What Happened
A Dunwoody, Georgia resident named Jason Hunyar filed a public records request for Flock Safety's internal access logs and discovered something the city's residents did not expect. Flock employees had accessed camera feeds from sensitive locations - including a children's gymnastics room, a playground, a school, the Marcus Jewish Community Center pool, and several fitness studios - to conduct sales demonstrations for police departments around the country. 1City Learns Flock Accessed Cameras in Children's Gymnastics Room as a Sales Pitch Demo, Renews Contract Anyway
Hunyar published his findings in a Substack post titled "Why Are Flock Employees Watching Our Children?" The access logs revealed not just who viewed what, but the sheer scope of Flock's surveillance footprint within a single suburb: the system encompasses not only cameras purchased by the city but also cameras owned by private businesses. 1City Learns Flock Accessed Cameras in Children's Gymnastics Room as a Sales Pitch Demo, Renews Contract Anyway
Flock's Defense and the Policy Contradiction
Flock confirmed that the camera access occurred but pushed back forcefully against the characterization. A spokesperson told 404 Media that Dunwoody is part of a "demo partner program" in which the city authorized select Flock employees to demonstrate new products and features. 1City Learns Flock Accessed Cameras in Children's Gymnastics Room as a Sales Pitch Demo, Renews Contract Anyway The company also pointed out that engineers can access customer accounts with permission for debugging purposes.
Flock framed the controversy as evidence of its own transparency, arguing it is "one of the few technology companies in this space dedicated to radical transparency" because it maintains access logs that can be obtained through public records requests. 1City Learns Flock Accessed Cameras in Children's Gymnastics Room as a Sales Pitch Demo, Renews Contract Anyway
The problem is what Flock tells prospective customers elsewhere. Flock's FAQ page states that "Flock customers own their data," that "Flock will not share, sell, or access your data," and that "nobody from Flock Safety is accessing or monitoring your footage." 1City Learns Flock Accessed Cameras in Children's Gymnastics Room as a Sales Pitch Demo, Renews Contract Anyway The access logs tell a different story. Whether the access was authorized by the city or not, it directly contradicts the plain language of Flock's own published assurances.
After Hunyar's post gained attention, Flock agreed to stop using Dunwoody's cameras for demos and said employees would be trained to conduct demonstrations only in "more public locations, like retail parking lots." 1City Learns Flock Accessed Cameras in Children's Gymnastics Room as a Sales Pitch Demo, Renews Contract Anyway
The City Council Renewed the Contract
Despite hours of public testimony from residents raising privacy and data security objections, the Dunwoody City Council voted to renew its contract with Flock Safety. 2Dunwoody City Council approves controversial Flock contract The decision reflects a pattern seen in cities across the United States, where law enforcement utility consistently outweighs privacy concerns in municipal decision-making.
Flock Safety has deployed cameras in more than 5,000 U.S. communities across 42 states, backed by over 9,400 documented government contracts. 3Flock Safety Government Contracts: ALPR & Public Safety Intelligence But resistance is growing. Cities including Mountain View, Austin, Eugene, Flagstaff, and Cambridge have canceled or declined to renew Flock contracts after discovering unauthorized federal agency access or facing constituent pushback. 4The Flock Rebellion: Cities Pull the Plug on License Plate Surveillance
The Broader Security and Privacy Lesson
This incident illustrates a recurring blind spot in municipal surveillance procurement: vendor access controls are defined by contract language and trust, not by technical enforcement. Dunwoody's "demo partner agreement" gave Flock broad latitude, and residents had no visibility into how that access was exercised until one of them asked for the logs.
For security professionals, three takeaways stand out:
- Vendor access policies must be auditable by default. If Flock had not maintained access logs - something the company claims is unusual in the industry - this access would have gone entirely undetected.
- FAQ assurances are not access controls. A public-facing statement that "nobody is accessing your footage" means nothing if the contract permits exactly that under a demo program.
- Private camera integration expands the blast radius. The logs show Flock's network includes privately owned cameras, meaning a vendor's access agreement with a city can expose data from businesses and community organizations that never directly consented.
What Comes Next
The Dunwoody case is unlikely to remain isolated. As more residents and advocacy groups learn to file public records requests for surveillance access logs, similar revelations may surface in other Flock partner cities. Washington state has already passed SB 6002, enacting the state's first legal restrictions on automated license plate reader access and use. 5Washington state passes SB 6002 restricting ALPR access and use Whether other jurisdictions follow will depend on how loudly constituents demand accountability - and how long elected officials choose to look the other way.
Bild: ROBERTO GOMIS GARCIA / Unsplash
