The Dunwoody Drone Deal

At the April 13 City Council meeting (Video, Transcript), Dunwoody unanimously voted to execute a Master Services Agreement (MSA) with Flock and a $200,000 prepaid drone order form. Because Flock requires the entire sum at signing, and because the MSA caps Flock’s liability at the amount paid in the preceding twelve months, Flock’s contractual liability for the drone program drops to $0 in year two.

The city also entered into a contract for FlockOS 911 that will see call data transferred to Invictus, under an order form that incorporates Flock’s standard website terms and a separate set of Prepared911 terms rather than the MSA the city just negotiated. The city’s existing Flock-provided contract with ForceMetrics for sensitive, federally-regulated criminal justice information and health data did not get a mention at all in either the meeting or the new MSA.

The most controversial aspect of the relationship, that Flock employees on Dunwoody’s account had been caught watching the pool and gymnastics room at the community center, was vaguely explained and addressed only through platitudes before being hand-waved away.

If your city has Flock cameras, the contract almost certainly contains the same structural problems described below. Flock’s standard terms give it effective ownership of your data, cap its liability at near-zero, and leave critical regulatory obligations undefined. Dunwoody tried to negotiate and still ended up here.

Sales Demos and Empty Promises

The explanation was that Flock had been using the cameras in the gymnastics center for its sales demos. It wasn’t a case of Flock executives watching children, the mayor assured the crowd. It was Flock executives showing children to some unnamed third party to sell its product. This, in the council’s view, made the situation better somehow.

The city’s new MSA does not prohibit Flock from accessing Dunwoody’s account, and continues to grant Flock a royalty-free license to “support and improve Flock’s products and services,” which arguably describes what happened here. The license has no specified term and cannot be revoked.

The city will also continue to pay^[1] to send video surveillance footage from inside the privately-owned and -operated rec center and daycare to Flock.

But, rather than write safeguards into the agreement up for a vote, residents were told Flock had promised not to do it again. In the future, Flock promises, it will not expose images of Dunwoody children practicing gymnastics or going for a swim as marketing materials for its sales prospects.

The council accepted the explanation and the promise at face-value and without further inquiry.

What Dunwoody Didn’t Win

A day before the meeting, councilmember Joe Seconder had told Jason Hunyar, the soon-to-be Dunwoody Dad who discovered Flock’s viewing of the rec center, that the MSA would be raised “as a discussion item, not a vote.” This would be so “there will be additional time to provide feedback on the MSA … and what kind of revisions we can have set forth before a vote is held by council.”

Councilmember Seconder voted to adopt the MSA at that same meeting.

It prohibits Flock from using Customer Data “to train, fine-tune, or improve any machine learning, artificial intelligence, or algorithmic models” without written authorization from the City Manager. An email suffices.

It contractually mandates existing Flock features for data governance: a Federal Sharing Toggle that lets the city disable all data sharing with federal agencies (as defined by Flock), and a toggle to require case numbers and search justification for every query. Neither feature has to be enabled, but both must exist.

It contractually includes Flock’s “audit log masking”, where Flock no longer exposes the complete audit trail to its customers, framing it as a measure “to protect active investigations, law-enforcement operations, and sensitive data.”

It also requires a post-login CJIS acknowledgment requirement. Never mind that the aforementioned audit logs are a required component of CJIS compliance.

It freezes Flock’s incorporated Online Terms as of the Effective Date and bars unilateral changes without a written amendment signed by the Mayor or City Manager — but stops short at requiring council approval to modify the agreement approved by council.

These are concessions that sound good but collapse under even minimal scrutiny. They do not address the structural problems that make the rest of the contract a liability.

What Dunwoody Lost

The standard terms that place effective data ownership with Flock are left unmodified:

Flock retains the exclusive right to determine and control the method, timing, format, and medium of access or delivery of Customer Data … and is not obligated to provide Customer Data in any alternative form, format or transmission method outside of the Web Interface.

It’s not your data if you can’t access it and Flock doesn’t have to hand it over. It’s also not definitionally your data:

For clarity, Flock Property also includes any derivative works, intermediate or final outputs, analyses, reports, models, or other results generated by or through the Flock Services. Except for the limited ability to access and download Customer Data within the applicable Retention Period, no rights are granted to download, extract, export, or otherwise create or retain copies of such derivative works, outputs, or other elements of Flock Property.

