L1
·
Quiz
·
Lab
L2
·
Quiz
·
Lab
L3
·
Quiz
·
Lab
L4
·
Quiz
·
Lab
Module Test
Module 2 · Lesson 1

Facial Recognition & Public Space

When cameras learn to identify, public space becomes something else entirely.
Who should decide when a face becomes a data point — and what happens when the answer is no one?

In January 2020, Detroit police used facial recognition software from DataWorks Plus to identify a suspect in a shoplifting case. The algorithm matched a still image from store surveillance to a database of state ID photos — and flagged Robert Williams, a Black man, as the suspect. Officers arrested Williams at his home in front of his family. He was held for 30 hours before investigators compared the original footage to Williams in person and conceded the match was wrong. It was the first publicly known case of a wrongful arrest in the United States caused directly by a facial recognition error.

Williams later testified before the U.S. House Oversight Committee. The city of Detroit settled his lawsuit in 2021, paying damages and agreeing to limit its use of the technology. Two additional wrongful arrests tied to facial recognition — Michael Oliver in 2019 and Porcha Woodruff in 2023 — followed the same pattern: low-quality surveillance footage, a probabilistic algorithm, and a human investigator who treated the output as confirmed identity rather than probable lead.

How Facial Recognition Systems Work

Modern facial recognition systems convert an image of a face into a mathematical vector — a unique arrangement of coordinates representing the relative positions of eyes, nose, mouth, cheekbones, and jawline. This vector is compared against a reference database using distance metrics (typically cosine similarity or Euclidean distance), and the system returns matches ranked by confidence score.

The system does not produce certainty. It produces probability. A match at 94% confidence means the algorithm believes there is a 94% chance the faces belong to the same person — which also means a 6% chance of error per query. When millions of queries are run across large databases, even a 99% accurate system generates enormous absolute numbers of false matches.

Training data composition directly shapes accuracy. Systems trained predominantly on lighter-skinned faces — as the widely cited 2018 MIT Media Lab Gender Shades study by Joy Buolamwini and Timnit Gebru demonstrated — perform significantly worse on darker-skinned women. Commercial systems from IBM, Microsoft, and Face++ showed error rates on darker female faces up to 34 percentage points higher than on lighter male faces. This disparity is not a bug introduced after training; it reflects the statistical distribution of the training set itself.

Documented Disparity — Gender Shades, 2018

MIT researchers tested three commercial facial analysis systems. The worst-performing demographic across all systems: darker-skinned women. IBM's system misclassified 34.7% of darker-skinned women while misclassifying only 0.3% of lighter-skinned men. Microsoft and Face++ showed similar gaps. The systems were sold commercially and used in real deployments before this study was published.

From Airports to City Streets

The United States Customs and Border Protection (CBP) began deploying facial recognition at airport departure gates in 2017 under the Biometric Exit program. By 2023, CBP reported it had processed over 400 million travelers using the technology, claiming a 99% match rate at the top-ten airports. The system compares live camera captures against visa and passport photos already held in government databases. Travelers who are U.S. citizens can opt out; few are informed they can.

In China, the "Sharp Eyes" national surveillance network — a direct expansion of earlier "Skynet" infrastructure — had installed an estimated 200 million cameras by 2018, a number that has grown substantially since. Facial recognition tied to the national ID database is used to identify jaywalkers (whose faces are sometimes displayed on public screens), to block individuals flagged as debtors from purchasing train or plane tickets, and to monitor religious and ethnic minority communities in Xinjiang. The Xinjiang system, documented in detail by researchers at the Australian Strategic Policy Institute and the New York Times, uses continuous location tracking linked to individual identities — a scale of population monitoring without documented historical precedent.

In the United Kingdom, the Metropolitan Police conducted live facial recognition deployments in London beginning in 2019. The first independent academic review, by Professor Peter Fussey and Dr. Daragh Murray at the University of Essex, found that 80% of the matches flagged by the system were false positives — the person identified was not the wanted individual. The Met continued deployments, citing the 20% true positive rate as operationally valuable.

False positive rateThe proportion of negative cases incorrectly identified as positive. In facial recognition, a false positive means the system flags someone as a match when they are not.
Biometric dataPhysical or behavioral characteristics that can be used to identify individuals — fingerprints, iris patterns, gait, voice, face geometry. Unlike passwords, biometrics cannot be changed if compromised.
Surveillance creepThe gradual expansion of monitoring infrastructure beyond its original stated purpose, typically enabled by the sunk cost of existing hardware and data.
Regulatory Response

San Francisco became the first U.S. city to ban government use of facial recognition in May 2019. Boston, Portland (Oregon), Minneapolis, and several other cities followed. The EU's AI Act, finalized in 2024, prohibits real-time remote biometric identification in public spaces by law enforcement with narrow exceptions — making it the most restrictive national-level regulation on the technology in a major jurisdiction.

