Local South Korean Government’s Use of CCTV Footage Analysis via Facial Recognition to Track COVID Cases Raised Concerns about Privacy, Retention, and Potential Misuse

Bucheon government’s use of facial recognition in analyzing CCTV footage, despite gaining wide public support, was scrutinized by privacy advocates and some lawmakers for collecting data without consent, and retaining and misusing data beyond pandemic needs.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The AI system is designed to track the movements and contacts of individuals using facial recognition and CCTV cameras, directly compromising their privacy and tracking sensitive location data without explicit consent.

Additional risk subdomains

• 5.2 Loss of human agency and autonomy: The system overrides individual consent by tracking non-consenting individuals using silhouettes and clothing, removing their agency over being monitored.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The privacy risks and public tracking are caused by the intentional decision of human government officials to deploy the facial recognition system.

EU AI Act risk tier

• Risk tier: 2 High Risk

Risk Level 2: High Risk. The system utilizes facial recognition technology for public tracking and surveillance, which falls under high-risk categories such as law enforcement and biometric identification. The report notes it uses 'facial recognition technology to analyse footage gathered by more than 10,820 CCTV cameras and track an infected person's movements'.

AI system and alleged parties

• AI system: AI-powered facial recognition system
• AI purpose: Face Recognition; Smart Surveillance
• Behaviour type: Assistant
• Alleged developer: unknown
• Alleged deployer: Bucheon city government
• Alleged harmed parties: Bucheon citizens

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Substantial, indirect Substantial
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Substantial, indirect Substantial
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Civil rights

Reported: The report explicitly describes concerns from human rights advocates and lawmakers regarding the violation of civil liberties and the creation of a 'Big Brother' surveillance state.

Directly caused: The system violates the civil right to privacy and freedom of movement by tracking individuals' locations and contacts without their explicit consent.

Indirectly caused: The deployment of such technology without public consent undermines democratic oversight and establishes a precedent for invasive state surveillance.

Inferred additional harm: It is likely that the system will lead to broader civil rights violations if the tracked data is retained or repurposed beyond the scope of the pandemic.

Privacy

Reported: The report explicitly describes significant privacy concerns regarding the tracking of infected individuals and their close contacts using facial recognition and CCTV.

Directly caused: The system analyzes CCTV footage to track people's movements, close contacts, and mask-wearing status, directly harvesting personally identifiable location data.

Indirectly caused: The system bypasses consent by tracking individuals using silhouettes and clothing even if they refuse to consent to facial recognition.

Inferred additional harm: The collection and processing of movement data for over 800,000 residents creates a high risk of unauthorized data access, leaks, or long-term state surveillance.

People affected

• Occurrences reported: 1
• People reportedly exposed: 800000

Potential causes

Management

• Prioritizing Speed Over Privacy: City management prioritized fast tracking over individual privacy concerns.

Technology

• Silhouette Tracking Bypass: Tracks individuals via silhouette and clothes even if they refuse consent.
• Facial Recognition AI: Uses AI algorithms to analyze CCTV footage and track movements automatically.

Data Inputs

• Mass CCTV Footage Integration: Feeds data from over 10,820 city cameras directly into the tracking AI.
• Lack of Consent for Data Use: System processes non-consenting individuals' visual data via silhouettes.

Human Factors

• Untruthful Patient Testimony: Patients are not always honest about their activities and locations.
• Overworked Tracing Teams: Epidemiological investigators working 24-hour shifts created pressure.

Process and Methods

• Slow Manual Analysis: Manual CCTV analysis takes hours, driving the push for automated tracking.

Regulatory Environment

• Infectious Disease Act Loopholes: Legal framework allows invasive tracking, bypassing strict privacy consents.
• Lack of Public Consent: System deployed without public consent or explicit data retention limits.

Information quality

• Classification confidence: High
• Reason for confidence: The report provides clear, detailed information about the planned pilot project, including the specific technology used (facial recognition and CCTV), the budget (1.6 billion won and 500 million won), the location (Bucheon), and the specific concerns raised by critics. The roles of the AI system and human actors are explicitly defined.
• Ambiguities identified: The report does not specify the exact developer of the AI software, only that it is nationally funded and implemented by the city of Bucheon.
• Alternative interpretations: None. The facts of the deployment and the nature of the privacy concerns are straightforward and uncontested, though opinions on whether the privacy trade-off is justified differ.

The deployment of an AI-powered facial recognition and tracking system in Bucheon, South Korea, for COVID-19 contact tracing represents a substantial societal stability and human rights concern. While intended for public health, tracking citizens without consent via a massive CCTV network establishes a concerning precedent for state-level mass surveillance.

• Overall national security impact: Substantial
• Scope: Single nation
• Primary target: South Korea
• Alleged perpetrator: Bucheon City Government

Threat characteristics

• Imminence: Long-term. Represents an ongoing strategic concern regarding state surveillance capabilities and privacy norms rather than an active military or security crisis.
• Autonomy: Human-supervised. AI system autonomously tracks movements and facial data from CCTV, but human operators oversee and utilize the data for contact tracing.
• Novelty: Evolved capability. Significant advancement in integrating widespread CCTV networks with AI facial and silhouette tracking for public health enforcement.

Impact by dimension

• Physical security: Negligible. No physical threats, kinetic attacks, or critical infrastructure compromise reported in the incident.
• Information security: Minor. Involves domestic mass surveillance capability deployment, but lacks evidence of intelligence compromise or foreign information warfare.
• Sovereignty: Minor. Local government pilot program for public health; while criticized as 'neo-totalitarian', it does not disrupt core sovereign functions or involve foreign interference.
• Economic security: Negligible. No threats to financial systems, strategic technology theft, or economic stability indicated.
• Societal stability: Substantial. Deploys a mass surveillance system tracking citizens without explicit consent, representing a substantial impact on privacy and civil liberties.