Your Smart City Is Owned by Someone Else

In Montréal, a rider can pass through three different definitions of "public" on a single commute. The automated REM railway is controlled by CDPQ Infra, a subsidiary of Québec's public pension-fund manager. BIXI, the bike-share, is run by a non-profit the city created after the original company went bankrupt. The photo-radar cameras on the same streets are owned by neither: as of July 2026, Québec's own rules say a municipality cannot even apply for one. All three serve the public. None fits the binary of public versus private ownership.

That is why "the private sector owns it" is not, by itself, a diagnosis. A specialist operator can supply capital a city does not have, absorb construction risk, maintain equipment over its full life and move faster than municipal procurement. The World Bank's guidance on public-private partnerships states the other half of the bargain just as plainly: even where a private party finances, builds and operates infrastructure, government stays responsible for the quality and quantity of the public service. The useful question is not whose name is on the asset. It is who can change the service, inspect it, obtain its data and replace the operator when the public interest shifts.

Ownership is a bundle of rights, not a single label

A smart-city project rarely has one owner. The land may be public, the equipment private, the software licensed, the data jointly controlled and the service regulated by another level of government. A more honest test separates six rights:

1. Capital. Who pays for construction, equipment and replacement?
2. Assets. Who owns the vehicles, cameras, sensors, stations and network?
3. Operations. Who runs and maintains the service day to day?
4. Data. Who can obtain raw and derived data, in usable formats, during and after the contract?
5. Decisions. Who sets fares, coverage, service levels and the automated rules?
6. Exit. Who can audit, intervene, terminate and keep the service running with another operator?

Third-party capital and operations can be strengths. Third-party control of all six is a warning. This matters more for smart systems than for concrete because these assets are not passive. A bridge does not decide who may cross it. A ticketing platform allocates subsidies and records journeys. A camera network decides which streets become machine-readable. A software update can change a service with no concrete poured and no council vote held. OECD guidance therefore treats data portability and the avoidance of vendor lock-in as public-interest procurement questions, not optional technical refinements: a city that cannot move its records to a new system holds a right to switch suppliers that is worthless in practice.

Montréal: private discipline, public exposure

Calling the REM "private" would be too simple. CDPQ Infra is wholly owned by the Caisse de dépôt et placement du Québec, which manages public pension and insurance funds. It is neither Montréal's transit authority nor a conventional vendor. The model has real attractions: CDPQ Infra took on financing, construction and operation of a 67-kilometre automated network, and bundling those roles rewards lifecycle thinking, because the organisation that builds the system also lives with its maintenance decisions. Governments use concessions precisely because conventional budgets and agencies do not always supply capital, capacity or speed at the required scale.

But the Québec Auditor General's November 2024 review shows why the structure deserves scrutiny. CDPQ Infra's March 2024 construction estimate had reached about C$9.4 billion. Payments are tied to passenger-kilometres, and the audit concluded that Québec government contributions will supply more than half of the ridership revenue the REM collects over its operating life. The management agreement runs for 99 years. The public is therefore not just buying tickets on someone else's railway. It is underwriting a large share of the operating model while control sits elsewhere.

The agreement also defines a protected catchment: within a set territory, other public transport may not simply duplicate a trip the REM already provides, with some exceptions, and buses are expected to feed the railway rather than compete with it. That can be efficient network planning, since parallel services waste money. It can also narrow the public authority's room to redesign the network later. Early demand adds a caution rather than a verdict: for the first nine months of operation, ridership was 57% of the base forecast, on the first branch and after pandemic-era changes in travel. That figure cannot settle the finished network's demand, but it shows who carries the downside when forecasts miss: the government contribution rises to cover much of the gap.

Long-term investors can bring long-term discipline. They also acquire long-term leverage.

The positive case: outsource what the city can still govern

Chicago's Divvy shows a cleaner division of roles. The city's transport department bought the bikes and docks with federal air-quality money in 2013 and still owns them; Lyft only operates them. The 2019 exclusivity deal committed Lyft to US$50 million in capital and is expected to pay the city US$77 million over nine years. Lyft can adjust prices, but any annual rise above 10% needs the transport department's approval. Historical trip data are published monthly and live station information runs on the open GBFS standard. Chicago combines a specialist operator's technology, labour and capital with public asset ownership, price oversight and data access.

This is not public helplessness, but it is not a guarantee either. The deal gave Lyft exclusivity and drew criticism at the time for limiting competition and moving quickly through approval. A 10% ceiling still allows steep compounding, and reporting in 2024 found Divvy raising fares near the maximum for a third straight year. A peer-reviewed case study, "A Tale of Two Divvys," argues that the shift to a private operator has pushed the system toward demand potential over locational equity, with the emphasis on profitable electric bikes squeezing classic-bike availability and pricing out lower-income riders. None of this is an argument against the arrangement. It marks where public control has to stay active: asset ownership does not deliver affordable prices or fair coverage on its own, it only gives the city leverage to pursue them.

Montréal's BIXI points the same way. After its original supplier went bankrupt in January 2014 owing about CAD 50 million, the city bought the local assets for CAD 11.9 million and created a non-profit to run them. BIXI now reports about 12,600 bikes at close to a thousand stations across thirteen municipalities. Its history does not prove that public or non-profit operation never fails. It shows that a mobility service can survive the failure of one corporate structure when the city keeps the local system and can redesign its governance. The strongest pro-ownership argument is not that companies are more efficient than governments. It is that specialisation can be bought without permanently surrendering the service. One caveat the atlas records: the copyright in BIXI's published trip data is claimed by the operator, not the city, which is why its data cell above reads third party even though the bikes are municipal.

