Big Brother in Serbia: Both schools and kindergartens are filmed with facial recognition cameras

Video surveillance with facial recognition options has been procured for at least 28 primary and seven secondary schools across the country, as well as for one preschool in Belgrade, a new report shows. BIRN research.

"The institution has completed the Risk Assessment Act and the necessary documentation and approvals for the introduction of video surveillance and physical and technical security. The video surveillance system with facial recognition features has been in use in our institution since 03.01.2024/29.12.2023/XNUMX, the works were completed on XNUMX/XNUMX/XNUMX," writes the response of the Elementary School Rastko Petrović - Sveti Sava from Nova Pazova to BIRN.

In addition to schools and kindergartens, video surveillance systems with facial recognition capabilities were also procured for student dormitories, but also for numerous public places, institutions and roads in 12 cities and municipalities across Serbia.

Most of this equipment was purchased in Belgrade - among other things for the National Library of Serbia, markets, several parks and the Belgrade transport system, writes BIRN.

BIRN has mapped the purchasers of equipment containing facial recognition technology, as well as a number of locations where it is stated that this equipment will be used. The map of intrusive technologies will now be available on BIRN's website and social media and will be periodically updated with new findings.

The map shows the address of the customer or the exact locations where the equipment is installed, if they are listed in the publicly available documentation on public procurement. BIRN mapped procurements in which it is decisively required in the procurement itself that the equipment has the ability to "recognize faces" and procurements where equipment that, according to the specifications, has this capability is requested.

The collection and processing of biometric data, which are collected by facial recognition technologies, is prohibited in Serbia, except in exceptional cases, in which case an assessment of the impact on the protection of personal data is mandatory.

BIRN contacted all the mapped institutions, local governments and public companies that procured equipment that enables facial recognition. Of the 32, BIRN's questions were answered by six before the publication of the text. Most of them - the City of Kruševac, the municipalities of Lučani and Palilula, the City Center for Social Work Belgrade and Elektrodistribucija Srbije (at the time of the acquisition of EPS Distribucija) - stated that they did not have face recognition systems. PUC Public lightingBelgrade says in a written response that it does not use this possibility.

Due to the scant responses, it is not known whether impact assessments have been made, as well as whether cameras have actually been installed and whether contractors are using facial recognition.

Recognition of children's faces and protection of children's privacy

Facial recognition equipment intended for schools, kindergartens and other educational institutions has been purchased in several cities across Serbia - Belgrade, Nova Pazova, Paraćin, Požega and Stara Pazova, from 2015 until today.

Paraćin stated in the competition documentation that he is also requesting the creation of an assessment of the impact on the protection of personal data, writes BIRN.

Maximus Global Technology, which procured equipment for the Vuk Karadžić School of Economics and Business in Stara Pazova and the Elementary School Rastko Petrović - Saint Sava from Nova Pazova, appears as a supplier of video surveillance in elementary schools in Stara Pazova and Stari Banovci, but the abbreviated specifications do not specify precisely which models are being procured.

By searching publicly available tender documents for public procurement, BIRN discovered that this equipment is mostly ordered by municipalities, and not by the schools themselves.

Milan Marinović, Commissioner for Information of Public Importance and Protection of Personal Data, says that the position of the Commissioner on the use of facial recognition technology is very restrictive and that the use of biometric data is necessary and necessary only in cases where it is necessary for a certain institution to perform its work , which, he adds, depends on what activity he is engaged in.

"The introduction of facial recognition technology in any other case would be excessive and pointless and represent an unnecessary invasion of individual privacy." In this sense, the introduction of facial recognition technology anywhere, including in schools, requires the deepest analysis and grounding in the law, especially bearing in mind that we are dealing with minors.

"The area of ​​qualified video surveillance must be clearly and unambiguously regulated, which can be achieved exclusively through legal regulations, but also raising the general awareness of citizens, for example through a special law on video surveillance," says the Commissioner.

He adds that children and minors are the most sensitive category when it comes to the right to privacy and that they must enjoy its highest degree.

