{"id":1923,"date":"2026-07-26T09:54:16","date_gmt":"2026-07-26T06:54:16","guid":{"rendered":"https:\/\/imru.ekke.gr\/?page_id=1923"},"modified":"2026-07-26T10:16:09","modified_gmt":"2026-07-26T07:16:09","slug":"beyond_the_border","status":"publish","type":"page","link":"https:\/\/imru.ekke.gr\/index.php\/blogs\/beyond_the_border\/","title":{"rendered":"Beyond the Border: How AI-enabled Surveillance Tools Turned Social Media into a Migration Control Apparatus"},"content":{"rendered":"\n
\n
\n

Beyond the Border: How AI-enabled Surveillance Tools Turned Social Media into a Migration Control Apparatus<\/h1>\n\n\n

The cancellation of Frontex’s social media surveillance project in 2019 seemed to represent a victory for fundamental rights. Yet the same surveillance vision quietly resurfaced 28 months later, through the Hellenic Coast Guard.<\/p>\n\n\n\n

<\/div>\n\n\n\n

27\/07\/2026 | 7 minutes read<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n
\n
\n
\n
\n
\"\"<\/figure>\n\n\n\n

Eleftherios Chelioudakis<\/strong><\/p>\n\n\n\n

Eleftherios is a data protection lawyer and serves as Executive Director of the Greek digital rights organisation Homo Digitalis<\/a>. He is also a PhD candidate at the School of Engineering of the University of the Aegean and a member of the European Commission’s AI Act Advisory Forum.<\/p>\n\n\n\n

His latest publication is a book chapter in the open-access volume Transgressive Tech: The Privatization of the Public Interest<\/a>.<\/p>\n<\/div>\n\n\n\n

<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
\n

<\/p>\n\n\n\n

In September 2019, an unusual tender call was published<\/a> in the EU Funding portal. The European Border and Coast Guard Agency, Frontex, planned to give up to \u20ac400,000 to a surveillance company to monitor social media, profile users, and predict future irregular migration flows towards EU external borders. More precisely, based on the tender\u2019s Terms of Reference<\/a>, the project aimed to analyse social media use in regions associated with migration flows towards the EU, with a particular focus on the online activities of migrants, smugglers, civil society organisations, and diaspora communities. It was intended not only to map the existing social media landscape but also to develop a strategic warning system capable of identifying emerging socio-political, economic, and security developments that could influence migration dynamics and pose challenges to Frontex’s policies.<\/p>\n\n\n\n

However, less than two months later, in November 2019, Frontex had to cancel<\/a> the tender, following scrutiny by journalists at MEDIAPART <\/a>and legal interventions by civil society organizations, such as Privacy International and Statewatch<\/a>, questioning the agency’s compliance with its obligations under EU data protection law. Specifically, Privacy International challenged the legality of Frontex’s social media monitoring tender by questioning its compliance with Regulation (EU) 2018\/1725. It argued that the project would entail the processing of personal data and therefore required Frontex to identify the legal basis for the processing, conduct a Data Protection Impact Assessment (DPIA), consult the European Data Protection Supervisor (EDPS) where necessary, and demonstrate how it would comply with key data protection principles and safeguard individuals’ rights.<\/p>\n\n\n\n

The cancellation of this tender represented a significant victory for the protection of fundamental rights at EU level<\/mark><\/em>, demonstrating the crucial role of data protection law in constraining unlawful surveillance initiatives. While the EU\u2019s data protection framework is not without shortcomings, it nevertheless imposes important legal constraints on the extent to which EU institutions, public authorities, and private actors may engage in surveillance-oriented data processing activities.<\/p>\n\n\n\n

Yet, just 28 months later, another coast guard authority, the Hellenic one, succeeded where Frontex had failed. <\/p>\n\n\n\n

More precisely, in February 2022, researcher Phoebus Simeonidis uncovered, in \u201cDiavgeia\u201d, the Greek government’s official portal for the mandatory online publication of public administration acts and decisions, a tender issued by the Hellenic Coast Guard for the upgrade of its computer room<\/a>. Among the components of this broader procurement was the acquisition of an AI-enabled social media monitoring software, capable of profiling individuals on social media and instant messaging apps, monitoring migration-related communications across these platforms, and predicting migration flows towards EU external borders in Greece. The project had a total budget of \u20ac726,000 (including VAT) and was co-funded by the European Union through the Internal Security Fund (ISF). <\/p>\n\n\n\n

Thus, what Frontex had been unable to pursue at the EU level appeared to be reintroduced through a national procurement process, effectively advancing the same surveillance vision via the Hellenic Coast Guard<\/em><\/mark>.<\/p>\n\n\n\n

The software, according to the detailed description in Annex D<\/a> of the tender call, was expected to cover Facebook, Twitter, VK, Xing, Instagram, and Telegram. Its required functionalities included using bots to map users’ social networks and interactions (such as friends, followers, comments, posts, and likes), identify user accounts through advanced search capabilities, and simulate human activity to avoid automated account blocking. As an example, for Facebook, the software was expected to collect public contact lists, second-degree connections, timeline posts, images, videos, comments, reactions, profile information (including employment, residence, and education), as well as enable searches based on personal characteristics. For Telegram, it was expected to store the identities of participants in group conversations involving up to 10,000 users, together with the complete contents of those conversations, including text, photographs, and other shared material.<\/p>\n\n\n\n

