Full transcript
A few weeks ago, using a commercial
search engine, I very easily found the
administration interfaces for dozens of
Flock Safety cameras. I shared this
information with 404 Media, and with
John Gain's help, that number quickly
grew to nearly 70. None of the data or
video footage was encrypted. There was
no username or password required. These
were all completely public-facing for
the [music] world to see, and some of
them still are. You don't have to be an
expert to find and gain access [music]
to this. You don't even have to type
anything in to see every single person,
vehicle, and activity that took place in
these locations in the last 31 [music]
days. Whether you wanted to watch this
footage live in real-time or look at
footage from a month ago, you could just
point and click your way to it like you
were watching Netflix. You could even
open up the live streams in VLC or cast
it to a television. Making any
modification to the cameras is illegal,
so I didn't do this, but I had the
ability to delete any [music] of the
video footage or evidence by simply
pressing a button. I could see the paths
where all of the evidence files were
located on the file system, and I could
see their hashes and signatures. Some of
the devices we saw were the
familiar-looking Falcon cameras that you
see all over the country, but the
majority of these were Flock's new
Condor [music] cameras, which are
designed to detect and track people.
They're PTZ cameras, meaning pan, tilt,
zoom, and they quite literally use AI to
zoom in and follow you around whether
you're a person of interest or not. In
just the time that [music] it took to
count and verify these vulnerabilities,
I saw a family in North Carolina lose
their infant and a bunch [music] of
merchandise in a Lowe's parking lot. And
I suppose one could cross-reference
their license plate with the ParkMobile
data breach and find out [music] exactly
where the garage is that will store
these new fancy tools. I watched a man
leave his house in the morning in New
York. I watched [music] a woman jogging
alone on a forest trail in Georgia. This
trail had multiple cameras, and I could
watch a man rollerblade and then take a
break to watch rollerblading videos on
his phone.
How? Because the camera's AI
automatically zoomed in on it. Just like
it zoomed in on a couple arguing at a
street market in Atlanta. So what?
They're still anonymous, right? No,
they're not. Within 2 minutes of
open-source intelligence using a
commercial facial recognition engine,
[music] I found out that one of them
just finished medical school, and the
other is dealing with chronic irritable
bowel syndrome. The couple also just had
a baby last year, and they have a pretty
concerning debt-to-income ratio. I also
know that they drove over 45 minutes
from their address in the suburbs to
attend [music] church in Atlanta that
morning, and then they checked out this
market and bought a sweater. I watched a
law enforcement officer and ambulance
escort a man having a mental health
crisis in Iowa. I know this because the
Cedar Rapids [music] Police Department
maintains a public database of every
single emergency call in the city, as
well as daily arrest reports [music]
with individuals' names, addresses,
ages, and genders. Listen, I know that
I'm being creepy right now. Just saying
these words out loud nauseates me, but
I'm trying to show you just a fraction
of the information that anyone in the
world with access to a commercial search
engine has had regarding anyone who
attended this market or walked on this
trail in the last 31 days. And it gets
worse. Here's an exposed Flock Safety
camera permanently pointed at a
playground near the Bay Area in
California, openly and publicly
broadcasting both live and archived
video footage of young children [music]
playing unattended.
Again, just saying this stuff out loud
feels so incredibly wrong. But for me
personally, the most impactful moment
while validating these vulnerabilities
was this.
[music]
This resonated with me so much that I
actually had tears welling up in my
eyes. I've [music] done this exact same
thing so many times. I've seen a swing
set in an empty park, looked around to
make sure nobody was watching, and
[music] then just enjoyed the mindless
motion that connected me to a simpler
time. But this isn't something that most
grown men want to be seen doing. The
experience [music]
requires one to have a moment that is
devoid of judgement. It's healthy
escapism at its finest, [music] and I
realized that it's likely that this man
didn't know that he was being recorded,
and he probably wouldn't have done this
[music] if he had. This is a classic
example of the Hawthorne effect, which
is a change in an individual's behavior
or choices when they know that they're
being observed. Surveillance
manufacturers love to talk about this
effect when it deters crime. After all,
someone isn't as likely to break [music]
into a car that's parked near a camera.
But what they don't talk about is how it
deters escapism. [music] People are less
likely to sing or dance or practice an
accent or a cartwheel when they know
that they're being watched. [music] But
escapism is often required for a lot of
things. For example, when you learn an
instrument or practice a skill for the
first time, or [music] even practicing
line delivery for a YouTube video. The
footage of the man swinging was powerful
[music] to me because it made me realize
exactly why I have such a visceral
objection [music] to mass surveillance.
It imposes on our right to find our own
identities without judgement. And as
someone whose identity and success is
owed to ample amounts [music] of
escapism, this is a hill that I am
willing to die on.
I don't have the luxury to dedicate even
more months to yet another Flock Safety
vulnerability, but as you can see, this
one is urgent. And frankly, I'm worried
that it's already being exploited at the
cost of the individuals who are unaware
that there are even cameras in these
locations. So I got in touch with 404
Media, who has been paramount in this
same field of journalism, and whose
reporting has tremendously helped my
research and content.
