The police already had permission to watch from the sky. What they didn't have was a lock on the video.

"There's a certain trust given to the police to use these things correctly. When you're watching a drone feed live, you can look into dozens of different apartments, you can see police zooming in on people, you can see arrests. The fact that all of this was exposed feels like a really big issue from a privacy perspective."

— Sam Curry, security researcher who found the exposed feed

The most revealing thing about the San Francisco police drone leak was not that it happened. It's who found it: two web security researchers, Sam Curry and Maik Robert, who did not hack anything. They ran a routine tool that pulls archived web addresses for a given domain, asked it for every link pointing at Skydio's infrastructure, and the city's police drone feeds fell out of the results like something dropped on a table. No password. No exploit. A public URL, open for roughly six months, streaming real-time color and thermal video from five SFPD surveillance drones to anyone who knew the address.

Wired reviewed the archive the researchers built over about 48 hours in mid-June: 60 videos from 20 separate flights, more than three hours of aerial color footage and roughly the same amount of thermal, plus second-by-second telemetry: 5,000 GPS points tracing over 44 miles, and the names and email addresses of six SFPD pilots. Object-detection software counted hundreds of people and vehicles across the 20 flights. In a single frame, hovering over a downtown intersection, it counted 34 pedestrians.

The department's own transparency portal publishes drone flight logs "after they occur" and without video. The leaked link was not part of that system.

What the footage shows is the gap between how police describe the drones and what the drones actually film. SFPD policy, which the department quoted in its statement, limits drone use to "active criminal investigations," "vehicle pursuits," and "training exercises." The videos tell a broader story. Drones capture detentions and searches, yes, but also streets, apartment buildings, rooftops, courtyards, and bystanders with no apparent connection to any operation. One flight, dispatched over what police records describe as an alleged "prowler" incident, hovers over a young person wearing headphones on a rooftop, zooms in, then flies away. Curry's description of the scene is the most honest thing in the whole report: "That one felt like an invasion of privacy, just so uncomfortable."

Translation: the cameras were never pointed at "active criminal investigations." They were pointed at the city, and the investigations were whatever the footage happened to include.

The scale behind the footage is worth pausing on. SFPD's fleet has grown from six drones to 98, and officers logged more than 1,400 launches between May 2024 and March 2026. The program is a pilot for something bigger: as the Electronic Frontier Foundation noted in records released in July, more than 1,000 law enforcement and public safety agencies had received FAA waivers by early 2026 to operate autonomous, AI-navigated surveillance drones under so-called "drone-as-first-responder" programs, and the FAA approved more beyond-visual-line-of-sight waivers between April 2025 and February 2026 than in the previous seven years combined.

The leak itself is a footnote to the main story. The link, as Wired reported, appears to have been created last December by someone with access to SFPD's instance of Skydio software: a shareable "ReadyLink" to five drones' feeds, with no authentication requirement and a one-year expiration. The SFPD called it "an internal restricted link that is for SFPD law enforcement purposes only" and said it had been "improperly obtained and accessed by individuals without authorization." Curry and Robert point out, correctly, that they bypassed no security of any kind, which is about the opposite of the legal definition of unauthorized access.

But even the leak is less important than what it confirms: that police surveillance video is what privacy advocates call a "toxic asset." Jay Stanley of the ACLU's Speech, Privacy, and Technology Project put it plainly. "The fact that so much San Francisco drone footage was potentially exposed online is 'shocking, but not surprising,'" he said. Every department that hoards aerial video of its citizens is one bad configuration away from the same outcome.

There is a pattern to the way these programs get built. In Nashville, the Metro Nashville Police Department quietly launched a trial drone program without a council vote or hearing; after public outcry, the city pulled the program on August 6. In New Orleans, activists from Eye on Surveillance discovered that police had changed internal rules to allow drones to carry "weapons" with the superintendent's approval; the policy was withdrawn after residents demanded it, and on August 6 the city council voted to require published drone flight logs. New Orleans flight logs reviewed by Truthout show drones dispatched for calls that read, almost apologetically, like something out of a sitcom: a subject "involved in a disturbance with the hot dog guy then fled the scene."

The punchline is that even the mundane missions are the point. Every flight logs GPS, every frame becomes a searchable data point, and the aggregate is a map of who goes where, when, and with whom.

The drones are the newest layer on top of an older system. More than 132,000 automated license plate readers now watch traffic across the United States, including roughly 120,000 made or managed by Flock Safety. The backlash to those cameras went viral this year: at least 100 local governments have ended contracts with Flock and its competitors, residents are cutting down the poles, and this month's "DeFlock" week of action produced a flood of public records requests. One of them, filed by a Kansas activist named Canyen Ashworth, returned a number he probably did not expect: his own vehicle had been flagged by license plate readers 150 times in under two years, in a city of about 70,000 people, in connection with a police "be on the lookout" alert that was issued against him personally after he wrote a newspaper op-ed criticizing his own city's police.

The drones integrate with that apparatus. Flock's "first responder" drones carry plate readers that can read a license from 2,000 feet up, and the major vendors, Flock, Axon, Skydio, Motorola Solutions, bundle everything into searchable databases that stitch together body cameras, plate readers, gunshot detectors, and aerial footage. The surveillance does not look like one system. It looks like a hundred small purchases, each with its own grant, its own contract, its own "first responder" framing.

So what should the leak mean? The SFPD has "put more restrictive sharing protocols in place," which is the appropriate institutional response to one bad link. It says nothing about the 98 drones, the 1,400 launches, the three hours of footage of ordinary people crossing ordinary streets, or the 1,000 other agencies with similar waivers.

Curry said the videos changed how he walks around San Francisco. "This was the first time I'd seen drones used in a city like this, and looking at these streets, they're the same streets I walk down when I'm visiting," he said. "I guess it just makes me feel more observed." The people the drones actually watch, the unhoused, the people with mental illness, the kids in a basketball game that one flight spent ten minutes hovering over, were never consulted about being observed at all.

The question was never whether the police could watch from the sky. They had the permission, the waivers, the hardware, and the funding. The question is what a city does when its own infrastructure proves, on its own, how much of it everyone was in.