AI in Public Infrastructure

Face recognition, plate readers and camera networks in public space.

London's Metropolitan Police scanned more than 3 million faces with live facial recognition in a year, and the UK has no dedicated statute for it. Police real-time face recognition in public has been banned in the EU, with narrow exceptions, since February 2, 2025.

Surveillance cameras per 1,000 people: China (national est.) 494; Hyderabad 79; Indore 72; Bangalore 41; Seoul 24; Moscow 20; Singapore 18. Comparitech estimates SURVEILLANCE CAMERAS PER 1,000 PEOPLE China (national est.) 494 Hyderabad 79 Indore 72 Bangalore 41 Seoul 24 Moscow 20 Singapore 18 CAMERAS PER 1,000 PEOPLE, 2025 COMPARITECH ESTIMATES
Met faces scanned, 12 months
3M+
Flock plate scans a month
20B+
US cities that dropped Flock, 6 months
38
Registry incidents
0

Deployments

London, US police departments and China run the largest public AI sensor networks

The Met reports a 0.0003% false alert rate and 962 arrests in 12 months. Flock Safety says its readers cover 6,000 communities in 49 states, and 38 cities dropped it in six months over data-sharing concerns. China's camera network is estimated at about 700 million cameras.

Flagship public infrastructure deployments
DeploymentDeveloper / operatorWhereScaleAutonomyStatusControls declared
Met Police live facial recognitionNot disclosed / Metropolitan PoliceLondon3 million+ faces scanned in 12 months (Sep 2025)Real-time matchingExpandingPolice-reported false alert rate of 0.0003%
Flock Safety license plate readersFlock Safety / Local police and other buyers6,000+ communities in 49 states20 billion+ scans a month (Jul 2026)Continuous readingActive; 38 cities dropped it in six monthsFederal national lookup barred Aug 2025
SkyNet camera networkNot disclosed / Chinese public security bureausNationwideAbout 700 million cameras (estimate) (2025)Not disclosedActiveNot disclosed

Recent events

  • The Home Office gave 10 face recognition vans to seven more forces on August 13, 2025.
  • Roseville, California police found 71% of 1,427 Flock alerts were misread plates.
  • Oakland rejected a $2 million Flock contract in November 2025 over ICE access concerns.
  • One Texas department searched more than 103,000 devices in a single homicide case.

Attack surface

Two of ten attack-surface dimensions rate very significant or critical

No dimension rates critical. Ratings use five levels, from limited to critical, and cover the paths an attacker or a failure can take into the agent.

Attack surface by dimension: Physical access significant; Identity and authentication moderate; Command and control channels significant; Perception and sensors very significant; Connectivity surface significant; OTA and update pipeline significant; Data capture and retention very significant; Integrations and permissions significant; Behavioral and policy boundary moderate; Multi-agent coordination significant, growing Physical access SIGNIFICANT Identity MODERATE Command and control SIGNIFICANT Perception VERY SIGNIFICANT Connectivity SIGNIFICANT OTA updates SIGNIFICANT Data capture VERY SIGNIFICANT Integrations SIGNIFICANT Behavior boundary MODERATE Multi-agent SIGNIFICANT, GROWING
Attack surface rating by dimension. Longer, darker bars are rated higher.
Public infrastructure attack surface by dimension
DimensionRatingWhy
Physical accessSignificantCameras, sensors, kiosks, and processing equipment in public spaces are physically accessible
Identity and authenticationModerateSystem operator credentials are the primary target
Command and control channelsSignificantOperator interfaces, vendor backends, integration platforms
Perception and sensorsVery significantCameras, microphones, RF sensors, environmental sensors typically operating continuously
Connectivity surfaceSignificantCellular, fiber, mesh, and dedicated networks
OTA and update pipelineSignificantVendor-managed updates to deployed systems
Data capture and retentionVery significantThe most distinctive dimension
Integrations and permissionsSignificantInter-agency data sharing, fusion centers, commercial data brokers, third-party AI vendors
Behavioral and policy boundaryModerateUse policies and operational procedures bound permitted use
Multi-agent coordinationSignificant, growingFusion centers and inter-jurisdictional data sharing aggregate across deployments

Incidents

No registry incident involves public infrastructure yet

The 137AI Incident Registry logs an incident when an agent's failure or misuse caused harm or a regulator acted, and public sources name the developer, the failed control and how it was found. No public infrastructure case meets that bar yet. Candidates go on the review list in the registry methodology.

Rules

The EU bans real-time police face recognition; the UK and US have no national rule

Rules that apply to public infrastructure
RuleJurisdictionWhat it requiresStatus
EU AI Act Article 5(1)(h)EUBans police real-time remote biometric identification in public, with exceptionsIn force Feb 2, 2025
Home Office police biometrics consultationUKProposes one regulator for police biometricsClosed Feb 12, 2026
CAC and MPS face recognition measuresChinaAlternatives to face ID; bans in hotel rooms and restroomsEffective Jun 1, 2025
State license plate reader lawsUS states13 states require audits; eight make misuse a crimeAug 2026

Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.

Record

Page Record

Agent class
Personal and ambient
Datasets
ai_deployments.csv (3 rows for this page); ai_attack_surface.csv (10 rows); ai_incidents.csv (0 linked)
Key sources
Met Police report
Comparitech camera study
Flock pullouts (TechSpot)
Source notes
Flock Safety license plate readers: company figures via secondary source; SkyNet camera network: estimate
Last verified
October 2026