What Flock’s Data Exposure Revealed About Amador County

When did the Flock data exposure occur?

The underlying security issue dates to November 2025. In September 2026 reporting on a customer notice, Flock said an individual reported an exposed map access key in November 2025, that Flock validated the finding, eliminated the vulnerability, and closed the issue in December 2025. Flock said that at the time it saw no indication of unauthorized data access. After the device-location website became public in September 2026, Flock told customers it had become apparent that data had been accessed and retained.

In that customer communication, Flock described a “security incident” and said the data had been “unlawfully accessed and exfiltrated from a third-party map service.” Flock said no images, video, or sensitive law-enforcement data were exposed, and said the information was limited to device name, location, and device type. It also said the dataset included planned, decommissioned, in-service, and integrated cameras plus other Flock device types.

Read the Sept. 29 WFSB report quoting Flock’s customer notice and statement ↗

What FlockSurveillance.org contains

The public research site currently reports 335,701 total device records. That figure is not a count of 335,701 license-plate cameras: the site’s own device-type breakdown includes Falcon LPR, Picard compute devices, Wing PTZ, Raven audio sensors, Condor trailers, drones, gateways, and other categories. The Amador screenshots in this archive likewise include a Wing PTZ and show Picard devices colocated with some Falcons.

Open FlockSurveillance.org ↗

ACSO’s ten-device sequence can now be reconstructed

The exposed records show a continuous ACSO-style F#001 through F#010 sequence. Eight are marked ACTIVE and two are marked PLANNED. That pattern matches the County’s ten-camera contract context and the later Flock email stating that two locations remained to install. The sequence does not by itself prove when each camera was installed or whether the planned records remain current today.

The two planned entries are F#008 at Highway 88/Ridge Road and F#009 at Highway 49/Electra Road. Importantly, those two locations were not secret: ACSO’s 2025 CEQA Notice of Exemption publicly listed both exact sites and essentially identical coordinates. What the exposed dataset adds is the internal-style F# numbering and snapshot status tying them into the ten-record sequence.

Four planned Sutter Creek locations appear to fill a public-detail gap

A City of Sutter Creek manager report publicly stated that the County was requesting to put Flock cameras in Sutter Creek. In the public City and County material reviewed for this report, the Project did not locate a preexisting disclosure of the four exact proposed sites shown in the exposed data:

• Golden Chain Hwy @ Sutter Ione Rd NB
• Gopher Flat Rd @ Main St SB
• Gopher Flat Rd @ Main St WB
• Bowers Rd @ Ridge Rd NB

All four are marked PLANNED and all four show the same “Created” timestamp of November 7, 2025 at 18:05 UTC. Because the public export redacts organization and network IDs, the records do not independently prove which Flock customer owned the batch. The City record provides the County-request context; the exact sites come from the exposed dataset.

Open the Sutter Creek City Manager report ↗

Eight planned Ione-area records remain unexplained

The screenshot set contains eight PLANNED Falcon entries around Ione, all showing March 26, 2024 at 18:02 UTC in the “Created” field. Searches of City of Ione materials and general public sources did not locate a Flock/ALPR record tying these exact sites to a specific public agency or private organization. The numbering shown is #01, #02, #04, #05, #06, #07, #09 and #10; because #03 and #08 are absent from the captured set, this report does not assume the eight screenshots represent a complete deployment.

Operator unresolved: the public export explicitly redacts organizationId, networkId, networkExternalId, externalId and parentExternalId, so the map panels alone do not establish whether these records belonged to the City of Ione, Amador County, another public agency, or a private customer.

Private and community devices

Two active entries are labeled CA #2335 and “Garden Center” / “Main Entrance.” Lowe’s official site identifies its Martell/Jackson location at 12071 Industry Boulevard as Store #2335, making the store attribution strong. This does not establish that ACSO had access to those cameras; the focused CPRA request specifically sought records of access to private cameras, including Lowe’s, and the County responded that it had not identified responsive records.

Lowe’s Store #2335 ↗ · ACSO private-camera request and response →

The Zinfandel Parkway entry is also not treated as exposure-only. A Plymouth City Council packet preserved a resident’s public comment stating that PRA records showed a February 2024 Flock encroachment permit for cameras contracted by the Zinfandel Ridge Homeowners Association. That is a secondary description within an official City packet, not the permit itself, so the report labels the attribution accordingly.

Open Plymouth City Council packet ↗

The Gayla Drive entry appears private/community-oriented by its naming and location, but its operator is left unresolved because no independently verified Flock ownership record was located.

The Pine Grove Wing PTZ matches a public Caltrans camera

The exposed entry named “133 - EB SR 88 Pine Grove” is a Wing PTZ, not a Falcon LPR. Caltrans’ public streaming-camera list contains the exact camera name “EB SR 88 Pine Grove” in Amador County. The match supports treating this as a state highway video-camera/integration record rather than an ACSO Falcon location.

Caltrans streaming-video list ↗

What does the “livestream” flag mean?

Every ACTIVE Falcon screenshot captured for this report displays a livestream feature alongside readsLicensePlates and supportsVehicleDescriptionAlerts. The exposed metadata does not define that field. Flock’s January 2026 public security post says its LPRs capture point-in-time images and do not track vehicles continuously. Accordingly, this report preserves the livestream flag as exposed metadata but does not treat it as proof that a Falcon provides continuous live video or that ACSO has live-video viewing enabled.

Complete Amador device inventory captured from the exposure

The table below records the 27 primary device panels supplied to the Project. Colocated Picard records shown inside some panels are not counted as separate roadside cameras because FlockSurveillance.org itself describes Picard as typically being the compute box for a colocated device.

Important limitations

• Snapshot, not current inventory: ACTIVE and PLANNED describe the exposed snapshot, not necessarily the present-day state of a device.
• “Created” is not treated as an installation date: unrelated records share identical timestamps, so the field may represent backend record creation, import, or another event.
• Private-camera sharing is not proven: organization and network identifiers were redacted, so the screenshots do not establish which private cameras ACSO could search or access.
• Planned does not mean installed: a planned record may have been moved, cancelled, replaced, or never built.
• Nonfinding is not proof of secrecy: where this report says a prior public disclosure was not located, it means one was not found in the public sources reviewed, not that no such record can exist.

Source archive and methodology

The 27 screenshots are preserved as crop-only archival derivatives. The surrounding map background and rounded outer edges were removed for consistent presentation; the device-panel content was not redrawn or altered. A machine-readable manifest records the original filename, published filename, SHA-256 hashes, dimensions and crop operation.