Flock Finder: Open-Source Tool for Mapping Flock Safety ALPR Surveillance Cameras

An open-source surveillance awareness tool that maps Flock Safety ALPR cameras using crowdsourced WiFi data.

What Is Flock Finder? #

Flock Finder is an open-source project that maps Flock Safety ALPR (Automatic License Plate Reader) cameras across the United States and 108 other countries. It combines 31 known Flock Safety WiFi OUI (Organizationally Unique Identifier) prefixes with the WiGLE crowdsourced WiFi database to identify and plot suspected camera locations on an interactive map.

The project lives at github.com/simeononsecurity/flock-finder , auto-updates daily via GitHub Actions, and as of July 2026 has mapped over 40,000 suspected cameras across 964 regions worldwide.

This is a general awareness tool, not a definitive inventory. Read the limitations section before drawing conclusions from the data.

For background on why Flock Safety ALPR surveillance matters to privacy, read Flock Safety Camera Surveillance: Prevalence, Privacy Concerns, and Protection Strategies .

How It Works: OUI Fingerprinting via WiGLE #

The Core Insight #

Flock Safety cameras contain WiFi transceivers that periodically wake from sleep to upload captured license plate data to the cloud. During these brief active windows, the camera broadcasts WiFi frames that contain its MAC address — and the first three bytes of every MAC address identify the manufacturer. This is the OUI (Organizationally Unique Identifier).

Security researcher @NitekryDPaul discovered 30 OUI prefixes consistently associated with Flock Safety camera hardware through promiscuous-mode 2.4 GHz analysis. A 31st prefix (82:6B:F2) was contributed by Michael / DeFlockJoplin during field testing in Joplin, MO.

Flock Finder takes those 31 OUIs, queries WiGLE for any recorded WiFi networks matching those prefixes, and plots the results on a map.

The 31 Known Flock Safety OUI Prefixes #

The addr1 Detection Technique #

@NitekryDPaul’s key discovery goes beyond simply matching on the transmitter MAC address. Flock cameras spend most of their duty cycle asleep. When a nearby access point sends a frame addressed to a camera, the camera’s MAC appears as addr1 (the receiver address) in 802.11 frames — even while the camera itself is not actively transmitting.

Combined with wildcard probe request detection (802.11 management frames type=0, subtype=4, empty SSID), this yields a very tight detection signature. Field testing in Joplin, MO achieved 11 of 12 cameras detected with only 2 false positives.

⚠️ Important: The WiGLE-based Flock Finder map does not implement the addr1 technique. WiGLE is a historical, passively collected dataset — it only records transmitters, not receivers. For real-time detection that actually uses @NitekryDPaul’s method, you need dedicated hardware running in the field.

Using the Live Map #

The interactive map is live at simeononsecurity.github.io/flock-finder/ . It displays:

• Clustered camera markers color-coded by OUI prefix
• Search by city, state, or BSSID
• OUI data table with per-prefix camera counts
• Stats panel showing total cameras, regions, and last update timestamp
• About ALPRs page with documented privacy harms, legal context, and community resources

The map data exports are also available directly:

• data/flock_cameras.geojson — GeoJSON for use in QGIS, Leaflet, or other tools
• data/flock_cameras.csv — spreadsheet-friendly format
• data/scan_stats.json — scan statistics and counts

Key Limitations #

Take the map with a grain of salt. WiGLE is a crowdsourced, sporadically-updated dataset, not a live feed.

• Flock cameras don’t broadcast continuously. They wake briefly to upload data, so WiGLE records depend entirely on a wardriver being nearby at exactly the right moment.
• Data may be months or years old. Cameras that have been relocated or removed may still appear.
• OUI matching is a heuristic. OUIs can be shared, reassigned, or spoofed. Every result is a suspected Flock device, not a confirmed one.
• Coverage is uneven. Dense metro areas have more WiGLE data; rural areas have far less.

Use the map to develop general awareness of surveillance density in your area. For ground-truth, real-time detection, see the hardware options below.

Running Flock Finder Yourself #

Prerequisites #

• Python 3.8+
• A free WiGLE account with API credentials

Setup #

# Clone the repository
git clone https://github.com/simeononsecurity/flock-finder.git
cd flock-finder

# Install dependencies
pip install -r requirements.txt

# Set up your WiGLE API credentials
cp .env.example .env
# Edit .env with your WiGLE API Name and Token

Running the Scanner #

# Full scan — all 31 OUI prefixes, worldwide
python3 scripts/wigle_query.py

# Single OUI test
python3 scripts/wigle_query.py --oui 70:C9:4E

# US only
python3 scripts/wigle_query.py --country US

# Specific bounding box (lat1,lon1,lat2,lon2)
python3 scripts/wigle_query.py --bbox 37,-97,39,-94

# Dry run — verify auth, no API queries
python3 scripts/wigle_query.py --dry-run

Viewing the Map Locally #

python3 -m http.server 8080 --directory docs/
# Open http://localhost:8080 in your browser

Automated Daily Updates via GitHub Actions #

Fork the repo and add your WiGLE credentials as repository secrets (WIGLE_API_NAME and WIGLE_API_TOKEN). The included workflow runs at 6 AM UTC daily and auto-commits updated data files whenever new cameras are found.

