South Africa’s private surveillance machine is fueling a digital apartheid
The cameras are not there yet. But the fiber already is.
Thami Nkosi points to the telltale black box atop a utility pole on a street once home to two Nobel Peace Prize laureates: South Africa’s first Black president, Nelson Mandela, and the anti-apartheid activist and theologian Desmond Tutu.
It always happens this way, Nkosi says. First the fiber; then the surveillance cameras. The cameras are useless unless there’s reliable connectivity to send their video feeds back to a control room where they can be monitored by humans and algorithms.
This is Vilakazi Street in Soweto, a historic suburb of Johannesburg—a sprawling megacity now birthing a uniquely South African surveillance model influenced by the global surveillance industry and set to influence it in turn. Civil rights activists say it’s already fueling a digital apartheid and unraveling people’s democratic liberties.
Five years ago, this wouldn’t have been possible. Neither the city’s infrastructure nor existing video analytics could support sending and processing footage at the necessary scale. But then fiber coverage expanded, AI capabilities advanced, and companies abroad, seeing an opportunity, began dumping the latest surveillance technologies into the country. The local security industry, forged under the pressures of a high-crime environment, embraced the menu of options.
The effect has been the rapid creation of a centralized, coordinated, entirely privatized mass surveillance operation. Vumacam, the company building the nationwide CCTV network, already has over 6,600 cameras and counting, more than 5,000 of which are concentrated in Joburg. The video footage it takes feeds into security rooms around the country, which then use all manner of AI tools like license plate recognition to track population movement and trace individuals.
Over the years, a growing chorus of experts have argued that the impact of artificial intelligence is repeating the patterns of colonial history. Here in South Africa, where colonial legacies abound, the unfettered deployment of AI surveillance offers just one case study in how a technology that promised to bring societies into the future is threatening to send them back to the past.
Two streets over from Vilakazi, with its touristy polish, the rest of Soweto—a predominantly Black township—is still poor and surrounded by hills formed from the toxic waste of the gold mining industry.
Nkosi, a Sowetan born and bred, has spent 15 years fighting against all manner of injustices—gender-based violence, lack of water and sanitation, and, most recently, the mass surveillance that threatens civil liberties. He sounds more amused than bitter as we drive by the towering heaps that have leached chemicals into his community.
“I’m surprised I haven’t died yet,” he says.
Thus far Soweto has been spared the cameras, precisely because it is poor. Vumacam originally placed them where it could find paying customers. As cramped streets give way to highway and highway to affluent areas, these installations come into view: steely gray poles with thick fat discs in the middle where clusters of CCTV cameras hang like bats, their gaze trained on the roads.
By the time we reach Rosebank, an upscale suburb of Johannesburg, the poles spring from concrete faster than we can count. Next to a mall, Nkosi, now on foot, stops and gapes at the latest fixture: a camera quadruple the size of all the others.
“That is the first time—that big, big, big thing—that is the first time I’ve seen it,” he sputters with growing animation. “This is definitely facial recognition,” he speculates, meaning that the camera could record video at high enough resolution for such technology to work. “Jesus Christ. No way, no way.”
Asked about that speculation, Vumacam says it doesn’t use facial recognition and will not consider using it until the technology is adequately regulated. “We don’t believe that facial recognition technology as it stands (from any provider) is reliable enough for ethical use,” says Cathryn Pearman, a Vumacam spokesperson.
NEC XON, the South African subsidiary of the world’s largest facial recognition provider, which says the companies had tentative talks over two years ago about adding that feature to Vumacam’s platform, adds that the cameras aren’t suited for the technology, which Vumacam confirms.
So maybe it’s coming. Maybe it’s not. That’s the thing about a privatized model of public surveillance. It’s really hard to know.
The first thing Rob Nichols wants to show off is the control room. Down the hall from a shared office space, the CEO of the private security company AI Surveillance opens the door to a cavernous room with screens plastered on the walls.
The screens stream footage from cameras around the city that the company has been hired to monitor. They’re also mainly for show. The real action happens below, on two rows of computers, where employees monitor Vumacam’s Proof 360 software platform.
Rather than display dozens of video streams at once, Proof 360 uses AI and other analytics to show only the footage that triggers security alerts. These include systems for license plate recognition and detection of “unusual” activity.