Lesson 1 Quiz

Facial Recognition & Public Space · 5 questions
1. Robert Williams was wrongfully arrested in Detroit in 2020. What was the direct technical cause of the error?
Correct. DataWorks Plus software returned a probabilistic match. An investigator treated that probability as confirmed identity rather than a lead requiring corroboration — a procedural failure compounding a technical one.
Not quite. The arrest stemmed from an algorithm's false positive combined with insufficient human verification — no fabrication, hacking, or prior record was involved.
2. The MIT Gender Shades study (2018) found that commercial facial analysis systems performed worst on which demographic group?
Correct. IBM's system misclassified 34.7% of darker-skinned women while misclassifying only 0.3% of lighter-skinned men — a gap rooted in the demographic composition of training data.
Incorrect. The Gender Shades study found darker-skinned women were the most consistently misclassified group across all three tested commercial systems.
3. The University of Essex evaluation of the Metropolitan Police's live facial recognition deployments in London found what result?
Correct. The independent academic review found 80% false positives. The Met continued deployments, reasoning that the 20% true positive rate still provided operational value.
Incorrect. The Essex review found the opposite of high accuracy: four out of five matches produced by the system identified the wrong person.
4. What makes biometric data particularly sensitive compared to other personal data like passwords or email addresses?
Correct. Unlike a compromised password, which can be reset, a face or iris pattern is permanent. A breach of biometric data creates irreversible exposure for the affected individual.
Incorrect. The key distinction is irreversibility — biometric identifiers cannot be changed, which is why their compromise is uniquely serious.
5. Which jurisdiction enacted the most restrictive national-level regulation on facial recognition in public spaces as of 2024?
Correct. The EU AI Act, finalized in 2024, is the broadest restriction — prohibiting real-time remote biometric identification in public by law enforcement except in narrow specified circumstances.
Incorrect. The EU AI Act is the most comprehensive national-level (supranational) regulation. The US has no equivalent federal law; the UK and Canada have not enacted comparable bans.

Lab 1 — Facial Recognition Policy Advisor

Discuss the ethics and governance of facial recognition in public space with an AI advisor.

Your scenario

You are advising a mid-sized city council considering a pilot facial recognition program at transit hubs. The technology vendor claims 97% accuracy. You've just read about Detroit's wrongful arrest of Robert Williams and the London Met's 80% false positive rate. The council wants your analysis.

Starter prompts: Ask about what questions the council should demand answers to before any deployment. Or challenge the advisor on whether accuracy rates alone are sufficient to evaluate these systems. Or ask how you would design meaningful oversight for such a program.
Policy Advisor — Facial Recognition AI Lab
Welcome. You're advising a city council on a proposed facial recognition pilot at transit hubs. I'm here to help you think through the technical, ethical, and governance dimensions. What's your first question for the vendor — or for the council?
Module 2 · Lesson 2

Predictive Policing & Algorithmic Suspicion

Forecasting crime before it happens sounds like science fiction. It has been tried. The results are instructive.
Can an algorithm decide who is likely to commit a crime — and what are the consequences of acting on that prediction?

The Chicago Police Department deployed a predictive tool called the Strategic Subject List — informally called the "heat list" — beginning around 2013. Developed by the Illinois Institute of Technology research arm, the system scored individuals on a scale of 0 to 500 based on factors including prior arrests (not convictions), age, gender, and proximity to gun violence as either a victim or a perpetrator. The city did not publicize the list. Officers were instructed to visit individuals with high scores for "custom notifications" — warnings that police were watching them.

An investigation by the Chicago Tribune in 2017 found that the list contained over 400,000 names — approximately 56,000 with scores above 400, flagged as highest risk. Civil liberties researchers noted that the inputs were themselves products of prior biased policing: arrests, not crimes, reflected where police had previously concentrated resources. The department quietly shelved the program in 2019. The city's Office of Inspector General concluded in a 2020 audit that the Strategic Subject List "had not been shown to reduce gun violence" and had imposed "disproportionate" burdens on predominantly Black and Latino communities.

PredPol and Place-Based Prediction

A separate family of predictive tools targeted geography rather than individuals. PredPol (later rebranded Geolitica) was among the most widely deployed, used by departments in Los Angeles, Santa Cruz, New Orleans, and dozens of other cities. The system ingested historical crime reports and produced daily maps of 500-square-foot zones the algorithm predicted had elevated risk of property crime or assault during specified time windows.

A 2021 investigation by the Los Angeles Times and the nonprofit Human Rights Watch found a feedback loop at the heart of the system: police sent to PredPol zones made arrests in those zones; those arrests were recorded as crimes; the algorithm treated those records as new evidence of risk; future patrols were directed to the same zones. The historical crime data used as input was a record of past police activity as much as it was a record of actual crime. Areas historically under-policed generated fewer arrest records and thus lower algorithmic risk scores — not because crime was absent, but because documentation was absent.

Santa Cruz became the first U.S. city to ban predictive policing tools in 2020. Los Angeles ended its PredPol contract in 2020 following internal recommendations and public pressure. The Santa Cruz ban explicitly cited the feedback loop problem as a core reason for discontinuation.

