At 13:30 UTC on September 15, a call to reconsider 25 years of post-9/11 mass surveillance had reached 635 Hacker News points and 204 comments in MrKeyoor's live brief. That score measures attention, not factual authority. The article's technical problem will outlast the day's score: AI lowers the cost of turning stored communications, location traces, and purchased records into searches about a person. Cindy Cohn and Bruce Schneier's essay, first published by Lawfare, asks readers to assess those systems together rather than program by program.
For developers, the revealing unit is the query. The U.S. government's latest transparency report says an FBI batch tool can run many searches at once when they share a justification. In the reporting period ending November 2025, the FBI logged 3,486 approved queries through that batch technology. ODNI's report makes the implementation concrete. Once a large archive exists, software determines how quickly an analyst can turn a lead into a list of people, messages, or connections.
Collection became retrieval
Cohn and Schneier trace a move from surveillance aimed at a named person to systems that collect at population scale. The best-known early example was the NSA's bulk telephone-records program. In 2014, the Privacy and Civil Liberties Oversight Board found that the Section 215 program had limited value, lacked a viable legal basis under that section, and raised constitutional concerns. Congress responded with the USA FREEDOM Act in 2015. Its House report says the law prohibited bulk collection under Section 215 and replaced it with targeted access to call records.
Section 702 is a different system. It permits the government to target non-U.S. people reasonably believed to be abroad, with help compelled from U.S. communications providers. It can also collect communications involving U.S. people when they speak with a foreign target. The oversight board's 2023 report says the intelligence community could not provide a measure of how much U.S.-person information was incidentally collected. That unknown sits upstream of every later search.
The distinction matters outside the United States. A person abroad is part of Section 702's intended target pool, while the U.S. constitutional fight centers heavily on communications swept up about Americans. The same PCLOB report says individual foreign targets are not submitted to the surveillance court for review. The court reviews annual certifications and the procedures governing targeting, retention, and queries. Readers worldwide therefore encounter different legal protections inside the same technical pipeline.
The query layer is measurable
The 2025 numbers show how much work happens after acquisition. ODNI estimated 349,823 non-U.S. targets under Section 702, up from 291,824 in 2024. It reported 7,724 U.S.-person query terms used by the NSA, CIA, and National Counterterrorism Center. The FBI used 7,413 U.S.-person query terms in its own reporting period, up from 5,518. Those figures come from ODNI's April 2026 statistical report, which also warns that agencies count queries differently.
A query term is not the same as a single search execution. The NSA counts an approved U.S.-person identifier once even if analysts use it repeatedly. The FBI counts a unique identifier once across users and databases during the period. Batch jobs add another wrinkle: if one term in a batch concerns a U.S. person, the FBI counts every query in that batch as a U.S.-person query. ODNI says each batch requires a shared justification and attorney approval. The published totals are useful, but they cannot tell a reader how many times a name, email address, or phone number was entered.
Oversight findings resist a simple verdict. PCLOB concluded in 2023 that Section 702 helps defend against foreign threats, including cyberattacks on infrastructure, and that U.S.-person searches can identify victims compromised by foreign hackers. The board also identified U.S.-person and batch queries as major privacy risks. Its report describes batch searches containing hundreds or thousands of terms. Faster correlation can help find a compromised network. It can expose many unrelated people just as quickly when the justification or input set is too broad.
AI changes how that analysis scales. Collection volume still matters, but analysis no longer scales only with the number of investigators and hours available. A model can classify free text, connect spelling variants, summarize years of records, and rank possible relationships. Cohn and Schneier argue that this analytic capacity raises the cost of mistakes and abuse. The change begins before autonomous agents enter the picture: cheaper, faster retrieval alters what can be done with data that has already been retained.
Commercial data supplies another archive
Government collection is only one input. The U.S. intelligence community has a policy for acquiring and processing commercially available information, the data sold or exposed through ordinary markets. In its statement on that policy, ODNI says individual records that may appear harmless can create privacy and civil-liberty concerns when combined with advanced analytic tools, including AI. The agency required intelligence bodies to catalog such holdings and apply extra rules to sensitive commercial data.
The commercial supply can be enormous before an intelligence agency buys anything. In a 2024 case, the Federal Trade Commission alleged that Mobilewalla had collected more than 500 million unique advertising identifiers paired with precise location data between January 2018 and June 2020. The complaint said the raw data could reveal homes, health-clinic visits, and places of worship. The FTC's proposed settlement would restrict Mobilewalla's sale of sensitive location data. This case concerns one broker and an FTC allegation, yet it gives a scale to the market that the surveillance essay treats as part of the same system.
The privacy risk now depends on the permissions around a query as much as the database's size. Useful controls have to reach model prompts, batch inputs, purpose declarations, result access, and audit logs. A deletion policy cannot explain who searched for whom yesterday. ODNI's commercial-data framework calls for periodic review of acquisition and use decisions, which recognizes that buying a dataset and interrogating it are separate acts.
A court drew a line around the search
The U.S. Supreme Court supplied a recent legal example in Chatrie v. United States. Police investigating a bank robbery used a geofence warrant to obtain Google Location History records for devices near the bank. Google's process narrowed the results until it disclosed three names. On June 29, the Court held that accessing Chatrie's location history was a Fourth Amendment search even though the request covered two hours and the records came from a technology company.
The ruling did not decide whether every stage of that warrant met the requirements for probable cause and particularity. It sent those questions back to the appeals court. Its narrower holding still fits the query-layer problem: data collected for an app remained constitutionally sensitive when police asked the company to retrieve it. The majority opinion rejected the idea that ordinary use of apps makes stored email, photos, calendars, or location history freely available to the government.
Congress has a live test
Section 702's statutory authority lapsed in June after a short extension failed, but collection did not stop that night. Existing surveillance-court certifications remain effective until March 2027, according to a June 13 statement from Representative Warren Davidson. That interval gives Congress a concrete choice about reauthorization and query rules while the current authorizations keep operating.
One bipartisan proposal, the Government Surveillance Reform Act, would require warrants for searches of Americans' communications collected under Section 702 and restrict government purchases from data brokers. Its sponsors also wrote explicit protections for location data, browsing history, search records, chatbot records, and vehicle telematics into the bill's announced provisions. Those are proposals, not current safeguards. Their scope shows that lawmakers are starting to treat AI analysis and commercial datasets as connected surveillance issues.
The next evidence will be less dramatic than the 635-point Hacker News discussion, and more useful. Watch whether Congress puts a warrant rule into any Section 702 renewal, whether agencies report AI-assisted searches separately, and whether future transparency reports count actual executions rather than only unique terms. The 25-year review lands on a practical test: a surveillance system should be judged by the questions it can answer about a person, who may ask them, and what record remains after the search.