A license plate number, a vehicle description, and arguably the raw image that Dunwoody won’t be able to access are a “derivative work,” “output,” or “result” “generated by or through the Flock Services.” “No rights are granted” to Dunwoody to any of this data.

Until the city manager sends an email, the AI/ML restriction limits what Flock can do with Customer Data for model training. It does nothing about data Flock classifies as Flock Property.

The Battle of the Order Forms

The city’s outside counsel assured the city council that the MSA with Flock would govern the city’s agreement with Invictus. She did not explain how the MSA, between Flock and Dunwoody, applies to an agreement with a separate company. She addressed the incorporation of Flock’s online terms by conclusorily asserting that the MSA would control; a possibility, not a given.

The FlockOS 911 order form does not incorporate the MSA. It incorporates the terms and conditions on Flock’s website and the Prepared911 Terms and Conditions at a separate URL. The council’s motion conditioned approval on execution of the MSA, but a condition precedent to signing is not the same as incorporating the MSA’s terms into the document being signed. The order form still says what it says. The council unanimously voted to sign the form that incorporates those terms rather than cross out the references and explicitly incorporate the MSA.

If Flock were to make the argument that the MSA does not govern the FlockOS 911 contract, it would have a strong position; the council agreed to the terms after adopting the MSA, and the MSA’s governance does not definitively follow from its structure:

The MSA defines “Agreement” to be the MSA plus any Order Forms. Its conflict-resolution clause handles conflicts between the “Agreement” (which includes the Order Form) and (1) any statement of work or purchase order, (2) special terms listed on an order form, (3) incorporated online terms. Conflicts between the “Agreement” and any “Order Form” (which is a part of the “Agreement”) are left unaddressed, because they are definitionally the same document.

$0 Liability

It’s a circular structure that’s especially damaging in the case of the Drone-as-First-Responder (DFR) contract:

1. Dunwoody signed a DFR agreement at some unspecified earlier date.^[2]
2. The MSA is executed. It “supersedes all prior agreements, understandings, and representations relating to the Flock Services.” The original DFR agreement is now dead.
3. The new DFR Order Form, approved during the April meeting, is executed “on the date hereof or following the Effective Date,” so it’s automatically part of the “Agreement.”

But the new Order Form incorporates “the previously executed agreement,” the document the MSA just killed in Step 2. It’s trying to resurrect terms that the Entire Agreement clause superseded. The conflict clause can’t resolve this. Not because it wasn’t designed for necromancy but because the new Order Form can’t conflict with the Agreement because it is the Agreement. There’s no hierarchy for resolving an internal contradiction within the Agreement itself.

The city is prepaying $200,000 for “Flock Hardware” it does not own and cannot maintain, per the MSA,^[3] but that’s not even the worst part: the MSA caps Flock’s aggregate liability at the total amount paid in the twelve months before a claim arises. Because the entire $200,000 is due at signing, in year two the amount paid in the preceding twelve months will be $0. Flock will carry no financial liability at all for operating an aircraft under contract with Dunwoody.

Drones, like any aircraft, are heavily regulated by the FAA. Those regulations are complex and violations can lead to severe penalties. Unsafe drone operations endanger other aircraft and persons on the ground. It wouldn’t be the first time a police drone collided with another aircraft.^[4]

Pricing

The pricing on the drone contracts is opaque. The first DFR Order Form lists a $300,000 contract total: $100,000 due in July 2025 and $200,000 recurring in January 2026, with a $160,699.50 discount on “Flock Safety Drone Hardware and Services”:

The second shows $200,000 due at signing with no discounts at all:

The first order is for “Flock Safety DFR 2.0 - 400ft”. The second for “Flock DFR - M4TD + Dock 3 (2 System Set)” and “Flock911 for Aerodome”. All items are priced as “included” under a platform fee that conceals the cost of each component.

Chief Carlson’s memo describes the second agreement as “the installation of additional DFR (Drone as First Responder) coverage,” which, I’m told, means Flock will add an additional drone.

Agreements All the Way Down

The original DFR agreement, the “previously executed agreement” on the order form, is an 11-page contract with a Product Addendum for “Unmanned Air Support as a Service,” two schedules covering training and specifications, and terms that place virtually all operational liability on the city.

That agreement itself incorporates another “previously executed agreement” on its order form. That appears to be a “Government Customer Service Agreement” from 2021, which is specific to ALPR.

