Cyber Security Researcher, Joshua Michael, Shares His Research and Findings

Summary

Cybersecurity researcher Joshua Michael described his investigation of Flock Group, the company behind Flock’s license-plate readers, cameras, microphones, and related surveillance network. He said his research began after he reported vulnerabilities to the company in June of the previous year.

According to Michael, he reported four issues, including an exposed, hard-coded API key that could provide broad access to Flock systems and data, and later weaknesses that exposed source code and API tokens without authentication. He said Flock was slow to respond, pushed him toward a bug-bounty process involving an NDA, and confirmed fixing only the first vulnerability after he set a public-disclosure deadline. These accounts were presented by Michael and were not independently verified during the broadcast.

Michael said he compiled roughly 335,000 device and deployment records from Flock’s production environment and published an interactive map and research paper at FlockSurveillance.org. Host John Padfield explained that the map includes more than license-plate readers: it also shows Flock Raven microphones and cameras owned by private parties but connected to Flock’s network.

Michael said the records revealed a widespread surveillance footprint. Padfield highlighted the concentration of Raven microphones in parts of Indianapolis and raised concerns about how their audio capabilities might be used. Speculation about future speech monitoring was not established as a current capability.

Potential national-security impact

The main focus of Michael’s research paper was the potential national-security impact of combining broad surveillance coverage with weak access controls and monitoring. He said he spent eight months developing a route-analysis model covering 22 sensitive sites, including military facilities, federal offices, and defense contractors. The analysis estimated how often randomly generated routes from nearby residential areas could reach those sites without passing a Flock camera.

Michael cited examples including Eglin Air Force Base, where he said only about 8–9% of routes from a 20-mile radius avoided confirmed camera sightings, and FBI headquarters, where he reported zero such routes. He argued that movement patterns could reveal sensitive information about personnel, deployments, or routines—even without directly accessing footage. These figures and conclusions were presented as his research findings.

Michael and Padfield argued that the risks extend beyond ordinary privacy: surveillance data could potentially be used for espionage, stalking, blackmail, or targeting military personnel and public officials. They also discussed a Flock “safe list” or opt-out mechanism, which Padfield said had been acknowledged by Flock in communications to law enforcement. They questioned why some groups may be exempt from tracking if license-plate collection is not considered a privacy concern, and whether exemptions could complicate the completeness of evidence in criminal investigations.

Flock’s response and other topics

Michael said Flock had attempted to remove the website through takedown complaints and had sent him a cease-and-desist letter threatening litigation and possible criminal referral. He said the site includes disclaimers clarifying that it is not affiliated with Flock.

He also claimed that Flock told customers it had not detected the data export until after the site was published, which he viewed as evidence of inadequate monitoring. Padfield encouraged viewers to read and share the research with elected officials.

The discussion briefly touched on security certifications. Michael said Flock appeared to have certifications such as SOC 2, but argued that certifications can be misleading if their scope excludes exposed development systems. He also praised Proton for offering him support amid the legal dispute, and both speakers briefly discussed the privacy claims of mobile carrier Cape. These were secondary topics to the Flock investigation.

Presenters and contributors

• Dr. John Padfield — Host of Business Reform
• Joshua Michael — Cybersecurity researcher and guest