# How Benn Jordan Discovered Flock's Cameras Were Left Streaming to the Internet
# 404 Media — https://www.youtube.com/watch?v=tSd0nXolnIs

[music]
Hello and welcome to the 404 media
podcast where we bring you unparalleled
access to hidden worlds both online and
IRL. 404 Media is a journalist owned
company and needs your support. To
subscribe, go to 404media.co.
Subscribers get bonus episodes and early
access to our interview series which
you're listening to right now. This
week, I'm talking to YouTuber Ben
Jordan, who has done some of my favorite
reporting on Flock, the automated
license plate reader surveillance
company. A couple months ago, he found
vulnerabilities in some of Flock's
license plate reader cameras. I've been
following Ben's work for a while, and
soon after that video came out, he
reached out to me to tell me that he had
learned that some of Flock's Condor
cameras were left live streaming to the
open internet. If you don't know, Flock
Condor cameras are video cameras that
are pan, tilt, zoom cameras, so they can
like go back and forth, zoom in. They're
not for license plates. They're actually
for tracking people. So, we learned that
some of those exposed cameras were
located in Bakersfield, California,
which is about a 2-hour drive from my
house. So, I went up there to film
myself on them. And before we get to my
interview with Ben, here's some footage
I took in Bakersfield that demonstrates
the problem we're about to talk about.
If you're listening on audio only, I
think this will still make sense, but
you can see the video on our YouTube.
Okay, so I've driven up to Bakersfield,
California from Los Angeles uh to check
out this Flock camera that Ben Jordan
uh Gain and myself found streaming
directly to the internet. Uh, it is a
Flock Condor camera, which is a newer
type of Flock camera that is designed to
track people as they walk by. This is an
addition to its automated license plate
reader systems. And so, this one is
stationed at Hughes Lane and Ming Avenue
in Bakersfield outside of a Big O Tires,
a Carl's Jr. Well, here's the Big O
tires.
Uh, a Carl's Jr.
and a Macy's. We have a Macy's mall.
And I don't know for sure, but I think
that the camera is probably owned by the
mall because the mall has automated
license plate readers at every entrance.
And this is stationed at a traffic
light. Um hopefully you can see it up
there uh on top of this traffic light.
We'll zoom in. And basically what we've
found is that this is streaming
unencrypted, totally insecure, no
password required directly to the
internet. Uh there's actually a panel
that you can go on there and you can see
not just the footage, which I believe
saves about 18 minutes at a time, but
you can sometimes see logs, you can
sometimes see the type of camera that it
is. And we found between 40 and 60 of
these live streaming throughout the
United States. We don't know if that's
the total number of them, but so far
we've seen them stationed at
playgrounds. We've seen them stationed
at malls. We've seen them stationed on
bike paths. Um I saw one like outside of
a skate park, a soccer field. And so I'm
going to go out there and walk my dog
who's here with me and I'm going to
record this camera recording me and then
I'm going to watch myself on the
internet because this is streaming
directly to the internet insecure. Uh we
can see people walking by. Uh some of
these cameras are so up close that we're
able to see people's faces. You can see
what they're doing. I saw people walking
their dogs. I saw people rollerblading.
Uh there was one that was like at a
Christmas fair. So yeah, we're going to
go check it out. So after doing that, I
published an article called Flock
exposed its AI powered cameras to the
internet. We tracked ourselves. And Ben
Jordan published a YouTube video called
this Flock camera leak is like Netflix
for stalkers. In a blog post after our
reporting, Flock said, quote, "The issue
involved a troubleshooting only debug
interface that was temporarily
accessible on the internet and quote,
the only content visible was live or
recorded video comparable to what can be
observed from a public roadway." It
added that quote, "No sensitive or
confidential information was accessed or
accessible." While recent thirdparty
coverage characterized the issue as more
extensive, this was an isolated
configuration issue and not indicative
of a broader or ongoing concern, we'll
let you make your own decision about
whether this data is sensitive based on
our reporting and what you're about to
hear. So, here's my interview with Ben
about how he found this, how he thinks
about Flock, and what comes next.
For people who don't know you, can you
tell me a little bit about yourself?
Like how you got into this? You know,
you have a big platform on YouTube, but
what do you what do you usually do?
Because you're not usually looking into
vlog cameras.
