# Two Researchers Found SFPD's Live Drone Video Feed Sitting Wide Open on the Internet

> A misconfigured sharing link let anyone with the web address watch live video from five San Francisco Police Department drones for months, exposing arrests, apartment windows and rooftop scenes before two researchers flagged it.

**Type:** article · **Category:** Security · **Published:** 2026-07-13 · **Source:** TrendKia
**Canonical:** https://trendkia.com/en/security/san-francisco-men-pulisa-ke-skydio-drona-ka-laiva-phuteja-mahinon-taka-intaraneta-para-bina-roka-toka-khula-para-raha-7390 · **Language:** English
**Tags:** drone surveillance, police drone leak, Skydio, San Francisco Police Department, data privacy, cybersecurity, SFPD

A man crouched behind a parked car, certain he had shaken the officers on his tail. He hadn't accounted for what was watching him from directly overhead. One of four Skydio quadcopters that had trailed him through the previous hour swung into position and locked onto him from a fresh angle, having just been pulled away from a nearby McDonald's, where it had been filming two other people who had stepped out of his car minutes earlier. Within seconds three officers closed in, two with weapons drawn, and tackled him to the ground as half a dozen more patrol units rolled up. Records handed over by the San Francisco Police Department describe the whole operation as a response to an alleged auto boost or strip call, department shorthand for the suspected theft of car parts or another object from a vehicle.

None of that footage was ever supposed to reach the public. Like almost every police department in the country, the SFPD rarely hands over drone video even when someone files a formal public records request for it. Yet this exact sequence, arrest and all, ended up streaming live on the open internet anyway. Two security researchers, Sam Curry and Maik Robert, discovered a public web address quietly broadcasting real time video from five of the department's surveillance drones. The feed carried both color and thermal camera views, GPS and location data tied to every flight, and the names and email addresses of the officers piloting the drones that day, all visible to anyone who happened across the link.

## A link nobody was supposed to find
Curry and Robert reported what they had found to Skydio roughly two days after stumbling onto it, and the stream was pulled offline shortly afterward. In that short window, though, they had already watched what looked like several arrests and searches play out from the sky, plus cars and people being tracked across the city, all through a page that demanded no password and no login of any kind.

> "There's a certain trust given to the police to use these things correctly," Curry said. "When you're watching a drone feed live, you can look into dozens of different apartments, you can see police zooming in on people, you can see arrests. The fact that all of this was exposed feels like a really big issue from a privacy perspective."
The footage captured two forced detentions, though the video alone does not make clear whether either person was formally arrested. It also showed police visiting an apartment inside a high rise building, and what appeared to be a search of an alley where homeless people were staying, along with numerous other less clear cut moments of drones watching individuals, vehicles or buildings. While the page was still live, Curry and Robert began saving copies of the video and data pouring out of it.

## Forty eight hours of San Francisco from above
What they preserved amounts to a detailed slice of SFPD drone activity across roughly 48 hours in the middle of June. It runs to 60 separate videos pulled from 20 individual flights, with each mission recorded on three simultaneous feeds: a color camera, a thermal camera that renders people as glowing heat outlines, and a third angle looking down from the drone's rooftop charging dock.

Running the 20 color videos through software built to detect people, vehicles and other objects turned up hundreds of people and cars across those flights. In a single frame, captured while a drone hovered over a downtown intersection, the software counted 34 separate people either crossing the street or standing on the sidewalks below. Taken together, the videos show clear, recognizable faces belonging to dozens of individuals who had no idea they were on camera.

Add it all up and the archive holds more than three hours of aerial color footage, with roughly the same amount again in thermal video. Sitting alongside the video is a second by second telemetry log for every flight, more than 5,000 individual GPS points tracing out some 44 miles of drone movement, recording each aircraft's latitude, longitude, altitude, speed, heading and battery charge from the moment it lifted off to the moment it landed. The names and email addresses of six SFPD drone pilots turn up scattered throughout those logs.

## A drone fleet that grew fast
Skydio, headquartered in nearby San Mateo, ranks among the biggest American drone makers selling to police forces, fire departments, other government agencies and the military. Its X10 model makes up the backbone of the SFPD's drone program, which launched in 2024 and is authorized for use during vehicle pursuits and active criminal investigations.

