Keywords

Opening

In Chapter 3, I suggested that our algorithms had begun to participate in everyday life by becoming involved in establishing the account-able order of life in the airport and train station. I also suggested that this form of account-ability intersected with concerns of accountability , in particular in relation to the project’s ethical aims and the possibility of future data subjects being able to question the algorithm . You will recall that the project was funded in order to develop an algorithmic system that would reduce the amount of visual video data seen within a surveillance system and stored within such systems, without developing new algorithms. As we saw in the last chapter, the extent to which these ethical aims were achieved was not straightforward to assess as the system went through various forms of experimentation and change, the ethics board set up to hold the system to account raised new questions as the system developed and my own understanding of the system grew over time. One aspect of this unfolding experimentation and accountability that never disappeared even as the project moved towards more thorough system testing in the train station and airport was the focus on storing less data.

We have already seen that it took a great deal of effort to utilise algorithms to select out such matters as human-shaped and luggage-shaped objects and then to deem these relevant as, for example, abandoned luggage and issue an alert to operatives. What we have not seen yet is the struggle to delete the vast majority of data deemed irrelevant. Computer scientists from Universities 1 and 2 spent some time in meetings taking project members through conventions for deletion . Most forms of deletion , it turned out, either left a trace of the original from which data might be extracted or simply changed the route through which a user might connect to data (meaning the data itself would potentially be retrievable). The computer scientists, the consulting firm coordinating the project, the ethics board, StateTrack and SkyPort entered into discussion of what might provide an adequate form of deletion . For the computer scientists, changing the route for accessing information was an elegant solution (see Chapter 2 for more on elegance ): it was an available, standard practice, and it would satisfy the project’s ethical aims to the extent that it would match most other forms of deletion . However, the project coordinators sought a more thorough form of deletion —they were already looking to the potential market value (see Chapter 6) of a deleting machine. Expunging data from the system, overwriting data and corrupting data were all suggested as more thorough forms of deletion . Hence the algorithms would not just participate in making sense of everyday life, start to produce outputs that would subtly compose everyday life and become a feature of the everyday (on this, see Chapters 5 and 6): the algorithms would also start to delete, remove and reduce everyday life. The elegant and accountable algorithms would be attuned to this negation of the everyday. The chapter begins by considering a means for grasping the everyday life of algorithmic deletion . It then looks at the deletion system in action to consider what it takes for our algorithms to be successful in not just identifying relevance but deleting irrelevance. The chapter concludes with some of the concerns that began to arise with deletion in the project and the future this portends.

Deletion and the Algorithm

Deletion and accountability are not only ethical aims of this project. Within the European Union, there has been a twin policy response to issues of algorithms and privacy through the right to be forgotten combined with a right to accountability. Current policy developments in Brussels anticipate that algorithms will be prevented from amassing and analysing data at will, through clear limitations on what data can be collected, how it can be used, how long it will be stored and the means of deletion . These principles will also be made accountable, even if it is not always clear what form that accountability will take. For the coordinators of the project that features in this book, deletion , as one part of an ethical and accountable algorithmic system, might provide a means to respond to these policy demands. The ethical aims might have market value .

These policy moves emerged through the complex and lengthy political developments that take place in the EU. The move to articulate and institute a ‘right to be forgotten ’ or ‘right to erasure’ has been a feature of the revision of the EU Data Protection Directive (Directive 95/46/EC) into the new EU General Data Protection Regulation . As Bernal highlights, the right has become defined as ‘the right of individuals to have their data no longer processed, and deleted when they are no longer needed for legitimate purposes’ (2011: n.p.). This sits alongside a move to establish a basis for accountability . The EU Article 29 Working Party on Data Protection has issued an Accountability Principle which sets out a provision: ‘to ensure that the principles and obligations set out in the [Data Protection] Directive [now a Regulation] are complied with and to demonstrate so to supervisory authorities upon request’ (2010: 2). In this way, the principle of accountability is designed to ensure a transition from Data Protection in theory to practice and to provide the means to assess that this shift has adequately taken place.

