Flock Safety Sells Surveillance as a Service

This research started on a trip to Dearborn, MI. I was driving back to my hotel, and noticed a solar panel and a camera on a black pole. A closer look took me down a rabbit hole. So… let me introduce you to Flock Safety.

Flock Safety sells automated license plate reading, and various other surveillance capabilities to businesses, communities, but mostly law enforcement agencies. Flock’s key selling point is lightweight, managed infrastructure. Most of which is solar powered and cellular — no expensive wires.

Flock variously claims a presence in 3,000+ communities, business customers in 42 states, and 2,500+ law enforcement “relationships”. Following in the footsteps of the tech giants, it has attracted hundreds of millions of dollars in venture capital funding that allows it to slash costs for its customers to quickly gain market share.

There are plenty of other ALPR solutions on the market. What’s special about Flock is how affordable it is for law enforcement in particular. Outfitting a fleet of police vehicles with mobile ALPR cameras from Motorola, or installing fixed camera infrastructure across a city requires enormous up-front cost.

Flock Safety takes on the installation and infrastructure costs. This allows law enforcement agencies to spend the affordable subscription costs out of their existing budgets so they don’t need to ask the local government for a big capital spend on an ALPR network.

Detroit, MI PD highlights the problem in law enforcement. Detroit had Motorola mobile ALPR cameras, but they had to come to the city council to very conspicuously ask for $5 million to buy fixed ALPR cameras — the kind you’d find on the side of the road.

Detroit to spend $5M in federal funds on 100 license plate readers at 25 intersections

Following the Lack of Money

Rewind to Dearborn. Why are there ALPR cameras on a public street near my hotel? Signs that Flock Safety had worked with the City of Dearborn on a contract were scarce. No press releases, no news articles.

Luckily, a lot of good work researching law enforcement ALPR use is being done. This includes several FOIA responses that reference Flock Safety, like this request to Dearborn, MI PD. The response includes two separate purchase orders to Flock Safety in 2022, for $25,000 and $30,000.

A 2022 agreement between Evanston, IL PD and Flock Safety breaks down the costs. A ten camera deployment, zero dollars installation, $25,000 annual subscription.

A brief aside: If $25,000 a year is a big ask for an unproven technology, why not ask Flock Safety for a “90 day free trial”?

Boulder police testing gunshot detection devices on University Hill

Ten cameras doesn’t sound like a lot, but that’s how Flock Safety acquires new customers for its larger platform. They suggest you to ring the perimeter of your city in cameras, leaning in to the outsider trouble narrative while minimizing initial cost.

This slide from one of their webinars shows this deployment strategy. It contains an actual installation map for their customer Piedmont, CA PD.

“Transparency”

Flock Safety plays both sides of the deal pretty well. As a vendor, they need to sell a law enforcement agency on a cheap city-wide solution, integrated into a rich “Real-Time Crime Center”. They also need to sell a community on safety, security, and most importantly, privacy.

Flock talks about its ALPR system as if it were privacy-preserving, but there seems little theoretical difference between an Amazon Blink camera and a Flock ALPR. As described, they both use Amazon Web Services with one or more layers of encryption. Images and vehicle metadata are uploaded to the cloud, and made available for searching via the Flock customer API with their paid subscription service. Flock says its differentiator is in-camera image processing.

There are two clear customer tiers, law enforcement, and everyone else. Flock’s website marketing for homeowner’s associations is quite distinct from the presentations given to law enforcement audiences. Both types of customers have real, practical barriers to installing cameras in a community, and Flock provides more than just marketing materials and feel-good copy for the public relations problem.

Admirable in design, Transparency Portals allow customers to optionally and selectively publish their ALPR use policies, statistics, and search audit logs. About 100 of these can be found by web search.

A section of the Transparency Portal is called “External organizations with access”, which likely refers to any Flock customer that has been granted explicit access to another customer’s data. The pages themselves do no define exactly what this means.

These customers are enumerated mostly by name, but that means many law enforcement agencies included in the Transparency Pages can be pinned on the map.

