An open-source project mapping Flock Safety ALPR license plate readers using WiGLE WiFi data and OUI fingerprinting research by @NitekryDPaul.
Data: WiGLE | Map: © OpenStreetMap contributors | Last updated: —
Automated License Plate Readers (ALPRs or LPRs) are AI-powered cameras that capture and analyze images of all passing vehicles, storing details like your car's location, date, and time. They also capture your car's make, model, color, and identifying features such as dents, roof racks, and bumper stickers — often turning these into searchable data points.
These cameras collect data on millions of vehicles regardless of whether the driver is suspected of a crime. Data is shared across thousands of law enforcement agencies nationwide, often without warrants, oversight, or transparency.
ALPRs track your movements and store data for extended periods, creating a detailed record of your location history without your knowledge or consent.
Data from ALPRs has led to wrongful arrests, racial profiling, and cases of officers stalking ex-partners. Once collected, there's little oversight.
No substantial evidence proves ALPRs effectively prevent crime. They ignore existing tools police already have, like cell phone location data with warrants.
Flock Safety is one of the largest ALPR vendors in the United States. Their cameras are installed for police departments, businesses, and HOAs. Captured vehicle data is uploaded to Flock's cloud system, where participating agencies can search and share information across jurisdictions — often secretly and without community approval.
This project identifies Flock cameras through their WiFi radio signatures. Every Flock camera has a WiFi transceiver that periodically wakes to upload data. These transmissions use MAC addresses with identifiable OUI (Organizationally Unique Identifier) prefixes — discovered through promiscuous-mode 2.4 GHz research by @NitekryDPaul.
These 31 OUI prefixes were identified by @NitekryDPaul through promiscuous-mode
analysis of Flock camera WiFi traffic. The 31st prefix (82:6B:F2) was contributed
by Michael / DeFlockJoplin during field testing.
| # | OUI Prefix | Source | Cameras Found |
|---|
Flock cameras spend most of their duty cycle asleep, waking briefly to upload captured plate data. During these brief active windows, a real-time passive sniffer can detect them by watching for their MAC address appearing as the destination (addr1) in probe responses and data frames from nearby APs — even when the camera itself is not actively transmitting.
The addr1 technique — matching on the receiver address in addition to the transmitter — is @NitekryDPaul's key discovery. Combined with wildcard probe request detection (802.11 management frames type=0 subtype=4 with empty SSID), this yields a very tight signature that field-tested at 11 of 12 cameras caught with only 2 false positives in Joplin, MO.