“I think most people don’t think about this.”
That’s what Computer Science Professor Susan Landau told me about surveillance and cybersecurity. Landau, a founding member of the Tufts Cybersecurity Center for the Public Good, is an expert in cybersecurity and privacy and is keenly aware of how we are tracked and monitored in day-to-day life.
I spoke to Landau in light of the public reckoning surrounding surveillance and, more specifically, criticism of Flock Safety. Flock, a company known primarily for its license plate-reading technology, has come under fire for oversurveillance of U.S. cities. Groups like DeFlock, an open-source mapping project, have made it their mission to identify and share the location of Flock cameras around the country. A Flock spokesperson said no team members were available for an interview with the Daily.
Privacy has also been a long-held concern for Tufts students. Tufts’ Video Security Policy was drafted between 2012 and 2014 and finalized in 2014. The policy, as presented on the Department of Public Safety’s website, has not been updated since then. In 2017, the Daily published an investigative series about security cameras on campus; several students criticized the video security policy and practices, finding them either invasive or unnecessary.
All of this raises the question: Are any of us really aware of how we’re being monitored? To get a better sense of how surveillance and data collection impact Tufts students, I asked Yolanda Smith, chief of police and associate vice president of the Department of Public Safety, and Lorna Koppel, chief information security officer, for statements.
Data is collected every time a Tufts student taps or swipes their ID card on campus.
“ID card tap records collect basic transaction data required for physical access control, including the name/location of the badge reader, date and time, badge number, and associated individual’s name,” Koppel wrote.
However, Koppel clarified that this information isn’t continuously tracked or monitored — it is only reviewed upon request or in light of a security concern.
“The system does not analyze, track, or process this data to map individual routines, frequency of visits, or movement patterns across campus. These logs are stored on secured servers within Tufts data centers, with access strictly limited to designated staff based on role-based access permissions, in case access to them is requested due to a legally required or permissible inquiry pursuant to law or university policy or procedure such as an investigation or litigation,” Koppel wrote.
Using Tufts’ Wi-Fi network also collects user data. However, this data is encrypted, so most of the time Tufts Technology Services cannot, or does not, see what users are doing on particular sites.
“Network and WiFi logging captures standard network metadata required to route traffic and maintain network stability. Most web traffic is encrypted, meaning TTS cannot view or access the actual content of user activity,” Koppel wrote.
Video security is also a key element of student privacy discussions. If you walk around campus, you’ll see security cameras in and outside of almost every single building. While preparing to write this article, I made an effort to look out for security cameras as I entered and exited buildings. Every time I made myself aware of the possibility that I was being recorded, I spotted a security camera.
“Students should expect cameras in many shared and public areas, such as building entrances, parking areas, and other typical locations,” Smith wrote. “Being recorded is different from being watched: under normal conditions, no one views the footage, and it is reviewed only for a legitimate safety purpose, such as a reported incident or an alarm.”
Smith noted that the number of cameras on campus, as well as their specific locations, are not publicly disclosed. The installation of new cameras is also not publicized.
I was not surprised to see a high level of video security on campus. I was curious, though, about the storage and use of that footage.
Smith noted that, barring particular exceptions, university policy states that footage is to be erased after 30 days.
“Recordings are stored in a secure university location for no more than 30 days and are then erased or overwritten. Exceptions include footage retained for a criminal investigation, a court proceeding, or another use approved by the AVP or designee, and certain higher-security areas where retention may be longer. Only designated personnel can play back footage, and all downloads are logged,” Smith wrote.
Student information is indeed collected through meal swipes, network use and security camera footage, but is only reviewed or investigated following an alarm or report.
In 2024, one Tufts student said that a combination of these types of information led to probation following their involvement in pro-Palestine protests.
Smith said that, under university policy, peaceful protest does not justify footage review. However, a perceived or real ‘security risk’ does provoke footage or tap access review.
“Video security cameras aren’t used as the principal investigative tool for non-violent and non-destructive minor offenses. It doesn’t prevent reviewing footage after an incident is reported, and the policy separately allows monitoring of special events for safety. The policy also bars monitoring based on protected characteristics and requires that monitoring be based on behavior. A peaceful protest is not a crime, and we do not use cameras to identify people for taking part in a peaceful protest. When there is a security risk or a potential that a crime has occurred, such as vandalism to university property or an assault, there is a public safety reason to review the cameras,” Smith wrote.
Smith also noted that Tufts does not employ facial recognition technology.
“Tufts does not use facial recognition on its camera system for students or anyone else. The policy’s reference to “digital analytics” means (e.g., motion-based alerts), not identifying individuals,” Smith wrote.
Koppel and Smith made clear that university policy does prohibit the viewing of data or footage without a designated need.
“University policy strictly prohibits viewing or accessing non-public institutional data without a clear, job-required need,” Koppel wrote.
I asked Smith who gets to determine what constitutes ‘need’ in these circumstances.
“TUPD operates the system, stores the footage, and decides on law enforcement and investigative use. The AVP or a designee approves those requests, including requests from outside police agencies; all other requests are reviewed in consultation with other university administrators including the General Counsel,” Smith wrote.
By using university systems and networks, students are agreeing or opting in to certain levels of data collection. Landau mentioned the importance of the Family Educational Rights and Privacy Act, though, and noted that Tufts faculty and staff must and do comply with students’ right to privacy.
“Faculty have to be careful, and the university has to be careful, in collection and storage of student data,” Landau said.
Although students might only have a vague sense of how their information is collected and stored, Landau told me that her conversations with TTS have not been troubling.
“The last time I talked to our chief security officer, I found that the way Tufts was considering security was thoughtful,” Landau said. “It may not be what students expect, but it definitely was thoughtful.”