There are approximately 18,000 state and local police agencies in the US, which puts Flock’s reach into about 15% of them. Ranking the top ten camera counts for law enforcement agencies with Transparency Portals shows:

Customer             Cameras
Flock - Admin            276
Shelby County TN SO      139
Vacaville CA PD          133
San Jose CA PD           128
Springfield IL PD         94
Vallejo CA PD             94
Tulsa OK PD               69
Baytown TX PD             58
Fairfield CA PD           56
Mooresville NC PD         52

The Flock - Admin page is very odd because it has copy referring to “Colton Police Department” but it would be odd for a city like Colton, CA with a population of only 54,000 to have 276 cameras installed.

Stranger, that Transparency Portal has some very odd “External organizations with access”:

Flock — Admin, Flock LE Training — Old, Flock Safety — Customer, Flock Safety — Engineering, Flock Safety — Ops, Flock Safety — Sales, Flock Safety Campus Security Training, Flock Safety HOA — External Testing 2, Flock Safety LE Training, Flock Safety PD — External Testing, External RTCC Demo Org, Graham’s Walkthrough Demo, Indiana LE Demo, Northeast LE Training — Demo, SchoolSafety Demo Org, Western PA Demo Agency

So, it seems like this is actually some sort of catchall administrative/test account, but now we’re left to wonder which 276 cameras would be connected to this account. Do any belong to law enforcement customers? How does this reflect on Flock’s security and transparency promises?

Oversharing

The organizations above are almost entirely law enforcement entities of some type, with some interesting exceptions. Notably, Shelby County Sheriff’s Office, which was at the top of the list of installed cameras, shares data with two unusual private organizations:

• FedEx Air Carrier PD, FedEx GSOC
• TN - Loeb Properties Inc - Security

Organizations with shared access include airport police, park police, university and school district police, railroad police, and miscellaneous organizations such as the following:

• Alabama Department of Revenue, Cal Fire, California Department of Insurance Fraud, Ector County Environmental Enforcement (TX), Fort Worth TX Code Compliance, Houston Arson Bureau TX, Houston Metro Transit Authority (TX), Illinois Gaming Board IL PD, Indiana Department of Corrections, Kansas Department of Labor KS, Michigan Department of Corrections (MDOC), Napa County (CA) Probation Department, Ohio Bureau of Workers’ Compensation (LE)

Some customers share their access with organizations clearly marked for testing, or non-production use.

• Sharing to “Flock Safety PD Test Org” - Champaign IL PD, Fairfield CA PD, San Jose CA PD, Wichita KS PD, Yakima WA PD
• Sharing to “Demo” - Lafayette CO PD, Costa Mesa CA PD
• Sharing to “Z Do not use” - Maple Bluff WI PD

Customers also share data with the organization “FBI”, such as the following.

• Lafayette CO PD, Costa Mesa CA PD, Hillsborough CA PD, Lafayette IN PD, Mansfield OH PD, Menifee CA PD, Michigan City IN PD, Oakley CA PD, Roselle IL PD , San Marino CA PD, Santa Clara CA PD, Shelby County TN SO, West Covina CA PD, Wichita KS PD, Woonsocket RI PD, Yakima WA PD

Some Transparency Portals offer a “search audit” log, with 30 days of customer search data. This data is limited, but shows key elements like how many searches are done against how many cameras, and “reason” — which is frequently just a case number.

Notable in this search audit log is some very large cameraCount numbers. Murrieta, CA PD only advertises that it has 34 cameras. Working backwards from the available data, Murrieta has only 418 cameras shared with it by other organizations that publish Transparency Pages.

However, Murrieta has audit records that assert 67,305 cameras were included in some searches. If this is accurate, then in some situations, some organizations can search what seems like every single camera Flock Safety has in the field.

Of the only 18 customers that publish search audit logs, four had searches in the last 30 days including more than 60,000 cameras.

Customer            High Count
Murrieta CA PD           67305
Santa Clara CA PD        66479
Wichita KS PD            63341
Wentzville MO PD         63188
Fairfield CA PD          10056
Oakley CA PD              9847

If the point of the Transparency Page is to bring confidence that this technology is not being regularly abused by customers, evidence of routine searches of the entire country for license plates by local law enforcement agencies undermines that point, and calls into question the narrative Flock Safety sells in its promises:

We build products and design systems with checks and balances to ensure the ethical use of our technology.