The latter is provided by a company known as iSentry, which originally developed it for the Australian military. The software trains on 100 hours of footage so each camera can learn “normal” behavior, and then it flags anything deemed out of the ordinary. Each camera can also be configured with additional hard-coded rules. For example, it can be programmed with barriers that people should never cross and zones where cars should never stop.
At a monitoring station in the first row, the alerts appear one by one on a security worker’s screen. In one a man’s been flagged for running, in another a woman for standing in the hall while texting, in a third a woman for walking too close to a car. The operator reviews each one and clicks a “Dismiss” button on all of them. There’s also a comment box and a button marked “Escalate.”
An escalated alert is kicked back to the second row, where a dispatch team coordinates a response based on the alert type and the client’s instructions. Sometimes that means texting an on-site security guard to dispel loiterers. Other times it means calling the police to arrest a suspected criminal.
Nichols points to a wanted-car alert, which has pulled in information from a database that the South African Police Service, or SAPS, maintains for vehicles linked to criminal activity. “It is very important that you take note of these vehicles,” he reads in the comments that SAPS wrote as a warning to security guards tasked with responding to the alert and apprehending the perpetrators. “They are involved in multiple home invasions and murders and are very dangerous. Use high-caliber weapons and will not hesitate to shoot. Call your security company and SAPS IMMEDIATELY.”
Vumacam uses a subscription-based model: entities registered with the private security industry regulator as well as SAPS and metropolitan police departments can rent access to whichever cluster of camera feeds they want within the Proof 360 platform. In 2019, the company charged 730 South African rand (roughly $50) a month per camera. It declined to give its latest pricing.
The bulk of Vumacam’s subscribers have thus far been private security companies like AI Surveillance, which supply anything from armed guards to monitoring for a wide range of clients, including schools, businesses, and residential neighborhoods. This was always the plan: Vumacam CEO Ricky Croock started AI Surveillance with Nichols shortly after founding Vumacam and then stepped away to avoid conflicts with other Vumacam customers.
Today a Vumacam subscription has become a de facto standard for security companies that operate in and around Johannesburg’s more affluent suburbs and commercial areas. “I don’t see a public space provider being able to effectively provide public security without the cameras,” says Ryan Roseveare, who lives in Craighall Park, one of the first suburbs in the country to adopt Vumacam.
These private security companies dominate duties usually associated with policing, even though they don’t have the same legal powers. Whereas South Africa has just over 1,100 police stations with just over 180,000 staff members, there are 11,372 registered security companies and 564,540 actively employed security guards, more than the police and the military combined.
The imbalance is a remnant of apartheid. In the late 1970s, the ruling National Party deployed police to protect its political interests, controlling widespread unrest in opposition to the government. These duties took precedence over actual police work, leaving an opening for private players.
Later, an already underresourced police force downsized further as a condition of post-apartheid reform. The private security industry ballooned alongside the country’s staggering rates of crime. South Africa recorded more than four times as many homicides per capita as the US in the last fiscal year.
Government policy encouraged communities and the police to collaborate with these private agencies. But the result has been the evolution of an increasingly martial private security sector. On a drive around Johannesburg, you can see these paramilitary units everywhere: uniformed men in tactical vehicles, toting big guns. They are far more prevalent than the actual police. The difference is they serve paying clients, not the public interest.
Just as the government failed to provide boots on the ground, it also fell short on meeting the surveillance demands of private citizens and businesses. Johannesburg first installed cameras in 2009, and today they number 574, according to city officials. But the city’s been plagued by media reports of nonfunctioning cameras. Even the 25 installed on Vilakazi Street in 2017, part of a smart-city initiative, are now gone, Nkosi says.
To support MIT Technology Review’s journalism, please consider becoming a subscriber.
Vumacam stepped into this gap in the market: its CEO, Croock, is a product of Johannesburg’s security industry, having previously operated a private patrol and monitoring service in the more affluent suburbs. With the introduction of fiber internet, he saw the opportunity to add internet-connected cameras and AI analytics to security companies’ offerings.
Vumacam partnered with the Chinese company Hikvision and the Swedish company Axis Communications to provide the hardware while iSentry and Milestone, a popular Denmark-based video surveillance management tool, provided the software. From there, it teamed up with private agencies patrolling wealthier residential areas and erected poles with high-definition cameras where they wanted on top of Johannesburg’s fiber network.
