Introduction
Over the past few years, I start getting super into digging around in random public government GIS servers. GIS stands for Geographic Information System; its basically a private Google Maps on steroids.
These maps are used to track a lot of different things; who owns property, where roads are, how many road signs a state maintains, amongst many other things. Some of these datasets are publicly viewable through web maps for the general public. GIS is used for more than just the public sector, theres a lot of organizations who utilize and publish their data publicly as well.
There are more polished versions of GIS out there: Google Maps, real estate/apartment search sites, weather maps, etc. You probably interact with a form of GIS everyday without realizing it!
What a lot of people don’t realize though is there are a lot of open GIS endpoints all over the internet, including the ones hosting your city, county, or state’s GIS services. These servers are setup by analysts who aren’t typically trained to be security conscious and its not uncommon for private datasets to mistakenly end up public on the backend ArcGIS REST API.
These datasets are often not visible in the public web maps that pull their information off of the same REST API. If you ever try this yourself, compare whats available on your public web maps vs. whats viewable through the REST API using a desktop application like QGIS. You might be surprised!
I’ll have to explain the process of finding the backend portals for online web maps another time, but its something thats easy to get the hang of and an absolutely crucial skill in finding and creating offline copies of these datasets.
As I mentioned earlier, a city will use a GIS map to track where their roads are; why wouldn’t they use it to track where their investment in ALPR cameras are?
The ALPR Problem
In recent years, ALPR and camera networks have sprouted up across America with minimal community input. Its often sold as a “cure-all” for your local community’s crime problems. On its face, it sounds like this technology could be used for good but systems like these are more often than not abused by the boys in blue. On top of that, there is no substantial evidence that ALPRs and mass surveillance actually effectively prevent crime.
That is why organizations like DeFlock and ALPR Watch have sprouted up; to allow us to work together to fight for our privacy and civil liberties. Mass surveillance is not freedom. This is merely a loop hole created by private companies to allow law enforcement to track and flag you as “suspicious” without a warrant.
DeFlock relies on community submissions to crowd-source a map on OpenStreetMap of all known ALPR camera locations. ALPR Watch takes that a step further by encouraging people to use OSINT (Open Source Intelligence) methods to find where possible locations are. This is commonly done through submitting data sources aggregated by local news organizations, FOIA Requests, and many other methods.
These submitted datasets are then placed onto a “Suspected Locations” map on ALPR Watch’s website where users can determine whether or not the camera is still there and add it to OpenStreetMaps which in turn will add it to DeFlock’s website.
Stumbling Into The Jackpot
Before I knew about ALPR Watch and what they were doing over there, I was just browsing GIS datasets for fun. I would query Google using dorking techniques like quotations and inurl strings.
I eventually had the idea to start searching for Flock cameras:
As you can see, there were lots of juicy results that had potential to show locations of Flock ALPR cameras. These are all publicly indexed ArcGIS REST APIs that Google has found. Searching using other search engines like DuckDuckGo, Yandex, or Shodan might also show different results.
This one particular city’s GIS dataset caught my eye and I decided to connect to it.
This was a bit more than the city that it was supposed to be; this dataset totaled over 21,000 individual camera pins. When compared to the current DeFlock database, some of these cameras were missing. From what I could tell, it appeared to be an older map; it was missing some cameras recently added to my town in 2025.
I decided to drive around the next day and see if I could verify that this map was still accurate, which turned out to be fruitful.
The dataset at this point was considered by me to be accurate, but I wasn’t sure at the time how to bulk add this information to the database. I joined and asked around on the DeFlock discord and folks pointed me to the ALPR Watch GitLab project page.
On there, you can open an issue with the project where you can provide your datasets and they’ll import them into the next update of the map. This in turn adds them to the ALPR Watch map located at https://alprwatch.org/flock/suspected-locations/.
From there, map editors can use this information to find ALPR cameras faster and those people can add this information into the official DeFlock database.
Conclusion
Since finding and sharing this dataset, I’m not sure how many cameras this has added to the DeFlock database; I’m certain though that this will add at least several thousand previously unknown cameras.
In the meantime, I’ve managed to find several other datasets for the Kansas City area and plan to submit those as well. There are still plenty more datasets out there to explore, archive and share with the community and I encourage you to do so.
More and more people are being targeted by LEOs who abuse of these systems daily and that number is only growing. It is our job and duty as a community to track and fight against these Orwellian nightmares. We are not a shepherds flock to be watched over. We are humans. We deserve to not be tracked by private companies.
You can find my contribution to ALPR Watch here: https://gitlab.com/alprwatch-org/suspected-locations/-/work_items/51