Upselling a Surveillance Ecosystem

Flock Safety isn’t just in this to sell ALPR cameras. Flock also entered the gunfire detection device market with a product called Raven. The cost of a Raven deployment is $35,000 a year per square mile, according to their marketing webinar.

Flock Safety also sells live video cameras, and hardware to add legacy and third party cameras which all integrate into FlockOS — the glue software for their hardware and subscription services. Flock also touts an integration with Axon mobile ALPR and body worn cameras.

Flock emphasizes the ability to detect a gunshot with Raven, capture video of the incident with Condor, then track fleeing vehicles with Falcon ALPR. This strategy supports the ideal “Real-Time Crime Center” to which law enforcement agencies seem to aspire.

Contrary Research describes one of Flock’s key business risks as an asset. Flock’s deterrent effect requires the growth of the network to remain useful, and will continue to push Flock into more and more communities.

Flock Safety has demonstrated success by reducing crime, but criminals could easily determine where cameras are located and, instead, commit crime away from where the devices are installed. This is a risk to Flock Safety in the sense that it may not fulfill its mission of solving crime if the product is just moving crime elsewhere instead of being deterred overall. However, it may also be an opportunity, as cities might feel that they are at more risk of criminal activity if neighboring cities have ALPR cameras and they don’t. The result of this could be a domino effect where cities that don’t have ALPR cameras now need them more, leading to more purchases for Flock Safety.

This push for more surveillance technology, more widely deployed, with better integration only heightens the need for Flock to deliver more security and more transparency at the same time, and perhaps focus less on improbable promises like this one:

In Summary

Flock Safety is contributing enormously to alarming growth of community surveillance that comes along with an apparent lack of public awareness the scale of this growth — driven by an inexpensive, maintenance-free subscription model.

One of the few real transparency mechanisms used to instill confidence in Flock is used only by a small percentage of law enforcement customers.

The web of data access expands well beyond what’s visible in the Transparency Portals, and so what’s shown in them is a fraction of the real nation-wide visibility Flock and its law enforcement customers have — 60,000+ cameras, each with 30 days of declared retention.

Management of production accounts looks sloppy — even by the standards of tech companies that don’t have a core privacy/security mission, and may represent a larger problem with cross-customer access controls, and the access Flock Safety employees themselves have.

Flock Safety may already be in your community. There’s a good chance you may not be aware unless you had your eyes peeled for its “discreet” technology. Hopefully now you’re a bit more prepared to ask questions and demand answers from your local leaders and law enforcement about Flock.

Flock Safety must be held accountable to its promises, and an unprecedented law enforcement surveillance boom should come with actual transparency, not what Flock Safety offers.

Follow for Part 2 looking at the technology Flock Safety uses.

Further Reading

• Fast-Growing Company Flock is Building a New AI-Driven Mass-Surveillance System
• Wichita moves to tighten access, increase oversight on secretive police surveillance program

What Exactly Does a Red Team Do?

On a Red Team, you’ll be emulating, simulating, or otherwise pretending to be a particular, set of, or your own theoretical threat actor(s). Activities are usually encapsulated into individual operations or exercises. The purpose of these are to train the Blue Team, which consists of groups or individuals who are responsible for various defense capabilities. This can be anything from application security to active defense.

There are as many kinds of Red Teams as there are organizations with Red Teams. Some are what we’d call a “half”, where a single person is only partly responsible for Red Team functions. Some do other offensive security tasks like penetration testing or vulnerability assessment. Some have numerous members with very well-defined roles, all distinct from other offensive security tasks in order to focus on detection and response.

As long as the capability of a Red Team is well matched to the capability of the organization’s Blue Team, you’re on track.

On the Attack Lifecycle

It’s important, first and foremost, to understand the attack lifecycle or cyber kill chain or just kill chain. This outline defines all the steps of how an attack might be carried out by a threat actor. Most of the Red Team operational work is executing on these steps, which are in service of a particular goal, often called “actions on the objective.”

Threat actors are usually classified by their motivations, such as making money with stolen payment data. All of the steps in an attack will eventually lead to this, and knowing this helps the Blue Team organize their defenses.