The Feedback Loop Problem

Predictive policing systems trained on arrest data inherit the distribution of historical policing — not the distribution of actual crime. Over-policed communities generate more arrest records per underlying crime, creating higher algorithmic risk scores, attracting more policing, generating more arrests, and reinforcing the score. The system becomes a machine for encoding and amplifying existing enforcement patterns under the appearance of data-driven objectivity.

COMPAS and Recidivism Scoring

Northpointe (now Equivant) developed the COMPAS system (Correctional Offender Management Profiling for Alternative Sanctions) to predict the likelihood that a defendant would reoffend. Judges in Wisconsin, Florida, and other states began receiving COMPAS scores as inputs to sentencing and bail decisions. The scores were treated as proprietary by Northpointe, meaning defendants could not examine the algorithm's logic or challenge how their score was derived.

In 2016, the investigative outlet ProPublica published an analysis of COMPAS scores for more than 7,000 defendants in Broward County, Florida. The analysis found that Black defendants were nearly twice as likely as white defendants to be falsely flagged as higher risk for future crimes — meaning they were rated high-risk but did not reoffend. White defendants who did go on to reoffend were more likely to have been rated low-risk. The overall predictive accuracy of the tool across both groups was approximately 65% — barely better than asking members of the public to guess.

Northpointe contested ProPublica's methodology. Academic researchers subsequently published multiple analyses examining whether COMPAS could simultaneously satisfy different statistical definitions of fairness — and demonstrated mathematically that, under certain conditions, no single algorithm can be equally calibrated across groups that have different base rates of the measured outcome. This became known as the impossibility theorem of algorithmic fairness.

RecidivismThe tendency of a convicted person to reoffend. Recidivism prediction tools estimate the probability that an individual will commit a new crime within a specified period after release or sentencing.
Proxy variableA measurable variable used as a stand-in for one that cannot be directly measured. In criminal justice algorithms, zip code or number of prior arrests may serve as proxies — often inadvertently — for race.
Algorithmic accountabilityThe principle that automated decision systems should be subject to scrutiny, audit, and challenge by those affected by their outputs.
The Loomis Case — Due Process and Secret Algorithms

In State v. Loomis (Wisconsin Supreme Court, 2016), Eric Loomis challenged his sentence on the grounds that the court had used a proprietary COMPAS score he could not examine or contest. The Wisconsin Supreme Court upheld the sentence, ruling that COMPAS had been used as one factor among many and that the due process violation was not established. Critics noted that the ruling permitted secret algorithmic inputs into criminal sentences — a reversal of centuries of evidentiary transparency in common law courts.

Lesson 2 Quiz

Predictive Policing & Algorithmic Suspicion · 5 questions
1. Chicago's Strategic Subject List was criticized primarily because its inputs — arrest records — reflected what underlying problem?
Correct. Arrests reflect where police have previously focused resources. Using them as predictive inputs encodes existing enforcement patterns, creating a self-reinforcing cycle of targeted policing.
Incorrect. The core problem was that arrest data reflects the distribution of police activity, not the distribution of crime — making the model's "predictions" reflections of its own history.
2. ProPublica's 2016 analysis of COMPAS scores in Broward County, Florida, found which disparity?
Correct. ProPublica found a systematic pattern: Black defendants who did not reoffend were labeled high-risk at nearly double the rate of white defendants who also did not reoffend.
Incorrect. ProPublica identified a specific racial disparity in false positives — the system disproportionately labeled Black non-reoffenders as high risk compared to white non-reoffenders.
3. What is the "feedback loop" problem identified in place-based predictive policing systems like PredPol?
Correct. The 2021 LA Times / Human Rights Watch investigation documented how PredPol's predictions effectively mapped police activity back onto itself — under-policed areas appeared "safe" not because they were, but because arrests there were sparse.
Incorrect. The feedback loop refers to a technical self-reinforcement: patrol predictions drive arrests, which become new training data, which drive similar predictions, encoding the prior patrol pattern indefinitely.
4. What was the legal significance of State v. Loomis (Wisconsin, 2016)?
Correct. The Wisconsin Supreme Court upheld the sentence, ruling proprietary COMPAS could be used as one factor among many — effectively allowing secret algorithmic inputs into criminal sentencing while the defendant could not challenge the logic.
Incorrect. The court upheld the sentence despite the secrecy, setting a precedent that proprietary risk tools could be used even when defendants lacked access to the algorithm's methodology.
5. Researchers demonstrated an "impossibility theorem" of algorithmic fairness in response to the COMPAS controversy. What does this theorem establish?
Correct. When base rates differ between groups — e.g., if actual recidivism rates differ — satisfying one fairness criterion (like equal false positive rates) mathematically prevents satisfying another (like equal calibration). No single model can satisfy all simultaneously.
Incorrect. The impossibility theorem shows that with differing base rates between groups, multiple fairness criteria are mathematically incompatible — you cannot optimize for all of them at once in a single model.

Lab 2 — Predictive Policing Ethics Analyst

Examine how feedback loops and proxy variables distort algorithmic predictions in criminal justice.

