Lawmakers say stolen police logins are exposing Flock surveillance cameras to hackers

Members of Congress are demanding the Federal Trade Commission (FTC) to look into Flock Safety, a company that provides license plate recognition cameras, following concerns about its inadequate cybersecurity measures. In a letter addressed to FTC Chairman Andrew Ferguson, Senator Ron Wyden (D-OR) and Representative Raja Krishnamoorthi (D-IL) have expressed their worries about Flock's failure to mandate multi-factor authentication (MFA), a crucial security feature designed to protect against unauthorized access. The lawmakers highlighted that while Flock allows law enforcement clients to activate MFA, it does not make this security measure compulsory. This lack of enforcement was confirmed by the company during a congressional hearing in October. They pointed out that if hackers or foreign agents obtain a law enforcement user’s password, they could access restricted areas of Flock’s site and view extensive databases of license plate images collected by public surveillance. Flock operates one of the largest camera networks in the United States, serving over 5,000 police departments and various private entities. The system enables these agencies to access and search through billions of images of license plates gathered from vehicles across the nation. The lawmakers referenced evidence indicating that some logins from Flock's law enforcement clients have been compromised and circulated online. This information was supported by data from Hudson Rock, a cybersecurity firm that tracks stolen credentials. Additionally, independent security researcher Benn Jordan presented evidence of a Russian cybercrime forum allegedly advertising access to Flock accounts. In response to the lawmakers' concerns, Flock's Chief Legal Officer Dan Haley stated that the company plans to implement MFA by default for all new clients starting in November 2024. Currently, 97% of its law enforcement users have activated MFA, meaning around 3%—potentially dozens of agencies—have opted not to do so for unspecified reasons. Flock's spokesperson, Holly Beilin, has not disclosed how many law enforcement agencies have yet to implement MFA or whether any federal agencies fall into this category. In a related incident, it was reported that the U.S. Drug Enforcement Administration accessed Flock's surveillance tools using a local officer's login without their consent, further raising alarms about the security of this sensitive data. Following this breach, the Palos Heights Police Department confirmed it had enabled multi-factor authentication to bolster its security measures.