Flock Safety, whose license plate readers and AI-powered cameras are used by police departments across the U.S., can now assign official identifiers to security flaws in its own products and publish the records itself, a change that puts a surveillance vendor facing scrutiny from lawmakers and courts in charge of how its weaknesses are described to the cities that buy its equipment. Security researchers told CyberScoop Monday that the arrangement amounts to self-grading and will test whether Flock's records carry enough detail for customers to judge their risk.

What Happened

Flock said in an announcement dated Oct. 6 that the Cybersecurity and Infrastructure Security Agency (CISA) had authorized it as a CVE Numbering Authority. CVE, short for Common Vulnerabilities and Exposures, is the standard public catalog of known software and hardware flaws, and each entry gets a unique ID that security teams use to track fixes. A numbering authority is an organization allowed to issue those IDs and write the records for a defined set of products. The program is sponsored by CISA, operated by the nonprofit MITRE and feeds the National Vulnerability Database kept by the National Institute of Standards and Technology, Flock's announcement says.

Flock's authority covers only Flock-branded hardware and software. The company says it will acknowledge researchers' findings, assign IDs, set disclosure timelines and credit researchers in-house rather than depend on outside parties. Chris Castaldo, its chief information security officer, said in the announcement that the designation "allows us to move faster when researchers report findings." Flock also said customers would get one consistent source of information without duplicate or conflicting entries. It joins more than 550 such authorities, CyberScoop reported.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

Flock's vulnerability disclosure policy promises to acknowledge reports within five business days and to rate severity within 10. It says Flock will publish a CVE and advisory once a fix or mitigation exists, and after 120 days even without a fix, unless publication would create a material safety risk to law enforcement or the public. Researchers may not test live customer or agency deployments, touch law enforcement data, or use physical attacks, denial-of-service or social engineering. Flock offers legal safe harbor for good-faith research but no paid bug bounty. Its security advisories page said it had not yet published an advisory under the policy.

Why It Matters

Many large vendors number their own flaws, and CyberScoop noted that few standardized norms govern how they do it. What sets this case apart is the customer base. The buyers are mostly police agencies and local governments, and CVE records are often their only practical way to track whether deployed cameras need fixes. Once Flock writes those records, it shapes how severe a flaw looks, which versions it lists and when the public learns of it.

Katie Moussouris, chief executive of Luta Security, told CyberScoop that vendors can be suitable authorities if their records are accurate. She warned that an immature vendor may play down issues and that the safety exception in Flock's policy could open the door to misuse. Security and privacy researcher Zach Edwards described numbering authorities as grading their own homework and said he expects some researchers to keep publishing Flock flaws without coordinating with the company. CyberScoop reported that researchers flagged several defects in Flock's plate reader and gunshot detection products last year, and that Flock submitted them to the national database but judged them not material because they required physical access to the devices. Flock declined CyberScoop's interview request and pointed to its blog post.

Procurement teams and city councils can use the change. Contracts can require advance notice of flaws and version-level detail, so customers do not depend only on what Flock chooses to publish.

Context

The authorization comes as Flock's network faces scrutiny in Congress and the courts. Senators have filed competing bills on how plate reader data is searched and kept, and a federal judge in Oklahoma threw out evidence from a warrantless lookup in the system.

What to Watch

The first CVE records Flock publishes will show how much version and severity detail it gives. Watch, too, whether it ever invokes the safety exception to delay disclosure, and whether outside researchers keep reporting Flock flaws through other channels. Customers may also start to ask for advance notice of flaws in their contracts.