He decompiled a Flock camera and found it labels 'person,' 'dog,' 'bicycle' — not just plates
A man who helped kick Flock out of two Oregon cities pulled the code off a legally obtained device. Its onboard object detector was already tagging people and bicycles, not only license plates.
Engadget reports there are now over 100,000 Flock cameras in the US, running modified Android, feeding a searchable network where a Texas officer can query Massachusetts footage and ICE rides along through local police. Searcher Benn Jordan found 70-plus cameras streaming live, password-free, in December 2025.
Then an HN commenter who co-led the campaign that removed Flock from Eugene and Springfield, Oregon and helped draft state ALPR law said his team decompiled a device: the object-detection categories included 'cat,' 'dog,' 'person,' 'bicycle' — confirming from the binary what marketing implies.
What Flock records when it isn't reading a plate

Engadget's explainer lays out a system most people still call a license-plate reader. Over 100,000 Flock devices are now deployed across cities, neighborhoods, and businesses. They run modified Android, push footage to searchable databases, and let police type natural-language descriptions — 'green sedan with an American flag bumper sticker' — instead of reviewing tape by hand.

The network is national: an officer in Texas can search Massachusetts footage, and ICE has run queries through local data-sharing — Denver police logged over 1,400 searches for ICE by August 2024. Security researcher Benn Jordan found at least 70 cameras publicly reachable through a search engine in December 2025, streaming parks, intimate moments, and children with no password; a month earlier he showed physical root access via a button press and an exposed USB port. The concrete harms are named too: a Denver woman handed a theft summons over Flock footage, cleared only by her own Rivian dashcam, and drivers stopped because the system read a zero as the letter O.

The man who took Flock to court documents, not Twitter
The thread's center of gravity was someone who has spent a year fighting these deployments: a participant who helped lead the effort that removed Flock from Eugene and Springfield, Oregon, helped draft Oregon's SB1516, and sat across the table from Flock and Axon executives. He moved the conversation from speculation to evidence:
"We decompiled some of their code on a legally-obtained device. That code very clearly included categories of interest for their onboard object detection software, and included, 'cat', 'dog', 'person', 'bicycle' …" — a co-leader of the Oregon campaign who helped draft SB1516
He added that public-records requests turned up police training materials sharing tactics for finding non-automobile objects, and that Flock's own Flock Freeform marketing advertises finding 'missing people' by clothing description. His verdict on the abuse pattern was that Flock has never meaningfully cooperated with controls, so the system tacitly approves of misuse.
The reversal: it's the boring part that's the problem
The sharpest disagreement came from a veteran who actually canceled his own town's contract — and still thinks the popular framing is wrong:
"the ALPR part of Flock is what caused all the problems here; the rest of it, of characterizing vehicles with attributes beyond just plates, wasn't really problematic at all" — tptacek
He argued the bans aren't sweeping the way the thread assumes: Flock loses contracts mostly in ultra-progressive municipalities and largely because of its public ties to the federal administration, while commodity ALPRs from less-political vendors keep going up everywhere. Even in what he calls one of the ten most progressive municipalities in the country, Flock had an ardent cheering section of ordinary residents who saw expediting stolen-car recovery as reasonable.
A different reframing explained why a private vendor is the whole trick:
"What makes Flock bizarre is that it's a private business … all of the invasive monitoring with none of the oversight" — a commenter on the public-private surveillance gap
Not everyone bought the alarm. One regular argued the public simply isn't as anti-Flock as HN believes, since cameras have recorded malls and roads since the '90s and Flock became a lightning rod mainly through ICE. The legal-realist camp kept repeating there's no expectation of privacy in public — and got the cleanest rebuttal of the thread:
"You can eavesdrop on a conversation at the park. You cannot put mics under all the benches. Privacy is a situational continuum of invasiveness." — a commenter distinguishing one photo from dragnet tracking
The practical takeaway the insider left, against the thread's recurring vandalism fantasies, is that the wins are administrative: DeFlock counts dozens of contract rejections, won at city-council meetings rather than with baseball bats. The catch he and others name — a canceled contract doesn't pull the hardware off private parking lots, and the next vendor isn't a political flashpoint — is why 'ban Flock' and 'end ALPR dragnets' turn out to be very different fights.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
LibrePods reverse-engineers AirPods' secret protocol onto Linux and Android
AirPods work as plain Bluetooth earbuds anywhere — what stays locked to Apple is the proprietary layer: ear detection, ANC switching, battery readout. LibrePods re-implements that layer, with two of its Rust files translated from Kotlin by AI.