Police AI Tools: What Corporate Security Teams Should Learn from Flock’s Code Leak

Police AI Tools: What Corporate Security Teams Should Learn from Flock’s Code Leak

A police AI tool just had its code exposed—if you’re using off-the-shelf AI, how sure are you about what’s running behind the scenes? For many small and medium-sized businesses, especially those in accounting and insurance, the convenience of ready-made AI tools is hard to pass up. But Flock Safety’s recent code leak should give every business security team pause. At MyPCFriends Cybersecurity, we believe in being trustworthy, reliable, and friendly guides through the sometimes-murky waters of modern IT. Let’s break down what happened, why it matters, and how you can protect your business from similar risks.

What Happened with Flock Safety’s AI Tool?

Flock Safety, a company specializing in surveillance tech for law enforcement, developed an AI system called Nightshift—recently rebranded as OS Investigate. This tool allows police to search massive databases (license plates, arrest records, ballistics, and more) using natural language prompts. In theory, it’s a powerful aid for investigations.

But in early 2024, reporters at WIRED obtained over 450 code files for OS Investigate. These files weren’t stolen by hackers—they were served publicly from Flock’s own login pages, no privileged access required. With this code, journalists and independent researchers reconstructed the product’s interface, its search tools, and even the 69 pre-written prompts police could use to query sensitive data [WIRED].

The AI’s reach was sweeping: it could access 45 different internal tools, pulling data from license plate scans, case files, ballistics, and even commercial databases holding Social Security numbers, birth dates, emails, and known associates [WIRED]. This wasn’t just theoretical—an independent security researcher and a privacy advocacy group both confirmed the exposure and were able to reconstruct the tool’s capabilities [Maryville Privacy].

Flock’s response? The company denied any data breach, called the exposures “configuration errors,” and insisted that no customer data was leaked [Flock Safety Blog]. But when you look closer, the story isn’t so reassuring.

The Real-World Risks Hidden in Off-the-Shelf AI

The Flock incident wasn’t just a one-off mistake. It revealed a pattern of security lapses that should make any business rethink their approach to AI and third-party tools.

Exposed Credentials and Public Data Endpoints

A security researcher found a default ArcGIS API key embedded in Flock’s public JavaScript bundles. This key granted access to about 50 private surveillance data layers—no restrictions by IP, referrer, or origin. Anyone, anywhere, could use it. Worse, this key appeared in 53 separate places across Flock’s front-end code [Nexanet Blog].

Publicly Accessible Camera Feeds

A PBS investigation revealed that a YouTuber accessed over 60 Flock video feeds simply by finding exposed admin interfaces through a commercial search engine. These weren’t deep technical hacks—just poor configuration. Flock said these cameras were mistakenly set as public-facing and fixed within 48 hours, but the exposure was real [PBS].

Hardware Vulnerabilities

Researchers who bought a Flock camera found they could access its controls by pressing a button three times and using a common Android diagnostic tool. With a firmware password (which was discoverable), they could upload, download, or delete footage [The Guardian].

Over-Broad Data Sharing

Flock’s cameras connect via cellular networks to a cloud database. There are toggles for “national lookup” and “statewide lookup,” controlling whether police can query data across agencies. Audits and legal filings showed these toggles were often enabled without city knowledge, letting law enforcement nationwide access locally collected data. This led at least 53 cities to cancel their contracts with Flock, even as the company hit 100,000 cameras deployed [TechTimes].

Why Should SMB Security Teams Care?

You might think: “We’re not running a surveillance network for police. How does this relate to our accounting or insurance business?” Here’s the connection:

• Most off-the-shelf AI tools are black boxes. You rarely see the code or know exactly what data they access.
• Credentials, API keys, and access controls are often embedded or configured by third parties. If they’re exposed, your data could be at risk.
• Misconfigurations—whether in cloud platforms, APIs, or hardware—can expose sensitive information without anyone noticing until it’s too late.

