In cities across Canada, police are partnering with social service agencies that work in housing, addictions, mental health, and child welfare to identify and intervene with people who they believe are at risk of harming themselves or others.
Proponents say this pre-crime approach, called the Hub and COR, is the future of law enforcement and social service delivery. But some experts warn that taking a data-driven approach to solving social problems can lead to discrimination.
"Our concern is how data is being used to identify people [deemed to be] 'at risk'," said Valerie Steeves, professor of criminology at the University of Ottawa, in a phone call. "The models that we use to analyze [risk] information are prone to reproducing stereotypes."
Hub assessments and interventions often involve people who are especially vulnerable. For example, many cases focus on minors: in North Bay, Ontario, 45 percent of those deemed to require an intervention in 2015 were between 12 and 17 years old, according to a report in the Northern Ontario Medical Journal.
"We're dealing with very, very sensitive information"
Hubs rely on public health agencies and social services to share unprecedented amounts of information about their clients with police.
The disclosure of personal health information is tightly regulated by provincial law, and while Hub guidelines encourage agencies to get consent before sharing it, agencies can get around these requirements thanks to language in health privacy laws that lets them share an individual's personal information if a "probability of harm" exists.
This means that if Hub agencies decide a person is at an elevated level of risk, they can share his or her information without explicit consent.
"The structure of privacy legislation says you need consent [to share information]," Information and Privacy Commissioner (IPC) for Ontario Brian Beamish said in a phone call. "but [there are] a bunch of exceptions."
Hub meetings follow a "four filter" information-sharing process—whereby the agency bringing a case to the Hub only reveals non-identifying information before deciding to assess a case in more detail—designed to protect the privacy of the individuals under discussion.
"Information can be used in a way that actually increases harm to marginalized people"
But if Hub members agree that if a person or family displays a sufficient number of risk factors—such as drinking alcohol, missing school, or exhibiting "negative behavior," an ill-defined term—the person's information is shared with other agencies and an intervention is planned. This can include an unannounced visit to the person's home, contacting family members and friends, or other steps determined by the agencies.
"We've definitely received inquiries from [Hub] agencies, wondering whether the Hubs are operating [in a way] that complies with privacy legislation," said Beamish. "We're dealing with very, very sensitive information [in Hubs]—it may be health information, or [information] about addictions, about homelessness."
Steeves said that the agencies are right to be concerned. "[By taking data] out of context, information can be used in a way that actually increases harm to marginalized people."
The first Hub and COR in Canada was started in 2011 in Prince Albert, Saskatchewan. Some early indicators suggested it was having a positive effect, but a subsequent privacy assessment found that the project had weak privacy protections and warned that some of its databases contained personally identifiable information, which the Information and Privacy Commissioner for Saskatchewan recommended be destroyed.
"All recommendations [made by] the Office of the Information and Privacy Commissioner have been implemented or are in the process of being implemented," said Drew Wilby of the Saskatchewan Ministry of Justice, Corrections and Policing in an email.
Hubs inspired by the Prince Albert model have been rolled out in more than two dozen Canadian cities, including Toronto, Ottawa, Surrey, Edmonton and Halifax, with participation from police at the local, provincial and federal levels.
Ontario's IPC hasn't conducted a formal privacy assessment of Hubs in the province. Beamish said that his office worked with the provincial Ministry of Community Safety and Correctional Services (MCSCS) to develop information sharing guidelines for Hubs, but they're not necessarily mandatory.
Risk-driven policing also involves storing and analyzing the data gathered by Hubs. In Saskatchewan, every Hub in the province has access to a centralized database of information.
MCSCS spokesperson Brent Ross said that Ontario Ministry maintains a Hub database that does not contain personally identifying information.
"[MCSCS] initiated the Risk-driven Tracking Database (RTD) project to [...]collect, track [and] analyze information in a consistent way throughout the province," Ross said in an email.
Steeves said that while Hubs have good intentions, the information used to assess young people often doesn't tell the whole story.
"One of the things being used to identify risk of suicide or depression is the posting of 'emo' lyrics [online]," said Steeves. She also noted the rise of companies that train school staff how to surveil students on social media to identify risk factors.
"This surveillance makes it tough for [kids] to develop relationships of trust with people in the real world who might be better placed to help them."
Get six of our favorite Motherboard stories every day by signing up for our newsletter.