A Leak of San Francisco Police Drone Footage Exposes the New Reality of Urban Surveillance
Just after noon on a Saturday last month, a Skydio X10 quadcopter hovered about 200 feet over a San Francisco apartment complex, watching police chase a man hiding behind a parked car. The target of this manhunt lay down on the pavement, apparently unaware that he remained in full view of the flying eye overhead. The 5-pound drone had, in fact, already followed him across the city, zooming in on his black SUV’s license plate, keeping the vehicle locked at the center of its video frame until he pulled over. Now it watched the police as they closed in and surrounded him.
As the officers approached, the man adjusted his hiding spot, moving to the other side of the parked car. At that moment, however, another Skydio drone zoomed in on his location, one of four Skydio quadcopters that had followed the man in just the prior hour. This one had been called away from a nearby McDonald’s, where it had been watching two people who’d exited the suspect’s car a few minutes earlier—and now began watching him from a second angle.
Within seconds, three officers converged on the man, two pointing weapons at him, then tackled him as half a dozen more police arrived on the scene. Police records provided to WIRED by the San Francisco Police Department show the entire street-and-sky response followed from what the SFPD described as an alleged “auto boost/strip” incident—the suspected theft of car parts or another object from a vehicle.
Drone footage exposed at a public web address shows how a quadcopter zoomed in on an SUV’s license plate, tracked it through traffic, then followed the driver as he exited the car and ran into an apartment complex. The suspect hid behind a vehicle, then adjusted his hiding place, yet was still visible to a second drone that arrived on the scene—one of four that tracked his location in a single hour and then captured police tackling him—all in response to what the SFPD describes as an alleged “auto boost/strip” incident, the theft of car parts or another object from a vehicle.
This glimpse of modern drone-enabled police surveillance, including the highly sensitive video of the man’s physical takedown, wasn’t voluntarily released by the SFPD—which, like most US police departments, rarely releases drone videos even in response to public records requests. Instead, it was accidentally livestreamed onto the open internet via Skydio’s website. That’s where two security researchers, Sam Curry and Maik Robert, discovered that the SFPD was leaking all of the real-time footage from five of its surveillance drones, including both color and thermal imaging, accompanying location metadata, and the drone pilots’ names and email addresses, to anyone who merely found the public web address where the videos were hosted.
Curry and Robert say they reported their discovery to Skydio around two days after discovering it, and it was quickly taken offline. By then, though, the researchers had watched police carry out what appeared to be multiple arrests and searches as well as tracking cars and individuals from the sky, all visible at a fully public web address.
“There’s a certain trust given to the police to use these things correctly,” says Curry. “When you're watching a drone feed live, you can look into dozens of different apartments, you can see police zooming in on people, you can see arrests. The fact that all of this was exposed feels like a really big issue from a privacy perspective.”
The leaked feed of video captures two forced detentions—whether any actual arrests were made is unclear from the footage—a police visit to an apartment in a high-rise apartment building, and an apparent search of an alley populated with homeless people, as well as numerous other more ambiguous instances where police used drones to surveil individuals, vehicles, or buildings. While the feed remained live, Curry and Robert began archiving the public stream of data and videos and later shared the results with WIRED.
Leaked drone video captures another detention.
The archive Curry and Robert captured offers a detailed record of SFPD drone operations over about 48 hours in mid-June. It includes 60 videos from 20 separate flights, with each mission recorded from three feeds: a color camera, a thermal camera that renders people as heat signatures, and a third view from the drone’s rooftop dock. WIRED analyzed all 20 color videos with software that detects people, vehicles, and other objects in images. The review found that the cameras had filmed hundreds of people and vehicles across the 20 flights. In a single frame, as a drone hovered over a downtown intersection, the software counted 34 people crossing the street or standing on the sidewalks. Across all of the videos the footage showed clear faces of dozens of people.
