A Privacy Failure Went Unnoticed for Months.

For six months, live San Francisco police drone feeds streamed on the open internet with no password, exposing people’s faces, locations, and officers’ details.

Story Snapshot

Five Skydio drone feeds were viewable online for months via a public link with no login.
Streams showed color and thermal video, live locations, and pilot names and emails.
Researchers say they bypassed no security; SFPD says the link was “improperly obtained”.
City drone use has surged, while critics say privacy rules lag behind growth.

What Was Exposed and How It Was Found

Security researchers found a San Francisco Police Department live stream link that needed no password and worked for months. The link displayed feeds from up to five Skydio drones at once. It showed color and thermal video, live flight paths, and the names and emails of six drone pilots. The researchers reported the issue soon after discovery. They say they did not hack anything; the link was simply open to anyone who had it.

San Francisco Police Department confirmed an “improperly obtained” link was accessed without authorization and said they disabled it after learning of the problem. The department said the link was meant for law enforcement use. Skydio stated that agencies control security for live streaming links, not the company. That places responsibility for settings and access on the police department that configured the share options.

What Viewers Could See During Live Operations

The open streams let watchers observe arrests, apartment visits, and searches of homeless encampments. The video revealed the faces of people who likely had no idea they were being filmed. It also showed tracking of cars and people not tied to crimes, according to posts describing the archive. The researchers captured more than three hours of footage over about 44 miles of flight before the link was shut off and the window finally closed.

Local reporting tied some drone call-outs to “suspicious person” reports that produced no findings. One example noted a person who was “on their way to go play some basketball.” This use bumps against the department’s claim that drones are authorized only for active criminal investigations, vehicle pursuits, and training. That gap raises questions about policy guardrails and real-world practice during daily deployments.

Privacy Risks Versus Crime-Fighting Gains

San Francisco voters approved expanded drone use in 2024, and supporters point to crime declines and faster response. Skydio has promoted a large drop in auto theft and police credit drones with aiding more than a thousand arrests since 2024. These outcomes make drones popular tools, yet they can overshadow the costs of mistakes like an open link. Public support can fade fast when basic digital locks fail on live surveillance video.

A Leak of San Francisco Police Drone Footage Exposes the New Reality of Urban Surveillance | Andy Greenberg & Dhruv Mehrotra, WIRED

Just after noon on a Saturday last month, a Skydio X10 quadcopter hovered about 200 feet over a San Francisco apartment complex, watching police… pic.twitter.com/KxIZ3yKjmi

— Owen Gregorian (@OwenGregorian) July 14, 2026

The department says it has no evidence anyone beyond the two researchers accessed the feeds, and that an internal investigation continues. However, officials have not released access logs or internet addresses to prove that claim. Without those records, the size of the privacy impact remains uncertain. That uncertainty is the problem: when systems lack simple controls and audit trails, trust breaks down across the political spectrum.

Why This Fits a Larger Pattern of Weak Controls

This incident echoes other cases where police aerial video or flight data were left exposed by weak cloud settings. In those cases, no advanced hacking was needed; simple misconfigurations did the damage. Advocates and scholars warn that drone programs often scale faster than their privacy and security checks. San Francisco’s rise from dozens of flights to more than 600 per month shows how growth can outrun the rules built to protect regular people on the ground.

Accountability Questions That Still Need Answers

Key facts remain missing. The department has not said who created the one-year, no-password sharing link or what approval process was used. Officials have not provided full deployment logs to show which missions matched authorized purposes. A third-party audit could compare settings before and after the exposure. Release of full access logs could confirm who watched what and when. These steps would test the system, not just the press statement.

What This Means for People Across the Aisle

For conservatives and liberals alike, this story hits a nerve. Many worry that powerful tools grow faster than the rules and that officials protect the system before they protect the public. Drones can help catch thieves and keep officers safer. But leaving live feeds open for months undercuts that mission. Strong locks, clear limits, and real oversight are not anti-police. They are how public safety earns and keeps consent in a free society.