The Pentagon gets flocked in a no-bid contract. What could go wrong?

The Pentagon has contracted the installation of Flock cameras under a no-bid contract, raising concerns about potential security risks and privacy violations. At least nine Flock automated license plate readers (ALPRs) are currently monitoring traffic lanes leading to the Pentagon’s parking lots, including those used by defense department personnel. These cameras aim to help security forces identify vehicles that may pose a threat. However, critics argue that the devices' alleged vulnerabilities could allow unauthorized users to access sensitive information about national security officials. Concerns about Flock’s cybersecurity practices have led to public backlash, including protests and contract cancellations. Some individuals have raised alarms about the possibility of these devices being exploited by hackers or foreign adversaries. In response, Flock has claimed that its systems have “never been hacked.” Nevertheless, critics challenge this assertion, citing multiple methods through which the devices could be accessed by unauthorized users. These concerns prompted two members of Congress, Senator Ron Wyden (D-Ore.) and Rep. Raja Krishnamoorthi (D-Ill.), to request an investigation into Flock’s cybersecurity practices. Wyden expressed skepticism about the Pentagon’s decision to deploy the cameras, suggesting that sharing such data with adversarial nations would be akin to sending it directly to China, Russia, and Iran. In late 2021, the Defense Department awarded a contract to M.C. Dean Inc., a Virginia-based firm, to enhance the Pentagon’s electronic and physical security systems. This contract is structured as an “Indefinite Delivery / Indefinite Quantity” agreement, allowing the DOD to issue smaller contracts directly to M.C. Dean whenever new requirements emerge. Although the Pentagon does not have a direct relationship with Flock Safety, it has acquired Flock’s products through these delivery orders. The desire for increased security is evident, given the Pentagon’s history of targeted attacks since the September 11, 2001, tragedy. One notable incident occurred almost a year after M.C. Dean began its work, when a Virginia man attempted to drive through the Pentagon’s checkpoints and was intercepted by security forces. He confessed to trying to “kill people,” and the incident underscored the importance of measures like the active vehicle barriers and traffic arms that M.C. Dean was tasked with implementing. Despite these efforts, some aspects of the contract have sparked questions about whether increased spending translates to greater security. In May 2023, the DOD issued a delivery order to M.C. Dean indicating its intent to proceed with further installations. Meanwhile, a cybersecurity researcher named Joshua Michael has compiled a comprehensive map of Flock’s surveillance network, revealing over 170,000 cameras and more than 130,000 associated devices across the United States. This map, based on data from Flock’s own records, highlights the extent of the company’s presence, including clusters near major airports and within detention centers. Michael noted that these devices enable foreign entities to monitor the movements of government officials without the need for espionage. His findings were presented during a Senate Subcommittee on Crime and Counterterrorism hearing. Michael discovered a method to access Flock’s location data by exploiting publicly accessible endpoints on the company’s servers. He informed Flock of his findings through multiple attempts, but received no response. His research underscores ongoing concerns about the transparency and security of Flock’s surveillance infrastructure.