Your scenario

A county prosecutor's office is considering implementing a recidivism scoring tool at bail hearings. You have been asked to prepare a briefing on what statistical fairness criteria the tool should be required to meet — and whether any single tool can satisfy all of them simultaneously. You've read the ProPublica COMPAS analysis and the academic impossibility theorem literature.

Starter prompts: Ask the analyst to explain the impossibility theorem in plain language for a non-technical prosecutor. Or ask what questions a defense attorney should be able to put to any vendor offering a risk score tool. Or challenge the analyst: is there any ethical way to use algorithmic risk scoring in bail decisions at all?
Ethics Analyst — Predictive Policing AI Lab
I'm ready to help you analyze the ethics of algorithmic risk scoring in criminal justice. We can work through fairness definitions, the impossibility theorem, or the practical questions a prosecutor's office should be asking vendors. Where would you like to start?
Module 2 · Lesson 3

Mass Data Collection & the Surveillance Economy

The most comprehensive surveillance apparatus in history was built not by governments, but by advertising companies — and it is for sale.
When data collected for targeted advertising becomes available to law enforcement, intelligence agencies, and data brokers, who bears the risk?

In June 2020, during protests following the death of George Floyd, the U.S. Department of Homeland Security purchased precise location data — tracking protesters' phone movements — from a commercial data broker called Venntel. Venntel's data was sourced from ordinary consumer apps: weather applications, games, and navigation software whose terms of service included language permitting location data to be sold to third parties. No warrant was obtained. The purchase was legal under existing U.S. law because Venntel had acquired the data commercially rather than through government surveillance authority.

A Senate Permanent Subcommittee on Investigations report published in December 2023 documented that multiple U.S. intelligence agencies had purchased commercially available data on Americans from brokers — data covering billions of location records and the associations, movements, and habits of millions of people. The report found that agencies held data "more sensitive than anything the government could obtain through a court order," obtained without one, because private collection and sale of that same data was not covered by the Fourth Amendment's warrant requirement.

How the Surveillance Economy Works

The modern data broker ecosystem operates through a layered supply chain. Consumer-facing apps — many free to download — collect granular data as a condition of use. This data flows to mobile measurement companies (sometimes called mobile advertising identity brokers) which link it to persistent device identifiers. Aggregators purchase and combine data from many sources, building comprehensive dossiers. Downstream buyers include advertisers, hedge funds, insurance companies, employers, and government agencies.

A 2023 Federal Trade Commission report on data brokers documented that the nine largest brokers in the U.S. collectively held records on virtually every American adult, including sensitive inferences about health conditions, political views, religious affiliation, income, and daily movement patterns. The FTC report found that consumers generally had no meaningful ability to access, correct, or delete records held by brokers with whom they had no direct relationship.

Location data is particularly revealing. A 2018 New York Times investigation ("Your Apps Know Where You Were Last Night") analyzed a single dataset of 50 billion location pings from 12 million Americans over several months. Reporters were able to identify the movements of specific individuals — including White House staff, military personnel, and celebrities — by cross-referencing location clusters with publicly known addresses. The data had been collected by a weather app.

The Carpenter Decision — And Its Limits

In Carpenter v. United States (2018), the Supreme Court ruled 5–4 that obtaining historical cell-site location records from carriers without a warrant violated the Fourth Amendment. Chief Justice Roberts wrote that the "detailed, encyclopedic, effortlessly compiled" nature of modern digital location records required constitutional protection. But Carpenter explicitly did not address data purchased from commercial brokers — leaving the surveillance economy largely outside its scope.

Social Media Intelligence and Automated Inference

Beyond location, AI systems can infer sensitive characteristics from seemingly innocuous behavioral data. Cambridge Analytica's data operation — which obtained Facebook profile data from roughly 87 million users through a third-party quiz application in 2014 — used psychographic modeling to infer political views, personality traits, and emotional vulnerabilities. The data was used in political advertising targeting without users' knowledge.

The Cambridge Analytica case, fully documented through Facebook's subsequent FTC consent decree and a £500,000 ICO fine in the UK, illustrated how data collected for one purpose (academic personality research) was transferred and weaponized for a different purpose (political micro-targeting) through contractual terms that users could not meaningfully review or anticipate.

A 2013 University of Cambridge study by Michal Kosinski, David Stillwell, and Thore Graepel demonstrated that Facebook Likes alone could predict — with statistically significant accuracy — a user's sexual orientation, political affiliation, religion, intelligence, and substance use. The study used 58,000 volunteers who consented to analysis; the concern it raised was that the same inference could be performed on anyone whose Likes were accessible, without consent.

Clearview AI, a company that scraped billions of images from social media platforms without permission and built a searchable facial recognition database, provided access to at least 600 law enforcement agencies in the United States by 2020. A February 2020 New York Times investigation first publicly documented the company's existence. Clearview subsequently faced enforcement actions in the UK (£7.5 million fine, ICO 2022), France, Italy, Greece, and Australia — but its database remained operational in the United States where no equivalent comprehensive law applied.

