Freedom-of-information requests as evidence-gathering

Use the statutory access-to-information machinery — US FOIA and state analogues like the California Public Records Act, UK Freedom of Information Act, EU regulation 1049/2001, national access-to-information laws elsewhere, and personal-data subject-access rights under GDPR / Convention 108 — to force public bodies (and, via subject-access rights, private controllers) to disclose which AI systems they operate, on which people, under which contracts, with which vendors, with which error rates. The output is the documentary substrate — procurement records, deployment memoranda, contractor scopes-of-work, decision-audit logs, training-data sourcing letters, redacted risk assessments — that the movement's litigation, audit, campaign, and municipal-ban arms then reason from.

An actor chooses this strategy because it converts a legal right that most public bodies would rather not exercise on themselves into a duty to produce documents an outside actor gets to keep. Unlike investigative journalism or leaked-document work, the request is authorised in statute and the produced record enters the public trace in a form that survives the news cycle. Costs are low — one skilled requester with a paralegal budget can run hundreds of requests a year — and the marginal cost of a request is asymmetric to the marginal cost of the responding agency's compliance, so a coordinated requester coalition can force a public body to commit ongoing resources to answering it.

It trades speed for durability. Statutory response windows are routinely violated, and the exemption apparatus — trade-secret carve-outs, ongoing-investigation exemptions, deliberative-process privilege, the vendor's own confidentiality claims — filters out much of what a well-organised public body does not want disclosed. A request coalition therefore lives inside a slow, appeal-heavy pipeline whose first return is often over-redacted, and whose real yield comes from the appellate and litigation follow-on. The strategy is also easy to defeat at the frontier of what "public body" means: a private vendor operating an AI system on a municipal contract is not the request's target, and the public body will often disclaim knowledge of what the vendor's model actually does.

The strategy pairs almost by construction with empirical-audit-and-expose — a FOIA campaign is the discovery layer an audit reasons from — and with strategic litigation against algorithmic state decisions, where the same request record becomes the plaintiff's evidence. It also underwrites municipal-ban campaigning by giving a city council the specific vendor names, contract values, and deployment scopes the ban text needs to bind.