Together, the videos amount to more than three hours of aerial color footage and roughly the same amount of thermal footage. The archive also includes second-by-second telemetry logs for every flight—more than 5,000 GPS points in all tracing over some 44 miles—recording each drone’s latitude and longitude, altitude, speed, heading, and battery level from takeoff to landing. Six SFPD pilots’ names and email addresses also appear across the logs.
Skydio, based in nearby San Mateo, is one of the leading American drone companies selling to police departments, fire departments, government agencies, and the military. Its X10 drones are part of SFPD’s drone program, which began in 2024 and is authorized for vehicle pursuits and active criminal investigations. Since then, the program has grown quickly: SFPD’s fleet has expanded from six drones to 98, and officers logged more than 1,400 launches between May 2024 and March 2026, according to a 2025 SFPD annual report and reporting from the San Francisco Chronicle.
The city maintains a transparency portal that publishes information about police drone flights, including logs, after they occur—without video. The link Curry and Robert found was not part of that transparency system.
Curry and Robert say the drone videos were exposed not as a result of any error on the part of Skydio, but rather by what seems to be a misuse of Skydio’s software by the SFPD. Skydio allows users to generate shareable links to videos or access to drones’ data streams in real time, known as ReadyLinks, with the ability to limit access to users with an authentication code or an expiration date. Someone with access to the SFPD’s instance of Skydio’s software, however, appears to have created a link last December to five of its drones’ feeds with no authentication requirement and an expiration date of one full year.
That link was then somehow added to an open-source collection of archived web URLs known as AlienVault Open Threat Exchange, typically used by security researchers, where Curry and Robert found it. In other words, the link appeared to have already exposed the drone feeds for six months by that time, with no assurance that Curry and Robert were the only ones who had been watching.
When WIRED reached out to the SFPD, it responded in a statement calling the exposed drone video web address an “internal restricted link that is for SFPD law enforcement purposes only,” of the kind that “allow SFPD to coordinate on law enforcement and public safety operations,” and that it had been “improperly obtained and accessed by individuals without authorization.” (Curry and Robert point out that they didn’t bypass any security or authentication of any kind to access the stream, which is the typical legal definition of “unauthorized access.”)
“After being made aware of the vulnerability, SFPD has put more restrictive sharing protocols in place to ensure unauthorized individuals will not be able to access our footage,” the statement continues. “At this time, we do not have information that other individuals were accessing the live drone feed. This matter remains under investigation.”
Skydio didn’t respond to WIRED’s request for comment.
In the footage WIRED reviewed, drones capture dramatic moments like police chasing and restraining targets of the aerial surveillance. In other videos, officers can be seen through the window of an apartment in a high-rise, which police records describe as both a “check on well-being” or a “missing person” investigation in different drone flights filming the same incident. In another, police can be seen talking to homeless people in an alley, what police records describe as a “person with a knife” investigation.
A drone watches police inside a high-rise apartment.
The innocuous appearance of many of the videos raises questions about whether the surveillance was necessary. In one “auto boost/strip”-related call, the drone follows two young men in their car, at least one of whom is described in police records as having been identified as a “suspicious person in a vehicle.” Then the two men emerge onto a basketball court and start playing, and the drone departs.
A drone flight in response to what police records describe as a “person with a gun” investigation seems to fixate on a seemingly intoxicated man stooped on a sidewalk. Another drone, called in response to an alleged “prowler” incident, hovers over a young person wearing headphones and sitting on the roof of a building, zooms in on them, then flies away. “That one felt like an invasion of privacy, just so uncomfortable,” Curry says. “Like this person thinks they’re by themselves on this roof and has gotten away from everybody, and then there's a police drone watching them.”
In its statement, the SFPD notes that it adheres to a “strict policy” around drone use, and that “drones can only be used to assist with active criminal investigations, to assist with or in lieu of vehicle pursuits, and for training exercises.”
