Despite the stated goal of conducting mass spying only on people outside the
U.S. -- which itself is problematic given international law's requirement that
surveillance be both necessary and proportionate -- mass surveillance collects a
tremendous amount of U.S. persons' communications. This can happen because
people communicate with people abroad, or because of overcollection -- when
government agencies gather far more personal data on non-targeted US persons
than authorized by law. The concerns about collecting Americans' data on U.S.
soil led Congress to allow the program to officially expire in 2026, although
the previously-approved mass surveillance itself continues until at least Spring
of 2027.

The shift to mass surveillance would be notable enough even if it remained only
a strategy of the intelligence community. It has not. Americans are awash in
mass surveillance. Networks of automated license plate readers such as those
offered by Flock and Vigilant Solutions blanket both public and private roadways
and parking lots. These networks often allow searches by law enforcement,
including across jurisdictions. They are, for example, being used to track
people seeking abortions across state lines. Facial recognition tools, once the
province of only the more elite parts of federal law enforcement, are
increasingly used by Immigration and Customs Enforcement agents on immigrants
and protesters, in airports by the Transportation Security Administration, as
well as by private entities. And, of course, modern phones track users'
locations constantly -- and that information is readily available to law
enforcement, often with only minimal process protections.

Constitutional Costs

Regardless of the murkiness of its actual usefulness, the shift from targeted to
mass surveillance has profound implications for Americans'rights. It has created
risks that have become increasingly evident, especially under the Trump
administration.

At a basic level, the Fourth Amendment guarantees that citizens can be secure in
their "persons, houses, papers and effects" from unreasonable searches. Warrants
breaching that security should be supported by probable cause and particular
descriptions of the place to be searched and items to be seized. Mass
surveillance turns that promise on its head, allowing access to our "papers and
effects" by the government without individualized suspicion or a particularized
description of what data is being seized, much less probable cause. This
protection was in response to colonial British misuse of writs of assistance,
which authorized indiscriminate searches rather than targeted ones.

The justifications for exempting mass surveillance from constitutional
protection vary. For Section 702, the government has taken the position that
U.S. persons' communications caught up in the dragnet, either due to
overcollection or because they were communicating with someone outside the
United States, do not require a warrant prior to initial collection or secondary
access by the FBI and several other agencies. The argument is that if the
initial collection was not aimed at Americans, the information is free from
constitutional protection for any later uses, even for reasons far afield from
the initial rationale for collection.

Other arguments rest on the claim that metadata is outside the Fourth Amendment,
despite its demonstrated ability to reveal intimate details of all of our lives.
Still others rest on the Supreme Court-created Third Party Doctrine, which holds
that the Fourth Amendment does not apply to data shared with companies that
provide us with services. Some turn on whether analysis by machine counts,
claiming that only "human eyes" matter -- a particularly troubling argument with
the rise of artificial intelligence. What's more, the government has used
doctrines like standing to limit the ability of those subjected to mass
surveillance to seek constitutional protection. No matter the argument, the goal
is the same: to place the mechanisms and fruits of mass surveillance outside the
protections of the Fourth Amendment.

The overarching truth is that, due to the concerted efforts by the government
since 9/11, and the rise of technologies in recent years, the slice of
Americans' lives and data that are actually protected by the Fourth Amendment
has shrunk significantly in the past 25 years. Together, with the technical
capabilities of mass surveillance and the increased ability for that data to be
analyzed using AI tools, the "security in our papers and effects" that the
constitution promises seems increasingly illusory.

In addition to the Fourth Amendment, mass surveillance creates tensions with the
First Amendment. The Constitution has long recognized that the right to freedom
of speech requires a zone of privacy against governmental surveillance. The
right to anonymous speech as well as the right of association both recognize the
chilling effect that surveillance creates for people saying unpopular things or
attempting to organize for political or other societal change. Mass surveillance
grants the authorities the ability to track those people, both in real time and
historically, that is inconsistent with actual techniques of freedom of speech
and assembly.

That is why the recently released 2026 U.S. Counterterrorism Strategy is so
troubling. On page seven, the White House expressly states that it intends to
target domestic activists with its heretofore foreign-targeted powers. It says
that the government "will prioritize the rapid identification and neutralization
of violent secular political groups whose ideology is anti-American, radically
pro-transgender and anarchist" and "will use all the tools constitutionally
available to us to map them at home, identify their membership, map their ties
to international organizations like Antifa." While framed as targeting "violent"
groups, it's clear that the government intends to use its national security
tools, presumably including the tools of mass surveillance, against Americans in
ways that will create profound tensions with the First Amendment rights of
people to organize and communicate privately.

Costs Due to Mistakes and Abuse

Even assuming some utility from mass surveillance -- a fact we do not dispute,
even if the public record is shaky and conclusory -- the history of both the
national security and domestic uses of mass surveillance confirms that these
tools are inevitably misused, and that mistakes have impacted huge numbers of
Americans. The past twenty-five years have demonstrated that it is not possible
to surveil the entire US population while staying within the bounds of even a
very generous legal framework like Section 702.

As Rep. Zoe Lofgren (D-Calif.) recently stated in discussion of Section 702 in
an interview with Tech Policy Press: "backdoor searches have been used
improperly for protestors, 19,000 campaign donors, members of Congress,
journalists, government officials, a state court judge who had complained to the
FBI about police misconduct. It has been abused substantially in the past." The
NSA experienced so much abuse of its mass surveillance tools by actual or
aspiring romantic partners and ex-spouses that an internal name emerged for it:
"LOVEINT," or Love Intelligence.

