Why Does DeFlock Tulsa Exist?

Cybersecurity Problems at Flock

The cameras themselves have been shown to be vulnerable to hackers. We aren't talking sophisticated attacks either. Cameras are easily taken over by anyone with physical access and knowledge of the button combinations required.[1] The cameras are also vulnerable to more sophisticated attacks, such as plugging in a low cost USB tool that can take over the device in seconds. The cameras have easily accessed USB ports making this fairly easy for someone with the time and forethought.[1] The cameras store around 30 days of raw recordings on the internal storage of the camera. [1] Using various means, an attacker can easily gain access to the recordings, view them, delete them, and alter them. It should be noted that Flock's cameras take photos when any movement is detected, not just vehicle movements or license plates. [1] This means that hackers have access to much more information than simple license plate data.

The software on the cameras is running in debug mode. This means that an attacker can modify running code, change memory contents, and hide traces of their activity much easier. Flock Safety ALPRs have been shown to be running Android 8.1.0.[1] This version of Android has not received security updates since 2021. Using an operating system this out of date would automatically be a compliance violation for many types of organizations, such as a doctor's office or hospital. There are many, many known high severity security vulnerabilties in this version of Android and they are no longer being fixed.

Flock has also misconfigured their own devices and left them open for anyone to access. Recently, 404 Media and Benn Jordan found dozens of open Flock Condor cameras. These cameras are different from the LPR types in Joplin in that they actually are intended to record people. The AI on them locks onto, zooms in, and follows people while recording. Benn and the journalists at 404 were actually able to use footage of themselves from Flock's cameras in their reporting on the issue. At least one of the cameras they found was pointed at a playground for children. [2][3]

Flock also failed to enforce multi-factor authentication for at least some time. This is like when you log in with your bank and they text you a code to make sure its you. According to TechCrunch.com, this allowed Flock logins to be sold on Russian hacking forums. [4] I could talk about these types of issues with Flock for quite a while, but the point is that the devices themselves are not secure and Flock is not taking care when building them or installing them. Flock is also a central repository for massive amounts of very sensitive data, which makes them a target for cybercriminals.

Abuses and Mistakes

As I researched all of these security problems, I began running across other news regarding Flock, rarely good.

Braselton, GA - According to AccessWDUN.com, the police chief was arrested for using his access to stalk and harass a woman. Unfortunately, a judge failed to grant her a temporary order of protection despite showing credible evidence of this behavior months before he was arrested.[5]

Sedgwick, KS - According to kansas.com a police chief was found to be using the cameras to track his ex-girlfriend and her new boyfriend.[6]

Redmond, WA - According to king5.com, the police arrested a man based on the fact that his son had an arrest warrant. He drove by a Flock camera, police were alerted it was related to his son, and they apprehended the father driving the vehicle. The vehicle was registered in the father's name. The man was injured during the arrest and he is now afraid to drive near Flock's cameras. The city has paused its cameras.[7]

Columbine Valley, CO - According to CBSNews.com, a woman was confronted at her home by police and accused of stealing. The officer refused to view footage from her video equipped Rivian vehicle. She was forced to prove her innocence over the course of weeks. At the end of the ordeal, the police chief emailed her letting her know the summons would not be filed and said "nicely done btw."[8]

Aurora, CO - According to APnews.com, a woman and her four girls were detained face down at gunpoint on hot concrete because police were alerted by Flock to her vehicle. The plate flock alerted on was for a stolen Montana Motorcycle. The woman was driving a Dodge van. She was paid $1.9 million.[9] Aurora's taxpayers are stuck with the bill, not Flock. In fact, Flock claims complete indemnity for any mistakes made as a result of use of their system. All of these abuses and mistakes are even more concerning now that Flock is going to be using its AI to report suspicious driving patterns to police according to a report by the ACLU.[10]

Bringing it Home

I became very concerned upon learning all of this and began to look into Joplin's relationship with Flock. I knew we had some cameras from the Deflock map, and I had actually seen some of them too. I couldn't find anyone talking about these cameras locally. I couldn't find a news story, I couldn't find a policy for using Flock, and I couldn't find City Council approval either. I realized that if I wanted to learn more, I was going to have to dig in. I learned that audit logs from other cities often contain data from your own, so I downloaded a set of logs, extracted Joplin's activity, grabbed a friend, and we got to work. I filed records requests with Joplin, and then also nearby cities.

Update 1/8/2026: What I couldn't share in this post before is that we already had evidence of an officer abusing this system. This motivated me significantly. We filed our first records request fully expecting the City to stonewall us, and they did. The fields they denied us would have prevented this accountability from being able to take place at all.