If you’d like to know more about the steps, called tactics (or tools), techniques, and procedures, review the MITRE ATT&CK Framework.

What Role Should I Choose?

There’s a spectrum of skills Red Teams can use to best organize their capabilities into roles, and no one right way to do this. It helps to logically group two different types of activities though, engineering and operations. This is a common strategy for all types of teams in technology.

Simply: Engineers build the tools, operators deploy and execute them.

Many teams create specific, often temporary, operator roles for individual operations. For example, one member can be sending out phishing emails, while the other is acting on incoming remote access as targets begin to execute the Red Team’s payloads.

How a Red Team distributes these skills across one or more team members is entirely a matter of taste, aptitude, training, and available talent. You should pick several of these to get up to speed on so you can be flexible when attempting to join small teams.

What Skills Should I Work On?

Easy! Pick relevant skills you find interesting, and that make you a better technical communicator. Try these on, and see how they fit…

Offensive Mindset

As a career in security grows, all of the ways the world is duct tape and bubblegum begin to reveal themselves. Most systems are designed only well enough to achieve the task for which they were designed. It will be your job to pick those systems apart, and poke at the gooey innards.

This is the skill which will get you through all of the tough problems.

Example: You have to open a lock for an operation, you use two hair pins instead of a key.

Skill Building: CTFs, wargames, or pen testing labs are a great way to exercise offensive mindset, such as PicoCTF, and Hack The Box. Look for groups doing live CTFs at local conferences. The real key here is to always question assumptions.

Penetration Testing

Under the banner of penetration testing lies a lot of what might be classified as vulnerability assessment, but for the sake of argument, let’s just describe it here as the process of hunting for known vulnerabilities on networks or hosts.

This responsibility may not lay primarily with the Red Team, but you’ll want to stay sharp on this topic. Taking opportunities to leverage a known vulnerability during an operation is good for training Blue Team incident response analysts.

Example: You scan for unauthenticated MongoDB instances for data which may be worthy of exfiltration.

Skill Building: Familiarize yourself with the existing automated vulnerability scanners available like Nessus or OpenVAS. Like offensive mindset, CTFs, wargames, or pen testing labs are also great for this.

Vulnerability Research

It’s not necessary, but often very helpful to have the ability to develop your own 0-days as a Red Team. These are unknown vulnerabilities in either third-party or in-house developed applications.

There is a lot of overlap here with penetration testing, but the key is that research time dedicated specifically for developing 0-days is expensive and may not improve your Blue Team from the perspective of detection and response enough to justify. Set your expectations accordingly.

Example: Your team finds that a particular in-house application would be very risky if exploited. Following this, you find an exploitable vulnerability, and write a proof of concept tool your team can leverage to achieve code execution.

Skill Building: Chew on one of the many blogs or books on application exploitation, such as Security Sift’s Introduction to Windows Exploit Development, or the Web Application Hacker’s Handbook by Dafydd Stuttard and Marcus Pinto.

Development

It cannot be stressed enough that the linchpin of a successful Red Team is in its development capabilities. The best Red Teams will be nearly indistinguishable from standard application product teams; adapting formal development methods, using version control and releases, setting roadmaps, using CI/CD techniques, writing tests. Most Red Teams do devops natively, if unknowingly.

You’ll find yourself writing code in numerous languages depending on the platforms and adversarial techniques you intend to use, and having to collaborate with others on that code.

Critical to this is understanding the minimum viable product (MVP). Get it working, get it documented. If it becomes a go-to tool in the future, spend more cycles on it later.

Example: Your operators need a way to search a host for sensitive files. To support them, you write a Python script that lists all potential private keys and spreadsheets.

Skill Building: There’s a vast array of methods for improving here, but there are also numerous books which focus on offensive use of programming languages, such as Black Hat Python: Python Programming for Hackers and Pentesters by Justin Seitz.

Infrastructure

Red Team operators can work best when the busy work of setting up and maintaining the command and control (C2) infrastructure they operate on is someone else’s problem.

This is where a reliable and repeatable infrastructure strategy shines. Using infrastructure automation and configuration management tools, you can iterate quickly and spend less time in the terminal.