That same pattern of abuse is now emerging at the domestic law enforcement
level. A Texas police officer misused, and then lied about, using license plate
readers to track a woman suspected of seeking an abortion. Multiple law
enforcement officials have been accused of tracking people they either wished to
have a relationship with or who were their exes. And mass surveillance
technologies have been used to track both immigration targets and citizens
engaging in their First Amendment-protected right to track and record the
police.

Mistakes are inevitable with collections of data of this size and scope. The
history of the FISA court's reviews of Section 702 is littered with examples of
the NSA not being able to follow its own rules limiting the scope of what it
collects and analyzes, even after having been given multiple chances by the
court. On the local level, the technical protections that Flock, for example,
put in place have repeatedly been insufficient to stop "accidental" sharing its
data with out-of-state law enforcement. These mistakes have fueled growing
efforts by local communities across the country to remove license plate readers.
Those efforts should be the first step in a broader reconsideration of mass
surveillance.

More generally, ubiquitous surveillance carries a real societal cost. The
chilling effects are real and pervasive, and they tend to fall hardest on the
most marginalized members of society. Moreover, social progress requires the
ability to experiment in secret. It's hard to imagine a society progressing
morally to the point of accepting and legalizing things like marijuana use or
gay marriage if the earliest signs of that shift are snuffed out because of
overzealous surveillance.

Reversing Course

While a cost-benefit analysis is not the best frame for deciding constitutional
rights, it is a place to start to evaluate government policies. If the costs are
too high and the benefits too small, what should the public do? While the policy
and legal frameworks can be individually complex, mass surveillance is a problem
in all of its applications. So too should solutions be comprehensive rather than
piecemeal.

One comprehensive strategy is to reset the promise of the Fourth Amendment and
recognize that a warrant is required prior to collection, access or use of
information gathered through mass surveillance. This would apply to collections
that include U.S. persons, whether done for national security or domestic
purposes. This protection would apply regardless of whether the information is
in the form of metadata. It would apply regardless of whether the information is
held in homes or by services people rely on, such as telephones, internet or
social network providers, or by private entities utilizing mass surveillance for
their own purposes. By passing this legislation, Congress could ensure this
rejection of mass surveillance, and include real enforcement such as a private
right of action and an automatic exclusionary remedy in criminal prosecutions.
The courts could also recognize this protection of "papers and effects" directly
as a plain language interpretation of the Fourth Amendment.

There are already a number of efforts that take on pieces of mass surveillance.
Section 702 has expired and should remain so. This was due largely to efforts to
block the "back door" access to Section 702-collected data without warrants. The
bipartisan "Fourth Amendment is Not for Sale Act" would prevent the government
from purchasing data that it would otherwise need a warrant to obtain. The
Supreme Court itself has already been chipping away at the Third Party Doctrine,
with a recent step in the rejection of mass geofence warrants
-- warrants seeking the identities of individuals based upon their proximity to
a crime -- in Chatrie v. United States. Now, such warrants fall, at least
initially, under the Fourth Amendment.

A more comprehensive approach would also address mass surveillance carried out
by private companies, and to ensure that Americans have the right to encrypt and
secure their data. There are many reasons the United States would benefit from a
comprehensive privacy law -- and curbing mass surveillance is one of them.
Addressing mass surveillance is certainly one of them. Ideas such as the banning
of secondary uses of data -- with roots in the Fair Information Practice
Principles from the 1970s -- are worth pushing forward. So are moves such as
creating fiduciary duties for mass data collectors. There are many more ways to
curtail private companies' mass surveillance while staying within constitutional
boundaries. But addressing the costs of mass surveillance by both companies and
governments is even more important in a world where AI agents are making
decisions both about the public and on their behalf based on their data and
observed behavior.

Twenty-five years after the U.S. government embraced mass surveillance, it's
time to evaluate it as a whole, and consider responses that address the problem
as a whole. Americans must ask: Is it consistent with a self-governing democracy
to have systems that watch everyone everywhere? Is the public comfortable with
governments -- federal, state, local -- that seek to "know it all" about its
citizens? Is the public comfortable with private mass surveillance in its own
right and as it's being increasingly used to fuel government surveillance? These
questions have long needed serious consideration. But as it becomes increasingly
evident that the Trump administration is using mass surveillance to keep itself
in power, stifle dissent, and undermine political opponents, these questions are
now more urgent than ever.

** *** ***** ******* *********** *************

Since 1998, CRYPTO-GRAM has been a free monthly newsletter providing summaries,
analyses, insights, and commentaries on security technology. To subscribe, or to
read back issues, see Crypto-Gram's web page.

You can also read these articles on my blog, Schneier on Security.

Please feel free to forward CRYPTO-GRAM, in whole or in part, to colleagues and
friends who will find it valuable. Permission is also granted to reprint
CRYPTO-GRAM, as long as it is reprinted in its entirety.

Bruce Schneier is an internationally renowned security technologist, called a
security guru by the Economist. He is the author of over one dozen books --
including his latest, Rewiring Democracy -- as well as hundreds of articles,
essays, and academic papers. His newsletter and blog are read by over 250,000
people. Schneier is a fellow at the Berkman Klein Center for Internet & Society
at Harvard University; a Lecturer in Public Policy at the Harvard Kennedy School
and the Munk School at the University of Toronto; a board member of the
Electronic Frontier Foundation, AccessNow, and the Tor Project; and an Advisory
Board Member of the Electronic Privacy Information Center and
VerifiedVoting.org. He is the Chief of Security Architecture at Inrupt, Inc.

Copyright ? 2026 by Bruce Schneier.

** *** ***** ******* *********** *************

Mailing list hosting graciously provided by MailChimp. Sent without web bugs or
link tracking.

--- BBBS/LiR v4.10 Toy-7
 * Origin: TCOB1 https://binkd.rima.ie (618:500/1)