The program has not stayed small. According to the department's own 2025 annual report, the fleet grew from just six drones to 98 in a short span, and officers logged more than 1,400 individual launches between May 2024 and March 2026. The city does run a transparency portal that publishes flight logs after the fact, though never any video. The exposed link that Curry and Robert found had nothing to do with that official transparency system; it existed entirely outside it.

## How a single misconfigured link exposed it all
Curry and Robert are clear that none of this traces back to a flaw in Skydio's own systems. It looks instead like a misuse of the company's software by someone inside the SFPD. Skydio lets its customers generate shareable links, called ReadyLinks, that give outside viewers access to a drone's video or its live data stream, with the option to require an authentication code or set an expiration date. Someone with access to the SFPD's account, however, appears to have generated a link back in December granting access to five drones' feeds with no authentication requirement at all, set to expire a full year later.

That link then somehow ended up inside AlienVault Open Threat Exchange, an open source archive of web addresses that security researchers commonly use for their own work, which is where Curry and Robert eventually spotted it. That timing matters: it meant the feed had likely already been sitting exposed for about six months by the time the two researchers found it, with no way of knowing whether anyone else had been watching it during that stretch.

## What the police department said
When asked about the exposed feed, the SFPD described the web address in a statement as an internal restricted link meant strictly for law enforcement purposes, of the kind that lets officers coordinate on operations and public safety matters, adding that it had been improperly obtained and accessed by individuals without authorization. Curry and Robert push back on that framing, noting that they never bypassed any password, login or authentication barrier to view the stream, the standard legal test for what counts as unauthorized access.

The statement went on to say that after learning of the vulnerability, the department put stricter sharing protocols in place so unauthorized people cannot get at its footage going forward, and that at this point there is no information indicating anyone else had been viewing the live feed. The matter, the statement added, remains under investigation.

## Arrests, welfare checks and a rooftop with headphones
Several of the incidents caught on camera raise their own questions about how these flights were actually justified. In footage showing officers visible through the window of a high rise apartment, department records describe the same flight in two different ways depending on which document is checked, once as a "check on well being" and once as a "missing person" investigation. In another clip, officers are seen speaking with homeless people gathered in an alley, a flight that department records label a "person with a knife" investigation.

Some of the calmer looking footage raises the sharpest questions about whether the surveillance was ever necessary in the first place. In one flight tied to an alleged auto boost or strip call, a drone tails two young men riding in a car, with department records describing at least one of them as a "suspicious person in a vehicle." The two men eventually get out, walk onto a nearby basketball court and start playing a game, at which point the drone simply flies off.

Another flight, logged as a response to a "person with a gun" call, appears to fixate instead on a man who seems intoxicated, stooped over on a sidewalk. A separate drone, dispatched over an alleged "prowler" report, hovers above a young person wearing headphones who is sitting alone on a rooftop, zooms in close on them, and then flies away.

> "That one felt like an invasion of privacy, just so uncomfortable," Curry said. "Like this person thinks they're by themselves on this roof and has gotten away from everybody, and then there's a police drone watching them."
In its statement, the SFPD maintains that it follows a strict policy governing drone use, insisting the aircraft can only be deployed to assist active criminal investigations, to support or replace vehicle pursuits, and for training exercises.

## How the leak came to light in the first place
Curry and Robert say their interest in Skydio began just last month, after they noticed a Florida police department announcing it was adopting the company's drone system, which led them to look into how widely Skydio's hardware had already spread across US law enforcement. As researchers who focus on web security, checking the company's own systems felt like a natural next step. Using a tool called GetAllURLs, which pulls every archived web address tied to a given domain from sources including AlienVault Open Threat Exchange, they simply searched for anything linked to Skydio. The San Francisco feed turned up almost immediately.

From there, they watched live scenes unfold, including a man with his hand wrapped in a bloodied white cloth talking with officers, followed later by a group of plainclothes police detaining a suspect at a gas station.

> That was the point, Robert said, when it became "pretty clear that this probably shouldn't be public." As he put it, "I don't think there's any reason that someone from the public should be able to watch in real time as someone is getting grabbed by undercover cops."

## A long pattern of guarding drone video
Police departments across the country have historically treated drone footage as too sensitive to release, even when compelled under freedom of information laws. Chula Vista, California, the department that pioneered the whole "drone as first responder" model now used by cities like San Francisco, spent years fighting a public records lawsuit over its own drone videos, arguing the footage counted as investigatory material and could expose private details about people who happened to be caught on camera. A California appeals court eventually rejected the city's argument that such videos could be withheld as a blanket category, and that ruling became precedent statewide after the California Supreme Court declined to take up the case. The matter was sent back down to the trial court to sort out which specific videos, if any, actually have to be released.