Within the development of the new European General Data Protection Regulation , these two moves have become combined such that to delete, must also become an accountable feature of activities; organisations must be able to demonstrably prove they have taken on responsibility for deletion and removed ‘our’ data. Although discussions of the Article 29 Working Party Accountability Principle and the proposed and critiqued revisions of the EU General Data Protection Act have been mostly focused on online data, these policy moves have also spurred broader concerns with data repositories and data analysis and the posited need for erasure. For example, erasure, forgetting and accountability have become key reference points in the development of what have become termed Privacy Enhancing Technologies (PETs) and Privacy by Design projects (see Goold 2009). Here the remit for data storage and analysis is not restricted to online data but also incorporates concerns with the kinds of video-based data that our algorithms specialise in. The premise of these arguments for PETs is that all algorithmic technologies ought to take privacy concerns into account. In these discussions, privacy is often understood in more or less straightforward binary terms. For example, it is proposed that if one’s data no longer exists, there is no risk to one’s privacy . One type of emerging PET within this field is auto-deletion technologies (also see Mayer-Schonberger 2009). To delete and to accountably demonstrate that deletion has taken place appears to be an emerging benchmark for policy compliance. For the coordinators of the project, being able to set such a benchmark through the emerging system would be a step towards market launch (see Chapter 6). It was not only the ethical aims of the project that were at stake in developing a means to delete but the future market viability of the technology. Regulatory compliance could be sold on the open market.

The coordinator’s search for a means to go beyond a conventional approach to deletion which involves simply changing the connections through which a user might access data was part of this preparatory market work. The conventional approach to deleting supported by the computer scientists, was unlikely to fulfil the proposed terms of policy mechanisms such as the revised EU General Data Protection Regulation or the concerns articulated in the literature on PETs and Privacy by Design. The concern articulated as prompting the right to be forgotten/right to erasure is couched in terms of a need to expunge data from a repository, making it impossible to link, scrape, share or make further uses of that data; it is argued that to simply change the route via which information is retrieved can be overcome with little effort and reopens the data to all future uses. And the Article 29 Working Party accountability principle requires that compliance with such expunging is made clearly and demonstrably available. Deletion then sits centrally within the development of our algorithms. To be able to select out images and send them to operatives as alerts was a technical achievement, but to competently delete would require selecting out all data that did not need to be sent to operatives and developing a system for its removal.

This is a challenging basis for research for an ethnographic social scientist. The very thing being studied is always and already in the processes of becoming nothing. It is a double negation: data that has been deemed irrelevant is the thing that we need to study in this chapter and data that has been deemed irrelevant needs to be studied because it will be deleted. Studying irrelevance heading towards digital oblivion seems a challenge. In practice both data and deletion can be traced up to a point, but then (at least in theory) it should be gone. How can we grasp this partial and momentary thing—the action of deletion —along with this stuff that is here for a time and then goes—the irrelevant data?

One way forward is to return to the detail of the algorithms. If we can make sense of how the algorithms participate in the selection of things that are irrelevant and to be deleted and we can then figure out how those things are deleted (or as it turns out, not very well deleted), that might be a start. One way to work through the complexities of deletion is to make sense of what it is: a system for turning the complexities and uncertainties of the everyday into a basis for calculating and dividing relevance from irrelevance. As Callon and Muniesa (2005) suggest on calculating:

A calculative agency will be all the more powerful when it is able to: a) establish a long, yet finite list of diverse entities; b) allow rich and varied relations between the entities thus selected, so that the space of possible classifications and reclassifications is largely open; c) formalize procedures and algorithms likely to multiply the possible hierarchies and classifications between these entities. As this calculative power depends on the equipments that agencies can rely upon, we can easily understand why it is unevenly distributed among them. (1238)

We can think of our algorithms on these terms: they establish a finite list of entities (human-shaped objects , luggage-shaped objects, bounding boxes and close-cropped images), entered into varied relations (object action states such as moving the wrong way or abandoned), of possible hierarchies (particularly with the coordinators’ interest in selling the technology in the future, see Chapter 6). That the algorithms will be the entities responsible for imposing this hierarchy of relevance on everyday life, suggests they will play a key part in the formulation of this initial step towards deletion , among a complex array of relations also involving other system components, the spaces in which the system operates and so on.

