The pushback from the company was that I'm a YouTuber and I was doing magic tricks and I'm not a serious security researcher. I think that me reading their statement about having never been hacked through a Flock camera and then downloading it on my own machine kind of made that indisputable.
There's something about that that I really just want to hone in on. The idea of the Flock camera being the problem is secondary to the Flock network being the problem. If you were to have a police officer follow someone or go through public traffic cams, which are all over the country, and wait for your car to come and then write down when that was there and do that for 30 days, that's generally like a serial killer situation.
Especially in something that serves law enforcement where you would maybe have a publicist that's used to dealing with Republicans and right-wing things, they just tell you to keep repeating the same thing over and over again and take a firm stance and dig your heels in. Most people who aren't Donald Trump when they do that get wrecked, right? And I think Flock got wrecked.
Hello and welcome to Decoder. I'm Nilay Patel, editor-in-chief of The Verge. Decoder is my show about big ideas and other problems. Today I'm talking with Ben Jordan, musician, YouTuber, researcher, and investigative journalist. You might know Ben from those first two titles. He's got a prolific discography of experimental music dating back decades. But in the last couple of years, Ben's become a high-profile face in the creator and media world for his work investigating Flock Safety, the maker of automatic license plate readers and the software that powers them. Ben recently testified in front of Congress at the Senate Judiciary Committee subcommittee on crime and counterterrorism at a hearing dedicated to Flock and other ALPR systems. To me, this hearing felt like the culmination of months and months of growing criticism and bipartisan backlash against Flock, all of which is taking shape similar to the pushback against AI data centers. This has led to major fallout for Flock. Hundreds of cities, counties, and other local governments have begun cancelling contracts, and Flock is now under investigation by Republican Senator Josh Hawley. We never voted for an insecure network of cameras in every street corner, and we're certainly not being asked if we're comfortable with access to this network being given to police officers with a penchant for abusing it. So, Ben sees his work on YouTube and with other researchers, civil rights groups, and journalists as an accountability function that forces the conversation to the forefront. And so far, it's working. Okay. Ben Jordan on Flock privacy and the new surveillance backlash. Here we go. Ben Jordan, you're a musician, you're a YouTuber, you're a researcher. Lately, you've been an investigative journalist. You are a witness in Senate hearings. Welcome to Decoder.
Oh, thanks for having me.
I'm a huge fan of yours. It's just a delight to have you here. I think a lot of people in the Verge audience know you as a musician, but lately you have been relentlessly focused on Flock cameras, automatic license plate reader cameras. You recently testified in front of a Senate hearing on those cameras and the surveillance they enable. Give us a sense of your background for people who don't know, who haven't been following for years. Where did Ben Jordan come from and how did you end up being the person who makes videos about Flock?
I started with, I mean, I've been a musician my entire life pretty much and I've also always been kind of a hacker, somebody who always takes stuff apart or, you know, if I get a product that wants me to pay for a service that's already in the product, then that's like a puzzle that I want to solve and I get actually kind of excited about it. But, you know, a lot of times that blends into the investigative journalism as well. And so with the Flock stuff, it's just I live in Atlanta, which has more Flock cameras than anywhere else per square mile. And about two years ago, I started noticing, you know, I've noticed them. I thought they were traffic cameras or something like that. Then I started looking into what they were actually doing. And then started looking into things like security vulnerabilities. And more than anything, I think that everything that's happening right now in the public and in the news has to do with people just figuring out that these have existed the entire time. And I think a lot of my focus now is on the lack of transparency from the government because you can, you know, the companies are always going to make money and try and make as much money as they can, especially if it's from taxpayer money. But in this case, I feel like our government kind of missed it and that's where we're at.
There's a question that's been rattling around my head the entire time we've been having what I would call the modern privacy and surveillance debate. And when I say modern, what I mean is like it feels like we woke up sometime in the last year and everything is recording us all the time and everything is watching us and the glasses have cameras in them and Mark Zuckerberg is like, phones don't have a light, and that is meant to end a conversation. That's the argument. Phones don't have a light, no further questions. And I don't know, the Apple Watches are going to start doing automatic transcriptions and everyone was like, wait, hold on, no thank you, we actually don't want this to happen. But my personal experience of this is that my political coming of age was the war in Iraq and the Patriot Act and this is the stuff that people were talking about 25 years ago, like don't do warrantless wiretaps, don't make the databases all connect to each other so you can take the metadata and de-anonymize people at will. What is it about this time that has made everybody so angry? Because we could have been angry 25 years ago.