Together with YouTuber Ben Jordan, we
found about 60 [music]
Flock Condor cameras that appear to be
streaming directly to the internet
without any sort of password, [music]
no protection whatsoever.
Uh these appear to be Condor cameras,
and they are designed to track people as
they sort of go about their business.
And of course, people don't like have
any idea that this is happening.
If you're coming into this cold, here's
some context. A little over a month ago,
I released a video detailing a long list
of security vulnerabilities with
hardware and services in the Flock
Safety ecosystem. There are over 60
published vulnerabilities, so if that
concerns you, check that video out.
During and after the process of
conducting that research and making that
video, I was visited by the police and
had what I believe to be private
investigators outside [music] my home
photographing me and my property and
bothering my neighbors. John Gains, or
GainSec, the brains behind most of this
research, lost employment within 48
hours of the video being released. And
the sad reality is that I don't view
these [music] things as consequences or
punishment for researching security
vulnerabilities. I view these as
consequences and punishment for doing it
ethically and transparently. I've been
contacted by people on or communicating
with civic councils who found my videos
concerning, and they shared Flock
Safety's response with me. The company
claimed that the devices in my video did
not reflect the security standards of
the ones being publicly deployed. The
CEO even posted on LinkedIn and boasted
about Flock Safety's security policies.
So I formally and publicly offered to
personally fund security research into
Flock Safety's deployed ecosystem. But
the law prevents me from touching their
live devices, so all I needed was their
permission so I wouldn't get arrested,
and [music] I was even willing to let
them supervise this research. I got no
response. But now, since the general
public has access to live video feeds
from search engines, let's just save the
back and forth, and I'll literally read
you Flock Safety's response to IPVM
about their security from a brand new
Flock Safety camera that's publicly
deployed. Might as well, it's my tax
dollars that paid for it.
Flock is committed to continuously
improving security. The devices in this
YouTube video were not connected to the
cloud and to the best of our knowledge
[music] not customer installed, so the
security is akin to factory setting.
It's like looking at an iPhone stolen
off a truck before it was ever connected
to the cloud. If a person were able to
gain physical access to the device
leased to [music] the city, which is
illegal, they still would not be able to
gain access to the footage as the data
is only stored for a very limited time
[music] duration on the device following
its transmission to the cloud. None of
these vulnerabilities affect our cloud
platform, where the vast majority of all
evidence and metadata is stored.
I found another one at E Young Street
[music] and Harris Road, also in
Bakersfield, which is about 15 minutes
from the other spot.
[music]
So I'm going to go walk up to that now.
You can actually see it. So there, if
your city or county or place of business
or whatever feels satisfied by the
company's reassurances, show them that.
Many of the feeds that you've seen in
this video were relatively easy to find
and completely accessible at the time
Flock [music] Safety was telling cities
that the devices are secure after
they're deployed. And if you are in
touch with your county or city council,
keep a record of your correspondence
with them. Let them know and fully
realize that if someone gets stalked,
robbed, harassed, or abducted as a
result of a reported security
vulnerability by a third-party
surveillance vendor, they'll be on
record for having known about it and
approving it anyway, and they can
explain that to their voters and
constituents. I've said this before, and
I'm sure I'll say it again, the
underlying problem is not Flock Safety.
The problem is cities wanting a
cloud-connected AI-enhanced mass
surveillance system, but are too lazy to
conduct their own security audit or
research the efficacy versus risk, and
it very much is an industry-wide
problem. For example, other vendors in
this industry have used my last video to
shame Flock Safety on social media,
being completely unaware that I had
broken their own AI model before ever
even having access to a Flock device.
And I need to make it very clear that I
am not the first and only person to find
out about all of these enormous
vulnerabilities. I'm just apparently the
first person and enough to walk the
expensive legal tight rope of making
them public on a large platform, but I
also have tremendously cool and
impactful projects lined up for this
channel that have taken a backseat due
to the urgency of this. I want to go
back to storing data in birds and
inventing microphones to record
volcanoes, but I'm happy to contribute
to and stay active in the growing
community of people standing up to
[music] this. If you don't subscribe to
404 Media's content and journalism, I
highly recommend doing so. And if you're
not already familiar with Louis
Rossmann, then go check out his channel
and work relating to this because it's
hugely impactful and something that you
can get involved in. Having seen and
[music] heard these Condor cameras in
person, I can tell you that they are so
much more dystopian and problematic than
license plate cameras, [music] and I
wish that I had some sort of advice for
people other than stay out of public,
but some of them are literally pointed
at people's private property. But in the
meantime, I just ask that you don't lay
down and accept the infiltration of your
expectations of privacy. You need
privacy to build your identity and
refine the things that make you
authentic. Thanks for watching. Keep
creating. Happy holidays. Bye.