This notion of calculative agency builds on a history of STS work on calculation . This includes studies of how accuracy is constructed (MacKenzie 1993), the accomplishment of numeric objectivity (Porter 1995), trading, exchange and notions of equivalence (Espeland and Sauder 2007; MacKenzie 2009), among many other areas. The kinds of concern articulated in these works is not focused on numbers as an isolated output of calculation . Instead, numbers are considered as part of a series of practical actions involved in, for example, solving a problem (Livingston 2006), distributing resources, accountabilities or responsibilities for action (Strathern 2002), governing a country (Mitchell 2002) and ascertaining a value for some matter (Espeland and Sauder 2007; MacKenzie 2009). Taking on these ideas, we can say that our algorithms are not only involved in classifying human-shaped and other objects and their action states, but also their relevance and irrelevance. The algorithms are involved in producing both quantities (a number of alerts, a complex means to parameterise visual data, the production of metadata and bounding boxes) and qualities (issuing or not issuing an alert, deciding between relevance and irrelevance). This is the starting point for the neologism of qualculation (Cochoy 2002; Thrift 2004). For Callon and Law:

Qualculation implies qualification. Things have to qualify before they can enter a process of qualculation … this can be … done in an endless number of ways. With an endless range of mechanisms and devices. (2005: 715)

The work of qualculation , they suggest, operates in three parts:

First, the relevant entities are sorted out, detached, and displayed within a single space. Note that the space may come in a wide variety of forms or shapes: a sheet of paper, a spreadsheet, a supermarket shelf, or a court of law – all of these and many more are possibilities. Second, those entities are manipulated and transformed. Relations are created between them, again in a range of forms and shapes: movements up and down lines; from one place to another; scrolling; pushing a trolley; summing up the evidence. And, third, a result is extracted. A new entity is produced. A ranking, a sum, a decision. A judgment. … And this new entity corresponds precisely to – is nothing other than – the relations and manipulations that have been performed along the way. (2005: 715)

Detachment, forging of new relations and the production of a judged result provides an initial analytic focus for studying the combined practices of quantification and qualification. These forms of qualculation can be seen at work in recent discussions of algorithms in academic work. Google search engines (Gillespie 2013) and academic plagiarism software (Introna 2013) suggest that algorithms are involved in the production of combined qualities and quantities in producing results. Taking plagiarism software as an example, we can see that such software would produce an algorithmic qualculation by detaching strings of characters (words, sentences and so on), forging new relations between those characters and other entities (by searching for similar or identical strings of characters in the world of published texts beyond the string) and producing a qualculative result; a basis for judging the similarity and distinctiveness of, for example, a student essay and already published texts. The algorithmic qualculation studied by Introna is a commercial product sold to Universities, which uses detachment, forging of new relations and the production of a result to generate a judgement of the students most likely to have plagiarised their essays.

This provides some starting points for thinking through the ways in which our algorithms are involved in the production of outputs—deciding relevance and irrelevance and sending alerts to operatives—that are qualculative. They set out a means to detach data, forge new relations and produce a judged result. This gives us a means to move on from our concerns in Chapters 2 and 3, focused on the means to classify and render those classifications accountable. But it is only one step forward: it alerts us to the importance of the algorithmic output (relevance or irrelevance), not yet what happens to that output. We need to discover a means to move from qualculation and the production of something—a judgement , a demarcation of relevance, an alert—to nothing—the deletion of irrelevance.

One starting point for augmenting the notion of qualculation by taking something and nothing into account is provided by the work of Hetherington and Lee (2000) on zero . They suggest that zero was introduced into western European mathematics and economics in approximately the fourteenth century. Zero provided the basis for a numeric logic of order at the same time as disrupting conventions for ordering, disrupting by connecting otherwise unconnected entities (nothing and the progressive accumulation of something from the number one upwards; as well as at a later date, providing the basis for counting downwards with the introduction of negative numbers to Europe from around the seventeenth century) and came to be seen as generating a new order. This despite zero itself being an underdetermined figure, both a sign on its own (signifying something of no value ) and a meta-sign of order (providing for the significance of subsequent numbers or indicating rank in the decimal system). Hetherington and Lee suggest that: ‘What [zero] reveals… is that very basic mathematical ordering practices are themselves dependent on a figure that refuses to adopt a singular position in their semiotic order’ (177). Following on from this, we might think of our emerging algorithmic system for deletion not just as a focus for qualculation (doing something), but as a system that refuses to occupy a singular position (both something and nothing , doing and undoing data and its relations).

