Flock can now issue CVEs for its own products. Should we trust it?
Flock gains CVE Numbering Authority for its surveillance products, raising trust concerns.
Run Flock?
Get an email when a reviewed story names Flock, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Flock, a company known for its controversial surveillance cameras and license plate readers, has become a CVE Numbering Authority (CNA). This allows them to assign CVE IDs to vulnerabilities in their own products. While many vendors are granted CNA status, Flock's history of privacy concerns and alleged law enforcement misuse of its technology raises questions about its credibility in assessing and disclosing its own security flaws.
The lesson from this incident
Full lessonFlock Safety, a surveillance technology vendor with documented privacy controversies, has been granted CNA (CVE Numbering Authority) status, allowing it to self-assign and control the disclosure narrative around vulnerabilities in its own products. While CNA status is common among large vendors, the credibility of self-disclosure hinges entirely on organizational transparency, integrity, and accountability — qualities that critics argue Flock has not consistently demonstrated. When a vendor with a contested track record controls its own vulnerability pipeline, there is inherent risk that disclosures may be delayed, minimized, or framed favorably. This matters significantly because Flock's cameras and license plate readers are deeply embedded in law enforcement infrastructure, meaning security flaws could have serious public safety and civil liberties implications. Organizations relying on Flock technology must not passively trust vendor-issued CVEs as complete or timely, and should maintain independent verification processes.