Proton, the Geneva-based company behind Proton Mail and Proton VPN, on October 21, 2026 began hosting a searchable map of Flock Safety's automated license plate readers across the United States, built from an inventory that a security researcher pulled from Flock's own systems. The map lists 214,073 Flock devices as in service, 83,427 in planning and 38,190 decommissioned. Flock has publicly cited a network of around 120,000 cameras.

In Short

A privacy company put a free online map on its website showing where one American company's car-tracking cameras are installed. The map matters because the data came from the camera company's own records, it shows many more devices than the company has said it runs, and it now sits on servers in Switzerland, which makes it harder to force offline. People can now look up which roads near them are watched, though the map is a snapshot from December 2025 and does not show changes since then.

What the map contains

The tool sits at proton.me/flock-camera-map and is searchable by ZIP code. At the national zoom level, the page reports 213,486 cameras in view, with a status breakdown of 214,073 in service, 83,427 in planning, 38,190 decommissioned and 11 unknown. Filters cover device status, device capability and state. A side panel ranks the counties with the most devices in view: Harris County, Texas, leads with 6,322, followed by Fulton County, Georgia, with 6,223, Maricopa County, Arizona, with 5,324, Los Angeles County with 4,437 and Riverside County, California, with 3,989.

The page frames the project in plain terms. "You have a right to know who's recording you when you leave home, especially when a private company controls the data and it's unclear how law enforcement uses that information," according to Proton.

Proton does not own the underlying data. "The device locations on this Flock camera map come from independent research by cybersecurity researcher Joshua Michael," according to the page, which adds: "We don't host or distribute the underlying dataset." The map tiles come from OpenFreeMap, using OpenMapTiles and OpenStreetMap data.

The data is not live. According to Proton's FAQ, "The data is a snapshot from December 2025. Devices installed or removed since then won't be reflected." Any installation, removal or contract cancellation from the past ten months is therefore absent.

How the data was obtained

The inventory traces back to a security lapse at Flock. According to Proton, Michael found in November 2025 that Flock's servers "publicly exposed an access token anyone could obtain without logging in." He reported the issue to Flock, then published his findings and his own map in December. Proton describes the data on its page as "a mirror of an inventory of Flock devices that security researcher Joshua Michael retrieved from Flock's own systems through an access token Flock had left exposed."

The Wikipedia entry on Flock Safety records a closely matching event: in November 2025 a security researcher discovered that Flock server logs were publicly available without a login, and the vulnerability was patched in December 2025.

The published accounts differ on when the map first appeared. Proton places the publication of Michael's findings and map in December 2025. CNET, in an article published on October 21, 2026, wrote that Michael "first published the interactive map in September before facing a swift trademark complaint from Flock." The Intercept reported on September 24, 2026 that Michael published his map of about 300,000 Flock devices on September 23, 2026, and that a day later he was notified that Doppel, a company that says it acts for Flock, had filed a trademark infringement complaint seeking the site's takedown. Proton's December date may refer to the findings rather than the public map; Proton's page does not say.

Michael runs a site, FlockSurveillance.org, documenting his research. "My research on FlockSurveillance.org documents cybersecurity failures with national-security consequences," Michael told CNET. "My research argued that Flock Safety could not detect exports of their data and that because they hold data on nearly every American and their pattern of life, they are a national security threat to our country and people."

Records rather than sightings

The origin of the data is what separates this map from earlier efforts. DeFlock, a crowdsourced map created in October 2024 by Colorado activist Will Freeman, relies on volunteers reporting cameras they see. Proton draws the contrast directly: "Maps like DeFlock rely on volunteers reporting cameras they spot; this inventory comes from Flock's records."

According to the Wikipedia entry, Flock sent DeFlock a cease and desist letter in January 2025. CNET reported that Flock also sent Michael a trademark complaint, and that "Flock has repeatedly attempted to shut down" the mapping tool "through legal threats."

CNET's reviewer, Tyler Lacoma, tested the map against his own city, which had cancelled its Flock contract more than a year earlier. According to CNET, the map reported no active Flock cameras there but correctly located decommissioned ones.

The count gap

The headline figure is the distance between what the map shows and what Flock has said publicly. According to Proton, Michael's inventory "lists more than 170,000 cameras and over 130,000 other Flock devices." Proton continues: "Flock has publicly cited around 120,000 cameras, so the actual camera count is about 40% higher."

CNET framed the same comparison differently. According to CNET, Flock "said this summer that it operates more than 120,000 cameras nationwide, but the tool says there are more than 214,000 Flock devices in service, with more than 80,000 in the planning stages."

