Like ‘being in prison’: Will EU’s AI safeguards apply to asylum seekers?

Pythagoras and the philosopher Epicurus both hailed from Samos, but this island in the eastern Aegean now has a less enviable claim to fame - as the host of a refugee camp equipped with some of the most sophisticated security and surveillance technology in Europe.

As its name suggests, the Closed Controlled Access Centre, or CCAC, is a closed camp for asylum seekers in a mountainous area some eight kilometres from the Greek island’s main town, Vathy. With capacity for roughly 3,000 people, it was inaugurated in 2021 as a ‘showpiece’ example of state-of-the-art security.

Cameras monitor residents 24 hours a day, and the entrance is fitted with a biometric identification system that uses artificial intelligence, AI.

The future of such security systems, however, has been thrown into doubt under legislation put forward by the European Union on December 8 last year after two and a half years of intense negotiations.

The landmark bill could be the first in the world to regulate the use of AI, laying down ethical standards and human rights principles that should govern how the technology is wielded.

But there are doubts as to whether it will apply to facilities built to house migrants and refugees reaching Europe’s borders.

Turnstiles, magnetic gates, x-rays, ID, and fingerprints

A 24-year-old Congolese man, Marcel [not his real name] left his country for greater freedom. “I thought I was going to a country where things were different. But when I arrived in the European Union, I realised I was still trapped and restricted,” he told BIRN.

He and his compatriots Emmanouel and François [not their real name] spent months in the Samos camp. Marcel compared the surveillance they experienced to “being in prison”.

“To enter the camp, you have to pass the turnstiles first,” he said. “Then, you show your card to a security guard who registers you. Then there’s a sort of customs office. If you wear a belt or have a bag, food or anything, you have to go through the machine, and they check your stuff if there is anything suspicious. Then you have to give them your fingerprints. The process is the same when leaving the camp.”

“Despite the presence of the police and the surveillance cameras, I didn’t feel safe when a fight broke out,” Emmanouel, 30, told BIRN. “For all the controls, many people were still bringing prohibited objects, knives, blades and drugs, such as Tramadol, into the camp.”

In June last year, 19-year-old François was returning to the asylum centre listening to music on his mobile when he reached the door and began the routine of passing security.

“I left the phone with the music on in a small basket. Then I put my hands in my pockets to take out everything else, like some coins,” François told BIRN.

“All of a sudden, a policeman began to talk to me. I couldn’t understand him, but I think he was asking me to stop the music. So I told him to wait just a moment before I took out everything from my pockets. But he got angry and started shouting at me.”

Two compatriots – Marcel and Emmanouel – came to François’ aid, but to no avail; all three ended up in the local police station accused of disobedience and physical violence against employees. They deny the charges.

“I never cared about the cameras,” François told BIRN. “Only after the incident did I realise they could be used.”

Lawyers for the men, Dimitris Choulis and Ionana Begiazi, also have suspicions about the surveillance.

“After numerous incidents of criminalisation and violence against camp residents, we have requested video footage,” they told BIRN in writing.

“However, we have either not received a response, received a negative one (e.g. ‘the camera was not covering the spot’), or had our request rejected by a prosecutor. It is unclear whether the technological systems are inefficient and failing to protect refugees, or if there is a cover-up.”

Hyperion and Centaurus

The surveillance cameras at the Samos camp are far from the run-of-the-mill cameras found in public places across the EU, but instead are part of the Hyperion and Centaurus systems introduced by the Greek migration ministry.

Hyperion manages entry and exit at the camp. It scans asylum seekers’ ID cards for biographic data, including full name, date, country of birth, and nationality, as well as their fingerprints. It is designed to store information about the services provided, such as food and clothing, and their transfers between camps.

Centaurus is a high-tech security management system for camps that automatically identifies security violations and notifies authorities. The devices monitor the camp’s internal and surrounding areas and are connected to a centralised control room in the ministry’s headquarters in Athens.

Critics say the use of such systems may adversely affect an asylum seeker’s rights to non-discrimination if it leads to biased decisions on asylum applications.

Their right to protect their personal data already appears to be severely compromised since no Data Protection Impact Assessment was conducted on either system despite a requirement to do so under the EU’s General Data Protection Regulation, GDPR.

Will the AI Act change asylum seekers’ lives?

The EU’s AI Act is expected to regulate, among other things, the use of biometrics for identification, recognition and categorisation [e.g. fingerprints] and predictive systems for decision-making [e.g. lie detectors]. 

Rights organisations, including Homo Digitalis, Algorithm Watch, and I Have Rights, have warned that the use of these systems, particularly in the context of migration or law enforcement – which often overlap in Greece – could unfairly target already marginalised communities and undermine their legal rights.

The AI Act classifies such systems into three categories based on their potential to violate fundamental rights.

First, applications and systems that pose an unacceptable risk, such as the government-run social scoring used in China, are banned. Second, high-risk systems, such as a CV-scanning tool used in order to rank job applicants, must meet certain requirements for its use to be permitted. Finally, applications not explicitly banned or listed as high-risk are largely unregulated.

The AI systems used in the context of migration policy may fall into the last category, as they are not categorised as high-risk in the draft texts of the AI Act published so far.

Although the texts acknowledge that certain border technologies may be classified as high-risk, it remains unclear which border tech projects will ultimately fall under this category and be subject to transparency obligations, human rights impact assessments, and increased scrutiny.

For now, the latest published text of the AI Act does not provide adequate safeguards for border technologies since major loopholes have made it into the current text, such as the fact that AI developers themselves have a say in whether their systems count as high-risk.