I'm always trying to get people more informed on the information that's being collected about them every time they go to a website, every time they sign up for something, every time they check into a restaurant online, every time they use their phone. In this case, I think one of the reasons that people are really upset about it is that you can't opt out, right? That's the first thing is I can't say, hey, I don't want these Flock cameras or Axon cameras or whatever they are tracking my every move and giving it to law enforcement. I have no option to do that. I was never given an option on whether to vote for them or vote for somebody who was in favor of them. They just kind of happened and, you know, people weren't told about them. So, that would be the first thing is like you can still install a separate OS on an Android phone or you could turn off Wi-Fi and Bluetooth or just leave your phone at home whereas you can't actually go to the grocery store without somebody tracking your vehicle. And the second thing is that, and this is kind of related to opting in and opting out, I can pay for a new AI smartwatch or I can pay for an Amazon Echo device or something like that, or I cannot, whereas this way I'm paying for this already. Like this is just my property taxes are going up and I'm paying for surveillance, which in some ways is the same as the NSA, but I feel like it's much more local now.
You don't get to go to the town board meeting and yell at the NSA, although maybe you should. Honestly, that might be good for everyone. That part of it, and you've certainly been at a bunch of local town board meetings. I've watched a lot of videos of you talking at them and helping other people articulate their concerns. That to me is one of the more fascinating aspects of all this. Flock went from a company that was selling cameras to everyone and the idea that adding Flock cameras would increase the safety of your town went from all but assumed to, oh, hold on, we all have a lot of questions, and now this company is struggling a little bit. They're losing contracts. They are retrenching. Their communication strategy has changed. What do you make of that? Is that just the power of local democracy and action or is there something else?
It definitely is democracy in action. And I think that that's the good news and the best news out of anything that's happened with both Flock and data centers. It's two things that have made people actually look up who their mayor is and who their city council members are and show up to meetings and then get involved in those local politics because those local politics affect your life way more than national politics. They just don't make the headlines so we're not as involved. Like your day-to-day following what Donald Trump is doing is likely not going to make that big of a difference other than, you know, what you argue about over Thanksgiving. Whereas the local politics, that's straight up in the next year that's going to have a big effect on your life. And so people getting involved in that and then in cases like Asheville, North Carolina where it's actually changing the political landscape, like people are so dissatisfied with the surveillance policies of their local politicians that it looks like they may have a new mayor as a result of it who also comes with a bunch of other interesting and progressive ideas that would, you know, probably help the city a lot more than the current mayor has. And so that's a big deal right there. The other side, the part that discourages me a little bit or the part that I find a little disappointing is that like Flock has become this buzzword, but a lot of people don't look beyond that. And just, I mean, I just heard in our Georgia, the race for governor in Georgia, I mean, I just heard like the Democratic candidate yesterday talk about getting rid of Flock cameras and being anti-Flock when this is somebody who as mayor of Atlanta brought Flock, you know, welcomed Flock. So, you see a lot of that happening now too where they just say bad Flock and then they go sign an Axon contract or they put Vax cameras everywhere, Motorola cameras. In my research, Flock has been like the low-hanging fruit just because they were kind of the loudest and most defensive, whereas every other company was just kind of taking a step back and cashing the checks.
One of the pieces of the puzzle here that I think is just fascinating is Flock is a startup essentially. They're a new company. They have a new go-to-market strategy. They talk a big game about what AI can and can't do and what they as a platform should and should not enable. Your Axons and your Motorolas are government contractors. They are not companies that are meant to have a personality. And there's something about Flock where Garrett, the CEO, had a personality. He would go on TV and deride any critics as left-wing terrorists. And that did not work. And there's something about surveillance in that case where that strategy didn't work. There's something about data centers where that strategy didn't work. We just ran a big piece about the people of Utah pushing back on Kevin O'Leary who called them all Chinese terrorists and they were like, what are you talking about? And that cut across party lines. Again, you've been out there. I know you've talked to a lot of people pushing back on surveillance. Is it just that Flock had a personality and that enabled bipartisan pushback or is it surveillance more generally?
In terms of the media getting attention, I think that Flock had, I mean, Flock had a lot of personality and they were very defensive. And I'm not sure. Wait, the thing is I've met a lot of the people from Flock who are so villainized and they don't seem at all the way that they've seemed in the clips that I've covered in my content, right? It's very different. And so, you would assume that there's a publicist behind a lot of this. And I think especially in something that serves law enforcement where you would maybe have a publicist that's used to dealing with Republicans and right-wing things, they just tell you to keep repeating the same thing over and over again and take a firm stance and dig your heels in. And most people who aren't Donald Trump when they do that get wrecked, right? And I think Flock got wrecked. They denied security vulnerabilities or they used clever ways of reframing or redefining words and people picked up on it and now they are the villain whereas companies like Axon, they're not as sexy for a journalist, they just aren't. And that's probably intentional on their part. Any company that's taking your tax dollars or trying to court your government to give your tax dollars to them probably wants to be out of the spotlight.
We've covered Axon before. They do not want to be a company with characters.
They are as anonymous as they can be.
