Securityflock safetylicense plate readerssurveillanceprotonsecurity research
Flock sent researcher Joshua Michael a cease-and-desist, and now Proton hosts his map of 170,000 Flock cameras
A researcher pulled Flock's own device list through an access token its servers handed out without a login, mapped it, and got a cease-and-desist and a 'malicious actor' email to Flock's customers. Proton now runs the map, searchable by ZIP code.
In November 2025, Michael found that Flock’s servers handed out an access token to anyone who asked, without logging in, and that the token could pull device-location information. He reported it to Flock and archived the inventory in December, according to CyberInsider. His site lists the result, published September 23, 2026: a 160-page paper called “Never Hacked” on four security failures he says he found and reported in Flock’s platform, with the map beside it. He writes that he “often got little or no response” when he reported them.
Two days later, on September 25, he posted that Flock had sent him a cease-and-desist letter threatening litigation. In an email to its customers, he writes, Flock “branded me a malicious actor” and said it had notified law enforcement. He posted the letter and the notice on his site.
That notice cuts both ways. CyberInsider’s read of it: Flock said it investigated the token, closed the access path and at first found no evidence of unauthorized access. After looking again in September, it found anomalous activity involving the token but said its forensic review showed no impact on customer data. Michael argues the first finding is the problem, because a company that couldn’t see his access in December may not see anyone else’s either.
Proton’s page lets anyone type a ZIP code and see the Flock devices in the dataset nearby. Proton says it hosts only the map view and doesn’t host or distribute the underlying dataset. It frames the map around misuse: Flock says its network processes more than 20 billion vehicle reads a month across 49 states, and a Washington Post review found at least 50 officers accused or charged with misusing license plate readers, with Flock’s system involved in 46 of those cases. Proton says it asked Flock CEO Garrett Langley how the company responds to misuse and who controls the data.
The data is a December 2025 snapshot. Cameras installed or pulled since then aren’t on it, and Proton says so on the page.
What’s in the cease-and-desist beyond the threat to sue hasn’t been reported anywhere but Michael’s own site.
A researcher who reports a hole and gets a lawyer in return is a story the security world has seen many times, and it almost always goes the same way. The threat brings more attention to the research than the research ever got alone. Companies send the letter anyway because, from inside, the person who found the flaw looks like the threat and the flaw looks like a solved ticket.
The harder question is what “solved” means for a company whose product is a record of where people drive. Closing a token is the easy part. Knowing whether anyone else used it before you closed it takes logs, and Flock’s own notice moved from “no evidence” in December to “anomalous activity” in September. That’s like a bank saying the vault was never opened, then finding a set of footprints nine months later.