However, Hetherington and Lee (2000) go further and suggest that zero , as something and nothing , can also be considered a blank figure , something that: ‘hybridises presence and absence rather than two forms of different presence’ (175). Following from this, an intervention in an order—such as the introduction of zero —can be considered a blank figure when its nature is underdetermined, uncertain, unclear, troubling, provokes tension and generates not just a connection between pre-existing entities, but provides a basis for further investigation of those entities now connected. In this way, an algorithmic system might introduce an accountable nothing (the deletion of data) that would not just create (or remove) connections between entities, but also create new troubling questions (e.g. regarding the extent or adequacy or consequences of deletion). Whereas studies of qualculation appear to depend on the emergence of a result from a singular order (‘a result is extracted’), the blank figure suggests a more persistent instability or multiplicity of order.

In this way, the work of Hetherington and Lee sensitises us to the possibility of disruptions to conventions of order through simultaneous somethings and nothings; zero which provides a basis for reordering something (the rules and conventions for order such as negative numbers) and for considering nothing (a more literal zero ). Following this argument, to introduce accountable deletion might be to generate instability and questions as much as order. The nature of data, of algorithms and their associations might be called into question, and so might the relations that generated the call for accountability in the first place. Instead of the algorithmic drama in current academic research that I noted in the Introduction and Chapter 2, we might have nothing (deletion), but we might also have a generative something (new accountability relations through which the deletion is demonstrated alongside difficult questions regarding what constitutes adequate deletion). The generative dissonance or profound change in ordering provoked by the blank figure —the something and nothing —as we shall see, attains a brutish presence: its adequacy as both something and nothing is difficult to pin down and yet vital to the marketable future of the technology under development.

The suggestion in policy discussions around deletion and accountably accomplishing deletion are that in some way an algorithm can be limited (even through another algorithm). Yet taking on board the work of Cochoy, Callon, Law, Hetherington and Lee suggests that when a new qualculative form is constituted and inserted into sociomaterial relations, it can constitute a something and nothing , a disruption and form of disorder, a set of questions and not only a limitation. The production of something and nothing and its accountable accomplishment clearly requires detailed investigation. This chapter will now begin this investigation particularly attuned to the possibility that deletion might generate blank figures , disorder as well as order. Attempts to accountably demonstrate that nothing has been created from something will be pursued, wherein I will suggest that the certainties of qualculation become overwhelmed by the disruptive figure of what might constitute deletion .

Deletion and the Challenges of Nothing

Deletion had become a notable cause for concern in policy debates in the European Union (set out above) and in academic literature that describes deletion as a solution to the ‘pernicious’ features of ‘comprehensive digital memory’ (Mayer-Schonberger 2009: 11). For the project coordinators, deletion was a means to respond to these concerns and maybe corner the market for accountably, ethically and algorithmically deleting data. Firms that needed to respond to new policy requirements might after all need a deletion system. But deletion had also become a cause for concern within the project. The computer scientists’ interest in a conventional form of deletion that was not particularly secure or complete, but was straightforward, stood in contrast to the views expressed by the project coordinators and the ethics board who for different reasons wanted a more thorough-going form of deletion . Should deletion simply involve changing the route by which data was accessed, should it involve expunging data from the system, corrupting or overwriting data?

