---

2.1 About this Volume

A detector is only as good as its understanding of the thing it detects. This volume is the target half of that understanding: what the surveillance hardware OUI-SPY hunts actually is, and — the part that matters for a passive radio detector — how each device leaks RF that a $7.50 listener can key on.

Four device families carry the weight:

1. Flock Safety ALPR cameras — the primary quarry, and the reason flock-you exists.
2. Penguin battery packs — Flock’s BLE-chatty external power accessory, often the easiest Flock-adjacent tell to catch.
3. Raven — Flock’s audio / gunshot-detection device, with its own leaky BLE GATT services.
4. Axon gear — body cameras and Tasers, the target of the sibling axeoff firmware.

The mechanism of detection — the OUI union, the wildcard-probe Information Element fingerprint, the five-tier confidence model, and the BLE signature tables — is Volumes 4 through 6. This volume stays on the targets and their physics, and closes with the policy context (DeFlock, civil liberties) that explains why anyone wants to map these devices at all.

Voice / sourcing note. Technical claims about Flock hardware here are drawn from the flock-you README’s own research and firmware analysis, plus public reporting on Flock and Raven. Vendor accuracy figures are labelled as vendor figures. Facts not independently confirmable are marked. Nothing is written as first-hand observation.

2.2 Flock Safety and the ALPR dragnet

Flock Safety is a US company that sells automated licence-plate-reader (ALPR) cameras and the cloud platform behind them to police departments, sheriffs, homeowners’ associations and businesses. A Flock camera (the “Falcon” line is the common fixed ALPR unit) photographs every passing vehicle, reads the plate with on-device machine vision, and also builds a “vehicle fingerprint” — make, colour, body type, and distinguishing features like roof racks or bumper stickers — so a vehicle can be searched for even without a plate read. Each read is uploaded to Flock’s cloud with a timestamp and location and retained, and agencies can query across a very large shared network of cameras.

The scale is the point. Flock cameras are deployed as a dense, networked dragnet — tens of thousands of cameras across the US (and, to a lesser extent, Canada). Because reads are pooled and searchable across jurisdictions, a single camera is a node in a national movement-tracking system, not a standalone traffic sensor. That is what makes “is there a Flock camera here?” a question civil-liberties researchers, journalists and ordinary residents actually ask — and what makes a cheap passive detector useful.

Physically, a Falcon-class unit is a solar-or-mains-powered camera head on a pole or a street fixture, with:

• a camera + ML inference stage (the licence-plate / vehicle-fingerprint work),
• an LTE modem to upload reads to the Flock cloud,
• a 2.4 GHz Wi-Fi radio used for provisioning and, as the firmware analysis below shows, for Qualcomm’s LOWI geolocation scanning, and
• often an external battery accessory (the “Penguin”, Section 5).

The LTE uplink is not a useful detection channel for a passive 2.4 GHz listener — it is licensed cellular spectrum, not something an ESP32 receives. The Wi-Fi radio, by contrast, is loud, local, and on exactly the band OUI-SPY listens to. That is the seam flock-you works.

2.3 How a Flock camera gives itself away on the air

The flock-you research is built on a firmware dump of a Flock ALPR camera: a Qualcomm MSM8953 SoC with a QCA9377 Wi-Fi radio, running Android 8.1 (codename hpnotiq, dump dated 2026-09-16). That dump is what turns “these cameras probably have Wi-Fi” into a precise, forensic signature. The camera leaks on the air in three distinct ways, listed newest-first because the project’s own detection has had to evolve as Flock closed earlier tells:

 Flock camera RF emissions (2.4 GHz, receivable by an ESP32)
 ═══════════════════════════════════════════════════════════════════════════
 (A) WILDCARD PROBE REQUESTS ← the current, highest-value tell
 QCA9377 radio emits 802.11 probe
 requests ~every 0.125 s while type=0 subtype=4 (Probe Req)
 channel-hopping, for Qualcomm SSID IE (tag 0) length = 0 (wildcard)
 LOWI geolocation scanning addr2 (transmitter) = a Flock/QCA OUI
 + IE field fingerprint match
 ─────────────────────────────────────────────────────────────────────────
 (B) SoftAP Flock-XXXXXX (WPA2 pw "security") ← provisioning AP
 + bare Flock SSID Deactivated ~Dec 2025 on deployed
 units; SSID-keyword match OFF by
 default (lowest tier) because the
 AP is mostly gone.
 ─────────────────────────────────────────────────────────────────────────
 (C) BLE methods ← stopped working in spring;
 (historically present) accessory BLE still useful (Penguin)
 ═══════════════════════════════════════════════════════════════════════════

