Flock Safety has spent the last year telling American cities that its surveillance network is accountable, auditable, and locally controlled. Cities have canceled contracts. Citizens have cut down camera poles. The ACLU has been publishing investigations. The EFF has catalogued abuse.
The company got caught sending data to Upwork contractors and Denmark. The CEO declares Flock is under attack. The CISO denies high-profile, very real security issues. The permit manager installs cameras without adequate permits in California, Iowa, and other states. The VP of Solution Engineering redacts information from log files. The Chief Legal Officer appears on niche livestreams. And marketing, seemingly sponsored by the City of Dunwoody, pumps out questionable videos.[1]
You’d think Flock has enough to worry about at home. Now it’s going international.
We already know what Flock’s jurisdictional sprawl looks like domestically. The Virgin Islands Police Department — a Caribbean territory under an active DOJ consent decree for unconstitutional policing — was caught querying Flock cameras in Rogers, Arkansas for stolen vehicles and traffic violations. No one in Flock’s 5,000+-agency network — including Flock and the state agencies responsible for criminal justice information — has flagged that absurdity.
Now take that indifference and remove the American legal framework entirely.
Flock’s first(?) international reseller is Vumacam. A Johannesburg-based company that has been accused of building a digital apartheid, charged by regulators for operating without a license, and caught making false claims under oath about data protection compliance.
Sounds about right.
The Partner: Ricky Croock
Flock’s partner page lists Vumacam as a “channel provider”: “Vumacam is Flock Safety’s reseller partner in South Africa. The partnership extends Flock’s technology internationally, fostering safer communities abroad.”
Vumacam operates a network of over 7,000 cameras across South Africa’s Gauteng province — the majority concentrated in Johannesburg. The company was founded by Ricky Croock, a former private security operator who previously ran CSS Tactical, a company providing armed response, guarding, and CCTV services.
If you thought the Flock model couldn’t get worse: Croock found a way. Vumacam builds and maintains the camera infrastructure — poles, cameras, connectivity — and then sells access to private security companies, who pay a monthly fee for video feeds in their patrol areas.
The network includes over 2,000 automatic license plate recognition cameras that, as of 2021, scanned an estimated 9.68 million vehicle registrations per day. That figure has likely grown substantially alongside the network’s expansion to 7,000 cameras.
If this sounds like Flock, that’s because it is.
Croock and Vumacam’s History
The critical reporting on Vumacam is extensive, spanning investigations by MIT Technology Review, Daily Maverick, VICE, and the Pulitzer Center. Here’s what the record shows.
Operating Without Registration
South Africa’s Private Security Industry Regulatory Authority (PSIRA) charged both Vumacam and Croock personally with a code of conduct violation for operating a security business while unregistered with the authority.[2] Police opened a parallel criminal investigation. Vumacam subsequently registered, but PSIRA confirmed both the criminal case and the code of conduct probe remained active.
For a company building a city-wide surveillance network, the sequence is notable: deploy first, register later. Flock has its own version of this approach where hundreds of cameras were installed on public roads without permits across Florida, Illinois, South Carolina, Texas, and North Carolina, with an Illinois DOT official receiving a thinly veiled threat that Flock would send “about 30 different police chiefs” to the office if permits weren’t fast-tracked. And that’s just the states that have taken some form of action.
Lying Under Oath
In a sworn affidavit to the Gauteng High Court, Croock stated that Milestone VMS — the video management software Vumacam uses — was “certified GDPR-compliant under the General Data Protection Regulation applicable under European Union law.” Daily Maverick’s investigation found this was not true. EuroPriSe, the certification body, had not officially accredited Milestone; the application was still pending.
Croock also told the court that Milestone “ensures responsible use of data by end users.” Milestone’s documentation says the opposite: users, not the software, bear responsibility for compliance.
We’ve heard these types of assertions before. Flock’s CEO Garrett Langley told the public that Flock had no federal contracts. That was also not true. Flock was running a pilot program giving Customs and Border Protection and ICE direct access to data from its cameras. After information about the program became public, Flock stated it shut it down, but quietly continued to run it.
And, of course, Flock has also claimed all sorts of compliance, including compliance with HECVAT, which is a vendor evaluation form, and CJIS ACE — a commercial certificate, every bit as valid as the official Certified Privacy Advocate Certificate from haveibeenflocked.com.
“We don’t track people or cars”
Exactly like Flock claims in the US, Vumacam has publicly claimed its system “does not track people or cars.” The company’s marketing materials also echo Flock’s — which makes sense, given it is a reseller — and show that the system can retrospectively map a vehicle’s complete movements over 30 days. Precisely the definition of tracking.