The two framings measure different things. Proton's 40% compares 170,000 cameras with 120,000 cameras. The 214,073 in-service figure on the map covers devices, a category that in Michael's inventory includes more than 130,000 items that are not cameras. By PPC Land's calculation, 214,073 is about 78% above 120,000, but that comparison mixes devices with cameras and should not be read as a camera count. Adding the four status categories on the map gives 335,701 records, which sits close to the combined 300,000-plus cameras and other devices that Proton attributes to the inventory.

Flock did not respond to CNET's request for comment before publication. Proton's page says it asked Flock chief executive Garrett Langley "how the company responds to misuse and who controls the data its devices collect," in an interview published separately on the Proton blog.

What a Flock camera records

Proton's page sets out the mechanism. "A Flock camera photographs each vehicle that passes it, whether or not the driver is suspected of anything. It logs the plate, time, and location." A feature Flock calls Vehicle Fingerprint "also records the make, model, and color, plus details like dents and bumper stickers, so a car can be found even without a readable plate."

The records go to Flock's cloud. According to Proton, police departments "can search them and share them with other agencies across city and state lines." Proton cites Flock as saying its network "processes more than 20 billion vehicle reads a month across 49 states." The Wikipedia entry, citing Flock material from July 2026, gives the same 20 billion monthly figure but says the company has license plate readers in all 50 states, and that it operates in more than 6,000 communities.

CNET described a wider capture. According to CNET, Flock's networks "capture license plates, vehicle details, human physical characteristics, and audio signals such as gunshots or shouting."

The hardware itself is designed to run almost anywhere. According to the Wikipedia entry, the Falcon and Sparrow readers send data over LTE cellular networks, most units run on solar panels and rechargeable batteries, and Flock states its readers capture vehicles traveling at up to 100 miles per hour at distances of up to 75 feet. Flock owns and operates its devices and leases them to customers, which include police agencies, homeowner associations and private property owners.

Misuse and the case for a public map

Proton's argument for publishing rests partly on documented abuse. "That kind of broad access leaves much room for misuse and abuse," according to the page. Proton cites a Washington Post review that "found at least 50 officers accused or charged with misusing license plate readers, often to follow people in their personal lives; Flock's system was involved in 46 of those cases."

The Wikipedia entry lists more than 20 individual cases, including a Sedgwick, Kansas, police chief who used Flock readers to track an ex-girlfriend's vehicles 228 times over more than four months, and an Albany, New York, investigator who searched an ex-girlfriend's plate almost 3,000 times. According to the same entry, Flock said in August 2026 that its Audit Assistance tool, previously opt-in and used by about one third of police department customers, would become mandatory by the end of the year.

Accuracy is a separate concern. According to the Wikipedia entry, a Roseville, California, police analysis found that 71% of 1,427 stolen or felony vehicle alerts sent by Flock in 2023 and 2024 were incorrectly identified plates, a finding Flock attributed to an unusual deployment and older hardware.

Why Switzerland matters

The choice of host is deliberate. According to CNET, Michael said Flock has "promised to take every measure possible to take my research offline," which he offered as one reason Proton moved to preserve the map on its Swiss servers. CNET noted that Proton's site states that under Swiss data protection rules the company is not required to comply with requests that are not supported by a Swiss court order. Flock is headquartered in Atlanta.

Proton has said it will refresh the map if better data appears. "If new and reliable data becomes available, then we will update the map," a Proton spokesperson told CNET. "We're committed to keeping the public informed of all forms of surveillance where reliable data can be sourced."

Proton is not a neutral party in privacy debates; it sells privacy products, and the map page sits inside its commercial site alongside sign-up prompts. CNET noted that the tool is available without a subscription to any Proton service. Proton's VPN business has previously benefited from surveillance and verification rules: in July 2025 it recorded a surge of more than 1,400% in UK sign-ups after age checks under the Online Safety Act took effect.

Flock's position in October 2026

The map arrives during a difficult month for the company. According to the Wikipedia entry, Flock said in October 2026 that it had cut its staff by 18%, or about 270 employees, after a voluntary buyout programme. The same month, Senators Bernie Sanders and Jeff Merkley and Representative Alexandria Ocasio-Cortez introduced the Ban Flock Act, which would bar federal agencies from using license plate readers and block federal funding for state and local governments that use them, without banning the company outright.

