FARO stands for Frontline Record of Online Harms. Technology-related harm usually reaches the public one case at a time: a school in one country, a family in another, each easy to treat as an exception. This directory puts those cases side by side to help grassroots actors see where others face the same issues they do, and to help governments and regulators see the bigger picture of the harms occurring. The directory describes what its records contain. It does not measure how often these harms occur, and a country with few records may simply have little published about it.
How to use this directory: Topics are filterable for FARO reports that have already been created based on these incidents. The harms and response patterns shown are those featured there. To see the incidents used in a country-specific report, choose that country under Country report. Pick a pattern or evidence type to see on the map which countries have matching records. Click a country on the map or in the list to see its records below. Use the filter to search for keywords or specific sources.
Shaded countries have at least one record. Choose a pattern to see where it appears.
At least one matching recordNo matching recordSelected country
Shading shows only that a country has at least one record in this directory that matches your selection, and every shaded country looks the same on purpose. It says nothing about how often these harms occur there. Pattern filters only cover records classified so far, and small countries are easy to miss on a map, so use the list as well.
Register password spread through student chats; about 40 students changed entry times and absence justifications, Emilia-Romagna, Italy
After an upper secondary school student obtained the password to the school's electronic register, the password spread quickly through student chat groups. Approximately 40 students used the access to modify their school entry times and absence justifications. The students faced potential suspension and potential criminal complaints for unauthorized access to the school's system. It is not stated in the source who first noticed the breach. The school's response was directed at the students; the source does not state whether the password or access controls were updated.
Remote Contractor Unable to Withdraw Funds from Digital Payment Platform
A remote contractor located in Texas, USA, received their platform earnings on a digital payment platform but was blocked from withdrawing or utilizing the funds in any way. The contractor was left unable to access their earned money and sought help from other users online to resolve the issue.
Remote worker faces unauthorized PayPal withdrawal attempt and unpaid wages after sudden platform ban
A remote worker was permanently suspended without explanation from an AI training platform where they had worked for two months. Following the suspension, the platform attempted to withdraw approximately $2,000 from the worker's connected payment account, which the worker had to dispute through their financial provider to recover. Additionally, the platform withheld payment for the worker's final completed tasks.
Remote worker misled into paying for third-party subscription with minimal compensation
An applicant was prompted by a remote work platform to purchase a paid subscription to a third-party generative AI service under the promise of accessing more tasks. Despite purchasing the subscription, they were never assigned any jobs and were compensated only three dollars after completing eight hours of testing.
Repeated intrusions with pornographic and violent videos into online lessons at an Italian high school; head warns parents
Anonymous intruders repeatedly entered online lessons at an upper secondary school in Tuscany, Italy, talking over the teacher and showing extremely violent films and pornographic videos; students disconnected on teachers' instructions, and smaller episodes occurred in other regional schools. The school head informed local postal police and law enforcement, and wrote twice to parents, the second time after a further intrusion in March, warning that the intruders needed a student to share the lesson link and that students who did so risked a criminal complaint.
Report identifies expansion of facial recognition in Brazilian schools
A report by InternetLab documented expansion of facial recognition technologies across state and municipal schools raising privacy and surveillance concerns for school communities.
Romanian educational platform used marketing cookies to target students with advertising
ȘcoalaIntuitext, a Romanian learning platform recommended by Romania's Education Ministry, says in its privacy policy that it installs 23 marketing cookies to target its students with behavioral advertising across the internet. The cookies excerpted in the report come from Meta, Google (AdSense and DoubleClick), Hotjar and Zendesk. Its operator, Softwin, told HRW the product is dedicated first to teachers and educators and only in a subsidiary way to children or their parents.
Russian students using an educational platform were exposed to commercial data collection systems
Digital Lessons, a Russian educational website built and operated by the government, was one of eight websites HRW found using canvas fingerprinting, which assigns a unique number to a user's device to track activity across the internet and is virtually impossible for users to block. None of the eight disclosed its use. HRW also lists Digital Lessons among websites using Yandex session recording and key logging.
Russian students using My School is Online had data transmitted to advertising ecosystems
My School is Online, a Russian government educational website, was found by HRW to use Yandex session recording and key logging. Session recording lets a third party watch and record a user's behavior on a page, and Yandex describes its tool as recording clicks, scrolls, keystrokes and mouse movements. HRW's table of government-built products lists it as having no privacy policy.
Safeguarding records disclosed to children in classroom environment
Sensitive personal and special-category safeguarding information relating to four individuals including three children was disclosed in a classroom environment through school systems. Children were exposed to confidential information not intended for them resulting in a personal data breach.