Data brokerA company that collects, aggregates, and resells personal information — often without direct consumer relationships. Data brokers are largely unregulated at the federal level in the United States.
Inference attackA method of deriving sensitive information not directly present in a dataset by combining observable data points — for example, inferring health status from purchasing patterns or movement data.
Third-party doctrineA U.S. legal principle holding that information voluntarily shared with a third party (such as a telephone company or a mobile app) loses Fourth Amendment protection — a doctrine challenged but not fully overturned by Carpenter.
The Mosaic Theory of Privacy

Justice Sonia Sotomayor, concurring in United States v. Jones (2012), argued that aggregation of individually innocuous data points can produce a profile whose intrusiveness surpasses any single data element. This "mosaic theory" — that privacy violations emerge from pattern rather than any individual piece — is central to understanding AI-enabled surveillance: no single app's data reveals everything, but combined, they reveal nearly everything.

Lesson 3 Quiz

Mass Data Collection & the Surveillance Economy · 5 questions
1. How did the U.S. Department of Homeland Security obtain precise location data on protesters in 2020 without a warrant?
Correct. Venntel sourced the data from consumer apps whose terms permitted commercial resale. Because the data moved through commercial channels, no warrant was legally required — the Fourth Amendment doctrine addressed government collection, not commercial purchase.
Incorrect. No warrant was involved. DHS simply purchased commercially available location data from a broker — a legal transaction under existing law that circumvented constitutional warrant requirements.
2. What did the 2018 Supreme Court decision Carpenter v. United States establish — and what did it explicitly leave unresolved?
Correct. Carpenter created a warrant requirement for carrier-held location records but its majority opinion specifically noted it was not addressing commercial data broker transactions — leaving a major loophole that agencies subsequently exploited.
Incorrect. Carpenter was narrow — it required warrants for carrier-held cell location records but explicitly left the commercial data broker market outside its ruling.
3. The 2013 Cambridge study by Kosinski, Stillwell, and Graepel demonstrated which concerning capability of AI inference?
Correct. The study showed that seemingly trivial behavioral data (Likes) contained enough signal for highly sensitive inferences — raising the concern that such inference was possible on anyone whose Likes were accessible, regardless of consent.
Incorrect. The Kosinski et al. study demonstrated that Facebook Likes — public, seemingly innocuous behavioral data — could predict deeply sensitive personal characteristics with statistically significant accuracy.
4. How did Clearview AI build its facial recognition database, and what regulatory consequences did it face?
Correct. Clearview scraped images without consent. European and Australian regulators fined or ordered deletion of the data. The U.S. lacked a comprehensive federal law to similarly compel compliance, so Clearview continued operating domestically.
Incorrect. Clearview built its database by scraping social media without permission — violating platform terms of service — and while it faced major regulatory actions abroad, the U.S. had no equivalent federal legal basis to shut it down.
5. Justice Sotomayor's "mosaic theory" of privacy, articulated in United States v. Jones (2012), argues what about aggregated data?
Correct. Sotomayor argued that pattern matters — a comprehensive picture of a person's life assembled from many innocuous fragments crosses a privacy threshold that the fragments individually do not, and the law needs to respond to that aggregate intrusiveness.
Incorrect. The mosaic theory holds that aggregation itself creates the privacy violation — no single data point may be sensitive, but the assembled picture can be extraordinarily revealing and should attract constitutional protection.

Lab 3 — Data Broker Investigator

Analyze the surveillance economy: where your data goes, who buys it, and what can be done.

Your scenario

You are a policy researcher preparing testimony for a Senate subcommittee hearing on commercial surveillance data. You need to explain the data broker ecosystem in accessible terms, address the loophole that allows government agencies to purchase data brokers have collected without warrants, and propose legislative remedies. You have access to the 2023 FTC data broker report and the 2023 Senate Permanent Subcommittee on Investigations findings.

Starter prompts: Ask the investigator to map the data supply chain from a weather app to a government purchase. Or ask what specific legislative language would close the commercial surveillance loophole left open by Carpenter. Or ask whether opt-out consent models are sufficient protection given how the data broker market operates.
Investigator — Surveillance Economy AI Lab
Ready to help you build your Senate testimony. We can trace data from consumer app to government database, discuss the Carpenter loophole, explore proposed legislative remedies, or examine whether consent frameworks actually protect people in the broker ecosystem. What would you like to start with?
Module 2 · Lesson 4

Consent, Oversight, and the Right to Not Be Watched

Surveillance without accountability reshapes the relationship between citizen and state — and between employee and employer.
What governance structures can make surveillance systems answerable — and is meaningful consent possible at population scale?

Beginning in 2018, Amazon deployed AI-powered surveillance systems across its fulfillment centers that tracked workers' every scan, package rate, idle time, and bathroom break frequency. The systems automatically generated productivity scores and, when scores fell below dynamic thresholds, issued automated warnings — and in some cases, automated termination notices — without direct human review. Workers at facilities in Delaware, Pennsylvania, and Minnesota described receiving termination letters signed by an algorithm, with no manager involved in the decision.

