SFPD Drone Surveillance Footage Leaked Online, Exposing Real-Time Police Operations
In mid-June, the San Francisco Police Department (SFPD) inadvertently exposed live drone surveillance footage to the public internet, revealing an extensive aerial monitoring operation. Security researchers Sam Curry and Maik Robert discovered the leak, which included real-time video feeds from five Skydio X10 quadcopters complete with color and thermal imaging, GPS telemetry, and the identities of drone pilots.
The leaked footage captured a high-profile police manhunt on a Saturday afternoon, where drones tracked a suspect accused of an "auto boost/strip" incident theft of car parts or property from a vehicle. The drones followed the suspect’s black SUV, zoomed in on its license plate, and maintained surveillance as he fled on foot into an apartment complex. Four drones were deployed within an hour, providing multiple angles as police closed in and tackled the man. Additional footage showed forced detentions, searches of an alley with homeless individuals, and routine surveillance of vehicles and pedestrians.
The exposed data included 60 videos from 20 flights over 48 hours, documenting hundreds of people and vehicles. Analysis of the footage revealed clear facial images of dozens of bystanders, along with second-by-second flight logs detailing each drone’s location, altitude, and speed. The leak also exposed the names and email addresses of six SFPD drone operators.
Curry and Robert reported the vulnerability to Skydio, which promptly secured the feed. However, the incident raised significant privacy concerns, as the drones captured sensitive police operations and civilian activity without public oversight. The SFPD, which rarely releases drone footage even under public records requests, had not intended to make the footage accessible. The accidental livestream underscored the potential risks of unchecked aerial surveillance.
Source: https://www.wired.com/story/sfpd-drone-video-leak-surveillance/
Skydio TPRM report: https://www.rankiteo.com/company/skydio
"id": "sky1784017672",
"linkid": "skydio",
"type": "Vulnerability",
"date": "7/2026",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"{'affected_entities': [{'customers_affected': 'Hundreds of civilians captured '
'in the footage, including '
'bystanders and suspects',
'industry': 'Public Safety',
'location': 'San Francisco, California, USA',
'name': 'San Francisco Police Department (SFPD)',
'size': 'Large',
'type': 'Government/Law Enforcement'}],
'attack_vector': 'Misconfiguration',
'data_breach': {'file_types_exposed': ['Video files', 'Telemetry logs'],
'number_of_records_exposed': '60 videos from 20 flights over '
'48 hours, documenting hundreds '
'of people and vehicles',
'personally_identifiable_information': 'Facial images, '
'license plates, drone '
'pilot names and email '
'addresses',
'sensitivity_of_data': 'High (real-time police operations, '
'civilian identities, and surveillance '
'tactics)',
'type_of_data_compromised': ['Video footage',
'GPS telemetry',
'Pilot identities',
'Facial images',
'License plate numbers',
'Flight logs']},
'date_detected': '2024-06-15',
'description': 'In mid-June, the San Francisco Police Department (SFPD) '
'inadvertently exposed live drone surveillance footage to the '
'public internet, revealing an extensive aerial monitoring '
'operation. Security researchers Sam Curry and Maik Robert '
'discovered the leak, which included real-time video feeds '
'from five Skydio X10 quadcopters complete with color and '
'thermal imaging, GPS telemetry, and the identities of drone '
'pilots. The leaked footage captured a high-profile police '
'manhunt, forced detentions, and routine surveillance of '
'vehicles and pedestrians, raising significant privacy '
'concerns.',
'impact': {'brand_reputation_impact': 'Significant damage to public trust and '
"privacy concerns regarding SFPD's "
'surveillance practices',
'data_compromised': 'Real-time drone surveillance footage, GPS '
'telemetry, drone pilot identities, facial '
'images of bystanders, license plate numbers, '
'flight logs',
'identity_theft_risk': 'High (exposure of facial images, license '
'plates, and personal identifiers)',
'legal_liabilities': 'Potential legal actions due to unauthorized '
'exposure of civilian data and police '
'operations',
'operational_impact': 'Potential disruption of ongoing police '
'operations due to exposure of sensitive '
'surveillance tactics',
'systems_affected': 'Skydio X10 quadcopters, SFPD drone '
'surveillance system'},
'investigation_status': 'Ongoing',
'lessons_learned': 'The incident highlights the risks of unchecked aerial '
'surveillance and the need for stricter access controls '
'and oversight of police drone operations. It also '
'underscores the importance of securing live feeds to '
'prevent inadvertent public exposure.',
'post_incident_analysis': {'corrective_actions': 'Feed secured by Skydio; '
'further actions pending '
'investigation',
'root_causes': 'Misconfiguration or lack of proper '
'access controls for live drone '
'surveillance feeds'},
'recommendations': ['Implement strict access controls and authentication for '
'drone surveillance feeds',
'Conduct regular audits of surveillance systems to ensure '
'compliance with privacy laws',
'Establish clear policies for the use and public '
'disclosure of drone footage',
'Enhance training for drone operators on data security '
'and privacy best practices',
'Engage with privacy advocates and the public to address '
'concerns about surveillance transparency'],
'references': [{'source': 'Security researchers Sam Curry and Maik Robert'}],
'regulatory_compliance': {'regulations_violated': ['Potential violations of '
'privacy laws (e.g., '
'California Consumer '
'Privacy Act, Fourth '
'Amendment concerns)']},
'response': {'containment_measures': 'Feed secured by Skydio',
'third_party_assistance': 'Skydio (drone manufacturer) secured '
'the feed after being notified by '
'researchers'},
'title': 'SFPD Drone Surveillance Footage Leaked Online, Exposing Real-Time '
'Police Operations',
'type': 'Data Leak',
'vulnerability_exploited': 'Inadvertent public exposure of live surveillance '
'feeds'}