Uh yeah. So I mean I
my YouTube channel started out with like
kind of deep audio synthesis stuff and
then it kind of went into general
science and techy stuff oftentimes
related to acoustics or things like
that. Um and I live near Atlanta and we
have the highest concentration of
surveillance cameras in America and many
if not most of them are flat cameras.
Like I literally can't go to a grocery
store without passing a flock camera and
being tracked by it. And it just it it's
kind of the story you hear about from
anybody who's been proactive or uh I
guess active with the the surveillance
scene. It's like they they were asking
what are these black cameras? Like what
what are they doing? and then they find
out and then they find out more and you
just end up down the rabbit hole and you
kind of can't believe that this is
something that actually exists and you
can't believe how how much of a Fourth
Amendment violation it is. And so I
guess mine was was the same story except
that I have the I have a lab here and
the capability to actually test
something. So I started testing breaking
the AI models that are in pretty much
every single license plate reader. And
then yeah, and then the security
vulnerability stuff. I started learning
about that when I was making the first
video and it just [laughter] kind of
brought me down. And I'm probably a
little bit more attracted to this type
of thing or or maybe a little bit more
concerned about it because I I would
categorize myself as like a left
libertarian. Like I I truly do believe
that privacy is a human right and I
think that it is there at the very fiber
of our ability to live out our own
destiny. Like I think it's very
important to have privacy when you need
it. and this is the opposite of that.
So, it's it so maybe that's what gives
me more energy, you know, or makes me
more more likely to keep diving into the
same thing. And that's I guess that's
how I got here.
Did you have the same experience that
Joseph and I have had where you do a big
story about Flock or learn something
about how these cameras work and and
what they're doing and you publish it
and then like 500 other leads pop out.
Yeah. Uh yeah, [laughter]
because that's that's what's happened to
us and you know it's a very important
story and an important company and you
know it's been a very like important
part of our reporting but also
it's like it feels like it's almost
never ending because we've done a couple
stories and then it you know we'll hear
from an activist in Washington, we'll
hear from an activist in Texas like that
there so many people are are sort of
pushing back against this on a city
level. Um, but they're also like
creating so much data with their audit
logs and all of that sort of thing and
people are pulling it and they're
finding like really up things in
it and and so it's like, oh, you should
look into this, you should look into
that. And it's like we are, but also
there's not enough hours in the day to
do it because there's so much going on
with this company. It's so expansive at
this point.
Yeah. Um, I mean employees, flock
employees have reached out to me even
like I a lot of people have reached out
to me. Um, and people have reached out
to me about like similar things too I
think after making these videos some
which you know I'll probably tell you
about like they're actually notable
stories that are that are kind of crazy.
Yeah, it not only do I have leads,
[clears throat] I think another weird
side effect of making the content is it
gets repurposed onto Tik Tok and
Instagram where basically you just sort
of have it's like somebody watched my
video and then they they put their face
on it instead and they give a two-minute
version of the video, which I'm totally
okay with. Like I think any sort of
advocacy for this is great. Use my
content. I don't care. However, they're
getting details a little bit wrong just
because they're a little bit lazier
about it. like and uh that that's I I
could I I have a bone to pick with that
of course, but the bigger concern is
that this company's extremely ligious
and um kind of malicious in my opinion.
They're not messing around. And and I
think like in the next content I make
about this, I I'm definitely going to
mention that in hopes that some of these
people watch it and maybe pay a little
bit more attention because if you say
the wrong thing, they're going to take
advantage of that and and send you a
cease and desist or something much
worse. Yeah, we we've noticed the same
where um you know very happy that uh
people are sort of spreading our
reporting on Instagram, on YouTube, on
Tik Tok and a lot of people are doing
their own reporting but there's also a
lot of people who are not uh which is
fine because they're talking about it
and they're raising awareness about it
but but then they are getting some of
the details wrong and that feels bad
because some of those have gone like far
more viral than our uh work on it and
then it's like okay it's not it's not
the worst that that people are learning
about this, but they they are learning
sort of like a distorted version of it
sometimes and and that that worries me a
little bit.
Yeah. And it's frustrating when you're
sort of asked to respond to someone
else's [laughter] someone else's
reframing of your content, which is, you
know, that's another thing where you're
just kind of like, well, hold on. I
never said that. They said that. But
yeah, I mean, I just hope people are
more careful. And I mean a lot of people
have been kind of in flax crosshairs,
myself included. Um it's it's been a
very stressful year and you you would
think that the company would just like
you know hire a robust security team and
fix this stuff rather than just you know
attacking every single person who points
out the problem. But here we are.