The decisive, durable tell is (A), the wildcard probe request. A Flock camera’s QCA9377 radio broadcasts probe requests roughly every 125 ms as part of Qualcomm’s LOWI location service, hopping across channels. A probe request is a Wi-Fi client asking “what access points are out there?”; a wildcard probe carries a zero-length SSID element — it is addressed to no particular network. That alone is unremarkable (phones do it), so flock-you does not treat a wildcard probe as a hit on its own. It qualifies the frame against all of:

• 802.11 management frame, type 0 / subtype 4 (a probe request),
• SSID Information Element (tag 0) of length 0 (the wildcard),
• the transmitter address (addr2) falling in the OUI list (Section 4), and
• the probe’s Information Element layout matching the observed Flock/LiteON fingerprint (the exact ordering and contents of the tagged parameters).

Only when the IE fingerprint also matches does flock-you raise its highest confidence tier — this is the forensic “wildcard-probe IE signature.” The full mechanics, the channel-hopping dwell schedule, and the five-tier grading are Volume 4. Emission (B), the Flock-XXXXXX SoftAP with the memorable WPA2 password security, was a strong tell historically but was deactivated on deployed units around December 2025, which is why the plain-SSID keyword match ships off by default (it would mostly false-positive on nothing, or on look-alikes). Emission (C), the camera’s own BLE, stopped working as a detection path in spring — but the BLE accessories (Penguin, Raven) remain very much detectable, which is the subject of Sections 5 and 6.

Callout — the detector chases a moving target. Flock has demonstrably closed earlier detection channels (the SoftAP, the camera BLE). The wildcard probe survives because it is a side-effect of Qualcomm’s location service, not a feature Flock can trivially switch off without breaking geolocation. A detector for commercial surveillance gear is inherently a cat-and-mouse artefact; treat any specific signature as current-as-of-dump, not permanent.

2.4 The firmware-dump provenance — why two OUIs are special

OUI-SPY keys first on the OUI — the top 24 bits of the transmitter’s MAC. The flock-you Wi-Fi signature set is a union of 34 MAC prefixes, assembled from three provenances. The provenance matters because it maps directly onto how much a given match can be trusted.

Table 1 — 4. The firmware-dump provenance — why two OUIs are special

Provenance	Count	Source	Trust note
Community collection	32	NitekryDPaul “nite-oui-collection”	Crowd-sourced; broad but noisier
DeFlock drive-test	1	82:6b:f2 (DeFlockJoplin)	Locally-administered-bit set — see below
Firmware-extracted	2	b4:1e:52, 00:03:7f from the camera dump	Highest provenance

The two firmware-extracted prefixes are the standout, because they do not come from guessing or war-driving — they come out of the camera’s own firmware image:

• b4:1e:52 — Flock Safety’s own IEEE MA-L block, registered to Flock’s Atlanta headquarters. A match on this prefix means the transmitter’s maker is Flock.
• 00:03:7f — the Qualcomm Atheros OUI for the QCA9377 Wi-Fi SoC inside the camera. The dump even yields the radio’s default/OTP MACs: 00:03:7f:50:00:01 (in bdwlan30.bin) and 00:03:7f:4f:00:16 (in otp30.bin). These are the factory radio identities before the camera is assigned a MAC.