As soon as the tender was uncovered in February 2022, Homo Digitalis, Privacy International, the Hellenic League for Human Rights, HIAS Greece and researcher Phoebus Simeonidis collectively submitted<\/a> a request before the Hellenic Data Protection Authority to investigate this case and assess its compliance with the applicable rules on data protection. The DPA accepted the joint complaint and launched an investigation<\/a> in the same month.<\/p>\n\n\n\n

It is therefore evident that the software was intended to enable the large-scale monitoring of an unlimited number of users across multiple social media platforms, as well as the collection and analysis of their personal data. However, the tender did not identify the specific purposes of the processing operations, the legal bases authorising such processing, or the safeguards required to ensure compliance<\/a> with EU data protection law, including the conduct of a Data Protection Impact Assessment (DPIA).<\/p>\n\n\n\n

Accordingly, the procurement of this software, designed to facilitate large-scale social media monitoring, raised serious concerns that it could enable mass surveillance and undermine compliance with the principles of lawfulness, purpose limitation, and data minimisation, as enshrined in both EU and national data protection law.<\/em><\/mark><\/p>\n\n\n\n

Furthermore, the creation of fake AI-generated accounts designed to simulate human activity was contrary to the terms of service of the social media and instant messaging platforms identified in the tender.<\/p>\n\n\n\n

Nevertheless, despite the serious legal concerns raised and the Hellenic DPA\u2019s investigation, the procurement process continued uninterrupted. Based on publicly available information<\/a> published on the Diavgeia Portal, the contract was awarded in September 2022 to a consortium of two Greek companies, namely BYTE S.A. and GRIVAS S.A., while the software and the tools developed were delivered to the Hellenic Coast Guard in March 2023. The final payment was completed<\/a> in November 2023, bringing the procurement process to its conclusion.<\/p>\n\n\n\n

By creating a social media ecosystem of constant monitoring, technologies like those available to the Hellenic Coast Guard extend the border far beyond the physical border crossing points and contribute to what scholars describe<\/a> as the internalisation of borders. In this sense, border control no longer operates solely at the geographical boundary<\/a> but becomes embedded in everyday life through pervasive practices of surveillance, policing, and data collection<\/em><\/mark>.<\/p>\n\n\n\n

Such forms of border internalisation have important implications for data protection, privacy and freedom of expression, amongst other rights. <\/em><\/mark> <\/p>\n\n\n\n

When public authorities systematically collect information from online platforms, monitor online discussions, and construct profiles of individuals, people on the move and people who stand in solidarity with them, such as activists, journalists and human rights defenders, may be discouraged from expressing their views, seeking information, or participating in online communities for fear of being identified, monitored, or subjected to migration enforcement measures.<\/em><\/mark><\/p>\n\n\n\n

The lack of publicly available information regarding the deployment and operation of the system significantly undermines transparency and makes it difficult to assess its compliance with data protection law. At the same time, the prolonged duration of the Hellenic DPA\u2019s investigation has perpetuated uncertainty as to whether the system has been deployed or used in practice, and, if so, under what legal and operational safeguards. <\/p>\n\n\n\n

The Hellenic Coast Guard tender demonstrates how surveillance initiatives that encounter legal obstacles at the EU level may nevertheless re-emerge through national authorities, even co-financed with EU funds. <\/p><\/blockquote><\/figure>\n\n\n\n

As border management increasingly extends into the digital sphere, ensuring meaningful oversight of such technologies is no longer merely a matter of regulatory compliance but a prerequisite for safeguarding the rule of law and fundamental rights in the European Union. The role of investigative journalism, civil society organisations, and independent supervisory authorities in scrutinising the deployment of such AI systems is indispensable.<\/p>\n\n\n\n

\n\n\n\n

The views and opinions expressed in this article are those of the author and do not necessarily reflect the official position of the Interdisciplinary Migration Research Unit (IMRU) or the National Centre for Social Research (EKKE).<\/em><\/p>\n\n\n\n

\n\n\n\n
\n

Share this article:<\/strong><\/p>\n\n\n<\/div>\n\n\n\n

\n<\/div>\n<\/div>\n<\/div>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

The cancellation of Frontex’s social media surveillance project in 2019 seemed to represent a victory for fundamental rights. Yet the same surveillance vision quietly resurfaced 28 months later, through the Hellenic Coast Guard. 27\/07\/2026 | 7 minutes read Eleftherios Chelioudakis Eleftherios is a data protection lawyer and serves as Executive Director of the Greek digital […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":1049,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-1923","page","type-page","status-publish","hentry"],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/PhcU9x-v1","_links":{"self":[{"href":"https:\/\/imru.ekke.gr\/index.php\/wp-json\/wp\/v2\/pages\/1923","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/imru.ekke.gr\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/imru.ekke.gr\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/imru.ekke.gr\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/imru.ekke.gr\/index.php\/wp-json\/wp\/v2\/comments?post=1923"}],"version-history":[{"count":17,"href":"https:\/\/imru.ekke.gr\/index.php\/wp-json\/wp\/v2\/pages\/1923\/revisions"}],"predecessor-version":[{"id":1962,"href":"https:\/\/imru.ekke.gr\/index.php\/wp-json\/wp\/v2\/pages\/1923\/revisions\/1962"}],"up":[{"embeddable":true,"href":"https:\/\/imru.ekke.gr\/index.php\/wp-json\/wp\/v2\/pages\/1049"}],"wp:attachment":[{"href":"https:\/\/imru.ekke.gr\/index.php\/wp-json\/wp\/v2\/media?parent=1923"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}