An open-source project mapping Flock Safety ALPR license plate readers using WiGLE WiFi data and OUI fingerprinting research by @NitekryDPaul.
Data: WiGLE | Map: © OpenStreetMap contributors | Last updated: —
Automated License Plate Readers (ALPRs or LPRs) are AI-powered cameras that capture and analyze images of all passing vehicles, storing details like your car's location, date, and time. They also capture your car's make, model, color, and identifying features such as dents, roof racks, and bumper stickers — often turning these into searchable data points.
These cameras collect data on millions of vehicles regardless of whether the driver is suspected of a crime. Data is shared across thousands of law enforcement agencies nationwide, often without warrants, oversight, or transparency.
ALPRs track your movements and store data for extended periods, creating a detailed record of your location history without your knowledge or consent.
Data from ALPRs has led to wrongful arrests, racial profiling, and cases of officers stalking ex-partners. Once collected, there's little oversight.
No substantial evidence proves ALPRs effectively prevent crime. They ignore existing tools police already have, like cell phone location data with warrants.
Flock Safety is one of the largest ALPR vendors in the United States. Their cameras are installed for police departments, businesses, and HOAs. Captured vehicle data is uploaded to Flock's cloud system, where participating agencies can search and share information across jurisdictions — often secretly and without community approval.
This project identifies Flock cameras through their WiFi radio signatures. Every Flock camera has a WiFi transceiver that periodically wakes to upload data. These transmissions use MAC addresses with identifiable OUI (Organizationally Unique Identifier) prefixes — discovered through promiscuous-mode 2.4 GHz research by @NitekryDPaul.
These 31 OUI prefixes were identified by @NitekryDPaul through promiscuous-mode
analysis of Flock camera WiFi traffic. The 31st prefix (82:6B:F2) was contributed
by Michael / DeFlockJoplin during field testing.
| # | OUI Prefix | Source | Cameras Found |
|---|
The table below lists the ten most frequently observed SSID values across all WiGLE records matching a known Flock Safety OUI prefix. Most Flock cameras transmit a hidden SSID (empty broadcast), so these entries represent the minority of records where a network name was visible to WiGLE wardrive scanners. Published here as a reference for researchers and detection tool authors.
ClickShare and TEST are generic and may co-occupy the same MAC space.
Treat them as correlated observations, not confirmed Flock identifiers.
| # | SSID | Occurrences |
|---|---|---|
| 1 | Flock | 2,603 |
| 2 | SMARTGATE_123456 | 859 |
| 3 | AndroidAP | 321 |
| 4 | TEST | 297 |
| 5 | Compudopt Connect | 220 |
| 6 | ClickShare | 211 |
| 7 | ClickShare-Boardroom | 211 |
| 8 | ClickShare-Conference Room | 137 |
| 9 | Audi HUD | 130 |
| 10 | Afsol Wifi | 127 |
Computed from 119,151 SSID-bearing records (108,596 unique values) across all 31 OUI files in
data/by_oui/. Stats update automatically after each scan.
Filtering the WiGLE dataset to only Flock*-prefixed SSIDs reveals
157 unique variants across 2,760 total records,
falling into five distinct naming patterns:
| Pattern | Unique SSIDs | Records | Description |
|---|---|---|---|
Flock |
1 | 2,603 | Bare name — fully configured / deployed cameras |
Flock-XXXXXX |
146 | 146 | Mixed-case with 6-char uppercase hex suffix (e.g. Flock-7EBB9D) |
FLOCK-XXXXXX |
5 | 5 | All-caps variant with 6-char hex suffix (e.g. FLOCK-215CB4) |
Flock-XXXX |
1 | 1 | Shorter 4-char hex suffix (Flock-6361) |
FlockXXX |
2 | 2 | Numeric suffix, no dash (Flock001, Flock003) |
Flock-XXXXXX / FLOCK-XXXXXX naming convention is consistent with
factory or pre-deployment SSIDs — each device appears to broadcast a unique hex
identifier (likely derived from its MAC address) before being claimed and configured through the
Flock Safety platform. Once provisioned, the SSID collapses to the bare Flock name.
Observing a Flock-XXXXXX SSID on a matching OUI prefix is a strong secondary
confirmation signal for an unconfigured or recently factory-reset Flock Safety camera.
Flock Camera net.Flock-* pattern searches.
The camera broadcast simultaneously on 2.4 GHz (ch. 1) and 5 GHz (ch. 157)
using sequential locally administered MACs (e.g. 52:64:CF:9F:A2:DE / :DF).
Locally administered addressing is likely a deliberate anti-fingerprinting measure —
these MACs will never match IEEE OUI lookups, making SSID-pattern detection the only viable
passive identification path for cameras using this scheme.
This table is populated automatically by querying WiGLE for SSIDs matching
Flock% / FLOCK%, then extracting OUI prefixes from results
that are not in the canonical OUI list. Only OUIs seen
≥5 times are shown to reduce false positives.
No candidate OUI prefixes have been identified yet via SSID-pattern queries. Any novel OUI seen ≥5 times in Flock-SSID-bearing WiGLE records will appear here automatically.
| OUI Prefix | Occurrences | Top SSIDs | Status |
|---|---|---|---|
| No candidate OUI prefixes yet — queries running incrementally. Prefixes seen ≥5 times will appear here. | |||
flock_ouis.csv.
Data files: ssid_candidate_cameras.geojson
·
ssid_candidate_cameras.csv
Flock cameras spend most of their duty cycle asleep, waking briefly to upload captured plate data. During these brief active windows, a real-time passive sniffer can detect them by watching for their MAC address appearing as the destination (addr1) in probe responses and data frames from nearby APs — even when the camera itself is not actively transmitting.
The addr1 technique — matching on the receiver address in addition to the transmitter — is @NitekryDPaul's key discovery. Combined with wildcard probe request detection (802.11 management frames type=0 subtype=4 with empty SSID), this yields a very tight signature that field-tested at 11 of 12 cameras caught with only 2 false positives in Joplin, MO.