Flock Exposed - Made in the USA?
The Claim Flock Used to Make
A Flock marketing brochure from 2023 described the company's cameras as "designed & manufactured in the U.S."
Source: Wired
By 2024, Flock's manufacturing partners were capable of producing 500 cameras a day, a ten-fold leap from several years prior, according to a person familiar with the matter.
Source: Wired
The Claim Flock Makes Today
Flock now reveals little about where its license plate readers are assembled, an answer that could carry geopolitical and cybersecurity implications.
Source: Wired
The company's current public statements and product documentation show a significant lack of detail concerning the final assembly of its ALPR units, in contrast to its earlier assertions about domestic manufacturing.
Source: Wired
The Supply Chain Trail
Import records reviewed by ImportGenius show Flock sourcing various components from Primax Electronics in Thailand.
Source: Wired, citing ImportGenius customs data
Primax is based in Taiwan but operates manufacturing facilities in China, Thailand and elsewhere. The company maintains production sites in Taiwan, China and Thailand and employs more than 10,000 people worldwide.
Source: Wired; Primax corporate disclosures
ImportGenius analyst Lynn Hughes, reviewing the shipment records, said: "My understanding is that these are components, but it looks like Primax manufactures whole security camera solutions."
Source: Wired
Why Assembly Location Matters
The origin of components and the location of final assembly can directly influence the potential for supply chain compromise, making the possibility of foreign involvement in the manufacture of sensitive surveillance technology a significant concern.
Source: Wired
These devices are installed by American police departments, photograph American drivers, and feed a nationwide database of vehicle movements. Who builds the hardware, and where, determines who may have had an opportunity to alter it.
The Security Record of the Hardware Itself
A Flock camera whose disk contents were dumped and examined was found to be running Android 8.1, a long out-of-support version of the operating system originally released in 2017, carrying known vulnerabilities that remain unpatched on that version.
Source: Hackaday, reporting on research by Micah Lee
The same examination found the devices contain a hard-coded, open-access API key that could be used by an outside party to reveal information from the system.
Source: Hackaday, reporting on research by Micah Lee
Independent security researcher Jon Gaines documented flaws granting root access to the devices with physical proximity. Flock acknowledged the flaws but maintained that footage remained safe because it moves quickly to the cloud.
Source: WebProNews
An independent vulnerability assessment compiling this research concluded that the Flock network operates with a "Critical Risk" posture, characterized by systemic security engineering failures, exposure to advanced persistent threats of foreign origin, and hardware supply chain exposure.
Source: Vulnerability Assessment and Intelligence Estimate of the Flock Safety Surveillance Network, Ali Gundogar
What a Foreign Adversary Could Reach
Security researchers have noted that the exposure documented in this research meant hostile nation-states had potential access to police vehicle locations, officer identities, surveillance camera placements, and emergency response patterns.
Source: SimeonOnSecurity, summarizing the GainSec white paper findings
This is the part that is easy to miss. The cameras do not only watch the public. Police vehicles pass these same cameras every shift. A database that records where every car in town goes is also a database that records where every patrol car in town goes, and from that a foreign intelligence service can reconstruct patrol routes, shift changes, response times, and which officers work which beats.
In November 2025, cybersecurity firm Hudson Rock provided lawmakers with data showing that at least 35 Flock customer account passwords had been stolen by hackers and were circulating in criminal networks.
Source: TechCrunch; Hudson Rock data as cited by lawmakers
Independent researcher Benn Jordan shared screenshots of a Russian cybercrime forum offering direct access to Flock accounts for sale.
Source: TechCrunch; Senator Ron Wyden letter to the Federal Trade Commission, November 3, 2025
Flock did not enable multi-factor authentication by default until November 2024, and then only for new customers, according to a letter from the company's chief legal officer, Dan Haley.
Source: TechCrunch
Members of Congress have asked the Federal Trade Commission to investigate Flock's security practices, warning that billions of license plate records have been left exposed.
Source: Senator Ron Wyden letter to the Federal Trade Commission, November 3, 2025
What Flock Says in Response
Flock has stated that none of the vulnerabilities detailed in the white paper have an impact on its customers' ability to carry out their public safety objectives, that a device shown in one researcher's video was on factory settings without Flock's security software enabled, and that the company would be alerted if a camera were physically accessed.
Source: Flock Safety statements, as reported by Truthout
Readers should weigh that response on its merits. Note what it does not address: it speaks to the company's own security software and cloud storage, not to who manufactures the hardware or where final assembly occurs.
The Bottom Line
A company that once advertised its cameras as American-made now declines to say where they are assembled, while customs records point to a Taiwanese supplier with plants in China. Those same cameras have been found running a years-old unsupported operating system with a hard-coded access key, and stolen logins to the national network have turned up for sale on Russian cybercrime forums. Town officials signing these contracts are rarely told any of it.
Questions to Ask Your Town
What is the make, model, and country of final assembly of every camera under contract in our town?
What has the vendor committed to in writing about firmware updates and support for hardware that reaches end-of-life?
Is multi-factor authentication required on every account in our police department, with no exceptions?
Who is accountable if login credentials tied to our town's cameras end up for sale on a foreign cybercrime forum?
This page will be updated as more factual sources become available.