Yeah. you know, you found at least 40 uh
of these flock condor cameras that are
streaming unencrypted to the internet
were streaming for at least days, maybe
weeks. Can you take me through a little
bit how you discovered this?
Yeah, I like I kept telling myself like,
"All right, I'm done with Flock. I have
so many other things to be doing. I I
genuinely have Flock fatigue from the
previous round of security
vulnerabilities and then the previous
round of like the video. I've already
made two videos and I never make more
than one video on on a topic. So yeah,
it randomly middle of the night I'm
searching on showdown which is kind of a
internet of things search engine and I
had known about the ports that some of
the cameras were using and they were
initially being used by the Falcon
cameras if if I if I remember correctly
and some of them were in saved searches
and I don't even remember the
methodology. I think I was just kind of
punching in numbers, procrastinating
going to sleep, and then I saw some some
come up and they they kind of matched
[snorts] it. The interesting thing is I
had definitely seen these models in the
past, but you see so many things when
when when you search stuff on Showdown
that a lot of times you don't really
want to click everything and then also
you're kind of worried. You don't want
to click something and then somebody
have your IP address, you have to start
your VPN, you know. So, a lot of times
you kind of get lazy and this time I
didn't. And so I I found some and then I
realized that just by searching flock
admin I could find even more and um and
different different set setups that were
in these cameras. And so uh I I think I
found probably 40 maybe around I didn't
really do a count um and at least 10
were active. Um I kind of stopped
counting at 10. I shared some of the
information with John um John Gaines
Gaines and uh he found even more. He he
updated the searches that for you know a
little bit smarter way to search cuz
he's more of an expert at this than I
am. Yeah. And and I mean immediately we
were just without any username, without
any password, we were just seeing
everything from playgrounds to parking
lots with people Christmas shopping and
unloading their stuff into cars. I mean,
it was it honestly we probably saw more
stuff that didn't have cars in it than
stuff that did.
Yeah. I mean, that's the thing that
really stood out to me is that um you
know, a lot of our reporting, almost all
of it has focused on Flock's ALPR
cameras. I know that's what your videos
have focused on so far. But this company
is building a huge surveillance
apparatus that is not just ALPRs. you
know, they have a drone program and now
they have these Condor cameras which are
specifically focused on tracking people
more or less. Um, you know, I watched
the webinar [clears throat] where they
uh showed this to cops and and you know,
they do talk about tracking cars as
well, um, to go along with their LPRs,
but you know, I I was able to see uh
these cameras tracking people walking
down a bike path, you know, walking down
the corner in front of a mall in
Bakersfield. And I I don't know, I just
I was so struck by how high- res it was
and how it was clearly tracking people.
And then also the kind of benality of
the places that they were stationed like
you know a bike path, random parking
lot, a playground. I I'm curious sort of
like what you thought when you saw this
stuff because I I know you were pretty
affected by it. Yeah. I I think it was
like the first time that I actually got
like immediately scared, you know, like
like like you see the next step right in
front of you, you know, like I all this
time I've been saying, you know, this is
a slippery slope. This might happen, you
know, and that was the first time I was
like, "Oh, it's it's it's here. This is
it. This is this is like the stuff that
I've been a conspiracy theorist about
for the last couple years, and now we
get to view it in real time." So that
bike path that you mentioned, I went
there um and I read Flock's statement
under a Flock camera with access to it
in real time. And but going down that
bike path is one of the most
uncomfortable dystopian things I've ever
experienced. It's these cameras, they
move around and make noise that you
could see them moving around and
following you. And it so it created this
this sort of rift with me where where
it's like okay so I'm I'm really angry
that this is here. I kind of hate the
city or you know for allowing it to
happen but like why is anybody dealing
with this like like if I live nearby I
wouldn't go on the bike path period.
Like I'd just be like this is creepy. I
don't want to be here. I again I don't
care who's watching me. It's just very
strange for these you know things to be
following you around while you're like
walking around. Um, yeah. I I think the
one that affected me the most was it was
a playground whi which is powerful.
