Flock Safety automated license plate reader cameras are being installed at the entrances to neighborhoods, apartment complexes, schools, and municipal roads across America at an extraordinary rate -- and most people who drive past them every day have no idea they are being logged. This workshop teaches participants to find them.

The detection methodology relies on the cameras' own wireless management interfaces. Flock Safety cameras are networked devices, networked devices have MAC addresses, and MAC addresses have organizationally unique identifiers that are publicly resolvable. Participants learn how to build MARVIN -- a MAC Address Recon for Vehicle Infrastructure Nodes war-driving kit -- around accessible hardware (a compute module such as a Raspberry Pi or laptop, a USB GPS dongle, and a set of ESP32S3 WiFi+BLE radios), then learn how to use it to passively enumerate Flock-associated hardware on every block they pass.

Participants leave with knowing how to build a working detection toolkit, a complete open-source software stack, a geo-referenced dataset from a real survey run, and the analytical methodology to turn raw Wi-Fi probe observations into a GIS-ready map of surveillance coverage.

Target audience: Privacy researchers, RF and hardware hackers, civil liberties advocates, journalists, homelab builders, etc. No RF or wireless background required - relevant 802.11 concepts are taught from scratch.

Venue requirements: Standard projection and audio. For hybrid delivery: a second video source (document camera or similar) for the hardware segment, a shared text channel serving both in-person and online attendees, and ideally a co-host to support remote participants during the hands-on lab.

Preferred duration: 2 hours. Expandable to 4 hours with a live field survey pass and extended coverage geometry and GIS analysis.

Format: In-person, online, or hybrid (in-person and online).

First public delivery: Wild West Hackin' Fest, Deadwood, South Dakota - October 2026.

Ethics and legal: Entirely passive, receive-only methodology. No active probing, no association or authentication, no packet injection, no credential capture, no images taken. Workshop datasets are sanitized or synthetic. The session frames this explicitly as civic documentation of public surveillance infrastructure, not as evasion of law enforcement.