Flock Safety and KSU's Data Security Policy

In Kennesaw State University’s procurement contracts with Flock Safety, Flock Safety agreed to adhere to KSU’s Data Security Policy, which Flock appears to be in direct violation of.

KSU’s policy defines Sensitive Information as follows:

Information maintained by a USG organization that requires special precautions to protect from unauthorized use, access and disclosure guarding against improper information modification, loss or destruction

It would make sense for realtime student location and historical travel data to fall under this category. Otherwise, why would the university have required Flock to sign this contract as part of their installation agreement?

Violation #1: section 6b.

The Flock cameras at Kennesaw State University are anonymously queried ~2,000,000 times a month. In December, Flock Safety locked the KSU Police Department out of viewing their external access logs^{1 2}.

The two million monthly searches run across KSU’s cameras are not official KSU business. KSU is not allowed to know who the individual searching is, who they’re tracking, or the purpose of the searches^{1 2}.

Violations #2, #3: section 6d. and 6g.

Section 6b: Section 6g:

Flock Safety’s Falcon v2 cameras, which are installed across campus run Android Things 8.1³. This version of Android is no longer maintained, and has not received a security patch since 2019.

Flock has also suffered breaches to their servers, exposing data from their national network⁴. Flock hard-coded an API key in their public-facing development environments, granting broad access to their national database⁴. Flock exposed this default key in 53 places.

Despite these vulnerabilities being responsibly disclosed to Flock, the company continues to deny their service has ever been breached⁵.