FARO stands for Frontline Record of Online Harms. Technology-related harm usually reaches the public one case at a time: a school in one country, a family in another, each easy to treat as an exception. This directory puts those cases side by side to help grassroots actors see where others face the same issues they do, and to help governments and regulators see the bigger picture of the harms occurring. The directory describes what its records contain. It does not measure how often these harms occur, and a country with few records may simply have little published about it.
How to use this directory: Topics are filterable for FARO reports that have already been created based on these incidents. The harms and response patterns shown are those featured there. To see the incidents used in a country-specific report, choose that country under Country report. Pick a pattern or evidence type to see on the map which countries have matching records. Click a country on the map or in the list to see its records below. Use the filter to search for keywords or specific sources.
Shaded countries have at least one record. Choose a pattern to see where it appears.
Shading shows only that a country has at least one record in this directory that matches your selection, and every shaded country looks the same on purpose. It says nothing about how often these harms occur there. Pattern filters only cover records classified so far, and small countries are easy to miss on a map, so use the list as well.
In the list but not drawn on the map: Multiple countries, Not stated.
A parent reported that a 6-year-old child viewed violent movie trailers through a platform used at school. Following the exposure, the child began experiencing nightmares. The parent questioned the educational use of the platform after the incident. This is a personal interview. Source available to SHIELD.
On January 26, 2019, an unauthorized attacker exploited a SQL injection vulnerability in the website of a school in Spain. The attacker gained unauthorized access to the website's user database and compromised the personal details of 1,555 registered extranet users, including parents and staff members. The exposed personal data included names, national ID (DNI) numbers, cooperative member numbers, email addresses, and encrypted passwords.
View sourceFive minor students running for their high school's student council had their full names and national identity card (DNI) numbers exposed online after another student photographed their election ballots and uploaded the image to Instagram. The ballots had been incorrectly generated with the DNI numbers by a regional school management system. The unauthorized post was shared with approximately 250 people before the school intervened and coordinated with the platform to have the image removed.
View sourceSpain's Fiscalía de Menores (Juvenile Prosecutor's Office) opened an investigation into three minors at a school accused of using AI applications to generate sexualized deepfake images and videos from real photographs of 61 people, including 22 minors and several teachers, taken from social media, and distributing this material among students at the school. Police recovered over 100 files as part of the investigation.
View sourceThe Spanish Data Protection Agency (AEPD) fined an educational center €20,000 (reduced to €12,000) for deploying Google Workspace for Education without properly informing families or obtaining lawful consent. An investigation triggered by a parent's complaint revealed that the school processed the personal data of more than 500 students, including minors under 14, without a valid legal basis or a compliant data protection impact assessment regarding international data transfers.
View sourceA school in Andalusia, Spain, restricted students' access to individual tablets, laptops, and the 'Educamos' digital educational platform if their families did not pay an annual ICT fee. As a result, affected students were forced to share devices and rely on physical paper agendas, which lacked the exclusive communication and schoolwork content uploaded to the digital platform. Following complaints from affected families, regional educational authorities launched an investigation into the school.
View sourceEach record is a short summary of an incident described in a public source or collected through an interview by SHIELD or its partners. Records are reviewed by people before they appear here. Names and identifying details are removed: where a person appears, a role, age band and gender stand in for the name, and dates and places for minors are generalised. Every record links to its original source and shows the date that link was last checked. Records are classified with shared harm categories. The classification is SHIELD's own, so it can differ from how a source describes the incident.
You are welcome to read, link to and quote individual records with credit to FARO. Please do not copy, scrape or republish the dataset in bulk, or use it to train or test automated systems, without written permission. To ask for permission, use the SHIELD contact form. The original sources keep their own rights, and the link on each record leads to them.
SHIELD-APS. Frontline Record of Online Harms (FARO). DIRECTORY-URL. Accessed [date]. To cite a particular selection, use the web address shown after you set the filters.
When you rely on the facts of an incident, cite the original source it links to. When you rely on the classification, the patterns or the country report, cite FARO. Please describe the records as documented incidents and do not present counts or country coverage as how often these harms happen. A country with few records may simply have little published about it.
If a record is wrong, a link no longer works, or you are described in a record and want it changed or removed, use the SHIELD contact form and include the title of the record. We review each request and update or remove the record where the request is justified.
Know of a documented incident that belongs here? Send it through the incident form. A public source, such as a news report, a court or regulator decision, or a research publication, helps us verify it quickly. Submissions without a public source are kept anonymous and are not tied to named products or companies. Please leave out the names of children and of anyone who has not agreed to be named. Submissions are reviewed before anything is published, and sending one does not guarantee a record.
