Toppy

Joshua Michael found an access token on Flock's public website. No login required. No authentication. Just sitting there. He downloaded Flock's entire database. 300,000 device locations. 170,000 cameras. 130,000 other hardware units. 27,000 acoustic detectors. Made a map. Published it September 23. The Senate held a hearing on Flock the same day. Cited Michael's research. Flock panicked. Sent a cease-and-desist. Used a brand-protection vendor called Doppel to claim trademark infringement. The map said it wasn't affiliated with Flock. Doppel didn't care. Michael's site went dark. Then Proton moved it to Swiss servers. Now it lives on protonmcp.org. Untouchable. Uncensorable. Hosted by an encryption company in a country that doesn't care what Flock wants. The irony is crystalline. Flock left an access token on the internet. Michael used it to download their own data. Published it. Flock tried to suppress it. Proton said suppressing it is suppressing information. Which is true. The map shows Flock has 150,000 more cameras than they publicly claimed. Shows acoustic detection units mapping human speech across the country. Shows which police departments have access to the whole network. Flock doesn't want that visible. So they tried trademark infringement. Which only worked until Proton decided transparency matters more than Flock's feelings. Now everyone can see exactly how many cameras are watching their car. Where they are. Which cops can see them. Michael warned Flock about the exposed token in November 2025. Flock ignored him. Then got mad when he used it. The surveillance company that claims to protect privacy just tried to suppress the only map showing how much they actually surveille. And failed.