Joshua Michael

Howdy, folks! I’m Joshua Michael, and I want to set the record straight and tell you about who I am outside of news headlines.

I’m a , own two privacy-tech businesses, and teach cybersecurity/privacy online in my free time. It’s ironic for a privacy-focused guy to have social media, but I started it as a hedge against the risk of being “suicided”. If you want to learn about surveillance, how to reclaim your privacy, or about Flock, I recommend you follow me.

Despite the opposing rhetoric surrounding my research, I am not a malicious actor, I am not a cop hater, and I am not a hacker. I have worked on my formal research for longer than the opposing side’s Chief Information Security Officer has worked for them, and my research speaks for itself.

Read moreRead less

I didn’t have a traditional start, and I began in cyber after being invited to join a private middle school largely funded by the US military. Before the invitation to the STEMM school, I received an award from my state’s governor for achieving the highest-level scores on our state testing for math and science. At this school there were 88 of us, and I still remember a field trip where they showed us the F-35 up close on the military base.

Growing up between three military bases, coming from a military family, and having nearly everyone I know in the military shaped how I think about duty and security. Outside of schooling I was a Boy Scout, played football, wrestled, and trained Jiu-Jitsu.

None of this would have been possible without my adoptive parents, who took my brother and me in when I was three years old. My papa (adoptive dad) was a disciplined Vietnam War veteran who instilled tenets into the core of my being. It’s the small things. Growing up he would drive me to school every day and I remember playing a game where he would point out gas prices and ask me to calculate how much it would cost to fill up the gas tank. We played this game daily.

Fast forward to today, I’m known for teaching online and my research that concerns matters of public interest involving surveillance technology, cybersecurity, and associated national security concerns. These are issues that I take very seriously, and I can largely thank him for that.

My research isn’t concerned with a company’s quarter-to-quarter profit. It focuses on the national security risks attached to the dataset that Flock holds. I reported four vulnerabilities to Flock and often got little or no response, though not for lack of trying.

This matters when the dataset that a company holds encompasses nearly every American’s pattern of life and the ability to trace their daily activities. Imagine the power you’d have knowing you can trace nearly every politician, judge, service member, or federal employee and their families. This opens up risks concerning espionage and blackmail. If you do not know about Flock, Flock probably knows about you.

Ignorance is not security, and foreign nations won’t warn a company about its security flaws the way I did. I hope you take the time to read my formal paper and the four vulnerabilities I reported. If you’re keen to know more about me you can look here.

Joshua Michael in a tan blazer, white shirt and striped tie with an American flag pin, a cowboy hat on the wall behind him.

Timeline

Legal threats

Flock Threatens to Sue and Reports Me to Law Enforcement

Flock Safety has responded to my research with a cease-and-desist letter threatening litigation. In an email to its customers, the company branded me a malicious actor, announcing it had notified law enforcement. That same email concedes Flock found no indication of unauthorized access to its data when it closed the issue in December, which is precisely the monitoring failure my research warns about. I’m not backing down.

Flock’s legal threats, its customer email, and why I’m standing by my national-security research.

Satellite map of the central and eastern United States covered in dots, one for each Flock Safety device, densest from Texas to the East Coast.

Formal research paper · 160 pages

‘Never Hacked’: The National Security and Accountability Failures in Flock Safety’s Nationwide Dynamic Surveillance NetworkCybersecurity Research Paper and Surveillance Map on Flock Safety

My formal research paper on four security failures I found and reported in Flock Safety’s platform, and why they make its camera network a national-security question. Around 22 military, intelligence, federal and defense sites, a median 66% of modeled trips from nearby homes to the gates pass a Flock camera.

My formal paper on four security failures in Flock Safety’s platform, with the map and site studies behind it.

Graphic listing familiar names found in Palantir subdomains: Ford and Audi under automotive, Albertsons and Kroger under grocery.

