A New Era of Mass Surveillance Is Taking Shape

We're entering an era of automated, turbo-charged assaults on privacy – and as tech companies give the government new AI-driven means of monitoring Americans at a massive scale, we're also seeing a bipartisan resistance from elected leaders to update the privacy rules of engagement for a new future.

This dynamic was witnessed this past week in the bipartisan passage of an extension to a key spy bill, but also through a deluge of less-publicized privacy-eroding bills collectively defining a new era of government-obtainable user data.

Evolving Surveillance Threats

The Foreign Intelligence Surveillance Act of 1978, or FISA, has long served as a controversial pillar of how the U.S. conducts surveillance abroad. It allows federal law enforcement and intelligence agencies to intercept the digital communications of foreign nationals located outside the United States without warrants, and is one of the most controversial pillars of modern surveillance policy.

At the center of FISA is a secretive court that reviews and approves government requests to conduct surveillance, without the knowledge of the person being monitored. While intended to target foreign individuals outside the United States, FISA surveillance inevitably sweeps more broadly. Because online networks are global, FISA surveillance can also extend to individuals who are not themselves under investigation. As a result, entirely domestic conversations can be collected, stored, and queried by intelligence agencies without requiring a traditional warrant.

Despite controversy over FISA, a bipartisan coalition within the U.S. House of Representatives just approved a three-year extension of the spy power program, declining to make any revisions.

Why should you care about FISA when it seems to be one of the few things Republicans and Democrats in Congress (mostly) agree on?

The surface area for government intrusion is growing and law-abiding citizens have fewer options at their disposal to avoid getting caught up in mass collection.

Earlier this year, the Federal Communications Commission banned the sale of new consumer internet routers manufactured outside the US, citing national security concerns. This push coincides with a nationwide push for operating system-level identity verification programs; the U.S. Congress, State of New York, and State of California have all introduced bills that will require software manufacturers to obtain the government-issued identifications of users.

In parallel, just this week, the Senate Judiciary Committee unanimously advanced the GUARD Act, a bill that will require AI companies to verify the identity of every American who wants to use a large language model. Per the bill’s text, “reasonable age verification measures” cannot include checkboxes or self-entered birth dates. These developments could ultimately exclude anyone who refuses to verify their identity from accessing the internet, while simultaneously enabling unlimited visibility into individuals’ online activity.

Similar developments have already occurred in the United Kingdom, where children have resorted to drawing mustaches on themselves to bypass mandatory age verification checks, meaning that enforcing ID verification at scale will likely require the widespread implementation of invasive digital identity systems capable of verifying users across platforms.

If you think you can still outmaneuver pervasive U.S. government surveillance by setting your VPN to Papua New Guinea, you’d be sorely mistaken, as governments around the world are already taking steps to eliminate VPN access altogether.

Newly passed legislation in Utah (which goes into effect tomorrow) will extend enforcement of age restriction requirements on “adult-focused” websites to all individuals located within Utah, and aims to account for whether they use a VPN or proxy to mask their IP address. As it is impossible for websites to know whether VPN users are located in Utah, the Electronic Frontier Foundation warns that legal risks could force sites to either ban VPN IPs or mandate age verification for every visitor globally. In reality, meaningful enforcement of Utah’s VPN ban would likely require invasive surveillance cooperation with internet service providers.

Soon, not even your car will be immune from prying eyes. Sneakily tucked into an eleven-hundred-page 2021 infrastructure bill that was approved with little public debate, Section 24220 of the Infrastructure Investment and Jobs Act directs the NHTSA to mandate “advanced impaired driving prevention technology” in all new passenger vehicles, with a full implementation targeted for 2027. A bill was introduced earlier this year by Representative Thomas Massie to defund this regulation, but it was defeated 164-268 as 57 Republicans joined 211 Democrats in opposition.

Crossing the Rubicon

The right to privacy was never intended to be conditional.

The UN's 1948 Universal Declaration of Human Rights enshrined this right among its global standards for fundamental freedoms and protections: “No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.”

New technology has greatly scaled the capabilities of government data collection, and privacy laws have not even come close to keeping up pace in protecting your rights, instead allowing private data brokers to bulk up massive domestic data sources that can be integrated into government surveillance pipelines with little oversight.

What makes this moment so dangerous is not just the scale of the surveillance, but the lack of resistance. Bills with far-reaching implications that will fundamentally reshape the relationship between individuals and the state are being introduced with little more than passing public concern or attention.

The cypherpunk DNA still embedded in the crypto industry – though sometimes only faintly visible – aims to shield citizens from authoritarian government overreach. Ethereum culture has done better than most ecosystems at enshrining values like censorship resistance, open source, privacy, and security into its operational values, but the tech industry and tech-savvy citizens need to show up for the web's founding ideals.

It is imperative that society stands up for our fundamental right to privacy at this very moment, for once we become accustomed to being watched, many will struggle to remember what they have lost.