Flock Safety Condor PTZ Cameras Left Live Streams and Archives Open to the Public Internet Without Authentication

A source is testimony, not proof. Citing one is a provenance fact — it records who said what, where — and never a verification that the claim is true.

Who is named

The characters and things this document talks about — 4 in alls. Each links to everything else the record knows about them.

Claims made

Every claim in this document. Firsthand = asserted on its own basis; secondhand = recounted from elsewhere, carrying no independent weight.

• Condor PTZ cameras stream live video and store 30‑day archives while exposing diagnostic and administrative interfaces.

  At the core the hardware streams live video and stores 30‑day archives while exposing diagnostic and administrative interfaces.

  Condor PTZ camera

  Untested — nothing else bears on it yet

• Flock Safety deploys Condor PTZ cameras under municipal public‑safety contracts across the United States.

  The company deploys them under municipal public‑safety contracts across the United States.

  Condor PTZ camera Flock Safety

  Untested — nothing else bears on it yet

• The dual‑use architecture permits unauthenticated public access when network configuration fails, granting live viewing, archive download, and control‑panel functions to anyone who locates the endpoints.

  The dual‑use vector is the same architecture that enables remote monitoring by authorized agencies also permits unauthenticated public access when network configuration fails, granting live viewing, archive download, and control‑panel functions to anyone who locates the endpoints.

  Condor PTZ camera

  Untested — nothing else bears on it yet

• Researchers using Shodan located and entered at least sixty live feeds and control panels.

  gaps that allowed researchers using Shodan to locate and enter at least sixty live feeds and control panels.

  Untested — nothing else bears on it yet

• In December 2025, at least sixty Condor cameras across multiple states, including Bakersfield, California, streamed without passwords for a period measured in days to weeks.

  In December 2025 at least sixty Condor cameras across multiple states, including Bakersfield, California, streamed without passwords for a period measured in days to weeks.

  Bakersfield, California Condor PTZ camera

  Untested — nothing else bears on it yet

• Flock described the event as a limited carrier‑network misconfiguration rather than a system compromise.

  Flock described the event as a limited carrier‑network misconfiguration rather than a system compromise.

  Flock Safety

  Untested — nothing else bears on it yet

• Legislative questioning in West Virginia in August 2026 elicited the same “never been hacked” phrasing while lawmakers noted the answers left residual concern about safeguards.

  Legislative questioning in West Virginia in August 2026 elicited the same “never been hacked” phrasing while lawmakers noted the answers left residual concern about safeguards.

  West Virginia

  Untested — nothing else bears on it yet

• Flock markets the systems as secure public‑safety tools that have never been hacked.

  Flock markets the systems as secure public‑safety tools that have never been hacked.

  Flock Safety

  Untested — nothing else bears on it yet

• Structural flaws include placement of diagnostic interfaces on publicly reachable cellular networks and the absence of mandatory authentication on those interfaces.

  Structural flaws include placement of diagnostic interfaces on publicly reachable cellular networks and the absence of mandatory authentication on those interfaces, gaps that allowed researchers using Shodan to locate and enter at least sixty live feeds and control panels.

  Condor PTZ camera

  Untested — nothing else bears on it yet

• Oversight gaps persist because Flock defines “hack” narrowly to exclude hardware exposure of live and archived footage, and municipal contracts rarely require independent verification of edge‑device security.

  Oversight gaps persist because Flock defines “hack” narrowly to exclude hardware exposure of live and archived footage, and municipal contracts rarely require independent verification of edge‑device security.

  Flock Safety

  Untested — nothing else bears on it yet

• Independent checks against open‑source device search engines remain the primary available detection method.

  Independent checks against open‑source device search engines remain the primary available detection method.

  Untested — nothing else bears on it yet

No claims match this filter.

What it cost

Reading this document into the graph cost <$0.01.

11 claims in all. Content fingerprint 70ab149c991a… — the document's text itself is not republished here; follow the link above to read it at its source.