Flock Becomes a CVE Numbering Authority for Its Own Products
Flock, the public safety technology company known for its automated license plate readers and AI-powered cameras, has been granted authority to assign CVE identifiers to vulnerabilities in its own products. The company announced it has joined the global network of more than 550 CVE Numbering Authorities (CNAs), allowing it to internally assess, coordinate, and prioritize responses to security flaws in its surveillance systems.
According to Chris Castaldo, Flock’s chief information security officer, the move enables faster response when researchers report findings, reduces confusion from duplicate or conflicting vulnerability entries, and provides customers with a single, trusted source for security information about Flock’s products.
Experts Acknowledge Benefits but Raise Concerns About Trust
Security experts note that granting CNA status to vendors is common and often justified, as companies possess deep knowledge of their own code and can accurately tie vulnerabilities to affected versions and fixes. Katie Moussouris, founder and CEO of Luta Security, told CyberScoop that the true measure of Flock’s effectiveness as a CNA will be whether its records provide sufficient detail and accuracy for cities, police departments, and the public to track risks by product version, vulnerability type, and mitigation steps.
However, Moussouris and other experts warn that Flock’s controversial history — including repeated reports of law enforcement abuse of its surveillance tools and ongoing privacy concerns — could undermine confidence in its ability to act as an impartial arbiter of vulnerability severity.
Credibility at Stake: The ‘Grading Your Own Homework’ Problem
Zach Edwards, a security and privacy researcher, echoed these concerns, describing CNAs as ‘essentially grading their own homework.’ He emphasized that credibility must be earned through consistent, transparent handling of all defects that meet a reasonable threshold.
Moussouris added that the conflict of interest becomes problematic when vendors lack the organizational and technical maturity to properly assess flaws. ‘An immature vendor may inaccurately represent an issue, either through ignorance or in a misdirected effort to downplay it,’ she said, noting that CNAs often write vulnerability descriptions and set severity scores.
Flock’s Disclosure Policy Limits Scope of Testing
Flock’s vulnerability disclosure policy explicitly prohibits certain types of testing, including against live customer deployments, access to law enforcement or investigative data, physical attacks, denial-of-service testing, and social engineering. The company does not operate a paid bug bounty program.
Moussouris pointed out that Flock’s policy reserves the right to withhold vulnerability disclosures if it determines publication could create a safety risk to law enforcement or the public. This exception, she warned, could lead to abuse of authority unless Flock adopts a more mature, safety-first approach centered on timely, transparent, and accurate disclosure.
Researchers Likely to Bypass Coordination, Expert Warns
Edwards noted that many activists and researchers have already conducted technical teardowns of Flock’s products and expects continued independent disclosure of vulnerabilities without coordination with the company. Last year, researchers reported multiple defects in Flock’s license-plate reader and gunshot detection systems, which Flock submitted to the National Vulnerability Database but labeled as non-material due to requiring physical device access.
Moussouris highlighted the irony: ‘These cameras sit on poles on public streets,’ underscoring that physical accessibility does not negate risk.
Future of Flock’s CNA Role Uncertain
Edwards observed that CNA practices vary widely, with some organizations being highly active in disclosure while others go years without publishing any vulnerabilities. ‘Only time will tell how Flock operates their CVE program and if they issue CVEs for vulnerabilities publicly disclosed,’ he said. ‘But, if their recent history is any indication, they will probably screw it up in some epic way that somehow unites people across the United States to demand CVE issuing reform.’
Flock declined interview requests for this article and directed inquiries to its blog post and newly published security advisories page, where it intends to post all newly discovered and confirmed vulnerabilities going forward.
Source: CyberScoop