You do not need to believe in a malicious government to care about surveillance.

THE FIRST DISTINCTION

Privacy is not the same thing as secrecy.

Most private things are not crimes. Medical appointments are not crimes. Political organizing is not a crime. Religious attendance is not a crime. Visiting a friend, driving to a protest, meeting a journalist, going to therapy, changing jobs, attending a support group, or spending the night somewhere other than home are all ordinary parts of life.

The privacy question is not whether those acts must be hidden from everyone. It is whether they should become easily searchable, reconstructable, shareable, or permanently attributable through government or commercial systems.

A society can reject criminal conduct while still deciding that lawful life should not automatically produce a searchable behavioral record.

TRUST IS NOT THE WHOLE THREAT MODEL

Good people can operate vulnerable systems.

Privacy debates often get reduced to motive: Do you think the government is trying to hurt you? That is only one possible failure mode.

A sensitive system can expose people through credential theft, phishing, software vulnerabilities, supply-chain compromise, misconfiguration, ransomware, contractor failures, lost devices, insecure integrations, overbroad permissions, or ordinary human mistakes. None of those require a malicious public employee.

Biometric systems make this especially important. A password can be changed. A cryptographic key can be rotated. A face is not a replaceable credential. That does not mean a stolen facial image automatically defeats every biometric system; it means the underlying identifier is persistent, so exposure can create unusually durable risk.

Data minimization is therefore a security control as much as a privacy principle: information that was never collected cannot later leak from that collection.

SCALE CHANGES THE QUESTION

Being visible is not the same as being searchable.

People have always been observable in public. A police officer can see a car. A witness can recognize a face. A camera can record a street. None of those facts, standing alone, are new.

What changes is the ability to index those observations, search them later, connect them across locations, share them between agencies, or combine them with other databases. A task that once required many people and many hours can become a query.

That difference matters because practical anonymity can disappear long before formal secrecy does. A stranger on a sidewalk may see your face without knowing your name. A large biometric or vehicle-tracking system can turn the same observation into an identity or a movement history.

DATA FUSION

The most revealing system may be the connection between systems.

A license-plate reader knows something about a vehicle. A facial-recognition system knows something about an identity. A camera knows something about a place and time. A phone record knows something about a device. A dispatch system knows something about an incident. A commercial database may add addresses, vehicles, associates, or historical records.

Each dataset can look limited in isolation. Combined, they can reveal patterns that no single sensor could produce.

The relevant record therefore includes integrations, sharing rules, exports, APIs, vendor relationships, and secondary dissemination—not only the camera itself.

FUNCTION CREEP

Systems outlive the emergency used to justify them.

A capability may be introduced for a narrow and compelling reason: stolen cars, violent crime, identity fraud, missing persons, or a specific security threat. The original purpose can be legitimate.

The harder question comes later. Once the infrastructure exists, adding a new user, integration, query type, retention period, or purpose can be much easier than building the system from scratch. What began as an exceptional tool can become ordinary infrastructure.

This does not mean expansion is inevitable or always improper. It means expansion should be visible, justified, and independently reviewable rather than treated as a technical detail.

POLICY CHANGES

You are not only trusting today's rules.

A database may be created under one administration, one police chief, one vendor contract, or one interpretation of the law and remain available under the next. Access policies can change. Laws can change. Agency missions can change. Vendors can be acquired. New integrations can appear.

That is why privacy protections should not depend entirely on the belief that the people currently in charge are reasonable. Durable limits matter precisely because institutions persist longer than individual decision-makers.

COMMERCIAL INCENTIVES

Surveillance can also be a market.

Private companies can create genuinely useful tools for government. The problem is not that a vendor earns money.

The concern is that a commercial system introduces incentives that are different from public necessity. More customers, more cameras, more searchable data, more integrations, more features, and longer subscriptions can all be good for the vendor even when the public-interest case for each expansion is weak.

Procurement is part of surveillance policy. Contracts, renewals, grants, data-sharing terms, technical capabilities, retention options, and exit conditions define what public agencies are buying with public money.

LEGITIMATE USES EXIST

Acknowledging benefits makes the privacy argument stronger, not weaker.

A facial-recognition search may help identify the unknown suspect in a murder. An ALPR may help recover a stolen car or find a vehicle connected to an abduction. A camera can document an event more accurately than memory. Data sharing can help one jurisdiction obtain evidence held by another.

Those are not imaginary benefits and NoRec does not need to pretend otherwise.

The disagreement is about proportionality: what population-scale infrastructure should exist to obtain those benefits, how narrowly searches should be authorized, how long innocent people's records should remain, and whether less intrusive alternatives could accomplish the same goal.

THE "NOTHING TO HIDE" TEST

Try applying it to every other kind of information.

Most people who say they have nothing to hide still close the bathroom door. They use passwords. They do not publish their entire bank history. They choose who sees their private messages. They may be perfectly willing to tell one person something they do not want broadcast to everyone.

That is not hypocrisy. Privacy is contextual. Information can be harmless in one context and invasive in another.

The same principle applies to government data. A photograph may be appropriate for issuing an ID. A location may be appropriate for responding to a 911 call. A plate number may be visible on a public road. None of those facts automatically settle every later use of that information.

THE BREACH QUESTION

“Secure” describes an intention. It does not make the data harmless to collect.

The cost of a breach depends partly on how much information existed to steal. A narrowly scoped system with short retention and limited exports creates a different risk than a historical database containing names, addresses, dates of birth, Social Security numbers, driver's-license numbers, photographs, biometrics, financial information, or years of personal history.

That information is useful precisely because it identifies people. After a breach, the same property can make it useful for impersonation, account takeover, fraudulent applications, targeted phishing, identity theft, or combining one leak with information obtained somewhere else.

Credit monitoring after the fact does not put a Social Security number, driver's-license number, fingerprint, or personal history back inside the database. The security question therefore starts before collection: how much permanent identifying information needs to exist in one searchable place at all?

DATA HAS A SECOND LIFE

A breach does not end when the vulnerable server is fixed.

Stolen PII can be copied indefinitely, combined with other breaches, traded, resold, or used years later. In one federal criminal case, two defendants admitted obtaining access to a database containing identities and selling PII on the dark web for approximately $160,000 in digital currency.^[8] That case did not involve a government-owned database, but it demonstrates the market that sensitive identity records can enter after unauthorized access.

Government itself recognizes the aggregation problem. In 2025, GAO warned that publicly accessible and commercially obtainable information can be combined into digital profiles that create privacy and safety risks for Defense Department personnel and their families.^[9]

This is why “the government already has it” is not a privacy answer. Every additional repository, export, integration, contractor, retention period, and searchable copy creates another place where information can escape its original context.

THE SECURITY PARADOX

The most sensitive databases are often the ones society cannot simply opt out of.

You can decide not to create an account with a social network. It is much harder to opt out of the records necessary to obtain an identification card, pay taxes, receive public benefits, hold a security clearance, register a vehicle, interact with a court, or comply with another legal requirement.

That changes the bargain. When government requires or strongly conditions participation on surrendering identifying information, the person providing it cannot meaningfully solve the security problem by choosing another provider.

NoRec's position is not that every government database will be breached, nor that every security statement is dishonest. It is that “we secure the data” cannot substitute for asking whether the data needs to be collected, centralized, retained, shared, or made searchable in the first place.