Quick Answer: Proton's public Flock surveillance map plots more than 300,000 devices across the United States, including over 170,000 cameras. The data comes from company records obtained by researcher Joshua Michael, not from volunteer sightings. Because it's a December 2025 snapshot, it shows a historical inventory rather than today's installations.
Most people who hear that a map tracks 300,000 surveillance devices assume volunteers spent months walking streets and photographing poles. This one didn't. The Flock surveillance map Proton is hosting was built from an inventory pulled out of Flock Safety's own systems, and that origin changes what it tells you, what it misses, and why the company is now threatening the person who made it. Here's what the data actually shows, and how to use it without overreading it.
What the Flock Surveillance Map Actually Contains
According to CyberInsider, the map includes more than 170,000 cameras and over 130,000 other devices. Those devices belong to Flock Safety, whose products include automated license plate readers (ALPRs) used by police departments and private customers.
The systems don't check whether a driver is suspected of anything. They record passing vehicles and create searchable records of plates, locations, and timestamps. Vehicle characteristics such as make, color, and body type can also help identify a car even when the plate isn't readable. That's the detail most coverage skips, and it's the reason a location inventory matters beyond a single camera.
Proton, the Swiss company behind Proton Mail and Proton VPN, is hosting the map as a way for the public to inspect Flock's footprint. Think of it as a public reference rather than an enforcement tool.
Where the Data Came From and Why It Matters
The source of this inventory is the most important fact about the map. Researcher Joshua Michael found that, in November 2025, an access token could be obtained without logging in and used to retrieve device-location information. He reported the exposure to Flock and archived the inventory in December.
That's a different kind of dataset from most public surveillance maps. Here's the practical difference:
- Company records capture every device the vendor has registered, including ones volunteers would never spot.
- Volunteer sightings capture only what someone physically noticed and bothered to report.
- Hybrid efforts combine both, but inherit the blind spots of each.
Because the Michael inventory comes from internal records, it's likely to be more complete than a crowdsourced project for the period it covers. Completeness isn't the same as currency, though, and that's where most readers will go wrong.
Company Records vs. Crowdsourced Maps: A Trade-Off
The two approaches answer different questions. The table below compares them on the dimensions that matter if you're deciding how much to trust a given map.
| Dimension | Michael inventory (hosted by Proton) | DeFlock (crowdsourced) |
|---|---|---|
| Data origin | Flock's internal records, obtained via exposed access token | Sightings submitted by volunteers |
| Reported scale | 300,000+ devices (170,000+ cameras, 130,000+ other) | Limited to what volunteers have reported |
| Snapshot date | December 2025 | Varies with each submission |
| Main weakness | Frozen in time; installs and removals after December 2025 won't appear | Coverage depends on where volunteers go |
The trade-off is clear. A company-sourced snapshot gives you breadth at one moment. A crowdsourced map gives you on-the-ground confirmation, but with gaps. If you want the most complete picture, you'd need to use both and check where they disagree.
The Legal Fight Behind the Map
The dispute didn't end with the original disclosure. In a September 25 update, Michael said Flock had sent him a cease-and-desist letter threatening litigation and had told customers it had notified law enforcement.
Flock's account in that notice is worth reading carefully. The company said it investigated the exposed token, closed the access path, and initially found no evidence of unauthorized access. After further investigation in September, it identified anomalous activity involving the token. Its forensic review, however, found no impact on customer data.
Michael's argument is that the first finding shows a weakness in Flock's ability to detect access, not just a one-off mistake. Both claims can be true at once: no customer data was affected, and the company's first read was still wrong. For you, the lesson is that a vendor's "no impact" statement is a conclusion, not a verified audit. Ask for the forensic methodology if it matters to you.
Why Snapshot Data Is a Starting Point, Not a Live Feed
Here's where most guides go wrong. They tell you to open the map, search your street, and conclude whether cameras are watching you. That advice is incomplete, and in some cases misleading.
Proton warns that the map reflects a December 2025 snapshot. Any installation or removal after that date won't show up. Cameras placed after December may be missing, and those taken down may still appear. Neither error is visible on the map itself.
The second caveat is less obvious. Because the data came from a company system, it reflects what Flock recorded, not necessarily what agencies have deployed or how they've configured the devices. A location in a database tells you a device was registered there. It doesn't tell you how it's used, how long it retains vehicle records, or who can search them.
So treat the map as a historical inventory. It's a strong reference for understanding the scale of the network and a weak one for confirming what's on your block today.
Civic Participation and the Surveillance Debate
The story also has a civil-liberties dimension. In a separate report, 404 Media revealed that California's Orange County Intelligence Assessment Center had circulated a July bulletin warning police about people attending city council meetings to oppose Flock's technology.
The bulletin acknowledged that no specific, credible threats had been identified. It nonetheless urged officers to watch for suspicious behavior such as unusual questions and loitering. It also listed media attendance, livestreaming, and emotional exchanges among potential public safety concerns. The center said its reporting recognized constitutional protections for speech and assembly.
That's a real tension. Ordinary public comment at a council meeting is now being framed within a threat-assessment model, even without evidence of threat. If you attend these meetings, know that your participation can be logged, and that the framing matters as much as the content.
How to Use the Map to Ask Better Questions
The most useful thing the map offers is a list of questions to bring to your local government. Rather than arguing from a dot on a screen, you can ask for specifics. Start with these:
- Where do cameras operate, and are the locations public?
- How long do vehicle records get retained?
- Which agencies, including out-of-jurisdiction ones, can access the data?
- How are searches audited, and who reviews them?
- Does the contract allow sharing with private customers?
Bring the map's device count and the December 2025 date to the meeting. Asking "Your agency's cameras appear in this inventory. Can you confirm the current list?" is far harder to dismiss than a general complaint.
Frequently Asked Questions
What is the Flock surveillance map?
The Flock surveillance map is a public database hosted by Proton that shows more than 300,000 Flock Safety devices across the United States, including over 170,000 cameras. It was built from an inventory researcher Joshua Michael obtained from Flock's systems. It reflects a December 2025 snapshot, so later installations and removals won't appear.
How do I find Flock cameras in my area?
Search the map for your city or ZIP code to see recorded device locations as of December 2025. For current information, file a public records request or ask your city council or police department for a current list of ALPR locations. Cross-check with volunteer-driven projects such as DeFlock to catch anything the snapshot missed.
What is an automated license plate reader?
An automated license plate reader is a camera system that captures images of passing vehicles and converts plates into searchable data with time and location. Unlike targeted enforcement cameras, these systems record vehicles regardless of whether drivers are suspected of an offense, which is why they're controversial.
Why does the Flock map show data from December 2025?
The inventory was archived in December 2025, when Michael saved it after reporting the exposed access token to Flock. Proton is hosting that frozen copy. Any devices installed or removed afterward won't appear, so the map is best used as a historical reference.
Is the Flock surveillance map complete?
No, and it's not meant to be. It's more complete than crowdsourced maps for the period it covers, because it comes from company records. However, it's a single snapshot and can't show changes since December 2025, so treat it as a baseline rather than a current inventory.
Final Takeaway
The Flock surveillance map is most valuable as evidence of scale and as a list of questions for your local government. Its strength is that it comes from company records, and its weakness is that it stops in December 2025. Pull up the map this week, find your city, and write down the one question you'd ask your council about camera retention. Pass this to someone who's wrestling with how their city uses license plate data.