Utrecht University stops camera trial ‘due to situation in Leiden’

Utrecht University has stopped a trial in which cameras were used to count how many people are in the buildings. The university is doing this after students from Leiden University protested against a similar system in that city.

Last year, Utrecht University installed cameras in seven buildings and eight teaching rooms to see how corona rules could be enforced, NOS writes. Cameras were also used to count attendees in two branches of the university library in Utrecht. All those cameras are now turned off, a university spokesperson confirmed to the broadcaster.

According to the spokesperson, these are cameras that convert images into counts and no images were stored. The university is stopping the trial ‘in response to the situation in Leiden’ and ‘because of the fact that the occupancy of the buildings does not need to be kept up to date for corona policy’. The university says it will bring the evaluation of the trial forward and will then see whether the cameras in the libraries are switched on again.

Earlier this week, students and employees of Leiden University protested against cameras at their educational institution. Leiden University also uses cameras to count the presence in rooms, but according to research by the university magazine Mare, these cameras can observe much more and this poses privacy risks.

In Leiden there are 371 cameras, which the university calls classroom scanners. The university uses the Xovis PC2S for this, which can be used for counting, tracking and analyzing people. Leiden University says that the cameras do not store images and only count people, but according to Mare, the security was bad and the privacy settings were not properly adjusted.

A login page of the university’s Xovis cameras was accessible online via http. Its source code contains the hashed password using the MD5 algorithm. After responsible disclosure from Mare, the university has shielded that page, but according to a fact check by the university magazine, the password is still in the source code and the connection is still not secure.

Since this week there has been an announcement on the Leiden University website about the presence of the cameras. The cameras have been active for a year. The university itself states that it fully complies with the GDPR with the use of classroom scanners. Earlier this month, 170 employees of the Faculty of Social Sciences already sent a burning letter to the dean, expressing their concerns about the cameras.

Update 16.43: The article initially stated that Leiden University has solved the security problems with the login page, but that is only partly the case. The article has been adapted accordingly.

Xovis PC2S, used by Leiden University