These questions responded to the project’s ethical aims in different ways, required different amounts of effort, budget and expertise and might provide different ways to make sense of the technology’s market potential (see Chapter 6). These concerns were not easy to separate. As the project moved beyond the experimental phase that we saw in Chapters 2 and 3, towards a more fully operational system that would be tested live in the train station and airport, a decision was required on what ought to constitute deletion . The consultancy firm that coordinated the project decided, with ethics board support, to pursue the development of a comprehensive, but complex deletion system. Eventually, this would involve using solid-state drives for data storage with data then overwritten by an automated system, making it more or less irretrievable. To begin with, however, solid-state technology was not available to the project and the means to automatically overwrite data was not yet developed in a way that would work on the project’s system architecture. Moreover, the system had to also demonstrate that it could successfully demarcate relevant from irrelevant data in order that the irrelevant data could be overwritten. And other data which had been tagged ‘relevant’ once it was no longer needed and metadata (such as timestamps and bounding box dimensions) would also need to be deleted. And not just deleted, but demonstrably and accountably deleted so that various audiences could be shown that deletion had taken place and that the system worked. TechFirm, a large IT network provider who were a partner in the project, had taken on the task of ensuring that the deletion system would be accountable. The complexity of deletion did not end here: discussions continued around how quickly data should be deleted. Just how long should data be stored, what was the correct ethical and practical duration for data storage? Operatives might need to do Route Reconstruction sometime after an alert had been issued, but ethical demands suggested such storage times should be limited. As a feature of the emerging technology under test conditions, 24 hours was initially set as a data storage period that responded to ethical and emerging policy imperatives and the practical requirements of operatives.

These were each significant challenges in software and hardware, but also conceptually and ethically. This was not simply about producing nothing—the deleted. Instead it involved the continual and simultaneous production of nothing and something—the deleted, an account that could demonstrably attest that deletion had taken place, a new benchmark for deletion , a new system that could take on all the requirements of end-users oriented towards data retention at the same time as satisfying the ethics board and newly emerging regulations that data would not be stored. It was through this array of questions and concerns that deletion became a blank figure , both something and nothing , a troubling and disruptive figure within the project.

As the project moved out of its experimental phase, our algorithms and their IF-THEN rules would need to provide the basis for demarcating relevance from irrelevance with a level of confidence that would enable deletion to take place (although as we will see in Chapter 5, this was in itself a challenge). As I suggested in previous chapters, the Event Detection algorithms for moving the wrong way, moving into a forbidden space and abandoned luggage were also termed relevancy detection algorithms. In order to decide what ought to be deleted, these algorithms would need to sift through streams of digital video data streamed from the airport and train station video surveillance system, via the system’s Media Proxy that we noted in Chapter 2 (to smooth out any inconsistencies). This should make available somewhere between 1 and 5% of data to operatives of the surveillance system through the User Interface as images that they might need to look at more closely. The Route Reconstruction system we saw in Chapter 3 might expand on these amounts of relevant data a little by creating ‘sausages’ of data around an image, constructing the history and future around a specific image selected by the algorithms. Still the technology ought to be able to select out huge amounts of irrelevant data for deletion . Even data that appeared to be initially relevant and was shown on the User Interface to operatives of the surveillance system and Route Reconstruction data would only be kept for a short time until reviewed by operatives who could also declare the images irrelevant and send them for deletion .

At the end of the experimental phase of the project, it might seem far-fetched to describe deletion as a disorderly and disruptive blank figure based on complex qualculations of quantities and qualities. Relevant data could be checked and then deleted. Irrelevant data, by default, would be all the other data. This apparent certainty, at least at this stage of the project, extended through the algorithmic system. The IF-THEN rules were clear, the maps of the fixed attributes of the experimental settings were clear, the models for object classification and the action states of objects as worthy of further scrutiny all seemed clear. The quantities involved were significant—terabytes of digital video data—but the qualities—mostly operatives clicking on text alerts and watching short videos, were neatly contained. Following Callon and Law (2005), we could say that this was the first step towards a straightforward form of qualculation . Things were separated out and disentangled such that they might be recombined in a single space (within the algorithmic system). The background subtraction technique that we saw in Chapter 2 provided this seemingly straightforward basis for beginning demarcations of relevant data (to be kept) and irrelevant data (to be deleted). A result could be extracted.