Like, you know, seeing unattended kids
being watched from public view is like,
you know, I feel like that's one of the
most powerful things. And obviously that
was like something that I wanted to show
other people publicly so they could
understand how dangerous this is. And
there was one that just going through
this footage like collecting some of it
for reporting. Um, I just saw a guy sort
of walk out, um, old, you know, a guy
who's looked like he's about 30 years
old, walked out and just went on a swing
set and like looked around and then just
had a blast on it for 15 minutes and
then, you know, went back to work and
left the playground and and that one
weirdly felt I think that one affected
me the most because that it it showed
what a person does when they have an
expectation of privacy and like that
person had he known that anybody was
actively watching him. It It's doubt
it's doubtful that he would have enjoyed
himself in that moment. Like it was like
this moment of innocence and privacy
that I had access to that I didn't think
I should have access to.
Mhm. [snorts]
Yeah. I mean, for me, the the most
affecting things I mean, I thought the
playground was very harrowing. Honestly,
I I felt happy that there were not that
many people who went to that playground.
Like, you know, when I was looking at
it, there were just not there wasn't
that much going on there. But for me it
was the fact that it was uh you know
these are PTZ cameras or pan pan tilt
zoom cameras and they were following
people who were walking around like
people walking their dogs a person
rollerblading and the fact that it is
tracking you as though you may be a
criminal at some point was very
just very wild to me because I have seen
how Flock talks about this to cops um
and what they tell them is that We our
AI automatically tracks people so that
you can use this for evidence if you
need it at some point. And yeah, it's
just like Okay, but you're tracking
literally every single person who walks
by these things,
right?
Yeah. I mean, I suppose that's the big
difference is having everybody's
activity in a giant, you know, data set
or uh in a [clears throat] giant in, you
know, a giant data storage thing that's
being organized by AI versus having the
police have a suspect and getting a
warrant and then following them, which
requires man-hour. And and if somebody
is suspected of something frivolous
that's not worth those man-hour, then
they don't investigate them. in that way
and they don't track them. So, it it's
easy to see how quickly this gets out of
control. A couple years ago, I went to
uh University of Chicago to interview
some data scientists. Um it was their
sociology department and to interview
data scientists and the professor of
sociology there who had made this AI
crime prediction system that had a 90%
accuracy rate. And oddly enough, the
neighborhood that this AI model was
initially trained on happened to be the
neighborhood that I grew up in, which is
West Anglewood in Chicago, which is uh
Anglewood's one of the most violent
neighborhoods in America right now. And
so it was really interesting to find out
that they had never actually visited the
neighborhood that was only 15 minutes
away, yet we're spending years studying
all all the the data from it. But more
so, and more to my point is you very
quickly realize that if you have um you
know, [clears throat] if you have police
uh constantly monitoring one area,
you'll find crime there because crime
happens everywhere. And that doesn't
necessarily make anybody safer. It just
means that more crime is being detected
where more police are. So that was kind
of the that was kind of the vibe of it
is you were able to to find all this
crime, but in the neighborhood next to
it or maybe even a neighborhood that
that didn't have as many socioeconomic
issues, you you know, you weren't
finding crime that maybe you should have
found. And and I I see this in the exact
same flavor as that where it's like you
could put these cameras up and yes,
you're going to find more crime and then
you're going to have more people uh you
know being affected by by you know maybe
policies that weren't being enforced by
actual police officers.
I've been thinking a lot about my goals
for 2026. I want to eat a little
healthier, work out more, be a little
bit more social. And the funny thing
about goals is you usually need the
right people around you to make them
happen. A dietician, a trainer, maybe
even a therapist. It's hard to find
people who are so good at what they do.
It's like if you're hiring, how can you
find the best people for all the
different roles on your team? Well,
that's easy. Zip Recruiter. And right
now, you can try it for free at
ziprecruiter.com/44
media. Zip Recruiter's matching
technology works fast to help you find
top talent so you don't waste your time
or money sorting through the wrong
candidates. You'll find out right away
how many job seekers in your area are
actually qualified the role. Zip
Recruiter's matching technology works
fast to help you find top talent so you
don't waste time or money sorting
through the wrong candidates. You'll
find out right away how many job seekers
in your area are actually qualified for
your role, which will help you know if
you're searching for a needle in a hay
stack or a needle in a pile of shiny
needles. Let Zip Recruiter help you find
the best people for all your roles. Four
out of five employers who post on Zip
Recruiter get a quality candidate within
the first day. See for yourself. Go to
our exclusive web address right now to
try Ziprecruiter for free.
ziprecruiter.com/404media.
Again, that's ziprecruiter.com/404media.
Ziprecruiter, the smartest way to hire.
