U of T’s Security Deal: Public Work, Private Terms

This week, the University of Toronto unveiled an AI-security partnership and a cybersecurity policy course. The sequence matters. The province moved first by shrinking research funds. The university’s pivot to corporate sponsors is the counter to keep the lights on. The roll-out is sold as public service. The paperwork reads like a lease.

Names matter because they tell you what can be built. Citizen Lab does the grind: technical, adversarial, documented to withstand pressure. The Munk School draws the officials and executives who write rules, or find ways around them. U of T can convene anyone. Put those facts against the timeline: first, the cut; then, the donors; then, the ribbon-cutting that says all is well. The risk isn’t a blow-up scandal. It’s a slow edit. Findings that would sting a benefactor get rounded off. Access that lets the public check the work moves to invite-only rooms and polished summaries.

I sat through one of those “reading groups.” The label sounds gentle. In practice, the reading list sets the temperature. Pick the papers, and you define what counts as harm, whose testimony qualifies as data, which risks get shelved as “theoretical” until they land on a real person. I watched a live problem, device searches at border crossings, reduced to a throughput model on a whiteboard. A witness became a metric. Policies that decide who gets stopped and who has their phone copied were treated like dials, not decisions with heat and consequence.

The incentives explain the drift. AI security brings contracts, not just citations. Companies selling “responsible” systems want to borrow reputations they haven’t earned. A joint paper. A branded panel. A visiting title. Universities hand out legitimacy at discount and get access in return, datasets, internships, placement stats. Law schools get glossy brochures. Institutes get leverage with funders. The public gets a promise that fixes are coming. Then the gears slip. “Assessments” replace requirements. Deadlines land for grants and course catalogs, not for the parts that would change conduct outside the quad.

The ripple is worse than the ad copy. When security work becomes a campus asset to rotate, the watchdog role slides toward hospitality. Tough questions flatten into panel topics with polite time limits. Enforcement is rebranded as “engagement.” Ask for the files behind a partnership, the procurement terms, indemnities, nondisclosure clauses, and you’re told to send a different request to a different office. I’ve heard the same answer in Cambridge, in Ottawa, in Columbus. The structure produces the refrain.

Start the chain where it begins. Public funding restraint came first. Universities and labs are reacting to a squeeze they didn’t choose. But adaptation is not neutral. Once private money sets the perimeter, the first thing to go is the public’s ability to see the work and test the claims. That loss is not abstract. It shows up at the checkpoint, at the hearing, at the desk where someone is told their appeal goes to a closed committee that does not publish minutes.

Basic fairness is not an academic luxury. When a campus model helps sort who gets flagged for search, anyone can be the next person asked to unlock a phone while the rules sit behind NDAs. Permissions expand. Records shrink. And the people most affected are asked to applaud the “partnership” that made it possible.

Repairs need to be small and binding. They should fit on paper, carry penalties, and be easy to verify without favors:

• Post all partnership contracts, full text, covering gag terms, indemnities, data-sharing, and risk allocation.
• Put third-party reviews into statute, with defined fines for missed or late reports.
• Separate teaching from vendor marketing in policy, space assignments, and payroll lines.
• Make conflict disclosures itemize payments, data-access rights, and any veto or approval power given to funders.
• Create protected channels for staff and students to report pressure or interference, with fixed penalties for retaliation.
• Publish meeting notes and draft policies by default; missed posting deadlines trigger automatic release or monetary fines.

If that sounds narrow, good. Speeches fade by Monday; signed pages shape the year. The people selling security on campus have learned the language. The rest of us need the paper. Read it. Ask for more. And don't trust the coffee.

Here is where the reporting goes next: who drafted the MOUs, who signed the indemnities, where the vetoes sit, and which findings changed on their way from lab to launch. Track the names on the signature blocks and the edits between drafts. That is the map of influence, and it’s the only one that holds up when the banners come down.

© Elias Rourke, 2025. Use it if it helps. Credit if you’ve got a conscience.