At dusk, a station fills with journeys that have little in common. Someone is returning from work, a teenager is waiting for her sister, an older man is trying to find the right platform, and a person staying in a shelter is hoping not to miss the last train. After several thefts near the entrances, the city proposes to measure safety by collecting mobile-device identifiers around the station. The presentation promises crowd maps, “suspicious” routes, and faster intervention. The proposal can sound careful because it starts from a real concern. Yet a legitimate concern does not make it necessary to follow the signal of everyone moving through a public place.
The important question is not whether a city should care for its stations. It should. The question is what information it needs to solve which defined problem, for how long, and under what limits. A technical identifier can look like an impersonal number; when collected repeatedly, however, it can reveal routines, schedules, neighborhoods, work shifts, health visits, or ordinary relationships. A system does not need a person's name to affect their freedom to move without leaving an administratively managed trace. Public safety loses legitimacy when it treats an entire population as observation material before showing that a less intrusive measure will not work.
Describe the harm before switching on the system#
“There is insecurity” is not yet an operational purpose. The city must describe what is happening: thefts at one exit, assaults on an unlit path, long waits at a transfer, conflicts at a particular hour, or fear that does not match reported incidents? Each answer calls for a different tool. A device heat map may count approximate presence, but it cannot by itself explain why an event occurred or who needs help. Using tracking technology to answer a cause that has not been investigated can produce an expensive data layer while moving resources away from simple, effective measures.
“There is insecurity” is not yet an operational purpose. The city must describe what is happening: thefts at one exit, assaults on an unlit path, long waits at a transfer, conflicts at a particular hour, or fear that does not match reported incidents?
The starting point should be a public necessity statement. It should identify the exact location, the period examined, the incidents the city aims to reduce, the sources used, and the harm it expects to prevent. It must also separate facts from interpretations. Many people passing a subway entrance at 10:30 p.m. is a mobility fact; deciding that the pattern indicates risky behavior is an inference that needs evidence. Turning a weak inference into a policing or administrative signal can harm people who work nights, travel frequently, or simply live nearby.
The statement needs a baseline. Before installing sensors, the city should know how many incidents occur, how they are recorded, what portion goes unreported, and how experience differs by age, gender, disability, and time of day. Statistics are necessary but insufficient. A walk-through with cleaning staff, station workers, drivers, and regular passengers can uncover blind spots that a dashboard misses: a badly lit exit, a broken elevator, an announcement nobody can hear, or a patrol that arrives late because it does not know the access route. Listening to such accounts does not turn every perception into conclusive data; it prevents incomplete data from becoming a total explanation.
Necessity means comparison, not choosing the most visible system#
The city should require itself to compare alternatives before collecting identifiers. It can improve lighting and maintenance, adjust staffing hours, strengthen mediation, redesign signs, create accessible help points, coordinate night transport arrivals, or study flows with non-persistent aggregate counts. It can use temporary observation by trained people, voluntary surveys, and existing incident data. No alternative is perfect, but comparison forces an answer to a basic question: what exactly does tracking add that the other measures do not?
A necessity test must also ask what happens when the system fails. Phones do not represent all people equally. Someone who carries no device, shares one, turns it off to save battery, or uses a different SIM disappears from the map. If officials read missing signals as missing need, the measure reproduces access and income bias. If they instead mistake repeated signals for suspicion, they penalize ordinary forms of movement. A system that sees fragments should not present itself as a complete portrait of a station.
The burden of proof belongs to the institution proposing the intrusion. Individual travelers should not have to prove why they do not want to be observed. The institution must show that a bounded risk exists, that the measure has a reasonable prospect of reducing it, and that a less invasive alternative cannot achieve the objective. This reversal matters: it turns technology from a vendor promise into a public decision that can be justified to the people who experience its effects.
Limits of place, time, and purpose#
If the comparison still shows that some signal collection is indispensable, the limits must be written as technical conditions rather than good intentions. A place limit should identify the exact points where the evidenced problem exists; it cannot automatically expand to plazas, shops, approach roads, or neighboring stations “just in case.” A bounded zone makes it possible to examine whether collection follows the problem or becomes normalized surveillance of the surrounding area.
