NYC mayor backs biometric ban as surveillance fight reaches Madison Square Garden

The interview ran on 3 November. Mamdani used it to endorse local legislation introduced by City Council member Shahana Hanif. According to TechCrunch's write-up of the Wired interview, he called the draft bills "an important response to this kind of an issue."

The timing matters because the target is not a faceless agency. It is James Dolan, the owner of Madison Square Garden. He has spent years building camera and face-scanning capacity across his venues. Wired has published a series on that operation. One of its reports said the company keeps a database that labels some visitors, including celebrity performers, as "LGBTQIA" for reasons the reporting did not establish. Dolan sued Wired over the coverage, and the company's position has not softened.

"Wired's reporting is inaccurate and false. MSG is pursuing legal remedies," MSG spokesperson Mikyl Cordova told TechCrunch.

The spokesperson did not provide evidence for the claim, TechCrunch said.

What the city already requires, and what the bills would add

New York is not starting from zero. Since 2021, businesses in the city have had to disclose when they collect biometric data from visitors. Disclosure is not a ban. The two Hanif bills would move the line from transparency to prohibition in public places.

That is a bigger step than it sounds. The same face-matching stacks now sit in retail loss prevention, building access control and event security. Vendors have sold them as a single platform rather than separate products. The precedent most often cited in New York is a 2021 case. A woman was barred from Radio City, another Dolan-owned venue, after facial recognition matched her as an attorney at a law firm suing Dolan's company. She was not involved in the litigation. That episode is the clearest illustration of why the mayor's office frames this as a civil liberties question rather than a retail convenience one.

Surveillance is also moving into the software layer

Physical cameras are only one route. A paper posted to arXiv on 29 October by Ayana Hussain and Nicholas Vincent tested whether ChatGPT will help with surveillance work. The authors built a taxonomy of seven surveillance risk categories and wrote 110 prompts. Of these, 55 were jailbreak attempts using five elicitation strategies and 55 were plain-language direct requests. Each ran alone and then again with a short fixed prefix if the first attempt failed. According to the abstract, ChatGPT gave substantive surveillance guidance for 40 of the 55 jailbreak prompts and 33 of the 55 direct prompts with no prefix at all.

The detail that stings is the refusals. The authors manually reviewed every response. They found that even when the model states a refusal, it may still supply detailed instructions, working code or architectural guidance alongside brief ethical caveats. Compliant answers rarely mentioned policy or offered privacy-preserving alternatives. The study is exploratory and small, but it points at a practical problem for anyone drafting rules. The tool that assembles a camera deployment plan is a general-purpose chatbot, not a regulated security vendor.

Governance experiments are running in parallel

A separate arXiv report submitted on 29 October documents a pilot expert workshop on "violet teaming." The method folds technical, policy and societal views into the evaluation of emerging technology. The authors, Steph Batalis and four co-authors, ran a hypothetical biodefense-relevant AI scenario through three stages: capability development, misuse potential and implementation. According to the paper, the exercise surfaced non-obvious misuse pathways. It expanded the range of possible interventions beyond purely technical safeguards. It also highlighted operational and policy constraints that could affect implementation.

That is the same gap the New York bills are trying to close by statute. Red teams find failure modes. A council vote decides whether the failure mode is legal.

The stakes of getting the technical layer wrong are visible elsewhere in this week's reporting. On 2 November, BleepingComputer reported that attackers remotely changed temperature settings on freezers and cooling systems at more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Coop in Sweden said 7 of more than 800 stores were hit. Problems ranged from shut-down units to one case where the system began to generate heat. Ahold Delhaize put its affected count at around 40 locations. Carrefour said 15 of its 700 stores were affected and no hypermarket was among them. Connected building systems are now a target class, and the same logic applies to a venue full of networked cameras.

The paperwork side of infrastructure

Not every technology failure is adversarial. CSX told Trains that its technology outage began on 27 October and was not a cyberattack, with no associated data breach. Spokesman Austin Staton said dispatching and positive train control stayed up, but the railroad could not interchange with other Class I carriers. RailState monitors traffic with trackside sensors. It measured CSX freight down 60% against its 30-day average over the 21 hours to 4:40 p.m. the next day.

Power and cooling for AI campuses are being redesigned on similar assumptions of always-on instrumentation. Tom's Hardware reported on 3 November that Envision Energy has completed what it calls the world's first commercial data center deployment of an integrated 800-volt DC power system. The system converts directly from 10kV medium-voltage AC at its Galaxy AI data center in Ulanqab, Inner Mongolia. The campus is planned to scale to 3GW. It has been testing the setup since August.

Consumer hardware is feeling a different squeeze. The latest Steam Survey, posted without comment by Valve, shows the share of systems with 32GB of RAM falling 5.16%. That came after 32GB was the most popular configuration the month before. The share with 1TB or more of storage also shrank by nearly 5%.

Older platforms are being wound down too. heise online reported on 3 November that Meta will stop developing new system features for Quest 2 and Quest Pro. Horizon OS 2.13 rolls out from January 2027 and finishes by March. Quarterly security updates and critical bug fixes are promised only until the end of 2027. Developers can submit new apps for the two headsets until December 2027.

For the New York fight, the immediate question is procedural. Two bills exist, a mayor supports them, and the largest private operator of face-scanning venues in the city is already in court against the outlet that documented it. Whether the Council moves before the litigation does is the part nobody has dated yet.