In 2013, after the Boston Marathon bombing, investigators reviewed footage from hundreds of cameras — private businesses, traffic sensors, bystander phones — to identify the Tsarnaev brothers in roughly three days. The same camera density that enabled that investigation now covers most major urban centers continuously, twenty-four hours a day.
Closed-circuit television existed in British banks and London streets from the 1960s. For decades it produced grainy analog footage that humans had to watch manually — useful only after an incident, and only if someone sat through hours of tape. The system was passive storage, not active observation.
Three technological shifts changed this. First, cameras became digital and internet-connected, enabling remote viewing and central archiving. Second, storage costs collapsed — recording everything continuously became affordable. Third, computer vision algorithms became capable enough to analyze footage automatically: detecting motion, classifying objects, reading license plates, and eventually recognizing faces.
The result is qualitatively different from old CCTV. Modern systems don't just record — they watch, generating alerts and building searchable databases of movement and identity in real time.
After IRA bombings in the early 1990s, the City of London erected a cordon of cameras and checkpoints called the "Ring of Steel." License plate readers logged every vehicle entering. After the 7/7 bombings in 2005, the system expanded city-wide. By 2022, Transport for London's network could reconstruct any individual journey across the tube, bus, and congestion-charge systems retroactively using camera and Oyster card data combined.
A modern urban surveillance network has four layers. Edge devices — cameras with onboard processors — capture and pre-process video, often performing motion detection or basic object classification locally. Communication infrastructure — fiber, 4G/5G, or dedicated police radio networks — moves compressed video to central servers. Analytics platforms — software from vendors like Axon, Motorola, or Hikvision — run face recognition, license plate reading, and behavioral analysis against the streams. Human operators sit in Real-Time Crime Centers (RTCCs) reviewing alerts and making decisions.
Many U.S. cities — including New York, Atlanta, and Los Angeles — have built RTCCs that aggregate camera feeds from police, transit, private businesses, and even private homeowners who opt into programs like Amazon's Neighbors portal, which allows law enforcement to request Ring doorbell footage.
No single camera is alarming. But when camera data is merged with license plate readers, cell phone location records, facial recognition databases, and social media scraping, individually innocuous data points combine into a comprehensive picture of a person's life — their associations, routines, beliefs, and movements — without any single piece of data feeling invasive on its own.
In this lab you'll examine how surveillance camera networks are constructed and what their capabilities actually are. Explore real cases, challenge assumptions, and think through what it means to move through a monitored public space.
In January 2020, Robert Williams, a Black man in suburban Detroit, was arrested in his driveway in front of his wife and daughters. He was detained overnight. The Detroit Police Department had used a facial recognition system to match a blurry surveillance image from a shoplifting incident at a watch store. The system matched Williams. The match was wrong. Williams had never been in that store. A human detective approved the arrest based on the algorithmic result alone. The case was dropped — but only after Williams spent a night in jail. He later sued the city.
Law enforcement face recognition typically follows a specific pipeline. A probe image — often a still frame from surveillance footage — is submitted to a system that converts the face to a mathematical embedding, then searches a database (often state DMV records, mugshot databases, or FBI repositories) for the closest mathematical match. The system returns a ranked list of candidates with similarity scores. A human analyst is supposed to confirm the match before action is taken.
The problem is that the probe images police actually work with are frequently low-resolution, poorly lit, or partially occluded — captured from aging cameras at unfavorable angles. The algorithms were often benchmarked on high-quality portrait photographs and perform significantly worse on surveillance-quality imagery.
The National Institute of Standards and Technology tested 189 face recognition algorithms in 2019. Most commercial algorithms showed significantly higher false-positive rates for Black women's faces compared to white men's — in some cases 10 to 100 times higher false match rates. The algorithms most widely used by U.S. law enforcement were among those with the largest demographic disparities.
