Proton, the Swiss company behind Proton Mail and Proton VPN, is hosting a searchable map of more than 300,000 Flock surveillance devices on its own servers.
The map traces back to security researcher Joshua Michael. In November 2025, he found that Flock's servers exposed an access token anyone could obtain without logging in. He used it to pull an inventory of device locations, reported the flaw, and published his findings and a map in December 2025. The inventory held more than 170,000 cameras and over 130,000 other Flock devices. Flock fixed the flaw but said it had never been hacked. Michael says the company also sent him a cease-and-desist letter and told customers it had notified law enforcement, calling him a "malicious actor."
In September 2026, Doppel, a brand-protection firm, filed a trademark complaint on Flock's behalf. It argued that Michael's site could confuse customers, even though the site carries a disclaimer saying it is not affiliated with Flock. Flock had not disputed the map's accuracy. Proton rejected the complaint and mirrored the map. "This is an attempt to suppress information, not to prevent consumer confusion," said Marc Løebekken, Proton's head of legal.
The map is a December 2025 snapshot, so newer installations and removals are missing. Users can search by ZIP code or pan around the country.
Flock makes automated license plate readers, and the company says its cameras log more than 20 billion vehicle sightings a month across 49 states. The Washington Post found at least 50 officers accused or charged with misusing plate readers, often to track people they knew. Flock's system was involved in 46 of those cases.
In an August interview with Proton, Flock CEO Garrett Langley called abuse "unacceptable" and pointed to audit logs, but declined to say how many police contracts Flock had suspended over it.
Other maps exist. DeFlock relies on volunteers who report cameras to OpenStreetMap, and MapQuest added a surveillance layer this month. This one differs in provenance: the locations came from Flock's own systems. That may explain why the fight centers on trademark rather than accuracy.
Michael also notes that Flock closed the issue in December saying it found no sign of unauthorized access. He reads that as proof of his point: data could leave without the company noticing.