School answered two teachers’ union complaints in one certified email, disclosing one teacher’s health information
At a school in Italy, two teachers filed separate union complaints about class assignments on the same day, and the school answered both with a single document sent in one certified email. The document contained health information about one teacher.
School app exposed child to games and YouTube content without parental awareness
A parent discovered that a school-provided application used for communication, homework, and school information also included games and direct links to YouTube videos. The parent reported being unaware these features existed within the student's version of the app. The consequence was unexpected exposure to non-educational content and lack of parental awareness regarding the child's digital environment. This is a personal interview. Source available to SHIELD.
Source: SHIELD - APS, Italy
Date source link verified: 14/10/2026
Technology in Education
ZimbabweNews article
School bullying assault recorded and circulated online
A senior pupil was filmed assaulting a junior pupil while other students recorded the incident. The video circulated online leading to disciplinary proceedings.
School district monitors students with AI surveillance software
School officials implemented an AI tool to scan students' school-issued accounts, documents, emails, and chats for concerning language. Students filed a lawsuit alleging that the constant automated monitoring created an environment of continuous surveillance and chilled their personal expression.
School Electronic Register Error Exposes Minor Student’s Individualized Education Plan to Class Parents
A support teacher at a school in Italy mistakenly configured the visibility settings on the school's electronic register while uploading an Individualized Education Plan (PEI). This error made a minor student's sensitive educational and disability records visible to all parents of the classroom for approximately 22 minutes. During this window, another parent saw the notification, took a screenshot, and shared it in a class messaging group. The student's parents subsequently retained an attorney and filed a formal complaint with the Italian Data Protection Authority, which issued an official reprimand to the school.
Source: Garante per la protezione dei dati personali
School email to about 37 families with visible addresses reveals children missing vaccination paperwork; school asks email software vendor for a warning, Lombardy, Italy
Parents complained through a lawyer that the school sent a vaccination-compliance reminder to about 37 families with all addresses visible, revealing which children were not in order. The school notified a data breach, retrained staff, and asked the software house that supplies its email program to add a warning whenever several recipients are entered. The Italian Data Protection Authority (Garante) found an unlawful communication of health data and fined the school EUR 1,000. The family first noticed. Responses acted on the school and, through its request, the vendor's tool. Whether the vendor added the warning is not stated in source.
Source: Garante per la protezione dei dati personali
School Employee’s Sensitive Medical Data Exposed via Document Management Software
An employee of a school in Italy had their highly sensitive medical information and labor dispute details exposed to 14 coworkers. The incident occurred when an administrative worker mistakenly uploaded the employee's court documents onto the ordinary registry of the school's document management software instead of the restricted, reserved protocol. Consequently, the employee filed a formal warning demanding the removal of the files and lodged a complaint with the Italian Data Protection Authority, which resulted in a regulatory fine of €1,000 for the school.
Source: Garante per la protezione dei dati personali
School fees fraud and payment portal tampering at a Nigerian university
An audit at a Nigerian university found that hundreds of students had paid tuition fees into a former employee's personal account instead of official university accounts. The university alleged that many students participated because they were offered discounted fees or commissions and referred the students to disciplinary proceedings as part of a wider fraud investigation involving more than ₦457 million.
School iPad transmitted substantial traffic to advertising networks
An IT professional analyzed a first-grade student's school iPad and found that approximately 20 to 24 percent of its traffic was associated with advertising networks. According to the account, the traffic appeared focused on behavioral tracking. The reported consequence was collection of children's data without their consent.
School principal secretly recorded female staff in restroom using mobile phone
Female teachers at a school in Chhattisgarh, India, discovered a mobile phone hidden in the women's restroom set to record video. A subsequent police complaint revealed that the school principal had been placing his phone there for two months to record the staff, leaving the female teachers distressed and fearful.
School Refuses Paper Homework Accommodations for Female Student After Device Removal for Mental Health
A parent reported removing digital devices from their child for mental health reasons, after which the child's school continued to rely on online-only homework systems and was unwilling or unable to provide equivalent paper-based work. The parent cited the incident as an example of increasing dependence on digital platforms in schools.
School surveillance cameras hacked and student video feeds streamed online
Hackers accessed surveillance cameras at several schools and livestreamed video feeds online. Students captured on the cameras experienced a privacy breach. This is a personal interview. Source available to SHIELD.
School officials in a Pennsylvania school district utilized remote activation software on school-issued laptops to covertly capture images of students inside their homes. This surveillance violated the students' privacy rights, leading to legal action and a subsequent financial settlement.
