Flock Security's CVE authority role sparks transparency and credibility concerns
The surveillance vendor gained authority to assign vulnerability IDs to its own cameras and license plate readers, raising questions about transparency.
Key points
- Flock joined the CVE Program as a CNA to manage vulnerability disclosures for its products.
- Critics argue the company's history of privacy controversies may undermine its credibility as a CNA.
- Researchers may continue to disclose vulnerabilities independently rather than coordinating with Flock.
Flock Security has officially become a CVE Numbering Authority, granting the company the power to assign vulnerability identifiers to its own surveillance devices. This move allows the manufacturer to grade defects and coordinate responses internally, according to CyberScoop.
What happened
Flock announced that it joined the global network of more than 550 CVE Numbering Authorities. This designation gives the company the authority to assign Common Vulnerabilities and Exposures IDs to flaws in its automated license plate readers and AI-powered cameras. The firm stated that this status helps it assess and prioritize responses to security defects internally.
Chris Castaldo, chief information security officer at Flock, said the new role allows the company to move faster when researchers report findings. He added that it eliminates confusion from duplicate entries and provides customers with a single source for security information. Flock published its vulnerability disclosure policy in August and recently launched a security advisories page for confirmed vulnerabilities.
The company declined to make an executive available for an interview regarding the development. Instead, Flock referred inquiries back to its blog post announcing the CNA status. CyberScoop reported that the company did not answer specific questions about its plans for transparency or coordination with external researchers.
Why it matters
Security experts note that many vendors gain CNA authority for legitimate operational reasons. However, Flock’s business has faced significant public and legal scrutiny over privacy concerns and reports of police abuse. These controversies have impacted the company’s credibility and may influence how security researchers view its role as a CNA.
Katie Moussouris, founder and CEO of Luta Security, told CyberScoop that the measure of Flock as a CNA is whether its records provide enough detail. She emphasized that cities, police departments, and the public need accurate information to track specific risks by product version. Moussouris noted that records should ideally include the nature of the vulnerability and how to mitigate it.
The development highlights limitations in the CVE program regarding what constitutes a vulnerability. Zach Edwards, a security and privacy researcher, noted that activists have performed technical teardowns of Flock products. He expects some researchers to continue disclosing vulnerabilities without coordinating with the company, regardless of its new CNA status.
Our take on the response
- Flock’s decision to become a CNA centralizes vulnerability reporting but raises concerns about independent oversight.
- The company’s history of privacy controversies may lead researchers to bypass official channels.
- Transparency in vulnerability records will be critical for maintaining trust with customers and the public.
What to do and how to stay safe: Flock Security
- Monitor Flock’s newly created security advisories page for confirmed vulnerabilities in your deployed hardware.
- Verify that your organization’s vulnerability management process includes tracking CVEs assigned by Flock as a CNA.
- Review your vendor contracts to ensure they require timely disclosure of security flaws and mitigation guidance.
- Consider independent security assessments of surveillance hardware to validate vendor-provided vulnerability information.
Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget
General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What does it mean for Flock to be a CVE Numbering Authority?
It means Flock can now assign CVE IDs to vulnerabilities in its own products and grade those defects.
When did Flock publish its vulnerability disclosure policy?
Flock published its vulnerability disclosure policy in August, according to the source material.
Will researchers still disclose vulnerabilities independently?
Yes, security researcher Zach Edwards expects some researchers to continue disclosing vulnerabilities without coordinating with Flock.
