Just after noon on a Saturday last month, a Skydio X10 quadcopter hovered about 200 feet over a San Francisco apartment complex, watching police chase a man hiding behind a parked car. The target of this manhunt lay down on the pavement, apparently unaware that he remained in full view of the flying eye overhead. The 5-pound drone had, in fact, already followed him across the city, zooming in on his black SUV’s license plate, keeping the vehicle locked at the center of its video frame until he pulled over. Now it watched the police as they closed in and surrounded him.
As the officers approached, the man adjusted his hiding spot, moving to the other side of the parked car. At that moment, however, another Skydio drone zoomed in on his location, one of four Skydio quadcopters that had followed the man in just the prior hour. This one had been called away from a nearby McDonald’s, where it had been watching two people who’d exited the suspect’s car a few minutes earlier—and now began watching him from a second angle.
Within seconds, three officers converged on the man, two pointing weapons at him, then tackled him as half a dozen more police arrived on the scene. Police records provided to WIRED by the San Francisco Police Department show the entire street-and-sky response followed from what the SFPD described as an alleged “auto boost/strip” incident—the suspected theft of car parts or another object from a vehicle.
This glimpse of modern drone-enabled police surveillance, including the highly sensitive video of the man’s physical takedown, wasn’t voluntarily released by the SFPD—which, like most US police departments, rarely releases drone videos even in response to public records requests. Instead, it was accidentally livestreamed onto the open internet via Skydio’s website. That’s where two security researchers, Sam Curry and Maik Robert, discovered that the SFPD was leaking all of the real-time footage from five of its surveillance drones, including both color and thermal imaging, accompanying location metadata, and the drone pilots’ names and email addresses, to anyone who merely found the public web address where the videos were hosted.
Curry and Robert say they reported their discovery to Skydio around two days after discovering it, and it was quickly taken offline. By then, though, the researchers had watched police carry out what appeared to be multiple arrests and searches as well as tracking cars and individuals from the sky, all visible at a fully public web address.
“There’s a certain trust given to the police to use these things correctly,” says Curry. “When you’re watching a drone feed live, you can look into dozens of different apartments, you can see police zooming in on people, you can see arrests. The fact that all of this was exposed feels like a really big issue from a privacy perspective.”
The leaked feed of video captures two forced detentions—whether any actual arrests were made is unclear from the footage—a police visit to an apartment in a high-rise apartment building, and an apparent search of an alley populated with homeless people, as well as numerous other more ambiguous instances where police used drones to surveil individuals, vehicles, or buildings. While the feed remained live, Curry and Robert began archiving the public stream of data and videos and later shared the results with WIRED.
The archive Curry and Robert captured offers a detailed record of SFPD drone operations over about 48 hours in mid-June. It includes 60 videos from 20 separate flights, with each mission recorded from three feeds: a color camera, a thermal camera that renders people as heat signatures, and a third view from the drone’s rooftop dock. WIRED analyzed all 20 color videos with software that detects people, vehicles, and other objects in images. The review found that the cameras had filmed hundreds of people and vehicles across the 20 flights. In a single frame, as a drone hovered over a downtown intersection, the software counted 34 people crossing the street or standing on the sidewalks. Across all of the videos the footage showed clear faces of dozens of people.
Together, the videos amount to more than three hours of aerial color footage and roughly the same amount of thermal footage. The archive also includes second-by-second telemetry logs for every flight—more than 5,000 GPS points in all tracing over some 44 miles—recording each drone’s latitude and longitude, altitude, speed, heading, and battery level from takeoff to landing. Six SFPD pilots’ names and email addresses also appear across the logs.
