For six months, anyone with a web link could wa
tch San Francisco police drones live — no password, no hacking required.
Story Snapshot
- Live feeds from five San Francisco police drones streamed openly on the internet for about six months with no password protection.
- The feeds showed color video, thermal imaging, live location data, and the names and email addresses of six drone pilots.
- Security researchers watched arrests, apartment visits, homeless encampment searches, and people tracked who had done nothing wrong.
- San Francisco police flew drones more than 600 times a month, but critics say privacy rules have not kept up with that growth.
No Hack Needed — Just a Link
Security researchers Sam Curry and Maik Robert did not break into anything. They found a public web link — no password, no login — that streamed live video from five San Francisco Police Department drones. The link had been active for roughly six months. Anyone who had the address could watch in real time. The researchers reported what they found to drone maker Skydio two days after discovering it, and the feed was taken down shortly after.
The exposed stream carried more than just video. It also showed thermal imaging, live location data, and the names and email addresses of six SFPD drone pilots. Researchers archived more than three hours of footage covering 44 miles of drone flight before the feed went offline. That footage included arrests, visits to apartment buildings, searches of homeless encampments, and people being tracked who were never linked to any crime — including, according to a Wired investigation, individuals who were simply on their way to play basketball.
Police Say It Was an Internal Link. Researchers Disagree.
The San Francisco Police Department (SFPD) said the link was “intended for law enforcement use only and was not authorized to be shared with the public.” The department called it “improperly obtained and accessed by individuals without authorization.” But the researchers are clear: the link had no password and required no bypass. It was a public URL. Anyone who found it could watch. That gap between what the department said and what the researchers found is hard to ignore.
Skydio, the company that makes the drones, said agencies — not Skydio — control the security settings for live stream links. That puts the responsibility squarely on the SFPD. The department has not said who created the link, why it had a one-year expiration with no authentication, or what approval process was followed. The SFPD did say it disabled the link immediately after learning of the problem and tightened its sharing settings.
Drones Are Flying More — Rules Are Not Keeping Up
The SFPD went from flying drones just a handful of times a month to more than 600 flights a month. San Francisco voters approved expanded drone use in March 2024, and the department credits the program with helping cut auto theft by 56% and assisting in more than 1,000 arrests since April 2024. Those results are real. But critics argue that privacy and security protections have not grown at the same pace as the program itself.
A Leak of San Francisco Police Drone Footage Exposes the New Reality of Urban Surveillance | Andy Greenberg & Dhruv Mehrotra, WIRED
Just after noon on a Saturday last month, a Skydio X10 quadcopter hovered about 200 feet over a San Francisco apartment complex, watching police… pic.twitter.com/KxIZ3yKjmi
— Owen Gregorian (@OwenGregorian) July 14, 2026
This kind of exposure is not unique to San Francisco. In 2021, 1.8 terabytes of Dallas Police Department helicopter footage leaked from an unsecured cloud server. A separate company called DroneSense exposed flight paths, pilot names, and emails for more than 200 law enforcement customers for over a month. There is still no national framework governing how police drone data must be stored or secured. The Brookings Institution has noted that the absence of federal rules leaves millions of Americans with no clear legal protection from aerial surveillance data that is poorly secured — or left wide open.
Sources:
reclaimthenet.org, dronexl.co, abc7news.com, gadgetreview.com, reddit.com, facebook.com, linkedin.com, worldjournal.com, vexdynamics.com, skydio.com, techbuzz.ai, news.backbox.org, live.skydio.com, sanfranciscopolice.org, news.ycombinator.com, sfgov.legistar.com, eff.org, vice.com, dronedj.com, rnz.co.nz, wired.com, dallasobserver.com, brookings.edu, dmagazine.com, aclu.org