At least 214 cities and counties have ended their relationships with Flock, according to the Wikipedia entry, while Flock has said new partnerships outpaced non-renewals by 10 to 1. The Los Angeles Police Department declined to renew a contract that was set to expire in June 2026, citing civil liberties and privacy concerns. The company had raised $950 million in venture funding at a $7.5 billion valuation, according to the same source.

Legal pressure predates the map. In June 2024, a judge in the Norfolk, Virginia, Circuit Court ruled that collecting location data from the city's 172 Flock readers constituted a search under the Fourth Amendment, and could not be used as evidence without a warrant. That reasoning echoes long-running arguments over metadata collection, such as the 1979 Supreme Court ruling that use of a pen register was not a search.

Why this matters for marketers

License plate data sits closer to advertising than its law enforcement framing suggests. Flock's records are, at their core, timestamped location trails for vehicles, the same category of information that location-based ad targeting and footfall measurement depend on. The business model also overlaps: Flock sells to homeowner associations and private property owners, and in October 2025 it announced a partnership with Amazon's Ring that would have let camera owners share video with public safety agencies. According to the Wikipedia entry, that integration was cancelled after scrutiny that followed Amazon's Super Bowl LX advertisement for Ring's AI-assisted "Search Party" feature.

Regulators have been tightening the rules on location trails sold for marketing. In May 2026 the FTC closed its Kochava location data case with an order barring the company from selling sensitive location data without affirmative express consent, a case that turned on how mobile advertising ID records can be tied back to individuals. In January 2026, US Immigration and Customs Enforcement asked ad tech and big data companies how their products could support investigations. Wikipedia's entry notes that Flock data was also reported in 2025 to have been queried for immigration enforcement.

The commercial market for this kind of information runs through intermediaries. PPC Land's explainer on the data broker industry describes how companies with no direct relationship to consumers assemble and resell personal information, including location, into audience segments. Earlier, in January 2025, EPIC and the Irish Council for Civil Liberties filed an FTC complaint alleging that Google's real-time bidding system exposes precise location data about Americans to foreign adversaries.

The Proton map also shows how a single credential failure can expose an entire infrastructure. The inventory was not leaked by an insider or compiled from public records; it came from a token Flock left reachable without a login. For any company holding large location datasets, that is the operational risk at the centre of this story.

Outside the US, the legal environment for surveillance companies has hardened. Clearview AI, which built a facial recognition database from scraped images, was at the Court of Appeal of England and Wales from October 19 to 21, 2026 contesting a fine of more than £7.5 million, a year after noyb filed a criminal complaint against the company in Austria over roughly 100 million euros in unpaid European fines. In September 2026, Hamburg's data protection regulator found that Ray-Ban Meta glasses can expose bystanders' data without their knowledge.

What the map does not show

Several limits apply. The data is ten months old. Proton does not publish the dataset and relies on Michael's inventory, which neither Proton nor CNET has independently audited against field observations beyond CNET's single-city check. The map shows device locations and statuses, not which agencies can query the data from each device, how long records are kept or how often they are searched. And the gap between 214,073 devices and 120,000 cameras is partly a gap in definitions, not only in disclosure.

The broader catalogue of police surveillance technology is maintained elsewhere. CNET pointed to the Atlas of Surveillance, a volunteer project that tracks automated license plate readers, cell-site simulators, body-worn cameras and other tools adopted by US law enforcement, and which is updated continuously.

Timeline

Summary

Who: Proton, the Swiss company behind Proton Mail and Proton VPN; Flock Safety, the Atlanta-based maker of automated license plate readers; security researcher Joshua Michael, whose inventory supplies the map's data.

What: Proton began hosting a free, ZIP-code-searchable map of Flock devices built from a December 2025 snapshot of Flock's own records, obtained through an access token Flock had left exposed. The map lists 214,073 devices in service, 83,427 in planning and 38,190 decommissioned, against Flock's public figure of around 120,000 cameras.

When: The map launched on October 21, 2026. The underlying data dates from December 2025, after Michael found the exposed token in November 2025.

Where: The map covers the United States and is hosted on Proton's servers in Switzerland, where, according to Proton, the company is not required to comply with requests unsupported by a Swiss court order.

Why: Proton says people have a right to know who is recording them, citing documented misuse of license plate readers by police officers. A trademark complaint filed on Flock's behalf sought to take Michael's map offline in September 2026, and Swiss hosting makes that harder. For the marketing community, the story concerns the same category of data, timestamped location trails, that location-based advertising and measurement rely on, and the security risks of holding it.