An open-source project mapping Flock Safety ALPR license plate readers using WiGLE WiFi data and OUI fingerprinting research by @NitekryDPaul.
“Cameras Mapped” counts the 85,416 records that pass evidence classification, out of 146,526 published. How the tiers work →
Data: WiGLE | Map: © OpenStreetMap contributors | Last updated: —
An OUI match on its own is weak evidence — OUIs are assigned to chipset and
contract manufacturers, so unrelated hardware shares the same MAC space. Every
published record therefore carries a confidence field, and the map
and the headline count only the records that pass that classification.
| Confidence | What it means | Pin |
|---|---|---|
ssid_confirmed |
The SSID is a Flock naming pattern — Flock, Flock-XXXXXX, FLOCK-XXXXXX, Flock Camera net., FS Ext Battery. The strongest signal passive WiFi can give. |
green |
oui_high |
High-confidence Flock OUI, but the SSID is absent, hidden or unrecognised. Suspected — unverified. | red |
oui_mfr |
Contract-manufacturer OUI (Liteon/USI) that is also shipped in unrelated products. Weakest evidence — expect false positives. | amber |
identified_other |
The SSID positively identifies other hardware (ClickShare*, SMARTGATE_*, DIRECT-*, AndroidAP, or wardriving-tool verdict text stored in the SSID field). Hidden by default and excluded from the headline count. |
grey |
Records outside the primary US market carry "out_of_market": true.
They are flagged rather than deleted — Flock has expanded internationally — and
the map filter can hide them. None of this is a confirmation from Flock: every
record remains suspected. See the
data policy.
Automated License Plate Readers (ALPRs or LPRs) are AI-powered cameras that capture and analyze images of all passing vehicles, storing details like your car's location, date, and time. They also capture your car's make, model, color, and identifying features such as dents, roof racks, and bumper stickers — often turning these into searchable data points.
These cameras collect data on millions of vehicles regardless of whether the driver is suspected of a crime. Data is shared across thousands of law enforcement agencies nationwide, often without warrants, oversight, or transparency.
ALPRs track your movements and store data for extended periods, creating a detailed record of your location history without your knowledge or consent.
Data from ALPRs has led to wrongful arrests, racial profiling, and cases of officers stalking ex-partners. Once collected, there's little oversight.
No substantial evidence proves ALPRs effectively prevent crime. They ignore existing tools police already have, like cell phone location data with warrants.
Flock Safety is one of the largest ALPR vendors in the United States. Their cameras are installed for police departments, businesses, and HOAs. Captured vehicle data is uploaded to Flock's cloud system, where participating agencies can search and share information across jurisdictions — often secretly and without community approval.
This project identifies Flock cameras through their WiFi radio signatures. Every Flock camera has a WiFi transceiver that periodically wakes to upload data. These transmissions use MAC addresses with identifiable OUI (Organizationally Unique Identifier) prefixes — discovered through promiscuous-mode 2.4 GHz research by @NitekryDPaul.
These 39 OUI prefixes were identified by @NitekryDPaul through promiscuous-mode
analysis of Flock camera WiFi traffic. The 31st prefix (82:6B:F2) was contributed
by Michael / DeFlockJoplin during field testing. Prefix B4:1E:52
is Flock Safety's own IEEE registration, and the six-prefix
FS Ext Battery series (04:0D:84, F0:82:C0,
1C:34:F1, 38:5B:44, 94:34:69, B4:E3:F9)
came from dougborg/PR#39, along with E0:0A:F6.
The Vendor column is the IEEE registrant — usually Liteon, Silicon Labs, USI or Espressif rather than Flock Safety itself — and Signal is measured from the published records: mostly other means most of a prefix's records name different hardware, confirmed n% means that share carry a Flock SSID, and unverified means neither — an OUI match on those prefixes means little on its own.
| # | OUI Prefix | Tier | Vendor (IEEE) | Source | Cameras Found | SSID-confirmed | Signal |
|---|
The table below lists the ten most frequently observed SSID values across all WiGLE records matching a known Flock Safety OUI prefix. Most Flock cameras transmit a hidden SSID (empty broadcast), so these entries represent the minority of records where a network name was visible to WiGLE wardrive scanners. Published here as a reference for researchers and detection tool authors.
ClickShare and TEST are generic and may co-occupy the same MAC space.