The original drone agreement makes Dunwoody responsible for ensuring that all crew, including pilots, visual observers, and sensor operators, hold the qualifications and certificates required by applicable FAA regulations. It also assigns the city “the entire risk of loss, damage to, theft or destruction of, all Flock Hardware” and states, in all capitals, that loss or damage “SHALL NOT RELIEVE CUSTOMER OF ANY OBLIGATION UNDER THE AGREEMENT.”

The agreement carves all drone data, including flight logs, telemetry, radar, and fleet information, out of Customer Data entirely. It classifies it as “Flock Drone IP” owned exclusively by Flock. The city cannot share any of it with third parties without Flock’s written consent. That restriction says “any third party” without an exception for regulatory authorities, covering the patently absurd situation where the city’s pilots can’t disclose flight logs or telemetry to the FAA or even ATC.

None of this is in the MSA that council reviewed and approved. The MSA has no terms concerning the drone program. If counsel is right that the MSA controls, the original drone terms are dead and there is nothing governing drone operations, FAA certification, pilot responsibilities, or risk of loss.

If the original terms survive through the Order Form’s incorporation clause, Dunwoody is responsible for everything: the pilots, the certifications, the waivers, the airworthiness, and the losses, while Flock owns the data the drones generate. Because it’s an order form, the MSA’s conflicts clause is inapplicable.

Either way, council and residents were told they had a negotiated deal: they don’t.

The State of Madlibs

Then there are the ForceMetrics terms signed by the city. Those were stapled to a Flock order form in February 2025. ForceMetrics is a data aggregation and analytics platform that pulls together internal databases like CAD (dispatch), RMS (records management), and JMS (jail management).

The “Informed Responder” product Dunwoody uses “surfac[es] real-time Safety Signals in search results,” to give “first responders quick, actionable insights into critical risks—such as mental health issues, dementia, drug use and domestic violence.”

The ForceMetrics agreement assigns itself a forever-license and ownership of all “Derived Data”, and claims to be the “final, complete and exclusive agreement between the Parties relating to the subject matter hereof”.

ForceMetrics receives federally-regulated criminal history record information and criminal justice information, like names, addresses, and domestic violence histories. It also gets information about mental health and substance history, categories that may be federally protected health information.

To add to this mess, the ForceMetrics terms set a different liability cap (“[t]o the extent authorized by the constitution and the laws of the State of ____,” nobody filled in the blank) and say any conflicts will be handled according to Colorado, not Georgia, law.

Flock Understands and Acknowledges

At the meeting, the most bizarre clause in the agreement was not questioned by council:

Flock understands and acknowledges that prior to Customer contracting for or using any new Flock Services that it does not use as of the Effective Date, Customer must obtain approval from the City Manager of Customer

Why Flock’s understanding matters is anyone’s guess. It could be a way to nullify any effect of the clause because it doesn’t place an affirmative duty on anyone, it merely says Flock understands something. At least someone does.

Looking past that, “any new Flock Services” presumably come with additional legal terms. Those terms, as we’ve seen here, tend to have significant effects on liability and obligations. For example, when the Flock Services send 911 caller data to parties like Invictus, or when the Flock Services come with a requirement to maintain FAA-certification.

In any organization with even slight governance in place, entering into those types of agreements is not something a staff member should be able to do, with or without city manager approval. The city attorney and city council should have a say.

Not here. Dunwoody PD will keep signing agreements without legal review or council approval. Flock will continue to operate its Dunwoody Lab as it has for years.

The MSA requires some software toggles without requiring a setting. The AI-training prohibition can, and likely will, be easily voided via an email from the city manager. Every single structural problem is left untouched: the data ownership, the liability cap that zeroes out on a prepaid contract, the order form chain that either governs nothing or governs too much, the ForceMetrics terms governed by a different state’s law with an unfilled blank in the indemnity clause, and the 911 contract that exists entirely outside of the scope of the MSA.

If there is ever a contractual violation severe enough not to be hand-waved away, one the PD and council find more concerning than using children in the pool for sales demos, Dunwoody will now have to spend a small fortune on litigating the mess it has allowed Flock to create.

Of course, when such contractual violations can be waved away with a vague assurance that it won’t happen again, Dunwoody is unlikely to stand up to Flock and to assert its contractual rights.

A public commenter characterized the relationship as abusive. That’s exactly what it looks like.