The most dangerous surveillance systems aren’t the ones that require new technology — they’re the ones that quietly stitch together technology we already accepted years ago. Reporting has detailed how the FBI can conduct mass surveillance on American citizens without relying on artificial intelligence at all, leveraging instead the vast, fragmented ecosystem of databases, cameras, license plate readers, and commercial data brokers that already blanket everyday life. The story’s core argument is deceptively simple: the infrastructure for a surveillance state doesn’t need to be built. It already exists. The only question is who gets to query it.
The public debate about surveillance has been captured by AI anxiety — facial recognition algorithms, predictive policing models, large language models scanning private communications. That anxiety isn’t wrong, but it’s incomplete. What reporting suggests is that the FBI’s surveillance capacity rests less on algorithmic sophistication and more on access architecture: the legal and technical ability to pull from thousands of existing data streams simultaneously. No machine learning required. Just SQL queries, interagency data-sharing agreements, and a commercial data market that treats your location history as a commodity.
This distinction matters enormously. Policy conversations fixated on regulating AI in law enforcement risk missing the deeper structural problem: the data itself has already been collected, already been sold, and already been made queryable. Regulating the algorithm while ignoring the aquifer is like debating the ethics of a particular fishing net while the entire ocean has already been drained into someone’s private lake.
The infrastructure was built in plain sight
The most striking element of recent reporting isn’t any single revelation — it’s the cumulative portrait of how many surveillance-adjacent systems Americans interact with daily that are accessible, in some form, to federal law enforcement. License plate readers mounted on police cruisers and toll booths. Commercially available location data harvested from mobile apps. Financial transaction records obtainable through third-party doctrine. Social media monitoring tools purchased off the shelf from private vendors.
None of these are new. Each was introduced with a narrow, often reasonable justification: tracking stolen vehicles, improving targeted advertising, catching fraud, monitoring public safety threats. But the aggregation of these systems creates something qualitatively different from the sum of its parts. A single license plate reader on a highway is a traffic tool. Ten thousand of them, networked and queryable, constitute a movement-tracking system that covers an entire population.
This is the pattern I keep returning to in my writing — the gap between what systems are described as doing and what they actually do once deployed at scale. The Department of Homeland Security’s surveillance apparatus is set to expand significantly in the year ahead according to internal documents, with increased AI funding and spyware procurement. But recent reporting shows that even without those upgrades, the current toolkit is already formidable.
The AI debate is a convenient distraction
There’s a useful thought experiment here. If Congress passed a comprehensive ban on AI use in federal surveillance tomorrow, how much would the FBI’s actual surveillance capacity diminish? Based on recent reporting, the answer appears to be: not much. The databases would still be there. The commercial data brokers would still sell location data. The interagency sharing agreements would still function. The cameras would still record.
AI makes surveillance faster and cheaper to scale. It doesn’t make surveillance possible. That’s an important distinction that advocates and policymakers consistently blur. When civil liberties organizations frame the threat primarily as an AI problem, they inadvertently give cover to the vast non-AI surveillance infrastructure that operates with even less oversight because it’s considered boring, legacy, or routine.
This mirrors a dynamic flagged by advocates in Hawaii, where a recent push for more police surveillance technology has drawn calls for greater caution. The argument there isn’t about whether the technology works — it’s about whether the institutional checks keeping pace with deployment actually exist. They mostly don’t.
The third-party doctrine is the real skeleton key
At the legal center of this story sits the third-party doctrine — a legal principle holding that information voluntarily shared with a third party (a bank, a phone company, an app developer) carries no reasonable expectation of privacy, and thus no Fourth Amendment protection from government access. This legal framework emerged from court cases in the 1970s involving telephone records and bank documents.
That world no longer exists. Today, “sharing information with a third party” means your phone transmitting precise GPS coordinates to dozens of apps every few minutes, your car recording your driving patterns, your smart doorbell capturing footage of your neighbors, and your search engine logging every question you’ve ever been afraid to ask a doctor. The legal framework hasn’t adapted. The data volume has grown by orders of magnitude.
The Supreme Court has begun to address this gap, ruling in some cases that accessing certain forms of historical location data constitutes a search requiring a warrant. But such rulings have been narrowly written and courts have been inconsistent in extending this logic more broadly. As ICE agents increasingly deploy facial recognition technology in street-level enforcement operations, the gap between constitutional principle and operational reality continues to widen.