 OUI trust ladder (narrowest / strongest at the top)
 ───────────────────────────────────────────────────────────────────
 b4:1e:52 Flock Safety MA-L "the maker is literally Flock"
 00:03:7f Qualcomm Atheros QCA9377 "the radio is the one in Flock cams"
 ───────────────────────────────────────────────────────────────────
 82:6b:f2 DeFlockJoplin drive-test locally-administered — see note
 ───────────────────────────────────────────────────────────────────
 32 community prefixes (nite-oui-collection) broader, noisier
 ───────────────────────────────────────────────────────────────────

The firmware-derived set is deliberately narrower than the 32-prefix community list: for a frame to match on the firmware set, its transmitter must belong to Flock’s IEEE block or to a Qualcomm Atheros radio — a far stronger statement than “this prefix has been seen near a camera once.”

Two provenance notes the README is emphatic about:

• 82:6b:f2 has the locally-administered bit set. A naive detector would add a “skip locally-administered MACs” filter (because randomised phone MACs set that bit). The flock-you README explicitly says do not add that skip filter for 82:6b:f2 — doing so would discard the DeFlockJoplin drive-tested signature. This is a worked example of why a generic hygiene rule can silently break a real signature.
• The firmware provenance is why the project can grade confidence at all (Volume 4’s tier model). A match you can trace to a chip or a vendor block is a different epistemic object from a match on a crowd-sourced prefix.

2.5 Penguin battery packs — the BLE accessory tell

A fixed camera needs power, and Flock’s external battery accessory — the “Penguin” — is a chatty BLE device. For a passive detector this is often the easiest Flock-adjacent catch, because the pack advertises on BLE in the clear with recognisable names and a manufacturer company ID, and does so even when the camera’s own radios have gone quiet.

Table 2 — 5. Penguin battery packs — the BLE accessory tell

Signal	Value	What it is
Advertised name	Penguin-NNNNNNNNNN	Penguin pack, serial-suffixed
Advertised name	(bare 10-digit number)	Penguin pack, name stripped to serial
Advertised name	FS Ext Battery	”Flock Safety External Battery”
Advertised name	DfuTarg	device in Nordic DFU (firmware-update) mode
Mfr company ID	0x09C8 (XUNTONG)	manufacturer-data company identifier
Flock accessory GATT	e8ccbb38-9532-46a8-9fe5-1814df172e6f	Flock accessory service UUID
Nordic DFU GATT	00001530-1212-efde-1523-785feabcd123	Nordic secure-DFU service

How to read these:

• The four advertised names are a tiered giveaway in themselves — FS Ext Battery is unambiguous, Penguin-NNNN… nearly so, and even a bare 10-digit name is a usable pattern. DfuTarg is the generic name a Nordic chip presents while updating firmware; it is not Flock-specific on its own, which is why it is paired with the other signals.
• The company ID 0x09C8 (XUNTONG) is the Bluetooth-SIG-assigned manufacturer identifier embedded in the advert’s manufacturer-specific data — a second, address-independent way to recognise the pack’s silicon vendor.
• The GATT service UUIDs — the Flock accessory service and the Nordic DFU service — are what a BLE scanner sees when it enumerates the device’s services. The Nordic DFU service tells you the pack is built on a Nordic BLE SoC (and can be caught in update mode); the Flock accessory UUID is the vendor-specific tell.

The BLE scanning mechanics (NimBLE, passive vs active scan, the 10% duty cycle) are Volume 5. The point here is that the accessory often outs the camera: a Penguin advertising FS Ext Battery with company ID 0x09C8 is a strong Flock-presence indicator even when the camera’s Wi-Fi is silent.

2.6 Raven — Flock’s audio and gunshot detector

Raven is Flock Safety’s audio-detection device — a gunshot / acoustic sensor that integrates with the Falcon ALPR cameras. Flock’s pitch is the integration: when Raven’s on-device machine learning localises a sound it classifies as a gunshot, it cues the nearest ALPR camera to capture vehicle evidence, tying an acoustic alert to a plate read. Flock claims 90%+ accuracy at identifying gunshots (a vendor figure) and says the device is being trained to recognise other sounds (fireworks, “sideshows”). Flock describes the processing as continuous analysis of short rolling windows (~5 s) on a dedicated low-power processor; at least one agency policy document cites a 30-day retention period for Raven audio.