It's easy to assume that being small
means flying under the radar, but the
reality is that small businesses are
being targeted more and more by bad
actors. Cyber criminals know that lean
teams often lack the resources to
prevent or respond to a breach, and
security by obscurity doesn't work. In
short, the bad news is teams of any size
can be a target. But the good news is
even the smallest teams can foil cyber
crime. One password provides simple
security to help small teams manage the
number one risk that bad actors exploit,
weak passwords. One password provides
centralized management to make sure your
company's login secure. It's a simple
turnkey solution that can be rolled out
in hours whether you have dedicated IT
staff or not. One Password is designed
to meet small teams where they are, but
it's also built to grow with your
company. One Password's enterprise
password manager helps your company
eliminate security headaches and improve
security by identifying weak and
compromised passwords and replacing them
with strong, unique credentials. I've
been using one password for years to
protect my many, many accounts, and I
couldn't recommend them more. And I
can't really imagine trying to manage my
accounts without it. Take the first step
to better security by securing your
team's credentials. Find out more at
onepass.com/404
and start securing every login.
Now that the holidays are over, you
might be feeling like you've got big
spending hangover. The drinks, the
holiday food, the gifts, it all adds up.
Luckily, Mint Mobile is here to help you
cut back on overspending on wireless
this January with 50% off unlimited
premium wireless. Mint Mobile's end of
the year sale is still going on, but
only until the end of the month. Cutout
Wireless's bloated plans and unnecessary
monthly charges with 50% off 3, 6, or 12
month plans. All plans come with
high-speed data and unlimited talk and
text delivered on the nation's largest
5G network. Use your own phone with any
Mint mobile plan and bring your phone
number along with all your existing
contacts. With Mint, I've saved on
wireless without having to cut back on
other parts of my life. It's like a fake
sacrifice. None of the pain, all the
savings. My favorite kind of restraint.
This January, quit overspending on
wireless with 50% off unlimited premium
wireless. Plans start at $15 a month at
mintmobile.com/404media.
That's mintmobile.com/404media.
Limited time offer. Upfront payment of
$45 for 3 months, $90 for 6 months, or
$180 for 12-month plan required. That's
$15 a month equivalent. Taxes and fees
extra. Initial plan term only after 50
gigabytes may slow down when the network
is busy. Capable device required.
Availability, speed, and coverage
varies. cment.com.
Let's talk about the security aspect of
this just because um I don't know. It's
like you walk around, you drive around,
you see CCTV cameras, you see cameras
out there and so we are being recorded
all the time. I don't like it. Um, but I
I also don't generally think like this
is being live streamed somewhere. And if
it is being live streamed somewhere like
in a law enforcement context, I imagine
that it's going to the police and to no
one else. But what was happening here is
that literally anyone on the internet
could go and not only look at this
stuff, but also, you know, see the
settings, see some of the logs, change
some of the logs if you wanted to, which
we did not do.
Um, you know, what what does this say
about Flux Security?
I mean, so before I even had access to
look at a stream, um, I had access to
the administration page of the actual
camera itself and 31 days of data of
every single person who had walked in
front of that camera. I had the ability
to delete that stuff. I had access to
the logs. Um, even more problematic, you
can't really prove it, but I was finding
when I went up on the logs, I was
finding like parser errors in that
player from 45 minutes before I looked
at it. And this is before I shared it
with John or anything, meaning that
someone had watched it and had an issue
playing the video because like it
wouldn't just play a video on its own.
Um, now it doesn't seem to me like Flock
would sit around and watch their cameras
all day or something, especially, you
know, at a playground or something like
that, but it did make me wonder like,
okay, who else? Because these were
visible on on Showdown. So, like it is
it's not that far of a stretch to think
that there are a lot of people who have
already found this and just didn't
report it or you know maybe uh or were
scared to report it or possibly using it
for some sort of nefarious
use. Um yeah, I mean the security with
Flock I I don't know how it could really
be any worse to be honest. Like I can't
imagine it being worse. It was already
bad enough being able to poke the camera
a few times and connect to it as
[laughter] an access point and then
route it and you know it be being able
to control outside of the operating
system which is Android by the way. I
mean so it's like it
I I honestly can't think of any way
where it could be worse. Like
[clears throat]
at this point, if I if I were, you know,
working for the company in security or
something,
I mean, we're at the point where like
most cameras, in my opinion, need to be
replaced. They need to be replaced with
something that's not running Android.
they need to be replaced with a
proprietary operating system or
something that's more low-level because
there's no need to load all of the
libraries and things in the Android OS
just for something that that rereams and
catalogs um footage from a security
camera. And this is a $7 billion
company. Like there's no there's no
excuse why they they couldn't develop
something like this. That's a start. But
right now it's the it really feels to me
I would never say this in one of my
videos cuz this is very opinionated. But
it really feels to me like they are
aware that this is a huge mess and
they're just pushing on until they can
have an IPO and then they'll deal with
it once the stock market is invested in
it and we'll have to you know pay the
damages.
