Proton hosts map of 300,000 Flock surveillance devices that Flock tried to take down

Proton, the Swiss company behind Proton Mail and Proton VPN, is now hosting a public map of more than 300,000 devices installed by Flock Safety, the US maker of automatic license plate reader cameras. The map was built by security researcher Joshua Michael, who has faced a trademark complaint and a cease-and-desist letter from Flock since he published it in September. Proton describes the move as preserving access to a research project whose creator faces legal threats, CyberInsider reported on 23 October.

What the map shows

The map at proton.me lists more than 170,000 cameras and over 130,000 other Flock devices. Users can search by ZIP code to see which cameras are near them or along a route. Flock has publicly cited around 120,000 cameras, so Michael's inventory is about 40% larger than the company's own figure. Proton's page says Flock's network processes more than 20 billion vehicle reads a month across 49 states.

The data is a snapshot from December 2025, so cameras installed or removed since then are not shown. Unlike volunteer projects such as DeFlock, which rely on people reporting cameras they spot, this inventory came from Flock's own systems.

How the data got out

In November 2025, Michael found that Flock's website handed out an access token without any login, and that the token could be used to pull the location of every device. He reported the flaw, sent two follow-up emails when he got no answer, and archived the inventory in December. In a January blog post, Flock said it had "never been hacked" and that "there has not been a leak of Flock information", Straight Arrow News reported.

Michael published a 160-page research paper and the map on 23 September 2026. The next day, Doppel, a brand protection firm working for Flock, filed a trademark complaint over the use of the name "Flock Safety", although the site states it is not affiliated with or endorsed by the company. On 25 September Michael posted that Flock had sent him a cease-and-desist letter threatening litigation and told its customers it had notified law enforcement.

According to CyberInsider, Flock's notice to customers said it had closed the access path in December and initially found no sign of unauthorized access. After a further review in September, it identified anomalous activity involving the token but said there was no impact on customer data. Michael argues that the first finding shows Flock could not see who was accessing its systems. We covered his earlier research into the cameras in our article on the hacked Flock camera.

Why Swiss hosting matters

Proton's position, as summarized by Gadget Review, is that a foreign takedown demand has little practical force against content on Swiss servers unless a Swiss court order backs it. That is Proton's argument, not a ruling, and Flock has not said publicly whether it will pursue the company.

A city votes the same week

On the night of 22 October, the city council of New Bedford, Massachusetts, voted 8 to 3 to bar the city from operating license plate readers or renewing contracts for them, TurnTo10 reported. The cameras had been switched off since August, after two officers were accused of using them to track romantic partners. Mayor Jon Mitchell fired both officers the same day. He has 10 days to sign or veto the ordinance and has said a permanent ban "would make our city less safe", but eight votes are enough to override a veto. The sponsor, Councilor Shane Burgo, calls it a temporary measure until the council writes a permanent policy, The New Bedford Light reported. Flock's contract with the city expires on 12 November.

How far police can use Flock data is also being tested in court: in October a federal judge in Oklahoma ruled a warrantless search of the network unconstitutional.