Proton hosts map of 300,000 Flock devices amid legal threats

Proton is hosting a public map showing more than 300,000 Flock surveillance devices across the United States, preserving access to a research project whose creator faces legal threats and intimidation.

The map draws on an inventory obtained by cybersecurity researcher Joshua Michael from Flock’s own systems. According to Proton, it includes more than 170,000 cameras and over 130,000 other devices.

In November 2025, Michael discovered that an access token could be obtained without logging in and used to retrieve device-location information. He reported the exposure to Flock and archived the inventory in December. His website dates the release of his formal research paper and surveillance map to September 23, 2026.

Proton, the Swiss company behind Proton Mail and Proton VPN, is offering another way to inspect Flock Safety’s footprint, whose automated license plate readers are used by police and private customers. The systems record passing vehicles regardless of whether their drivers are suspected of an offense, creating searchable records of plates, locations, and timestamps. Vehicle characteristics can also help identify cars without a readable plate.

Unlike crowdsourced projects such as DeFlock, Michael’s inventory comes from company records rather than sightings submitted by volunteers. However, Proton warns that the map reflects a December 2025 snapshot: subsequent installations and removals will not appear.

Proton

Security research draws legal threats

The dispute extends beyond the original security disclosure. In a September 25 update, Michael said Flock had sent him a cease-and-desist letter threatening litigation and told customers it had notified law enforcement.

In that notice, Flock said it had investigated the exposed token, closed the access path, and initially found no evidence of unauthorized access. Following further investigation in September, it identified anomalous activity involving the token but said its forensic review found no impact on customer data. Michael argues that the initial finding illustrates shortcomings in the company’s ability to detect access.

Growing scrutiny on Flock opponents

Earlier this week, 404 Media reported that California’s Orange County Intelligence Assessment Center had circulated a bulletin warning police about people attending city council meetings to oppose the surveillance technology.

Although it acknowledged that no specific, credible threats had been identified, the July bulletin urged officers to watch for suspicious behavior, including unusual questions and loitering. It also listed media attendance, livestreaming, and emotional exchanges among potential public safety concerns, bringing ordinary civic participation into a police threat-assessment framework. The center said its reporting supported safety planning and recognized constitutional protections for speech and assembly.

For residents, the map offers a starting point for asking local authorities where cameras operate, how long they retain vehicle records, which agencies can access them, and how they audit searches. Its age and coverage limitations mean it should be treated as a historical inventory rather than a complete picture of surveillance on today’s roads.