FARO stands for Frontline Record of Online Harms. Technology-related harm usually reaches the public one case at a time: a school in one country, a family in another, each easy to treat as an exception. This directory puts those cases side by side to help grassroots actors see where others face the same issues they do, and to help governments and regulators see the bigger picture of the harms occurring. The directory describes what its records contain. It does not measure how often these harms occur, and a country with few records may simply have little published about it.
How to use this directory: Topics are filterable for FARO reports that have already been created based on these incidents. The harms and response patterns shown are those featured there. To see the incidents used in a country-specific report, choose that country under Country report. Pick a pattern or evidence type to see on the map which countries have matching records. Click a country on the map or in the list to see its records below. Use the filter to search for keywords or specific sources.
Shaded countries have at least one record. Choose a pattern to see where it appears.
At least one matching recordNo matching recordSelected country
Shading shows only that a country has at least one record in this directory that matches your selection, and every shaded country looks the same on purpose. It says nothing about how often these harms occur there. Pattern filters only cover records classified so far, and small countries are easy to miss on a map, so use the list as well.
Ten high school students allegedly planted a trojan on a teacher’s laptop to alter grades and absences on the register, Tuscany, Italy
Ten high school students allegedly installed a trojan on a teacher's unattended laptop, obtained the register password and from home deleted absences and raised grades. The head teacher spotted the anomalies and imposed disciplinary sanctions, with some students assigned community work and none failed in June; the regional postal police investigated and a trial before a regional juvenile court was expected on charges including unauthorised access and falsification of public records.
Two middle-school students allegedly hacked a teacher’s register account and changed classmates’ grades, Italy
A report of an anomaly in an electronic register at a lower secondary school in Italy reached the police cyber-security unit, which checked access logs and IP addresses and confirmed a teacher's account had been breached and many students' grades changed. Two students of the school were identified as the alleged authors and referred to the regional juvenile prosecutor for unauthorised access to a computer system (an allegation).
Unauthorised Disclosure of Student’s Educational Evaluation on Classeviva Electronic Register
A teacher at a state professional institute in Italy accidentally published a private academic evaluation and behavioral note regarding a student in the public class 'Agenda' section of the Classeviva electronic register. Because the teacher failed to select the option to restrict the visibility of the note, the message was exposed to all other students in the class and their families. The Italian Data Protection Authority (Garante Privacy) investigated the incident and fined the school for the unlawful communication of a minor's personal data.
Source: Garante per la protezione dei dati personali
Unauthorized Disclosure of Student’s Disability Status via School Email
An instructor at a high school in Italy mistakenly sent three email communications regarding a student's Individualized Education Program (PEI) to all of the student's classmates. As a result of this error, the student's sensitive disability and medical status were exposed to their peers without authorization.
Source: Garante per la protezione dei dati personali
Unauthorized Exposure of Special Education Students’ Status via School Register Platform
A public school in Italy distributed operational meeting schedules via its school register platform. The documents contained the initials of 52 certified students with disabilities, making their sensitive medical-educational status recognizable to unauthorized parents, teachers, and students. As a result, the sensitive health data of these students was exposed to the wider school community, leading the Italian Data Protection Authority to issue a fine of €1,000.
Source: Garante per la protezione dei dati personali
Unauthorized Online Disclosure of Minor Student’s Medical Information by Italian School District
The Italian Data Protection Authority fined a school district in Italy €4,000 for a privacy breach. The school published a teacher selection circular on its public institutional website that included the initials, class, and references to medical documentation of a minor student who required home-based instruction. This online publication effectively exposed the student's private health status and medical condition to both the public and members of the school community.
Source: Garante per la protezione dei dati personali
Unauthorized Public Exposure of High School Exam Results and Schedules on School Website
The Italian Data Protection Authority (GPDP) fined a high school in the Lombardy region of Italy 2,000 after an administrative staff member mistakenly published intermediate exam results, final exam scores, and detailed oral exam schedules containing student names on the school's public website. The data was intended to be restricted to the secure, private electronic register. A female high school student filed a formal complaint regarding the public exposure of her classmates' and her own data, which was subsequently removed by the school.
Source: Garante per la protezione dei dati personali
University of Turin approves online exam proctoring despite student protests
Students objected to the university's approval of camera-based proctoring for remote exams, calling it invasive and 'classist', and hundreds protested, some chaining themselves to the rectorate entrance, then marching. The rector held the approval meeting online from another location and the board of directors also approved the software. The rector set a one-month trial, with a review on 12 April 2021, and said monitoring arrangements would be defined.