Real-Time Detection: STS Collective FlockYou Hardware #

The WiGLE map tells you where cameras have been observed. For real-time detection as you drive — using @NitekryDPaul’s actual OUI matching method on live WiFi traffic — you need dedicated hardware.

STS Collective makes portable ESP32-based detectors that scan for Flock OUI signatures and alert you the moment a matching signature is detected.

FlockYou Device Lineup #

All devices:

• Pre-flashed, ready to use out of the box
• Scan live WiFi traffic for all 31 known Flock OUIs
• Compact and portable — fits in a cup holder or pocket
• Powered via USB-C (car adapter, power bank, or laptop)

💰 Exclusive Discounts: Use code FLOCKFINDER for 20% off all STS Collective FlockYou devices — or use code SIMEONONSECURITY for up to 20% off your entire order. Shop at stscollective.com/discount/SIMEONONSECURITY .

For a full technical breakdown of these devices and DIY alternatives, read the Flock-You Detection Project: Complete Counter-Surveillance Hardware and Setup Guide .

Project Structure #

flock-finder/
├── scripts/
│   └── wigle_query.py        # WiGLE API query and data pipeline
├── data/
│   ├── flock_ouis.csv         # 31 known Flock Safety OUI prefixes
│   ├── flock_cameras.geojson  # Camera locations (GeoJSON)
│   ├── flock_cameras.csv      # Camera locations (CSV)
│   └── scan_stats.json        # Scan statistics
├── docs/
│   └── index.html             # Interactive Leaflet map
└── .github/workflows/
    └── update-data.yml        # Daily auto-update workflow

Frequently Asked Questions #

Is this legal? #

Yes. Flock Finder uses only publicly available data from the WiGLE database, which aggregates voluntarily contributed WiFi survey data. No hacking, unauthorized access, or proprietary systems are involved. Passive WiFi monitoring for OUI signatures is legal in the United States.

Is every mapped camera definitely a Flock camera? #

No. OUI matching is a heuristic. OUI prefixes can be shared across manufacturers, reassigned, or spoofed. Every record in the database is a suspected Flock device — not a confirmed one. Read the Data Policy for details on how to request a correction.

Why do some OUI prefixes show no cameras? #

WiGLE coverage is uneven. If no wardriver has scanned a given area with that specific OUI active, there will be no records. Absence of data does not mean absence of cameras.

How current is the data? #

The GitHub Actions workflow runs daily and pulls the latest WiGLE results. However, WiGLE itself may have records ranging from days to years old for any given location. Check the scan_stats.json file for the timestamp of the most recent scan.

Can I contribute my own wardrive data? #

Yes. Upload your wardrive data to WiGLE — it automatically feeds into Flock Finder’s next daily scan. You can also contribute OUI prefixes or code improvements via the Contributing Guide .

Community and Related Projects #

Flock Finder does not stand alone. A growing ecosystem of tools and organizations is working to document and counter ALPR surveillance:

• DeFlock.org — Community-driven ALPR tracking, documentation, and advocacy
• Have I Been Flocked? — Check if your plate has been searched in Flock’s system
• FlockHopper — Route planning that avoids known ALPR cameras
• Atlas of Surveillance (EFF) — EFF’s database of surveillance tech used by law enforcement
• NoALPRs.com — Resources for communities fighting ALPR deployments
• DeFlockJoplin — Open-source firmware and field research; contributed the 31st OUI prefix

Credits #

• OUI Research: @NitekryDPaul — all 30 original OUI prefixes and the addr1/promiscuous-mode detection strategy
• Field Testing: Michael / DeFlockJoplin — 31st OUI prefix (82:6B:F2) and wildcard probe tightening
• Data Source: WiGLE — crowdsourced WiFi/cell network database
• Inspired by: DeFlock and track-openroaming-passpoint
• Hardware partner: STS Collective — FlockYou ESP32 detectors

Conclusion #

Flock Finder gives anyone a quick, visual sense of how widely Flock Safety ALPR cameras have been deployed — 40,000+ estimated locations across 109 countries, automatically updated every day from crowdsourced WiFi data.

It is a transparency tool, not a live tracker. Its data is historical, incomplete, and probabilistic. But it makes the scale of ALPR surveillance visible in a way that abstracts and reports cannot.

For genuine real-time protection as you move through surveilled areas, pair the map with dedicated hardware. STS Collective’s FlockYou devices implement @NitekryDPaul’s detection method directly on an ESP32 and alert you the moment a live camera signature is detected — available at stscollective.com with code FLOCKFINDER or SIMEONONSECURITY for up to 20% off.

Related Reading #

• Flock Safety Camera Surveillance: Prevalence, Privacy Concerns, and Protection Strategies — The broader context of ALPR surveillance in 2026
• Flock-You Detection Project: Complete Counter-Surveillance Hardware and Setup Guide — Hardware platforms for real-time Flock detection
• DagShell Custom Firmware for Orbic RCL400 — Turn a mobile hotspot into a security research platform
• How to Flash Rayhunter Devices — Detect IMSI catchers alongside ALPR cameras

References #

1. Flock Finder GitHub Repository
2. Flock Finder Interactive Map
3. STS Collective — FlockYou Devices
4. WiGLE — Wireless Network Mapping
5. DeFlock — Community ALPR Awareness
6. DeFlockJoplin — Open-Source Detection Firmware
7. Electronic Frontier Foundation — ALPR
8. ACLU — You Are Being Tracked