The Dark Side of Smart Cities: Data Security, Privacy Risks, and the Loss of Human Autonomy

As Canadian municipalities increasingly adopt smart city technologies, concerns surrounding privacy, data security, and the delegation of urban governance to artificial intelligence (AI) and third-party companies have come to the forefront. While smart city programs promise efficiency, sustainability, and modernization, they also pose significant risks that municipalities must confront to avoid unintended consequences.

Third-Party Data Security Risks: A Growing Concern

One of the most significant risks in smart city implementation involves third-party data management. Many municipalities rely on private companies to operate and maintain the interconnected systems that make cities "smart." However, this reliance on external companies introduces numerous data security vulnerabilities.

According to the National Institute of Standards and Technology (NIST), third-party data handling comes with serious risks such as potential data breaches and commercial exploitation of personal information (NIST, 2020). The reality is that third-party companies may fail to implement adequate security measures, leaving the data they collect—often without full resident awareness—exposed to unauthorized access, theft, or exposure. Sensitive data could be exploited for commercial gain without municipal consent or even knowledge.

When a city relies on third parties for data management, residents may not realize how much of their personal information—ranging from energy consumption to travel patterns—is being harvested and potentially shared or sold. Municipalities, therefore, must prioritize data protection by thoroughly assessing the data handling practices of third-party companies, implementing robust contractual provisions, and regularly monitoring and auditing third-party compliance with security regulations.

Failure to mitigate these risks can result in reputational damage, financial losses, and legal liabilities for municipalities. As smart cities become more interconnected, the consequences of data breaches or misuse of information will only grow more severe. Municipalities must ensure data protection policies prioritize transparency and informed consent, so residents fully understand what data is being collected and how it is used.

The Risks of Interconnected Smart City Technologies

A recent EastWest Institute guide on smart cities warns of the increased risks associated with the rapid deployment of smart technologies (Route Fifty, 2019). As more cities adopt Internet of Things (IoT) devices—ranging from traffic sensors to smart waste management systems—the interconnected nature of these systems makes them vulnerable to cyberattacks. Unstructured networks, combined with older generations of technology, increase the chances of technical failures, security breaches, and system crashes.

These risks are compounded by the reality that most municipalities do not have the financial or technical resources to adequately secure these technologies. Cities, especially smaller municipalities, often lack the budget to hire cybersecurity talent capable of managing multiple generations of smart devices that have been procured over a decade or more. Without proper frameworks for incident and emergency response, municipalities will continue to be exposed to serious cybersecurity threats.

To mitigate these risks, cities must take a proactive approach to cybersecurity. This includes only procuring secure devices that can be regularly patched and upgraded, changing default passwords, encrypting communications, and ensuring proper authentication for users (Route Fifty, 2019). Importantly, municipalities should map their network to ensure that data flows only where it’s intended and avoid leaving systems open to exploitation. Resilient systems must be put in place to ensure critical services, such as public safety and emergency response, can continue even during cyberattacks or technical failures.

AI and the Future of Autonomous Cities

While smart cities are still focused on data collection and management, the concept of AI urbanism—where artificial intelligence governs many of the city's core functions—is rapidly emerging. According to The Conversation (2024), AI technologies are increasingly being used to make critical decisions in cities, ranging from predictive policing to infrastructure management. These AI systems raise ethical concerns about how urban governance is being shaped and how decision-making responsibilities are being delegated to machines (The Conversation, 2024).

One of the biggest challenges AI presents is its inherent lack of morality. Unlike human decision-makers, AI operates based on algorithms and data patterns rather than ethical considerations. For example, AI-driven predictive policing tools, such as those developed by Palantir, are already being used in cities to forecast crime hotspots and target individuals. However, the decisions AI makes are based on historical data, which can inadvertently amplify biases or penalize vulnerable populations, particularly racial minorities (The Conversation, 2024).

As cities move towards adopting more autonomous technologies, they risk ceding control over critical governance functions to machines that may not be capable of making ethical or nuanced decisions. The decisions AI systems make are often detached from the social contexts in which they are applied, which could lead to significant consequences in areas like housing, policing, and public safety.

For example, AI systems already influence housing markets by determining who qualifies for mortgages or rental approvals, often penalizing low-income individuals or minorities. As AI plays a growing role in urban governance, these issues could become more widespread, exacerbating inequality and diminishing human autonomy. As noted in the Neom Project—an AI-driven city under construction in Saudi Arabia—the creation of autonomous cities risks displacing human decision-making altogether (The Conversation, 2024).

The Overreach of Smart and Autonomous Cities

One key criticism of smart cities and AI urbanism is the extent to which they demand constant data collection from residents. Municipalities now collect data through license plate readers, traffic cameras, public transportation systems, and even predictive policing technologies (Route Fifty, 2019). This data is used to optimize city operations but at the cost of residents’ privacy and autonomy. Unisys surveys reveal that while residents may support data collection for public safety purposes, they are skeptical about the government’s ability to safeguard this data and ensure it ends up in the right hands (Route Fifty, 2019).

The public’s growing distrust is not unfounded. Smart city programs often blur the lines between surveillance and urban management, leaving citizens with little say over how their data is being used. Worse yet, there is little transparency or accountability when cities enter into data governance agreements with private companies to manage these data systems. Without robust privacy protections and public oversight, smart cities risk becoming highly intrusive environments where surveillance is normalized, and individual privacy is undermined.

Resisting the Push for Smart and Autonomous Cities

Despite the promises of efficiency and modernization, smart cities and AI-driven governance systems present substantial risks. Cities must resist the temptation to blindly adopt these technologies without carefully weighing the consequences for data privacy, security, and human autonomy. Municipal leaders should involve residents in decisions about smart city implementations, making data collection and usage transparent.

Furthermore, municipalities must prioritize local control over their data. Outsourcing data management to third-party companies—who may exploit data for commercial purposes—compromises public trust and heightens the risk of data breaches. Effective frameworks must be established to safeguard personal data, provide transparency in smart city projects, and maintain public accountability.

The ongoing push toward AI urbanism and autonomous cities may signal a future where AI, not human governance, plays a central role in decision-making. Municipalities must take a stand now to ensure that human autonomy, ethical governance, and individual privacy are not sacrificed on the altar of technological progress.

---

References

National Institute of Standards and Technology (NIST). (2020). Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. NIST Special Publication 800-161r1. U.S. Department of Commerce.

Route Fifty. (2019, February 14). Managing Smart City Risks: New Guide for Non-Technologists Aims to Help Local Officials Avoid Technology and Policy Pitfalls. Retrieved from https://www.route-fifty.com/emerging-tech/2019/02/managing-smart-city-risks/154913/?oref=rf-author-river

The Conversation. (2024, January). AI Could Make Cities Autonomous—But That Doesn't Mean We Should Let It Happen. Retrieved from https://www.route-fifty.com/digital-government/2024/01/ai-could-make-cities-autonomous-doesnt-mean-we-should-let-it-happen/393075/?oref=rf-topic-lander-top-story