An investigation by The Verge in 2019 obtained internal Amazon documents showing that the automated system terminated hundreds of workers at a single Baltimore facility over a 15-month period. An Amazon spokesperson confirmed the system existed and that workers were informed of productivity expectations. Workers and labor organizers noted that the pace targets were set algorithmically based on the fastest performers — creating a system where targets could rise faster than most workers could adapt. The rate of musculoskeletal injuries at Amazon fulfillment centers was documented to be substantially higher than industry averages by the Strategic Organizing Center, a coalition of unions, using data from OSHA filings.

Employee Surveillance in the Digital Workplace

Workplace surveillance expanded sharply during the COVID-19 pandemic as remote work required employers to develop new verification mechanisms. By 2022, market research firm Gartner estimated that 60% of large employers used some form of employee monitoring software — tracking keystrokes, mouse movements, application usage, screenshots, and video. Tools marketed under terms like "productivity analytics" logged workers' computer activity at intervals as short as every 30 seconds.

In the United Kingdom, the Information Commissioner's Office published guidance in 2023 clarifying that extensive covert monitoring of workers was likely unlawful under the UK GDPR and would require a legitimate interest assessment. In the United States, by contrast, federal law largely permits employer monitoring of company-owned devices and networks with minimal disclosure requirements, and only a handful of states — including Connecticut and Delaware — require employers to notify employees of electronic monitoring.

A 2022 investigation by The Guardian and the nonprofit Coworker.org documented that at least 15 major corporations — including UPS, Kroger, and financial institutions — had deployed algorithmic performance management systems that set targets, issued warnings, and recommended discipline without line manager review. Workers interviewed described the systems as producing constant anxiety, difficulty disputing errors, and a loss of any meaningful appeal process when automated assessments were wrong.

Surveillance and Chilling Effects

Research by Elizabeth Stoycheff (Wayne State University, 2016) found that knowledge of government surveillance significantly reduced willingness to search for and express opinions on sensitive political topics online — a "chilling effect" on free expression measurable even when no legal consequences were attached. The study demonstrated that surveillance shapes behavior not only when sanctions are applied, but through the awareness that monitoring is occurring.

Governance Frameworks for Surveillance Systems

Effective oversight of surveillance technology requires mechanisms operating at multiple levels. Procurement review — requiring that government agencies conduct civil liberties impact assessments before purchasing or deploying surveillance tools — is implemented in Seattle (through its Surveillance Ordinance, passed 2017) and Oakland (through its Privacy Advisory Commission). These ordinances require public hearings and city council approval before new surveillance capabilities are deployed by any city department.

Algorithmic impact assessments (AIAs), modeled partly on environmental impact statements, require deploying organizations to document a system's likely effects on different populations before deployment. New York City's Local Law 144 (2023) requires employers using AI hiring tools to conduct annual bias audits and publish the results — the first such mandate in the United States. The EU AI Act requires conformity assessments for "high-risk" AI systems (including employment screening and biometric identification) before market placement.

Transparency and redress mechanisms address the problem that affected individuals often do not know they are subject to algorithmic decision-making. The EU's General Data Protection Regulation (GDPR) provides a right not to be subject to decisions made solely by automated means without human review, applicable to decisions producing significant effects. In practice, enforcement of this right has been inconsistent — the Irish Data Protection Commission, regulator for most major U.S. tech companies' European operations, had a documented backlog of thousands of cross-border complaints as of 2023.

Meaningful consent at population scale remains contested. Critics of consent-based frameworks argue that when surveillance is a condition of using public infrastructure, public transit, or employment, consent is not genuinely voluntary. An alternative framing — used in GDPR's "legitimate interest" and the EU AI Act's prohibited practices provisions — restricts what can be collected regardless of consent, removing surveillance practices from the consent economy entirely.

Algorithmic impact assessmentA structured pre-deployment review documenting a system's potential effects on individuals and groups, analogous to an environmental impact assessment for technology systems.
Chilling effectA reduction in the exercise of rights (speech, association, movement) caused by awareness of surveillance — occurring even without direct legal sanction.
Right to explanationThe principle, codified in GDPR Article 22, that individuals are entitled to meaningful information about the logic of automated decisions affecting them significantly.
The Illinois Model — BIPA

Illinois enacted the Biometric Information Privacy Act (BIPA) in 2008, requiring informed written consent before collecting biometric data, specifying retention limits, prohibiting sale of biometric data, and providing a private right of action. BIPA has produced the most significant privacy litigation in the U.S. — Facebook settled a BIPA class action for $650 million in 2021; TikTok for $92 million in 2022; Google for $100 million in 2022. BIPA's private right of action — allowing individuals to sue without proving harm — is widely viewed as the mechanism that gives the law actual teeth compared to state laws requiring a showing of concrete injury.

