What Is Mass Surveillance? Collecting First and Deciding Later

Three changes converted surveillance from an expensive targeted activity into a default. Storage became extremely cheap, so retaining everything costs less than the staff time required to decide what to discard. Communications moved onto a small number of centralised platforms and through a small number of network chokepoints, which means a single access point reaches an enormous quantity of traffic. And analysis became automated, so the traditional constraint, that intercepted material had to be read by a person, no longer limits collection. The result is that the cost structure inverted: in the era of physical mail and telephone taps, surveillance was expensive per target and therefore rationed by resources, which functioned as a practical protection independent of any law. When the marginal cost of one more person's data falls close to zero, that protection disappears and only legal limits remain, which is why the legal arguments became urgent at precisely the moment the technology changed.

Several distinct techniques are grouped under the term and they raise different questions:

• •Bulk interception of communications in transit, including at undersea cable landing points, which captures traffic indiscriminately and filters afterwards
• •Metadata collection, recording who contacted whom, when, for how long and from where, without content, which is frequently treated as less intrusive in law and is in practice extremely revealing, since a pattern of contacts discloses relationships, health, religion and activity
• •Compelled access to platform data through legal orders served on companies holding it
• •Data retention mandates requiring telecommunications providers to store records of all customers for a period
• •Camera networks with automatic number plate recognition and increasingly facial recognition, which convert public space into a searchable record
• •Purchase of commercially collected data, including location data from applications, which allows agencies to obtain information they would need authorisation to collect directly
• •Device access through compelled decryption, exploitation of vulnerabilities and installed software, which is targeted rather than mass and frequently discussed alongside

The security case is that serious threats are planned in communications, that identifying who to target requires seeing patterns across a population, and that oversight plus minimisation rules prevent misuse. The objections operate on several levels. Effectiveness has been questioned by official reviews, with a United States board finding that one bulk telephone records programme had not been essential to preventing any attack, and critics argue that the volume of material collected impedes analysis rather than assisting it. Chilling effects are documented, with studies finding measurable changes in what people search for and read after surveillance revelations, which is a harm even to people who are never targeted. The accumulation risk is that databases built for one purpose are reused for others, which has happened repeatedly, and that a capability built under one government is inherited by the next. And function creep in practice is well evidenced, with powers introduced for terrorism used for ordinary policing and regulatory enforcement.

The 2013 disclosures by Edward Snowden, whatever view is taken of them, moved the legal debate from speculation to documented programmes and produced concrete change. European courts struck down a general data retention directive in 2014 for failing to limit retention to what was necessary, and have repeatedly invalidated national schemes since. Successive arrangements permitting transfer of European data to the United States were annulled over government access. Several countries legislated to place existing practices on an explicit statutory footing with judicial authorisation, which is an improvement in transparency and an acknowledgement that the activity was previously conducted under strained interpretations of older law. Encryption became widespread, which shifted the contest to access at the endpoints and produced the recurring proposal for lawful access mechanisms, which cryptographers consistently argue cannot be built to work for one government without weakening the system for everyone. The unresolved question is not whether surveillance should exist but what independent authorisation, retention limits and effective remedy look like when the collection is automatic.

Mass surveillance collects broadly and searches afterwards, which became the default because storage, centralisation and automated analysis removed the cost that once rationed it. Metadata is treated as less intrusive in law while being highly revealing, and commercially purchased location data lets agencies bypass authorisation. Official reviews have questioned the effectiveness of some bulk programmes, chilling effects on what people read are measurable, and European courts have repeatedly struck down general retention schemes.