When The World Cup Ends, The Surveillance Stays

Welcome to Memorandum Deep Dives. In this series, we go beyond the headlines to examine the decisions shaping our digital future. 🗞️

This week, the FIFA World Cup kicked off in Mexico City, opening 39 days of football across 16 cities in the United States, Mexico, and Canada. With 104 matches and an expected 6M fans, it is the largest tournament in the sport's history and, by some distance, the most closely watched, in every sense of the phrase.

Look past the opening ceremony and the group-stage drama, and you will notice something else moving through the venues. Robot dogs patrol the perimeters. Counter-drone systems scan the skies. Thousands of AI-enabled cameras read the crowds in real time, and every one of the 1,248 players has been biometrically scanned. The official reason is safety, and it is a reasonable one.

But a tournament this size is never only about the football. The technology arriving with it tends to lag behind, and the questions worth asking are not about what these systems do during matches. They are about what happens to all of it once the final whistle blows on July 19.

The most surveilled event ever staged

When the FIFA World Cup kicked off on June 11 in Mexico City, it brought with it something that had little to do with football. Spread across 16 cities in the United States, Mexico, and Canada and running through July 19, the tournament has become the site of one of the largest deployments of AI-powered surveillance technology ever seen at a civilian event. Robot dogs patrol security perimeters, counter-drone systems monitor the skies, thousands of AI-enabled cameras analyze crowds in real time, and every player undergoes biometric body scans. Surrounding 104 matches and an expected 6M fans is a security apparatus whose significance may outlast the tournament itself.

The immediate justification for enhanced surveillance technology is clear. An event of this scale faces genuine security risks, particularly as drones have become cheaper, more capable, and more widely available. Yet the World Cup is also serving another function. Major international events have long been used to test and normalize new security technologies. The systems being deployed today are intended to protect fans and players, but they also provide governments and security agencies with a rare opportunity to evaluate AI-driven surveillance, biometric monitoring, and autonomous security tools at massive scale. Which raises the question: what happens to the technology after the event?

What the technology actually does, and what it quietly collects

As of now, the known surveillance architecture comprises three distinct technology layers, and understanding each helps clarify why their combination carries implications beyond any individual system.

The first is the officiating layer. According to Lenovo, FIFA's official technology partner, all 1,248 players across the 48 competing nations were physically scanned before the tournament to generate photorealistic 3D avatars. Each scan took approximately 1 second and captured precise body-part dimensions, including limb lengths, proportions, and the exact physical geometry of each body part. During matches, those avatars sync in real time with a 500Hz sensor embedded in the Adidas match ball and with stadium-wide tracking cameras, allowing the semi-automated offside system to reconstruct any disputed moment using a player's actual body rather than a generic wireframe. The stated purpose is transparency, and it is a reasonable one: fans have long complained that VAR decisions rendered in stick-figure graphics feel abstract and unconvincing. A photorealistic reconstruction of why a goal was disallowed addresses that directly. It also produces, as a byproduct, a biometric dataset of elite athletes from 48 nations, with no publicly stated deletion timeline and no published restrictions on secondary use.

The second layer is venue management. Lenovo's digital twin technology, a continuously updated virtual replica of a physical space, maps all 16 stadiums in real time, tracking crowd flow, security deployments, and infrastructure status. If congestion builds at a gate, it appears on a command center screen before it becomes a crush. The crowd-safety value here is genuine: the 2021 Astroworld tragedy and the 2022 Seoul Halloween disaster both demonstrated how quickly crowd dynamics can become lethal without real-time monitoring. The same system that prevents those outcomes also means that every person moving through a venue is a continuously updating data point in a live model, and neither FIFA nor Lenovo has published a specification for how long that data is retained or who, beyond the security team, can access it.

The third layer is the perimeter. Boston Dynamics' Spot robots, deployed by Hyundai at the International Broadcast Center in Dallas and at MetLife Stadium in New Jersey, patrol for suspicious packages and hazardous materials. In Mexico, four K9-X robot dogs from an undisclosed manufacturer are stationed at BBVA Stadium, equipped with cameras, night vision, and communication systems. Boston Dynamics confirmed that its robots do not have facial recognition capability. The K9-X units arrived with no published technical specification at all, including no disclosure of who manufactures them, what their data retention settings are, or under what conditions their footage can be subpoenaed. Each of these systems has a defensible operational purpose. What none of them comes with is a binding answer to the question of what happens to the footage on July 20.