Time limits have two dimensions. The first is when collection activates: perhaps during defined windows in a limited intervention, rather than continuously every day of the year. The second is how long each record survives. Aggregated occupancy information may need minutes or hours to guide resources; retaining identifiers for months under a general prevention purpose changes the character of the measure entirely. Every retention period should be linked to a specific decision and a verifiable reason.
Purpose must be closed as well. Data collected to assess lighting at one entrance cannot later appear in commercial analysis, a transport campaign, an immigration investigation, or a list of “frequent” people. A ban on secondary uses needs controls: separated databases, least-privilege access, consultation logs, export alerts, and contractual penalties if a supplier reuses information. Saying that use will be “protected” does not answer who opens the database, what they can do with it, or how a breach is discovered.
Minimization can be designed from the start. Sometimes the safety question can be answered with instantaneous counts that do not retain identifiers. In other cases, local transformation and immediate aggregation reduce exposure, although they do not remove the obligation to justify the system. The crucial sequence is that the technical solution follows the public limit: decide what minimum is needed first, then verify that the tool does not collect more than authorized.
Expiration has to happen in practice#
Promising deletion is not the same as deleting. Digital projects leave copies in diagnostic logs, backups, support accounts, supplier dashboards, and spreadsheets exported for meetings. Real expiration needs an inventory of those locations, an automatic deletion rule, people responsible for checking it, and evidence that it occurred. A date hidden in a contract is useless when nobody can verify which information disappeared and which remained.
The city can publish a data-life schedule: capture, transformation, operational use, aggregation, deletion, and verification. Publication should not reveal details that enable crime, but it should let any person know whether the measure retains minutes, days, or months. An independent auditor should examine deletion samples, exceptional access, and supplier accounts. If unauthorized copies are found, the result cannot be merely a recommendation; there must be authority to suspend collection and correct the contract.
The program itself also needs an expiration date. A measure created after a cluster of incidents should not renew by inertia. When the pilot ends, the city must publicly choose whether to remove it, change it, or justify a tightly bounded continuation. That decision requires information about incidents, user experience, complaints, differences between locations, and the performance of less intrusive alternatives. Keeping a system because it has already been purchased turns past spending into an argument for normalizing surveillance that never demonstrated necessity.
Oversight that can change a decision#
Citizen oversight is not a survey at the end of the process. It should occur before procurement, during the pilot, and before renewal. A monitoring group can include neighborhood associations, transport staff, digital-rights organizations, youth-support groups, disabled people, and representatives of nearby businesses and night workers. Composition matters: if only those designing the measure participate, oversight becomes an explanation of a decision already made.
That group needs understandable materials and real power to respond. It should receive the necessity statement, compared alternatives, data map, technical limits, incident reports, and audit results. It should be able to ask what was discarded, request additional evidence, and trigger a review when unexpected harm appears. The institution does not have to accept every proposal automatically, but it must respond in writing to what it accepts, rejects, and why.
An accessible individual channel is needed too. A person should not need fluency in technical vocabulary to ask whether a station participates, request information about the processing, or report an expansion of collection. The channel should work outside office hours, accept non-digital formats, and provide answers within stated deadlines. Rights protection is measured by the practical ability to use it, not by the existence of an email address hidden at the end of a privacy notice.
Measure safety without measuring compliance#
Success cannot mean the volume of signals collected, the number of alerts generated, or the speed with which a screen produces a map. Those metrics reward system activity, not improvement in daily life. An honest evaluation asks whether verifiable incidents fell, whether people feel safer without moving harm to another area, whether vulnerable people can obtain help more easily, and whether alternative measures proved sufficient. It should include adverse effects: errors, complaints, exclusion, out-of-purpose use, and maintenance costs.
The responsible next step is not to install sensors in order to demonstrate action. It is to publish a necessity test for each station, open the comparison of alternatives, and set an auditable expiration date from day one. If the city cannot explain what minimum data it requires, when it deletes it, and who can stop the measure, it has not yet designed safety; it has designed surveillance capacity. A safer station is one where people find light, help, and clear routes without having to surrender their everyday mobility as a silent price.