Yeah. I mean it struck me that uh you
know you and John Gaines um
found all of these CVEes like you know
made a video got quite a lot of
attention on it um because the things
that you found were frankly insane and
then here it's just a few weeks later
and this is like an entirely different
class of vulnerability and exposure on
totally different cameras and and it it
feels to me like like it's new and
interesting ways of of being uh
insecure.
Yeah. Long before this when I was making
the the security the flock security
video. Um it was almost like a
catchphrase where I'd say like I don't
see how it could get any worse and and
then something would happen where you'd
be like, "Wow, they they pulled it off.
They made it worse." And you know, that
happened like three or four times. Um
and then this was like the ultimate one
because again, yeah, like you said, this
is completely unrelated. Um, and it's
it's exactly what has been promised
would never. I mean, there are so many
quotes. I mean, right off the bat, the
company says that it doesn't collect
data of people that that it only
collects license plates. Like, that's
right on their fact. It says that all
data is encrypted. You can see now that
that is a flatout lie. Like that is that
like, you know, that's not even a
misunderstanding of what's happening.
They're just lying at this point. Well,
I mean, if it's encrypted, but you give
people the endpoint,
it's functionally not encrypted. Who
cares? Like, it doesn't matter. Yeah.
Yeah. And so, it's it's just
mindboggling at this point. But, um
Yeah. No, I I honestly felt a little I
felt a little bit bad. I I hadn't hit up
John about anything flock related for a
few weeks because two days after the
video came out, he lost his job. Um, and
and it wasn't it didn't make any sense
to me, you know, it wasn't like he
hadn't been showing up to work or it's
not like, you know, a company that was
downsizing. Like he he was a val he
seemed like a valued high up member of a
security team that just randomly got got
canned 2 days after the video came out.
And he probably won't speak speak about
this just for, you know, his own, but
you know, I could have my own opinions,
but I think it's pretty easy for the
average person to figure out, yeah,
these two things are probably connected.
So, I I actually didn't reach out to him
about anything flock related. Just kind
of kept things friendly because I felt
bad. I felt terrible. Like I was like,
"Wow, if I didn't release this video,
he'd still have a job." And but when I
found this, I was just like, "Okay, you
got to see this." And he he immediately,
you know, fell down the rabbit hole,
too, as did you. And, you know, it it is
one of the most astonishing security
vulnerabilities.
Yeah. I mean, it was um the the cameras
that you went and saw are were closer
up. Like the ones that I I saw were
pretty far back. Uh you know, like very
very wide shots. But there was something
pretty
like I'm I had to drive two hours to go
see these cameras. And
I was surprised by how much it affected
me even though I knew exactly like what
I was doing. But I was like, "Oh, I took
my dog. I was walking my dog." Uh, and
I'm like I'm watching I'm recording
myself being recorded and I'm watching
myself back in real time as I'm doing
this like on the open internet.
Yeah.
In a way that it shouldn't be. And I was
kind of surprised by how much it
affected me. You knew what you were
getting into, but was it weird uh seeing
yourself on these cameras like that you
had been watching on the internet uh you
know days before?
Yeah. Uh I've always sort of called that
closing the loop. It's like when you
when you you know you know something
exists. You you your your logic lets you
know that you know you have an instinct
that something exists. You you logically
believe it exists but then you see it
and and when you see it you it's like
then you actually you feel the full
weight of the whole thing. It was kind
of funny because I was recording a you
know I was reading flocks statements
contradicting exactly what you would be
seeing with your own eyes watching me
read it and uh random people on the
trail were just kind of like hey uh
what's going on cuz you know then I
realized how crazy I was talking into a
security camera into a microphone that
had a little recorder on it. Yeah. And I
and I just told them I'm like, "Oh, no.
