Flock Pitched Turning 350,000 Uber and Lyft Drivers Into Rolling Surveillance Cameras. It Never Told the Drivers.
- 350,000 Uber, Lyft, and delivery vehicles Flock's own sales deck said were part of its planned Nexar partnership — Flock presentation to Georgia AG, Aug. 2025 — via 404 Media
- 130+ terabytes of Nexar dashcam footage exposed in a September 2025 breach traced to a single exposed access key — 404 Media breach reporting
- 1-in-3 LAPD Flock "hot list" alerts a city Inspector General audit found were false — Los Angeles Inspector General audit
- 54+ U.S. cities that have cancelled or declined to renew Flock contracts in 2026 — GovTech / TechCrunch
In Dunwoody, Georgia, a private citizen named Jason Hunyar filed a routine request under the state’s Open Records Act. What came back was a sales presentation Flock Safety — the Atlanta-based license-plate-reader company whose cameras now watch more than 5,000 U.S. communities — had prepared for Georgia’s Attorney General in August 2025. One line, buried in the slides, described a partnership the company had never disclosed to the public.
That partnership would have folded 350,000 Nexar-equipped Uber, Lyft, and delivery vehicles into Flock’s surveillance network — turning ordinary drivers’ windshield dashcams into a rolling fleet of license-plate readers. Nobody asked the drivers. Nobody asked their passengers. 404 Media reporter Joseph Cox, who received Hunyar’s find, published the story on August 7, 2026. Flock told Cox by email that it “never executed the partnership with Nexar.” The plan, as far as anyone has confirmed, stayed a pitch.
That distinction matters, but it shouldn’t be reassuring on its own. What follows is what the pitch actually said, how the mechanism would have worked, why a real security breach eleven months earlier proved the stakes were never hypothetical, and why Flock was already hemorrhaging city contracts nationwide by the time this document became public.
Flock’s Nexar pitch didn’t surface in a vacuum. It landed amid a broader, ongoing national fight over what these cameras see and who answers for it — the subject of the two clips below, neither of which is reporting on Hunyar’s document specifically.
Flock Safety’s pitch to Georgia’s Attorney General laid out the scale of its Georgia footprint the way a company brags to a regulator it wants to keep friendly: hundreds of businesses and homeowners associations already wired in, plus a partnership that would multiply its reach overnight. The presentation, delivered in August 2025, put it in the company’s own words:
“Hundreds of Commercial Business and HOA in GA are part of the network. Plus Nexar partnership which includes 350k Uber/Lyft and other delivery service devices.”
Flock Safety sales presentation to the Georgia Attorney General's office, Aug. 2025 — via 404 Media
That single line is the exact, sourced origin of the number now attached to this story everywhere: 350,000 — Flock’s own count of Nexar-equipped rideshare and delivery vehicles it planned to bring into its network. 404 Media had reported the existence of a Flock-Nexar partnership concept as early as August 2025; what Hunyar’s records request surfaced a year later was the first confirmation both of the specific scope and of the fact that the plan had been pitched directly, in writing, to a state Attorney General’s office. Breitbart’s report, published the same week, amplified the find. Georgia Attorney General Chris Carr (R-GA) is the recipient of the pitch, not its architect — nothing in the record ties him to authoring, approving, or acting on it.
Nexar makes AI-powered dashcams already mounted in hundreds of thousands of rideshare and delivery vehicles, sold to drivers and fleets as an insurance and safety tool — the kind of camera that catches the other driver running the light. Flock’s plan would have repurposed that consumer hardware for something else entirely: reading and logging the license plate of every car those dashcams passed, then feeding the results into the same searchable database law enforcement already queries through Flock’s stationary cameras. The driver’s dashcam would keep doing its insurance job. It would also, without anyone telling the driver, become a government-facing sensor.
No law required Flock, Nexar, Uber, or Lyft to disclose any of this to the drivers whose windshields would host the equipment, or to the passengers who’d be riding — and being recorded — behind them. Gig work’s independent-contractor classification leaves exactly the kind of regulatory gap this plan would have driven through: no employer notice requirement, no bargaining unit, no union contract clause covering what a mounted camera is allowed to do with a driver’s own hardware. Neither Uber, Lyft, nor Nexar responded to 404 Media’s requests for comment.
The risk in handing a private surveillance company access to hundreds of thousands of vehicle-mounted cameras isn’t theoretical. In September 2025 — before Hunyar’s records request, before the Georgia pitch became public — a hacker breached Nexar itself. The point of entry was almost absurdly small: a single AWS access key, embedded in every one of Nexar’s cameras, that handed the intruder a master key to the company’s cloud storage. In roughly two hours, the hacker pulled more than 130 terabytes of dashcam footage — video recorded by ordinary drivers on ordinary trips, now sitting in a stranger’s hands.
Some of that footage had been recorded near CIA headquarters and multiple Defense Department sites — ordinary dashcam trips that happened to pass through sensitive federal real estate. The breach also exposed Nexar’s client list, which named Lyft, Apple, Microsoft, Amazon, Google, Niantic, the NYPD, and the cities of Los Angeles and Austin among the organizations relying on its cameras. None of that is what Flock’s pitch would have created directly. It is, instead, the clearest evidence available of what can go wrong when this much footage sits behind one company’s security — a preview of the exposure a 350,000-vehicle network would have multiplied many times over.
By the time the Georgia pitch surfaced, Flock was already absorbing hits on multiple fronts. In Los Angeles, a 98-page city Inspector General audit found roughly one in three alerts generated by LAPD’s Flock “hot list” system were false — cars flagged as stolen or wanted that weren’t. A separate investigation found LAPD among the agencies illegally sharing license-plate data with ICE and Customs and Border Protection, in violation of California’s SB 34 sanctuary-data law. LAPD, under Mayor Karen Bass (D-Los Angeles), let its three-year Flock contract expire in July 2026, the department citing “serious concerns” over privacy and civil liberties.
Denver had already made its decision. Mayor Mike Johnston (D-Denver) pulled the city off Flock in February 2026, after a local news investigation found the company had given U.S. Border Patrol undisclosed access to Denver’s camera data; the city switched to a competitor, Axon. The revelation directly contradicted public claims by Flock founder and CEO Garrett Langley that the company had no federal contracts. The ACLU’s ongoing “Get the Flock Out” campaign has tracked the fallout nationally and, in April 2026, filed a Fourth Circuit amicus brief arguing automated license-plate-reader networks violate Fourth Amendment privacy expectations. More than 54 U.S. cities have cancelled or declined to renew Flock contracts in 2026 alone; 82 Flock contracts have been terminated across 28 states since August 2021.
The clip below, again broader context rather than direct coverage of the Nexar pitch, captures the shape of that fight — police departments defending the technology’s crime-solving value against critics who call it exactly the kind of network this story describes.
Flock Safety’s own sales deck put a number on a plan it never told the public about: 350,000 Uber, Lyft, and delivery vehicles, wired through a Nexar partnership, folded into a license-plate-surveillance network without informing a single driver or passenger. Flock says the deal was never executed. But the pitch existed, it went to a state Attorney General’s office, and it became public eleven months after a hacker used one exposed access key to pull 130-plus terabytes of Nexar dashcam footage — proof the exposure isn’t hypothetical. LAPD dropped its contract. Denver dropped its contract. Fifty-four-plus cities have followed. The 350,000-vehicle network was never activated. The appetite for building it clearly was.
