How Benn Jordan Discovered Flock's Cameras Were Left Streaming to the Internet

0:04Hello, and welcome to the 404 Media Podcast, where we bring you unparalleled access to hidden worlds, both online and IRL. 404 Media is a journalist-owned company and needs your support. To subscribe, go to 404media.co. Subscribers get bonus episodes and early access to our interview series, which you're listening to right now. This week, I'm talking to YouTuber Ben Jordan, who has done some of my favorite reporting on Flock, the automated license plate reader surveillance company. A couple of months ago, he found vulnerabilities in some of Flock's license plate reader cameras. I've been following Ben's work for a while, and soon after that video came out, he reached out to me to tell me that he had learned that some of Phlox Condor cameras were left live streaming to the open internet.

0:47If you don't know, Phlox Condor cameras are video cameras that are pan-tilt zoom cameras so they can go back and forth, zoom in. They're not for license plates. They're actually for tracking people. So we learned that some of those exposed cameras were located in Bakersfield, California, which is about a two-hour drive from my house. So I went up there to film myself on them. And before we get to my interview with Ben, here's some footage I took in Bakersfield that demonstrates the problem we're about to talk about. If you're listening on audio only, I think this will still make sense, but you can see the video on our YouTube.

1:19Okay, so I've driven up to Bakersfield, California from Los Angeles to check out this Flock camera that Ben Jordan, Gainsec, and myself found streaming directly to the internet. It is a Flock Condor camera, which is a newer type of Flock camera that is designed to track people as they walk by. This is in addition to its automated license plate reader systems. And so this one is stationed at Hughes Lane and Ming Avenue in Bakersfield outside of a Big O Tires. A Carl's Jr. Well, here's the Big O Tires. A Carl's Jr. And a Macy's. We have a Macy's Mall. and I don't know for sure but I think that the camera is probably owned by the mall because the mall has automated license plate readers at every entrance and this is stationed at a traffic light hopefully you can see it up there on top of this traffic light we'll zoom in and basically what we've found is that this is streaming unencrypted totally insecure no password required directly to the internet there's actually a panel that you can go on there and you can see not just the footage which i believe saves about 18 minutes at a time but you can sometimes see logs you can sometimes see the type of camera that it is and we found between 40 and 60 of these live streaming throughout the United States.

3:00We don't know if that's the total number of them, but so far we've seen them stationed at playgrounds. We've seen them stationed at malls. We've seen them stationed on bike paths. I saw one like outside of a skate park, a soccer field. And so I'm going to go out there and walk my dog who's here with me. And I'm going to record this camera recording me. and then I'm going to watch myself on the internet because this is streaming directly to the internet. Insecure. We can see people walking by. Some of these cameras are so up close that we're able to see people's faces. You can see what they're doing.

3:44I saw people walking their dogs. I saw people rollerblading. There was one that was like at a Christmas fair. So yeah, we're going to go check it out. So after doing that, I published an article called Flock exposed its AI powered cameras to the internet. We tracked ourselves. And Ben Jordan published a YouTube video called this Flock camera leak is like Netflix for stalkers. In a blog post after our reporting, Flock said, quote, the issue involved a troubleshooting only debug interface that was temporarily accessible on the internet. And quote, the only content visible was live or recorded video comparable to what can be observed from a public roadway.

4:23It added that, quote, no sensitive or confidential information was accessed or accessible. While recent third-party coverage characterized the issue as more extensive, this was an isolated configuration issue and not indicative of a broader or ongoing concern. We'll let you make your own decision about whether this data is sensitive based on our reporting and what you're about to hear. So here's my interview with Ben about how he found this, how he thinks about Flock, and what comes next.

4:56For people who don't know you, can you tell me a little bit about yourself, like how you got into this? You have a big platform on YouTube, but what do you usually do? Because you're not usually looking into Flock cameras. um yeah so i mean i my youtube channel started out with like kind of deep audio synthesis stuff and then it kind of went into general science and techie stuff oftentimes related to acoustics or things like that um and i live near atlanta and we have the highest concentration of surveillance cameras in America. And many, if not most of them are flock cameras. Like I literally can't go to a grocery store without passing a flock camera and being tracked by it.

