In November 2020, reporters at Netzpolitik.org revealed that the city of Karlsruhe wanted to establish a smart video surveillance system in the city centre. The plan involved an AI system that would analyse the behaviour of passers-by and automatically identify conspicuous behaviour. The biometric mass surveillance system was presented by authorities as “data protection compliant video surveillance”. After the intervention of EDRi-member CCC (Chaos Computer Club’s chapter Karlsruhe, also known as Entropia) the project was buried in May 2021. Such a success adds to previous wins by EDRi members involved in the ReclaimYourFace campaign that calls for the EU to ban biometric mass surveillance across all EU countries.

Through media reports, publics found out that the city’s project of invasive public CCTV surveillance would happen with the help of  a private company.The system, with the name SAVAS DS+ ( Savaş means “war” in Turkish) would allow the company to evaluate people’s behaviour  and call the police if necessary. There has been little transparency on the part of the company and authorities involved. Thus, the CCC tried to gather more information   and sent four freedom of information requests . (1, 2, 3, 4). Also, a transcript from the city council was found. Some useful information could be obtained:

1. There was no contract yet, so no documents were available, including no planning documents.
2. Some news articles read as if there had been an audit by a data protection authority. However, the system has not been reviewed.
3. The company involved in this project assumed that allowing for data to be captured at 16mm/pixel does not result in collecting “personal data”.

These revelations led the CCC to send a statement to the Karlsruhe city council on the day before the vote that decided whether this system should be allowed happened. Through this letter, CCC made several arguments against the adoption of this project.

Although little information was available, the CCC was able tho show that false promises were made: First, the general specification of 16mm/pixel does not allow any assumptions about anonymisation. Especially people who are closer to the camera than expected would remain identifiable. Second, another important argument CCC made was that the response to a FOIA request indicated that there was no actual audit by the data protection authority. – a requirement for such a project. Furthermore, the transfer of sovereign tasks to private companies is very problematic and must be rejected. Finally, social problems are not solved by surveillance cameras but outreach work and education.

In conclusion, the case demonstrates the importance of transparency. Without the responses to the FOIA requests, it would have been harder to argue against a project presented by city officials and the company involved as  supposedly “privacy-preserving system”. Surveillance cameras in public spaces remain surveillance cameras in public spaces, no matter what happens behind the sensors. Supposedly intelligent and networked surveillance involving AI only make things worse.

The CCC appreciates that, for now, the surveillance project was rejected. However, the club also notes that the project was rejected only by a voting patt in the city council. We must remain vigilent against such new cases of biometric mass surveillance and continue to apply pressure on city officials, as well on the EU to ban these practices.

(Contribution by: Matthias Marx, EDRi member, Chaos Computer Club)