Curry and Robert say they first became curious about Skydio last month after seeing an announcement from a Florida police department that it was adopting the company’s drone system, and then learning how widely the company’s drones have been deployed across the US. As web-focused security researchers, they decided to check out the company’s systems. In one routine step, they used the tool GetAllURLs, which pulls all archived web addresses for a given domain from sources including AlienVault Open Threat Exchange, requesting all Skydio links. Almost immediately, they found the San Francisco police drone feed.
A drone, called in response to what police describe as a “prowler” incident, zooms in on a person on a rooftop with no apparent involvement in a crime.
Soon they were watching live footage of scenes like a man with a hand wrapped in a bloody white cloth talking to police and then a detention of a suspect at a gas station by a group of plainclothes policemen. At that point, it started to become “pretty clear that this probably shouldn't be public,” as Robert put it. “Like, I don't think there's any reason that someone from the public should be able to watch in real time as someone is getting grabbed by undercover cops.”
In fact, police departments have very often treated drone footage as too sensitive to release, even under freedom of information laws. Chula Vista, California, whose police department pioneered the “drone as first responder” model, spent years fighting a public-records lawsuit seeking access to its drone videos, arguing that the footage is investigatory and could expose private details about people caught on police cameras. (A California appeals court rejected the city’s position that the videos could be categorically withheld, a ruling that became statewide precedent after the California Supreme Court declined to review it. The case was sent back to the trial court to determine which videos, if any, must be released.)
pioneered the “drone as first responder” model
The fact that so much San Francisco drone footage was potentially exposed online is “shocking, but not surprising,” says Jay Stanley, a senior policy analyst with the ACLU Speech, Privacy, and Technology Project who focuses on drone surveillance and privacy. The videos, he says, demonstrate why privacy advocates consider any law enforcement surveillance data a “toxic asset” that’s always at risk of a security breach, and recommend minimizing the data and video recorded and retained from drone flights. “That means not recording when you don't need to record,” Stanley says.
SFPD’s drone policy says operators must keep cameras trained on areas necessary to a mission and minimize the inadvertent collection of data about uninvolved people or places. It also instructs operators to take reasonable precautions, including turning cameras away, to avoid inadvertently recording or transmitting images of places where people have a reasonable expectation of privacy. But the exposed Skydio feeds reviewed by WIRED showed full missions from takeoff to landing, capturing not only detentions and searches, but also streets, apartment buildings, rooftops, cars, courtyards, and bystanders who did not appear to be the subject of any police operation.
Another leaked drone video tracks a car for 10 minutes in response to what police records describe as an alleged “auto boost/strip” incident—until its driver and passenger emerge and begin playing basketball, and the drone departs.
“Watching these videos, it was just a reminder of what a powerful technology this is, and the amount of city life that is swept up in these videos,” Stanley says. The potential for privacy violations based on that broad video collection only becomes greater in the age of AI, he notes. “Maybe no human has the time to pore over every frame of these videos, but an AI can do that, and it's scalable to vast amounts of video,” Stanley says.
After each mission, the SFPD policy says, drone footage must be reviewed for evidentiary value and uploaded to the department’s digital evidence database; footage with no evidentiary value must be deleted within 30 days. Since the URL Robert and Curry found made real-time drone data available but not historical data, it’s not clear if the exposed videos violated that policy.
Curry and Robert were struck by the fact that, in all the videos they watched, no one ever looks up at the drone or makes an attempt to hide from it—perhaps evidence that, given their size and altitude, the flying cameras are virtually invisible to the targets of their surveillance. “You’re just watching from above, and no one is aware that the drone is there,” Curry says. “It felt kind of creepy.”
Curry says watching the videos has changed his sense of his own privacy as he walks around an American city—or, at least, San Francisco. “This was the first time I'd seen drones used in a city like this, and looking at these streets, they’re the same streets I walk down when I’m visiting,” he says. “I guess it just makes me feel more observed.”