{"resourceId":"aegis-police-facial-recognition-misuse-oversight-sweden-belgium-france-20261027","versions":[{"version":"external-081945427c915a7ea80f1aa87fba9287111de1281704a5bf707453d31af778b8","resource":{"id":"aegis-police-facial-recognition-misuse-oversight-sweden-belgium-france-20261027","title":"Independent comparative study finds European supervisors learned of police facial recognition misuse from the press in all four documented cases, and often could not reconstruct use or show corrections were made","organization":"AEGIS (independent research; author Tom Anciaux Berner)","sector":"Policing / facial recognition oversight","geography":"Sweden, Belgium and France","publishedAt":"Zenodo, AEGIS Research Paper 01, Expert Review Edition v1.0, 27 Oct. 2026","publicationDate":"2026-10-27","eventDate":null,"sourceName":"Zenodo (AEGIS Research Paper 01)","sourceLabel":"When the alarm comes from outside: Detecting, verifying and correcting police facial-recognition misuse in Sweden, Belgium and France","sourceUrl":"https://zenodo.org/records/23696453/files/aegis-rp01-police-facial-recognition-v1.0.pdf","evidenceClass":"independent-research","outcomeClass":"cautionary","topics":["governance-procurement","data-security","operating-model"],"finding":"This source-based pilot, released for expert review on Oct. 27, 2026, examines four documented police facial recognition uses: Swedish and Belgian police use of Clearview AI, the Brussels Airport system, and BriefCam’s face function in France. In all four, supervisory action followed a public report, three times press coverage. Belgium’s supervisor relied on Clearview’s own figure of 78 searches, which it could not verify, and found no police logs; an earlier police answer denying use was later contradicted. At Brussels Airport, equipment bought in early 2017 was unknown to the supervisor until a 2019 interview. In France, connection logs were deleted after 365 days, so inspectors relied on declarations. Sweden’s SEK 2.5 million penalty was annulled on appeal. The author says the evidence does not show supervision is ineffective: once informed, supervisors acted, and Belgium halted a deployment.","sledRelevance":"Directly relevant to U.S. oversight design: it separates whether a control exists, whether it worked and whether that can be demonstrated, and shows how vendor-held logs and short retention defeat audits.","evidence":"Downloaded and read the full PDF from Zenodo, including methodology, the four case sections and stated limitations. Primary regulator decisions cited in the paper were not opened.","architectureImplications":"Audit reconstruction depended on log retention and on whether usage records were held by the police or the vendor.","governanceImplications":"Supervisors depended on information supplied by the supervised agency or vendor; proof that corrective orders were carried out was often absent from the public record.","securityPrivacyImplications":"Uploading police photos to an external commercial service was found to be a data breach in Belgium; deletion could not be confirmed publicly.","caveats":"Preprint, not peer reviewed (expert review edition; open items listed by the author). Four publicly documented European cases, not a representative sample; events 2017-2024 under EU-era law; transferability to U.S. agencies is limited by different legal frameworks.","streamIds":["public-safety"],"roles":{"sales":"Sales framing: this study gives oversight bodies language for a hard question: can you prove your controls work, not just that they exist? The buyer problem for inspectors general and civilian oversight boards is independent evidence of use. A bounded engagement could assess whether an agency’s facial recognition and analytics logs would let an outside reviewer reconstruct a year of use. The evidence cannot support claims that European or U.S. supervision is failing overall.","engineering":"Engineering framing: the failures are about logs. Belgium relied on vendor-supplied search counts; France lost history when logs expired after 365 days. Pre-sales should check where usage logs live, who controls them, how long they are kept and whether an auditor can read them directly. A proof of value would reconstruct three months of searches from agency-held logs without vendor help. Constraint: retention rules differ by state and contract.","delivery":"Delivery framing: the work is to make oversight demonstrable: agency-held logs, retention matched to audit cycles, a register of tools including trials and vendor-added features, and recorded proof that corrective orders were completed. The owner is the agency’s compliance or professional standards unit, answerable to the oversight body. Acceptance criteria are proposals: complete tool register, auditor read access, and closure evidence for every finding. Main risk: unsanctioned trial tools that never enter the register."},"roleDetails":{"sales":{"customerProblem":"Oversight bodies cannot independently show how police facial recognition was used or that corrections were made.","stakeholders":["Inspector general or civilian oversight board","Police compliance unit","City or county attorney","Records and IT security"],"discoveryQuestions":["Where are search logs held and for how long?","Could an auditor reconstruct use without vendor input?","How are free trials and vendor-added features detected?"],"valueHypothesis":"An auditability assessment could show oversight bodies where evidence would be missing before a controversy arises.","potentialEngagement":"Facial recognition and analytics auditability review for one agency.","unsupportedClaims":["That supervision is ineffective in general","Prevalence of unlawful use","U.S. legal conclusions from EU cases"]},"engineering":{"fit":"Relevant to agencies using face search or video analytics, and to their overseers.","architectureIntegration":"Usage logs across vendor platforms and agency systems; retention and access controls determine audit reach.","prerequisites":["Inventory of tools and features","Agency-held usage logs","Retention schedule aligned to audits"],"constraints":["State retention laws vary","Vendor contracts may hold logs","Study is European and pre-AI Act"],"security":"Ensure logs are tamper-evident and readable by auditors without vendor mediation.","proofOfValue":["Reconstruct three months of use from agency-held logs and compare with vendor counts."]},"delivery":{"work":"Build a tool register, align log retention, give auditors access, track corrective actions to closure.","dependencies":["Vendor cooperation on log export","Oversight body mandate","IT security support"],"ownership":"Agency compliance or professional standards unit","skillsAdoption":"Train supervisors to recognise and report unsanctioned tool use.","governanceCheckpoints":["Annual tool register review","Auditor access test","Closure evidence for findings"],"acceptanceCriteria":["100% of AI tools and trials registered","Logs retained at least one audit cycle","Every corrective order closed with evidence"],"risks":["Shadow trials outside the register","Vendor-held logs unavailable","Retention shorter than audit cycle"]}},"retrievedAt":"2026-11-01T02:55:51Z","enrichedAt":"2026-11-01T03:01:09Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Individual officers used trial tools outside sanctioned channels, which organisational controls did not catch.","procurementImplications":"Free trial licences and vendor-added features (BriefCam’s face function) entered operations without procurement review.","operatingModelImplications":"Oversight bodies need independent log access and verification of corrective actions, not only legal powers.","peerReview":"preprint","sourceVerification":{"openedUrl":"https://zenodo.org/records/23696453/files/aegis-rp01-police-facial-recognition-v1.0.pdf","referenceExcerpt":"In all four cases, the documented supervisory action followed a public report.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}