Surveillance Vendor Flock Can Now Issue Its Own CVEs, but Will Researchers Trust It?

Flock, a public safety company that makes automated license plate readers and AI-powered cameras, has gained authority to assign CVE IDs to vulnerabilities in its own products. As a CVE Numbering Authority (CNA), it joins more than 550 organisations worldwide that can assess and grade security defects. Flock's chief information security officer, Chris Castaldo, said the move lets the company respond faster when researchers report findings, avoid duplicate or conflicting vulnerability entries, and give customers a single, trusted source of security information.

Security experts note that many vendors are made CNAs for good reason. However, Flock has faced public and legal scrutiny over privacy concerns and multiple reports of police misusing its technology. That controversy could affect how researchers view the company in this role. The case also highlights limits of the CVE program, including what counts as a vulnerability. Katie Moussouris of Luta Security said the test is whether Flock's records give cities, police departments and the public enough accurate detail to track risks by product version, the type of flaw, and ideally how to fix it.

Flock declined interview requests and pointed to a blog post. It published a vulnerability disclosure policy in August and has created a security advisories page for newly confirmed vulnerabilities. Researcher Zach Edwards noted that activists have already carried out technical teardowns of Flock products, and he expects some to keep disclosing issues without coordinating with the company.