WTF WHAT THE FLOCK
- Started
- Last post
- 2 Responses
- autoflavour0
you lost me at 2:38 mins..
like who even has time to make that, let alone watch it- 2 hours and 38 mins..
i struggle with 2mins 38 secondsautoflavour - thismilfhunter
- and it starts with AI slop figures..milfhunter
- 2 hours and 38 mins..
- kingsteven1
Agree autoflavor, I built a YouTube Triage plugin with Claude that sends the transcript of YouTube videos to Claude - this one actually does look decent @"40–50 minutes of substance". It usually reports "1 minute of substance inside a ~2h38m runtime" :D
TITLE
Flock Whistleblower: I Hacked 280,000 Police Cameras in 30 Seconds—I'll Probably Go to Jail For This
A Cybersecurity Researcher Explains a Real Flock API Flaw, Then Spends an Hour Speculating About Epstein, Palantir, and the End of NationsWHAT IT IS
Jack Neil interviews Joshua Michael, a self-described cybersecurity researcher and founder of privacy firm Nexonet, about vulnerabilities he found in Flock Safety's license-plate-reader/surveillanc... network. It's a long-form monologue-heavy podcast interview: technical disclosure for roughly the first half, sliding into geopolitics, conspiracy theory, and personal philosophy for the second.VERDICT
Roughly 40–50 minutes of substance inside a ~2h38m runtime — skim (jump to the vulnerability disclosure and the reachability-analysis sections, skip the last third).WHAT'S NEW
He says he found a hardcoded default API key (tied to ArcGIS) exposed 53 times, giving access to data across 5,000 police departments, 6,000 private communities, and 1,000 businesses (~36:45–40:00).
Flock's dev subdomains allegedly authenticated at the wrong layer, exposing client-side source code before login (~42:50–44:00).
Claims planner.flocksafety.com / dev-planner.flocksafety.com let anyone re-mint a fresh production API token for every device location in the US (~44:15–46:00).
Says he found and downloaded Flock Nova's source code via an exposed demo domain (~47:40).
On Dec 14, 2025, he claims to have exfiltrated every device location in Flock's network multiple times as an undisclosed test — and Flock has since claimed publicly, three times, that they've never been hacked (~58:35–1:00:15).
Cites 280,000 active cameras (335,000 including decommissioned), 20 billion license plate reads/month, and an average of 3.17–3.7 camera passes per person daily (~16:50–17:05).
Describes Aerodome, a ~400-drone program flown at 400ft (above the altitude where they're audible) for "drone as first responder" alerts (~18:00).
Says Flock Nova uses mobile advertising IDs (MAIDs) to get persistent location tracking without the warrant normally required for cell tower tracking (~26:55–27:20).
Claims a reachability analysis of 22 sites found near-zero odds of reaching them without camera detection — Eglin AFB ~8%, FBI HQ 0%, Coronado ~10% (~1:03:55–1:04:30).
Describes "Raven," Flock's always-on gunshot-detection microphone product (~21:27).HEDGES AND ADMISSIONS
"I may be citing this one improperly" — the pregnancy-pamphlet anecdote (~29:43).
Asked if intelligence officers were identifiable in the data: "I did not [check]... could someone have done that? More than certainly" (speculation, not observation) (~52:44).
On Flock/intelligence ties: "I'm not aware of any direct intelligence ties but I've also not researched it" (~1:11:14).
On predictive-policing/genetics claim: "I don't know where the heck I saw this. I may just be making up" (~2:05:17).
On GM/Kia selling location data to insurers: "I can't be certain though" (~2:00:26).
Refuses to discuss anything specific about Epstein, calling it his "dead man switch" — no actual claims given (~1:46:40).BEING SOLD
Cape (privacy-focused mobile carrier), code "jack133," ~19:38–20:15.
Nexonet, his own privacy/intelligence firm, ~55:04–55:47.
Data Minimal, the consumer version of Nexonet, ~55:53–56:12.ALREADY KNOWN
Data brokers sell personal information; social media algorithms optimize for engagement; VPN quality varies widely; license plate readers exist and are controversial; smart speakers raise privacy concerns.STATED WITHOUT SUPPORT
Suggests the repeated API key exposure might have been "intentional," citing only the CEO's manner and a vague mention of Chinese investors (~1:13:19).
A story about a political campaign using location data to suppress Nevada votes, sourced only to an unnamed friend (~1:31:22).
"Most crimes are solved through... data exhaust," attributed to an unnamed acquaintance "over a bottle of wine" (~2:11:09).
Extended claims about a coming "one world order," religious identity as the basis for elite coordination, and tribalism as biological destiny — presented as near-certainty with no sourcing.
Flat claim that treason convictions result in death — stated as simple fact without qualification.DOES THE FRAMING HOLD
The title's "hacked 280,000 cameras in 30 seconds" oversells a process the transcript itself describes as four separate incidents unfolding over roughly six months, not one fast breach. The core technical claim — an exposed API key/token flow that Flock allegedly never fully fixed, sitting alongside their public "never been hacked" statements — is specific and falsifiable, and the reachability-analysis data point is the strongest piece of original material here. But the video's implicit promise (a documented whistleblower exposé) frays badly in its second half, where claims about Epstein, Palantir-as-blackmail-network, and civilizational prophecy are offered with the same confidence as the technical findings but with none of the same grounding.