If a company specializing in security technology can make these mistakes, so can anyone. The difference is, when it happens to a business handling financial or personal data, the regulatory and reputational fallout can be severe.

What to Learn: How to Spot Similar Risks in Your Stack

At MyPCFriends Cybersecurity, we support SMBs with managed IT and zero-trust security, so we see firsthand how these risks play out in business environments. Here’s what your corporate security team should do—based on lessons from the Flock code leak.

1. Scrutinize Your AI Supply Chain

Start with a full inventory of every AI-powered tool and service in use. For each, ask:

• Who built it? Are they transparent about their security practices?
• What data does the tool access—directly or via integrations?
• Can you review the code, or at least demand an independent security audit?

Don’t assume that because a product is popular or “enterprise-grade” that it’s safe. Flock’s tools were used by hundreds of police departments before these exposures came to light [TechTimes].

2. Audit for Embedded Credentials and API Keys

One of the most glaring issues at Flock was the hardcoded API key, found in dozens of places in public-facing code [Nexanet Blog]. In your own stack:

• Use automated tools to scan for embedded credentials in code and configuration files.
• Require vendors to rotate keys regularly and restrict their usage by IP, referrer, or origin.
• Never allow long-lived credentials in client-side code.

This isn’t just a technical detail—it’s a basic hygiene step that prevents outsiders from accessing internal data.

3. Demand Transparency on Data Flows and Access Controls

The Flock case showed how toggles for broad data sharing were enabled without customer knowledge [TechTimes]. For any AI or SaaS vendor you use:

• Get a clear, written description of what data is collected, where it’s stored, and who can access it.
• Ask if there are any “hidden” features or toggles that could grant wider access than you intend.
• Review audit logs regularly for unusual data queries or access patterns.

If a vendor can’t answer these questions clearly, reconsider the relationship.

4. Insist on Strong Authentication and Access Management

Lawmakers warned that stolen police logins were exposing Flock cameras to hackers [TechCrunch]. Flock only enabled multi-factor authentication (MFA) by default for new customers starting November 2024. Even then, only 97% of law enforcement customers had MFA enabled [TechCrunch].

For your business:

• Enforce MFA for all users—no exceptions.
• Regularly review and remove unused accounts, especially admin or integration accounts.
• Monitor for signs of credential theft or suspicious logins.

5. Don’t Accept “Configuration Error” as an Excuse

Flock’s leadership repeatedly framed exposures as minor mistakes, fixed quickly, with no harm done [Flock Safety Blog]. But independent researchers and city audits found systemic issues—misconfigurations, exposed credentials, and hardware flaws that allowed broad unauthorized access [Nexanet Blog][TechTimes]. If a vendor’s answer to a security issue is “it was just a configuration problem,” ask for evidence:

• What controls are in place to prevent similar errors?
• How do they monitor and alert on configuration changes?
• Are there independent audits or penetration tests?

A trustworthy provider will welcome these questions.

How We Help—And What You Can Do Next

At MyPCFriends Cybersecurity, we work with accounting firms, insurance providers, and other SMBs to bring reliable, friendly expertise to cybersecurity. Our managed IT support and helpdesk, AIPS (AI Powered Solutions), and compliance services are all designed to give you confidence—without the surprises that come from black-box tech.

When you choose or review an AI tool, ask us to help with:

• Vendor risk assessments
• Credential and API key audits
• Data flow mapping and access reviews
• Ongoing monitoring for misconfigurations and suspicious activity

We believe every SMB deserves the same vigilance as the big players—without losing the personal touch.

The Takeaway: Don’t Wait for a Code Leak

Flock Safety’s AI code leak wasn’t just a technical slip. It was a warning: even the most security-focused vendors can make mistakes that put sensitive data at risk. For SMBs, the lesson is clear—scrutinize your supply chain, audit your tools, and don’t take vendor assurances at face value.

If you have questions about your own AI stack, or want help reviewing your security posture, reach out. And for ongoing insights like this, follow us!