Marinović also explains that video surveillance in schools, as a part of physical and technical security, is regulated primarily by the Law on Private Security (ZPO) and the Rulebook on the manner of performing technical security tasks and the use of technical means, the implementation of which is supervised by the MUP, not the Commissioner. .

It is questionable what biometric surveillance is used for in schools

Goran Mandić, associate professor at the Faculty of Security in Belgrade, says that the question is whether schools, preschools and other educational institutions use facial recognition technology, because its use would require the creation of a database of school students' photos.

BIRN's research has shown that some software that appears in the procurement of intrusive video surveillance has the possibility of forming an internal database of facial photographs by detecting all human faces that appear in the video frame, photographing them and storing them in the form of photographs in separate databases of facial photographs.

"The question of expediency arises. What will that software do for me?" says Mandić and adds that it is an open question whether the ordered software was actually delivered, as well as whether it was put into use, who needed it and for what purposes.

Rodoljub Šabić, a lawyer and former Commissioner for Information of Public Importance and Protection of Personal Data, says that the question arises why the acquisition of advanced software that, among other things, also has these options.

"Of course, it cannot be justified that equipment is procured but not used... From the point of view of the legal and purposeful use of budget funds, it is completely irrational for someone to acquire technology that they will not use."

"Furthermore, the one who acquires technology that he not only will not, but must not use and whose use is not only a certain violation of the Personal Data Protection Act, but also causes reasonable suspicion of the commission of the criminal offense of unauthorized processing of personal data (Art. .146 of the CC), he would have to bear responsibility for that", says Šabić for BIRN.

Video surveillance in schools and kindergartens: Between security and privacy

Goran Mandić believes that video surveillance in schools makes sense, because it enables a quick reaction, if necessary, as well as that newer software for video surveillance allows blurring of faces to protect privacy.

"Video monitoring plays a role during breaks and when students come to school and has the function of being able to react immediately. Identification and recognition is most important for video surveillance in schools, e.g. I'm looking for a face or a child dressed in a red shirt who has caused some trouble and I'm now going to the recognition camera and looking for a person with those characteristics. […] It is important that no one records in the toilet and in places where it is inappropriate, and everything else is irrelevant. What, the privacy of students is violated, if someone is filming them in the school corridor? How?” he asks.

Mandić, however, adds that it is questionable whether schools effectively use the systems they have.

"A video security system, if not covered by other measures, does not protect anything." That's the illusion everyone is trying to push. I can set up a flawless video security system, but if you don't know what's being watched, what's the point of the system?

"Video surveillance footage can only be monitored by a licensed security officer, and in schools it is often handed over to the principal, pedagogue, psychologist... In retail stores, if you know the methodology of petty theft, then you know what to watch and how to react." In our country, there is not enough education of security officers on what to look for on video surveillance," he says.

In addition to the schools attended by minors, BIRN also mapped the procurement of intrusive equipment for student dormitories in Novi Sad.

Novi Sad Student Center acquired access control terminals in 2021. The specifications call for a recognition accuracy of more than 99 percent and a storage capacity of 10.000 people, and student dormitories are listed as the delivery locations.

"These are high-risk treatments. These are public institutions. No one told the students that their data would be used in that way. […] When we talk about any human right, the question arises whether there is a less intrusive measure to achieve a certain goal. And what do the security guards do, what do the security guards who are paid to control and monitor do," says Nevena Ružić, an expert in data security.

Face recognition and surveillance of institutions and public areas

Traffic points in numerous cities in Serbia are covered by video surveillance with facial recognition capabilities, according to documentation obtained by BIRN through a search of the public procurement portal.

PUC Public lighting Last year, in the procurement of video surveillance for "decorative" objects, Belgrade also bought a Dahua video recorder with the option of face detection and recognition. The publicly available documentation does not specify precisely at which locations this surveillance was installed.

This company told BIRN that "the acquired video surveillance is not used for facial recognition, but is only used to monitor the operation of decorative lighting."

In Belgrade, the option for facial recognition is available in the park surveillance systems in the municipality of Čukarica, Kalemegdan, the promenade near Beton Hall, Knez Mihailova, the plateau in front of the Faculty of Philosophy, Trg Republike and Zeleni venac.

