A San Francisco Police Department drone feed that showed live surveillance operations was exposed on the public internet through an unprotected Skydio sharing link, according to reporting by WIRED. The exposed material included real-time color video, thermal imaging, location metadata, and the names and email addresses of drone pilots.
The privacy problem is not theoretical. WIRED reported that the footage showed police tracking vehicles and people from the air, including one mid-June operation in which four Skydio drones followed a man over roughly an hour after what SFPD records described as an alleged “auto boost/strip” incident, a term for suspected theft from a vehicle or of vehicle parts. The drones tracked a black SUV, zoomed in on its license plate, followed the driver after he stopped, and captured officers detaining him near an apartment complex.
Security researchers Sam Curry and Maik Robert found the exposed feeds and later shared archived material with WIRED. They said they reported the issue to Skydio about two days after finding it, and the feed was soon taken offline.
How the feed got exposed
The exposure appears to have come from Skydio’s link-sharing feature, not from a novel exploit. Curry and Robert told WIRED that Skydio’s software can create “ReadyLinks” for live drone data, with options for authentication codes and expiration dates. In this case, someone with access to SFPD’s Skydio system appears to have created a link in December for five drone feeds with no authentication and a one-year expiration.
That URL later appeared in AlienVault Open Threat Exchange, an open-source repository of archived web addresses used by security researchers. Curry and Robert found it while using GetAllURLs to collect archived Skydio links. No password prompt, token challenge, or other access control blocked them, according to their account.
SFPD told WIRED the URL was an “internal restricted link” for law enforcement and public safety coordination, and said it had been “improperly obtained and accessed by individuals without authorization.” The department said it added more restrictive sharing protocols after learning of the vulnerability and did not have information showing that others had accessed the live feed. Skydio did not respond to WIRED’s request for comment.
What was in the archive
The material Curry and Robert captured covered about 48 hours in mid-June, WIRED reported. It included 60 videos from 20 flights, with three feeds for each mission: color camera video, thermal camera video, and a view from the drone’s rooftop dock. The archive contained more than three hours of color footage and about the same amount of thermal footage.
It also included second-by-second telemetry logs: more than 5,000 GPS points over about 44 miles, with latitude, longitude, altitude, speed, heading, and battery level. Six SFPD pilots’ names and email addresses appeared in the logs, according to WIRED.
WIRED said its analysis of the color videos found hundreds of people and vehicles captured across the flights. In one downtown intersection frame, object-detection software counted 34 people. The footage showed clear faces of dozens of people.
Other recorded incidents included two forced detentions, a police visit to a high-rise apartment tied in police records to a well-being check or missing-person inquiry, and an apparent alley search connected to a “person with a knife” call. Some flights captured people who did not appear to be involved in a crime, including a person sitting on a roof during a “prowler” call and two men who got out of a car and began playing basketball after an “auto boost/strip” call, WIRED reported.
SFPD’s drone program began in 2024 and is authorized for active criminal investigations, vehicle pursuits, and training, according to department policy cited by WIRED. The fleet has grown from six drones to 98, and officers logged more than 1,400 launches between May 2024 and March 2026, according to a 2025 SFPD annual report and San Francisco Chronicle reporting cited by WIRED.
The department publishes some post-flight drone information through a transparency portal, but not video. The exposed Skydio link was separate from that system.
This story draws on original reporting from WIRED.