Infrastructure-as-code should be an aspiration for Red Teams to limit the everyday tweaking and frustration of literally having to manage an entire infrastructure for a small team.

Example: Your reverse proxy should be configured to defend against nosy analysts, and this capability should be deployed automatically from a repository or container.

Skill Building: Try setting up a cloud-based network lab using free-tier AWS resources, and the automation tools they offer such as CloudFormation and OpsWorks. Review the Red Team Infrastructure Wiki by @bluscreenofjeff for processes optimized for Red Teams.

Networks and Systems

In the design and crafting of infrastructure, is all of the nuance required to maintain functional hosts and networks — reliably and securely. I can’t stress the securely enough.

These systems can be public or private cloud hosted, virtual machines on ESXi, physically or virtually networked. They’ll often be hacked together in weird ways to assure the attacker techniques you’re emulating work without much effort. You’ll need to be very comfortable with the command line.

Any familiarity with these topics will help you operate in the target environment as well.

Example: A typical first step once access to a target host is gained is to list running processes.

Skill Building: These skills can be augmented with the usual suspects, but practice things like setting up reverse proxies, firewalls, authentication. Try to set up a post-exploitation framework like Empire in your lab, and explore all of its features.

Reverse Engineering

Reverse engineering is process of analyzing something with the intent of figuring out how it works.

Reversing can be done to analyze in-the-wild malware (malware analysis), with the intent to emulate its functions, and the threat actors using it. You can find malware samples in various places to practice on, but be very careful in doing so.

You can also use this process understand how potentially exploitable applications function, with the intent of eventually finding an exploit for them.

Example: Say you want to execute code using unusual COM objects. You need to analyze, in bulk, Windows COM objects to find the ones which import the functions necessary to start processes.

Skill Building: You may get a kick out of learning how to use IDA Pro with The IDA Pro Book by Chris Eagle, or following @malwareunicorn’s excellent Reverse Engineering Malware 101.

Social Engineering

Since what we call initial access for threat actors so often involves schemes like phishing emails, it’s important to understand how people might be susceptible to a bamboozle.

There’s various applications of such social engineering in offensive work, like USB device drops and watering-hole attacks.

Using social engineering as part of actual Red Team operations with the intent of tricking unsuspecting users is also well within the realm of Red Team. Tricking people is optional though. You can skip the phishing part and use seeded access, or intentionally creating remote access to a specific host or hosts, to make your operations less time consuming.

This function is distinct from phishing assessments which are for end-user awareness measurement and training.

Example: You’re tasked by the intel team to create a convincing whale phish to test against your C-suite.

Skill Building: Check your spam folder for phishing samples, and try out @HackingDave’s Social Engineer Toolkit for the nuts and bolts.

Physical Security

Some Red Teams include physical within their scope of operations. This can be as simple as hiding a drop box somewhere on site, to a full on covert entry scenario. Don’t expect every organization to be excited about this. It’s a fun topic, but often not a risk organizations are interested in mitigating.

Example: Network jacks in the headquarters lobby are on the internal LAN, and you need to demonstrate an attack against them.

Skill Building: Lockpicking, security system bypassing, badge hacking, and social engineering confidence games are all fair game here.

Threat Intelligence

Red Teaming requires multiple sources of threat actor tactical intelligence. This feeds the threat actor emulation portion of your tactical bucket. You can add new capability to your tools and documentation, with a reference, like a blog post, to that threat actor.

Threat intelligence also ascertains the motives of threat actors, and the patterns of their behavior in a process known as threat actor tracking. Red Teams use this information to design the story or narrative behind their operations.

Threat intelligence can also come from more benign sources, like security researchers. Their work can not only be predictive of threat actor tactics, it can even influence them.

Example: You know a particular threat actor sends malicious macro-enabled Office documents which leverage WMI subscriptions while setting persistence, so you design a proof-of-concept to replicate that behavior.

Skill Building: Review lots of blog posts and reports about malware analysis and actor tracking.

Detection and Response

The Blue Team will be your primary customer and opponent. They are the experts in detection of events, and execution of incident response. Your Red Team will need to be able to predict the capabilities the Blue Team, and use that knowledge to operate in the environment.

Learning about defending an organization will make you more valuable to a Red Team than other offensive security practitioners.