School WhatsApp Group Used to Distribute Intimate Images of Student without Consent
A high school student in Zimbabwe had intimate, naked photographs shared to a school WhatsApp group by a former boyfriend. As a result, the student experienced severe fear, stopped attending school, and contemplated suicide.
Secondary School Student Penalized with Detentions Due to Managed School iPad Repair Delay
A female secondary school student's mandatory learning iPad developed a technical fault and was sent to the vendor for repair. While the vendor delayed resolving the issue and the device remained missing in transit, the student was repeatedly penalized with demerits and detentions by her school for not having the device in class. The issue was only resolved after the student's parent filed a formal complaint with the vendor's CEO and posted about the situation on LinkedIn.
Secondary School Student Receives Detention Over Mandatory Use of Reading App
A male secondary school student in the United Kingdom received a school detention for failing to complete his homework through a mandatory reading application. The school required all reading to be logged through the software, which strictly limits book selection, controls reading speed, and requires completing AI-generated quizzes. The student ultimately chose to accept recurring weekly detentions instead of using the application, which his parents argued ruined his enjoyment of reading.
Secondary school student required to use WhatsApp and gained unavoidable access to AI chatbot
A parent reported that a secondary school teacher required class communication through WhatsApp. After Meta AI was integrated into the platform, the child (a secondary school student) gained access to an AI chatbot that could not be deactivated or restricted. The parent reported being unable to prevent their child's access to the AI tool while maintaining necessary participation in school-mandated communications. This is a personal interview. Source available to SHIELD.
Source: SHIELD - APS, Italy
Date source link verified: 14/10/2026
Technology in Education
NigeriaNews article
Secondary School Teachers Forced into Salary Deductions for Mandatory ICT Tablets
A state education board issued a directive requiring secondary-school teaching and non-teaching staff to either purchase ICT tablets or enroll in a salary-deduction scheme through a private vendor. The directive reportedly stated that failure to comply could affect eligibility for promotion, prompting criticism that educators were being required to personally fund workplace technology despite low salaries
Sextortion of Teenage Girls by High School Coach on Snapchat
A group of teenage girls as young as 14 in New Mexico were targeted on Snapchat by a high school coach. The coach utilized the platform's communication features to extort and coerce the girls into sending sexual videos of themselves.
Source: United States District Court for the Northern District of California
Singapore – soft-porn-bordering content accessed via Dailymotion on school-issued learning devices
A father discovered that his two secondary-school-aged children could access video content bordering on soft pornography via the Dailymotion platform on their school-issued Personal Learning Devices (PLDs), despite device management applications intended to block undesirable content. He reported the issue to Singapore's Ministry of Education in March 2026, and the ministry confirmed it blocked the Dailymotion website in response within days. The Ministry stated it takes proactive and reactive action to review and block undesirable sites and offered to meet directly with the parent. This case is notably well-documented and government-confirmed, with a clear, fast institutional response following a single parent's report.
Each record is a short summary of an incident described in a public source or collected through an interview by SHIELD or its partners. Records are reviewed by people before they appear here. Names and identifying details are removed: where a person appears, a role, age band and gender stand in for the name, and dates and places for minors are generalised. Every record links to its original source and shows the date that link was last checked. Records are classified with shared harm categories. The classification is SHIELD's own, so it can differ from how a source describes the incident.
Using the directory
You are welcome to read, link to and quote individual records with credit to FARO. Please do not copy, scrape or republish the dataset in bulk, or use it to train or test automated systems, without written permission. To ask for permission, use the SHIELD contact form. The original sources keep their own rights, and the link on each record leads to them.
How to cite
SHIELD-APS. Frontline Record of Online Harms (FARO). DIRECTORY-URL. Accessed [date]. To cite a particular selection, use the web address shown after you set the filters.
When you rely on the facts of an incident, cite the original source it links to. When you rely on the classification, the patterns or the country report, cite FARO. Please describe the records as documented incidents and do not present counts or country coverage as how often these harms happen. A country with few records may simply have little published about it.
Corrections and removals
If a record is wrong, a link no longer works, or you are described in a record and want it changed or removed, use the SHIELD contact form and include the title of the record. We review each request and update or remove the record where the request is justified.
Report an incident
Know of a documented incident that belongs here? Send it through the incident form. A public source, such as a news report, a court or regulator decision, or a research publication, helps us verify it quickly. Submissions without a public source are kept anonymous and are not tied to named products or companies. Please leave out the names of children and of anyone who has not agreed to be named. Submissions are reviewed before anything is published, and sending one does not guarantee a record.
Manage Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
