Your phone logged where you slept before you woke up. You check Gmail, search something on Google, message a friend on WhatsApp, pay for coffee with a card and walk past a dozen cameras before lunch. None of that feels like surveillance. It feels like a normal morning.
It felt the same five years ago, and I want to show you what changed in between. The comfortable version of privacy, “I have nothing to hide”, has quietly stopped being true, and I think most people haven’t noticed. Three things happened at once. On its own each one is manageable. Together they’re what worries me.
The collection is finished
Start with the part nobody disputes anymore. Every email, text, call, location ping, purchase and search query gets collected somewhere. Snowden showed us the plumbing in 2013. We’ve had thirteen years to make our peace with it, and most of us did.
What changed is the completeness. In 2013 the collection had gaps. Today the data portrait of anyone in the developed world is finished, and it lives in dozens of databases at once. Government ones, corporate ones, criminal ones.
Want the list? The websites you’ve visited, from ISP logs and browser fingerprinting. The places you’ve been, from cell towers, GPS and wifi positioning. Your purchases, through payment processors and loyalty cards. Who you’ve talked to, as metadata on every platform. Your photos, in cloud backups and facial recognition databases. And every word you’ve typed, through keyboard apps and autocomplete training data.
That data exists, and it’s stored indefinitely. Whether someone could assemble a complete profile of your life was never the open question. The question is who already has, and what they plan to do with it.
The other version of that morning
Now picture the same morning, wired differently. Your email lands on a server in your own house. Your photos sync to storage you control. Your passwords live in a vault only you hold the keys to. You still pay for the coffee and the cameras are still on the street, but the bulk of your digital life isn’t sitting in someone else’s database waiting to be queried.
Is that a fantasy? No. It’s a Saturday afternoon of setup and a small monthly electricity bill. I run it. Plenty of people run it. Most of us don’t because the default path is so smooth that opting out never crosses your mind.
Hold on to that picture. The next two trends are why I’m glad I did.
The analyst bottleneck is gone
Large language models changed the maths.
For decades the intelligence agencies had a needle-in-a-haystack problem. They could collect everything and process almost none of it. The NSA famously hoarded more data than it could ever read. Human analysts were the bottleneck, and that bottleneck was the only real protection most people had.
An LLM reads and summarises millions of documents in hours. It finds patterns across unrelated sources, builds a profile of one person from scattered fragments, predicts behaviour from history and flags the “interesting” people for a human to look at. The data that sat in cold storage for years is searchable now. The embarrassing message you sent in 2015. The protest you turned up to in 2020. The late-night search you assumed nobody would ever connect back to you.
And there’s a nasty twist. LLMs hallucinate. They produce plausible-sounding facts that never happened, with full confidence. In an interrogation room or a courtroom, how do you prove you didn’t do the thing a model says you did? I don’t know either, and I’d rather not find out.
This is where the opt-out version of the morning stops being a lifestyle choice and becomes a threat model. The less of you that sits in a queryable database, the less there is for a model to mine, misread or invent.
Eighteen years of decline
This is the part people would rather not discuss.
Freedom House counted 2024 as the 18th consecutive year of global democratic decline. More people live under authoritarian rule now than at any point since the Cold War. The democratic expansion after 1991 is over.
Look at the map:
- Russia: authoritarian
- China: authoritarian
- India: backsliding
- Turkey: authoritarian
- Hungary: illiberal democracy
- Brazil: narrowly avoided it
- United States: institutions under strain
This matters for privacy because authoritarian governments use the data, in production, today. China’s social credit system. Russia’s SORM surveillance. Iran switching off the internet during protests. All three are in the news, and have been for years.
Democracies aren’t exempt. The UK’s Online Safety Bill. The EU’s proposed chat control. The renewals of FISA Section 702 in the US. Even a healthy democracy keeps building surveillance plumbing that a future, less healthy government inherits along with the keys.
A regime that doesn’t fall
This is the synthesis that keeps me up.
Historically, authoritarian regimes were fragile. They collapsed because they couldn’t hold control, couldn’t spot threats fast enough, couldn’t suppress dissent without making more of it. The 20th century is a graveyard of dictatorships.
