A police-drone livestream sat behind one unprotected link
Researchers found live SFPD drone feeds at a public web address with no PIN and a one-year expiration, exposing how a useful ground-team sharing feature can become a privacy and operational-security failure.
By Joel Kelly
Decision brief
A live-video link is part of the aircraft system. Agencies should require short expiration, authentication, named access, viewer logs, immediate revocation, and a documented response when a link escapes its intended audience.
- Live feeds
- 5
- Link lifetime
- 1 year
- Access control
- No PIN
SFPD aircraft visible through the link
Configured expiration reported by Skydio and WIRED
No authentication barrier on the shared address
Exposure
The link carried operations, telemetry, and personnel information into public view.
Security researchers found a public web address carrying live video from five San Francisco Police Department drones, according to reporting by WIRED. The ReadyLink had no PIN and was configured to remain active for one year. The researchers said they found it in an open archive of web addresses rather than by bypassing authentication.
The material the researchers preserved covered 20 flights over about 48 hours, with color, thermal, and dock views. WIRED reported that the archive also included flight telemetry and pilot names and email addresses. The incident therefore involved more than an interesting camera feed: it exposed operational movements, public activity, and information about the people running the missions.
Response
No software exploit was required, but the product still shaped the failure.
Skydio CEO Adam Bry said the company was not hacked and that nothing technically failed in the ReadyLink service. He also wrote that the product made it too easy to create a long-lived link without protection and gave customers too little visibility into who was watching. Skydio said it was working on stronger controls and apologized to SFPD and the San Francisco community.
SFPD told WIRED that the link was intended for restricted law-enforcement use and that it had adopted more restrictive sharing protocols. The department's published UAS policy separately tells operators to minimize collection about uninvolved people, avoid recording places where privacy is reasonably expected unless authorized by law, review mission media for evidentiary value, and delete non-evidentiary material within 30 days.
Secure-share drill
Make a live link expire before the mission does.
A useful field feed should reach the intended responder quickly without becoming an invisible standing window into future operations.
- 01
Name the audience
Choose specific roles or accounts instead of a reusable public audience.
- 02
Set the shortest lifetime
Expire access at the end of the response window and require a new decision for any extension.
- 03
Require proof of access
Use authentication and viewer records appropriate to the agency, data, and mission.
- 04
Close and review
Revoke the link, preserve required evidence, inspect access logs, and document any unexpected viewer or disclosure.
Control plane
Every shared view needs an owner, a deadline, and a visible access record.
The operational lesson is broader than this one vendor or agency. A shared live view crosses the same boundary as an aircraft control account, evidence system, or dispatch platform. The program should define who may create a link, the maximum lifetime, whether authentication is mandatory, how viewers are identified, how access is revoked, what is logged, and who must be notified after unintended exposure.
Training
A capable public-safety crew has to secure the information after takeoff.
Public-safety pilots and program managers therefore need data-governance skills alongside flight proficiency. A complete recurrent exercise should test not only launch, communications, and emergency procedures, but also live-stream creation, least-privilege sharing, revocation, evidence handling, public-record responsibilities, and incident reporting. The aircraft can return to its dock while its data remains in motion.
Practical read
What a public-safety video-sharing system should prove
Strong fit
- Named responders who need live context for a defined incident
- Short-lived links with authentication, revocation, and access records
- Programs that connect flight policy, evidence policy, security review, and public accountability
Account for
- Year-long links created for temporary operations
- Anyone-with-the-address access to sensitive live imagery
- Treating streaming settings as an IT detail outside pilot and program training
Source file
Verify the reporting
Continue on Drone Authority
Put the report to work
Continue this beat
More public safety reporting
Industry · July 28, 2026
Virginia's AED drone beat the average fire response by 5 minutes and 36 seconds — on a test flight
Industry · July 28, 2026
An NYPD drone found six subway surfers, then had to hand them off to a ground team
Safety · July 27, 2026