Somebody pulled a Flock camera off a pole. Page 32 of Michigan's contract says what happens to what was inside it.

Yesterday morning 404 Media published what hackers found inside a Flock Safety license plate reader. Joseph Cox wrote it with Dhruv Mehrotra of WIRED. Somebody took the camera off a pole, copied what was on it, and handed them the files.

I never touched those files. I read the reporting, and then I put it next to the Michigan contracts that were already sitting on my desk. 3 things lined up.

The video is the 3 minute version. Everything below it is what would not fit in 3 minutes.

Housekeeping. This one runs long. It goes in this order: the numbers first, then the 3 findings, then a correction I owe you from yesterday, then the parts of this that cut against me, then where every document came from. And if you hit reply, I read it. Replies are the only number in this whole operation that beehiiv cannot show me. Of all the replies I get, my newsletter subscribers are my favorite to hear from - you guys are the real ones. If you know someone who might enjoy it, consider sending it to them.

1 camera, in 1 location, over roughly 21 days of recovered logs. Do not multiply any of this by a town.

404 Media and WIRED report that the camera photographed roughly 50,200 vehicles and generated about 1.6 million images across those logging periods. On a typical day it logged around 3,300 vehicles, with a high of 4,454. A typical passing vehicle generated about 28 images, though some produced more than 100. The recovered storage held 27,321 short video clips. WIRED ran detection models across those 27,321 clips and found people in 11 of them, all of them riding motorcycles. About every 2 minutes, code on the camera checked that the camera was still running and logged the message "Who's a good boy?!", and more than 12,000 of those messages appear in the recovered logs. The same logs recorded more than 27,000 "no space left on device" errors while the camera tried to save full resolution images.

The State of Michigan's Flock Safety contract, MA250000000832, runs 172 pages, and the phrase "machine learning" appears in it exactly 1 time, on page 32. That page gives Flock Safety the right to anonymize State Data to use for the services "including the training of machine learning algorithms," and in the next sentence Michigan grants a "non-exclusive, worldwide, perpetual, royalty-free right to use and distribute" that anonymized data.

Superseded, do not cite: 1 line from my video of September 16, 2026, corrected in the table below. Every other figure in this issue is current as of today.

The reporting is careful here, and it should be. The camera "does not appear to read the plate or identify the vehicle's make, model, and color," 404 Media writes, and that "appears to happen on Flock's servers." So what comes off the pole is images, roughly 28 of them per car, sent "to Flock over the cellular network" in the article's words, to servers where the reading happens.

Page 32 of MA250000000832 says, in section 21.2, that "State Data is and will remain the sole and exclusive property of the State and all right, title, and interest in the same is reserved by the State." Section 21.3(d), on the same page, says Flock Safety must "not use, sell, rent, transfer, mine, distribute, commercially exploit, or otherwise disclose or make available State Data for Contractor's own purposes."

The next paragraph down, same page, is the one I keep coming back to. Michigan "hereby grants Contractor a non-exclusive, worldwide, perpetual, royalty-free right to use and distribute such Anonymized Data to improve and enhance the Services and for other development, diagnostic and corrective purposes, and other Contractor offerings." The sentence before it names what the anonymizing is for, "including the training of machine learning algorithms."

1 page. Michigan holds the data, Flock Safety may not mine it, Flock Safety may anonymize it for training, and Michigan grants a perpetual license to distribute the anonymized version. Now put 28 pictures a car underneath that license and read it again.

Flock Safety published a plain English guide to data ownership at flocksafety.com/legal/data-ownership, last updated August 21, 2026. I read that guide on August 27, 2026 and counted: "machine learning" appears 0 times in it, and "anonymized" appears 0 times in it.

404 Media reports that the software running on the device "explicitly detects people as well as vehicles, license plates, and bicycles," and that when it spots a person it records where in the image that person appears and how confident it is.

I hold Michigan order forms for these cameras. The Kalamazoo Department of Public Safety's 2025 agreement with Flock Safety came to me under the Michigan Freedom of Information Act, MCL 15.231, at no charge, and another Michigan department's order form, signed in August 2025, came to me from a collaborator. 5 pages each, same product table in both. The line item reads: "Law enforcement grade infrastructure-free (solar power + LTE) license plate recognition camera with Vehicle Fingerprint (TM) technology (proprietary machine learning software) and real-time alerts for unlimited users."

So a phrase that appears 1 time in 172 pages of the state contract is printed in the product description on both of those order forms, in the sentence that names what a department is buying.

In early 2025 a security researcher reverse engineered one of these cameras and documented flaws that could give root access. Flock Safety's reply then, as the article recounts it, was that someone who gained access to a camera "would still not be able to gain access to footage," because images remained on the device only briefly after being transmitted to the cloud.

On the camera that came off the pole, there were 27,321 video clips.

404 Media reports that the hackers "were able to copy the camera's storage and recover an encryption key stored on the device, which unlocked videos of thousands of vehicle detections."

Flock Safety's response to the teardown was that "the unauthorized removal and tampering of a Flock camera is illegal," which it is. The company also said no report came through its disclosure process, and that it does "not have enough detail to assess the claims being made." Nothing in that response disputes a finding.

The video says the order forms call the thing a license plate recognition camera, and that the product description sits on the same page as the price. The camera part is right. The page part is wrong.

The point survives the correction, because a buyer reading either document sees "proprietary machine learning software" in the description of what they are buying.

It is 1 camera, on 1 road, for about 21 days. 404 Media says plainly that those figures "would vary considerably depending on where a camera is installed." Nobody should take 1.6 million images and multiply it by the number of cameras in a town.

There is no facial recognition in there. WIRED and 404 Media looked, and they report finding "no evidence of any face-recognition capabilities in the camera's software beyond ones included by default in the Android operating system." Anyone running with this as proof of face recognition is going to be wrong by tomorrow.

The 11 clips with people in them were motorcyclists, on a road, in front of a camera pointed at a road. The detector found what went past it.

I am not a lawyer and I do not know what any of this means in a courtroom. I know what page 32 says, and now I know more about what it is sitting on top of.

1. "Hackers Stole Flock's Camera Software, Revealing How the Company Tracks Cars and People," 404 Media, published September 16, 2026, by Joseph Cox and Dhruv Mehrotra. Read and captured September 16, 2026, re-checked September 17, 2026 with no correction or update note on the article. Every figure attributed to the reporting in this issue comes from that article. 404media.co

2. State of Michigan contract MA250000000832, Flock Safety, 172 pages. Obtained from Michigan DTMB Central Procurement Services under the Michigan Freedom of Information Act, MCL 15.231, at no charge. Sections 21.2, 21.3(d) and the Anonymized Data paragraph quoted here are all on page 32. Text re-extracted and re-counted from the PDF on September 17, 2026.

3. Kalamazoo Department of Public Safety, 2025 agreement with Flock Safety, 5 pages. Obtained from the Kalamazoo Department of Public Safety under the Michigan Freedom of Information Act, MCL 15.231, at no charge, delivered July 8, 2026. Pricing table page 2, product description page 4.

4. Another Michigan police department's Flock Safety order form, signed August 26, 2025, 5 pages, received from a collaborator. Pricing pages 2 and 3, product description page 4.

5. "Data Ownership, A Plain-English Guide to Data Ownership Under the Flock Customer Terms and Conditions," flocksafety.com/legal/data-ownership, last updated August 21, 2026. Read and counted from the raw page text on August 27, 2026.

None of these documents are posted on my site right now. If the work is worth something to you, there is a donate page at donate.magneticnorse.com. The records fees come out of my pocket first and get paid back second, or not at all.