The commercial data market is the government’s backdoor
Perhaps the most uncomfortable implication of recent reporting is that the private sector has done the surveillance state’s procurement work for it. The commercial data broker industry — companies that aggregate, package, and sell consumer data — has created a marketplace where anyone with budget can purchase location histories, browsing patterns, and behavioral profiles. The government is a customer like any other.
This sidesteps the warrant requirement entirely. In some cases, if the FBI needs your cell tower data from Verizon, they need a court order. But if they buy equivalent location data from a broker who sourced it from a weather app you installed three years ago, the legal path is dramatically easier. The data is functionally identical. The constitutional treatment is not.
Several states have started to respond. States are enacting privacy laws and restricting technologies like license plate readers, creating a patchwork of protections that vary dramatically by jurisdiction. But state-level action can’t constrain federal agencies operating under federal authorities. The structural asymmetry is baked in.
There’s a broader pattern worth noting here — the way the real story behind tech layoffs is where the money actually goes, with public narratives masking resource reallocation. The surveillance-industrial dynamic operates similarly. The public narrative says the government is debating whether to adopt new surveillance tools. The operational reality is that the government is purchasing access to surveillance capacity that private companies already built and consumers already funded through their own data.
The consent architecture is designed to fail
Here’s where the analysis has to move beyond government overreach and into something more uncomfortable: complicity by design. The data that makes non-AI mass surveillance possible doesn’t materialize from nothing. It’s generated by billions of individual interactions with products and services whose business models depend on data extraction. Every “I agree” click on a privacy policy, every location permission granted to a food delivery app, every smart device installed in a home — these are the atomic units of the surveillance infrastructure described above.
The consent model governing these interactions was never designed to produce informed decisions. It was designed to produce agreement. A 4,000-word privacy policy written by lawyers, presented as a binary gate between you and the service you need, is not consent infrastructure. It’s compliance theater.
This connects to something I explored in a recent piece about power maps and strategic silence — the way systems create the appearance of neutrality or choice while structurally constraining what choices are actually available. You can refuse to share your location with a rideshare app. You just can’t use the rideshare app. The “choice” is real in a narrow technical sense and meaningless in a practical one.
Even the automotive sector is now navigating this tension. A Forbes report cites fleet management company Geotab claiming that drivers now demand in-vehicle cameras, reframing surveillance as safety. The language shift — from monitoring to protection — is worth watching. It’s the same repackaging that turned commercial data collection into “personalization” and government database access into “information sharing.”
Schools as the canary
The expansion of this infrastructure isn’t limited to adults or public spaces. A recent GovTech investigation examined whether federal agents can tap into school surveillance cameras, raising fundamental questions about the boundaries of government access to systems originally installed to protect children. When infrastructure built for one protective purpose becomes queryable for an entirely different enforcement purpose, the original justification becomes irrelevant. The capability is what matters.
This is the recurring theme: purpose creep as a design feature, not a bug. Systems are introduced with legitimate, bounded purposes. They are then networked, integrated, and made accessible beyond their original scope. At no point does anyone make a single dramatic decision to build a surveillance state. It emerges incrementally, through a thousand small expansions of access that each seem reasonable in isolation.
What to watch next
Three trajectories deserve close attention. First, the commercial data broker market faces increasing legal pressure from state privacy laws, but federal agencies are likely to argue national security exemptions that preserve their access regardless. Watch for court challenges testing whether state privacy statutes can restrict federal data purchases.
Second, the legal landscape around digital privacy remains unresolved. Courts remain inconsistent in applying constitutional protections to various forms of digital data. The next Supreme Court case that addresses commercially purchased data will be a consequential surveillance ruling.
Third, the organizational push documented in DHS budget documents suggests that the federal government is layering AI capabilities on top of the existing non-AI surveillance infrastructure, not replacing it. This is additive, not substitutive. The infrastructure described in recent reporting is the foundation. AI is the accelerant being poured on top.
The uncomfortable conclusion is this: the surveillance debate as currently framed — Should we allow AI in policing? Should facial recognition be regulated? — is asking the wrong question. The more fundamental question is whether a society that has already built and commercialized a comprehensive data infrastructure covering the movements, communications, transactions, and associations of its entire population can meaningfully claim that mass surveillance is something that requires a policy decision. The decision was made. It was made in a thousand product launches, a million terms-of-service agreements, and a legal doctrine that hasn’t been updated for the world it now governs. Everything else is negotiating the terms of access.
Feature image by Jakub Zerdzicki on Pexels