One of the things that I want to do with you on the show, most importantly of all, is just describe what a Flock camera is and what the technology behind the hardware does that makes it new. Because from watching all the videos that you make, they're just putting a bunch of Android phones around town and it's actually the database and the AI that makes it more dangerous than usual. But describe what the actual Flock hardware is and then how that connects to the system that makes it as controversial as it is.
So ALPRs have existed, I believe, since the 1970s and I think they started getting used in the United States in like the late 80s and 90s. And one of the classic ways that they would be used in the 2000s is they would be mounted on a police car and if a police car wanted to run someone's plate that way they didn't have to type it in while they're driving and they could run a plate over to dispatch. I personally don't have any problem with that. Like I think that makes sense. That's a decent use. However, you would have issues where you would get plate misreads and then people would get taken out of their car at gunpoint as a result. Flock is a lot different. Flock basically started a private nationwide network where any police department or city that's using Flock's network, they can opt into it and share their data with it and then police departments across the country can run a license plate with 30 days of retention on everywhere someone's been anywhere in the country as long as they're sharing the data. So you would have someone in Texas being able to search somebody's movement through New York or Atlanta or something like that. And they are doing this without a warrant. Whereas any type of ALPR data sharing previous to Flock had to go through the National Crime Information Center which does require a magistrate judge to look at the overall context of a situation and then issue a warrant to allow tracking.
So that's the innovation here, right? They built the private network, the private database, they convinced a bunch of law enforcement agencies to buy their system and they could opt in. And there's some kind of legal innovation here where by making it a private database, they could just sort of excuse themselves from the warrant process. But the actual hardware of the cameras is not all that impressive, right? There's something about that that I really just want to hone in on. The idea of the Flock camera being the problem is secondary to the Flock network being the problem.
Yeah, absolutely. I mean, one way that I think of it, a lot of the defense of Flock cameras, even outside of Flock themselves, is that it's all happening in public. So, this is all in public view. So, it's generally the same as you're allowed to take a picture anywhere in public. So, why can't they do this? My argument would be that if you were to have a police officer follow someone or go through public traffic cams, which are all over the country, go through every single public traffic cam and wait for your car to come and then write down when that was there and do that for 30 days. That's generally like a serial killer situation. Like the amount of resources that you have to dump into that, you would have to justify that expense with a very serious crime. But doing that for somebody who, you know, stole steaks from a Kroger is very different. And I think what worries me about it is that you might end up with police officers being able to get a lead on a case much easier that doesn't necessarily need police for society to become safer and a better place, like a nonviolent crime or something that's not a huge deal, rather than investigating more serious crimes.
The argument that Flock makes, that proponents of this technology make, we had Jamie Siminoff from Ring on the show and the argument he would make is if you put enough cameras into certain neighborhoods, you will zero out crime. That is a thing that he has said to me in the context of Ring doorbells and floodlight cams. It's the same argument that proponents of Flock make. We put up all these cameras, we can catch criminals, thus we will deter criminals, the crime rate will fall. Do you buy into this?
I don't because first of all, we've never tested this. We've never had a city in a vacuum where we put in a bunch of cameras and then because one of the metaphors I like to use is if you have a supermarket and you put one camera in one aisle where you think that things are going to get stolen, like that will probably increase theft in other aisles rather than just assuming that every shoplifter is just going to become a plumber instead, you know, just like, oh, I'll be a doctor instead of a shoplifter. Like that doesn't actually deal with the overall problem. And then if you have a Walmart that has cameras all over it and then you have a neighborhood store that can't afford all those fancy cameras, then maybe the shoplifters and people who would hold up a store will go to that place instead. And you have the same thing with cities, like you have crime relocation happening. So yes, of course, if you put a camera above a street, it's less likely that a car on that street within the view of the camera will get broken into. But does that make it more likely that a car a block over where there is no camera will get broken into? And this is something that has been observable by criminologists, like crime relocation is a real thing. And a lot of times effective policing just moves criminals elsewhere. So yeah, selfishly you could say, well, yeah, in my subdivision we have less crime and I don't care about anything other than that. But over time, over the next decade, it doesn't really work out that way. You end up with more crime overall or you end up with bigger problems in society. Also, we've seen that Ring cameras don't really reduce crime all that much, do they? Like you end up being able to see somebody stealing a package off your porch or you end up being able to see somebody breaking into your house. But do they actually increase clearance rates? I've not seen any evidence that they do.
Well, you got to connect them to the nationwide database of license plates, right? If you put a camera everywhere, you can't relocate anywhere. That's the argument. It's the end point of the argument that they are making, which is, okay, if putting up some cameras would move the crime, putting cameras everywhere would make that impossible and there will be no crime.
