Faced with government secrecy, we the people depend on whistleblowers to tell us what the state is doing. (We were reminded of this in 2019 as various whistleblowers gave the public increments of information about Trump's attempt to shake down the president of Ukraine.) However, today's surveillance intimidates potential whistleblowers, which means it is too much. To recover our democratic control over the state, we must reduce surveillance to the point where whistleblowers know they are safe.

Using free/libre software, as I've advocated since 1983, is the first step in taking control of our digital lives, and that includes preventing surveillance. We can't trust nonfree software; the NSA uses and even creates security weaknesses in nonfree software to invade our own computers and routers. Free software gives us control of our own computers, but that won't protect our privacy once we set foot on the Internet.

Bipartisan legislation to “curtail the domestic surveillance powers” in the U.S. is being drawn up, but it relies on limiting the government's use of our virtual dossiers. That won't suffice to protect whistleblowers if “catching the whistleblower” is grounds for access sufficient to identify him or her. We need to go further.

If whistleblowers don't dare reveal crimes and lies, we lose the last shred of effective control over our government and institutions. That's why surveillance that enables the state to find out who has talked with a reporter is too much surveillance—too much for democracy to endure.

An unnamed U.S. government official ominously told journalists in 2011 that the U.S. would not subpoena reporters because “We know who you're talking to.” Sometimes journalists' phone call records are subpoenaed to find this out, but Snowden has shown us that in effect they subpoena all the phone call records of everyone in the U.S., all the time, from Verizon and from other companies too.

Opposition and dissident activities need to keep secrets from states that are willing to play dirty tricks on them. The ACLU has demonstrated the U.S. government's systematic practice of infiltrating peaceful dissident groups on the pretext that there might be terrorists among them. The point at which surveillance is too much is the point at which the state can find who spoke to a known journalist or a known dissident.

When people recognize that the level of general surveillance is too high, the first response is to propose limits on access to the accumulated data. That sounds nice, but it won't fix the problem, not even slightly, even supposing that the government obeys the rules. (The NSA has misled the FISA court, which said it was unable to effectively hold the NSA accountable.) Suspicion of a crime will be grounds for access, so once a whistleblower is accused of “espionage,” finding the “spy” will provide an excuse to access the accumulated material.

In practice, we can't expect state agencies even to make up excuses to satisfy the rules for using surveillance data—because US agencies already lie to cover up breaking the rules. These rules are not seriously meant to be obeyed; rather, they are a fairy-tale we can believe if we like.

In addition, the state's surveillance staff will misuse the data for personal reasons. Some NSA agents used U.S. surveillance systems to track their lovers—past, present, or wished-for—in a practice called “LOVEINT.” The NSA says it has caught and punished this a few times; we don't know how many other times it wasn't caught. But these events shouldn't surprise us, because police have long used their access to driver's license records to track down someone attractive, a practice known as “running a plate for a date.” This practice has expanded with new digital systems. In 2016, a prosecutor was accused of forging judges' signatures to get authorization to wiretap someone who was the object of a romantic obsession. The AP knows of many other instances in the US.

Surveillance data will always be used for other purposes, even if this is prohibited. Once the data has been accumulated and the state has the possibility of access to it, it can misuse that data in dreadful ways, as shown by examples from Europe, the US, and most recently Turkey. (Turkey's confusion about who had really used the Bylock program only exacerbated the basic deliberate injustice of arbitrarily punishing people for having used it.)

You may feel your government won't use your personal data for repression, but you can't rely on that feeling, because governments do change. As of 2021, many ostensibly democratic states are ruled by people with authoritarian leanings, and the Taliban have taken over Afghanistan's systems of biometric identification that were set up at the instigation of the US. The UK is working on a law to repress nonviolent protests that might be described as causing “serious disruption.” The US could become permanently repressive in 2025, for all we know.

Personal data collected by the state is also likely to be obtained by outside crackers that break the security of the servers, even by crackers working for hostile states.

Governments can easily use massive surveillance capability to subvert democracy directly.

Total surveillance accessible to the state enables the state to launch a massive fishing expedition against any person. To make journalism and democracy safe, we must limit the accumulation of data that is easily accessible to the state.

The Electronic Frontier Foundation and other organizations propose a set of legal principles designed to prevent the abuses of massive surveillance. These principles include, crucially, explicit legal protection for whistleblowers; as a consequence, they would be adequate for protecting democratic freedoms—if adopted completely and enforced without exception forever.

However, such legal protections are precarious: as recent history shows, they can be repealed (as in the FISA Amendments Act), suspended, or ignored.

Meanwhile, demagogues will cite the usual excuses as grounds for total surveillance; any terrorist attack, even one that kills just a handful of people, can be hyped to provide an opportunity.

If limits on access to the data are set aside, it will be as if they had never existed: years worth of dossiers would suddenly become available for misuse by the state and its agents and, if collected by companies, for their private misuse as well. If, however, we stop the collection of dossiers on everyone, those dossiers won't exist, and there will be no way to compile them retroactively. A new illiberal regime would have to implement surveillance afresh, and it would only collect data starting at that date. As for suspending or momentarily ignoring this law, the idea would hardly make sense.

