Asep Darmawan
In a move that has reignited tensions between the surveillance industry and the cybersecurity research community, Flock Safety—a prominent provider of automated license plate readers (ALPRs) and AI-enhanced public safety cameras—has officially joined the Common Vulnerabilities and Exposures (CVE) Program. As a designated CVE Numbering Authority (CNA), Flock now possesses the autonomous power to assign CVE IDs to security flaws discovered within its own hardware and software ecosystems.
While the company maintains that this transition is a standard step toward improving product security, the development has drawn sharp criticism. Given Flock’s history of navigating public controversy regarding law enforcement’s use of its data, security experts are questioning whether the company possesses the transparency and maturity required to "grade its own homework" when it comes to critical infrastructure vulnerabilities.
The Mechanics of the CVE Program
The CVE Program, sponsored by the Cybersecurity and Infrastructure Security Agency (CISA), is the global backbone for identifying and cataloging cybersecurity vulnerabilities. Organizations granted status as a CNA are authorized to assign CVE identifiers to defects in their own products, allowing them to coordinate disclosures and prioritize patches. Currently, more than 550 organizations worldwide participate as CNAs, ranging from massive software conglomerates to specialized hardware manufacturers.
For a company like Flock, the benefits of becoming a CNA are clear from a corporate governance perspective. By managing the vulnerability lifecycle internally, the company can streamline the process of assessing incoming research reports, prevent duplicate entries in global databases, and provide a single, verified portal for its law-enforcement and private-sector customers to track security updates.
"It allows us to move faster when researchers report findings, eliminate confusion from duplicate or conflicting vulnerability entries and give our customers a single, trusted source for security information about our products," said Chris Castaldo, Chief Information Security Officer at Flock, in a recent statement.
A Chronology of Surveillance and Security Concerns
The path to this designation has been anything but conventional for the Atlanta-based company. Over the past several years, Flock has moved from a niche startup to a dominant player in the American surveillance landscape, with its solar-powered cameras becoming a common sight on suburban streets and at traffic roundabouts.
- Rapid Expansion: Following its founding, Flock aggressively expanded its footprint, signing contracts with thousands of police departments and private homeowners’ associations.
- The Privacy Backlash: As the network of cameras grew, so did public concern. Reports emerged detailing instances of law enforcement abuse, including the improper tracking of individuals and the potential for "mission creep" in how surveillance data is utilized.
- Technical Teardowns: In recent years, security researchers have turned their attention to the devices themselves. High-profile teardowns by independent hackers and privacy activists have exposed potential weaknesses in how Flock’s cameras communicate and how data is stored.
- The 2025-2026 Shift: Facing pressure to formalize its security posture, Flock published a formal Vulnerability Disclosure Policy (VDP) in August 2026. This was followed by the launch of a dedicated security advisories page, setting the stage for its entry into the CNA program.
- Current Status: With its new CNA authority, Flock is now responsible for the lifecycle management of its own bugs, from initial report to public disclosure.
Supporting Data and the "Self-Grading" Conflict
The core of the current debate lies in the inherent conflict of interest in the CNA model. Because vendors are responsible for both the code and the reporting of its flaws, the integrity of the CVE system relies entirely on the vendor’s willingness to be honest about the severity of a bug.
Security researcher Zach Edwards, who has tracked Flock’s technical development, notes that while the company’s transition is technically standard, the real-world application of this power is concerning. "CNAs are essentially grading their own homework," Edwards observed. "Credibility and trust have to be earned consistently by properly addressing every defect that meets a reasonable threshold."
The stakes are high. In the past, researchers reported defects in Flock’s gunshot detection and license plate recognition systems. While these were eventually submitted to the National Vulnerability Database, the company reportedly downplayed their materiality, arguing that the flaws required physical access to the device—an argument that carries little weight given that these devices are permanently installed on public utility poles.
"These cameras sit on poles on public streets," says Katie Moussouris, CEO of Luta Security and a long-time expert in vulnerability disclosure programs. "The measure of Flock as a CNA is whether its records give cities, police departments, and the public enough detail and accuracy to let people track specific risks by product version."
Implications for Public Safety and Privacy
The implications of this move extend far beyond simple software patching. Because Flock’s products are used by law enforcement to monitor the movement of citizens, a single vulnerability could theoretically allow unauthorized parties to access sensitive tracking data.
The Risk of Downplaying Severity
A recurring fear among critics is that a company under public scrutiny might be tempted to use its CNA authority to obfuscate the danger of a vulnerability. If a vendor has the power to set the "severity score" of a flaw, an immature or defensive organization might intentionally minimize a critical security hole to avoid a PR disaster.
The "Safety-First" Clause
Flock’s vulnerability disclosure policy includes language that reserves the right to withhold or delay the publication of a vulnerability if the company determines that disclosure would create a "safety risk to law enforcement or the public." While this is common in some specialized industries, it introduces a subjective element that could be abused to bury legitimate security failures.
"Flock stands out as a CNA because its products track drivers’ movements, its customers are police, and its policy reserves the right to hold back publication," Moussouris notes. "The latter may lead to an abuse in their authority and control of CVEs unless they embrace a more mature, customer-safety-first stance of timely, transparent, and accurate disclosure."
Official Stance and Future Outlook
Despite requests for comment and clarification regarding its specific criteria for vulnerability scoring, Flock has maintained a policy of silence beyond its initial blog post and the establishment of its security advisory portal. The company has explicitly stated that its VDP does not allow for testing against live customer deployments, nor does it currently offer a paid bug bounty program—a tool that many major tech firms use to incentivize ethical hackers to find flaws before malicious actors do.
Without a bug bounty program, the company relies entirely on unsolicited reports from the security community. However, as noted by researchers, many activists who have previously scrutinized Flock’s hardware may choose to bypass the company’s official channels entirely, opting instead for public disclosure to ensure that flaws are not swept under the rug.
The Path Forward
The success of Flock’s role as a CNA will be measured in the coming months by how they handle the next major vulnerability report. Will they be transparent about flaws that impact the privacy of the citizens whose data they store? Or will the "conflict of interest" trap prove too difficult to overcome?
"Only time will tell how Flock operates their CVE program and if they issue CVEs for vulnerabilities publicly disclosed," says Edwards. "But if their recent history is any indication, they will probably face a significant test of their credibility sooner rather than later."
Ultimately, the CVE Program depends on the participation of vendors who view security as a collaborative effort rather than a PR management strategy. For Flock Safety, the road ahead is narrow: they must prove that their status as a CNA is a commitment to public safety, rather than a convenient tool for controlling the narrative around their surveillance infrastructure. Failure to do so may not only damage their reputation but could force a broader conversation in Washington about whether companies involved in sensitive public surveillance should be allowed to regulate their own security reporting.
Lina Irawan
Basiran
Nana
Rifan Muazin
Ali Ikhwan
Evan Lee Salim
