In February 2023, New York-based construction training provider Valor Security and Investigations, along with six of its executives, was indicted on charges that the company issued thousands of safety certificates without providing any training at all. The words belong to Manhattan District Attorney Alvin Bragg, who described it as thousands and thousands of safety certificates and cards issued without any training whatsoever.

The charges stem from a November 2022 incident in which construction worker Ivan Frias fell to his death from the 15th floor of a job site on West End Avenue. Frias was safety certified. He had, on paper, completed an eight-hour fall prevention course. He was one of more than 20,000 Valor-certified workers who allegedly received little or no actual safety training.

This is not an abstract compliance problem. A person died.

The System That Made This Possible

Valor's alleged fraud may be extreme, but the conditions that enabled it are not unusual. They reflect a broader pattern in how safety training is treated by some employers and some training providers.

For some employers, safety training is viewed as an expense to be minimized rather than an investment in the people doing the work. The demand for cheaper, faster, easier certification creates a market for providers willing to supply it. Valor appears to have been built to serve exactly that demand.

Training companies can be complicit in this. When the priority is volume and convenience rather than the integrity of the program, corners get cut. Verification gets skipped. Participation goes unconfirmed. A certificate gets issued that represents nothing.

That attitude then reaches the workers themselves. Disillusioned by a system that treats their safety as a formality, many disengage from training altogether. They navigate hazardous job sites without the knowledge they were supposed to have. The certificate says they are qualified. The training says otherwise.

What the Indictment Establishes

The Valor case is not just a criminal matter. It is a public statement about what verified training actually means, and what happens when it is absent.

Courts have consistently held that for safety training to carry legal and regulatory weight, it must involve confirmation of who completed it and whether they participated. The Valor indictment reinforces this standard at the criminal level. Issuing a certificate without delivering training is not just a compliance failure. It is fraud.

For employers, the implication is direct. A training record that cannot confirm identity or participation is not a defense in a regulatory investigation or a wrongful death proceeding. It is evidence of negligence.

What Meaningful Reform Looks Like

The Valor case makes clear that voluntary standards are not sufficient. Regulatory agencies need to strengthen oversight and codify what courts have already established: that valid safety training requires verified identity and confirmed participation.

Employers need to recognize that the cost of cutting corners is not abstract. It is measured in the lives of workers who trusted that their training prepared them for what they would face on the job.

And the industry needs to move past treating safety training as a checkbox. A certificate that was never earned is not protection. It is a liability, for the employer, for the certifying organization, and most importantly for the worker whose name is on it.

Every worker has the right to return home safely at the end of each day. Verified training is one of the most direct ways employers can uphold that right. Anything less is a failure of responsibility.

{{post-cta}}

Most people assume fraud means stealing or pretending to be someone else. In the world of workplace training and certification, the definition is broader than that. Fraud is also when a person receives credit for something they did not, in fact, do.

That definition has real consequences for employers, and two recent cases make it impossible to ignore.

When Certifications Become Fraudulent

In Australia, a registered training organization was charged with issuing false documents to multiple trainees. The organization marked participants as attending a full two-day training when they had actually left at noon each day. Participants received certifications to operate forklifts and erect scaffolding without meeting the full training requirements. The organization faced significant financial penalties as a result.

In Canada, the Royal Canadian Mounted Police uncovered a large-scale counterfeiting operation selling fake training certifications for safety credentials including H2S Alive and First Aid/CPR. H2S Alive is issued to people working with hydrogen sulphide, a highly flammable and toxic chemical. The people who purchased these certificates did not miss half a course. They did not participate in any training at all.

In both cases, employees and their colleagues were put at risk. That risk includes injury, loss of limb, and death.

Why This Happens More Often Than Organizations Realize

It is far too common for certificates to be issued without confirming identity or full participation. Most people do not think twice about the consequences of leaving a training session early. Few would assume that attending training where identity and attendance are not confirmed could result in a regulator declaring their certificate fraudulent.

But that is exactly what happens.

Employers carry a legal and moral responsibility to protect their employees and their organization from risk. Employee certifications are a promise to colleagues, clients, and regulators that your workforce meets industry standards. If you cannot demonstrate that your employees actually completed the required training, that promise is hollow and the certification that represents it may be worthless.

Without a trusted mechanism to verify identity and participation, the consequences range from reputational damage to financial penalties to legal action.

Who Is at Greatest Risk

Workers who operate heavy machinery or work with dangerous chemicals face the highest physical risk from fraudulent certifications. But employees across all roles must be able to demonstrate proof of training that holds up to scrutiny.

The Australian case resulted in financial penalties and a loss of public trust. For organizations in regulated industries, that combination of reputational and financial damage can have lasting consequences that far exceed the cost of implementing proper verification in the first place.

How Organizations Are Addressing This

The solution starts with how training organizations are selected and evaluated. For in-person training, careful vetting of providers is essential. For online training, which now accounts for the majority of workplace learning, the training organization must use an identity verification and participation monitoring solution.

Effective online proctoring uses a combination of human review and AI to verify that the right employee takes the right training and stays engaged throughout, without adding significant cost or administrative burden.

Safety-conscious businesses and industry safety organizations are increasingly requiring verified training, allowing them to take advantage of online delivery without compromising legal compliance or risk management. This trend is accelerating across industries where the consequences of unverified training are most severe.

Choosing verified online training gives employers documented evidence that their workforce completed training as required, evidence that holds up in regulatory investigations and legal proceedings.