However, the project was now moving beyond its initial experimental phase. In the airport and train station as the technology moved towards system testing , the computer scientists from University 1 and 2 began to engage with the complexities of relevance detection in real time and real space. They started to look for ways to tidy up the initial steps of object classifications (which provided approximate shapes for background subtraction) in the airport and train station, through ever more closely cropped pixel masks for objects, with any single, isolated pixels erased and any holes between pixels filled. They suggested masks could be further tidied by removing shadow, just leaving the new entity. And these tidied up entities could now be subjected to object classification with what the computer scientists hoped was greater certainty. They were cleaned and tidied objects. Object classification would now define with confidence the objects in view as, for example, human-shaped or luggage-shaped. Cleaning the images, removing shadow, removing gaps in pixel masks was more processor intensive than the initial quick and dirty technique we noted in the earlier experimental phase of the project, but it was still computationally elegant for the computer scientists. It was a reasonably quick technique for ascertaining a classification of putative objects and it was a classification in which they (and other project participants) could have confidence.

Object classification required this more developed form of qualculation , drawing entities together into new relations such that they might be qualified for judging as relevant or irrelevant because the system faced new challenges in working in real spaces in real time. Classifying something as a human-shaped object in object classification still involved algorithmic analysis of video streams in order to draw the parameters (size and shape) of human-shaped or other shaped objects, it still required background subtraction and each object was still identified through a vector of around 200 features, so each object in itself was complicated. But the airport and train station involved far more cameras than initial experimentation , data in a wider array of formats and frame-rates , a far greater number of human-shaped and other objects.

Confidence in the system’s ability to demarcate relevant from irrelevant data had to remain high as the algorithmic system required further development in order to work in the airport and train station. In particular, object tracking in the airport and train station needed to be attuned to the specificities of the spaces in which it would work. Object tracking just like our abandoned luggage algorithm had to be able to grasp everyday life. Object tracking was vital for the Route Reconstruction system to work and follow a human-shaped object across multiple cameras, and for the system to know if human-shaped and luggage-shaped objects were moving apart, to know if human-shaped objects were moving the wrong way or into a forbidden space.

Once an object was given a bounding box and metadata had started to be produced on its dimensions, and the speed and direction of the box was noted in its movement across the screen, then object tracking needed to take on the complexities of the train station and airport. The bounding box had to be tracked across one camera’s visible range, but also between cameras in the train station and airport where the system searched for other bounding boxes of the same dimensions, relative to camera position, angle and zoom. To know that a human-shaped object on camera 17 was then the same human-shaped object that appeared on camera 18 and was the same human-shaped object that had previously appeared on cameras 11, 7, and 6, required a sophisticated form of tracking. Calculating objects in this way involved what the computer scientists termed Tsai calibrations. These did not operate using pixels alone, but rather by working out the position of an object relative to a camera, its position, angle and zoom, and then counting the number of pixels to figure out the dimensions of that object in centimetres relative to its distance and angle from a camera. Knowing the size in centimetres of an object in the space of the train station and airport would enable object tracking to happen. But to calculate the size of an object in centimetres (rather than just its size on a screen), the world of the video stream had to be connected to the world of measurement in the space where the camera was located (the airport or train station) and the world of the objects within the video stream had to be connected to the world out there of people, luggage, etc. This was accomplished by measuring the space seen by a camera and then incorporating those measurements into a topological database drawn on by the Event Detection component of the algorithmic system. Eleven conversion coefficients including angle and zoom of the camera in relation to the world-out-there measurements were now involved in producing an object’s size and initiating object tracking.

In this way, demarcating relevant from irrelevant data in the everyday space of the train station and airport, in contrast to the experimental space where all measurements were more or less already fixed and known, required more qualculative work. Judgements had to be made on what might work as a basis for connecting the images on the video stream to the objects that they referenced in the airport or train station. Accurate measurements of the space had to be compiled in a database. And this database had to be combined with the database of popular routes, the metadata on size, speed and direction of bounding boxes, and the algorithmic IF-THEN rules in order to build the sausage of data around an image that we looked at in Chapter 3. Without these efforts, all data except for the single images of luggage once it was abandoned or a human-shaped object moving the wrong way or into a forbidden space would be deemed irrelevant and deleted. Qualculative work to connect the airport and train station space to the video data flowing through the algorithmic system was needed to prepare data for deletion or salvation.