On its end of the bargain, Vumacam promised regular maintenance, high uptime, and storage of the footage for up to 30 days, during which officers and legal representatives could request a more permanent copy for use as evidence in crime investigations. By March 2021, 50 security companies were subscribed to its service. Vumacam declined to say how many customers it has today.
More recently, the company has sought adoption in malls, office buildings, and even people’s homes. It doesn’t place its own cameras within these spaces, but customers can connect their existing CCTV feeds to Proof 360 for comprehensive security monitoring of public and private spaces.
Having achieved this market penetration, Vumacam is now pushing a new level of centralization and coordination to fight criminal activity. It pitches its solution as a way to track criminals, from the moment they commit a crime, to wherever in the city they try to escape.
Proof 360 users can add wanted vehicles—those reported stolen or suspected of being used to commit a crime—to their own private database on the platform or a shared database that allows all users to work together to track cars across jurisdictions; in car-dependent Johannesburg, this can be as targeted as facial recognition. “In essence, we could have an incident on one of our cameras, and the security companies are all now trying to intercept that same vehicle in a coordinated fashion,” Croock says.
Vumacam boasts that this approach is orders of magnitude faster than waiting for a police investigation. Users need not file a crime report and receive a case number from the police before adding a plate number to the system. “What if there’s an armed robbery that’s just happened?” says Kelly de Ricquebourg, Vumacam’s product software manager. “I’m going to be able to put this license plate in and catch them in the next 10 minutes. It’s not going to take me 10 minutes to get a case number from SAPS. It takes me up to 48 hours.”
After 48 hours, if a license plate in the shared database still doesn’t have a case number, it’s automatically deleted, she adds. But there’s no transparency or mechanism for public accountability about how thoroughly this cleaning is done; nor is the same process applied to plates stored in each user’s private database, meaning any plate number could be added without any vetting. As a result, cars could be monitored and pulled over for erroneous or illegitimate reasons.
Such apprehensions can be carried out by either security companies or the police, or during joint operations between the two. To avoid the bureaucracy of their own system, which entails opening an enquiry docket, police sometimes ask private security companies to use Vumacam’s network. “We had SAPS in this control room just last week checking it out and seeing what we’re doing,” Nichols says of AI Surveillance. “Last year, mid-July, a police guy came for a full day so he could have access to the cameras.”
Vumacam says its approach aided in the apprehension of 97 vehicles and the arrest of 85 individuals in the Sandton Central Improvement District, a commercial area of Johannesburg, during the first seven months after its cameras were installed. Pearman says it was “not privy” to details about whether the arrests led to convictions.
Vumacam is now building out more applications on Proof 360, including a system to detect license plate cloning—when two cars show up in different locations with identical plate numbers. It’s also opening up the platform for third-party developers to add their own applications and distribute them to its users.
In parallel, it’s extending its physical infrastructure to the rest of the country. Later this year, Croock says, the company will switch to a new model, where customers will pay a flat fee to get access to the full network of cameras instead of just a selection. Agencies will still be able to filter the alerts to their jurisdiction, but they will also be able to view any feed in the country.
The new approach will allow Vumacam to place poles and cameras irrespective of whether there are paying customers nearby. “If you go to your cell phone provider, you don’t ask him, ‘I want a tower there and a tower there.’ You say, ‘I want coverage,’” he says.
“We need to make sure we get that coverage,” de Ricquebourg adds, “so that there’s no way for the vehicles to miss those cameras or hide from the system.”
The crime is real. On the day we walked around Rosebank with Nkosi, holding out our smartphones as recording devices, two passersby called out warnings within minutes of one another. “Ma’am you have to be careful around here,” said one. “That’s a really nice phone. They’re going to take it, and you’re going to cry too much,” said the other.
It’s not just petty theft—though both Nkosi and the South Africa–based reporter on this piece, Heidi Swart, did have their phones stolen just days before our meeting. The last three months of 2021 saw 165,000 violent physical crimes like murder, rape, common assault, and robbery reported to police nationwide.
It’s why Craighall Park and Craighall, two suburbs that share a residents’ association, were eager to be early adopters of Vumacam, says Roseveare, who oversaw the company’s initial installations. “When the cameras first went up, the community definitely felt safer,” he says. He believes they deterred crime—though he admits that’d be difficult to prove with statistics. “In South Africa, crime is always going up like inflation,” he says, so the impact would manifest as a slower increase or a reduction in its average severity.
