Dunwoody Flock contract deferred again over security and legal concerns

A seemingly routine $15,000 contract has become a prolonged fight in Dunwoody, as the city council, for the second time in as many months, unanimously voted to defer a deal for Flock Safety’s 911 response system due to ongoing privacy, security and legal concerns. 

The contract for Flock911 will come up for a third vote at the April 13 meeting. The city’s outside counsel, Jill Dunn, is working on a new master services agreement—the overarching contract governing the city’s relationship with Flock—to address the city’s concerns. 

Flock has a strong relationship with the Dunwoody Police Department, which began piloting the 911 software a year ago after determining that the previous technology did not meet its needs. Flock911 monitors and transcribes incoming 911 calls, allowing officers in the field or those in a real-time crime center to begin responding before the call is complete. Dunwoody’s real-time crime center is largely powered by a suite of Flock software products. 

Dunwoody resident Jason Hunyar has been concerned about the city’s relationship with Flock since December. He has filed about 35 public records requests with the city related to Flock. Hunyar had never filed a public records request prior to December. 

“The public deserves to know in writing what surveillance technologies the police department uses,” Hunyar said. 

Through his records requests, Hunyar found several issues that alarmed him, including the Dunwoody Police Department sharing out camera data from the Marcus Jewish Community Center (MJCC) of Atlanta, despite the private network noted in the system as “do not share.” 

The police department said that only live data, not retained data, was accessible to four other departments before the issue was corrected. 

Hunyar began bringing his concerns to the city council and the Dunwoody Police Department ahead of the proposed Flock911 contract, which first came up for a vote on Feb. 23. Many of the concerns he raised were brought forward by council members during both the February and March meetings.

During the February meeting, the city council deferred the contract over security, data and privacy concerns with Flock technology more broadly. The council requested that the city’s technology and legal departments review Flock’s security and the city’s current contracts with the company. 

During Monday’s meeting, Dunwoody’s Technology Department presented the audit prepared for the council. The audit noted several areas of concern, including “breach/security incident history,” a lack of evidence for misuse controls and no mandatory enforcement of multi-factor authentication for all Flock users. 

“Is the city’s position that because the department needs this technology, we are willing to compromise on cybersecurity?” Hunyar asked after reading the audit. “That is an unacceptable standard.”

Dunwoody and Flock disagree on what counts as a breach

Ginger LePage, the city’s technology director, presented the audit and discussed what she called past breaches of Flock technology. Flock disagrees with the use of the term breach. 

Dunn said that the definition will be clarified in the master services agreement. 

At the core of the disagreement sit two videos released by Benn Jordan, a technology journalist, who was in attendance at Monday’s meeting. 

In his first video, which was released in November, Jordan showed vulnerabilities with Flock hardware that allowed him to gain root access to devices, view footage dating back to factory testing and see license plate photos, which he said were stored unencrypted. Jordan told ACPC that the devices were running Android 8, which Google has not supported with security updates since 2021. 

Flock’s chief legal officer, Dan Haley, who appeared before the council via Zoom, disagreed with the characterization of Jordan’s findings as a breach. 

“There are not documented breaches online,” Haley said. “There’s documented attempts to intrude on a single camera online, and that is like saying that if someone hacks into your iPhone, Apple has been breached.”

Haley also said that the camera Jordan used in his first video was obtained “illicitly” and was not directly connected to Flock’s network, thus could not receive security updates. In that video, Jordan stated that, to his knowledge, all Flock cameras he worked with were obtained legally. 

LePage clarified that she was referring to a second video, in which Jordan used footage of himself streamed directly from a Flock camera in Brookhaven through an administrative website he found on a commercial search engine. 

Haley described the issue as a “misconfiguration” by Verizon Wireless that enabled “someone on the dark web” to access live camera streams. He said the issue has since been fixed. 

Jordan told ACPC that Flock’s language on the issue was indicative of broader problems. 

“If a company is going to pedantically redefine the definition of ‘data breach’ instead of owning a mistake, that gives you a forecast of what you can expect the next time it happens,” he said.

What’s next?

Dunn, the city’s outside counsel, said that she and Flock’s legal team were working on the updated master services agreement, which she anticipates will be completed within the next 10 days. 

Earlier this month, Jordan offered to pay out of pocket to have an independent security contractor audit Dunwoody’s surveillance infrastructure.

As of Monday’s meeting, the offer had not been accepted, but Jordan was approached by several council members after the meeting ended. 

Meanwhile, additional groups have begun organizing against Flock in the metro Atlanta area. All but three of the 16 speakers during public comment on Monday opposed the Flock contract. 

Sean Collins, a Dunwoody resident and member of the local Democratic Socialists of America chapter, highlighted a resolution the organization recently passed that included a proposal to launch a pressure campaign against Flock in DeKalb County, where Dunwoody sits. 

Several attendees handed out flyers that read, “Don’t allow Atlanta to be Flock’s nest. Call for an end to contracts with Flock across Atlanta now.”

We need to raise $65,000 by June to keep publishing stories like this one! Historically, readers like you have accounted for ~5% of our annual revenue. For sustainability, we need it to be closer to 25%. We’ve run fundraisers before, but not at this scale. That’s the number we need to hit so we can continue to cover ICE, protests, surveillance, DEI, Cop City, policing and the City Council.

To that end, we’ll start attaching a cost of goods to each of our stories so you can see part of what it costs to do this work.

This story is 1012 words. We pay $.66/word for freelance work, for a total of $667.92. There was an additional hour of editing time. A livable wage in Atlanta is $27/hr.

The total cost of this story is $694.92.

Can you chip in $25 to help cover the cost of this story?