This qualifying work, separating things out, drawing them together into classifications, working through IF-THEN rules to further qualify whether an image needed to be seen by operatives, was directed towards reducing the amount of video-based data made visible and the amount of data stored and achieving the project’s ethical aims. Qualculative work was complex in that it involved detailed efforts to know the everyday space in which the surveillance system operated, build that space into the algorithmic system, and come up with a means to identify and qualify relevant objects. However, this was merely a first step in the move towards deletion .

Achieving the project’s ethical aims required a combination of this notable something—a potentially relevant event from which to issue an alert—and a broad aggregate category of nothing—the irrelevant data to be deleted. This also required that the nothing itself became accountable. What was deleted had to be demonstrably seen to be deleted. In part this involved gathering all the data not seen by operatives along with those clips deemed irrelevant by operatives and deleting that data. However, it also involved retaining the orderly integrity of the accountability process imagined in relation to the initial qualculation process. Deletion needed to follow a similar logic to that of background subtraction and object classification which were expected to be appropriately qualified and made available for accountable judgement .

In this project, to generate accountable certainty, the system was designed to work in the following ways. A secure erase module (SEM) would be built of three sub-modules: a secure erasure scheduler (SES); a secure erase agent (SEEA); and a log generator (SELG). The SES would work with the other system components to retrieve data to be deleted (this would operate using a FIFO queuing system). The SES would send a series of requests for data to the other system components. These requests would include the full path to the file to be deleted; the start point of deletion (this was based on temporal parameters); and the end point of deletion (using temporal parameters to calculate the final block of video data to be erased in each session).

The SEEA would then work on the data to ensure it was overwritten and completely irretrievable from within the system. Overwriting was designed to try and ensure that data could not be retrieved from within the system and provide accountable certainty for its non-status. The project participants hoped that they could demonstrate that overwriting had taken place and that the data had become irretrievable. In place of conventional deletion whereby data access routes would be cut, overwriting became the basis for expunging data from the system (although in practice this turned into something closer to corrupting than expunging the data as expunging proved technically difficult to automate). The SEEA would then check that deletion was successful by matching the content deleted with that selected by the SES. After deletion , the SELG would then produce a log of data deleted. The log would include the file names of deleted objects, the time taken to delete and the form of overwriting that had been applied. The SELG would act as the key component for producing accountable certainty of nothing—that the data to be deleted was now deleted—as well as something—the account of nothing.

To make an accountable something from nothing, an external viewer component would parse the log to make it readable by humans and then a human system administrator could audit the log and check it against expectations of how much data should have been deleted (e.g. by comparing how much data had been deleted against how much data passed through the system on average every 24 hours) and whether any traces had been left (of either video streams or metadata relating to, for example, object classification or bounding boxes). Events which had been the subject of an alert to operatives would be reviewed manually on a regular basis and then also moved into the SEM for deletion as necessary. The audit log provided a basis for demonstrating within the project that deletion was working. As an internal accountability mechanism it could become a means to see that the algorithm was limited, that further judgements could not be made on the corpus of video-based data that would now be unavailable.

In this sense, accountability (in the form of a data log) ought to provide the means to transform nothing (the deleted) into something (proof of deletion ) and to do so in an orderly and certain manner. The log bore the responsibility for accountable action and for achieving the project’s ethical aims. However, the results derived from system testing suggested deletion would be anything but straightforward. In tests carried out ‘live’ in the airport, designed to act as a demonstration of system capabilities for potential users (airport security operatives), video frames and metadata were not gathered in their entirety, orphan frames were left behind on the system, and the reporting tool merely produced a continual accountable output of partial failure. Problems particularly appeared during secure auto-deletion; it was in the moment that data should be corrupted and made irretrievable that some data evaded the system’s grasp. The computer scientists involved in the project could get the system to auto-delete the system files in their entirety by using an insecure deletion protocol (which effectively involved a conventional approach to deletion , changing the routes via which data could be accessed) or by dropping auto-deletion and carrying out a manual corruption process (which might prove more complete but also require more work). The elegant solution of automatic, accountable deletion remained out of reach. This would prove important in efforts to establish the market value of the technology (see Chapter 6), but also somewhat pre-empted the chaotic scenes of demonstration that the entire system began to experience as it moved outside its initial experimental phase (see Chapter 5). Everyday life and the algorithmic system did not see eye to eye.