Private security companies can add registration numbers to watchlists without court orders. Police can request location data through private security databases without subpoenas or warrants.
That’s true in America and South Africa.
Digital Apartheid
The “digital apartheid” criticism is the most damning line of criticism against Vumacam, and it’s also the most structurally relevant to understanding what Flock’s technology does, both domestically, and abroad.
Vumacam deployed its cameras almost exclusively in affluent, predominantly white suburbs of Johannesburg because that’s where paying customers were. Poor Black townships were left uncovered, not out of principle, but because there was no revenue model — nobody hires ADT or other security companies there. The result is a surveillance geography that maps onto apartheid-era spatial divisions with uncomfortable precision.
Flock declines to release its camera locations and many cities have refused to release Deployment Plans and other documentation. Efforts like Deflock are underway and are beginning to draw Flock devices on the same maps as America’s apartheid-era redlined districts.
A leaked shift report from Fibrehoods, a Vumacam partner, documented 14 incidents flagging 28 people as “suspicious.” — a term that’s commonly found in Flock logs as a “justification” for retrieving 30-day location histories. All 28 “suspicious” persons in the shift report were Black. The suburbs in question were majority-white.
Michael Kwet, a visiting fellow at Yale Law School who studies the South African surveillance industry, drew a direct line to the apartheid-era dompas — the internal passport system that restricted Black people’s movement in white enclaves. Vumacam (x Flock)'s AI-powered camera network recreates this digitally: Black residents in historically white suburbs are surveilled, flagged, and tracked.
Police in the US say they need Flock to stop them from pulling Black people out of cars at gunpoint. South Africa shows what actually happens when surveillance infrastructure is deployed by private companies in a society with deep racial stratification.
Intent is irrelevant. The business model is what matters.
Why This Partnership Matters
Flock’s domestic troubles are well-documented on this site and elsewhere. Secret data sharing, secret employee access to camera networks, cameras installed without permits, a CEO who goes ballistic rather than address concerns, and these types of hits keep on coming while the company only offers empty promises through increasingly snazzy marketing videos.
The Vumacam partnership introduces something new. The Virgin Islands querying Arkansas cameras was a preview — absurd, unmonitored, jurisdictionally incoherent, but still technically domestic. It’s the diet version of what’s happening in South Africa.
In the United States, Flock’s surveillance network technically operates within — however loosely and poorly enforced — a framework of Fourth Amendment protections, state privacy laws, US DoJ policies, FOIA requests, city council votes, and the kind of public pressure that gets contracts canceled.
In South Africa, Vumacam successfully sued the Johannesburg Roads Agency when the agency tried to suspend its camera permits, and the court ruled that the JRA’s job was to protect road infrastructure, not human rights. No civil society organization has brought a subsequent case. The Information Regulator’s investigation into POPIA compliance appears to have produced no public enforcement action.
Flock gets to sell its technology into this environment through a reseller. It is insulated from direct accountability while Vumacam gets access to the surveillance platform of a $7.5 billion company backed by Andreessen Horowitz and Founders Fund.
Vumacam wants to be Flock as much as Flock wants to be Vumacam.
The Response
SafeCity — featured in the backdrop for the event photo where Flock, Matrix, and Vumacam promote the partnership — is Vumacam’s premium product tier. It is the pitch to government. In February 2024, Vumacam announced a partnership with the Gauteng provincial government giving officials access to a network of over 6,000 cameras and “advanced crime-fighting technologies.”
Response times dropped, the company says, from 18–30 minutes to 5–10 minutes.
Last month, in March 2026, apartheid police commander Eugene de Kock, nicknamed “Prime Evil” testified in court about the atrocities he committed in the name of public safety.
Now, South Africa evaluates a high-tech mass surveillance network that replicates apartheid-era movement controls and lack of oversight that let Prime Evil act with impunity when his security forces abducted, tortured and killed activists.
When Flock’s critics — “activists” mounting a “coordinated attack” according to its CEO — warn about what happens when surveillance infrastructure scales without democratic oversight, they don’t speak in hypotheticals.
Johannesburg proves the outcome: Apartheid 2.0, powered by Flock.
There will be more in the future, if Flock’s Indeed page is anything to go by. The company is looking to hire a salaried ($135k–$160k p.a.), Los Angeles-based “Sr. Producer”: “As Flock’s video output continues to grow in volume, ambition, and operational complexity, the Senior Film Producer role is responsible for owning all pre-production and on-site production logistics that make high-quality video possible.” ↩︎
Flock did similar in North Carolina and Texas, and continues to operate without required licenses in states like Iowa. US regulators are seemingly not as effective as South Africa’s. ↩︎