Flock Safety’s technology plays a vital role in helping law enforcement respond to crimes they might not otherwise detect — from identifying unreported gunfire to capturing sideshow stunt activity. Our license plate reader (LPR) and gunshot detection systems are deployed in hundreds of communities across the country, accelerating investigations and ultimately saving lives. 

To deliver on our mission, we hold our deep commitment to data integrity and security to the utmost importance. Flock’s security program reflects a thoughtful investment in people, partnerships, and process. Beyond our internal team, we actively collaborate with private and public sector partners to stay ahead of emerging threats, coordinating with agencies such as CISA and with law enforcement partners to align on best practices and threat intelligence. 

Flock has recently been alerted to a limited security exposure, and we’re addressing it with the urgency and transparency our customers deserve.

‍

How Data Transmission from Flock Sensors Work In Practice

Flock’s LPR camera and gunshot detection system is made up of individual sensors connected to each other and to the cloud through cellular networks. LPR cameras record still images of vehicles when triggered by motion. When a gunshot, firework, or audio event indicative of a sideshow stunt (like tires screeching or glass breaking) is detected, our gunshot detection devices record a three-second audio clip to be preserved as evidence. 

Images, audio and associated metadata are encrypted and transmitted to the cloud through Transport Layer Security (TLS) encryption. The data is then stored encrypted in the cloud for 30 days so it can be accessed if it needs to be used as evidence in a case. On the device, images and audio are regularly deleted. The gunshot detection device cannot hold more than 50 seconds of audio. 

‍

Ongoing Security Reinforcements 

Flock’s security team was recently alerted about limited, localized security vulnerabilities on our license plate readers and gunshot detection devices. As responsible stewards of customer data, upon notification we analyzed the impact of these vulnerabilities and subsequently have made the following submissions to Mitre for inclusion in the National Vulnerability Database.

• Debug interface enabled (CWE-1191)
• Hardcoded credentials (CWE-798, CWE-259)
• Hardcoded connection details ( CWE-798, CWE-259)
• Clear Text Storage of Code (CWE-312)

These are not material vulnerabilities, and both severity and likelihood to be exploited are low. The exploitation of these vulnerabilities require physical access to a device and knowledge of device debugging. If a person was able to gain physical access to the device (which is typically placed on a pole several feet above normal height), they would still not be able to gain access to footage, as the data is only stored for a very limited time duration on the device following its transmission to the cloud.

None of these vulnerabilities affect our cloud platform, where the vast majority of all evidence and metadata is stored. Flock secures data in accordance with industry requirements, including encryption using AES-256, as validated by the company’s ISO 27001 compliance certification. 

We have not at this time determined a need to remediate devices currently deployed. Flock will address these vulnerabilities through a combination of Over the Air Updates and improved factory settings for new devices starting today, in Q2 2025.

‍

Our Commitment to Security and to You

At Flock Safety, the security of your data remains our utmost priority. We understand the trust you place in us to provide the evidence you need to keep your community safe, and that requires our relentless commitment to keeping your data safe. We are extremely confident that our gunshot detection and license plate reader devices are not only secure, but the best-in-class product on the market to help you protect your city and save lives. 

Should you have any concerns or questions please don't hesitate to contact securityquestions@flocksafety.com.