# The Cameras That Watch Everything Have a Blind Spot — and Someone Just Found It
Flock Safety has quietly built one of the largest vehicle surveillance networks in American history. Tens of thousands of cameras mounted on utility poles and suburban streets, feeding license plate reads into a shared database that law enforcement agencies can query in real time. The company's pitch is simple: make crime easier to solve. The civil liberties objection is equally simple: that's a lot of power to hand to a commercial vendor with no meaningful judicial oversight.
A researcher just handed both sides of that debate new ammunition.
## What the Researcher Actually Did
The technique isn't new in principle — adversarial machine learning has been an active research area for nearly a decade. What's notable here is the target. A security researcher demonstrated that specially designed computer-generated patterns, when applied to a vehicle, can prevent Flock's AI-powered license plate readers from detecting the car at all. Not just obscuring the plate. The vehicle itself becomes effectively invisible to the detection system.
Adversarial attacks work by exploiting the gap between how humans and neural networks perceive images. A pattern that looks like random noise or abstract art to a person can catastrophically confuse the feature extraction layers of a convolutional neural network. The model doesn't "see" what it expects to see, so it stops seeing anything at all — or misclassifies it entirely.
The key word in the researcher's framing is "invisible." Flock cameras don't just read plates; they log vehicle make, model, color, and direction of travel. The system builds a motion history. If you can defeat the object detection layer, you fall out of the database entirely — no plate read, no vehicle log, no alert trigger.
## Flock's Footprint Is Bigger Than Most People Realize
Before dismissing this as academic, consider the scale of what's being defeated. Flock Safety claims to work with over 5,000 law enforcement agencies across the United States. Their cameras generate billions of plate reads annually. Several cities have entered agreements where Flock cameras are installed in residential neighborhoods at no upfront cost — the company retains the data. Some departments have signed contracts requiring them to query the Flock network before conducting certain investigations.
This isn't niche surveillance infrastructure. It's becoming the default backbone for vehicle tracking in American law enforcement, and it's built on computer vision models that can apparently be defeated with a well-crafted sticker.
The attack surface matters. A system embedded in thousands of jurisdictions, queried by hundreds of thousands of officers, used to establish probable cause and track suspects — its failure mode isn't academic. It's operational.
## Who Benefits and Who Doesn't
This is where the story gets genuinely uncomfortable, because the people who benefit from this research sit on opposite ends of the political spectrum.
Civil liberties advocates and privacy researchers have spent years arguing that mass license plate surveillance creates a dragnet that catches innocent people alongside criminals, enables domestic abuse through stalker husbands with cop connections, and disproportionately subjects Black and Brown neighborhoods to monitoring. They'll see this research as proof that the technology isn't the invincible panopticon its vendors market — and perhaps as inspiration.
Law enforcement agencies and Flock's commercial clients will see it differently: a threat to a tool they've come to depend on, potentially being weaponized by organized crime, human traffickers, and anyone else with a reason to move vehicles undetected.
Both reactions are correct. That tension is the story.
## The Adversarial Patch Isn't Theoretical
It's worth being precise about what this attack requires in practice. Adversarial patches for physical-world deployment — as opposed to digital images — have to survive real-world conditions: varying lighting, angles, distances, motion blur, weather. Early adversarial patch research worked beautifully in controlled lab settings and fell apart when researchers tried to deploy it in parking lots.
The gap between "works in a paper" and "works on a highway at 60 mph in rain" has historically been wide. The researcher's claim is that computer-generated patterns can "successfully prevent" detection — the details of testing conditions, patch size, application method, and environmental variation matter enormously for assessing how serious this actually is in practice.
But Flock's cameras are typically static, mounted at fixed heights, with relatively consistent geometry. That's actually a more favorable attack environment than, say, defeating a mobile dashcam or a body-worn camera. A fixed camera with known position parameters makes it easier to engineer a patch that remains adversarial across the relevant angle range.
The operational difficulty is real but not insurmountable. And the research pointing the way exists publicly now.
## What Flock Should Do — and Probably Won't
Robust defenses against adversarial attacks exist in the academic literature: adversarial training (including adversarial examples in the training set), input preprocessing, ensemble detection across multiple model architectures, and anomaly detection that flags inputs that look "too unusual" for a vehicle. Certified defenses with provable robustness guarantees have advanced significantly in recent years.
The problem is that implementing these defenses requires retraining models, updating firmware across thousands of deployed cameras, and accepting some degradation in normal detection performance. None of that is cheap or fast, and Flock's incentive structure rewards rapid deployment over defensive depth.
The company will almost certainly patch its models. The question is timeline, and whether the update actually closes the attack or just raises the bar slightly.
---
## HackWire Analysis
This story is a Rorschach test for how you feel about commercial surveillance infrastructure, and that's precisely why it's significant beyond the technical details.
The adversarial ML technique isn't surprising to anyone who follows computer vision security research — physical-world adversarial attacks have been a known class since at least 2017, when researchers demonstrated stop sign misclassification that fooled autonomous vehicle systems. What's changed is the target's societal weight. Defeating a research prototype is academic. Defeating a surveillance network embedded in thousands of US cities with commercial contracts and law enforcement dependency is something else.
The deeper problem Flock faces isn't this specific attack. It's that their entire value proposition rests on a black-box AI system that departments don't understand, can't audit, and have integrated into workflows that assume it's reliable. Every adversarial attack demonstration against a widely-deployed system creates the same crisis of confidence: if this fails this way, what else fails? What are the false positive rates in practice? What happens when someone spoofs a plate into the database to frame someone, rather than remove a vehicle from it?
The other thing missing from most coverage of this story: the attack is inherently asymmetric. Deploying adversarial countermeasures requires technical knowledge, materials, and deliberate effort. Most people who might benefit from evading surveillance — immigrants, domestic abuse survivors, political dissidents — don't have those resources. The people who do have those resources tend to be exactly who law enforcement actually worries about most. Sophisticated adversarial evasion isn't going to be a tool for the vulnerable; it'll be a tool for organized actors. That inversion is uncomfortable for both the "this helps criminals" and "this helps privacy" narratives.
Defenders relying on Flock data for critical enforcement decisions should treat this as a reminder: single-vendor AI surveillance infrastructure with no redundancy is a single point of failure. Corroborate it.
— HackWire Editorial
---
## Related Coverage