I have access to this." And I just
showed them my phone and they were like,
"Oh my god, what?" Yeah. And I mean,
they were they were blown away by it.
So, I guess more to your point, it's one
of those things where it's like I always
tell people things like this. I always
tell people like, "Yeah, this is this is
a really bad security vulnerability, but
that closes the loop." And once, you
know, once they saw their image on the
phone in real time, uh, that I think,
you know, probably not likely that
they're going to be going on that trail
again.
Yeah.
For me, it just it really shows kind of
the like holistic nature of the
surveillance. It it like adds a lot to
sort of what I thought of Flock as a
company. Not not not giving them too
much power here, but like I had largely
thought of them as an ALPR company. Uh
yeah.
And sort of seeing
like the the cameras that I saw, there
was a bunch of Falcon cameras right near
it. the ALPR cameras near it and and it
just I was like, "No, this is like a
holistic like
surveillance state situation and and
just also seeing that the exposures were
not just in California, like we saw some
in New York, we saw some in Louisiana,
you know, various in Georgia, you know,
it really is. It's like it's all over
the place. And you could click one link
and be in, you know, Bakersfield, you
click another link and be in suburban
Atlanta, like They're all over the
place.
Yeah. I guess like seeing the scope of
it, I I guess I just keep asking myself
or I I mean I I want to ask my my the
people who watch my platform as well
like what's it going to take? Like what
is it going to take? So now that we
could see children unattended on at
playgrounds and we could see women
jogging alone on a forest trail and we
could see people uh buying, you know, a
bunch of expensive Christmas gifts and
loading it into their van in a in a the
shopping a retailer's parking lot. Uh
what's it going to take for somebody to
stand up to this? Well, like what's it
going to take for Lowe's to say, "Yeah,
you got to get these out of the parking
lot. This is this is endangering our
customers and making us liable." Like,
the answer I don't want to hear is it's
going to take a child getting abducted
or a woman being assaulted. Like, I
don't want to hear that because I don't
think that that's necessary at all. I
think we could see the risk right here
of uh like if I'm finding this stuff.
I guess an interesting thing to say here
is that if if you see a security
vulnerability on my video or if you hear
about it generally in the press,
anything like that, chances are that
things are a lot worse because I can
only tell you that about things that I
can legally access. But if I didn't
intend on telling you that, then I would
try to obiscate my research so I didn't
get caught and I would be using more
backdoor things. So basically, I am
limited by the law to only use the
search engine and click on things, you
know, and then find them and then show
them to you. But if I actually go into
that log and take that hash information
or um you know do an audit of of the
system that's running the software on
there like you could do all those things
and you can find a whole lot more but I
just can't report on it and most people
can't due to the crazy computer crime
laws that we have in this country.
Yeah. I mean also you know you do really
great work but um
it's like showdown isn't magic. It's
like people know about Showdan. Uh, you
know, hackers know about it. Bad actors
know about it. A lot of security
researchers obviously obviously know
about it. It's like if you were able to
find this, like who knows how many
people were able to find it.
Yeah. And if it's on Showdown, that
doesn't mean it's only on Showdown, you
know? Like somebody could pro could have
used Duck. Go and possibly found the
exact same thing. Like it just depends
if the web crawler had reached it or
not. Showdan mostly just prioritizes
things. Like it just filters out other
stuff. But with enough dorking, I mean,
yeah, we we found all that uh in the
last video I did, we found Joshua
Michael, he found a bunch of uh GPS
location data of police cars and things
like that um just off Google just from
doing Google Dorking. So yeah, I mean
it's it's it would be unlikely for me to
think that nobody else had found this.
Um in fact, you know what? I did get an
email from somebody who after I had
already told the group about this, I got
an email from somebody notifying me that
they had found a similar camera on a
from a web search engine. I mean, we're
we're in a world right now where we're
like banning Tik Tok and DJI because
we're concerned about national security
and surveillance of Americans, yet this
is allowed, which you know that I feel
like somebody needs to pay attention to
that.
Thanks so much for listening. You can
watch Ben's videos on YouTube at
Benjordan. Ben is [music] with two N's.
And you can find more of our reporting
about Flock at 404media.co.
[music] As a reminder, 404 Media is a
journalist owned company and needs your
support. You can subscribe to us at
404media.co.
This episode was created in partnership
with Kaleidoscope and was produced and
edited by Alyssa Midaf. We'll be back
with a new episode soon.