To have privacy, you must not throw it away: the first one who has to protect your privacy is you. Avoid identifying yourself to web sites, contact them with Tor, and use browsers that block the schemes they use to track visitors. Use the GNU Privacy Guard to encrypt the contents of your email. Pay for things with cash.

Keep your own data; don't store your data in a company's “convenient” “cloud” server. It's safe, however, to entrust a data backup to a commercial service, provided you put the files in an archive and encrypt the whole archive, including the names of the files, with free software on your own computer before uploading it.

For privacy's sake, you must avoid nonfree software; if you give control of your computer's operations to companies, they are likely to make it spy on you. Avoid service as a software substitute; in addition to giving others control of how your computing is done, it requires you to hand over all the pertinent data to the company's server.

Protect your friends' and acquaintances' privacy, too. Don't give out their personal information except how to contact them, and never give any web site your list of email or phone contacts. Don't tell a company such as Facebook anything about your friends that they might not wish to publish in a newspaper. Better yet, don't be used by Facebook at all. Reject communication systems that require users to give their real names, even if you are happy to divulge yours, since they pressure other people to surrender their privacy.

Self-protection is essential, but even the most rigorous self-protection is insufficient to protect your privacy on or from systems that don't belong to you. When we communicate with others or move around the city, our privacy depends on the practices of society. We can avoid some of the systems that surveil our communications and movements, but not all of them. Clearly, the better solution is to make all these systems stop surveilling people other than legitimate suspects.

If we don't want a total surveillance society, we must consider surveillance a kind of social pollution, and limit the surveillance impact of each new digital system just as we limit the environmental impact of physical construction.

For example: “smart” meters for electricity are touted for sending the power company moment-by-moment data about each customer's electric usage, including how usage compares with users in general. This is implemented based on general surveillance, but does not require any surveillance. It would be easy for the power company to calculate the average usage in a residential neighborhood by dividing the total usage by the number of subscribers, and send that to the meters. Each customer's meter could compare her usage, over any desired period of time, with the average usage pattern for that period. The same benefit, with no surveillance!

We need to design such privacy into all our digital systems [1].

One way to make monitoring safe for privacy is to keep the data dispersed and inconvenient to access. Old-fashioned security cameras were no threat to privacy(*). The recording was stored on the premises, and kept for a few weeks at most. Because of the inconvenience of accessing these recordings, it was never done massively; they were accessed only in the places where someone reported a crime. It would not be feasible to physically collect millions of tapes every day and watch them or copy them.

Nowadays, security cameras have become surveillance cameras: they are connected to the Internet so recordings can be collected in a data center and saved forever. In Detroit, the cops pressure businesses to give them unlimited access to their surveillance cameras so that they can look through them at any and all times. This is already dangerous, but it is going to get worse. Advances in facial recognition may bring the day when suspected journalists can be tracked on the street all the time to see who they talk with.

Internet-connected cameras often have lousy digital security themselves, which means anyone can watch what those cameras see. This makes internet-connected cameras a major threat to security as well as privacy. For privacy's sake, we should ban the use of Internet-connected cameras aimed where and when the public is admitted, except when carried by people. Everyone must be free to post photos and video recordings occasionally, but the systematic accumulation of such data on the Internet must be limited.

Most data collection comes from people's own digital activities. Usually the data is collected first by companies. But when it comes to the threat to privacy and democracy, it makes no difference whether surveillance is done directly by the state or farmed out to a business, because the data that the companies collect is systematically available to the state.

The NSA, through PRISM, has gotten into the databases of many large Internet corporations. AT&T has saved all its phone call records since 1987 and makes them available to the DEA to search on request. Strictly speaking, the U.S. government does not possess that data, but in practical terms it may as well possess it. Some companies are praised for resisting government data requests to the limited extent they can, but that can only partly compensate for the harm they do to by collecting that data in the first place. In addition, many of those companies misuse the data directly or provide it to data brokers.

The goal of making journalism and democracy safe therefore requires that we reduce the data collected about people by any organization, not just by the state. We must redesign digital systems so that they do not accumulate data about their users. If they need digital data about our transactions, they should not be allowed to keep them more than a short time beyond what is inherently necessary for their dealings with us.

One of the motives for the current level of surveillance of the Internet is that sites are financed through advertising based on tracking users' activities and propensities. This converts a mere annoyance—advertising that we can learn to ignore—into a surveillance system that harms us whether we know it or not. Purchases over the Internet also track their users. And we are all aware that “privacy policies” are more excuses to violate privacy than commitments to uphold it.

We could correct both problems by adopting a system of anonymous payments—anonymous for the payer, that is. (We don't want to help the payee dodge taxes.) Bitcoin is not anonymous, though there are efforts to develop ways to pay anonymously with Bitcoin. However, technology for digital cash was first developed in the 1980s; the GNU software for doing this is called GNU Taler. Now we need only suitable business arrangements, and for the state not to obstruct them.

