Surveillance Expert: "I'll Go to Jail for This!" The Hacker Exposing America's Secret Spy Network

In December 2025, cybersecurity researcher Joshua Michael quietly pulled the location data for every single Flock Safety device in the United States—hundreds of thousands of cameras, gateways, and sensors—by exploiting a vulnerability he had already reported to the company months earlier. He made millions of requests in minutes, exported the data, and never told Flock he had done it. Since then, Flock's CEO has publicly stated three times that the company has never been hacked. Michael is now preparing to release the full dataset and his research publicly. He expects to go to jail for it.

The Cameras Are Not Just License Plate Readers

Flock Safety markets its devices as AI-powered license plate readers (LPRs), a friendly label that helped the company get cameras installed in municipalities, private communities, and businesses starting around 2017. But as Michael explains, the company's own patent describes a "dynamic surveillance network" that classifies not just license plates but also people, vehicles, animals, and bikes. The cameras can search for anything in their field of view using a feature Flock calls "freeform"—an officer could type "cowboy hat and a Ford F150" and the system would track matching individuals across every camera the department has access to, nationwide.