The pattern is older than the technology

Mega-events normalizing surveillance infrastructure is not a new phenomenon, which is precisely why the World Cup is worth examining as a case study rather than an isolated deployment. The 2012 London Olympics led to widespread permanent expansion of video surveillance across the British capital. Russia's use of voice recognition technology at the 2018 World Cup on an experimental basis has, according to France24, since been applied to suppress political opposition. The Paris 2024 Olympics deployed algorithmic video surveillance under a law framed as an Olympic exception. However, within months of the closing ceremony, French officials were publicly calling for it to become permanent, with the incoming prime minister promising to "generalize the methods experimented with during the Games."

The 2026 World Cup is following the same logic on a larger scale. The NYPD's counter-drone unit, built for the tournament, will continue operating after July 19 for planned events, hobbyist incursions, and terror investigations, as Commissioner Tisch confirmed. More tellingly, the $250 million in FEMA counter-drone grants flowing to World Cup host states is structured as the first tranche of a two-phase program. According to FEMA's grant documentation, a second $250M phase opens in fiscal year 2027, with eligibility expanded to all 56 state administrative agencies, including states that hosted no matches. The tournament was the occasion. The funding pipeline is permanent, and it was written that way before the opening whistle.

The civil rights friction

This is the point at which the security story and the civil rights story cease to be separable, because the surveillance infrastructure deployed for the World Cup does not exist in a political vacuum. It is being operated by agencies whose conduct during the same period has generated significant documented concern. More than 120 civil society organizations, led by the ACLU, issued a formal travel advisory in April warning that fans, players, journalists, and visitors could face serious rights risks at the U.S. portion of the tournament, citing invasive social media screening, racial profiling, and the confirmed presence of Immigration and Customs Enforcement (ICE) agents as part of the security apparatus.

The concern is grounded in documented incidents. According to Al Jazeera, Human Rights Watch documented a case in which an asylum seeker who attended the Club World Cup final in New Jersey the prior year was subsequently arrested by ICE and deported. Democratic legislators introduced three bills in May 2026 to prohibit civil immigration enforcement near World Cup venues and on public transit in host cities. When asked directly whether ICE would stay away from matches, the agency's head declined to give that assurance. None of the three bills had reached a floor vote by kickoff.

The structural issue runs deeper than any individual incident. AI cameras with behavioral analytics do not announce their presence to the people they monitor. They do not distinguish between a security mandate and an immigration enforcement mandate at the camera level. Those distinctions are made by policy, and policy can change without the hardware changing at all.

Reporters Without Borders captured this reality in practical terms, advising journalists covering the tournament to remove biometric authentication from their devices before traveling and to implement source-protection measures as if entering a sensitive reporting environment. That guidance applies in Mexico due to the particular dangers journalists there face. It applies in the U.S. because of the surveillance environment the World Cup has assembled around it.

The accountability gap that underlies all of it

The deepest problem is not the technology itself, nor even the specific agencies operating it. The accountability architecture governing this entire deployment is far thinner than the deployment itself.

Biometric privacy law in the U.S. is a patchwork that reflects no coherent national policy. Illinois' Biometric Information Privacy Act requires explicit written consent before collecting biometric identifiers and prohibits companies from profiting from that data. Chicago is a host city, so the law applies there. Dallas and New York have no equivalent statute. The 1,248 body scans collected by Lenovo's systems, therefore,e generate different legal exposure and different rights for the athletes involved depending on which stadium they happened to be standing in when the scan was taken. That is not a loophole someone exploited. It is simply the state of U.S. law, and the World Cup lands inside it without any bespoke framework to fill the gaps.

The diversity of the jurisdictions involved further compounds the problem. The venues are spread across three countries with different legal frameworks, and there is no overarching data-sharing agreement governing what can flow between them. Kaspersky's researchers found that 17% of public Wi-Fi networks across Mexico's three host cities lacked encryption, meaning the digital environment fans are navigating is itself poorly secured, independent of any official surveillance apparatus. The tournament's technology footprint extends from the stadium to the street, and its governance stops well short of its edges.

What July 20 looks like

The World Cup comes to a close on July 19, but the counter-drone units, the AI cameras, the digital twins, the grant-funded screening equipment, the biometric scans, and the legal precedents established or quietly bypassed during 39 days of football will not end with it. Sporting mega-events have always served as testing grounds for technologies that governments and vendors seek to normalize, and the World Cup is a particularly effective vehicle for that process because it compresses an enormous amount of infrastructure deployment into a window defined by celebration rather than deliberation. By the time deliberation begins, the infrastructure is already in place, budgeted for, and generating operational familiarity, making decommissioning feel unnecessary.