Key points
- Flock Security joined the CVE Program as a Numbering Authority for its products.
- Critics question whether the firm will disclose risks accurately given past controversies.
- The move allows faster internal response but limits independent verification initially.
The short version
- Flock Security gained authority to assign Common Vulnerabilities and Exposures (CVE) IDs to defects in its own surveillance hardware.
- The company manufactures automated license plate readers and AI-powered cameras used by law enforcement agencies.
- Security experts warn that the firm’s history of privacy controversies may affect how researchers view its disclosures.
The details
Flock Security has officially joined the CVE Program as a CVE Numbering Authority (CNA), granting the organisation the power to assign unique identifiers to security flaws found in its own equipment. According to CyberScoop, this new status allows the manufacturer to assess, coordinate, and prioritise responses to vulnerabilities internally without relying on external parties for initial identification. The company manufactures various surveillance systems, including automated license plate readers and artificial intelligence-powered cameras, which are deployed in public safety contexts.
Chris Castaldo, the chief information security officer at Flock, stated that this authority enables the company to move faster when researchers report findings. He noted that the new role helps eliminate confusion from duplicate or conflicting vulnerability entries and provides customers with a single, trusted source for security information regarding their products. Flock joined a global network of more than 550 CNAs that perform similar functions for their respective technologies.
Despite the operational benefits, the development has drawn scrutiny from security professionals and privacy advocates. Flock’s business has faced considerable public and legal attention due to privacy concerns and multiple reports of police abusing its technology. These controversies have impacted the company’s credibility, potentially clouding how independent security researchers perceive its role as a CNA. The situation highlights broader limitations within the CVE program, particularly regarding what constitutes a vulnerability and who defines it.
The context
Katie Moussouris, founder and CEO at Luta Security, told CyberScoop that the measure of Flock as a CNA depends on whether its records provide sufficient detail and accuracy. She emphasised that cities, police departments, and the public need enough information to track specific risks by product version, the nature of the vulnerability, and ideally how to mitigate or fix it. Without transparent and precise data, the value of the CVE assignment is diminished for end-users and regulators.
Flock declined to answer specific questions or make an executive available for an interview, referring instead to a blog post. The company published its vulnerability disclosure policy in August and recently created a security advisories page. This page will publish all newly discovered and confirmed vulnerabilities going forward, aiming to centralise security information. However, the lack of direct executive commentary has left some observers seeking further clarification on the company’s commitment to transparency.
Zach Edwards, a security and privacy researcher, noted that numerous activists have already conducted technical teardowns of Flock’s products. He expects some researchers to continue disclosing Flock vulnerabilities without coordinating with the company first. This independent disclosure activity may persist regardless of Flock’s new CNA status, reflecting ongoing tensions between vendor-managed disclosure and community-driven security research.
Defender's checklist
Organisations using Flock products should monitor the new security advisories page for confirmed vulnerabilities. They should also track independent researcher disclosures that may not be coordinated with the vendor. Agencies should verify that vulnerability records include specific product versions and mitigation steps.
What to do and how to stay safe: Flock Security
- Subscribe to Flock’s security advisories page to receive notifications of confirmed vulnerabilities in your deployed hardware.
- Monitor independent security research channels for uncoordinated disclosures that may reveal risks not yet addressed by the vendor.
- Ensure your procurement contracts require vendors to provide detailed vulnerability information, including version specifics and mitigation guidance.
- Review your current inventory of surveillance devices to identify which models and firmware versions are in use, facilitating faster patching when updates are available.
Step-by-step guide: Unpatched Software: Why Missing Updates Create Hidden Entry Points
General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What does it mean for Flock to be a CVE Numbering Authority?
It means Flock can assign official CVE IDs to vulnerabilities in its own products and grade their severity, rather than relying on external organisations to do so.
Why are experts concerned about Flock’s new role?
Experts worry that Flock’s history of privacy controversies and alleged police abuse of its technology may affect the transparency and accuracy of its vulnerability disclosures.
Will researchers still report Flock vulnerabilities independently?
Yes, security researcher Zach Edwards expects some activists and researchers to continue disclosing vulnerabilities without coordinating with the company, despite its new CNA status.