The Williams case was not isolated. In 2019, Nijeer Parks of New Jersey was arrested for shoplifting and an alleged hit-and-run in Woodbridge, NJ. The sole evidence connecting him to the scene was a face recognition match. Parks spent 10 days in jail and paid $5,000 in legal fees before charges were dropped. He had been 30 miles away at the time of the incident, provable by hotel records. In 2021, Randal Reid of Georgia was arrested in Louisiana for thefts that occurred in a state he had never visited — again on the basis of a face recognition match that a human analyst had accepted without sufficient scrutiny.
Georgetown Law's Center on Privacy and Technology documented in a 2016 study that roughly 117 million American adults — nearly half the adult population — were enrolled in face recognition networks accessible to law enforcement, predominantly through DMV databases, without those individuals' knowledge or meaningful consent.
San Francisco (2019), Oakland, Boston, and Portland, Maine all passed bans on government use of face recognition. Illinois' Biometric Information Privacy Act (BIPA), passed in 2008, requires written consent before capturing biometric data including face prints — it has been the basis for major lawsuits against Facebook (settled for $650M in 2021) and other tech companies. The EU AI Act (2024) classifies real-time remote biometric identification in public spaces as high-risk, requiring specific authorization.
You'll examine the evidentiary and ethical questions raised by facial recognition in law enforcement. Think about what standards should govern when and how face recognition can be used as evidence, and what accountability mechanisms could prevent wrongful arrests.
In 2013, Edward Snowden revealed that the NSA's PRISM program collected metadata — call logs, email headers, browsing records — on hundreds of millions of people, most of whom had no connection to any investigation. Studies published afterward in peer-reviewed journals documented measurable drops in Wikipedia searches for terrorism-related topics, as users apparently self-censored their curiosity once mass surveillance became public knowledge. The effect occurred without any individual being targeted.
A chilling effect occurs when the awareness of possible surveillance or punishment causes people to modify their behavior — avoiding legal activities, associations, or speech out of concern that those activities might be misinterpreted or recorded. The key characteristic is that no direct action by the state is required: the possibility of observation is sufficient to alter conduct.
The legal concept originates in First Amendment jurisprudence, where laws that are vague or broad can deter protected speech even without being enforced. Courts have recognized chilling effects as genuine constitutional harms. Computer vision surveillance produces the same dynamic in physical space: if people know cameras can identify them, they may avoid protests, religious gatherings, or political meetings they fear might be associated with disfavored groups.
Jonathon Penney's study published in the Berkeley Technology Law Journal analyzed Wikipedia traffic before and after the Snowden revelations. Wikipedia articles related to terrorism-related topics — including "al-Qaeda," "jihad," "suicide attack," and "dirty bomb" — saw statistically significant drops in page views after June 2013 that persisted for months. The study found a 20% reduction in traffic to these articles, consistent with the hypothesis that users were self-censoring their information-seeking behavior.
When New York Police Department's Demographics Unit conducted surveillance of Muslim communities between 2002 and 2014 — mapping mosques, monitoring student groups, and placing informants in community organizations — the NYPD's own reports acknowledged that the program generated zero terrorist leads over its entire run. But a subsequent lawsuit brought by Muslim community members documented extensive impacts: people stopped attending mosques, changed their behavior at community events, and avoided discussing political or religious topics even in private settings. Some businesses reported customers stopped coming.
The ACLU documented similar effects in communities subject to gang database surveillance. In Chicago, the city's gang database listed approximately 134,000 people as of 2018 — nearly 32% of Black male Chicagoans over 16. Being in the database, even without charges or convictions, affected people's ability to get jobs, housing, and professional licenses. Community members reported changing their social networks and avoiding gatherings to reduce the chance of being associated with listed individuals.
During the 2020 George Floyd protests, law enforcement agencies across the United States used aerial surveillance, social media monitoring, and facial recognition to identify protesters. The Washington D.C. Metropolitan Police used facial recognition on protest photographs. U.S. Customs and Border Protection flew Predator B drones over Minneapolis. The Drug Enforcement Administration was authorized under an emergency declaration to conduct covert surveillance of protesters.
