Who Watches the Watchers? Inside Sri Lanka’s Expanding Surveillance State
Today, a camera can record a face, software can compare it against a database, telecommunications records can reconstruct a person's movements, and digital information can reveal relationships never intended to become public knowledge. None of these capabilities necessarily requires the person being observed to know that the observation is taking place. More importantly, surveillance no longer needs to be directed at a particular individual to collect information about them. It can become an ordinary feature of the environment through which everyone moves.
In Sri Lanka, these developments are no longer confined to technological speculation. Police have introduced facial recognition at Bandaranaike International Airport, announced plans to connect privately owned surveillance cameras to law enforcement networks, and invested in mobile surveillance equipment. Meanwhile, proposed legislation has raised questions about investigative access to telecommunications and digital information. Each development has been presented, in one form or another, as a means of strengthening public security. Yet considered together, they raise a far more consequential question about the relationship between the citizen and the State. At what point does the legitimate pursuit of public safety become the infrastructure of a surveillance state?
The distinction matters because surveillance technology is not inherently oppressive. Cameras can identify offenders, establish evidence, locate missing persons and reconstruct criminal incidents. Digital investigations can dismantle organized criminal networks. The State has a responsibility to protect its citizens, and refusing to use effective technology would be difficult to justify. But the existence of a legitimate purpose does not automatically legitimize every method used to achieve it. A democratic government must demonstrate not only that surveillance can make people safer, but that the powers it exercises are necessary, proportionate, accountable and protected against misuse. In Sri Lanka, the public conversation has largely concentrated on what surveillance technology can accomplish. Far less attention has been paid to what happens after information is collected, who controls it, how long it survives and what prevents it from being used for purposes beyond those originally promised.
In January 2024, Sri Lanka Police announced the deployment of facial recognition technology at Bandaranaike International Airport. According to contemporary reporting, police had uploaded images of 1,092 individuals identified as members of organized crime syndicates into a facial recognition watchlist. The stated objective was to identify wanted individuals attempting to leave the country, including those using fraudulent travel documents. The security rationale is understandable. Airports are sensitive locations, and identifying fugitives is a legitimate law enforcement objective. But facial recognition represents a substantial departure from conventional CCTV. An ordinary camera records what happens within its field of vision. Facial recognition attempts to establish who a person is by analyzing facial characteristics and comparing them with stored images. That distinction transforms surveillance from an instrument of observation into an instrument of identification.
In August 2025, Sri Lanka Police advertised a tender for an integrated CCTV facial recognition system for airports and seaports, including an eight-year support and maintenance arrangement. The advertisement indicated an ambition to develop the technology further, although it does not establish whether the proposed system was subsequently commissioned or how extensively it operates today. Nevertheless, the questions arising from such capabilities are substantial. Who determines whose face belongs on a watchlist? What evidence is required before inclusion? How frequently are records reviewed? Can an individual challenge an incorrect identification? What happens when an algorithm produces a false match? Facial recognition systems are not infallible. Their performance depends on image quality, system design, database integrity and operating conditions. A mistaken identification could result in questioning, delays or more serious consequences if officers treat an automated match as conclusive evidence. Without meaningful safeguards, the individual may be required to prove that the machine is wrong rather than the authorities establishing that their identification is correct.
The expansion of surveillance is not limited to equipment owned by the State. In April 2024, Daily Mirror reported that Sri Lanka Police intended to integrate approximately 2,000 privately operated CCTV cameras in Colombo into its monitoring network during an initial phase, with plans for wider integration. Participation was described as voluntary. Subsequent reporting indicated that police were developing an application through which footage from participating businesses and residences could be monitored, particularly cameras facing roads and public spaces. On the surface, the proposal appears practical. Thousands of privately owned cameras already observe roads, pavements, entrances and commercial spaces. Linking selected feeds to police operations could improve investigations without requiring the Government to construct an entirely new network.
But voluntary participation by camera owners raises a question frequently overlooked: the person who owns a camera is not necessarily the person whose movements it records. A business may consent to police access, but pedestrians passing its entrance have not individually consented. A homeowner may share a camera feed, but the delivery worker, neighbor or passer-by recorded by that camera may never know that the footage is accessible beyond the property. This does not automatically make such arrangements unlawful. Nevertheless, connecting previously separate cameras into a coordinated monitoring network changes the scale and consequences of observation. A camera outside a shop records a location. A network of cameras, particularly when combined with identification software and searchable records, could potentially reconstruct movements across multiple locations. What was once fragmented information becomes an interconnected picture of everyday life. Whether Sri Lanka's proposed integration has reached that level remains unverified, but the implications deserve scrutiny before such infrastructure becomes embedded in civic life.