Work to build the algorithmic deleting machine and constitute an ordered and certain accountable nothing, a notable absence, instead became the basis for establishing a precarious kind of uncertain presence. Orphan frames and the audit log continually generated a disorderly account of something instead of nothing, a blank figure (Hetherington and Lee 2000) that paid recognition to the terms of its own order (that it should find and prove the existence of nothing), but also questioned that order (by finding orphan frames that then required explanation). The system threatened to overwhelm the qualculations that had tried to establish a demarcation between relevant data to be kept and irrelevant data to be deleted.

The audit log generated a notable question for the project participants: could the technology still be sold primarily on the basis of its technical efficacy in deleting? The clear and negative answer to this question for the coordinators required a significant switch in the conditions under which parties might be invited to engage with the system. Initially the project coordinators had sought to take the internal accountability mechanisms of deletion out into the world as a basis for bringing the world to the deleting machine. They sought to develop from nothing, a market-valued something. After these somewhat sketchy results, the project coordinators sought to leave aside the technical difficulties through which nothing (the deleted) failed to be effectively and accountably constituted, at the same time as they continued to embark on concerted market work. As we will see in Chapter 6, having one form of calculation overwhelmed by this blank figure , encouraged the coordinators to seek a different basis for ordering their calculations .

Conclusion

In this chapter, we have seen that grasping everyday life and participating in everyday life became more challenging for our algorithms as they moved from experimentation to something closer to system testing in the train station and airport. What might be termed the real world conditions of real time and real space operations proved difficult. Indeed the algorithmic system needed more development to cope with these new exigencies. Further measurements and a new database were required to build durable links between the space of the airport and train station and the video stream that flowed through the system.

As our algorithms moved from experimentation towards testing in the train station and airport, its calculations changed, the system components were further developed, a more complex and uncertain everyday life needed to be engaged. This was all oriented towards demarcating relevant from irrelevant data in order to delete. Deletion was seen as crucial by the project coordinators to achieving the project’s ethical aims and in order to start building a market value for the technology under development. The system, it was hoped, would become the first choice among firms looking for automated ways to manage their adherence to new data regulations.

Yet deletion could not only happen through demarcation. Decisions had to be taken on the form that deletion would take (changing the route to access data, expunging, overwriting, corrupting data) and the means to accountably demonstrate that deletion had happened. Although decisions were made on all these matters, problems remained. The anticipated nothing—the deletion of irrelevant data—retained a troubling presence in orphan frames that inexplicably escaped the deletion protocols. The anticipated something—a log that accountably demonstrated to audiences that deletion had taken place—was then undermined. In place of a pristine account of nothing (the deleted) was a continual demonstration of the presence of something (the orphan frames): the algorithmic machine had become an expert in accountably demonstrating its own failures. This disruptive blank figure , always attentive to the order in which it was expected to work, was simultaneously managing to challenge that order, by placing significant questions next to the algorithmic system’s future viability. As we will see in Chapters 5 and 6, these questions only become more pronounced over time.

In sum, we have seen in this chapter that doing deletion can be a form of active qualculative work. The members of the project team dedicated hours and effort to build a machine to algorithmically delete. The technical work was also preparatory market work and accountability work. It involved coordination, computer science, social science, the invocation of end-user needs, and different ways to understand a developing policy environment. Doing this work was neither singular nor straightforward, but involved somehow making something from this diverse array. And making something required qualculations to separate out and identify objects, then bring those objects together in object classifications in order to be judged. Yet setting limits for our algorithmic system through deletion was not straightforward; for something to be convincingly limited, it needed to be demonstrably and accountably limited. The work to produce an accountable deleting machine was focused on producing a machine that could account for itself and the way it set limits, demonstrating nothing (the product of deletion) as a prior step to something (the account of nothing, building a world of relations of value into the technology). However, accountability work was also uncertain and a little precarious with the world of relations of people and things assembled to do accountability, shifting between certainty and uncertainty. The study of making deleting accountable, emphasised this precariousness—to prove that nothing existed as a result of something being deleted, without resurrecting the thing deleted, proved an ongoing conceptual and practical challenge. As we will see in Chapter 5, this was only the start of a series of challenges for our algorithms.