The documented effect on subsequent protest behavior: legal scholars and civil liberties organizations documented that awareness of pervasive surveillance reduced participation in subsequent protests, particularly among individuals in more vulnerable positions — undocumented immigrants, government employees, people on probation or parole — who faced asymmetric risk from being identified in protest footage.
Michel Foucault's analysis of Jeremy Bentham's panopticon prison — designed so that any prisoner might be watched at any moment but never knows when — argued that this uncertainty is itself the mechanism of control. Modern surveillance networks reproduce this dynamic at urban scale: you cannot know when your face is being matched, when your license plate is being logged, or when that data is being reviewed. The uncertainty becomes the instrument of behavioral modification, independent of whether surveillance is actually occurring at any given moment.
This lab focuses on the subtle but measurable ways surveillance changes behavior — often in ways that harm the very freedoms democratic societies are meant to protect. Think about what chilling effects mean for democracy, protest, religious practice, and political speech.
In May 2024, the European Union's AI Act became law — the world's first comprehensive legal framework specifically regulating artificial intelligence. It classified real-time remote biometric identification in public spaces as a prohibited AI practice, with narrow exceptions requiring prior judicial authorization. Any system that continuously identifies people by face in public — precisely what China's national surveillance grid does — is presumptively illegal in the EU under this framework.
No single governance approach has emerged globally. Instead, a spectrum of approaches reflects different political values, legal traditions, and threat environments. At one end sits China's social credit and surveillance infrastructure — a state-administered system in which face recognition, location tracking, financial behavior, and social associations feed into scores that affect access to transportation, education, and employment. The system represents the most comprehensive integration of computer vision and social control ever deployed.
At the other end of the spectrum, cities like San Francisco, Boston, and Portland, Maine have banned government use of face recognition entirely. These bans are typically city ordinances — they don't affect federal law enforcement or private sector use, and they can be reversed by future city councils.
Research on surveillance governance identifies several mechanisms with documented effectiveness. Use limitations — laws specifying what surveillance data can and cannot be used for — have reduced misuse when paired with enforcement. Data minimization requirements — deleting data that is not actively needed for an investigation — limit the scope of potential harm from breaches or misuse. Mandatory disclosure — requiring prosecutors to tell defendants when face recognition was used — enables legal challenge and prevents the technology from operating as a secret tool. Independent auditing — third-party review of face recognition system accuracy across demographic groups — can surface bias before deployment.
The most frequently cited gap in U.S. governance is the absence of federal legislation. The FTC has taken enforcement action against companies misusing biometric data, but no federal statute equivalent to BIPA exists. Multiple federal bills have been introduced since 2019 and none has passed as of 2024.
Clearview AI built a face recognition database of over 30 billion images scraped from Facebook, Instagram, LinkedIn, and millions of other public websites — without the consent of any of the people in those photographs. It sold search access to over 600 law enforcement agencies. A 2020 New York Times investigation made the company's existence public. Subsequent BIPA litigation, regulatory action by data protection authorities in Canada, Australia, the UK, France, and Italy, and a class action settlement represent the first significant accountability for a company that essentially built a privately operated global face recognition infrastructure from public images.
The most consistent finding across surveillance governance research is that the gap between technological capability and legal accountability is widening faster than regulation can close it. Face recognition systems are deployed commercially, upgraded, and adopted by new agencies in the months it takes a legislature to hold a single hearing. This asymmetry — where technology moves at the speed of a startup and governance moves at the speed of a legislature — is itself a governance problem that no individual regulation fully solves.
You'll act as a policy designer, working through the tradeoffs involved in regulating surveillance AI. You need to balance legitimate public safety goals against the harms of bias, chilling effects, and abuse of power. What would your city's surveillance policy look like?