Here’s a quietly significant development: Flock Safety, the company behind those license-plate-reading cameras you’ve probably seen on highways and in parking lots, just became a CVE Numbering Authority (CNA) for its own products. If you’re not familiar, a CVE (Common Vulnerabilities and Exposures) is basically a standardized ID tag for a known security flaw. Normally, a neutral third party (often MITRE or a big vendor’s security team with established oversight) assigns these. Now Flock gets to assign them to itself.
On paper, this sounds efficient. Flock finds a bug in its own gear, tags it, tells customers, done. No waiting on an outside board to process the paperwork. Companies like Microsoft and Google run their own CNAs too, so there’s precedent. But those companies built decades of public scrutiny and independent research into their vulnerability disclosure process first. Flock is a relatively young company in the physical surveillance space, and it’s already been under fire for how it handles data sharing with law enforcement and the accuracy of its systems.
That’s the real issue here: self-reporting only works when there’s trust that the self-reporter isn’t incentivized to downplay or quietly bury bad news. A bank or a city government buying Flock’s cameras is trusting that if a serious flaw is found (say, something that lets an attacker spoof plate reads or pull location data), it actually gets disclosed promptly and accurately, not massaged for a quieter headline.
Why should finance and government readers care about a license-plate camera company’s paperwork process? Because this is a preview of a bigger pattern. More vendors selling into critical infrastructure, policing, and financial security are going to want CNA status as their footprint grows. If self-issued CVEs become normal without strong independent audits backing them up, the whole vulnerability disclosure system (which already relies heavily on honor and reputation) gets a little shakier. For banks managing vendor risk assessments, or government procurement teams writing security requirements into contracts, this is exactly the kind of fine print that deserves a second look before the next purchase order goes out.
None of this means Flock is acting in bad faith. It might run this program flawlessly. But “might” isn’t a great word to build critical infrastructure trust on.
Worth Discussing
- Should companies selling surveillance or security hardware to governments be required to use independent CNAs instead of self-issuing?
- Does Flock’s track record on data privacy affect how much trust it deserves here, or should this be judged separately?
- What kind of oversight, if any, would make self-issued CVEs feel trustworthy to you?
- Should financial institutions treat vendor-run CNA status as a red flag in vendor risk assessments?
- Is this trend toward vendor self-certification inevitable as more companies’ products touch critical infrastructure?