Mass collection plus AI analysis plus authoritarian governance produces something we haven’t seen before. Something that might be stable.
Imagine a regime that knows every relationship in society through social network analysis, predicts who might become a dissident from their behaviour, intervenes before a threat forms, personalises propaganda for each citizen and picks out the organisers the moment they start organising. I’m not speculating. China is building this, and the technology travels. Dozens of countries have bought Chinese surveillance infrastructure off the shelf.
We may be watching the birth of stable authoritarianism. Regimes that no longer fall, because they’ve solved the information problem that used to constrain every despot in history.
Your own government has the same data
If you assume this only applies to faraway autocracies, you haven’t been watching closely.
The Five Eyes alliance, the US, the UK, Canada, Australia and New Zealand, shares intelligence freely. What the NSA can’t legally collect on Americans, GCHQ collects and passes over. What GCHQ can’t collect on Brits, the NSA returns the favour on.
The legal frameworks that supposedly protect citizens get routed around all the time. Parallel construction, where an agency uses surveillance data and pretends it never had it. The third-party doctrine, which strips protection from any data a company holds for you. FISA courts, which are secret courts with secret readings of the law. Executive orders that skip congressional oversight altogether.
Your Western democracy holds the same data the authoritarian regimes hold. The difference so far is how each has chosen to use it. Governments change, though, and laws change. The data stays.
Why I self-host
This is the whole reason I self-host everything. I’m not up to anything. I take the threat model seriously.
When your email is on Gmail, Google has it, and Google hands it to any government that shows up with the right paperwork, and occasionally without. Photos on iCloud belong to Apple. Documents on OneDrive belong to Microsoft. You’re a guest in all of those houses.
Self-hosting drags the data back under my own roof. My mail server, my cloud storage, my password manager, all running on hardware I can physically touch. A government can still demand access, sure. First it has to know the data exists, and then it has to come to me specifically to get it.
That gap is the difference between mass surveillance and targeted surveillance. If I ever become a target, I can’t stop the targeted kind. The bulk dragnet I can step out of.
What you can still change
I’m not going to tell you to delete every account and move to a cabin in the woods. That’s unrealistic for almost everyone, and honestly, the historical data is gone. Whatever’s out there is out there.
What you can change is what gets created from here.
Minimise new data. Use end-to-end encrypted messaging, so Signal rather than WhatsApp. Use a VPN for browsing, because your ISP doesn’t need a log of every site. Use a privacy-respecting email provider, ProtonMail, Tutanota or self-hosted. Use a password manager, so a breach stays contained to one account.
Reduce exposure. Audit your cloud services and ask what needs to live there. Use local-first software where you can. Consider self-hosting the services that matter most, my earlier posts walk through how.
Support the people fighting this at the systemic level. Back the EFF, the ACLU and the digital rights groups. Vote for representatives who understand technology. Push for strong data protection laws.
And accept the trade-offs. Privacy usually means a bit more inconvenience. Self-hosting costs you time and effort. You can’t control what other people do with data you share.
I’m being honest about that last block on purpose. Sovereignty has a price, and pretending otherwise would be dishonest. The price is a few weekends and some ongoing maintenance. What you buy is control over what governments and corporations can trivially learn about you.
What privacy is for
Privacy is about power.
When a government or a corporation knows everything about you, it holds power over you. It can predict your behaviour and nudge your decisions. It can single you out, and make an example of you to keep everyone else in line.
A democratic society depends on a power balance, and privacy is what preserves it. Citizens need parts of their lives the state can’t see or steer. Take that away and dissent gets expensive. Make dissent expensive enough and democracy stops working, quietly, without a coup.
We’re assembling the infrastructure for perfect totalitarianism right now. The data is here and the models are here. The only variable left is governance, and governance can flip overnight.
So don’t wait until it does. Move what you can of your data under your own roof, build a little of your own infrastructure and help the people doing the same. My email lands on my own server now, the morning looks the same from the outside, and the list of people who can read it is a lot shorter.