San Francisco Police Drone Footage Livestreamed to Open Web
San Francisco Police Department accidentally exposed hours of real-time surveillance drone footage from five Skydio quadcopters on a public web address. Security researchers discovered the leak containing color and thermal imaging, location metadata, and pilot information before the link was removed.
What happened
Someone with access to the SFPD Skydio instance created a link to five drones' feeds with no authentication and an expiration date of one year last December. Security researchers Sam Curry and Maik Robert discovered the publicly exposed link on Skydio's website, which livestreamed real-time surveillance drone footage including color and thermal imaging, location metadata, and drone pilots' names and email addresses.
By the time the link was taken down, Curry and Robert had recorded and shared approximately three hours of video from two days of exposed drone flights. The SFPD stated the link was an internal restricted link that had been improperly obtained and accessed by individuals without authorization, but the researchers said they did not bypass any security.
Reported impact
The drone cameras filmed hundreds of people in vehicles across 20 flight recordings, with dozens of faces captured in some single frames. The footage showed police surveillance of multiple incidents including a chase response to an alleged auto theft, a prowler investigation, and a detention, with hundreds of uninvolved bystanders inadvertently recorded.
Index analysis
The small size and high altitude of the drones made them virtually invisible, with no evidence in the videos that anyone looked up or attempted to hide from the drone. SFPD drone policy requires pilots to minimize inadvertent recording of uninvolved people, but the exposed footage showed extensive incidental capture of the public.
Governance controls
The SFPD has a drone policy requiring pilots to minimize inadvertent recording of uninvolved people in places. However, the unintended public exposure resulted from a link created with no authentication protection and without a secure expiration mechanism.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.