
Proton hosts map of 300k Flock devices amid legal threats
Proton is hosting a public map of more than 300,000 Flock Safety surveillance devices (about 170,000 cameras and 130,000 other devices), built from an inventory researcher Joshua Michael obtained in November 2025 via an access token that could be fetched without login. Flock closed the path, later found anomalous token activity but no customer data impact, and sent Michael a cease-and-desist letter. The map is a December 2025 snapshot.
What it is
Proton is hosting a public map of more than 300,000 Flock Safety devices in the United States, about 170,000 cameras and over 130,000 other devices. The data comes from an inventory that researcher Joshua Michael took from Flock's own systems. Flock's automated license plate readers are used by police and private customers. They record plates, locations and timestamps for all passing vehicles, and vehicle characteristics can help identify cars without a readable plate.
How it works
In November 2025, Michael found that an access token could be obtained without logging in and used to retrieve device-location information. They reported it to Flock and archived the inventory in December 2025. Michael's website dates the release of their formal paper and map to 23 September 2026.
What to do
The page suggests using the map as a starting point for asking local authorities:
- where cameras operate;
- how long vehicle records are retained;
- which agencies can access them;
- how searches are audited.
Caveats
- The map is a December 2025 snapshot. Later installations and removals are missing, so Proton's guidance is to treat it as a historical inventory, not a current picture.
- Unlike crowdsourced projects such as DeFlock, it is built from company records rather than volunteer sightings.
- Flock's account, per its customer notice, is that it closed the access path and at first found no unauthorized access. After further investigation in September it found anomalous activity involving the token, but its forensic review found no impact on customer data. Michael argues the first finding shows weak ability to detect access.
- In a 25 September update, Michael said Flock sent a cease-and-desist letter threatening litigation and told customers it had notified law enforcement.
- The page also cites a 404 Media report on a July bulletin from California's Orange County Intelligence Assessment Center. It told police to watch for suspicious behavior at city council meetings opposing Flock, while saying no specific, credible threats had been identified.
Organisations named here
- 404 Media
- cease-and-desist letter
- DeFlock
- Flock Safety
- Joshua Michael
- Orange County Intelligence Assessment Center
- responsible disclosure
Technologies named here
- DeFlock
- Flock Safety
- Proton
Techniques named here
- Anomalous token activity review
Related in AppSec
Flowise MCP Security Bypass Enables RCE
Inside an Oracle Database SQL Injection Attack | Huntress
OASIS
