A security concern about Apex's license plate cameras reached the Town Manager in February 2026. The Chief of Police asked IT for specifics in April. IT replied that the investigation had been parked for three months and that nothing was verified. Four months later, no public record shows anyone closed it.
Everything on this page comes from Town of Apex emails produced under the North Carolina Public Records Act, or from published security research with a citation. Where the record is ambiguous, this page says so and explains what it does not prove. That matters more here than anywhere else on this site, because the underlying question is one that residents will be tempted to overstate.
Part 1: The Town's own record
On April 14, 2026, Apex Police Chief Ryan Johansen emailed Erika Sacco of Town IT, copying Demetria John. The subject line was "Flock ALPR follow-up". He was writing after a meeting with Flock executives about the security of the Town's cameras.
"In our meeting, you stated that someone you knew had successfully hacked into one of our deployed ALPR cameras. You cited lack of a key security patch as the likely reason this was able to be done."
"In an effort to reconcile what our vendor is telling me, and what happened with this hack, I need specific information. Namely, I need to know which of our cameras was accessed, when, and by what means. I'd appreciate it if you would provide these details so that I can continue to evaluate the reliability of our current vendor."
Chief Ryan Johansen to Erika Sacco, Town of Apex IT · April 14, 2026That is the Chief of Police, in writing, treating a reported compromise of an Apex camera as serious enough to question his vendor's reliability over.
Sacco's reply on May 1 does not repeat the Chief's description. Her account of the original concern is narrower and more cautious, and the difference is important enough that this page will not paper over it.
"My recollection of the reason for the meeting was that several citizens had contacted Council stating they believed they were able to hack Flock cameras. Randy asked IT to look into the concern, and we provided the attached briefing to him back in February as part of that request."
Erika Sacco, Town of Apex IT, to Chief Johansen · May 1, 2026So the chain contains two versions. The Chief's recollection is that IT told him someone had successfully hacked a deployed Apex camera through a missing security patch. IT's written reply describes residents who believed the cameras could be hacked. Sacco neither confirms the Chief's version nor denies it, and she never identifies a camera, a date, or a method.
The rest of Sacco's email is not a recollection. It is a status report, and it is unambiguous.
This finding does not depend on whether a camera was actually breached. It holds either way, and that is what makes it worth asking about.
It would be easy to say Flock ignored its customer. The record does not support that. The February meeting made the Chief responsible for connecting the two parties, by either route. Nothing in these documents shows that Flock was ever contacted and refused to respond. What the documents show is that the handoff did not happen. Residents who blame the vendor here are letting the Town off the hook for the part it controlled.
Part 2: The vendor's published security record
The Chief's email points at a missing patch as the likely cause. Whatever happened in Apex, that phrase describes the ordinary state of this product line, and the evidence for that is public and independent of anything the Town holds.
Security research published by GainSec documented 51 security findings across Flock Safety's device ecosystem, covering the Falcon and Sparrow license plate readers and the Raven gunshot detection microphones. Twenty-two of those findings were assigned CVE numbers by MITRE, with eight more pending at the time of publication.
A CVE number is not a complaint. It is a permanent public identifier issued through the program MITRE operates under federal funding, and it means the flaw was reviewed and accepted as a real vulnerability by a body independent of both the researcher and the vendor.
CVE-2025-59403. The Flock Safety Android application on Falcon, Sparrow and Bravo devices exposed administrative API endpoints on port 8080 with no authentication at all. The documented endpoints include /reboot, /logs, /crashpack and /adb/enable. The stated impacts are denial of service, information disclosure, and remote code execution.
CVE-2025-59409. Falcon and Sparrow readers shipped with development Wi-Fi credentials stored in cleartext inside production firmware.
Neither of these requires sophistication to understand. The first means anyone who could reach the device on a network could reboot it, read its logs, or run code on it. The second means credentials that should never have left a lab were printed inside shipped hardware.
Flock's readers run Android Things 8.0 and 8.1. Google ended support for Android Things in January 2021. There have been no platform security patches for more than five years, and the hardware continued to be manufactured, sold and deployed on that base.
This is the part that matters for Apex. A vendor can fix an individual flaw. A vendor cannot patch an operating system its supplier abandoned five years ago. So when the Chief writes "lack of a key security patch," he is not describing one unlucky device in one town. He is describing the platform.
Put the two halves together and the question for Council becomes narrow. The Town was told a camera may have been compromised through a missing patch. The product runs on an unpatchable platform with 22 accepted CVEs. And the Town's own IT function wrote down that it never verified whether anything was fixed. Renewing a contract in that posture is a decision, not a formality.
Part 3: 133 share requests, June 2025 to May 2026
Separately from the security question, the Town produced 16 automated emails from Flock to Deputy Chief Trevor Materasso, each headed "Great news, your network is growing!" Each one lists organizations that have asked for access to Apex's Flock network and are awaiting approval.
These have been on this site as source PDFs for weeks. Nobody read them, including us, because they were posted without titles. Extracted into a table, they contain 133 access requests from 133 organizations across a span of roughly eleven months. Every row below is transcribed from those PDFs and the full set is downloadable as a CSV.
The public conversation in Apex has assumed that sharing means plate searches. It does not. Flock's own notification emails break each request into permission types, and 57 of the 133 asked for something beyond search.
Fourteen organizations asked for video access. Among them: the NYS Crime Analysis Center Network, a Florida state wildlife agency listed as "Fish and Wildlife Commission FL PD," and Guilford Technical Community College. The Florida entry is the broadest request in the set, covering search, hot list, all three VMS permissions, and Analytics.
| Organization▲▼ | Requested▲▼ | Permissions requested▲▼ | Flock notified APD▲▼ |
|---|
The 16 notifications arrive on a two-week Wednesday cycle, but the series is not continuous. Eight expected dates in the cycle are absent from the production, including April 22, 2026.
That date matters because of a separate email chain. On April 8, 2026, Criminal Intelligence Analyst Jennifer Conley told Deputy Chief Materasso that "there is a state agency requesting Flock access." The April 8 notification in this set lists New York State Police, which matches. On April 13 she reported another state request. Then on April 15 she wrote: "Two federal agencies are requesting access in Flock."
No federal agency appears anywhere in the 133 rows above. There is no notification email in the production covering the window that contains April 15. So either Flock's automated notifications do not include federal requests, or the notification for that window was not produced.
These are narrow, dated requests. Each one is for a document that either exists or does not, which makes them hard to answer with an adjective.
Prepared at the Town Manager's request and referenced twice as an attachment in the April to May chain. It was not included in the production.
If Flock was contacted, there is a record of it. If Flock was never contacted, that is the answer to why an investigation into camera security sat for three months.
If it was resolved, this takes one sentence and we will publish it here. If it was not, residents should know that before the contract is renewed.
Requesting agency, date received, approved or denied, and who holds approval authority. This covers the two federal requests of April 15 and the four requests in that window generally.
September 24, October 22 and November 5, December 3 and December 31, 2025, and March 11, March 25 and April 22, 2026. If no email was sent on a given date, a statement to that effect closes the question.
The last regular Council meeting with guaranteed public comment before the committee takes up the Flock contract is Tuesday, September 22, 6:00 PM, Apex Town Hall, 73 Hunter Street. Arrive by 5:30. The sign-up sheet goes out before the start.
Email Council →