Lesson 4 Quiz

Consent, Oversight & the Right to Not Be Watched · 5 questions
1. Amazon's automated performance management system at its fulfillment centers generated controversy primarily because of what feature?
Correct. The Verge's 2019 investigation documented automated terminations at scale, signed by algorithm without manager involvement, and targets set against top performers — structurally preventing most workers from sustainably meeting them.
Incorrect. The documented controversy centered on automated terminations without human review and algorithmically rising targets — not biometrics, facial recognition, or pay reduction.
2. Illinois's Biometric Information Privacy Act (BIPA) is considered more effective than most U.S. state privacy laws for what specific reason?
Correct. The private right of action — allowing lawsuits without demonstrated concrete injury — is what produced Facebook's $650M, TikTok's $92M, and Google's $100M settlements. Most state laws require showing of harm, which is much harder to establish.
Incorrect. BIPA's distinctive feature is its private right of action without requiring proof of concrete harm — this is what drove hundreds of millions in settlements and distinguishes it from weaker state frameworks.
3. New York City's Local Law 144 (2023) established what requirement regarding AI in employment?
Correct. Local Law 144 mandated annual bias audits with published results — a transparency and accountability requirement rather than an outright ban, and the first of its kind at any U.S. jurisdictional level.
Incorrect. Local Law 144 required annual bias audits and publication of results — it did not ban AI hiring tools, mandate source code disclosure, or create a registry.
4. Elizabeth Stoycheff's 2016 research on surveillance and chilling effects found that surveillance affects behavior in what way, even absent sanctions?
Correct. Stoycheff's research demonstrated that simply knowing surveillance is occurring — without any specific targeting or punishment — measurably reduced political expression. The mechanism is the watched person's own self-censorship.
Incorrect. Stoycheff showed that awareness of mass surveillance — even without individual targeting or punishment — produced significant self-censorship in expression about sensitive topics.
5. The EU AI Act's approach to surveillance fundamentally differs from a consent-based framework in what key way?
Correct. The AI Act's prohibited practices provisions — covering real-time biometric identification in public, social scoring, and subliminal manipulation — remove those practices from the consent economy entirely. They cannot be made lawful by individual agreement.
Incorrect. The AI Act goes beyond consent: it prohibits specific high-risk surveillance applications regardless of whether individuals consent — because regulators determined that genuine consent is not possible when surveillance is embedded in public infrastructure.

Lab 4 — Surveillance Governance Designer

Design an oversight framework for AI surveillance systems in a democratic municipality.

Your scenario

You are the newly appointed Digital Rights Director for a city of 300,000 residents. The mayor has asked you to design a comprehensive AI surveillance governance framework — covering public space cameras, algorithmic performance management in city employment, and data broker purchases by city agencies. You must present your framework to the city council within 90 days. You have studied Seattle's Surveillance Ordinance, Oakland's Privacy Advisory Commission, New York's Local Law 144, and the EU AI Act's prohibited practices provisions.

Starter prompts: Ask the governance advisor to help you identify which surveillance systems should be prohibited outright versus regulated with oversight requirements. Or ask how to design a meaningful public hearing process that doesn't simply rubber-stamp police department requests. Or ask how to handle the tension between legitimate public safety uses of surveillance and civil liberties protection.
Governance Advisor — Surveillance Oversight AI Lab
Welcome, Director. You have 90 days to build this framework from the ground up. I can help you think through which surveillance practices to prohibit, which to regulate, what oversight structures actually work (drawing on Seattle and Oakland's documented experience), and how to handle the political pressure you'll face from law enforcement and vendors. What's your first design decision?