There is another dimension to Sri Lanka's surveillance ambitions: the security of the surveillance systems themselves. In December 2025, Daily Mirror reported findings from a 2024 police audit indicating that 37 of Colombo's 108 CCTV cameras, installed across 33 locations, were non-functional. The network was reportedly operating on Windows XP, an operating system for which Microsoft ended support in 2014. Police officials indicated that modernization was being pursued. The revelation exposed an uncomfortable contradiction. While authorities were pursuing increasingly sophisticated surveillance capabilities, parts of the existing infrastructure were struggling with technological obsolescence. Surveillance systems contain potentially sensitive information about the public. Their security depends on maintenance, controlled access, encryption and the ability to detect unauthorized activity. Outdated infrastructure can create vulnerabilities that undermine the very security such systems are intended to provide.
The fundamental question, therefore, is not simply whether the State possesses the technology to watch its citizens. It is whether the State possesses the institutional capacity to protect the information it collects. In February 2026, Sri Lanka Police announced the addition of three surveillance-equipped vehicles to its CCTV Division, describing the investment as a means of strengthening monitoring and public safety. Yet equipment procurement is only one measure of institutional readiness. Public accountability also requires transparent operating procedures, independently reviewable access records and consequences for misuse. A surveillance system that cannot adequately protect its own data risks turning a public safety instrument into another source of public vulnerability.
Perhaps the most consequential surveillance debate currently unfolding in Sri Lanka concerns not cameras but the legal authority to access digital information. The proposed Prevention of Organized Crimes Bill has attracted criticism over provisions that would broaden investigative powers. In an assessment published in October 2026, Human Rights Watch warned that the Bill would permit authorities, subject to court orders in specified circumstances, to intercept communications, extract information from electronic devices and obtain data from telecommunications and online service providers. The organization also highlighted provisions allowing police to obtain certain subscriber, call and telecommunications tower-location information without a court order. These are proposed powers, not evidence that the Bill has already been enacted or implemented.
The distinction between communication content and associated data is important. Telephone records may not reveal the words spoken during a conversation, but they can identify contacts, communication patterns and, through location-related records, potentially indicate where a device has been. Combined over time, such information can expose aspects of private life without requiring access to a single message. For journalists, the implications are particularly serious. Confidentiality of sources is essential to investigative reporting. If authorities can identify who communicated with a reporter, when those exchanges occurred and where the individuals were located, source protection may be weakened even without direct access to conversations. For ordinary citizens, the concern extends to political association, personal relationships and participation in lawful public activities.
Sri Lanka's Online Safety Act, enacted in 2024, adds another dimension to this debate. The legislation established an Online Safety Commission and introduced mechanisms intended to address specified harmful or prohibited online communications. Its provisions include powers relating to investigations and restrictions on certain online material, while Section 35 provides for access to information and interception of communications under a magistrate-issued warrant in investigations under the Act. Protecting people from online harassment, fraud and other genuine harms is a legitimate objective. But legislation governing digital expression demands particular precision because the boundary between unlawful conduct and protected speech can become contested. A person does not need to be arrested to experience a restriction on freedom. Sometimes the possibility of being identified, investigated or questioned is sufficient to discourage participation in a protest, discussion of a controversial issue or communication with a journalist.
Sri Lanka is not without a legal framework for personal data protection. The Personal Data Protection Act, No. 9 of 2022, established an important statutory foundation, while the Data Protection Authority has a mandate concerning personal data processing in both public and private sectors. Yet the existence of legislation does not, by itself, answer every question concerning State surveillance. How long is footage retained? Who can access biometric records? Are searches independently audited? Can information collected for traffic enforcement later be used for unrelated investigations? What happens when sensitive information is leaked? Can citizens discover whether they have been incorrectly included in a surveillance database? These questions are not obstacles to policing. They are the mechanisms through which lawful policing earns public confidence.
The most dangerous characteristic of surveillance power is not necessarily its immediate misuse. It is its capacity to expand quietly, through a succession of apparently reasonable decisions, until extraordinary observation becomes an ordinary feature of governance. One camera is installed to monitor traffic. Another is connected to identify suspects. A database is expanded to improve detection. Telecommunications information becomes easier to obtain. Each decision may be defended by a legitimate security objective. Yet the cumulative consequences can be far greater than those of any individual measure. The question is not whether every government official intends to misuse surveillance technology. It is whether the system is designed to prevent misuse even when someone does.
Sri Lanka has spent decades debating the limits of State power, often after those limits have already been tested. Digital surveillance offers an opportunity to ask difficult questions before technological capability outruns democratic accountability. A society does not become free merely by being protected from criminals. It remains free when those entrusted with protecting it are themselves subject to the law. The cameras may be watching the public. The public must be able to watch the power behind the cameras.
