Back to all lessons
Awareness Lessons
2 months ago

Flock Safety's Opaque Manufacturing Origins Raise National Security Concerns

Written by AI from the linked story. Not reviewed by an editor. How this works

Flock Safety's shift away from clear 'Made in the USA' claims, combined with evidence of reliance on components manufactured in China via Primax Electronics, exposes a critical supply chain transparency gap. Government agencies procuring these license plate readers may unknowingly be violating the National Defense Authorization Act (NDAA), which prohibits certain Chinese-manufactured components in federal contracts. This matters because surveillance infrastructure integrated into law enforcement networks represents a high-value target for foreign adversaries, and compromised hardware could enable data exfiltration or system manipulation. Organizations that fail to rigorously vet vendor supply chains risk introducing hardware-level vulnerabilities that are extremely difficult to detect or remediate after deployment.

Tactical Insight

Immediate actions

  • Audit all existing Flock Safety and similar surveillance device deployments to document their stated country of origin and cross-reference against import records.
  • Issue a procurement freeze on new orders until vendors provide verifiable, component-level supply chain documentation compliant with NDAA Section 889.

Long-term improvements

  • Require all vendors to provide a Software and Hardware Bill of Materials (SBOM/HBOM) as a mandatory condition of government contracts.
  • Establish a formal third-party supply chain risk management (SCRM) program that includes periodic re-vetting of existing vendors, not just new procurements.
  • Embed supply chain integrity clauses in contracts that mandate notification of any manufacturing location changes.

Detection & Verification measures

  • Subscribe to import record monitoring services (e.g., Panjiva/S&P Global) to independently track vendor shipping and sourcing patterns.
  • Conduct periodic hardware inspections or commission independent teardown analyses of critical infrastructure devices to verify component origins.

Back this up with a control

All controls and vendors

Training helps people spot this. These controls make the attack fail even on the day someone does not.