I’ll write from the story briefs we have, with the Florida cameras as the case and Vicksburg as the cost of a missing inventory.TITLE: The County Had Cameras It Never Bought

St. Lucie County staff went looking along Florida roads and found a dozen Flock cameras they could not assign to anyone. No county permit. No owner on the roster. The housings were mounted, powered, and pointed at license plates. If your cybersecurity program still treats “what’s deployed” as a spreadsheet you update after budget season, this is what the gap looks like in daylight. Bruce Schneier flagged the find this week, and the ugly part is how familiar it should feel.

The Poles Were Live. The Asset List Wasn’t.

Counties sell “smart streets” in budget hearings. St. Lucie got a live camera plant with a hole in the ledger. Schneier lined the find up with unidentified StingRay devices that turned up in Washington, D.C. years ago, gear whose operators stayed unnamed. His working guess for Florida is a local government shop that skipped the permit. That guess still leaves you with twelve computers in public space and no enrolled owner.

A Flock-style plate camera is a host. Firmware. Credentials. Stored reads. A backhaul path into a vendor cloud. Once it’s mounted, plate, time, and location become someone else’s dataset. The county still owns the complaint, the records request, and the counsel question: who signed off on this feed?

Ghost hardware starves threat detection before a packet reaches a collector you pay for. Your firewall never received an object. DHCP never got a reservation. Brute-force noise against a camera admin portal riding LTE never lands in the city SOC. Threat-protection catalogs skip devices that were never in scope. You run a parallel collection network beside the one on your architecture slide.

Treat mystery cameras as default-password appliances with stale firmware and a support account you don’t control. Teams already know that checklist for units they purchased. The units nobody claimed skip every control on it. That’s the failure you now have to explain.

Vicksburg Cut Power Because Isolation Had No Map

A few states west, Vicksburg, Mississippi made the same class of gap loud. Mayor Willis Thompson said ransomware pushed the city to shut systems down. Civic services paused. The FBI and partner agencies opened an investigation. You take that step when the first hour of incident response cannot name what still has a path to everything else.

Pulling civic apps offline is the move you make when isolation has no map. Vicksburg’s press turn is the noisy cousin of St. Lucie’s shrug. One ends with residents in line because government services went dark. The other ends with plate cameras watching traffic for an operator who never identified themselves to the county that has to answer for the street.

If you run city or campus IT, these headlines belong in one queue. Unowned sensors and ransomed civic apps are both missing-system-of-record problems. Defense in depth is a story you tell about layers. Layers need names. A camera you didn’t hang sits outside the outer layer. A file server you can’t take down cleanly sits inside a blob. Security hardening on the gear you know does not commute to the gear you never enrolled.

You Can’t Do Cybersecurity on Ghost Hardware

Here’s the work this week. Vendor-neutral. No new platform required.

Walk a corridor you think you understand. City block, campus loop, plant fence, hospital drive. Pick the stretch with the most poles and cabinets. Treat it like a survey you already have permission to run. Photograph every camera, radio, traffic box, badge panel, and kiosk. Capture serials, MAC labels, SIM slots, SSID names, and whether backhaul is copper, fiber, or cellular. Then match that pile to purchase orders, right-of-way permits, DHCP, DNS, switch MAC tables, and firewall objects. Unmatched gear is untrusted. Isolate it. Disable the switch port. If the box rides LTE, you’re containing a device you don’t route. Document it, record the SIM identity if you can reach it, and escalate to whoever owns permitting on that pole. Leaving it live “for monitoring” is how a dozen cameras stay up with no name.

Same-day checks on the management plane. Default passwords. Open admin ports. Brute-force hits against camera and recorder logins. If those interfaces sit on city Wi-Fi or a flat VLAN with finance, that’s your emergency change. Security hardening here is deliberately dull: unique credentials, unused services off, management only from a jump segment, firmware you can actually patch or a written call to unplug.

Put the survey on a calendar. Permit-to-connect should cover poles, not just laptops. New MAC OUIs from camera vendors, new DHCP from cabinets, and unexpected DNS to ALPR clouds belong in threat detection with an owner and a play. Recheck corridors every quarter, because neighboring agencies and vendors add hardware without copying you. Tabletop the Vicksburg move. If ransomware hits civic apps, can 911, utilities, and records fail separately, or does one shutdown flatten everything because you never drew the map?

Cyber security for a county is plate-to-cloud, not just the data center. Threat-protection on email will miss a rogue ALPR modem. Make ghost hardware expensive to leave in place.

If You Don’t Enroll It, You Still Own the Blast

The feed is leaving. That’s what these products do. Unidentified units mean unidentified tenants, retention, and sharing you never contracted. Your public-records posture now includes a dataset you cannot produce or delete on demand.

Somebody hung those cameras. Schneier’s guess, a local shop that didn’t file the permit, still requires a phone call, a contract review, and a decision about the data already collected. Residents will not parse org charts when plate reads leak from a tenant you never enrolled. Put a named owner on every sensor that can see a person or a car. Put a data-flow diagram next to the purchase. Put a kill path in the runbook that doesn’t require the mayor on television. That’s the standard. Florida just showed you what missing it looks like from the curb.

Sources

• Unidentified Flock Cameras in Florida
• Mississippi mayor says ransomware incident led city to shut down systems