Joshua Michael, a cybersecurity researcher and founder of privacy firm Nexonet, hacked Flock Safety’s surveillance network four times to expose systemic security failures in what he describes as the largest dynamic surveillance network in the United States, comprising over 280,000 cameras across 5,000 police departments, 6,000 private communities, and 1,000 businesses, with data on nearly every American’s movements retained for up to five years.
Flock Safety’s Surveillance Network and Capabilities
Flock markets its cameras as “automated license plate readers” (LPRs) to municipalities and police departments, but their patent describes a “dynamic surveillance network” using AI to classify and search people, vehicles, animals, and bikes across a nationwide camera network.
The cameras collect far more than license plates: vehicle make, model, color, roof racks, stickers; for people, race, height, gender, weight, clothing, and even signs held; all searchable via “free form” AI queries like “cowboy hat and Ford F-150” or “wash me on dirty car.”
Flock Nova, their “person intelligence platform,” combines license plate data with mobile advertising IDs, financial records (oil changes, tire repairs), data broker profiles, and breach data to build comprehensive dossiers: usernames, emails, phone numbers, addresses, associates, and behavioral predictions (pregnancy, vehicle preferences, etc.).
Wing Gateways let businesses plug existing IP cameras (gas stations, schools, stores) into Flock’s network, turning any camera into a Flock node; Aerodome drones (400+ deployed) sit on rooftops and deploy automatically on alerts to track individuals from 400 feet.
Average person passes 3.2 Flock cameras daily; network scans 20 billion license plates monthly despite only 160 million commuters; data retention defaults to 30 days but packages extend to 5 years, and factory test images were found on cameras suggesting deletion claims are unreliable.
Joshua’s Four Hacks and Flock’s Response
First hack (June 2024, from France): Found a hardcoded ArcGIS API key on a public Flock subdomain — a “default API key for the system” granting access to all 5,000 police departments’ live officer locations, 911 call transcripts, vehicle detections, and 50+ private data layers; key was hardcoded 53 times across the codebase.
Second hack (November 2024): Flock authenticated at the wrong layer on development subdomains, serving full client-side source code before login, exposing backend architecture, camera management, hot lists, and search functionality across all dev subdomains.
Third hack (November 2024): planner.flocksafety.com and dev-planner.flocksafety.com served fresh API tokens without authentication, granting access to every device location nationwide; development and production environments were mixed, violating basic security practice.
Fourth hack (December 2024): Same authentication flaw on Flock Nova (person intelligence platform), exposing source code for the people-search tool; Flock took the site down but never acknowledged the report.
Flock ignored or delayed responses to all four reports, offered five-figure bug bounties with NDAs (which Joshua refused), and publicly claimed three times (January, March, June/July 2025) they had “never been hacked” and “no cloud platform has ever been breached.”
On December 14, 2024, Joshua exfiltrated every device location nationwide (millions of data points) via the planner API to test detection; Flock never detected it, yet continued claiming zero breaches — implying either they knew and lied, or their monitoring is nonexistent.
National Security and Privacy Implications
Flock’s poor security (no mandatory 2FA, dev/prod mixing, hardcoded keys) makes the “heartbeat of the nation” vulnerable to foreign intelligence; Joshua’s blog received traffic from North Korea’s sole internet egress node days after publishing the API key research.
Police access is nationwide by default: officers in LA can search Florida cameras; auto-accept and auto-discovery features let departments join networks without oversight; ICE used Flock searches for deportations, prompting some cities to restrict access.
Warrantless tracking via mobile advertising IDs (MAIDs): Flock Nova pulls MAIDs from apps (weather, Uber, Snapchat) to geolocate individuals persistently; Garrett Langley falsely claimed warrants are required while his product enables warrantless tracking.
Predictive policing and surveillance pricing: advertisers and insurers buy location/behavioral data to adjust prices (Uber charges more when battery low; CVS/Walgreens coolers use facial emotion detection); political campaigns buy location data to suppress turnout rather than persuade voters.