Johannesburg: when speed arrives before governance

Vumacam is the opposite sequence. It is a private company, not a city programme: since 2019 it has mounted cameras on its own poles across Johannesburg and sold access by subscription to private security firms and residents' associations, with plate readers beside the overview cameras. The company says its Gauteng network now exceeds seven thousand public-space cameras. The appeal is obvious, and it is the purest form of the pro-ownership case: private capital builds capacity the state can use at once. In February 2024 the Gauteng provincial government gained access to more than 6,000 cameras through a partnership.

The only published outcome figures, however, are the operator's own. Vumacam told MIT Technology Review that its cameras aided the apprehension of 97 vehicles and 85 arrests in one Johannesburg district over seven months, and its chief executive said he did not know whether those arrests led to convictions. No independent evaluation, crime-reduction study or audit of the network has been located. Coverage grows first where customers can pay: investigations of the early rollout described a concentration in wealthier suburbs and raised concerns about privacy and automated plate recognition in the absence of any regulatory framework. South Africa still has no statute governing public-space cameras.

The legal history is often misread. In 2020 the High Court ruled against Johannesburg's roads agency after it stopped processing Vumacam's applications to install poles in public road reserves. The judgment was narrow: the agency could not use its wayleave power to impose a surveillance policy the by-law did not authorise. It did not certify the network as privacy-safe. The city later adopted a by-law requiring registration of private cameras overlooking public space, then withdrew it in 2025 under litigation pressure, before any court had ruled on the challenges. The result is a paradox: a private network reached metropolitan scale before the city had a durable framework for deciding where cameras go, who may use the data, how performance is judged or what happens if the relationship ends. The failure is not that a company owns cameras. It is that public access to a private system was mistaken for public control of it.

Rio: taking back control without rejecting concessions

Rio de Janeiro shows that control can be recovered, and that recovery need not mean permanent municipal operation. The city's BRT system ran under private bus concessions. A city-ordered intervention found a 33% loss of operating fleet between 2017 and 2019, and by September 2020 56 of 125 stations were shut. Rio revoked the operators' concession in February 2022 and handed the network to the municipal company Mobi-Rio, which reopened stations and bought a new fleet. Yet the mayor still argued the system should ultimately be run by a private concessionaire. That is not inconsistency. It separates two questions cities too often collapse: should a specialist company operate the service, and must that company also control the assets, revenues, data and rules?

Rio applied the same distinction to fare collection. For a decade the card that billed the city belonged to the bus operators' own federation, so the city paid subsidies without audited boarding counts. Its replacement, the Jaé system, is itself a 12-year private concession worth about R$1.34 billion. But this time the city published the procurement and contract documents, wrote rules for municipal custody of the system's primary keys, and began publishing operating data that exposes fare revenue and passenger counts government could not previously inspect. The redesign is not flawless: a 2025 FGV Transportes review praised the data transparency while warning that registration errors could distort planning. Public control does not remove technical failure. It makes failure observable, and gives the authority a stronger basis to demand a fix.

The clauses that matter more than the ownership label

The cases point to a practical test. Before approving a smart-city concession, licence or partnership, a city should be able to answer yes to six questions:

• Can it retrieve the complete operating record? Not a supplier-chosen dashboard, but timely raw and derived data, a documented data model, audit logs and export rights in non-proprietary formats. Privacy limits on personal data should not leave the authority blind to service performance.
• Can policy change without renegotiating the whole business model? Fares, service standards, coverage and accessibility should be adjustable through defined procedures, not bought back from the supplier every time elected policy shifts.
• Is exclusivity narrow, justified and reviewed? Some may be needed to finance a network. A protected market with no meaningful review turns an operating contract into a policy veto.
• Are assets and knowledge portable? The contract should say what happens at expiry to equipment, software configurations, documentation, cryptographic keys, domain names, customer accounts and historical data. A termination right is weak if switching supplier would stop the service.
• Does coverage follow public need, not only revenue? Commercial demand is a signal, not a map of public value. Minimum-service and universal-access targets need funding and enforcement.
• Does the city have the capacity to use its rights? Contract language cannot substitute for engineers, data specialists and regulators. A city that owns the data but cannot analyse it, or holds audit rights it never exercises, is only nominally in control.

The verdict: outsource machinery, not sovereignty

The record does not support a blanket case against third-party ownership. Chicago secured a large capital commitment while keeping Divvy's physical assets. Montréal's REM mobilised institutional finance and tied construction to long-term operation. Vumacam built a network at a scale government could use immediately. Rio kept using private concessions even after a failed one, because competent private operation is still valuable. What the record does support is scepticism toward models where the same outside party accumulates the asset, the data, the pricing power, the coverage decision and the practical ability to block replacement.

Public ownership can fail through weak maintenance, political interference or missing expertise. Private ownership can succeed through disciplined investment and specialist operation. The decisive variable is not ideology. It is contestability: whether the public authority can see what is happening, change the rules and credibly walk away without losing the service. That is why the most resilient model looks less dramatic than either privatisation or municipalisation. The city defines outcomes, keeps the data and exit rights, owns the irreplaceable layer where it can, and lets qualified third parties compete to build or run the rest. This is the same fault line that runs under most of the cases in why smart cities fail: the technology is rarely the thing that breaks.

Your smart city may be owned by someone else. That is not automatically a problem. It becomes one when the city no longer owns its choices.