The National Library of Serbia is one of the customers of Hikvision cameras and recorders for video surveillance of the user part of the building with the functions of thermal imaging, "recording" and "comparison" of a human face, and alarming.

Almost all Belgrade markets are connected to the integration software with this option and options for counting people, determining gender and age, and the markets in Novi Sad are also under surveillance with facial recognition options, which the media have already written about.

Market administration Market AD, which manages a flea market, car and livestock market in Subotica, has acquired nine cameras with the option of facial recognition.

Rodoljub Šabić says that the intrusiveness of biometric video surveillance is indisputable in all cases, but that the indiscriminate application of this technology in open spaces is certainly the most dangerous.

"In our normative system, there is no valid legal basis for the application of biometric, so-called intelligent video surveillance [...] which makes the application generally, in all cases, very problematic, ultimately illegal," says Šabić.

Nursing homes have not been immune to emerging surveillance technology. In 2015, the Belgrade Gerontology Center acquired a license for facial recognition - supervision of elderly and demented persons. In the competition documentation, it is written that "the software must have the function of recognizing demented persons who want to leave the facility and alert security" with the additional "possibility of entering images (photographs) of demented persons".

Milan Marinović, commissioner for personal data protection, says that the option of facial recognition is not legally regulated in Serbia and that the physical and technical security of the institution cannot be introduced arbitrarily.

"The video surveillance system must be used exclusively for the purposes prescribed by the Law on Private Security and it cannot be used to monitor more than what is necessary to fulfill a specific purpose, while at all times it must be taken into account what is recorded, where the recordings are stored, who has access to the recordings and to whom the recordings are eventually disclosed, i.e. delivered," says Marinović.

The Commissioner explains that a project and a plan for the technical protection system of facilities must be prepared, as well as training on handling technical protection equipment, along with "a whole series of other conditions", and adds that it is within the competence of the Ministry of Interior to issue licenses and control monitoring centers where review video surveillance footage.

Face recognition in public companies and institutions

In addition to public institutions, equipment that enables facial recognition was also acquired by numerous public companies, such as Belgrade's GSP, Agencies for local economic development from Leskovac, Tax Administration, Directorate of Civil Aviation and PUK Belgrade Waterworks and Sewerage.

Certain customers - such as the Agency for Restitution and the municipalities of Ruma and Novi Kneževac ordered equipment that has the possibility to upgrade facial recognition modules or licenses.

Traffic cameras with intrusive capabilities

Certain cities and municipalities, such as Kruševac, Paraćin, Bor and Leskovac, ordered intrusive technology for traffic control.

In the case of Leskovac, Bor and Kruševac, it is explicitly stated that the monitoring centers are located with the police.

In 2016, the Leskovac Economic Development Agency ordered software for video management that "performs face detection and comparison with the identification of a person from a pre-prepared database."

In 2022, Bor acquired at least 21 Dahua cameras connected to a network recorder with intrusive analytics. The procurement notes state: "The video surveillance system is public, the user is exclusively the Ministry of Interior of Serbia and it does not fall under the Law on Physical and Technical Security".

In 2022, the city of Kruševac acquired two cameras with the ability to recognize faces for traffic control.

The Ministry of Internal Affairs of Serbia (MUP) bought and installed cameras with facial recognition in Belgrade in 2019 from the Chinese company Huawei.

The MUP planned to install thousands of surveillance cameras throughout Serbia as part of the "Safe Society" project. This ministry denied that it uses facial recognition.

The Ministry of Internal Affairs of Serbia already owns the software of the Swedish company Griffeye, which has the option of facial recognition, as BIRN has already published in the text The Police of Serbia has acquired software with the option of facial recognition.

Radio Free Europe announced last year that 40 cities and municipalities in Serbia have acquired Dahua cameras, which have the ability to recognize faces.

After the publication of the research, the Office of the Commissioner for the Protection of Personal Data told Free Europe that they will not initiate surveillance in cases of acquisition of facial recognition cameras until there is valid evidence that this technology is being used.