What happened
Flock, the company behind automated licence plate readers and AI-powered cameras used by law enforcement, has been authorised as a CVE Numbering Authority. That gives it the right to assign CVE identifiers to vulnerabilities in its own products and to grade those defects. The company said it joins a programme of more than 550 numbering authorities, and that the role lets it assess, coordinate, and prioritise response to vulnerabilities internally.
Chris Castaldo, Flock's chief information security officer, said the authority lets the company move faster when researchers report findings, remove confusion from duplicate or conflicting entries, and give customers a single trusted source of security information. Flock published a vulnerability disclosure policy in August and has created a security advisories page.
Security experts acknowledge that many vendors hold numbering authority for good reason, while noting that Flock's business has drawn sustained scrutiny over privacy concerns and repeated reports of police misuse of its technology.
Katie Moussouris, founder and chief executive of Luta Security, told CyberScoop that the measure of Flock as a numbering authority is whether its records give cities, police departments, and the public enough detail to track specific risks by product version, the nature of the vulnerability, and how to fix it. A vendor in that role writes the description and often sets the severity score, she said, so an immature vendor may misrepresent an issue through ignorance or an effort to downplay it. She also observed that Flock's products track drivers' movements, its customers are police, and its policy reserves the right to withhold publication where it decides disclosure would create a safety risk.
Privacy and security researcher Zach Edwards described numbering authorities as essentially grading their own homework, and expects some researchers to keep disclosing flaws without coordinating with the company. Researchers reported defects last year in Flock's licence plate reader and gunshot detection system, which the company submitted to the National Vulnerability Database but deemed not material because the vulnerabilities required physical access to the device. Flock's disclosure policy rules out testing against live customer deployments, access to law enforcement data, physical attacks, denial of service testing, and social engineering, and there is no paid bug bounty.
Why this is a GRC story
Self-attestation concentrates risk. When a vendor assigns the identifier, writes the description, and sets the severity, the quality of the record depends on that vendor's process maturity. Procurement teams inherit whatever that process produces.
A disclosure policy is a governance document. Rules about which tests are permitted, whether researchers are paid, and when publication can be withheld are decisions about transparency that customers can assess before signing a contract.
Conflicts of interest need visible mitigations. The concern is not that vendors lack the ability to assess their own code, but that nobody outside the vendor can audit the judgement calls when the stakes are highest.
What to watch
Watch what Flock actually publishes. The test is whether advisories arrive promptly, name affected versions, explain the flaw in enough detail to act on, and state the fix. A quiet advisory feed is a finding in itself.
For organisations buying surveillance or public safety technology, the diligence questions are specific: the median time from report to advisory, which classes of testing are out of scope, and how defects with safety implications are handled.
Attribution: Analysis based on CyberScoop and related public reporting. This article is original commentary, not a repost of the source material.