Module 2 Test — Surveillance at Scale

15 questions · Score 80% or above to pass
1. Robert Williams was the first publicly documented case of a wrongful arrest caused directly by facial recognition error in the United States. In which city did this occur?
Correct. Detroit Police Department used DataWorks Plus software in 2020; the wrongful arrest of Robert Williams became the first publicly documented case of this type in the U.S.
Incorrect. The arrest occurred in Detroit in 2020, by the Detroit Police Department using DataWorks Plus facial recognition software.
2. The Gender Shades study (MIT, 2018) found error rate gaps of up to how many percentage points between the best- and worst-performing demographic groups in commercial facial analysis?
Correct. IBM's system misclassified 34.7% of darker-skinned women vs. 0.3% of lighter-skinned men — a gap of approximately 34 percentage points.
Incorrect. The gap was approximately 34 percentage points — IBM's system had a 34.7% error rate on darker-skinned women versus 0.3% on lighter-skinned men.
3. The University of Essex independent review found that what percentage of the Metropolitan Police's live facial recognition matches in London were false positives?
Correct. The Essex review found 80% of the Met's matches identified the wrong person — four in five alerts were false positives.
Incorrect. The Essex review found 80% false positives — the Metropolitan Police continued deployments, citing the 20% true positive rate as operationally valuable despite this result.
4. Chicago's Strategic Subject List (the "heat list") scored individuals on a scale of 0–500 using inputs that included which factor — one that was directly criticized as embedding prior bias?
Correct. Using arrests (not convictions) meant the model encoded where police had previously focused — over-policed communities generated more arrest records, producing higher scores independent of actual behavior.
Incorrect. Arrests — not convictions — were a primary input, and critics noted this embedded the history of biased policing directly into the algorithmic scoring.
5. ProPublica's 2016 COMPAS analysis found the tool's overall predictive accuracy for all defendants in Broward County was approximately:
Correct. COMPAS achieved approximately 65% accuracy overall — which ProPublica contextualized by noting untrained individuals asked to predict recidivism also achieved roughly that accuracy.
Incorrect. COMPAS achieved approximately 65% overall accuracy — a modest result that raised questions about whether the tool's authority in sentencing was proportionate to its actual predictive power.
6. PredPol was discontinued in Los Angeles in 2020 following what documented problem?
Correct. The LA Times / Human Rights Watch investigation documented the feedback loop. LA ended its PredPol contract in 2020 following internal recommendations and public pressure driven by this finding.
Incorrect. The feedback loop — police patrol generates arrests, arrests confirm algorithmic risk, risk drives more patrol — was the documented and central reason for the program's discontinuation.
7. The Wisconsin Supreme Court in State v. Loomis (2016) ruled that use of a proprietary COMPAS score in sentencing was:
Correct. The court upheld the sentence, ruling COMPAS was one factor among many and that due process was not violated — permitting secret algorithmic inputs into criminal sentencing.
Incorrect. The Wisconsin Supreme Court upheld the sentence, finding no due process violation even though the defendant could not access or challenge the algorithm's methodology.
8. The U.S. Department of Homeland Security's 2020 purchase of protester location data from Venntel was significant because it demonstrated:
Correct. The DHS-Venntel transaction was a legal commercial purchase — no warrant, no judicial oversight — because Carpenter addressed government collection from carriers, not government purchase from brokers.
Incorrect. The key issue was legal circumvention of Carpenter: by purchasing data from a commercial broker rather than compelling it from a carrier, DHS avoided warrant requirements — entirely legally under existing law.
9. Cambridge Analytica obtained Facebook profile data from approximately how many users — and through what mechanism?
Correct. The quiz app — developed by researcher Aleksandr Kogan — used Facebook's then-permissive API to harvest data not only from 270,000 people who installed it, but from their friends' networks, reaching approximately 87 million profiles.
Incorrect. The Cambridge Analytica data harvest reached approximately 87 million users through a quiz app that exploited Facebook's API permissions to access not just installers' data but their entire friend networks' data as well.
10. Clearview AI faced major regulatory fines in multiple countries. Which jurisdiction did NOT issue a fine or enforcement order against Clearview as of 2023?
Correct. The U.S. federal government had no comprehensive facial recognition or biometric privacy law applicable to Clearview. The UK, France, Italy, Greece, and Australia all took enforcement action; the U.S. did not at the federal level.
Incorrect. The United States at the federal level is the jurisdiction that did NOT take major enforcement action against Clearview — the absence of comprehensive federal privacy law meant no equivalent mechanism existed.
11. Amazon's automated termination system at fulfillment centers set productivity targets algorithmically based on what benchmark — creating a structural problem for most workers?
Correct. Setting targets against top performers means that as any individual improves, the target rises — a race against the fastest that structurally prevents most workers from meeting sustainable standards over time.
Incorrect. Targets were set against the fastest workers at each facility — creating a moving standard that rose as any worker improved, making the system structurally unsustainable for most employees.
12. Seattle's Surveillance Ordinance (2017) established what governance mechanism for new city surveillance tools?
Correct. Seattle's ordinance requires impact assessments and council approval through public hearings — a democratic oversight mechanism applied before deployment rather than after problems emerge.
Incorrect. Seattle's ordinance required civil liberties impact assessments and city council approval via public hearing before new surveillance tools could be deployed — not mayoral approval, automatic deletion, or a live dashboard.
13. The GDPR's Article 22 right not to be subject to solely automated decisions applies under what condition?
Correct. Article 22 applies to automated decisions producing significant effects on individuals — it is not limited to biometrics or citizenship location but applies across employment, credit, insurance, and similar high-stakes decisions.
Incorrect. GDPR Article 22 applies when automated decisions produce significant effects on individuals — it covers employment, credit, legal, and similar consequential decisions, not restricted to biometrics or territorial presence.
14. The mathematical "impossibility theorem" of algorithmic fairness demonstrated by researchers responding to COMPAS shows that:
Correct. The impossibility theorem shows that competing fairness criteria — equal false positive rates, equal calibration, equal false negative rates — are mathematically incompatible when base rates differ between groups. Choosing one means failing another.
Incorrect. The impossibility theorem addresses fairness criteria, not accuracy ceilings or jurisdictional transferability: with differing group base rates, you cannot simultaneously satisfy all fairness definitions in a single model.
15. Illinois BIPA's 2008 passage produced Facebook ($650M), TikTok ($92M), and Google ($100M) settlements. The EU AI Act's prohibited practices provisions and BIPA share which underlying regulatory philosophy?
Correct. BIPA prohibits biometric collection without consent but also restricts sale regardless of consent; the AI Act prohibits certain practices outright. Both reflect the view that consent cannot legitimize all surveillance — some practices are categorically off-limits.
Incorrect. Both BIPA and the AI Act's prohibited practices provisions recognize limits to the consent framework — some surveillance practices are restricted or prohibited regardless of individual agreement, because meaningful consent is not possible or because the harm is categorically unacceptable.