LIVE · cybersecurity feed
Live wire
surveillancemedium

Flock’s Plans for Rideshare Dashcams and Coaching Police, Revealed

Flock Safety, a company known for its public safety cameras, reportedly pitched a plan to utilize dashcams from rideshare and delivery vehicles to collect license plate data. This initiative, which did not proceed, would have involved a partnership with Nexar, a dashcam manufacturer, and potentially involved drivers without their knowledge. Separately, a former Flock employee alleged the company provided direct camera access to ICE and CBP through a pilot program, contradicting internal statements.

zeroday.news ·

Flock Safety, a company known for its network of fixed license plate recognition cameras, reportedly proposed a plan to integrate its data collection with 350,000 dashcams used by rideshare and delivery drivers. This proposal, detailed in a sales presentation from August 2025 to the Georgia Attorney General’s Office, outlined a partnership with dashcam manufacturer Nexar. While Flock's existing cameras are stationary, capturing vehicle details as they pass, the Nexar collaboration would have enabled a mobile collection system.

Flock Safety has stated that this partnership never materialized. Uber, Lyft, and Nexar have not commented on the matter, and there is no indication that drivers would have been aware their dashcams were contributing to such a network. The proposal came to light through a public records request filed by a resident of Dunwoody, Georgia.

Separately, Nexar experienced a breach in September 2025, which resulted in the theft of terabytes of customer video footage, including recordings made near US Department of Defense facilities.

Further scrutiny of Flock Safety's operations revealed that a former government affairs manager, Jonathan Paz, claimed he resigned in July 2025, declining equity and severance, after discovering the company had provided direct camera access to Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP) through a pilot program. Paz stated that this contradicted internal company assurances to staff that Flock did not work with ICE.

Additionally, a coaching guide provided by Flock Safety to police departments advises officers on how to engage with city councils regarding the company's technology. The guide suggests private briefings with council members and city managers before public meetings, encourages scripted presentations, and recommends framing the discussion around the costs of unresolved crime rather than the direct cost of the system.

surveillancedata privacyridesharedashcamslaw enforcement
ShareXLinkedInWhatsAppFacebook

More News

view all →
breachcritical

Critical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise Data

The RovoBlast attack method identified by Varonis researchers could have been exploited to steal Confluence, Jira and SharePoint data. The post Critical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise Data appeared first on SecurityWeek.

email securityhigh

Sensitive Info Goes Into ‘No Reply’ Emails Constantly. This Guy Sees It All

Security researchers Cory Solovewicz and Mike Sheward have inadvertently created honeypots by purchasing domains like noreply.us and deleteduser.com. Organizations are mistakenly sending sensitive data, including personal information, company secrets, and system credentials, to these domains, believing they are unmonitored. Both researchers are now working to notify affected entities and raise awareness about this widespread misconfiguration, highlighting the potential for malicious actors to exploit such vulnerabilities.

atlassianhigh

Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers

Two security firms have identified vulnerabilities in Atlassian's Rovo assistant that could allow attackers to exfiltrate data from Jira and Confluence. One vulnerability, dubbed RovoBlast by Varonis Threat Labs, allowed attackers to trick Rovo into sending data to an external server via a malicious link. Atlassian has confirmed this issue is fixed server-side. The second vulnerability, found by PromptArmor, involved injecting malicious instructions into content Rovo processes, enabling data exfiltration without explicit user approval. The status of this second vulnerability remains unconfirmed after its initial disclosure.

css attackshigh

New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens

New research reveals that sophisticated CSS-based attacks can bypass webmail security measures, enabling attackers to steal sensitive information like passwords and session tokens. These techniques exploit vulnerabilities in popular email services including Outlook, Gmail, and Yahoo Mail, potentially leading to account takeovers and data breaches. The findings highlight the need for stricter sanitization and isolation of email content.

breach

Unlimited Technology Systems Data Breach Exposes Data of 3.8 Million Healthcare Patients

Hackers stole personal, medical, and insurance data of 3.8 million people from Unlimited Technology Systems’ data center. Unlimited Technology Systems disclosed a data breach affecting more than 3.8 million people after hackers accessed one of its commercial data centers between October 5 and 10, 2025. Unlimited Technology Systems is a U.S.-based healthcare technology company headquartered […]

CVE-2023-38646critical

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase has issued a critical alert regarding a zero-day vulnerability in its business intelligence software that has been actively exploited. The flaw allows unauthenticated attackers to inject SQL, leading to administrator access, credential theft, and data exfiltration. Metabase Cloud instances have been patched, and users of self-hosted versions are urged to update immediately.