The Database of Ruin

A law professor named Paul Ohm gave the thing its name some years ago, and the name is the most honest description anyone has managed. He called it the database of ruin. The idea is simple and terrible. As more of life is recorded, and as the scattered records are linked together, we are converging on a single comprehensive database that holds, about each person alive, at least one fact that would ruin them. Not most people. Each person. The affair, the diagnosis, the debt, the search history, the clinic visit, the meeting, the thing said in anger twenty years ago, the place the car was parked at an hour that would need explaining. Everyone has at least one. The database of ruin is where all of them are kept, indexed, and waiting.

We are not there yet, but we are building it quickly, and mostly without noticing, because it does not arrive as a single monstrous thing. It arrives as conveniences and safety features. A camera here, an app permission there, a loyalty card, a doorbell, a license plate reader on a pole outside the school. Each piece is defended on its own small merits. The machine is the sum, and almost no one is looking at the sum.

The friction that kept us free

Here is what most arguments about privacy miss. For all of human history until about twenty years ago, privacy was not mainly protected by law. It was protected by friction.

Watching people was expensive. Following a man required a man to follow him. Remembering what everyone did required clerks and paper and filing cabinets, and the records sat in separate buildings in separate towns and mostly rotted unread. You were not unwatched because a statute forbade watching you. You were unwatched because watching you, remembering it, and cross-referencing it against everyone else was simply too much work to bother with for anyone but the rare and important target. That practical obscurity, the plain physical cost of surveillance, was the real guarantor of a private life. The law was a thin top layer over a thick foundation of “it is too hard to be worth it.”

Digital technology did one specific thing. It drove the cost of watching, remembering, and cross-referencing to nearly zero. A license plate reader does not get tired, does not draw a salary, and never forgets. Cheap storage means the record is kept forever instead of rotting. Cross-referencing that once took a team of investigators now takes a search box. The friction that protected us, the friction we mistook for a permanent law of nature, is gone, and we never passed anything to replace it, because we never understood it was doing the work in the first place.

The general warrant, resurrected

Americans of all people should recognize what is being rebuilt, because we were founded against it.

The grievance that lit the Revolution was not only taxation. It was the writ of assistance and the general warrant, the open-ended power of the Crown’s officers to search any home, any ship, any person, without naming a suspect or a crime, on the chance that something might turn up. James Otis argued against the writs in Boston in 1761, and John Adams, who sat and watched, said that then and there the child Independence was born. The men who later wrote the Constitution put their answer to that grievance in the Fourth Amendment, in plain words: no warrant without probable cause, naming the place to be searched and the person or thing to be seized. The entire animating purpose was to forbid the search of everyone in advance, and to require the state to suspect you of something in particular before it was allowed to look.

The surveillance grid we are assembling is the general warrant brought back from the dead, and it evades the Fourth Amendment by two routes the Founders did not foresee. The first is bulk. The amendment assumed a search was a discrete act aimed at a person, and it has little to say about a system that simply records everyone continuously and searches the recording later, because at the moment of collection no one in particular is the target. Everyone is. The second route is the private company. The state has learned that what it may not seize, it may buy. A license plate network, a data broker’s trove of phone locations, a face-recognition firm’s scraped archive, these are built by corporations and then sold or handed to police, and a line of cases holds that information you “shared” with a company carries no expectation of privacy, so the government needs no warrant to take it. Between bulk collection and the corporate laundromat, the Fourth Amendment has not been repealed. It has been routed around, left standing as a monument while the very thing it was built to stop is rebuilt beside it, larger than the Crown ever dreamed.

Nothing to hide

Say all of this to most people and you will hear the same five words, the most dangerous sentence in the language: I have nothing to hide. It is worth taking apart slowly, because it is wrong in at least three separate ways, and each one matters.

It is wrong, first, about what privacy is for. Privacy is not a screen for wrongdoing. It is the precondition of a self. The ability to control who knows what about you is the ability to be the appropriate and different person to your doctor, your employer, your priest, your child, and your rival, which is to say it is the ability to live a human life rather than perform a single flattened one for an audience that never looks away. A person with nothing to hide is not especially virtuous. He is either lying, or he has already been hollowed out.