Flock cameras inside prisons, prison showers, schools (locker rooms, wrestling rooms, girls’ bathrooms), sexual assault centers — creating intimate surveillance with no governance; officers can add anyone to “hot lists” without warrants or case numbers, just a dropdown reason.
Joshua’s Reachability Analysis and Intelligence Findings
Analyzed 22 military/defense sites (plus FBI HQ): measured what percentage of personnel within 20-mile radius could reach base gates without Flock detection; Eglin AFB: 8% undetected; FBI HQ: 0% undetected from any starting point.
Intelligence value: pattern-of-life analysis reveals covert operations — if a SEAL team and their French translator disappear simultaneously for 4 days, likely a Sahel region mission; no top-secret clearance needed, just camera access.
Comparable to US/UK compromising Iranian traffic networks to track leaders; Flock creates a domestic equivalent for any actor with access.
Joshua’s Motivation and Personal Risk
Started social media anonymously (face blurred in Ben Jordan video) as a “dead man switch” — feared assassination by an $8.5B valuation company protecting quarterly profits built on Fourth Amendment violations; three separate warnings implied “sign NDA or die.”
Close friend Dr. John Padfield asked “are you physically safe?” and offered shelter — realized hiding was insufficient; went public to force accountability.
Holds Epstein file correlations as insurance; believes Palantir (Peter Thiel-backed) functions as “new Epstein” — centralized data silo enabling blackmail via Flock-style tracking of politicians’ movements.
Plans to publish full device location database and research shortly after this podcast; expects arrest under CFAA but argues public interest defense: “not sharing it would be the least patriotic thing I could imagine.”
Digital Disappearance and Privacy Practices
Nexonet helps executives, politicians, celebrities digitally disappear: removes data from brokers, facial recognition databases, job sites, breach repositories; Data Minimal offers $30 consumer version.
Core advice: lie on the internet (no gain from truth); use LLC/trust for vehicle registration; long passcodes (40+ chars) over Face ID (can be compelled at borders); KeePassXC locally or Bitwarden/Proton Pass for passwords; Mullvad or Proton VPN (cash payment, no logs, RAM-only).
Data brokers: Axiom (axiom.com) sells 90-page profiles; LexisNexis, Experian, TLO are “digital colonoscopies” nearly impossible to scrub; breaches are permanent — once leaked, identifiers persist forever across breach sites.
Most breaches today are social engineering (Scattered Spiders: kids calling help desks), not technical exploits; nation-state APTs keep breaches secret for intelligence.
Broader Surveillance Landscape
Cars spy via OnStar, tire pressure sensors, Bluetooth/Wi-Fi sniffing (Signal Trace/Leonardo fingerprints); GM/Kia caught selling location/immigration data to insurers; Ford patent (effective 2027) mandates biometric/facial recognition for impairment detection, including back-seat passengers, with remote disable capability.
Alexa/indoor devices are “spies” — NSA historically turned TV speakers into microphones; short-form media (Reels/Shorts/TikTok) creates “intellectual obesity with thought poverty” — algorithmic mind control via emotional manipulation, foreign propaganda, and polarization.
Social credit exists de facto: credit scores, advertising profiles, predictive policing (crime likelihood from genetics/family/data); hiring algorithms use phone battery habits, charge cycles.
One-world-order conspiracy: religious/tribal identities unite elites across borders; DEI is “racism with favor”; 80 years of propaganda cannot undo tribal biology; eschatology drives some groups’ end-times actions.
Final Messages
“Still time for change. It’s never too late.” — engage locally (city council), not just national outrage; restoration via law/juries/prosecution of treason, not revolution.
Joshua: “Throughout this entire podcast, I was not guided by money and I was genuinely extremely curious.” Hopes jail time becomes political authenticity for independent run.
Best advice (from grandfather): “Always be curious about things and question them, but don’t go crazy… question things but don’t drive yourself mad doing it.”