Raven sits in the same civil-liberties conversation as the long-established ShotSpotter acoustic-gunshot system (now owned by SoundThinking). It is important to be precise about the relationship, because the detector-firmware’s shorthand blurs it:

Callout — Raven is Flock’s product, not ShotSpotter’s. Raven is Flock Safety’s own audio/gunshot detector, whose selling point is that it connects to Flock’s Falcon cameras. ShotSpotter / SoundThinking is the separate, older, competing gunshot-detection system. They are rivals, not the same device. Both draw criticism over accuracy, over-deployment in particular neighbourhoods, and the diversion of police resources. any claim that a specific sensor on the air is one brand versus the other — the RF signature below is what the detector keys on, not the marketing name.

On the air, the Raven unit exposes unauthenticated BLE GATT services that the flock-you research keys on:

Table 3 — flock-you research keys on

Signal	Value	Note
Raven GATT services	0x3100 – 0x3500	unauthenticated
GPS leak	0x3101, 0x3102	these characteristics leak GPS data

The standout here is not just that Raven is detectable but that its BLE services are unauthenticated and leak location — 0x3101 and 0x3102 expose GPS. For a passive detector this means a Raven is both findable and, inadvertently, self-locating. (This series documents the detection signature only; it does not walk through interacting with those services.)

2.7 Axon — body cameras and Tasers

Axon (formerly TASER International) makes the dominant US police body-camera and conducted-energy-weapon (Taser) product lines, plus the Evidence.com cloud and the “Signal” sidearm/holster-activation accessories that auto-start recording. Axon gear is a different target class from Flock — wearable and mobile rather than fixed infrastructure — and gets its own dedicated firmware in the family, axeoff (Volume 7), a headless buzzer-only Axon detector.

Axon’s RF tells are BLE-centric:

Table 4 — Axon's RF tells are BLE-centric

Signal	Value	What it is
OUI	00:25:DF	Axon / TASER MAC prefix
BLE company ID	0x034D	”TASER International” Bluetooth-SIG company identifier
Service UUID	0xFC81	Axon service
Service UUID	0xFE6B	Axon service
Service UUID	0xFE6C	Axon service

axeoff’s behaviour is a good illustration of the headless-detector idiom: on a match it plays a “lub-dub” heartbeat on the buzzer whose rate tracks proximity — faster as the signal gets stronger. That is the same RSSI-to-cadence idea that the Foxhunter generalises into full direction-finding (Volume 8). The device-class significance: body cameras and Signal-enabled holsters mean an Axon BLE hit frequently indicates an officer, a patrol vehicle, or an active-recording event nearby.

2.8 The emission-class summary

The whole target set, folded into one table — which band each device leaks on, the key signal, and which OUI-SPY firmware hunts it. This is the reference to come back to; the why is in the sections above, the how (the matching engine) is in Volumes 4–6.

Table 5 — 8. The emission-class summary

Target	Band / mode	Key signal(s)	Firmware
Flock camera	Wi-Fi (2.4 GHz)	Wildcard probe-req + IE fingerprint; OUIs b4:1e:52, 00:03:7f; SSID Flock-XXXXXX / Flock	flock-you
Penguin battery	BLE	Names Penguin-…/FS Ext Battery/DfuTarg; company ID 0x09C8; GATT e8ccbb38-…	flock-you
Raven audio	BLE	GATT 0x3100–0x3500 (unauth); GPS leak at 0x3101/0x3102	flock-you
Axon body-cam / Taser	BLE	OUI 00:25:DF; company ID 0x034D; svc 0xFC81/0xFE6B/0xFE6C	axeoff
Drone (Remote ID)	Wi-Fi + BLE	OpenDroneID / ASTM F3411 beacons (covered in Vol 9)	Sky-Spy

 What leaks where (passive, 2.4 GHz)
 ──────────────────────────────────────────────────────────────
 Wi-Fi mgmt BLE advert / GATT
 ───────────── ──────────────────
 Flock camera ●●● (probe IE) ○ (BLE path closed)
 Penguin pack — ●●● (name + CID + GATT)
 Raven audio — ●● (unauth GATT, GPS leak)
 Axon gear — ●● (OUI + CID + svc UUIDs)
 Drone RID ●● (NAN/vendor) ●● (svc 0xFFFA)
 ──────────────────────────────────────────────────────────────
 ● strength of the passive tell — not a useful passive channel

[FIGURE SLOT — Vol 2 §8] A simple field illustration or photo montage of the four target classes — a pole-mounted Flock Falcon, a Penguin battery pack, a Raven audio unit, an Axon body camera — to put faces to the signatures.

