Field Guidefluckfock · passive only
Field manual · v2026.08

Learn the silhouette.

If you can see the pole, you can name the camera. Spot it, build a $10 passive detector, map it, and understand exactly what the network does — verified, and current.

20B+
Plate scans a month
49
States with cameras
30 → 7d
New default retention
$10
Cost of a detector
01 — The landscape

What you're looking at.

Know the system before you go hunting the hardware — and know that the ground is shifting fast right now.

Flock Safety runs one of the largest private ALPR networks in the US — 20 billion+ vehicle scans a month across 49 states and 5,000+ communities. Each capture is a vehicle fingerprint: plate, make, model, color, and distinctive marks, stamped with time and location, uploaded to a system police (and often HOAs and businesses) can search — frequently across agencies, so a camera in one town is queryable from far away.

The product line matters for identification: Falcon is the common fixed plate camera; Sparrow photographs vehicle rears for traffic; Condor is a pan-tilt-zoom camera that can zoom on faces; Raven is an audio/gunshot sensor, not a plate camera; and Nova is a data platform that fuses ALPR data with other datasets.

2026 in brief: under pressure, Flock cut default data retention from 30 days to 7, added case-code requirements and audit tooling, and gave agencies the option to block immigration-related searches — changes the ACLU and Institute for Justice call insufficient. It also canceled a plan to have Raven microphones flag human "distress"/voices after backlash. Class actions are live, and investigative reporting (404 Media and others) keeps surfacing misuse.

02 — Identify

The 60-second checklist.

A fixed Flock plate reader (Falcon-style) is far more likely when several of these show up together. Strongest when you can corroborate on a map.

  1. 01Black, oval or narrow rounded housing. More like a flattened dark cylinder than a boxy camera.
  2. 02Dedicated dark pole ~12–14 ft. Or a clamp on an existing utility / light pole.
  3. 03Small solar panel + battery box. Many run off-grid; hardwired installs exist too, so missing solar doesn't rule it out.
  4. 04Aimed through traffic. At the rear of passing vehicles — not across a sidewalk or at a doorway.
  5. 05Narrow field of view. Covering one entrance/exit or 1–4 lanes.
  6. 06Matching point on DeFlock / OSM. Corroboration, not proof — entries can be stale or wrong.

Strongest everyday pattern: black oval camera + rear-plate aim + roadside pole + solar/battery + a known label or mapped point.

Hardware families

Falcon plate cam
The common fixed license-plate reader. Black oval/rounded housing, road-facing lens, pole-mounted, often solar + battery. This is what the detector targets.
Sparrow plate cam
Traffic-oriented camera that photographs the rear of passing vehicles. Same family, same identification cues.
Condor PTZ cam
Pan-tilt-zoom camera that can swivel and zoom — including onto people's faces. Larger, movable housing.
Raven audio — not a plate cam
Acoustic gunshot/event sensor, not a license-plate reader. Compact box; different purpose. (Flock canceled its plan to also flag human voices in 2026.)
Other vendors varies
Motorola/Vigilant, Genetec and others deploy ALPRs too — different shapes and branding. The open maps track multiple manufacturers.

Treat visual + map + (optional) RF as a combined signal — never any single method as absolute. Similar-looking non-Flock cameras exist, labels get removed, and maps lag reality.

03 — Build a detector

They already shout.

A ~$10 ESP32 that hears cameras phone home — without ever transmitting. Pure listening: no deauth, no spoof, no jam.

How the signal works

Falcon-family cameras run their Wi-Fi in station mode and constantly send probe requests hunting for their uplink — even with their own hotspot off. Those are public radio frames any receiver can hear.

SIGNAL

Probe requests

Wildcard (null-SSID) probes sprayed constantly to phone home. Always-on, no hotspot needed.

LISTENER

Promiscuous mode

An ESP32 hops channels 1 / 6 / 11 a few times a second, reading every probe that passes.

MATCH

OUI + IE fingerprint

Flag probes whose transmitter MAC matches a known Flock OUI and whose 802.11 IEs fingerprint Flock radios.

What's dead: detecting units by their Flock-XXXXXX SSID name is mostly useless now — units keep hotspots off. Bluetooth detection largely stopped working in spring 2025. The probe + OUI + IE path is what holds up. (Research lineage: Jon Gaines / GainSec and the DeFlock community.)

Read hits by confidence

HighWildcard probe + full IE fingerprint match. The strong signal — built on hundreds of miles of driving with no false positives.
MediumSSID keyword (flock / flck) or a transmitter MAC on the community OUI list. Worth a look.
LowHidden SSID, receiver-side OUI, or BSSID match. Ambient only — note it, don't trust it.

RSSI tells you proximity (−70 dBm is closer than −85). OUI lists differ between projects — treat the one bundled with your firmware as current, and always confirm with your eyes.

Pick a board

BoardCostScreenBest for
Seeed XIAO ESP32-S3canonical flock-you default$7–15None (buzzer + LED)Smallest headless build; phone GPS; flash log + KML export.
ESP32-2432S028R "CYD"Cheap Yellow Display$10–132.8" TFTAt-a-glance "FLOCK FOUND" screen, SD logging, web-flasher.
ESP32-DevKitC / WROVER-E8MB PSRAM$8–12NoneMost-documented method; auto-flashes over USB.
LilyGO T-Dongle S3ST7735 screen$12–18Small TFTUSB-stick form factor with a display.

The afternoon build

BUILD PROGRESS0 / 8
  • Buy a board + USB-C cableXIAO ESP32-S3 or a CYD. ~$10.
  • Find a known camera to test againstPick a mapped ALPR near you on DeFlock as ground truth.
  • Get the firmware for your boardClone the matching repo; note its OUI/IE dataset.
  • Flash itCYD web-flasher (drop firmware.bin at 0x10000) or PlatformIO.
  • Open the serial monitor or screenConfirm it's hopping 1 / 6 / 11 and counting probes.
  • Walk/drive slowly past the known unitLow speed = easier. Watch for a High-confidence hit.
  • Confirm visually, log RSSI + GPSEyes on the housing. Save MAC, RSSI, channel, coords.
  • Report new finds to DeFlockFeed confirmed cameras back to the map.
PlatformIO · flash from source
# XIAO ESP32-S3 (headless)
pio run -e xiao_esp32s3 -t upload
pio device monitor

# Cheap Yellow Display (CYD)
pio run -e cyd -t upload

Reliability, honestly: range is short (tens of meters), probes are intermittent, and detection is worse at speed. Field tests miss units. An RF hit is a lead — never treat a silent detector as proof an area is clear.

04 — Map & avoid

The no-hardware path.

You don't have to build anything to get situational awareness today.

DeFlock deflock.org

Open-source, crowdsourced map of 300K+ reported ALPRs on OpenStreetMap. Filter by type/operator; add cameras you find. Free web map + mobile app.

Situational awareness, not a cloak — no map is complete.

Open the map

FlockHopper dontgetflocked.com

Don't Get Flocked's routing app: shows ALPRs on your trip and generates alternatives that minimize exposure. iOS + Android, GPX export, same open data.

Plan a route

Have I Been Flocked? haveibeenflocked.com

Search your plate against public Flock audit logs from records requests — searches of your plate, with the stated reason.

Not real-time; incomplete, delayed, often redacted. Not whether a camera physically saw you.

Check a plate
Resources

Projects & further reading.

Verified current as of August 2026. Confirm the OUI/IE datasets in whatever firmware you flash — they move faster than any guide.