I mean, with a lot of that stuff it's just like, well, if you're worried that you're going to have a porch pirate, if you're worried that your house is going to get broken into, I'm not sure why you would jump to put cameras all over your house. And same thing with cities, like why wouldn't you just increase your insurance payout if something like that happens because that actually will get you new things and the other one will just get you a police report with evidence that the police might not even be able to handle or will not be able to connect to any sort of criminal because even if that criminal gets caught, it's not like they just save all the money to pay back their victims, right? So it's figuring stuff like that out. But I think another thing I don't like about surveillance in general, especially things like ALPRs, is that they're not solving crime with embezzlement. They're not solving crime with corruption. They're not solving bigger crimes. They're really honing in on things like car theft and things like shoplifting out of a Lowe's parking lot and then them sharing that data with the police and then the police tracking the car two days later and pulling it over. Most of the time those crimes actually have solutions that are in broader public policy, right? Like if somebody's shoplifting from Lowe's, I would assume they probably either have a drug problem or they have a problem with poverty because I don't want to shoplift from Lowe's, you know, I have no desire to do that. It's not like a crime of passion. It's a crime of necessity. And so yeah, I would say that along the lines like even if the clearance rates were improving, which I've not seen evidence of, what does that mean? And does that just mean that we're putting more nonviolent offenders in prison or through the justice system? Does that actually make society safer?
We're getting into the trade-offs of how using technology to solve social problems. And one of the most important trade-offs that you have brought to light repeatedly is that these devices are not secure. So even if you solve the problem of you should get a warrant, or even if Flock responds to the public pressure and says we ought to let people type case numbers into the system before they start searching, which was their big concession recently. Even if you get to, okay, we're going to control the system a little bit better. The devices themselves are insecure. The network is insecure and that means anybody can do almost anything they want with it. You're a security researcher. Describe how you started digging into the security problems here and what the response has been to that.
I mean, starting out I found out that they didn't have, at the time in early 2025, they didn't require multi-factor authentication and I also witnessed a police officer logging into Flock from a Wi-Fi network that wasn't at a police station. And so immediately, like, had you told me those things I wouldn't believe them, but witnessing it happening made me go, oh, okay, this is something that needs more looking into. So I started, I'm like, okay, well, it's probable at that point because now you have human error and if all of these police departments are sharing data with one another, then it could just be the dispatcher, somebody who's not even deputized that has a Flock account at, I don't know, a rural Louisiana police department, and that person could sell their account, or that person could click the wrong link in an email and whatever. So I started looking for Flock credentials on the dark web and I found some and they were coming from a Russian vendor. And then I started thinking, okay, well, how exactly did that happen? That's how I met John Gaines. Found that there was a lot of, at the time there was a lot of hardware vulnerabilities in the camera where you could get them to open up a Wi-Fi access point and then you could get complete control over the Android device and you could route it and have it do whatever you wanted in a way that would be undetectable because it's happening outside of the Flock ecosystem on the device. I had found a bunch of Flock cameras that were just, their administrative interfaces were open on the internet. So you could just type in the IP address and then delete footage, watch footage from 30 days ago. You could even put files on the device, look at all the logs. In all these situations, we found a lot of plain text credentials, things that shouldn't have been there. And yeah, so I mean, at first the pushback from the company was that I'm a YouTuber and I was doing magic tricks and I'm not a serious security researcher. I think that me reading their statement about having never been hacked through a camera, through a Flock camera, and then downloading it on my own machine kind of made that indisputable. You know, they still disputed it for a while, but I think that is what really got the media involved and finally paying attention to it. Since then, it's been like smaller things that I found, but more so the bigger deal here is that no matter if you're using Flock or Axon or whatever it is, because now you have Axon and Motorola also launching their own private networks outside of the NCIC. And so now that you have this, it's like, yeah, the person on this entire network with the worst security hygiene is going to be as secure as the entire network will be, right? That's the big problem. If I were to have it my way, police officers would not have access to Flock at all. Like, I mean, if I were to have it my way, you wouldn't have this level of surveillance. But if I were to have it my way on security policy, a police department would have one person who is trained and has a lot of security hygiene and privacy hygiene and things like that, is trained to look up Flock searches for police officers, right? But what we're seeing is like a lot of police chiefs who have Flock accounts. It's like, why would a police chief ever even need to use a service? Like, it's their job to manage the department.
In the action movie, the person with access to the surveillance tool, you know, the cops have to bribe them with like cookies and booze to run a search for you.
And usually have like bifocals and are really smart. So yeah.
Like we've been conditioned to be like, that's how it should work at the very least, that there should be some light bribery involved, not free access. I am not a security expert by any means. I've been covering tech for a long time and it just strikes me that there are some very basic concepts about security that Flock in particular missed. The idea that we have open access, there are no access controls, that they were practicing what is called security by obscurity and you could just drive a truck through it and they would deny it. All of that seems very basic. Is that just they're a startup and they didn't know any better?