There are now 159 cameras across both communities, including 70 with license plate recognition, at all the exit and entry points and major intersections.
But absent from the conversation is why the crime exists in the first place. Researchers of industrial societies have repeatedly demonstrated that inequality drives crime. Not only is South Africa the world’s most unequal country, but the gap is deeply racialized, a part of apartheid’s legacy. The latest government reports show that in 2015 half of the country lived in poverty; 93% of those people were Black.
As a result, it’s predominantly white people who have the means to pay for surveillance, and predominantly Black people who end up without a say about being surveilled.
Adding to it all, AI tools like facial recognition and anomaly detection don’t always work, and the consequences aren’t evenly distributed. The likelihood that facial recognition software will make a false identification increases dramatically when footage is recorded outdoors, under uncontrolled conditions, and that risk is much greater for Black people.
In many ways, the cameras have re-created the digital equivalent of passbooks, or internal passports, an apartheid-era system that the government used to limit Black people’s physical movements in white enclaves, says Michael Kwet, a visiting fellow at Yale Law School who studies the South African surveillance industry. Only Black people were required to hold the passbooks; white people moved freely. Pearman says such claims “purposefully attempt to mislead the public to create fear instead of hope where technology is successful in fighting crime.”
Meanwhile, the privatization of public safety has crowded out discussion of how the same money could be spent if not on mass surveillance: improved access to water, sanitation, electricity, health care, education, and youth employment to alleviate the poverty fueling the crime. Companies instead see a business opportunity.
“They’re essentially monetizing public spaces and public life,” Nkosi says.
“Vumacam’s technology is honed for the purpose of preventing crime and as such does not have mass surveillance capability nor intention,” says Pearman. “The concerns of so-called ‘activists’ quoted is propaganda that we deem intentionally malicious, defamatory and without any basis in truth.”
And though crime temporarily decreased during the pandemic, it has once again exploded. Many companies we interviewed argue that this justifies more investment in surveillance technologies. “Surveillance infrastructure honed on crime is key to curbing, preventing, and understanding crime which currently impedes the investment and economic growth so critical to job provision and poverty alleviation,” Pearman says.
“We have seen that surveillance technologies that were properly installed and had analytics as part of the solutions proactive rather than reactive, had a huge effect on criminal activities,” adds Jan Erasmus, NEC XON’s business lead for surveillance and analytics.
Erasmus says security firms are now working to beef up their facial recognition capabilities to identify suspected criminals. The technology relies on a database of wanted individuals’ faces to compare with faces extracted from surveillance footage. One security provider, Bidvest Protea Coin, is collaborating with NEC XON to implement a system using 48,000 mugshots of suspects wanted for anything from rhino and abalone poaching to ATM bombings and theft of base station batteries. Both companies hope to share the system with the rest of the security industry as well as with banks and government players.
But there have already been cases in which facial recognition has been used on face databases of individuals with no criminal background. In 2016, when economically disadvantaged Black students at universities across the country protested against high tuition fees, NEC XON collected protesters’ faces from photos and videos that were circulating on WhatsApp and social media; then it compared them against university databases of student ID photos. Erasmus says the aim was not to stop the protesters but to determine whether they were students (most were not, he says) and prevent damage to university property, which is estimated to have totaled 786 million rand ($52 million) nationally.
But five years later, when protests erupted anew, students said they felt they were being criminalized. Police arrived with riot gear, tear gas, and rubber bullets, and they openly filmed students at close range for so-called “evidence” collection, says Ntyatyambo Volsaka, a 19-year-old law student and activist at the University of the Witwatersrand.
“We’re trying to make sure that everyone is getting an education,” he says, “but the police treat us like animals.” Erasmus says NEC XON did not assist police with surveillance during the 2021 protests.
These same companies are building surveillance systems around the world. South Africa represents not only a high-growth market but also a place to perfect their technologies. When AI is “developed in Europe and America and all of these places,” says Kyle Dicks, a Johannesburg-based sales engineer for Axis Communications, “often South Africa is the place to put them to the test.”
Vumacam’s quietly sprawling camera network has met with little resistance since it launched in February 2019.