Palantir

Palantir Subdomains Name Hundreds of Familiar Organizations

Palantir-linked web addresses across 20 industries name 611 companies most people deal with every week: Ford and Honda, Kroger and Trader Joe’s, Discover, HCA and Quest, Cigna and Humana, AccuWeather and CBS. Palantir was built to merge separate records into one searchable picture. A name on the list is a lead, not proof of a live contract.

611 companies across 20 industries appear in Palantir subdomains. The reach, why it matters, and the full list.

Personal Research

You don’t know what Flock Safety really is, let me tell you.

There is a lot of speculation as to what the cameras are, what they can do, and what Flock Safety is. In this video I explained everything I learned during the tenure of my research.

There is a lot of speculation as to what the cameras are, what they can do, and what Flock Safety is. In this video I explained everything I learned during the tenure of my research.

Redacted ArcGIS key details showing the owner FlockSafety and the title Default API Key.

Personal Research

53 Times Flock Safety Hardcoded the Password for America’s Surveillance Infrastructure

Flock Safety’s public JavaScript carried a default ArcGIS API key in 53 separate files, with no referrer, IP or scope limits. It listed access to 50 private items behind FlockOS, Flock’s “one map” of cameras, patrol cars, drones and 911 incidents. I did not open them. I reported the key, and it has since been rotated.

A responsible disclosure write-up on an organization-wide ArcGIS API key embedded in public front-end code.

Flock Nova code for an Advanced Dark Data Search panel headed Search Dark Data By.

Personal Research

Flock Said It Does Not Use Dark Web Data. Analysis of Their Code Tells a Different Story

In May 2025 Flock Safety said Flock Nova “will not supply dark web data.” Nova’s front-end code defines a Dark Data search behind a permission flag, with fields for Social Security numbers, credit card numbers, crypto wallets, IP addresses and usernames. With the flag on, phone searches fetch it automatically. The code does not show where that data comes from.

Flock says it won’t use dark web data, but its Nova code appears able to search breach-style identifiers.

Search results from Flock Safety’s exposed demo: 2,500 camera captures with a Download button.

Personal Research

A Misconfigured Demo Exposed Flock Safety’s 83,000 Camera Nationwide Tracking System

A development demo of Flock Safety’s search interface was left public and indexed by Google, exposing about 5,000 lines of front-end code. It included the vehicle-matching logic, which scores cars on ten traits from plate and make to roof racks and bumper stickers; a hard-coded ArcGIS key with no referrer or IP restriction; and a search type for people as well as vehicles.

How a demo environment left Flock Safety’s nationwide camera tracking system open.

Support

Purchases and donations support independent research, public-interest work, and the costs of defending that work.

Ways to give

  • Yard Sign

    $29.99

    24″×18″

    Double-sided, with a metal stake.

  • 10″×2.93″

    Vinyl. Sticks to any smooth surface.

  • 10″×3″

    Removable. Sticks to steel car panels.

  • Sticker

    $3.99

    4″×3″

    Vinyl. Sized for laptops, notebooks and water bottles.

US shipping only: $2.99 for stickers and magnets, or $12.99 with a yard sign ($4 more for each extra sign).

Work

Over the years I’ve founded Nexanet and Dataminimal in an effort to give privacy back to the people. Nexanet primarily focuses on niche cases and high-profile scenarios, while Dataminimal is meant to offer privacy to everyone.

Nexanet is an all-source intelligence firm. It combines open-source intelligence, records research, human sources and field work to establish what happened and what can be proven.

Investigations
Fraud, misconduct, insider threats and harassment attribution.
Digital disappearance
A hands-on program that reduces public exposure and breaks the links between a person’s identities.
Litigation support
Asset tracing, witness research and evidence development for legal teams.

Go to nexanet.ai

Dataminimal is privacy software. It finds where a person is exposed across data brokers, facial recognition services, breaches, social platforms and job boards, then runs the removals and keeps a record of each one.

Data broker removal
Removal requests to the brokers that hold and sell personal records.
Facial recognition opt-outs
Opt-outs from services that index faces from photos.
Digital footprint
A map of what is public about a person, built from contact details they have verified.

Go to dataminimal.com