Two researchers discovered a public web link to five SFPD drone cameras with live feeds of active arrests and investigations, as well as the faces and other identifying info of bystanders, and it was active for six months before it was taken down.
In mid-June, two internet security researchers, Sam Curry and Maik Robert, stumbled across a publicly accessible web link that enabled them to watch live feeds from five SFPD drones for roughly two days, as Wired reports. Curry and Robert reported the issue to the manufacturer, San Mateo-based Skydio, which quickly disabled access. The exposed feeds reportedly showed active arrests, searches, and vehicle stops, along with the names and email addresses of drone pilots and location data.
Curry and Robert archived about 48 hours of footage from 20 drone flights, including color, thermal, and rooftop camera views, which reportedly recorded hundreds of people and vehicles, with the faces of dozens of bystanders clearly visible, despite SFPD policy directing operators to minimize recording people unrelated to investigations.
According to Wired, the cameras also reportedly hovered over people who appeared to have nothing to do with police activity. In one clip, the drone zoomed in on a young person sitting alone on a rooftop listening to headphones, while other footage showed views into apartment windows from above.
“That one felt like an invasion of privacy, just so uncomfortable,” Curry said, referring to the person alone a the rooftop. “Like this person thinks they’re by themselves on this roof and has gotten away from everybody, and then there's a police drone watching them.”
According to the researchers, the problem wasn't a flaw in Skydio's software but an SFPD-generated share link that appears to have been created without password protection and set to remain active for a year. Wired reports that the link was later indexed in a public database commonly used by security researchers, raising the possibility that others may have accessed the feeds over the past six months before they were taken offline.
SFPD called the link an internal law enforcement resource that was “improperly obtained and accessed by individuals without authorization,” though the researchers said they didn't bypass any security measures to view it.
“I don't think there's any reason that someone from the public should be able to watch in real time as someone is getting grabbed by undercover cops," said Robert, speaking to Wired.
As SFist reported at the time, the department's drone program launched in 2024 for vehicle pursuits and active criminal investigations, and the program has since expanded from six drones to 98, with officers logging more than 1,400 flights between May 2024 and March 2026, according to the Chronicle.
More recently, SFist reported that the SFPD will be testing out the use of drones as pre-first responders to crime scenes or potential crime scenes in SF's South of Market neighborhood starting this fall.
Jay Stanley, a senior policy analyst with the ACLU's Speech, Privacy, and Technology Project, called the exposure “shocking, but not surprising,” warning that advances in AI make large collections of surveillance footage even more vulnerable to privacy abuses.
Related: SFPD Launches Pilot Program In SoMa That Will See Drones Arrive at Crime Scenes Before Cops Do
Image: Skydio