In late 2023, during negotiations on the AI Act, European parliamentarians agreed to prohibit using emotion recognition in education, the workplace, law enforcement and migration. However, pressure from member states – the European Council – saw the exemption for law enforcement and migration struck from the final text.

It remains unclear whether AI systems used in border security and biometric identification come under the ‘high-risk’ category. Still, the Greek government told BIRN that adopting the AI Act “does not affect the operation of the Centaurus and Hyperion systems”.

“These systems do not pose a clear threat to the fundamental rights of individuals. There is no capacity for manipulating human behaviour, nor for ‘social scoring’, preventive policing, emotion recognition”.

Yet according to previous statements by the Greek Ministry of Immigration and Asylum, the Centaurus system does involve ‘Artificial Intelligence Behavioural Analytics’.

Then there is the question of transparency.

“High-risk AI systems deployed by public authorities or entities acting on their behalf will have to be registered in a public EU database unless those systems are used for law enforcement and migration,” the European Commission said in a Q&A published in December last year. “The latter will have to be registered in a non-public part of the database that will be only accessible to relevant supervisory authorities”.

Some practices will be banned, “such as cognitive behavioural manipulation, the untargeted scraping of facial images from the internet or CCTV footage, emotion recognition in the workplace and educational institutions, social scoring, biometric categorisation to infer sensitive data, such as sexual orientation or religious beliefs, and some cases of predictive policing for individuals”.

According to NGOs, more loopholes exist beyond allowing AI developers to determine risk status. There are exemptions and derogations to the law, such as for matters of national security, which may include technologies used in migration and border control.

‘For reasons of national security’

Greece’s practices in tackling migration have raised concerns before.

In January 2022, the Greek Coast Guard issued an open tender for the upgrade of its IT infrastructure, including the purchase of software to monitor social networking sites such as Facebook, Instagram, X [Twitter], VK and messaging services such as Telegram.

Lefteris Helioudakis, a lawyer and member of the digital rights NGO Homo Digitalis, said it is a typical example of exclusionary treatment of people on the move.

The Coast Guard justified the purchase by the need to anticipate migration flows.

“Beyond that, the system would aim at profiling, to collect personal information in all the profiles, such as occupation, academic background, name and even public photos on a public profile,” Helioudakis told BIRN. “That would be very invasive.”

Member states, Greece in particular, are often permitted to circumvent EU law “for national security reasons”, he said.

In such states, migration is often treated as a matter of national security.

The AI Act currently leaves a gap on the issue of technologies to predict trends and conditions of migration flows.

Frontex’s desire for predictive tools and situational analysis technologies is also evident in its AI strategy, published on 9 November 2023.

However, if used without appropriate safeguards, these tools can potentially enable illegal border interdiction operations, including ‘pushbacks’, for which the Greek Coastguard and Frontex have been accused of.

Asked what would change for asylum seekers under the AI law, the Greek Ministry of Immigration and Asylum told BIRN: “The new regulation will not apply to areas outside the scope of EU law, such as the use of systems used exclusively for military or defence purposes, exclusively for research and innovation purposes, or to individuals using AI for non-professional purposes.”

Nikolett Aszodi, policy and advocacy manager at the Switzerland-based human rights organisation Algorithm Watch, told BIRN: “There are several exemptions in the AI Act that explicitly state when it does not apply and to what kind of matters.”  

“The member states and the European Council have added defence and national security to the scope. We know it is very easy to abuse the rationale of national security.”

‘Just grateful to be here’

The Samos camp is effectively a panopticon, a prison where people can always be seen from the centre. Control systems include turnstiles, magnetic gates, x-rays, and two-factor access [ID and fingerprint] that residents and workers must pass through to enter and exit the facility. Even children staying in the camp are subject to these measures.

Sources told BIRN that there are workers in the Samos camp who, having complained, are not required to give fingerprints to enter and exit the facility but only allow their personal belongings to be checked. They have also sought assurances regarding the protection of their personal data.

Instead of carrying out a Data Protection Impact Assessment, DPIA, to identify and minimise the risks to them, the Greek Ministry of Migration and Asylum excluded them from the process because of their objections.

Ella Dodd, advocacy and strategy coordinator of the NGO ‘I Have Rights’ in Samos, said NGO access to Samos is not easy and that she had managed to enter only twice.

Those inside complain about general conditions but not so much about privacy rights.

“People are unwilling to complain even when authorities take their phones and force them to hand over their passcode to have complete access,” Dodd told BIRN, echoing a claim made by other laws working on the island but which BIRN has been unable to independently corroborate.

People are afraid, she said, having already been subjected to pushbacks, unlawful detention or other inhumane or degrading treatment. They also fear harming their chances of obtaining asylum.

“They already feel so unwelcome and an unwanted burden that they feel they can only be grateful,” Dodd said. “People very often say, ‘No, I’m just grateful to be here. I don’t want to complain.’”

“The third reason is that they have more serious problems than having their phone scraped, or being fingerprinted or surveyed.”

The most important thing for François is that he made it to Greece.

“When I was in Turkey, I prayed to come here,” he said. “I don’t know what will happen to me, I’m alone here. But at the end of the day, I feel good here. Of all the countries, Greece is the one that recognised me and gave me legal documents. I see no reason to go and live in another country.”

 

This article was first published on 23 February 2024 on Balkan Insight.

It has been produced with the financial support of the Heinrich-Böll-Stiftung Thessaloniki.

Its content is the sole responsibility of the author and does not represent the Foundation’s views and opinions.