A map that shows where automated plate readers sit is now running on infrastructure its creator does not have to defend. Proton, the Swiss privacy firm behind Proton Mail, is hosting the dataset after the researcher who assembled it faced legal pressure from Flock Safety.
Where the locations came from
The coordinates are not crowdsourced. Security researcher Joshua Michael found an access token exposed on a publicly reachable Flock website in November 2025 – no login required – and used it to query a mapping system that returned device inventories.
The snapshot lists more than 170,000 cameras and roughly 130,000 other units, including networking gear and about 27,000 acoustic sensors. Flock publicly claims over 120,000 cameras across 49 states, logging some 20 billion vehicle sightings a month.
Why the mirror matters more than the numbers
Flock objected to the project, and The Intercept reported that its response included legal threats. Hosting the map on Swiss servers moves the argument somewhere the company’s usual pressure tactics carry less weight.
The data is frozen at December 2025, so recent installations are invisible. DeFlock and MapQuest have since added their own layers, but both depend on volunteers spotting hardware or on commercial data.
The unresolved question is access control. Michael’s finding was a token that anyone could lift, and Flock eventually closed it. What the episode shows is that the inventory of American plate surveillance was reachable through a single misconfigured endpoint – a supply-chain problem on the platform side rather than a flaw in any individual camera.
