The government does not need to hack your phone. It just buys the data.

The pipeline nobody explains to you

I remember the first time I really understood how this works. I was reading about ad auctions and realized that every time you open an app, your location, device ID, and browsing habits are broadcast to thousands of advertisers in milliseconds. That is not a bug. That is the design. And according to a Citizen Lab report covered by NPR, surveillance vendors have figured out they can tap directly into that same advertising marketplace to track anyone, without a warrant, without your knowledge.

This is not a conspiracy theory. On March 18, 2026, FBI Director Kash Patel confirmed to Congress that the FBI is buying Americans' location histories from data brokers to track citizens. No warrant. No judge. Just a purchase order.

The legal framework you think protects you is riddled with holes, and the people in charge know it.

Step one: your phone is already doing the work

Here is the actual day-to-day mechanics. You walk into a store. Cameras scan your face and track your movement through the aisles. If you pay with Apple Pay or Google Pay, your phone logs what you bought and how much you spent. All of that data quickly becomes commercially available, bought and sold by data brokers, and aggregated by AI into a detailed profile that can predict your behavior.

Your neighborhood is also doing the work for the government. Flock Safety license plate cameras photograph every car that drives by and sell that data to third parties, including federal agencies. Your doorbell camera feeds into the same ecosystem. Nextdoor posts, Ring footage, and hyperlocal social media create a crowdsourced record of everyone's movements in public spaces.

This is not passive collection. It is an active pipeline.

The app that turns your Medicaid record into a raid target

The clearest example of how this all connects is Palantir's ELITE tool, which ICE uses to decide which neighborhoods to raid. According to internal documents obtained by 404 Media, the app populates a map with potential deportation targets, generates a dossier on each person, and assigns a "confidence score" predicting whether that person is actually at their listed address.

Where does the address data come from? Medicaid records, DMV files, utility bills, and court records. If you updated your address to get medical care, that update feeds directly into your confidence score. Last year, ICE and the Centers for Medicare and Medicaid Services signed a data-sharing agreement covering nearly 80 million Medicaid patients.

“This kind of consolidation of government records provides enormous government power that can be abused.”

— Palantir blog, responding to EFF criticism of ELITE, January 2026

That quote is from Palantir's own blog, written as a defense of their practices. They acknowledged the danger in the same breath they dismissed it. I find that breathtaking.

The counterargument, and why it does not hold up

The standard defense goes like this: these tools only target people with final orders of removal or serious criminal charges. Palantir itself insists ELITE is used for "prioritized enforcement" of specific individuals, not mass sweeps. That sounds reasonable until you read the sworn ICE testimony.

ICE officials themselves described using ELITE to identify "target-rich" neighborhoods where large numbers of people could be detained in a single operation. That is not targeted enforcement. That is area sweeps dressed up in algorithmic language.

Would you trust a system that assigns you a numerical score based on your healthcare records and then sends agents to your door? Tell me that is targeted.

The money behind the machine, and the oversight that vanished

The scale of investment here is staggering. The 2025 spending law gave DHS more than $191 billion, nearly double the prior year's appropriation. DHS is now planning to award hundreds of millions in new surveillance contracts in 2026 alone, including a $1 billion ceiling contract with Palantir that went into effect in February.

Meanwhile, the oversight infrastructure is collapsing. Privacy impact assessments at DHS dropped to just eight in 2025, down from a peak of 24 in 2024. In 2026, there have been zero. DHS privacy officers were reportedly ousted after objecting to mislabeling government records.

More money, more tools, less accountability. This is not a bug in the system. This is the system working exactly as designed.

FISA 702: the legal fig leaf that keeps getting renewed

On the intelligence side, the legal architecture is just as broken. Section 702 of FISA allows the NSA to collect communications of foreign targets without a court order, but it inevitably sweeps in Americans' calls, texts, and emails when they communicate with anyone abroad. Nearly 350,000 targets are currently under this authority.

The NSA collects those conversations and stores them, then the FBI operates in what the Electronic Frontier Foundation calls a "finders keepers" mode: the data is already collected, so why not search it? Congress has extended this program repeatedly, most recently in a chaotic overnight session in April 2026, without requiring warrants for searches of Americans' data.

What good oversight would actually look like

I want to be fair here. Some of these tools have legitimate law enforcement uses. Tracking a known violent offender with a final deportation order is not the same as sweeping a neighborhood. Facial recognition at a border crossing is not the same as scanning protesters. The technology itself is not the problem.

The problem is the complete absence of enforceable guardrails. A bipartisan Government Surveillance Reform Act was introduced in March 2026 that would require warrants for Section 702 searches involving Americans and ban government purchases of data broker records. GovTrack gives it a 3% chance of being enacted.

Three percent. That number tells you everything about how seriously Washington takes your privacy.

“The line between collaborating for lawful national security purposes versus unlawful domestic spying is becoming dangerously blurred or ignored.”

— The Conversation, analysis of US government AI surveillance expansion, April 2026

The automation of surveillance means the government is no longer limited by the number of agents it employs. AI-powered systems never sleep, never forget, and scale infinitely. The traditional check on government overreach, the sheer cost and labor of watching everyone, has been eliminated. What replaces it is supposed to be law. Right now, the law is losing.

When was the last time you updated your address for a doctor's visit and thought: that just fed a federal confidence score? Because it did. And until the law catches up to the technology, every routine transaction you make is raw material for a system that has no meaningful obligation to leave you alone.