Caution: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. 11/18/20254:28:11PM Sent: From: Lily Ho <lily.ho@flocksafety.com To: "Wendy Stratton" Cc: "Mark","Edward" Bcc: Importance: Normal Subject: Re: FW: Benicia Must Reconsider Its Flock Safety Deployment Attachments image604200.png,image724539.png,image324275.png , image611335.png , image438156.png, image074009.png ,image158946.png,image189917.png,image585058.png , image473993.png, image109081.png,image347389.png Thanks, Wendy. I'm ready. :) On Tue, Nov 18, 2025 at 3:59 PM Wendy Stratton Monahan <WMonahan@ci.benicia.ca.us> wrote: Lily, Pleasebepreparedtospeaktothevulnerabilityof thesystemtohacking.WendyStrattonMonahan SeniorManagementAnalyst/PDPIo PoliceDepartment O:707-746-4306 1941 POLICE WMonahan@ci.benicia.ca.u THECITY OF S BENICIA www.ci.benicia.ca.us/police f@口n From:MarkMenesini<MMenesini@ci.benicia.ca.us> Sent:Tuesday,November18,20253:54PM To:WendyStrattonMonahan<WMonahan@ci.benicia.ca.us> Subject:FW:BeniciaMustReconsiderItsFlockSafetyDeployment MarkMenesini Police Chief PoliceDepartment ENIC O:707-746-4262 1941 EST. POLICE MMenesini@ci.benicia.ca.u THECITYOF S BENICIA www.ci.benicia.ca.us/police F@口目 Mario: Do we still have under contract a cyber security consultant? I watched the Video and the majority doesn’t address the use and major issues other communities have experienced. My question to The Chief would be about the concerns related to the vulnerability and security of our systems from hacking? Sent from my iPhone
“Life is what happens when you’re busy making other plans,” John Lennon Terry Scott Council Member ElectedOfficial O:707-746-4213 TScott@ci.benicia.ca.us THECITY OF www.ci.benicia.ca.us BENICIA Fooin ALIFOESI CityHallisclosedonalternatingFridays.Learnmoreaboutclosureshere. Begin forwarded message: From: Date:November16,2025at10:49:15AMPST To: Steve Young <SYoung@ci.benicia.ca.us>, Lionel Largaespada <LLargaespada@ci.benicia.ca.us>, Trevor Macenski Birdseye<Kbirdseye@ci.benicia.ca.us>,MarioGiuliani <MGiuliani@ci.benicia.ca.us>, Mark Menesini <MMenesini@ci.benicia.ca.us> Subject:Benicia Must ReconsiderIts FlockSafetyDeployment Caution: This email originated from outside of the organization. Do not click links or Benicia’sCityCouncilshouldurgentlyreconsideritsrelianceonFlockSafety surveillancedevices.Independentsecurityresearchintothesameecosystemof Flockhardware deployed nationwidereveals systemicvulnerabilities that place public data, city infrastructure, and law-enforcement operations at risk—not hypothetically, but demonstrably. Thewhitepaper documents51security findings acrossFlock’s gunshot detection ·Disabled Secure Boot on multiple devices, allowing attackers to load malicious firmware and gain persistent control (e.g., CVE-2025-47819). 2. Exposed debug interfaces such as UART, JTAG, and Android Debug Bridge, enabling shell access or full system compromise with minimal skill. 3. Hardcoded Wi-Fi credentials and automatic connection behavior, allowing attackers to impersonate access points and intercept traffic. 4. Unauthenticated administrative APl endpoints and multiple paths to remotecodeexecution,includingwirelessattacksacrossdevices. secrets—including APl keys and authentication tokens.
- Flock license plate readers operating on Android Things 8.1, a long- abandoned, end-of-life OS with no security updates. These issues are not edge cases-they are systemic design and hardening failures. They expose Benicia to risks of data breaches, evidence tampering, vulnerabilities—many carrying CVE identifiers—does not meet any reasonable security standard for systems that monitor the public or support police operations. independent verification of remediation, transparent risk assessments, and a clear plan to eliminate these security failures. Public safety technology must be secure to be trustworthy—and today, Flock’s ecosystem simply is not. The Whitepaper can be found here and a video outlining the findings is below https://zenodo.org/records/17584876 https://www.youtube.com/watch?v=uB0gr7Fh6lY
Public Records Exemptions Enclosed please find a copy of the response documents for your public process employed to review and produce the response documents. Reason Description Pages 1 of 1