5:42And it just, it, it's kind of the story you hear about from anybody who's been proactive or I guess active with the, the surveillance scene. It's like they, they were asking, what are these black cameras? Like, what are they doing? And then they find out, and then they find out more and you just end up down the rabbit hole and you kind of can't believe that this is something that actually exists and you can't believe how much of a fourth amendment violation it is. And so I guess mine was the same story, except that I have a lab here and the capability to actually test something. So I started testing, breaking the AI models that are in pretty much every single license plate reader.

6:23And then the security vulnerability stuff, I started learning about that when I was making the first video and it just kind of brought me down. And I'm probably a little bit more attracted to this type of thing or maybe a little bit more concerned about it because I would categorize myself as like a left libertarian. Like I truly do believe that privacy is a human right. And I think that it is there at the very fiber of our ability to live out our own destiny. Like I think it's very important to have privacy when you need it. And this is the opposite of that. So maybe that's what gives me more energy, you know, or makes me more likely to keep diving into the same thing.

7:00And I guess that's how I got here. Did you have the same experience that Joseph and I have had where you do a big story about Flock or learn something about how these cameras work and what they're doing, and you publish it, and then like 500 other leads pop out? Yeah. Because that's what's happened to us. And it's a very important story and an important company. and it's been a very important part of our reporting. But also, it feels like it's almost never-ending because we've done a couple stories and then we'll hear from an activist in Washington, we'll hear from an activist in Texas. So many people are sort of pushing back against this on a city level, but they're also creating so much data with their audit logs and all that sort of thing and people are pulling in.

7:57They're finding really fucked up things. And so it's like, oh, you should look into this. You should look into that. And it's like we are, but also there's not enough hours in the day to do it because there's so much going on with this company. It's so expansive at this point. Yeah. I mean, employees, block employees have reached out to me even. A lot of people have reached out to me. And people have reached out to me about similar things too. I think after making these videos, some which, you know, I'll probably tell you about like, they're actually notable stories that are that are kind of crazy.

8:31Yeah, it not only do have leads, I think another weird side effect of making the content is it gets repurposed onto TikTok and Instagram, where basically you just sort of have it's like somebody watched my video, and then they they put their face on it instead, and they give a two minute version of the video, which I'm totally okay with. I think any sort of advocacy for this is great. Use my content. I don't care. However, they're getting details a little bit wrong just because they're a little bit lazier about it.

9:04I have a bone to pick with that, of course, but the bigger concern is that this company is extremely litigious and kind of malicious, in my opinion. They're not messing around. And I think in the next content I make about this, I'm definitely going to mention that. in hopes that some of these people watch it and maybe pay a little bit more attention because if you say the wrong thing, they're going to take advantage of that and send you a cease and desist or something much worse. Yeah, we've noticed the same. We're very happy that people are spreading our reporting on Instagram, on YouTube, on TikTok.

9:41And a lot of people are doing their own reporting, but there's also a lot of people who are not, which is fine because they're talking about it and they're raising awareness about it, but then they are getting some of the details wrong. And that feels bad because some of those have gone far more viral than our work on it. And then it's like, okay, it's not the worst that people are learning about this, but they are learning sort of like a distorted version of it sometimes. And that worries me a little bit. Yeah. And it's frustrating when you're sort of asked to respond to someone else's reframing of your content, which is, you know, that's another thing where you're just kind of like, well, hold on.

10:21I never said that. They said that. But yeah, I mean, I just hope people are more careful. And I mean, a lot of people have been kind of in flocks, crosshairs, myself included. It's been a very stressful year. And you would think that the company would just like, you know, hire a robust security team and fix this stuff rather than just, you know, attacking every single person who points out the problem. But here we are. Yeah. You know, you found at least 40 of these Flock Condor cameras that are streaming unencrypted to the internet. We're streaming for at least days, maybe weeks. Can you take me through a little bit how you discovered this?