{{post-cta}}

When a proctoring tool violates a participant's privacy, who is responsible? The software vendor? The organization that deployed it? Both?

Recent legislation and court decisions from Canada, the UK, and the United States have answered this question with increasing clarity: the liability rests with the organization running the testing, not the software provider. For anyone deploying online proctoring, this is not an abstract legal point. It is a direct operational risk.

The Core Issue

Organizations that deliver online training and testing have a legitimate need to confirm who is taking their assessments and that participants are engaging in good faith. Meeting that need often requires collecting sensitive personal data: ID images, biometric verification, session recordings, and audio. The question of who bears legal responsibility for how that data is handled has been answered by courts and regulators in ways that most organizations have not fully reckoned with.

The consistent finding across multiple jurisdictions is that the data-collecting organization, not the software vendor, is the accountable party.

CASL: The Canadian Perspective

Canada's Anti-Spam Legislation was created in 2014 to reinforce best practices in electronic communications and combat spam and related cyber threats. Among its provisions, CASL requires organizations to obtain consent and written acknowledgement before using invasive computer programs, and to provide users with assistance in removing such programs afterwards.

Under CASL, software is considered invasive if it interferes with the user's control of their computer system by opening programs, printing, or accessing files without their knowledge, or if it changes system settings, preferences, or commands without their knowledge.

Online proctoring tools that block restricted sites, monitor web use, require camera access, or install browser extensions clearly fall within this definition. And most proctoring plugins do not provide uninstall assistance, remaining active by design after the session ends to reduce support overhead for the vendor.

The risk for organizations: CASL violations carry regulatory penalties of up to $10 million per violation. If your proctoring system leaves you liable to CASL noncompliance, that exposure belongs to you, not your vendor.

GDPR: The Global Standard That Places Liability on the Data Owner

The EU's General Data Protection Regulation has established a universal standard for data privacy that reaches any organization handling the personal data of EU residents, regardless of where that organization is based.

Under GDPR, the organization running the testing is the data controller, while the proctoring tool is the data processor. Fines for inappropriate collection, storage, transfer, or deletion of personal data fall on the data controller, not the data processor.

Ireland's Data Protection Commission made this distinction explicit in a judgment against Slane Credit Union Limited, stating that processors cannot be used by controllers as a legislative safety net, and that it is essential that due diligence is carried out to ensure the protection of personal data.

GDPR fines can reach 20 million euros or 4% of a company's total worldwide annual revenue, whichever is higher. The liability for how a proctoring vendor handles learner data belongs to the organization that chose to deploy it.

BIPA: The Illinois Warning

American organizations are increasingly coming under regulatory scrutiny for proctoring practices. Illinois' Biometric Information Privacy Act is one of the most consequential examples.

BIPA places liability on organizations when biometric data is collected or used in a way that violates participant privacy, including failing to secure written consent and failing to publish a retention schedule outlining when data will be permanently destroyed.

Two landmark cases illustrate how serious this exposure can be.

BNSF Railway Co. was subject to a $228 million jury verdict for scanning the fingerprints of truck drivers without consent. The case was eventually settled for $75 million. The third-party vendor that provided the scanning technology was not implicated in the charges.

White Castle System Inc. faced a separate BIPA lawsuit in which the Illinois Supreme Court ruled that claims accrue with each individual finger scan, exposing the restaurant chain to a potential liability in the billions of dollars. White Castle ultimately settled for approximately $10 million. Again, the vendor supplying the technology was not the party held accountable.

The pattern across both cases is consistent: the organization that deployed the biometric technology bore the liability. The software vendor did not.

Cleveland State: A Fourth Amendment Violation

In 2022, a federal court found that Cleveland State University's remote testing requirement of a room scan constituted unreasonable search and seizure in violation of students' Fourth Amendment rights.

Cleveland State used two separate proctoring providers to facilitate these scans. Both were named in the decision. Neither was fined. The university bore the consequences.

This case illustrates two important points. First, the room scan requirement itself was the violation, regardless of which vendor implemented it. Second, choosing a proctoring tool that conducts room scans does not transfer the legal risk to the vendor. The organization that required the scan is the one that faces the consequences when that requirement is found to violate participant rights.

What This Means for Online Training and Testing Providers

These cases are not outliers. They reflect a consistent and accelerating trend in privacy legislation globally: organizations are responsible for the actions of any third-party software, plugins, or services they deploy. Vendor liability does not substitute for organizational accountability.

For organizations delivering online training and testing, this has direct implications for vendor selection. The question is not just whether a proctoring tool works. The question is whether deploying it creates liability for your organization under CASL, GDPR, BIPA, or other applicable legislation.

The steps that reduce that liability are straightforward: choose a vendor with documented privacy practices, confirm that data handling complies with the legislation applicable to your jurisdiction and your learners' jurisdictions, require clear data deletion timelines, and ensure that any software deployed on learner devices complies with consent and removal requirements.

How Integrity Advocate Approaches This

Integrity Advocate is designed to reduce the compliance exposure that comes with deploying a proctoring tool, not to add to it.

No installation is required in most cases, which eliminates CASL's invasive software provisions entirely for the majority of deployments. Data is collected only for its stated purpose and deleted by default within 24 hours of session completion. Consent is obtained before any data collection begins. Data is stored in GDPR-designated jurisdictions. Room scans are optional rather than mandatory, and can be enabled or disabled based on the organization's assessment of their necessity and proportionality.

These are not policy commitments. They are architectural decisions built into how the platform works.

{{post-cta}}