The Flock Camera Map and the Slow Normalisation of Being Watched

Been down a bit of a rabbit hole this week, the kind that starts with one Reddit thread and ends with you closing forty tabs at midnight wondering if you should cover your webcam with something more substantial than a Post-it note.

The thread was on r/privacy, about a security researcher who built a map of every Flock Safety camera location in the US, pulled from a leak in Flock’s own database. Flock makes those automated licence plate readers you’ll see bolted to poles around American neighbourhoods, feeding into a network that police departments (and, increasingly, private buyers) can query. The researcher says he reported the vulnerability to Flock back in November, they denied there was a problem, and then in December he pulled a full export anyway. Now there’s a map, and a torrent floating around with more detail than most people are comfortable with.

What got me wasn’t the leak itself. Companies leak data. That’s basically a law of nature at this point, up there with gravity and Melbourne having four seasons in one afternoon. What got me was a comment buried in the thread, something like: “if you’ve done nothing wrong you have nothing to hide” gets thrown around right up until the moment a breach exposes the travel patterns of a few million cars to whoever wants them. That’s the whole argument, really, compressed into one sentence. The problem was never about what you’re hiding. It’s about who else gets to see it, and what they do with it, and whether they can even keep it locked up in the first place.

Same week, closer to home, there’s a story doing the rounds about an OpenAI agent apparently getting into a Medicare Australia database, prompting some kind of government investigation. I haven’t seen enough detail to know exactly what happened there, and some of the commenters reckon it’s being overstated, that it might just be unindexed data rather than an actual breach. Fair point, and worth holding loosely until more comes out. But even the shape of the headline tells you something about where we’re at: an AI agent, a government health database, a word like “hacked” doing a lot of work in a single sentence. Three years ago that headline would have read like science fiction. Now it barely rates above the fold.

I work in tech. I’m not the guy who thinks every camera is a government plot or every app is spyware, because most of the time the truth is duller and more structural than that: someone built a system to solve a real problem (find stolen cars, catch cases, whatever), and then quietly forgot that a database of everyone’s location is also, inherently, a weapon, and weapons get stolen. Flock didn’t set out to build a surveillance network that anyone with a leaked export could map. They set out to sell “public safety” to city councils. The surveillance network is just what you get on the way there, and it turns out to be a lot less securable than the sales pitch implied.

There’s a version of Melbourne life where this all feels abstract, a very American problem with very American licence plates. But we’ve got our own versions creeping in: council CCTV networks, facial recognition trials at Crown Casino a few years back that got walked back after public pressure, myGov breaches that make the news for a news cycle and then get forgotten. The infrastructure of being watched doesn’t need a grand conspiracy to spread. It just needs a procurement officer who thinks it sounds efficient, and a public that’s too tired or too busy to push back until something goes wrong.

What I keep coming back to is that none of this is a technology problem, not really. The cameras work fine. The AI agent probably did exactly what it was built to do. The failure is always upstream of the tech: who decided this data should exist, who decided it didn’t need to be secured properly, who decided the public didn’t need to be told. Flock apparently had months of warning and did nothing. That’s not a coding error. That’s a choice, made by people who calculated that fixing it was less urgent than selling more cameras.

I don’t have a tidy solution here, and I’m suspicious of anyone who does. Regulation helps, but it’s always a few years behind the thing it’s regulating. Individual privacy hygiene helps a bit at the margins but doesn’t touch systemic collection. Public pressure works sometimes, like it did with Crown, and does nothing other times. Maybe the honest answer is that this is going to keep happening in slow motion for the rest of our lives: another leak, another map, another headline with an AI’s name in it, each one landing with slightly less shock than the last, until we’ve been quietly boiled into just accepting that this is what living in public looks like now. That thought genuinely worries me. But the fact that a researcher spent months trying to get Flock to fix this before going public, and that thousands of people are still angry enough about it to argue in a comment thread past midnight, tells me the boiling isn’t complete yet. Small comfort. I’ll take it.