Every time your car passes a roadside camera, it may belong to Flock Safety, a company that has publicly described operating more than 120,000 license-plate-reader cameras nationwide. A researcher’s new map suggests the broader infrastructure is considerably larger, and a Senate subcommittee is pressing for answers.
Cybersecurity researcher Joshua Michael published a map identifying approximately 300,000 Flock-associated devices across the United States, according to The Intercept. The two figures are not directly equivalent: Flock counts cameras, while Michael’s inventory includes more than 170,000 cameras plus roughly 130,000 supporting devices, such as acoustic sensors, processing units, networking hardware, and equipment linking third-party cameras.
How the Map Was Built
A snapshot of Flock’s own mapping data became the foundation for a public device inventory the company is now trying to suppress.
Michael says he discovered an unauthenticated access-token exposure in Flock’s infrastructure in November 2025 and notified the company. He then used the token to query ArcGIS, a third-party mapping service Flock uses, according to Tom’s Hardware.
He preserved a December 2025 snapshot of the location data and later verified portions of the map by visiting several sites in person. The map labels individual devices, sometimes with addresses and other identifying information.
Among the labeled entries is one tagged “FBI Pilot Camera” at the J. Edgar Hoover Building, FBI headquarters in Washington, D.C., according to The Intercept. That label reflects a database entry in Michael’s map, not a confirmation from the FBI of any operational relationship with Flock.
Michael has warned that a network this size could expose movement patterns of federal agents, elected officials, and military personnel. That warning is a risk assessment attributed to Michael, not evidence that any foreign actor has accessed Flock’s systems.
Flock’s Position and the Terminology Dispute
The company says no breach occurred; the researcher says data from Flock’s own infrastructure built the map.
Flock stated in a January 2026 blog post that it has never experienced a data breach and that customer data has not been compromised. The company characterized prior disclosures as vulnerabilities that did not result in customer-data exfiltration.
Michael’s account differs. He says the map was built from location information accessible through Flock’s mapping infrastructure, an exposure the company has not publicly detailed in full. Whether an exposed infrastructure record constitutes a breach of customer data is contested between the two parties and remains unresolved.
Senate Scrutiny and Takedown Pressure
Executives skipped a Senate hearing the day before the map drew wide attention, and Flock has since sought to have it removed.
The Senate Judiciary Subcommittee on Crime and Counterterrorism held a hearing titled “Always Watching: Flock’s Nationwide AI Surveillance Network” on September 23, 2026. Flock CEO Garrett Langley, along with executives from Axon, Motorola Solutions, and Verkada, were invited but did not appear, according to CNBC.
Senators and civil-liberties advocates raised questions about data retention periods, interagency sharing, and whether vehicle searches require warrants. Flock has separately sought to have Michael’s map removed. A trademark complaint from another surveillance app arrived shortly after the hearing, though available reporting does not establish that Flock filed it.
A takedown demand does not by itself establish that a map is inaccurate or unlawful; those questions would require independent legal and technical evaluation.
What Remains Unanswered
The core dispute is not about which number is right, but about what the public can actually know.
The more pressing question is whether the public, elected officials, or the courts have any clear accounting of what this infrastructure collects, which agencies can search it, and how long records are kept. Those questions remained unresolved after the September 23 hearing, where Flock’s executives were absent and offered no testimony.