11:02Yeah, I kept telling myself, like, all right, I'm done with Flock. I have so many other things to be doing. I genuinely have Flock fatigue from the previous round of security vulnerabilities hoodies and then the previous round of like the video i've already made two videos and i never make more than one video on a topic so yeah it randomly middle of the night i'm searching on showdown which is kind of a internet of things search engine and i had known about the ports that some of the cameras were using and they were initially being used by the falcon cameras if i remember correctly And some of them are in saved searches.

11:41And I don't even remember the methodology. I think I was just kind of punching in numbers, procrastinating, going to sleep. And then I saw some come up and they kind of matched. The interesting thing is I had definitely seen these models in the past, but you see so many things when you search stuff on Shodan that a lot of times you don't really want to click everything, and then also you're kind of worried. You don't want to click something, and then somebody have your IP address, they have to start your VPN. So a lot of times you kind of get lazy, and this time I didn't. And so I found some, and then I realized that just by searching flock admin, I could find even more and different setups that were in these cameras.

12:25And so I think I found probably 40 maybe around. I didn't really do a count. And at least 10 were active. I kind of stopped counting at 10. I shared some of the information with John Gaines, Gainesack. And he found even more. He updated the searches for a little bit smarter way to search because he's more of an expert at this than I am. Yeah. And I mean, immediately, we were just without any username, without any password, we were just seeing everything from playgrounds to parking lots with people Christmas shopping and unloading their stuff into cars. I mean, it was honestly, we probably saw more stuff that didn't have cars in it than stuff that did.

13:11Yeah, I mean, that's the thing that really stood out to me is that, you know, a lot of our reporting, almost all of it has focused on Phlox ALPR cameras. I know that's what your videos have focused on so far. But this company is building a huge surveillance apparatus that is not just ALPRs. You know, they have a drone program and now they have these Condor cameras, which are specifically focused on tracking people more or less. I watched the webinar where they showed this to cops. And they do talk about tracking cars as well to go along with their ALPRs. But I was able to see these cameras tracking people walking down a bike path, walking down the corner in front of a mall in Bakersfield.

13:56And I don't know. I was so struck by how high res it was and how it was clearly tracking people. and then also the kind of banality of the places that they were stationed, like, you know, a bike path, random parking lot, a playground. I'm curious sort of like what you thought when you saw this stuff, because I know you were pretty affected by it. Yeah, I think it was like the first time that I actually got like immediately scared. You know, like you see the next step right in front of you. You know, like all this time I've been saying, you know, this is a slippery slope. This might happen, you know, and that was the first time I was like, oh, it's here.

14:40This is it. This is like the stuff that I've been a conspiracy theorist about for the last couple of years. And now we get to view it in real time. So that bike path that you mentioned, I went there and I read Flock's statement under a Flock camera with access to it in real time. and but going down that bike path is one of the most uncomfortable dystopian things i've ever experienced it's these cameras they move around and make noise that you could see them moving around and following you and so it created this this sort of rift with me where where it's like okay so i'm really angry that this is here i kind of hate the city or you know for allowing it to happen.

15:22But like, why is anybody dealing with this? Like, like if I lived nearby, I wouldn't go on the bike path, period. Like, I just feel like this is creepy. I don't want to be here. Again, I don't care who's watching me. It's just very strange for these, you know, things to be following you around while you're like walking around. Yeah, I think the one that affected me the most was it was a playground, which is powerful. Like, you know, seeing unattended kids being watched from public view is like, you know, I feel like that's one of the most powerful things. And obviously that was like something that I wanted to show other people publicly so they could understand how dangerous this is.

15:59And there was one that just going through this footage, like collecting some of it for reporting. I just saw a guy sort of walk out, you know, a guy who looked like he's about 30 years old, walked out and just went on a swing set and looked around and then just had a blast on it for 15 minutes and then went back to work and left the playground. And that one weirdly felt, I think that one affected me the most because it showed what a person does when they have an expectation of privacy. And that person, had he known that anybody was actively watching him, it's doubtful that he would have enjoyed himself in that moment.