Unlawful Biometric Attendance Verification of Students at Università Telematica e-Campus
The Italian Data Protection Authority fined Università Telematica e-Campus 50,000 euros for unlawfully processing students' biometric data between March and November 2024. The university used a facial recognition system integrated into its webinar platform to verify the attendance of adult students enrolled in its online teacher training courses. Students were required to provide mandatory consent to have their faces periodically scanned and matched against their IDs as a condition for taking the course and obtaining their certification, resulting in unlawful biometric surveillance and excessive data retention.
Source: Garante per la protezione dei dati personali
Unlawful Biometric Processing and International Data Transfer of Italian University Students via Respondus Proctoring Software
Starting in April 2020, students at a university in Italy had their sensitive biometric facial data, screen activities, and video recordings captured and analyzed by the 'Respondus' proctoring software during remote exams. The software automatically flagged behaviors deemed suspicious and compiled automated surveillance logs on the students without a valid legal basis or proper student consent. Additionally, this personal and biometric data was transferred to servers in the United States without adequate legal safeguards, violating the students' data privacy rights under the GDPR.
Violent animal-killing video shared in middle school class WhatsApp chat
A first-year pupil at a middle school in Reggio Emilia shared a graphic video in a class WhatsApp group showing a sheep being slaughtered, upsetting and disturbing many classmates. Parents reacted immediately, expressing concern about the impact on children and consulting a lawyer. Some considered filing a complaint with prosecutors and criticized the school's response. In reply, the headteacher argued that the incident occurred outside school through a privately created WhatsApp chat on students' personal smartphones and therefore was not directly within the school's control. The school nevertheless addressed the incident by discussing it with students, incorporating it into citizenship education activities, conducting classroom discussions about social media and shared content, and highlighting existing programmes on legality, digital responsibility, and online behaviour.
WhatsApp chat targeting 500 members spread pornographic images to hundreds of middle school students
A WhatsApp group involving hundreds of middle school students in two Italian municipalities expanded rapidly and began circulating pornographic images and other inappropriate content. The incident raised concerns among parents, schools, and local authorities about young people's unsupervised use of social media and messaging platforms. Authorities intervened to shut down the group, while schools and community organizations promoted awareness initiatives focused on responsible digital citizenship and safer online behaviour.
WhatsApp group with over 700 middle school students circulated Nazi imagery and sexual content involving children
A WhatsApp group with more than 700 participants, many of them middle school students, was found to be circulating child sexual abuse material, pornographic content, and Nazi imagery. The discovery prompted reports to parents, school authorities, and law enforcement agencies, leading to an investigation into the origin and dissemination of the material. The case highlighted concerns about the scale at which harmful and potentially illegal content can spread through youth messaging networks and the challenges schools face in responding to digital misconduct among students.
Each record is a short summary of an incident described in a public source or collected through an interview by SHIELD or its partners. Records are reviewed by people before they appear here. Names and identifying details are removed: where a person appears, a role, age band and gender stand in for the name, and dates and places for minors are generalised. Every record links to its original source and shows the date that link was last checked. Records are classified with shared harm categories. The classification is SHIELD's own, so it can differ from how a source describes the incident.
Using the directory
You are welcome to read, link to and quote individual records with credit to FARO. Please do not copy, scrape or republish the dataset in bulk, or use it to train or test automated systems, without written permission. To ask for permission, use the SHIELD contact form. The original sources keep their own rights, and the link on each record leads to them.
How to cite
SHIELD-APS. Frontline Record of Online Harms (FARO). DIRECTORY-URL. Accessed [date]. To cite a particular selection, use the web address shown after you set the filters.
When you rely on the facts of an incident, cite the original source it links to. When you rely on the classification, the patterns or the country report, cite FARO. Please describe the records as documented incidents and do not present counts or country coverage as how often these harms happen. A country with few records may simply have little published about it.
Corrections and removals
If a record is wrong, a link no longer works, or you are described in a record and want it changed or removed, use the SHIELD contact form and include the title of the record. We review each request and update or remove the record where the request is justified.
Report an incident
Know of a documented incident that belongs here? Send it through the incident form. A public source, such as a news report, a court or regulator decision, or a research publication, helps us verify it quickly. Submissions without a public source are kept anonymous and are not tied to named products or companies. Please leave out the names of children and of anyone who has not agreed to be named. Submissions are reviewed before anything is published, and sending one does not guarantee a record.
Manage Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
