Flock Gains CVE Numbering Authority Amidst Trust Concerns
Public safety tech company Flock has been granted CVE Numbering Authority (CNA) status, allowing it to assign CVE IDs to vulnerabilities in its own products, sparking debate over its credibility.
Flock, a company known for its surveillance systems and past controversies involving law enforcement misuse of its products, has achieved a significant milestone by becoming a CVE Numbering Authority (CNA). This designation empowers Flock to assign CVE IDs to vulnerabilities discovered within its own product lines, including automated license plate readers (ALPRs) and AI-powered cameras. The company states this move is intended to streamline its internal vulnerability management processes, enabling faster responses to researcher findings, reducing confusion from duplicate entries, and providing customers with a centralized, authoritative source for security information.
While many vendors are granted CNA status to improve security communication, Flock's position is complicated by its history. The company has faced considerable public and legal scrutiny over privacy concerns and documented instances of police abusing its technology. These controversies have eroded trust, leading some experts to question how security researchers and the public will perceive Flock's credibility as a CNA. The effectiveness of Flock's new authority will ultimately be judged by its ability to provide accurate, detailed, and timely vulnerability information.
Security experts emphasize that the true measure of Flock's CNA status lies in the quality of the information it disseminates. "The measure of Flock as a CNA is whether its records give cities, police departments, and the public enough detail and accuracy to let people track specific risks by product version, the nature of the vulnerability, and ideally how to mitigate or fix it," noted Katie Moussouris, founder and CEO of Luta Security. Flock has declined to provide further comment beyond a blog post and has recently established a security advisories page where it plans to publish vulnerability information.
Concerns about potential conflicts of interest are also prominent. As a CNA, Flock is essentially "grading its own homework," as described by security researcher Zach Edwards. This self-assessment capability requires a high degree of trust, which Flock must earn through consistent and transparent handling of security issues. Moussouris elaborated that while vendors can be effective CNAs due to their intimate knowledge of their code, "the conflict of interest manifests when they lack the organizational and technical maturity to correctly assess the flaws and their impact." An immature vendor might inaccurately represent an issue, either intentionally or unintentionally, to downplay its severity.
Flock's vulnerability disclosure policy outlines several restrictions, disallowing testing against live customer deployments, accessing law enforcement data, physical attacks, denial-of-service testing, and social engineering. Notably, the company does not operate a paid bug bounty program. Furthermore, Flock reserves the right to withhold publication of vulnerabilities if it deems disclosure could pose a safety risk to law enforcement or the public. This policy, combined with the sensitive nature of its products and clientele, raises concerns about potential abuses of its CNA authority.
Experts like Moussouris suggest that Flock's unique position as a vendor whose products track individuals and whose primary customers are police departments necessitates a particularly mature and transparent approach to vulnerability disclosure. "The latter may lead to an abuse in their authority and control of CVEs unless they embrace a more mature customer-safety-first stance of timely, transparent, and accurate vulnerability disclosure," she stated.
While some vendors possess CNA status, the operational norms can vary significantly. Some CNAs are highly active in disclosing vulnerabilities, while others remain largely silent for years. The ultimate success and trustworthiness of Flock's CNA program will depend on its future actions and transparency. As Edwards wryly commented, "Only time will tell how Flock operates their CVE program and if they issue CVEs for vulnerabilities publicly disclosed. But, if their recent history is any indication, they will probably screw it up in some epic way that somehow unites people across the United States to demand CVE issuing reform."