16:40Like it was like this moment of innocence and privacy that I had access to that I didn't think I should have access to. Yeah. I mean, for me, the most affecting things, I mean, I thought the playground was very harrowing. Honestly, I felt happy that there were not that many people who went to that playground. Like, you know, when I was looking at it, there were just not, there wasn't that much going on there. But for me, it was the fact that it was, you know, these are PTZ cameras, they're pan tilt zoom cameras, and they were following people who were walking around, like people walking their dogs, a person rollerblading.

17:18And the fact that it is tracking you as though you may be a criminal at some point was very, just very wild to me because I have seen how Flock talks about this to cops. and what they tell them is that our AI automatically tracks people so that you can use this for evidence if you need it at some point. And it's just like, okay, but you're tracking literally every single person who walks by these things. Right. Yeah, I mean, I suppose that's the big difference is having everybody's activity in a giant data set or in a giant data storage thing that's being organized by AI versus having the police have a suspect and getting a warrant and then following them, which requires man hours.

18:11And if somebody is suspected of something frivolous that's not worth those man hours, then they don't investigate them in that way and they don't track them. So it's easy to see how quickly this gets out of control. A couple of years ago, I went to University of Chicago to interview some data scientists. It was their sociology department. And to interview data scientists and the professor of sociology there who had made this AI crime prediction system that had a 90 % accuracy rate. And oddly enough, the neighborhood that this AI model was initially trained on happened to be the neighborhood that I grew up in, which is West Englewood in Chicago, which is Englewood's one of the most violent neighborhoods in America right now.

18:53And so it was really interesting to find out that they had never actually visited the neighborhood that was only 15 minutes away, yet we're spending years studying all the data from it. But more so and more to my point is you very quickly realize that if you have police constantly monitoring one area, you'll find a crime there because crime happens everywhere. And that doesn't necessarily make anybody safer. It just means that more crime is being detected where more police are. So that was kind of the vibe of it is you're able to find all of this crime, but in the neighborhood next to it, or maybe even a neighborhood that didn't have as many socioeconomic issues, you weren't finding crime that maybe you should have found.

19:39And I see this in the exact same flavor as that, where it's like you can put these cameras up and yes, you're going to find more crime and then you're going to have more people being affected by maybe policies that weren't being enforced by actual police officers.

20:03I've been thinking a lot about my goals for 2026. I want to eat a little healthier, work out more, be a little bit more social. And the funny thing about goals is you usually need the right people around you to make them happen. A dietician, a trainer, maybe even a therapist. It's hard to find people who are so good at what they do. It's like if you're hiring. How can you find the best people for all the different roles on your team? Well, that's easy. ZipRecruiter. And right now, you can try it for free at ziprecruiter.com slash 404media. Zip Recruiter's matching technology works fast to help you find top talent so you don't waste your time or money sorting through the wrong candidates.

20:45You'll find out right away how many job seekers in your area are actually qualified to roll. Zip Recruiter's matching technology works fast to help you find top talent so you don't waste time or money sorting through the wrong candidates. You'll find out right away how many job seekers in your area are actually qualified for your role, which will help you know if you're searching for a needle in a haystack or a needle in a pile of shiny needles. Let ZipRecruiter help you find the best people for all your roles. Four out of five employers who post on ZipRecruiter get a quality candidate within the first day.

21:20See for yourself. Go to our exclusive web address right now to try ZipRecruiter for free. ZipRecruiter.com slash 404media. Again, that's ZipRecruiter.com slash 404media. ZipRecruiter, the smartest way to hire. It's easy to assume that being small means flying under the radar, but the reality is that small businesses are being targeted more and more by bad actors. Cyber criminals know that lean teams often lack the resources to prevent or respond to a breach, and security by obscurity doesn't work. In short, the bad news is teams of any size can be a target, but the good news is even the smallest teams can foil cybercrime.

22:021Password provides simple security to help small teams manage the number one risk that bad actors exploit, weak passwords. 1Password provides centralized management to make sure your company's logins are secure. It's a simple turnkey solution that can be rolled out in hours, whether you have dedicated IT staff or not. 1Password is designed to meet small teams where they are, but it's also built to grow with your company. 1Password's enterprise password manager helps your company eliminate security headaches and improve security by identifying weak and compromised passwords and replacing them with strong, unique credentials.