Yet pushback came last year from an unlikely champion of privacy rights: the Johannesburg Roads Agency (JRA), a body tasked with ensuring that anyone who erects structures on municipal walkways doesn’t hold up traffic or cut into power cables or water mains. Since Vumacam’s cameras are mounted on special poles on public sidewalks, the company needed JRA approval.
It was all smooth sailing until the JRA suddenly refused to grant Vumacam further permissions, arguing that the company would use the cameras to “spy” on the public. The agency said it would not proceed until the city released a framework to regulate surveillance cameras. Vumacam took the agency to court.
Ultimately, the JRA lost the case, but not the privacy debate. The judge ruled that the JRA’s job was to protect the integrity of road infrastructure, not human rights. But, acknowledging the matter’s complexity, the court refrained from issuing judgment on the alleged privacy infringement.
Since then, there’s been no further litigation from civil society organizations, and no legislation specifically regulating surveillance cameras in public spaces or accompanying analytics like facial recognition. The public is simply preoccupied with more immediate problems, Nkosi says: “People are worried about where their next job is going to come from, where their food is going to come from, and the political instability in the country. We haven’t educated our public enough to understand the dangers of surveillance and what it means in a democratic society.”
But the questions raised by the lawsuit have only grown more urgent. The global surveillance industry has always exchanged ideas across borders. To this day, the US government, the first major funder of modern surveillance technologies like facial recognition, is the most important institution shaping their direction through its standards and vendor rankings, says Os Keyes, a doctoral candidate at the University of Washington.
Many of the technologies being used in South Africa emerged under that influence and have continued to develop with the US market in mind. Now both technology and ideology are beginning to flow back in that direction.
AI Surveillance, for example, wants to find clients in the US that will feed their CCTV footage to its control room and monitoring staff in Johannesburg. CEO Nichols thinks the cheaper local wages will give the company a competitive edge, as will its experience handling security in the South African market. “The US is more mature in the hardware and recording—there’s more cameras and more footage stored,” he says. “South Africa is more mature in the analysis of the feed and the dispatch—out of necessity.”
Vumacam has also begun to adapt its model to other markets. It’s moved into Nigeria, where it’s placing cameras on existing infrastructure like cell towers rather than erecting its own poles. In other places that have existing CCTV camera networks, such as the US and UK, it could focus on selling its Proof 360 platform. “We think we’re onto something,” Croock says. “We see big global ambitions.”
There are signs that the rest of the surveillance industry is moving toward a platform-based approach as well. Milestone, the video management tool that Proof 360 is built on, similarly allows anyone to build AI applications like facial and license plate recognition for its software. So does Axis Communications, which has offices in the US and South Africa and recently launched its own platform.
This year NEC, the parent company of NEC XON, also plans to launch a new product known as NEC Nexus that allows government agencies to combine their watchlists in a way that echoes Vumacam’s centralization of license plate databases. Nexus is currently being trialed in the UK, where NEC has the largest pilot of live facial recognition, and will soon be rolled out globally, although there are no current plans for its implementation in South Africa, Erasmus says.
Nkosi fears what could happen next. He’s watched governments around the world embrace these advancements under the pretense of public safety before inevitably expanding it for mass surveillance of activists and civilians, with targets including the Black Lives Matter movement in the US and the Uyghur minority in China.
“Ultimately you’re going to have the state colluding with these private companies, because the state has no capacity to run such a massive complicated network of CCTV cameras,” he says. “That is the bigger danger for me.”
Indeed, South Africa is in the process of building out a national biometric identification database called ABIS that would include the face of every resident and foreign visitor. Combined with camera upgrades to Vumacam’s nationwide surveillance network and expanded use of facial recognition, ABIS could one day enable the government to track the movements of everyone in the country.
“We do not underplay the very real threat of activists, journalists, and business people being tracked illegally by nefarious individuals (some with fatal outcomes),” Pearman says. “However, people cannot be ‘surveilled’ using our technology or systems which are not built to surveil individuals.”
“NEC XON will always ensure that the use of facial recognition is done ethically,” Erasmus says.
As we continue walking through Rosebank, Nkosi begins to count the cameras. Seven on one pole. Three across the street. Six on another.
“The state may not be awake to it right now, but we’re heading there,” he says back in his home. “The spaces [for activism and protest] are going to shrink. Private companies are going to make a killing.”
