Last month, just after noon on a Saturday, a Skydio X10 drone hung in the air. 200 feet above a San Francisco apartment complex. It wasn’t there to scout traffic or take pretty pictures of the fog. It was watching a man. He was hiding behind a parked car, unaware that the sky itself was staring right at him.
The 5-pound machine had already trailed him across the city. It tracked his black SUV. It locked onto his license plate. It kept his vehicle in the dead center of its lens until he stopped moving.
Then things got weirder.
As cops closed in, the man shifted his weight. Moved to the other side of the car. At that exact moment, another drone zoomed in. A second Skydio quadcopter. It had been pulled away from a McDonald’s nearby to watch two people who’d stepped out of the suspect’s SUV. Now it provided a second angle. Four drones in total had hunted this one guy in just an hour.
Seconds later. Three officers tackled him. Half a dozen more arrived.
This wasn’t a spy thriller script. It was a live stream. And the worst part? It was completely free to watch.
An Open Door on the Internet
The San Francisco Police Department didn’t share this footage. They don’t do that. Like most US departments, they treat drone video as sensitive evidence, often denying public records requests.
No, this leaked because of a mistake.
Security researchers Sam Curry and Maik Robert stumbled upon it. They found a public web address on Skydio’s platform. It hosted real-time feeds from five of the SFPD’s surveillance drones. Not just video. Everything. Color and thermal imaging. Location data. Even the names and email addresses of the pilots flying the birds.
Any stranger on the internet could have watched it. Curry and Robert only noticed it by chance.
“There’s a certain trust given to the police,” Curry said. “When you’re watching a live feed, you see into dozens of apartments. You see arrests happening. To expose that is a massive privacy issue.”
They told Skydio two days after finding the glitch. It got taken down quickly. By then, however, the damage was done. The researchers had archived nearly 48 hours of footage from mid-June.
Sixty videos. Twenty separate flights. Each one captured from three angles: standard color, thermal heat signatures, and the drone dock itself. WIired used software to analyze the frames. In one single shot over a downtown intersection. The algorithm counted 34 people. Dozens of clear faces appeared across the entire archive.
How It Happened
Skydio is a big deal in Silicon Valley. They sell drones to cops, fire departments, and the military. The SFPD bought in back in 2024. Since then their fleet grew from six to 98 drones. Officers logged over 1,400 flights in less than two years.
But this leak wasn’t a hacking job. No code was broken.
Curry and Robert believe an SFPD employee just made a bad link.
Skydio allows users to create “ReadyLinks” for sharing live data. You can add password protection. You can set an expiration date. Last December, someone created a link to five drones. They left it unprotected. They set the expiry for a full year later.
Then someone added that link to the AlienVault Open Threat Exchange. This is an open-source directory used by cybersecurity folks. Curry and Robert were looking at all Skydio domains. The link was already there. It had been live for six months.
How many people had watched before them? We don’t know.
The SFPD called the address an “internal restricted link” in a statement. They claimed it was “improperly obtained” by unauthorized users. Curry and Robert find this language funny. They didn’t bypass any security. The door was just wide open.
“It wasn’t unauthorized access in the traditional sense,” the researchers noted. “No authentication was required.”
The View from Above
The footage shows a lot. Not just cops arresting people. It shows daily life from a bird’s-eye view that nobody asked for.
There are moments of high tension. A man with bloody cloth on his hand talking to police. Plainclothes officers detaining someone at a gas station. But then there is the rest of it. The banal surveillance of ordinary life.
A drone hovered over an alley where homeless people were living. Police described it as a “person with a knife” investigation. Another feed watched a high-rise apartment window for hours. Was it a well-being check? A missing person? The records weren’t clear.
One incident involved two young men labeled “suspicious persons in a vehicle” for an auto-theft report. They drove to a basketball court. Started playing ball. The drone left. Was the surveillance necessary? Who knows.
Another flight fixedated on an intoxicated man slumped on a sidewalk. The record said “person with a gun.”
Another watched a young person wearing headphones, sitting alone on a rooftop. Just chilling. Then a police drone zoomed right into their face before flying away.
“It felt like an invasion,” Curry said. “That person thinks they are alone. They got away from everyone. Except there is a drone watching them.”
The SFPD claims drones are only for active investigations and pursuits. They have policies. Operators are told to avoid recording unrelated people. To turn cameras away if privacy is expected.
But the leaked feeds captured entire missions. Takeoff to landing. They recorded streets, courtyards, cars, and bystanders. People who had nothing to do with any crime.
Jay Stanley from the ACLU calls police data a “toxic asset.” It always leaks eventually. He argues agencies should minimize what they record. Turn the cameras off when possible.
The problem is scaling. Maybe no human officer watches every frame of this video. But AI can. AI doesn’t sleep. It can process terabytes of footage, finding patterns humans miss. The technology is powerful. And right now. It feels uncontrolled.
SFPD says they have tightened their protocols since the leak. They deny anyone else watched the stream. It is still under investigation.
The drones are still flying. The fleet keeps growing. We don’t know what is being recorded today. We just hope no one finds the next link.
