Tony Stark built a system to protect the world. He wanted to see every threat before it happened. But the tool slipped out of his control. In the real world, good intentions matter even less – they are usually a pretext for building yet another data-mining machine, ready to become a machine of control. This is the heart of the whole story.

In 2013, Edward Snowden, then a 29-year-old computer specialist working for America’s National Security Agency (NSA), copied a huge collection of secret documents and handed it to journalists. In doing so, he revealed what “national security” had become: not the surveillance of particular suspects, but the gathering of data on everyone at once. The leaked material described programs that collected the phone records of entire societies, reached into the servers of Google, Facebook and Apple, and let analysts search through almost everything a person did online. It was the largest leak about mass surveillance in history.

Snowden paid a high price for it. Pursued by the United States on espionage charges, he became stranded in Russia, where he still lives today. In 2022 he was granted Russian citizenship by Putin. There is a bitter irony in this – a defender of privacy living under the jurisdiction of a state that is itself notorious for surveillance. Less is said about the fate of the documents themselves. Of the hundreds of thousands of files, only about one per cent were ever published, and in 2019 the archive was quietly closed. Let me stress this: the most important leak about surveillance in history was itself silenced.

After the attacks of 11 September 2001, a conviction took hold in the United States that if anyone could be a threat, then everyone had to be watched. The US government moved from tracking particular suspects to collecting data on the whole population. An internal NSA presentation put this philosophy plainly: “collect it all”, “process it all” and, ultimately, “know it all”. It was sold as an essential defence against terrorism. And this is the starting point: once a tool has been built, it is rarely dismantled. Far more often it goes looking for new uses.

Since Snowden’s day, three things have changed, and together they shape the world we live in now. First, collecting data has become free and automatic. Sensors are everywhere: in your phone, your laptop (unless it runs Linux¹), your car, your television, in the cameras on the streets. No one needs to follow anyone deliberately any more – the data flows in on its own, freely given. Second, the bottleneck of analysis has disappeared. Once the limit was the human being who had to sift through it all; today artificial intelligence does the job, and not only in real time but retrospectively too. Third, the line between company and state has blurred. Governments no longer need to spy for themselves – they simply buy ready-made data from brokers.

“The history of my browser is the history of my life”

Fisz Emade Tworzywo (a Polish hip-hop and alternative music group) painted an ironic portrait of a person whose life has shrunk to a screen. But from a distance the observation is sharper still. Your browsing history is, with a probability close to 100%, recorded, stored and readable by someone else. The big tech companies know things about us that we sometimes don’t confide even to those closest to us.

A system built to sell us adverts and make life easier is, technically, the very same thing that power needs to track down inconvenient people. The database that recommends shoes to you today could just as easily, tomorrow, point out who was at a protest, who saw a psychiatrist, who goes to the mosque, who belongs to a trade union. The difference lies not in the technology, but in who holds the remote and why they reach for it.

We consent to surveillance easily, because we don’t associate it with oppression. It comes to us as a service. We agree to it so an app will start the car, so we can get through the airport faster, so we can get a discount or cheap space in the cloud. We allow it because it is simply convenient (and often free, as in free of charge). No one protests against something that makes their life easier.

The familiar “I’ve got nothing to hide” sounds reasonable, but it rests on the mistaken assumption that privacy is about concealing something bad. Privacy is control over who has access to us. The other popular argument “I’m too small for anyone to take an interest in me” also sounds reasonable, but… Mass surveillance, by definition, does not target individual people but whole populations. You don’t need to be someone important. Each of us is one of millions of records in a database, and what counts is their sum².

Our data is safe

We consent to handing our data to companies that advertise themselves as secure. And indeed they are, in the sense that no one will steal it from us. But “well protected” is not the same as “not used”. This data is legally (though not always – for often it happens against our objection, especially on mobile devices) analysed, profiled and sold on. Companies write about this in their privacy policies, which no one reads, because they are written precisely so as not to be read.

