Madison Square Garden kept a file called 'Facial Recognition Activists.docx'
Among 45GB of data hackers pulled from Madison Square Garden was a document titled Facial Recognition Activists.docx — a collection of tweets and comments from people who had publicly criticized the venue's face-scanning. The EFF's privacy litigation director was on it.
MSG, which has run facial recognition at its venues since 2018, compiled a dossier of activists who criticized that surveillance — collecting their tweets and comments — and it surfaced inside a 45GB cache hackers stole and posted. EFF privacy litigation director Adam Schwartz was named in it.
The thread's twist: MSG has already weaponized face-scanning to bar lawyers from firms merely litigating against it, and under NY law it can trespass anyone with no reason given — so the dossier is the legal system working as designed, not a glitch.
A venue that keeps a list of its critics
The document is real and bluntly named. 404 Media reports that a file titled Facial Recognition Activists.docx — tweets and comments from people who publicly criticized MSG's face-scanning — was sitting inside a 45GB cache of company data that hackers stole and posted online. It was accessible to multiple employees. Among those listed: Adam Schwartz, privacy litigation director at the Electronic Frontier Foundation, who had a pointed response to where his name turned up.
"The wake of a data breach would be a good time for Madison Square Garden to stop subjecting its patrons to biometric surveillance." — Adam Schwartz, EFF privacy litigation director, quoted in the article
MSG has run facial recognition at its venues since 2018, under owner James Dolan, who the reporting notes has a reputation for going after perceived enemies. The breach exposes a second failure on top of the surveillance itself: the company collected this biometric and reputational data and then stored it badly enough to lose 45 gigabytes of it.
The part that's already legal
The HN thread's most useful contribution was to deflate the idea that this is a rogue act. It's closer to a feature of how the rules already run.
One commenter laid out the New York statute: in premises open to the public, the owner can revoke your license to be there by simply telling you to leave — no reason required.
"In NYC, you can trespass anyone from a private business at any time and for no reason at all… The owner does not need to say: 'You have to leave because…'" — a commenter citing NY Penal Law § 140.00
That legal backdrop is why an earlier MSG tactic stuck: using face-scanning to block entry to lawyers who work at firms litigating against the company, even lawyers not personally on the case. A reader with 28,000+ karma argued the dossier is a distraction from that larger pattern.
"Debating this specific dossier ignores the larger issue… MSG's facial recognition systems have been used to block entry to the stadium for all sorts of people. The list includes lawyers who work at law firms in litigation with MSG, even if they are not part of the litigation themselves." — a long-tenured reader arguing the dossier is the small story
His proposed lever was financial: if MSG arbitrarily blocks people, it should lose the tax exemptions it enjoys.
Who decides who's barred — and the conference-room version
A dissent worth keeping pushed against blanket opposition to the technology. The tool itself can keep convicted violent offenders out of stadiums; the rot is in unaccountable control of the list.
"who gets to decide who is excluded, how transparent do they need to be about this decision making process, and what is the course of appeals." — a commenter proposing tiered audits for large venues
His model: small venues policed by lawsuits, mid-size ones forced to publish their rules, large operators subjected to audits and formal blacklisting limits. The fear running underneath the calmer takes was scope creep — that once a venue can identify everyone at the door, the line between barring violent offenders and cataloguing people who booed the wrong person is a policy choice, not a technical one. For anyone who's ever posted a critical tweet about a company they buy tickets from, that's the uncomfortable read: the capability is built, and the only thing standing between a complaint and a dossier is whoever controls the file.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
An extreme-heat conference was cancelled by an extreme-heat warning
The LSE page says it plainly: the conference on governing extreme heat was called off because the UK Met Office issued a red extreme heat warning. The program had ended with a 'fire side chat'.