Recent advances in artificial intelligence (AI) and other technologies have expanded states’ capacity to monitor, categorize, and predict human behavior. In the Gulf, states such as Saudi Arabia and the United Arab Emirates (UAE) have unveiled national strategies for embedding AI in citywide infrastructure to create “smart” cities that emphasize public safety and efficiency. To guide the implementation of these strategies, GCC states have developed so-called ethical AI frameworks that, on the surface, reflect the ideals of the European Union AI Act (2024). These GCC frameworks, however, exempt security applications from their responsible-use provisions, giving governments significant latitude to deploy AI on national security grounds in ways that may violate their citizens’ civil rights. Critics suggest that many states are attempting to “ethics-wash”—to promote a false image of ethical concern—their implementation of mass surveillance technologies, while avoiding genuine transparency and accountability. These concerns are not unique to the Gulf or the Middle East, but are also causing alarm in the United States.
The development of smart cities in the Gulf has taken different forms in each national strategy. The means, however, are markedly similar: embedding surveillance technologies that collect biometric data and behavioral information in citywide infrastructure and using that data for algorithmic predictive policing practices. In the absence of meaningful regulation, the cases of Saudi Arabia and the UAE illustrate how “ethical” AI and surveillance frameworks mask the reality of no real accountability for states and leave civil society organizations as the most viable actors to monitor and document the harms of state-sponsored surveillance.
The Institutionalization of Mass Surveillance
Days before the October 2, 2018, killing of Saudi journalist Jamal Khashoggi, phone devices belonging to some of his friends and family members reportedly were infected with Pegasus, a sophisticated spyware developed by the Israeli firm NSO Group. The spyware provided access to their chat logs with Khashoggi and allowed the Saudi government to track his travel plans and movements, capabilities that were then used to entrap and assassinate Khashoggi during his visit to the Saudi consulate in Istanbul. (In 2021, the US government concluded that Saudi Prince Mohammed bin Salman had ordered the killing.) The Khashoggi murder illustrated states’ willingness to deploy targeted surveillance, or espionage, technology against dissidents. In addition, the UAE reportedly surveilled a prominent Saudi activist residing in the Emirates and funneled intelligence back to Riyadh, leading to her arrest.
Sophisticated tools like Pegasus are designed to conduct surveillance of specific individuals. The Gulf states also have the capacity to use AI for mass surveillance. In 2019, the founding of the Saudi Data and Artificial Intelligence Authority (SDAIA) marked an expansion in the technological capacity of surveillance systems for groups. The SDAIA was created to oversee the “National Strategy for Data and Artificial Intelligence” (NSDAI), a core component of the kingdom’s Vision 2030 agenda, which seeks to diversify the kingdom’s economy partly by positioning the country as a global leader in AI. The NSDAI’s first phase targets five sectors for AI integration—education, healthcare, energy, mobility, and government—embedding AI into the infrastructure of daily life across nearly every sector of Saudi society. Saudi Arabia’s economic incentives for AI integration are wide-ranging in these sectors: strengthening prevention against health threats, promoting efficiency in government services, and improving urban traffic safety, among other goals. But it also poses threats to privacy and other rights.
The SDAIA’s 2023 “AI Ethics Principles,” require AI systems to be “ethically permissible and aligned with human rights and cultural values.”
To mitigate risks such as bias and discrimination that are often associated with AI tools, the SDAIA’s 2023 “AI Ethics Principles,” established by royal decree, require AI systems to be “ethically permissible and aligned with human rights and cultural values.” The principles also state that designing “AI systems that result in profiling individuals or communities” is generally prohibited, as is using AI systems for “social scoring or mass surveillance programs.”
A closer look at the Principles reveals that the ethical framework is not legally binding and that the SDAIA lacks the power of enforcement. Together with the expansion of AI monitoring systems, the lack of meaningful regulation creates conditions in which the authorities could use surveillance technologies to discreetly compile sensitive information for political purposes. The scale of this infrastructure is already visible in Riyadh, where the municipality has deployed more than 1,600 AI-powered cameras across public parks and squares, forming an integrated monitoring network designed to detect “unsafe or irregular behavior” and to promote “responsible public behavior” among residents. The definition of what constitutes responsible public behavior, however, is left entirely to the state.
Predictive Policing and Commercial Partnerships
In 2017, the UAE introduced its own “National Strategy for Artificial Intelligence” that articulates the country’s goals in implementing AI across sectors and promises improvements in education, government, and “community happiness.” Although the strategy outlines the UAE’s commitment to responsible AI, in practice what has emerged in the surveillance industry is a centralized infrastructure deployed for what authorities call “proactive safety” measures. These measures rely on biometric data and facial recognition to flag “suspicious” behavior using predictive analytics. In other words, proactive safety measures purportedly allow state officials to anticipate crime before it is committed.
These surveillance technologies have been embedded within public spaces and citywide infrastructure in the Emirates, and continuously monitor and analyze personal behavior with little transparency regarding data collection and storage practices. For instance, the AI-enabled surveillance system Oyoon combines AI analytics with CCTV feeds operationalized through partnerships with malls and hotel chains across Dubai. Oyoon “uses AI-powered video analysis to detect and predict crimes in real time.” In Abu Dhabi, the Monitoring and Control Centre leads the Safe/Secure City Initiative, which integrates “biometric access control into everyday transactions.”
