A Camera Records. An Officer Responds.
On Monday, September 21, I joined Lars Larson on the nationally syndicated Lars Larson Show to talk about a story that broke the week before. A group physically removed a roadside license plate reader camera, opened it up, and pulled three weeks of data off the device.
The headline number is enormous. The lesson underneath it has nothing to do with the number.
What actually happened
404 Media reported that a group calling itself stegan0gram obtained a Flock Safety camera that had been taken off its pole. On the device they found an encryption key stored on the camera's media partition. That key opened the partition holding the media files.
From that one camera they recovered roughly 1.6 million images and 27,321 short video clips covering 21 days, with detections of about 50,200 vehicles and 11 people.
Flock has said images are only briefly stored on its cameras before being forwarded to company servers, and that exploiting the device requires physical access. The second part is correct. The first part is what three weeks of recovered footage called into question.
Be precise about the rest of it, because the scary version is not the true version. What they got came off one camera. Nobody reached the wider network. Overstating a breach damages your own credibility and accomplishes nothing else.
Physical access is logical access
That is the whole finding, and it is older than any of this hardware.
A device mounted outdoors, unattended, on public right-of-way is physically reachable. That is a design assumption, not a surprise. Somebody put hands on the thing and it handed over its own key. That is the equivalent of writing your password down and taping it under your keyboard, then telling yourself the bank account is safe.
If somebody can walk up to the device, the device is in play. Every protection that matters has to live on the other side of that assumption.
The second problem is that the method is now public. Whoever wants to try it on the camera around the corner from their house does not have to work it out. They have a playbook.
The people already inside
Everyone is focused on the outsiders. That is not where the exposure sits.
An outside attacker has to defeat something. A person with credentialed access does not. They log in, the way they are supposed to, and unless somebody is auditing the searches nobody knows what was pulled or why.
In August, a month before any of this, Flock announced that officers would have to enter a code tying every search to a specific case before running it, and that all law enforcement customers would be moved onto an audit tool built to flag abnormal search behavior. Both are due by January 1. Read that as what it is: a description of the controls that were not there before.
Access control without audit is not access control. It is a list of names.
Retention and audit are the argument
Flock, Ring, Blink, whatever is on the pole. The camera does what it was built to do. It records everything it sees. Arguing with that is arguing with a lens.
The two questions that decide whether a camera program is defensible are how long the data is kept and who audits the searches.
In that same August announcement, Flock cut its standard retention window from thirty days to seven. That is the right direction and it is not the end of the argument, because a recommended default is not a cap. The agency running the cameras still sets its own window, and the vendor's suggestion is not a constraint on the customer who wants longer.
There is no reason to hold a record of every one of us driving across town for weeks on end. Most of these crimes get reported quickly. The investigative value of a plate record falls off long before a long retention window closes.
Retention policy is boring, and it is the entire argument.
What this means if you own or manage property
Cameras are on your property, on the street outside it, or both. Three things worth settling this quarter:
Know the retention window on every system that covers your property, and who is allowed to search it. If you cannot answer that from memory, nobody is auditing it.
Put it in writing. A one-page policy naming the retention period, who may run a search, and what has to be logged is enough. It is also the document you will want if anyone ever asks.
Understand what the footage is for. A camera produces a record of what already happened. It is evidence. It is not response.
That last one is the part people buy backwards. A camera does not walk a resident to her door at nine at night, challenge a vehicle at a jobsite gate, or notice that the same description showed up twice in six weeks. Those are different jobs, and buying one does not get you the other.
We don't post warm bodies. We deploy trained officers behind a real threat assessment. If you want to know what officer coverage looks like alongside the cameras you already have, that is what our patrol and guard services do.
More segments and interview clips are on the media page.
Thirteen Alpha Solutions LLC · TX DPS Class C License #C31017501
4364 Western Center Blvd #2105, Fort Worth, TX 76137
SDVOSB certified · TALI member · Insured and bonded