2.9 DeFlock and the civil-liberties context

The reason to build any of this is in the policy layer. ALPR networks, audio detectors and body-worn cameras are mass-surveillance infrastructure whose deployment usually happens with little public notice and less public consent. Movement data from ALPR reads is persistent, pooled across jurisdictions, and has been used well beyond its stated purpose; audio detectors raise accuracy and equity questions; the whole stack concentrates a lot of tracking power in systems most people cannot see.

DeFlock (the GitHub project FoggedLens/deflock, and the public site around it) is the community countermeasure that OUI-SPY draws on directly:

• DeFlock provides crowdsourced ALPR-camera location data and detection methodologies, and the flock-you repo bundles DeFlock datasets in its datasets/ folder.
• DeFlockJoplin is the specific contributor credited with the breakthrough wildcard-probe signature, the IE-fingerprint detection path, and the 82:6b:f2 OUI. The README reports a drive-test in Joplin that caught 11 of 12 cameras with 2 false positives — a concrete field-validation figure for the Wi-Fi method, and the empirical basis for trusting the wildcard-probe tier.

The project frames itself explicitly as “for research and educational use only.” That framing is load-bearing: the detectors are passive receivers — the act they perform is listening to RF that is already being broadcast into public space, which is categorically different from the offensive Red tools (Volume 9). Mapping where the public is being surveilled is the civil-liberties use case; the legal and ethical posture that keeps a builder on the right side of that line is developed in full in Volume 10.

Callout — passive, with an asterisk. “Passive” accurately describes the core detection: receiving broadcast frames and adverts. The asterisks, stated plainly so they are not hidden: the general detector and the foxhunter use BLE active scan (they transmit scan requests); and the Red tools transmit outright. Volume 10 covers what “passive by default” means for local RF law.

2.10 What this volume establishes

• Flock Safety ALPR is the primary target — a dense, networked, cross-jurisdiction vehicle-tracking dragnet — and its cameras run a QCA9377 Wi-Fi radio that emits wildcard probe requests ~every 125 ms for Qualcomm geolocation. That probe, qualified by an IE fingerprint and an OUI match, is the durable Wi-Fi tell; the SoftAP and camera-BLE tells have been closed over time.
• Two OUIs come straight from a camera firmware dump — b4:1e:52 (Flock’s own IEEE block) and 00:03:7f (the Qualcomm Atheros QCA9377) — giving the detector forensic, gradeable provenance that crowd-sourced prefixes cannot match. Do not add a locally-administered-MAC skip filter: it would break 82:6b:f2.
• Accessories out the camera. Penguin battery packs (BLE names, company ID 0x09C8, Flock/Nordic-DFU GATT) and Raven audio units (unauthenticated GATT 0x3100–0x3500, with a GPS leak at 0x3101/0x3102) are frequently the easiest catches.
• Axon body-cams and Tasers are a separate wearable target class (00:25:DF, company ID 0x034D, service UUIDs 0xFC81/0xFE6B/0xFE6C), hunted by the dedicated axeoff firmware. Raven is Flock’s product, distinct from ShotSpotter/SoundThinking.
• DeFlock is the civil-liberties project the signatures and datasets come from; the Joplin drive-test (11/12, 2 false positives) is the field validation for the Wi-Fi method, and “research and educational use only” is the project’s own stated frame.

Volume 3 turns to the hardware this all runs on — the Seeed XIAO ESP32-S3, the finished boards, and the full supported-hardware table. Volumes 4 and 5 then open up the matching engine: how the Wi-Fi probe-IE fingerprint and the BLE signature tables actually fire, and how the five-tier confidence model grades every hit.