FARO stands for Frontline Record of Online Harms. Technology-related harm usually reaches the public one case at a time: a school in one country, a family in another, each easy to treat as an exception. This directory puts those cases side by side to help grassroots actors see where others face the same issues they do, and to help governments and regulators see the bigger picture of the harms occurring. The directory describes what its records contain. It does not measure how often these harms occur, and a country with few records may simply have little published about it.
How to use this directory: Topics are filterable for FARO reports that have already been created based on these incidents. The harms and response patterns shown are those featured there. To see the incidents used in a country-specific report, choose that country under Country report. Pick a pattern or evidence type to see on the map which countries have matching records. Click a country on the map or in the list to see its records below. Use the filter to search for keywords or specific sources.
Shaded countries have at least one record. Choose a pattern to see where it appears.
Shading shows only that a country has at least one record in this directory that matches your selection, and every shaded country looks the same on purpose. It says nothing about how often these harms occur there. Pattern filters only cover records classified so far, and small countries are easy to miss on a map, so use the list as well.
In the list but not drawn on the map: Multiple countries, Not stated.
An adult male employee opened a wallet account to receive his salary, which his company successfully paid. The wallet platform then blocked his account, preventing him from logging in and accessing his salary. Customer support replied only with an automated response.
Rumah Belajar, a website and app developed and operated by Indonesia's Ministry of Education and Culture for preschool, primary and secondary students during the pandemic, was observed sending children's Android advertising IDs to Google and Facebook. Its privacy policy says the collected device identifiers may be used to show advertisements and to advertise on third-party websites after a visit, and HRW lists it among four government products that explicitly disclose using student data for behavioral advertising.
Kelas Pintar, a privately developed Indonesian learning app apparently designed for children with an estimated 1 million installs, was found by HRW to have the ability to collect children's advertising IDs, IMEI numbers, contacts and contacts' photos, and camera access. It embeds Google and Facebook analytics SDKs and Adjust. Its privacy policy does not disclose the collection of contacts information, which HRW found neither necessary for the app to function nor of educational benefit. HRW listed it among nine apps potentially engaging in ID bridging, which can bypass privacy controls such as resetting the advertising ID. Kelas Pintar did not respond to HRW's request for comment.
Ruangguru, an app recommended by Indonesia's Ministry of Education and Culture and used by over 10 million students in its free pandemic version, continuously logged what children did in its virtual classrooms and sent that log to Facebook as well as to itself. Its privacy policy says it may collect interaction information such as scrolling, clicks and mouse movement to serve advertisements, and may share data with advertisers and ad networks without naming them.
Forensic analysis for HRW found that Ruangguru collects students' precise location, Android advertising ID, device information and in-app navigation, and transmits them to AppsFlyer and Facebook. The app also has the ability to access call logs, camera and microphone. Its privacy policy says it combines data it holds on students with information from other sources for advertising and other purposes. AppsFlyer told HRW it does not sell or serve ads, build targeting profiles or sell data, and did not address the questions about Ruangguru specifically.
Each record is a short summary of an incident described in a public source or collected through an interview by SHIELD or its partners. Records are reviewed by people before they appear here. Names and identifying details are removed: where a person appears, a role, age band and gender stand in for the name, and dates and places for minors are generalised. Every record links to its original source and shows the date that link was last checked. Records are classified with shared harm categories. The classification is SHIELD's own, so it can differ from how a source describes the incident.
You are welcome to read, link to and quote individual records with credit to FARO. Please do not copy, scrape or republish the dataset in bulk, or use it to train or test automated systems, without written permission. To ask for permission, use the SHIELD contact form. The original sources keep their own rights, and the link on each record leads to them.
SHIELD-APS. Frontline Record of Online Harms (FARO). DIRECTORY-URL. Accessed [date]. To cite a particular selection, use the web address shown after you set the filters.
When you rely on the facts of an incident, cite the original source it links to. When you rely on the classification, the patterns or the country report, cite FARO. Please describe the records as documented incidents and do not present counts or country coverage as how often these harms happen. A country with few records may simply have little published about it.
If a record is wrong, a link no longer works, or you are described in a record and want it changed or removed, use the SHIELD contact form and include the title of the record. We review each request and update or remove the record where the request is justified.
Know of a documented incident that belongs here? Send it through the incident form. A public source, such as a news report, a court or regulator decision, or a research publication, helps us verify it quickly. Submissions without a public source are kept anonymous and are not tied to named products or companies. Please leave out the names of children and of anyone who has not agreed to be named. Submissions are reviewed before anything is published, and sending one does not guarantee a record.