By giving up our data for convenience, we build with our own hands a tool whose use against our freedoms becomes merely a matter of decision. To convince us that we are doing the right thing, the arguments used are that it is “for the good of our children” and “against terrorism”.

This rhetoric is no accident. Slogans about children and terrorism are so emotionally powerful that they shut down normal debate – criticism of the tool starts to sound like opposition to the good it is meant to serve.

The British have two recent examples of this. The Investigatory Powers Act of 2016, sold as an anti-terrorism measure, gave the government some of the broadest surveillance powers among democracies and passed with little resistance, quickly earning the nickname “Snoopers’ Charter”. The Online Safety Act, brought in under the banner of protecting children and enforced from 2025, has in practice built a system tying identity to online activity. Children are no safer for it – determined teenagers get round it with VPNs anyway.

But because the argument is “protecting children”, no one asks whether it even works. That was never the point. The act did not have to protect children – it only had to pass. Children were the pretext, and the only thing it really leaves behind is a ready-made system of surveillance.

Where we are and where we are heading

In democratic systems there will always be rights – on paper, at least. We are free to protest, to associate, to say what we think. What changes, however, is the cost of exercising those rights. Going to a perfectly legal protest carries the risk that the system will make a note of it and tie it to your face, your car, your phone and your history. Not in order to arrest you at once – simply in order to know. The awareness that someone knows is enough to make people start holding back of their own accord. After all, we don’t know what risk it carries, whether it might affect our credit score, and so on.

After Snowden’s revelations, people did in fact begin to avoid reading and searching for sensitive topics. Not because they were forbidden to, but because they knew someone was watching ³⁴.

This whole mechanism could operate legally and quietly in the hands of people who would not give in to the temptation to exploit it. The trouble is that people, by their nature, are greedy for money and even more so for power. Tools like these are already being abused, and there are many documented cases of it⁵. We have no assurance at all that things will be better in the future. Snowden called it “turnkey tyranny” – a tyranny you can switch on with the turn of a key. This is why the claim “I’ve got nothing to hide” is not enough.

The superhero

Tony Stark, a superhero saving the world, in the fiction built a system of total surveillance in the belief that this was exactly how he would save it. We watch him on the very screens that, along the way, collect data about us, and so, click by click, we build a similar system for real. In the fiction, Stark’s system slipped out of control, and that is why it became dangerous. Ours doesn’t have to slip out of anything – an irresponsible hand holding it is enough.

Nor is the point to unplug everything and flee to the woods. Quite apart from being impossible, that would also be excessive. The point is to know what we are paying, and what for. If the price stops suiting someone, there are ways to bring it down. Of course, putting them in place takes some effort – cognitive effort, at the very least. The reward is not full anonymity (no such thing exists), but the recovery of some of the control we gave away without stopping to think to whom, or for how long.

1. Windows collects data by default, and turning this off requires a deliberate opt-out; Linux is the opposite – by default it collects nothing, and every such mechanism is left to the user to decide on. This does not make the computer invisible, but it removes one of the default sources of data. ↩︎
2. On its own, an individual’s data really is unimportant – apart from a narrow group of public figures, whose single trace carries weight in itself. For “ordinary” people, it is only the sum of it that matters. ↩︎
3. After 2013, a roughly 20% drop was recorded in views of terrorism-related Wikipedia articles (study by J. Penney, Oxford/Berkeley Technology Law Journal, 2016). ↩︎
4. A PEN America survey found that one in six American writers had avoided topics they believed might bring surveillance upon them (the “Chilling Effects” report, 2013). ↩︎
5. After 11 September, the FBI subjected entire Muslim communities to “ethnic mapping” and infiltrated mosques. From 2015, federal agencies monitored participants in Black Lives Matter protests. In 2026, Congresswoman Zoe Lofgren revealed that so-called backdoor searches under Section 702 had been aimed at, among others, protesters, journalists, members of Congress and 19,000 campaign donors. ↩︎

If you’re interested in how to look after your own privacy, I recommend this short article: Reclaiming Your Privacy.