It is wrong, second, about who decides what counts. “Nothing to hide” assumes that you get to define what is incriminating, that because you have committed no crime you are safe. But the database does not work that way. It hands the definition of incriminating to whoever holds the database, after the fact, and applies it backward. Everyone, under patient and detailed enough scrutiny, has done something that can be made to look like something. Lavrentiy Beria, Stalin’s secret police chief, put it without embarrassment: show me the man and I will find you the crime. The database of ruin is the fulfillment of Beria’s wish, a standing file on everyone, from which a crime, or merely a ruin, can be assembled for anyone the moment it is wanted. You do not get a vote on whether your file is dangerous. The person reading it does.

It is wrong, third and worst, about who will hold it. The nothing-to-hide reply always pictures the watcher as today’s watcher, more or less benign, more or less on your side. But a database is permanent and power is not. The file built by an administration you trust is inherited, whole, by the next one, and the one after that, including the ones you fear, including the ones that have decided people like you are the problem. I have argued elsewhere that every instrument of control you build is a weapon your enemy eventually inherits. The database of ruin is that principle at its highest power, because it is the one weapon that, once built, works against absolutely everyone, forever, no matter whose hands close around it. Building it on the assurance that good people will always hold it is the most naive bet a free society can make, and we are making it by default.

The inversion

There is a shape to a free country, and the surveillance state turns it inside out.

The American design pointed the flow of visibility in a deliberate direction. The government was meant to be transparent to the people, its proceedings public, its officials named, its actions on the record. The people were meant to be opaque to the government, secure in their homes and their papers, casting a secret ballot precisely so that power could not see how each of them voted and therefore could neither buy nor punish it. Visibility ran upward, from the state to the citizens who watched it. Privacy ran downward, shielding the citizen from the state.

The database reverses both arrows. Now the citizen is transparent, his movements and purchases and associations laid open to a system he cannot see, and the system is opaque, its searches secret, its audits absent or ignored, its data shared sideways between agencies and sold between companies without anyone’s consent. You cannot find out who looked you up, or why, or what they kept. The watched cannot watch the watchers. That inversion is not a glitch in a free system. It is the defining architecture of an unfree one, and it does its work without ever needing to kick down a door. Tocqueville saw the mild version of it coming nearly two centuries ago, a power that does not tyrannize so much as supervise, that does not break men but softens and guides and shrinks them until they are little more than a flock of timid animals with the government for a shepherd. He was describing a mood. We have gone and built him the machine.

A people that can be reconstructed

Here is the part the privacy debate, conducted in the language of data and consent forms, almost always misses. The harm of the database of ruin does not begin when it is used against you. It begins when it exists.

A person who knows he can be reconstructed at any moment, his whole record pulled up and read backward by a stranger with a grievance or a quota, is not the same person as one who believes himself unobserved. He joins fewer things. He says less. He drives a different way, reads a different book, attends a different meeting, or attends none at all. He polices himself, continuously and half-consciously, against a watcher who may in fact never look, because the cost of being wrong about that is too high to risk. This is the quiet genius of total surveillance, understood by every regime that ever practiced it. It does not need to punish in order to control. It only needs to be believed. A watched people is a tamer, smaller, more obedient people, and it becomes so without a single order being given.

Which is why this is not, in the end, a technology story or even a privacy story. It is a story about what kind of people we are going to be. Self-government requires a self, and a self requires a space the government cannot see into, a zone of the unwatched in which a person can think, doubt, err, change his mind, and become someone other than the sum of his file. Take that zone away and you do not get a safer free society. You get a society that is still nominally free and quietly incapable of it, full of people who hold the vote and have lost the inward independence that ever made the vote worth holding.

What we still get to decide

None of this requires smashing the cameras or pretending the technology can be un-invented. It requires deciding, as a free people still can, that the machine will not be finished. That a search of your movements needs a warrant naming you, the same as a search of your home, because that is what it is, a search of your home conducted from a pole. That the government may not buy from a company what the Constitution forbids it to seize. That bulk collection of the innocent is the general warrant under a new name and is unlawful for the same reason the general warrant was. That the firms assembling the database of ruin and renting it to the state are not neutral vendors but the architects of the precise thing the country was founded to prevent.

We were, once, the nation that looked at the general warrant and went to war rather than live beneath it. The database of ruin is that warrant returned, patient and total and sold by subscription, and the only real question left is whether the people who inherited the founding still recognize the thing their ancestors refused to tolerate. The cameras are already on the poles. What we do about them will say, more honestly than any anthem, whether we are still that nation or only wearing its clothes.