Another possible method for anonymous payments would use prepaid phone cards. It is less convenient, but very easy to implement.

A further threat from sites' collection of personal data is that security breakers might get in, take it, and misuse it. This includes customers' credit card details. An anonymous payment system would end this danger: a security hole in the site can't hurt you if the site knows nothing about you.

We must convert digital toll collection to anonymous payment (using digital cash, for instance). License-plate recognition systems recognize all cars' license plates, and the data can be kept indefinitely; they should be required by law to notice and record only those license numbers that are on a list of cars sought by court orders. A less secure alternative would record all cars locally but only for a few days, and not make the full data available over the Internet; access to the data should be limited to searching for a list of court-ordered license-numbers.

The U.S. “no-fly” list must be abolished because it is punishment without trial.

It is acceptable to have a list of people whose person and luggage will be searched with extra care, and anonymous passengers on domestic flights could be treated as if they were on this list. It is also acceptable to bar non-citizens, if they are not permitted to enter the country at all, from boarding flights to the country. This ought to be enough for all legitimate purposes.

Many mass transit systems use some kind of smart cards or RFIDs for payment. These systems accumulate personal data: if you once make the mistake of paying with anything but cash, they associate the card permanently with your name. Furthermore, they record all travel associated with each card. Together they amount to massive surveillance. This data collection must be reduced.

Navigation services do surveillance: the user's computer tells the map service the user's location and where the user wants to go; then the server determines the route and sends it back to the user's computer, which displays it. Nowadays, the server probably records the user's locations, since there is nothing to prevent it. This surveillance is not inherently necessary, and redesign could avoid it: free/libre software in the user's computer could download map data for the pertinent regions (if not downloaded previously), compute the route, and display it, without ever telling anyone where the user is or wants to go.

Systems for borrowing bicycles, etc., can be designed so that the borrower's identity is known only inside the station where the item was borrowed. Borrowing would inform all stations that the item is “out,” so when the user returns it at any station (in general, a different one), that station will know where and when that item was borrowed. It will inform the other station that the item is no longer “out.” It will also calculate the user's bill, and send it (after waiting some random number of minutes) to headquarters along a ring of stations, so that headquarters would not find out which station the bill came from. Once this is done, the return station would forget all about the transaction. If an item remains “out” for too long, the station where it was borrowed can inform headquarters; in that case, it could send the borrower's identity immediately.

Internet service providers and telephone companies keep extensive data on their users' contacts (browsing, phone calls, etc). With mobile phones, they also record the user's physical location. They keep these dossiers for a long time: over 30 years, in the case of AT&T. Soon they will even record the user's body activities. It appears that the NSA collects cell phone location data in bulk.

Unmonitored communication is impossible where systems create such dossiers. So it should be illegal to create or keep them. ISPs and phone companies must not be allowed to keep this information for very long, in the absence of a court order to surveil a certain party.

This solution is not entirely satisfactory, because it won't physically stop the government from collecting all the information immediately as it is generated—which is what the U.S. does with some or all phone companies. We would have to rely on prohibiting that by law. However, that would be better than the current situation, where the relevant law (the PAT RIOT Act) does not clearly prohibit the practice. In addition, if the government did resume this sort of surveillance, it would not get data about everyone's phone calls made prior to that time.

For privacy about who you exchange email with, a simple partial solution is for you and others to use email services in a country that would never cooperate with your own government, and which communicate with each other using encryption. However, Ladar Levison (owner of the mail service Lavabit that US surveillance sought to corrupt completely) has a more sophisticated idea for an encryption system through which your email service would know only that you sent mail to some user of my email service, and my email service would know only that I received mail from some user of your email service, but it would be hard to determine that you had sent mail to me.

For the state to find criminals, it needs to be able to investigate specific crimes, or specific suspected planned crimes, under a court order. With the Internet, the power to tap phone conversations would naturally extend to the power to tap Internet connections. This power is easy to abuse for political reasons, but it is also necessary. Fortunately, this won't make it possible to find whistleblowers after the fact, if (as I recommend) we prevent digital systems from accumulating massive dossiers before the fact.

Individuals with special state-granted power, such as police, forfeit their right to privacy and must be monitored. (In fact, police have their own jargon term for perjury, “testilying,” since they do it so frequently, particularly about protesters and photographers.) One city in California that required police to wear video cameras all the time found their use of force fell by 60%. The ACLU is in favor of this.

Corporations are not people, and not entitled to human rights. It is legitimate to require businesses to publish the details of processes that might cause chemical, biological, nuclear, fiscal, computational (e.g., DRM) or political (e.g., lobbying) hazards to society, to whatever level is needed for public well-being. The danger of these operations (consider the BP oil spill, the Fukushima meltdowns, and the 2008 fiscal crisis) dwarfs that of terrorism.

However, journalism must be protected from surveillance even when it is carried out as part of a business.