SFPD Skydio Drone Footage Exposed on Public Internet for Nearly Six Months Due to Misconfigured Share Link

SFPD Skydio Drone Footage Exposed on Public Internet for Nearly Six Months

A misconfigured Skydio share link left San Francisco Police Department (SFPD) drone feeds—including live video, thermal imaging footage, and drone pilot names—completely unprotected on the public internet for approximately six months, until two cybersecurity researchers uncovered the serious security flaw.

How It Happened

According to reports, the incident stemmed from an improperly configured sharing feature within the Skydio drone system. The relevant link was not protected by any access controls or authentication mechanisms, meaning anyone who obtained the URL could directly view live drone footage captured during SFPD operations. This included highly sensitive thermal imaging video as well as the personal names of drone operators.

For a period of roughly six months, anyone with the link could freely access law enforcement imagery that should have been strictly protected.

Researchers Uncover the Vulnerability

The misconfiguration was eventually discovered by two cybersecurity researchers, who subsequently disclosed the issue publicly. The incident has sparked significant concern over law enforcement agencies' ability to manage data security when operating commercial drone systems.

Potential Impact and Key Concerns

The exposure raises several serious issues:

• Live surveillance footage leaked: Real-time imagery from active law enforcement operations, if accessed by unauthorized parties, could compromise operational security and endanger personnel.
• Thermal imaging data at risk: Thermal footage is highly sensitive and can reveal the positions and movement patterns of individuals.
• Pilot personal information exposed: The names of drone operators were made publicly accessible, raising both privacy and personal safety concerns.
• Inadequate configuration management: The incident highlights a lack of robust security configuration review processes within law enforcement agencies when operating commercial drone platforms.

Implications for Drone Data Security

This case serves as a stark reminder for law enforcement agencies and organizations of all kinds that deploying drone systems requires more than just flight operations training—data security and system configuration management are equally critical. In particular, any sharing or streaming features involving live video feeds must be governed by strict access controls, subject to regular configuration audits, and supported by adequate cybersecurity awareness among all relevant personnel.

As one of the leading commercial drone manufacturers in the United States, Skydio now faces questions about the security design and default settings of its products. It remains unclear whether SFPD or Skydio has issued a formal statement or taken remedial action in response to the incident.

原文來源： 查看原文