Example: You know your Blue Team monitors Powershell-related logs, so when you design tools leveraging Poweshell, you have them invoke version 2 instead of the most recent version.

Skill Building: Set up Security Onion on your lab network, and host based monitoring tools like sysmon or auditd. Keep an eye on them while operating in your lab. You’ll start to see like a Blue Team. Review blogs about threat actor tactics that describe methods which are effective in prevention and detection.

Technical Writing

Communicating highly technical issues clearly and with a broad audience in mind is challenging, but the importance cannot be overstated.

Technical writing can be vital to delivering valuable reports to clients as a consultant.

Equally important is documenting the tools and processes your Red Team uses to operate. There’s so much information with regards to capabilities and the various functions, the only way to maintain situational awareness is to have complete and consistently updated documentation.

In planning, most teams will want to develop operation proposals, written to detail the risks and rewards of a particular Red Team operation for approval of management.

Be able to know who your customers are, put yourself in their position, and write so that audience can understand the story your team wants to tell. Avoid being verbose for the purpose of being verbose — save your team and your customer’s time with concise writing.

Example: For your operation proposals, you need to reassure stakeholders that you can operate safely and responsibly while executing, and describing what the outcomes should be.

Skill Building: This is a tricky muscle to exercise. You may want to consider a formal course on technical writing, like the one offered by Coursera. Write a blog post on a topic you’re familiar with, and ask some experienced acquaintances to review it for you.

Training and Debriefing

All of the above skills build upon your ability to deliver on the educational goals of the Red Team.

You should be able to use a Red Team operational report to deliver a short presentation (the debrief) on the narrative (description of the chain of events) to the primary Blue Team stakeholders. Doing this clearly, consistently, and without harsh judgment is how the Red Team shows its value to the larger organization, and maintains a positive relationship with the Blue Team.

You should also be able to encapsulate Red Team knowledge, and deliver it in an individual or group training environment. You share what you know about the subject, and people can ask questions in real-time instead of trying to learn through inference in your operations.

Example: Your Blue Team is having trouble analyzing tactics leveraging alternate data streams in Windows. You’d want to look at what you know about ADS, collect some threat actor tactics, and build that into a short deck you can use to present to a group of analysts.

Skill Building: Practice explaining a topic you’re familiar with, like in a blog post or to friends with an interest in security. If your public speaking needs tweaking, everyone recommends Toastmasters, or you can submit a talk to a small local conference.

Should I Go Internal?

Depends on what you want…

An external (consulting) Red Team gives you the opportunity to learn from a large selection of organizations. You’ll find the maturity, agility, and receptiveness to your input varies wildly between them. This is a great opportunity to learn about, and advance the state of your industry.

The work you do on a Red Team is designed to get you into and around inside nearly all of your clients. The feedback loop between you and the client’s defenders is usually superficial. You won’t get the opportunity to see how your client ticks, but it keeps you out of the politics and infighting of a business.

An internal (corporate) Red Team has opposing benefits. You can choose one of those maturity levels to dive into, get the narrow-but-deep view of an organization — which is very hard to get as a consultant.

You’ll get to experience all of the complexity that comes with being funded directly by a fully-functional business whose first priority is running a business, not information security. You’ll work side-by-side with defenders — incident responders, intelligence analysts, security engineers… and not only can you use their expertise to increase your skill as an attacker, you can use it to help you build better security organizations in the future.

You’ll make lots of compromises. You’ll grow along with many other people and functions in your organization. You’ll have a visible, measurable, and accountable impact on a system which protects important information.

Can You Wrap This Up?

Finding what piques your interest in offensive security is step one, and a variety of skills are important to effective Red Teaming, so there’s absolutely no shortage of paths to employment there. Figuring out how you want to impact organizations is also important. Your biggest challenge will be to find an organization that has a functioning Red Team that shares your values, and is willing to grow along with you.

Red Teams will hire based on previous offensive or (hopefully) defensive security experience. But what will make you stand out? Understanding what defenders need, and what their daily work looks like.

At the heart of Red Team is the challenging of assumptions. It’s looking critically at systems or humans, and asking, politely, “Why does it work that way, and can it be made better?”