The Danger of 'Good Faith' Surveillance

In the world of cybersecurity, 'move fast and break things' is a recipe for disaster—especially when the state is the one breaking things. The recent reprimand of London's Metropolitan Police Service (MPS) by the Information Commissioner's Office (ICO) is a textbook case of why unchecked biometric and PII aggregation is a threat to civil liberties.

As first reported by The Register, MPS officers spent over 18 months using Auror, a retail crime platform, without formal procurement or data protection checks. Between March 2023 and September 2024, officers created roughly 500 free accounts. The ICO determined that officers had unlawfully uploaded the personal details of 179 individuals, three of whom were children. While some entries were limited to names, others included dates of birth and home addresses.

Opinion: This isn't just a clerical error; it's a failure of governance. The MPS relied on 'soft controls'—training and policy reminders—rather than technical blocks. The fact that officers operated this platform for over a year without triggering a single alert proves that the force's web controls were effectively nonexistent.

This is a pattern, not an anomaly. The ICO noted a repeat failure, citing the MPS's unauthorized use of Clearview AI in 2021. Despite the ICO's enforcement notice, the MPS told The Register that it has since approved the platform for use in 14 London boroughs, claiming the tech has quadrupled positive outcomes for shoplifting and is deployed in stores like Tesco, Boots, Greggs, and M&S.

When law enforcement prioritizes 'positive outcomes' over the legal requirement for data protection impact assessments (DPIAs), they create a surveillance vacuum. As David Doodson, head of investigations at the ICO, stated, technology must be used lawfully and transparently from the outset. Until the state implements hard technical barriers, our PII remains a plaything for officers acting in 'good faith' without oversight.