Treat them as correlated observations, not confirmed Flock identifiers.
| # | SSID | Occurrences |
|---|---|---|
| 1 | Flock | 3,342 |
| 2 | SMARTGATE_123456 | 856 |
| 3 | AndroidAP | 314 |
| 4 | TEST | 295 |
| 5 | Compudopt Connect | 219 |
| 6 | ClickShare-Boardroom | 214 |
| 7 | ClickShare | 212 |
| 8 | ClickShare-Conference Room | 137 |
| 9 | Audi HUD | 137 |
| 10 | MAX-PRINTER | 133 |
Computed from 121,331 SSID-bearing records (109,873 unique values) across all 31 OUI files in
data/by_oui/. Stats update automatically after each scan.
Filtering the WiGLE dataset to only Flock*-prefixed SSIDs reveals
166 unique variants across 3,532 total records,
falling into five distinct naming patterns:
| Pattern | Unique SSIDs | Records | Description |
|---|---|---|---|
Flock |
1 | 3,342 | Bare name — fully configured / deployed cameras |
Flock-XXXXXX |
152 | 152 | Mixed-case with 6-char uppercase hex suffix (e.g. Flock-7EBB9D) |
FLOCK-XXXXXX |
5 | 5 | All-caps variant with 6-char hex suffix (e.g. FLOCK-215CB4) |
Flock-XXXX |
1 | 1 | Shorter 4-char hex suffix (Flock-6361) |
FlockXXX |
2 | 2 | Numeric suffix, no dash (Flock001, Flock003) |
Flock-XXXXXX / FLOCK-XXXXXX naming convention is consistent with
factory or pre-deployment SSIDs — each device appears to broadcast a unique hex
identifier (likely derived from its MAC address) before being claimed and configured through the
Flock Safety platform. Once provisioned, the SSID collapses to the bare Flock name.
Observing a Flock-XXXXXX SSID on a matching OUI prefix is a strong secondary
confirmation signal for an unconfigured or recently factory-reset Flock Safety camera.
Flock Camera net.Flock-* pattern searches.
The camera broadcast simultaneously on 2.4 GHz (ch. 1) and 5 GHz (ch. 157)
using sequential locally administered MACs (e.g. 52:64:CF:9F:A2:DE / :DF).
Locally administered addressing is likely a deliberate anti-fingerprinting measure —
these MACs will never match IEEE OUI lookups, making SSID-pattern detection the only viable
passive identification path for cameras using this scheme.
This table is populated automatically by querying WiGLE for SSIDs matching
Flock% / FLOCK% / FS Ext Battery%, then extracting OUI
prefixes from results that are not in the canonical OUI list. Only OUIs seen
≥5 times are shown to reduce false positives.
No candidate OUI prefixes have been identified yet via SSID-pattern queries. Any novel OUI seen ≥5 times in Flock-SSID-bearing WiGLE records will appear here automatically.
| OUI Prefix | Occurrences | Top SSIDs | Status |
|---|---|---|---|
| No candidate OUI prefixes yet — queries running incrementally. Prefixes seen ≥5 times will appear here. | |||
LAA-MAC camera class (Flock Camera net.): zero records. No published record has an SSID containing Flock Camera net., so the one camera class that defeats OUI matching entirely (locally-administered MACs — flock-you issue #43) currently has no coverage at all. This is a data gap, not a pattern gap: the Flock% pattern is a prefix match that already covers Flock Camera net., so the search is correct — either no wardrive has passed one of these cameras yet, or they broadcast a hidden SSID. If it stays at zero across several scans, the next widening step is %Camera net.% (any prefix before Camera), which trades precision for coverage.
Locally-administered (LAA) records: 23 — all from 82:6B:F2 (23). That prefix is a confirmed Flock OUI whose first octet happens to set the LAA bit, so it is not the anti-fingerprinting class; LAA-randomised cameras remain unrepresented.
FS Ext Battery pattern: 0 published record(s) carry an FS Ext Battery… SSID — the class the FS Ext Battery% discovery pattern was added for.
flock_ouis.csv.
Data files: ssid_candidate_cameras.geojson
·
ssid_candidate_cameras.csv
Flock cameras spend most of their duty cycle asleep, waking briefly to upload captured plate data. During these brief active windows, a real-time passive sniffer can detect them by watching for their MAC address appearing as the destination (addr1) in probe responses and data frames from nearby APs — even when the camera itself is not actively transmitting.
The addr1 technique — matching on the receiver address in addition to the transmitter — is @NitekryDPaul's key discovery. Combined with wildcard probe request detection (802.11 management frames type=0 subtype=4 with empty SSID), this yields a very tight signature that field-tested at 11 of 12 cameras caught with only 2 false positives in Joplin, MO.