iiinova — where your digital self keeps evolving

Full investigation: @infolibre.es in Spain, Búsqueda in Uruguay, with @investigate-europe.eu and the @pulitzercenter.org's AI Accountability Network. Reporting in collaboration with Ignacio Carrascón, Guillermo Draper and Juan Francisco Pittaluga. Links below (11/x)

131

FIFA, which imposes human rights requirements on World Cup hosts, didn't answer whether the system will be switched on during the tournament. (10/x)

Herta says it only supplies the software, neither operating the systems nor "defining the watchlists", that it builds to European data protection principles, and that it doesn't use EU-funded projects to get around European legal or ethical standards. (9/x)

The EU restricts this technology at home. Its export isn't regulated at all. Since 2020 Herta has received more than €3.3m in EU research funding for work including crowd behaviour analysis and facial recognition. (8/x)

132

And the surveillance hasn't ended the violence. Researchers called 2025 a year marked by violence in Uruguayan sport. That July a police officer was seriously injured by a flare thrown from the stands of the Centenario. (7/x)

Uruguayan law has required an impact assessment for biometric data since 2020. The stadium cameras never had one. In 2017 a Peñarol fan was wrongly flagged at the Centenario; he says guards and police beat him before the mistake was sorted out. (6/x)

Football opened the door to the region, but the reach goes further. Police in Medellín linked the software to 80 street cameras to match passers-by against a list of 19,000 wanted people. In Peru, Alianza Lima scans fans at its stadium. (5/x)

122

Its software has run at the Centenario since 2017. 41 cameras, roughly 25 faces per second, checked against a watchlist held by the interior ministry, police, the football association and the clubs. It later spread to Uruguay's two other big grounds. (4/x)

The maker: Herta Security, founded in Barcelona in 2009, fewer than 20 employees on the books. Its flagship product promises live searches against databases of up to 100 million faces and keeps working if you're wearing a scarf, a cap or a mask. (3/x)

Spain's data protection authority has blocked biometric checks in Spanish stadiums again and again. In Dec 2024 it fined LaLiga €1m for making fans hand over a fingerprint or a face scan to get in. Osasuna was fined €200,000 the same year. (2/x)

New investigation: In June 2030 the World Cup opens at Uruguay's Estadio Centenario. Fans passing the turnstiles will have their faces scanned against a watchlist - by software written in Barcelona, in a country where regulators have shut that practice down. (1/x)

The football stadium Centenario in Montevideo as seen from space

3159

This investigation was supported by the @pulitzercenter.org's AI Accountability Network, and made possible by the outstanding collaboration with Mayank Aggarwal and Ignacio Carrason. Thank you! (8/8)

110

When I reached out to Herta, the company responded saying its products are developed in line with European data-protection principles, but that it cannot control how authorities deploy them. (6/x)

The EU itself supported the company with millions in research funding, for technology to identify suspects in crowds. Soon after the project ended, the EU largely banned that very use case at home. (5/x)

Part of the rollout is financed by a fund created to protect women after the 2012 Delhi gang rape. Women's rights groups say the money has gone largely into surveillance rather than into protecting and supporting women. (4/x)

The result, out today: a new @investigate-europe.eu investigation into Barcelona-based Herta Security. Its technology runs facial recognition at hundreds of railway stations, in Delhi's prisons and even at temples across India. (3/x)

When the AI Act introduced its prohibitions, I began to wonder: would European developers simply take their technology elsewhere? For months, I combed through tender databases and company documents and spoke to experts and industry insiders. (2/x)