22:39I've been using 1Password for years to protect my many, many accounts, and I couldn't recommend them more. And I can't really imagine trying to manage my accounts without it. Take the first step to better security by securing your team's credentials. Find out more at 1password.com slash 404 and start securing every login. Now that the holidays are over, you might be feeling like you've got big spending hangover. The drinks, the holiday food, the gifts, it all adds up. Luckily, Mint Mobile is here to help you cut back on overspending on wireless this January with 50 % off unlimited premium wireless.

23:16Mint Mobile's end of the year sale is still going on, but only until the end of the month. Cut out wireless's bloated plans and unnecessary monthly charges with 50 % off three, six or 12 month plans. All plans come with high speed data and unlimited talk and text delivered on the nation's largest 5G network. Use your own phone with any Mint mobile plan and bring your phone number along with all your existing contacts. With Mint, I've saved on wireless without having to cut back on other parts of my life. It's like a fake sacrifice. None of the pain, all the savings. My favorite kind of restraint.

23:51This January, quit overspending on wireless with 50 % off unlimited premium wireless. Plans start at$15 a month at mintmobile.com slash 404media. That's mintmobile.com slash 404media. Limited time offer. Upfront payment of$45 for three months,$90 for six months, or$180 for 12-month plan required. That's$15 a month equivalent. Taxes and fees extra. Initial plan term only after 50 gigabytes may slow down when the network is busy. Capable device required. Availability, speed, and coverage varies. See mintmobile.com.

24:33Let's talk about the security aspect of this just because, I don't know, it's like you walk around, you drive around, you see CCTV cameras, you see cameras out there. And so we are being recorded all the time. I don't like it. But I also don't generally think this is being live streamed somewhere. And if it is being live streamed somewhere, like in a law enforcement context, I imagine that it's going to the police and to no one else. But what was happening here is that literally anyone on the internet could go and not only look at this stuff, but also So, you know, see the settings, see some of the logs, change some of the logs if you wanted to, which we did not do.

25:20What does this say about Flux security? I mean, so before I even had access to look at a stream, I had access to the administration page of the actual camera itself and 31 days of data of every single person who had walked in front of that camera. I had the ability to delete that stuff. if I had access to the logs, even more problematic, you can't really prove it. But I was finding, when I went up on the logs, I was finding like parser errors in that player from 45 minutes before I looked at it. And this is before I shared it with John or anything, meaning that someone had watched it and had an issue playing the video.

26:04Because like it wouldn't just play a video on its own. now it doesn't seem to me like Flock would sit around and watch their cameras all day or something especially at a playground or something like that but it did make me wonder like okay who else because these were visible on Shodan so like it is it's not that far of a stretch to think that there are a lot of people who have already found this and just didn't report it or you know maybe or were scared to report it or possibly using it for some sort of nefarious use. Yeah, I mean, the security with Flock, I don't know how it could really be any worse, to be honest.

26:45Like, I can't imagine it being worse. It was already bad enough being able to poke the camera a few times and connect to it as an access point and then root it. And, you know, being able to control outside of the operating system, which is Android, by the way. I mean, so it's like... I honestly can't think of any way where it could be worse. Like at this point, if I, if I were, you know, working for the company in security or something, I mean, we're at the point where like most cameras, in my opinion, need to be replaced. They need to be replaced with something that's not running Android. They need to be replaced with a proprietary operating system or something that's more low level because there's no need to load all of the libraries and things in the Android OS just for something that, that restreams and catalogs footage from a security camera.

27:37And this is a$7 billion company. Like there's no, there's no excuse why they couldn't develop something like this. That's a start. But right now it's the, it really feels to me, I would never say this in one of my videos cause this is very opinionated, but it really feels to me like they are aware that this is a huge mess and they're just pushing on until they can have an IPO and then they'll deal with it once the stock market is invested in it and we'll have to, you know, pay the damages. Yeah. I mean, it struck me that, you know, you and John Gainsack found all of these CVEs, like, you know, made a video, got quite a lot of attention on it because the things that you found were frankly insane.