The machine learning algorithms behind these AI systems have several shortcomings. For example, these models are trained on lighter-skinned faces and features, resulting in systematically higher error rates for darker-skinned women. Though these disparities may also be influenced by non-demographic factors such as hairstyles and makeup, they are partly shaped by culture and gender. In the context of predictive policing, the substantial error rate for darker-skinned women means that the algorithm may misidentify such women for “suspicious” behavior at a much higher rate than lighter-skinned men. The disproportionate rate of misidentification raises serious ethical, civil, and political concerns, particularly given that 88 percent of the UAE’s resident population is comprised of migrant workers, the demographic most likely to bear the burden of algorithmic error and the least well positioned to seek redress.
In addition to these infrastructure systems, there are examples of states broadening their surveillance efforts to social media apps and messaging platforms. One Emirati firm developed a messaging app, ToTok, that was later identified as a spying tool used to track individual devices. In 2019, ToTok was removed from app stores after a New York Times investigation found the app tracked users’ conversations, movements, relationships, and device activity in their entirety, and allowed unauthorized access to users’ devices. ToTok’s ties to Dark Matter Group, the firm responsible for a secret Emirati intelligence program called Project Raven, may suggest that the app was not merely a corporate surveillance tool but an instrument of state intelligence. Unlike infrastructural surveillance systems confined to UAE territory, ToTok had been available for download globally, potentially making the UAE’s surveillance apparatus capable of reaching beyond its borders. As AI-powered applications become increasingly embedded in daily life worldwide, the example of ToTok illustrates how states can weaponize consumer technology as instruments of transnational surveillance.
The use of surveillance software to track individuals presents an array of concerns, especially regarding the rights and freedoms of people surveilled
The use of surveillance software to track individuals presents an array of concerns, especially regarding the rights and freedoms of people surveilled. For example, the deployment of these tools in the UAE has been coupled with repressive laws criminalizing speech and political activity. Laws such as Terrorism Law No. 7 of 2014 and Federal Law No. 34 of 2021 on Combatting Rumors and Cybercrime have been used to imprison activists such as human rights defender Ahmed Mansoor. In 2024, Mansoor, along with 52 other defendants, was charged with “establishing and managing a clandestine terrorist organization in the UAE known as the ‘Justice and Dignity Committee.’” This charge resulted in an additional 15 years on top of his 2018 ten-year conviction; his co-defendants received sentences ranging from 10 years to life imprisonment. The evidence used against him was drawn from his emails and WhatsApp messages with organizations such as Human Rights Watch and Amnesty International. Without legally binding frameworks, these systems of surveillance risk normalizing the criminalization of dissent and the targeting of activists, racial minorities, and indeed any person under the guise of public safety.
Toward Accountability and Reform
The surveillance infrastructure documented in the Gulf has not emerged despite these ethical technology frameworks, but alongside them as mechanisms designed to project accountability rather than to enforce it. The accountability gap that arises from the lack of legal enforceability is a function of deliberate design: States have little incentive to empower the institutions of oversight that would constrain them. Left unaddressed, AI governance in the form of ethics-washing provides a model that opaque governments around the world may be inclined to adopt.
International mechanisms offer little recourse. Any binding framework modeled on the EU’s AI Act would remain aspirational as long as it depends on state-led political will alone. The prospects for a dedicated United Nations oversight body are undermined by the ongoing marginalization of intergovernmental institutions by the United States and other governments. The challenge is further complicated by the growing alliances between transnational surveillance firms and states themselves, making accountability more difficult to enforce.
Where international regulations and state-led policies fall short, civil society organizations and legal advocates have been working to hold technology firms and governments accountable. Strategic litigation, investigative journalism, and public accountability campaigns serve as pragmatic tools to constrain the expansion of surveillance infrastructure. But these efforts face real limitations, as illustrated by the imprisonment of human rights advocates in contact with international civil society organizations. Beyond the risk of repression, civil society organizations are often underfunded and stretched thin, weakening their ability to sustain long-term pressure on surveillance infrastructure. Such challenges limit the effectiveness of civil society efforts in AI governance and reduce their capacity to monitor and challenge excessive state surveillance.
The limitations of civil society make the case for transnational coordination even stronger. Although the Gulf frameworks may appear hollow, they offer an opening for accountability, as they represent an acknowledgement that surveillance requires justification. That acknowledgment is a pressure point that civil society can exploit by calling for states to be accountable to their own publicly stated principles. Civil society can expose the gap between stated values and actual practice as a basis for demanding accountability, thereby challenging the ethics-washing approach that these states have adopted to legitimize surveillance while avoiding scrutiny. Coordinated transnational civil society campaigns can pressure multilateral institutions to establish a binding international legal framework that incorporates enforceable accountability mechanisms, closing the gap between hollow commitments and meaningful reform. Until that pressure produces results, the smart cities of the Gulf and elsewhere may continue to promise progress while deepening government control.
The views expressed in this publication are the author’s own and do not necessarily reflect the position of Arab Center Washington DC, its staff, or its Board of Directors.
Featured image credit: Milkovasa via Shutterstock
