The terrorist attacks of September 11, 2001 triggered a fundamental shift in how the United States conducts surveillance. What began as targeted monitoring—individual wiretaps and pen-register orders—morphed into mass-collection programs that sweep up the communications and location data of millions of people who are not suspected of any crime. In an essay originally published in Lawfare, security expert Bruce Schneier and Electronic Frontier Foundation executive director Cindy Cohn mark the 25th anniversary of that shift and argue it is time for a full accounting of its costs.
The article opens by introducing Bruce Schneier as the primary author of the Lawfare essay marking 25 years since the surveillance shift after 9/11; his photo identifies the central voice behind the argument.
## From Targeted to Mass Collection
The earliest and clearest example is the National Security Agency's bulk telephone-metadata program. Launched under a claim of pure executive authority as the "President's Surveillance Program," it was secretly re-grounded in 2006 on a novel reading of Section 215 of the USA PATRIOT Act—a provision that had previously authorized only targeted record requests. The program remained officially unacknowledged until Edward Snowden's 2013 disclosures. In 2015 the Second Circuit Court of Appeals rejected the government's Section 215 interpretation, and Congress passed the USA Freedom Act, which ended indiscriminate bulk collection but still permits collection of a "tremendous amount" of domestic call records.
A parallel track, the NSA's Upstream program, taps directly into internet backbone junctions inside the United States to intercept both metadata and content. Brought under programmatic (not individualized) Foreign Intelligence Surveillance Court review via Section 702 of the 2008 FISA Amendments Act, Upstream officially targets non-U.S. persons abroad. Yet it inevitably captures Americans' communications—either because they communicate with people overseas or through "overcollection" that gathers far more data on non-targeted U.S. persons than the law authorizes. Congress allowed the statutory authority to expire in 2026, though previously approved collection continues until at least spring 2027.
## The Private-to-Government Pipeline
A defining feature of modern mass surveillance is that governments increasingly obtain data through private companies. "Surveillance is the business model of the internet," the authors write; firms such as Google and Facebook constantly monitor user behavior for advertising purposes. The NSA relies on data from telecommunications and internet providers; local sheriffs and ICE agents buy cellphone location data and query privately managed automatic license-plate reader (ALPR) networks like Flock and Vigilant Solutions. FBI Director Kash Patel recently confirmed in congressional testimony that the bureau purchases information on Americans from data brokers and intends to keep doing so.
This pipeline means that as commercial surveillance expands—driven by "surveillance capitalism" and now supercharged by AI analysis—more data becomes available to law enforcement without traditional legal process. Facial recognition, once limited to elite federal units, is now deployed by ICE, the Transportation Security Administration, and private venues such as Madison Square Garden. ALPR networks blanket public and private roadways, enabling cross-jurisdictional searches that have been used to track people seeking abortions across state lines.
## Constitutional Erosion
The Fourth Amendment guarantees security in "persons, houses, papers, and effects" against unreasonable searches, requiring warrants supported by probable cause and particularity. Mass surveillance inverts this logic: it grants access to the digital equivalent of "papers and effects" without individualized suspicion or a particularized description of what is seized. The government has advanced multiple doctrines to keep this data outside constitutional protection:
- **Section 702's "incidental collection" argument**: Communications of U.S. persons caught in the dragnet supposedly lack Fourth Amendment protection because the initial target was foreign. - **Metadata exceptionalism**: The claim that metadata falls outside the Fourth Amendment, despite its demonstrated power to reveal intimate details of daily life. - **Third-Party Doctrine**: The Supreme Court-created rule that data shared with service providers loses constitutional protection. - **Machine-analysis loophole**: The assertion that only "human eyes" trigger constitutional scrutiny—a distinction that collapses as AI systems analyze vast datasets autonomously.
Together with standing doctrines that block judicial review, these arguments have shrunk the slice of Americans' digital lives that actually enjoys Fourth Amendment protection.
First Amendment concerns are equally acute. The right to anonymous speech and association depends on a "zone of privacy" against government monitoring. The 2026 U.S. Counterterrorism Strategy explicitly states that the White House "will prioritize the rapid identification and neutralization of violent secular political groups whose ideology is anti-American, radically pro-transgender and anarchist" and "will use all the tools constitutionally available to us to map them at home, identify their membership, map their ties to international organizations like Antifa." While framed as targeting violent groups, the language signals an intention to turn national-security surveillance tools—including mass-collection authorities—against domestic activists, creating a direct chilling effect on protected political activity.
## Documented Abuse and Error
Even granting some operational utility, the historical record shows that mass-surveillance tools are inevitably misused. The NSA coined an internal term—"LOVEINT" (Love Intelligence)—for analysts who abused access to spy on romantic partners or ex-spouses. Representative Zoe Lofgren (D–Calif.) recently cited improper "backdoor searches" of Section 702 data against protesters, 19,000 campaign donors, members of Congress, journalists, government officials, and a state-court judge who had complained about police misconduct.
Similar patterns appear at the state and local level. A Texas police officer misused ALPR data to track a woman suspected of seeking an abortion, then lied about it. Multiple law-enforcement officials have been accused of using surveillance databases to monitor romantic interests or ex-partners. The same technologies have been deployed against immigration targets and against citizens exercising their First Amendment right to record police.
## The Missing Cost-Benefit Analysis
A central thesis of the essay is that the national-security community has never produced a comprehensive cost-benefit analysis of these programs—neither in taxpayer dollars nor in diverted resources—nor demonstrated that mass surveillance stopped attacks that targeted methods could not. The NSA occasionally cites success stories, but these "regularly fall apart upon serious scrutiny." Likewise, no rigorous study establishes that domestic law-enforcement use of ALPRs, facial recognition, or location data makes communities safer or that alternative techniques could not achieve the same results. Vendors such as Flock equate database "hits" with solved crimes, a metric the authors call "dubious data."
## What Remains Uncertain
The essay does not claim mass surveillance has zero utility; it argues that whatever utility exists must be "seriously weighed against the costs"—a weighing that has never occurred. The precise scale of overcollection under Section 702 remains classified. The full scope of data-broker purchases by federal agencies is not publicly documented. And the operational impact of the 2026 Counterterrorism Strategy's domestic-turn provisions has yet to be tested in court.
What is clear, after 25 years, is that the architecture built for a specific emergency has become a permanent, expanding infrastructure—one that blurs the line between public and private surveillance, weakens constitutional safeguards, and has a documented history of abuse. The authors' conclusion is not a call to abandon all surveillance, but a demand for the kind of rigorous, transparent evaluation that democratic governance requires before such powers become entrenched beyond recall.