Skip to content

Back to the catalog

Proton hosts map of 300k Flock devices amid legal threats
cyberinsider.comarticle

Proton hosts map of 300k Flock devices amid legal threats

Proton is hosting a public map of more than 300,000 Flock Safety surveillance devices (about 170,000 cameras and 130,000 other devices), built from an inventory researcher Joshua Michael obtained in November 2025 via an access token that could be fetched without login. Flock closed the path, later found anomalous token activity but no customer data impact, and sent Michael a cease-and-desist letter. The map is a December 2025 snapshot.

TL;DR Reports Proton mirroring a 300,000-device Flock camera map built from an unauthenticated token exposure, while Flock threatens the researcher with litigation.
Document

What it is

Proton is hosting a public map of more than 300,000 Flock Safety devices in the United States, about 170,000 cameras and over 130,000 other devices. The data comes from an inventory that researcher Joshua Michael took from Flock's own systems. Flock's automated license plate readers are used by police and private customers. They record plates, locations and timestamps for all passing vehicles, and vehicle characteristics can help identify cars without a readable plate.

How it works

In November 2025, Michael found that an access token could be obtained without logging in and used to retrieve device-location information. They reported it to Flock and archived the inventory in December 2025. Michael's website dates the release of their formal paper and map to 23 September 2026.

What to do

The page suggests using the map as a starting point for asking local authorities:

  • where cameras operate;
  • how long vehicle records are retained;
  • which agencies can access them;
  • how searches are audited.

Caveats

  • The map is a December 2025 snapshot. Later installations and removals are missing, so Proton's guidance is to treat it as a historical inventory, not a current picture.
  • Unlike crowdsourced projects such as DeFlock, it is built from company records rather than volunteer sightings.
  • Flock's account, per its customer notice, is that it closed the access path and at first found no unauthorized access. After further investigation in September it found anomalous activity involving the token, but its forensic review found no impact on customer data. Michael argues the first finding shows weak ability to detect access.
  • In a 25 September update, Michael said Flock sent a cease-and-desist letter threatening litigation and told customers it had notified law enforcement.
  • The page also cites a 404 Media report on a July bulletin from California's Orange County Intelligence Assessment Center. It told police to watch for suspicious behavior at city council meetings opposing Flock, while saying no specific, credible threats had been identified.

Organisations named here

  • 404 Media
  • cease-and-desist letter
  • DeFlock
  • Flock Safety
  • Joshua Michael
  • Orange County Intelligence Assessment Center
  • responsible disclosure

Technologies named here

  • DeFlock
  • Flock Safety
  • Proton

Techniques named here

  • Anomalous token activity review