## Why privacy advocates call this data "toxic"
Jay Stanley, a senior policy analyst with the ACLU's Speech, Privacy, and Technology Project who focuses specifically on drone surveillance, called the scale of what got exposed in San Francisco "shocking, but not surprising." The footage, he said, illustrates exactly why privacy advocates treat any law enforcement surveillance data as a toxic asset, something permanently at risk of a security breach, and why they urge departments to record and retain as little as possible in the first place.

> "That means not recording when you don't need to record," Stanley said.
The SFPD's own drone policy instructs operators to keep their cameras trained only on areas relevant to a given mission and to minimize picking up footage of uninvolved people or places. It also tells pilots to take reasonable precautions, including turning the camera away, to avoid accidentally recording or transmitting images of spaces where people have a reasonable expectation of privacy. But the exposed feeds captured entire missions start to finish, from takeoff to landing, sweeping up not just the actual detentions and searches but ordinary streets, apartment buildings, rooftops, parked cars, courtyards and bystanders who were plainly not the target of any operation at all.

"Watching these videos, it was just a reminder of what a powerful technology this is, and the amount of city life that is swept up in these videos," Stanley said. He noted that the risk to privacy from that kind of broad collection only grows as artificial intelligence tools improve. "Maybe no human has the time to pore over every frame of these videos, but an AI can do that, and it's scalable to vast amounts of video," Stanley said.

Under SFPD policy, footage from every mission is supposed to be reviewed afterward for evidentiary value and uploaded into the department's digital evidence database, with anything lacking evidentiary value deleted within 30 days. Because the exposed link only carried live, real time drone data rather than any archived footage, it remains unclear whether the exposure itself violated that retention policy.

## An eye in the sky nobody notices
One detail stuck with Curry and Robert throughout their review: in every single video they watched, not one person ever glanced up at the drone or tried to duck out of its view, likely because the aircraft's size and altitude make it nearly invisible to whoever is underneath.

> "You're just watching from above, and no one is aware that the drone is there," Curry said. "It felt kind of creepy."
Curry said the experience has changed how he thinks about his own privacy while walking through an American city, or at least through San Francisco. "This was the first time I'd seen drones used in a city like this, and looking at these streets, they're the same streets I walk down when I'm visiting," he said. "I guess it just makes me feel more observed."

## What this means for you
This story is not tied to India directly, but it matters for anyone living in a city where police are rolling out drone surveillance, a trend growing quickly in several Indian cities too.

- **For privacy-conscious citizens:** The leak shows that police surveillance data, including live video from inside apartments, streets and of individuals, can end up exposed on the open internet through a single misconfigured link, no matter how strict the official policy sounds on paper.
- **For anyone under aerial surveillance:** The footage shows drones can record ordinary people going about everyday activities, walking, playing basketball, or sitting on a rooftop, without them ever knowing they were being watched.

## Questions & Answers

### 1. How did the San Francisco Police Department's drone footage leak onto the internet?
A link created through Skydio's ReadyLinks feature had no authentication requirement, letting anyone view live feeds from five drones without logging in.

### 2. Who discovered the leak?
Security researchers Sam Curry and Maik Robert found the link while searching archived web addresses from sources including AlienVault Open Threat Exchange.

### 3. How long was the feed exposed?
The link was created last December with a one year expiration, meaning it had likely been exposed for about six months before the researchers found it.

### 4. What did the leaked footage show?
It showed two forced detentions, a police visit to a high rise apartment, a search of an alley where homeless people were staying, and many other ambiguous surveillance moments.

### 5. How big is SFPD's drone fleet?
According to the department's 2025 annual report, the fleet grew from six drones to 98, with more than 1,400 launches logged between May 2024 and March 2026.

### 6. How did the SFPD respond to the exposure?
It called the link an internal restricted link accessed without authorization, said it has since put stricter sharing protocols in place, and said the matter remains under investigation.

### 7. Was the link hacked?
No, the researchers say they never bypassed any password or authentication; the link was simply public with no security barrier at all.

### 8. Has drone footage secrecy been an issue before?
Yes, the Chula Vista, California police department fought a public records lawsuit for years over releasing its own drone videos.

---
_TrendKia — Har trend, sabse pehle.. Machine-readable view; canonical HTML at the URL above._