The Cost of
Being Seen

There is a comfortable story we tell about privacy, and it goes like this: what matters is the content. Encrypt the message, and the message is safe. Everything else is packaging — routing overhead, plumbing, the boring exhaust of a system doing its job. It is a tidy story and it has one flaw. The packaging is the part that describes you. Content is what you said once; metadata is what you do, continuously, and it is legible at a scale no one could ever read a sentence at.

The distinction was written into law and habit long before it was written into protocols. A letter needs an address on the outside, so the address was never treated as private. A phone call needs a number to route to, so the number was fair game. The reasoning held while the outside of the envelope was one line of text and a human had to squint at it. It stopped holding the moment envelopes became machine-readable, permanent, and free to keep.

Ask what a single connection reveals and the answer sounds harmless. A source address. A destination. A timestamp. A byte count. The name of the server you asked for, still travelling in the clear on most connections because the handshake needs it before the tunnel exists. Individually these are facts about a machine, not a person.

Now ask what a year of them reveals. Which building you sleep in and which one you work in, inferred from where your phone stops moving. What time you wake, from the first sync of the morning. Who you talk to, ranked by frequency. Which of those people talk to each other. When that pattern changed, and roughly when the change began. None of that required reading a word. It required only the outside of the envelopes, sorted by time.

This is the asymmetry that makes metadata the more valuable half. Content is expensive: it is unstructured, ambiguous, in a dozen languages, and someone has to interpret it. Metadata is structured by construction. It arrives pre-formatted for a database, because a database is what the routing layer needed anyway.

A shadow contains no detail and still identifies a person. Gait, height, the way someone carries a bag — projected flat, stripped of everything, and recognisable anyway. Behavioural data works the same way. You do not need to know what is inside a pattern to know whose pattern it is.

Researchers have shown this uncomfortably often. A handful of location points is enough to single out one person in a dataset of millions, because almost nobody shares a home, a workplace, and a commute. Typing rhythm identifies. Packet timing identifies. The set of fonts and screen dimensions and extensions your browser exposes identifies, well enough that fingerprinting is a business rather than a curiosity.

Anonymisation, in this environment, is mostly a promise about intent rather than a property of the data. Remove the name and the record still knows exactly one person. It is not that the identifier was hidden badly. It is that behaviour is an identifier, and you cannot remove behaviour from a record of behaviour.

> sig_int // aggregate :: pattern-of-life

We kill people based on metadata.

Michael Hayden, former director of the NSA and CIA, 2014

The other thing that changed is that forgetting became a choice. For most of history, records decayed by default. Paper was expensive, filing cabinets filled up, tapes were reused, and the natural end state of an observation was that it disappeared. Surveillance was bounded not by law but by storage.

Storage stopped being the constraint about two decades ago. Keeping everything forever is now cheaper than building the machinery to decide what to delete — which means retention is no longer a decision someone makes but a decision someone has to actively un-make. Deletion has become a feature request. It has to be argued for, engineered, audited, and justified against the possibility that the data might be useful later.

The consequence is that the present is being recorded against a future whose rules nobody knows. A record collected under one regime, one employer, one government, one set of norms about what is acceptable, will still be sitting there under the next one. The threat model you evaluated the disclosure against is not the threat model the data will eventually live under. That is not paranoia; it is just what a durable record means.

Bentham's panopticon is usually described as a prison design and is more useful as an observation about cost. The point of the central tower was never that a guard watched every cell; it was that the guard might, and the inmates could not tell. Uncertainty did the work that manpower could not afford. Behaviour changed to fit the possibility of being seen, which is far cheaper than enforcing it.

The measurable version of this shows up in ordinary data. After surveillance programmes become public knowledge, searches for sensitive topics fall — not the illegal ones, the merely awkward ones. People stop looking things up that they would rather not have to explain. Editors make fewer contributions to contentious articles. The effect is small per person and enormous in aggregate, and it lands hardest on exactly the questions a society most needs someone to ask out loud.

This is the cost that never appears on the ledger. Surveillance is always defended in terms of what it catches, and the catching is at least countable. What it suppresses is not. A question not asked leaves no record, and the absence of a record is indistinguishable, from the outside, from nothing having happened at all.

The honest position is not that observation is illegitimate. Networks have to route; systems have to be debugged; abuse has to be detectable; some of the most valuable things we have built are made of aggregates. The problem is not that anyone looks. The problem is that looking is one-directional, unlogged, and unbounded in time, and that the people it describes cannot see the picture being assembled about them.

Almost every meaningful reform is a version of restoring symmetry. Retention limits put decay back into a system that lost it. Access logs make observation itself observable. Purpose limitation stops a record collected for one reason from quietly becoming evidence for another. Encrypting the envelope — not just the letter — shrinks how much of the pattern leaks to parties who only ever needed to move bytes. None of these are exotic. They are just expensive to whoever currently gets the data for free.

Being seen is not, in itself, a harm. Being seen by someone you cannot see, under rules you did not agree to, forever, is a different arrangement — and it is worth naming it as an arrangement rather than a fact of nature. It was designed. It can be designed differently.