The San Francisco Police Department exposed real-time video from five of its Skydio surveillance drones on the open internet for roughly six months, an exposure that went undetected until two outside security researchers stumbled onto the feed. The exposed stream carried color and thermal video, live location metadata, and the names and email addresses of six SFPD drone pilots, viewable by anyone who found the public web address. WIRED broke the story on July 13, 2026, based on an archive the researchers shared with the publication.
Researchers Sam Curry and Maik Robert found the link while poking at Skydio’s public web infrastructure last month. They reported it to Skydio about two days after discovering it, and the feed was quickly taken offline. By then they had watched San Francisco police carry out detentions and track vehicles in real time, and had archived roughly 48 hours of SFPD drone operations from mid-June.
DroneXL has covered San Francisco’s drone program since the department stood up its first six aircraft in 2024, and this is the most serious operational failure in the program’s history.
A Sharing Link With No Password Caused The Leak
The exposure came from a misconfigured sharing link inside the SFPD’s own Skydio software, created with no authentication code and a one-year expiration date. Skydio’s ReadyLinks feature lets agencies generate shareable links to live drone feeds, with options to lock them behind an access code or a short expiry. Someone at the department skipped both.
According to WIRED’s reporting, the link was created last December and later surfaced in AlienVault Open Threat Exchange, an open-source collection of archived web addresses that security researchers routinely mine. Curry and Robert found it there using a standard URL-harvesting tool. That means the feed had likely been reachable for six months before they came along, with no way to know who else had been watching.
The researchers stress that they bypassed no security of any kind, which matters because the SFPD’s statement to WIRED framed the address as an internal-use link meant for law enforcement coordination that outsiders reached without authorization. A public URL with no password is not restricted in any meaningful sense. The department says it has since put tighter sharing protocols in place and that the matter remains under investigation. Skydio did not respond to WIRED’s request for comment.
The Archive Shows Full Missions From Takeoff To Landing
The captured archive contains 60 videos from 20 separate flights, each mission recorded from a color camera, a thermal camera, and a third view from the drone’s rooftop dock. WIRED ran all 20 color videos through object-detection software and found the cameras had filmed hundreds of people and vehicles, with clear faces of dozens of individuals. In one frame over a downtown intersection, the software counted 34 people on the street.
The telemetry is just as revealing. The logs contain more than 5,000 GPS points tracing some 71 kilometers (44 miles) of flight, recording each drone’s position, altitude, speed, heading, and battery level from takeoff to landing.
The missions themselves range from a textbook pursuit to flights that should make any Drone as First Responder advocate wince. Four Skydio X10 quadcopters tracked one suspected car-parts thief across the city in a single hour before officers tackled him at an apartment complex. Other flights filmed officers through the windows of a high-rise apartment during a well-being check, hovered over a search of an alley where homeless people live, and lingered on a young person wearing headphones on a rooftop during an alleged prowler call. In another flight, a drone followed two young men flagged as suspicious until they got out of their car, walked onto a basketball court, and started playing. “It felt kind of creepy,” Curry told WIRED.
SFPD Policy Says Minimize Recording, The Feeds Show Everything
SFPD drone policy requires operators to keep cameras trained on areas necessary to a mission, to minimize incidental capture of uninvolved people, and to turn cameras away from places where people have a reasonable expectation of privacy. The exposed feeds reviewed by WIRED instead showed complete missions from takeoff to landing, sweeping up streets, rooftops, courtyards, and bystanders with no apparent connection to any police operation.
That gap between written policy and recorded reality lands in a program that has scaled at remarkable speed. San Francisco’s fleet has grown from six drones to 98, with officers logging more than 1,400 launches between May 2024 and March 2026, according to a 2025 SFPD annual report and San Francisco Chronicle reporting cited by WIRED. DroneXL reported on the $9.4 million donation from crypto billionaire Chris Larsen that funded much of that expansion, and on the department’s earlier admission that it bought its first drones without the state-mandated approval in 2024. The city runs a transparency portal that publishes flight logs after the fact, without video. The leaked link was never part of that system.
The irony of the disclosure fight is hard to miss. Police departments have spent years arguing drone footage is too sensitive to release. Chula Vista spent over $1 million in a four-year legal war to keep 25 routine drone videos away from a newspaper publisher, losing at every level and creating statewide precedent in the process. San Francisco just gave away six months of live operational video for free, to anyone with the URL.
DroneXL’s Take
The DJI ban was sold to Congress on a simple story: the security risk lives in the drone’s country of origin. San Francisco just demonstrated the actual threat model. An American police department, flying American-made Skydio hardware, streamed its own live surveillance operations onto the open internet for half a year because somebody created a sharing link without a password. No Chinese server was involved. No foreign adversary was needed. The weakest link in drone data security is, and has always been, the person configuring the software, and no procurement mandate fixes that.
Eleven days ago I wrote about California residents pushing back on police drone programs, and I made the point that a properly run DFR drone does not film the ground on its way to a call. San Francisco’s exposed feeds recorded everything from takeoff to landing, in direct tension with the department’s own written policy. Compare that with Montgomery County, which points its cameras at the horizon in transit and publishes a searchable public dashboard. The difference between those two programs is the difference between earning public trust and burning it.
Here is my position: I want police drones to succeed, because the search and rescue saves, the de-escalated calls, and the pursuit-free arrests are real. That is exactly why this leak angers me. Every department that runs a sloppy program hands ammunition to the people who want all of them grounded. SFPD says the matter remains under investigation. The investigation that matters is the one residents will now run on every police drone program in the country, and departments should assume the public is watching the watchers from here on out.
Source: WIRED
DroneXL uses automated tools to support research and source retrieval. All reporting and editorial perspectives are by Haye Kesteloo.
