The Quiet Expansion of Surveillance and the Myth of Security
In February 2026, the European Union's AI Act came into full effect, introducing the first comprehensive legal framework for artificial intelligence governance in a major jurisdiction. Among its provisions were restrictions on real-time biometric surveillance in public spaces. Within weeks of implementation, member state governments had begun applying for the exceptions the Act itself had written into its own restrictions. The architecture of observation, it turns out, is easier to legislate around than to legislate against.
That gap between the rule and its exception is worth examining carefully. Not for what it decided, but for what it assumed.
The Infrastructure
Surveillance infrastructure rarely arrives as an instrument of control. It arrives as a solution to a specific and legitimate problem. Cities introduce facial recognition systems to improve public safety. Employers deploy behavioural monitoring tools to optimise workplace productivity. Governments expand digital identity systems to streamline public services. Financial institutions build transaction monitoring systems to detect fraud. Each deployment appears modest, targeted, and temporary in its original justification.
The architecture assembles itself in the gaps between those justifications.
Systems introduced to track financial irregularities connect to broader identity databases. Security cameras installed for traffic management integrate into policing networks. Workplace productivity analytics evolve into algorithmic management systems that determine hiring, performance assessment, and termination. Smart city infrastructure generates continuous behavioural data that persists long after the urban management problem it was introduced to solve has been addressed or forgotten.
The underlying logic is accumulation. Surveillance infrastructure gains analytical and commercial value as datasets interconnect. Each additional layer expands the capacity to observe, categorise, predict, and ultimately govern behaviour. The infrastructure does not plan this expansion. It is simply the direction in which the incentives consistently point.
The Power Structure
The conventional framing of surveillance as a government-to-citizen power dynamic is increasingly inadequate. It describes one layer of a more complex arrangement while leaving the more consequential layer largely unexamined.
The infrastructure of observation is no longer primarily owned or operated by states. It is built, maintained, and in many cases controlled by private technology corporations whose relationship to democratic accountability is indirect at best and adversarial at worst. When a city deploys a facial recognition system, the cameras may be publicly owned but the recognition algorithms, the data processing architecture, and the analytical frameworks that determine what the system sees and reports are almost always proprietary. The state purchases access to an infrastructure it does not fully understand and cannot fully audit.
The data generated by that infrastructure does not flow exclusively to government. It flows through corporate systems, is processed by corporate algorithms, and generates commercial value for corporate shareholders. The citizen surveilled by a public safety system is simultaneously generating behavioural data for a private entity that faces no electoral accountability for how that data is used, stored, sold, or eventually deployed.
This is a structural transformation of the relationship between observation and authority that the Myth of Security is specifically designed to obscure. The narrative of protective governance, the state watching over its citizens to keep them safe, conceals a tripartite arrangement in which the state, the corporation, and the infrastructure itself each hold different and partially misaligned forms of power over the observed population.
The Extraction Logic
Three forms of extraction operate simultaneously within surveillance infrastructure, and they compound each other.
The first is behavioural data, the continuous harvest of movement, transaction, communication, and social pattern data that feeds commercial profiling systems, predictive analytics markets, and the training datasets on which the next generation of observation tools will be built.
The second is governance capacity. As public institutions become dependent on privately built surveillance infrastructure, the ability to make independent administrative decisions migrates toward the architectures that generate and interpret the data on which those decisions rest. Democratic institutions retain formal authority. The corporations that own the observational infrastructure accumulate the operational authority that formal authority increasingly requires in order to function.
The third extraction is the most politically consequential and the least visible. Surveillance infrastructure does not observe populations equally. Facial recognition systems perform with documented accuracy differentials across racial groups, with the highest error rates consistently occurring in darker-skinned faces. Predictive policing algorithms trained on historical crime data reproduce and amplify the enforcement patterns of the systems that generated that data, directing disproportionate observation toward communities that were already disproportionately policed. Workplace monitoring tools are deployed most intensively in the lowest-paid and least unionised sectors of the labour market.
The communities most thoroughly surveilled are consistently those with the least political power to contest the terms of their observation. The Myth of Security frames this as a technical coincidence, the systems go where the risks are highest. The structural reality is that the systems go where resistance is weakest, and then define the presence of the systems as evidence that the risks were real.
The Myths
The Myth of Security is the primary legitimising narrative of surveillance infrastructure, but it does not operate alone. It is supported by two subsidiary myths that together close the space for structural challenge.
The Myth of Security itself performs a specific transformation. It converts asymmetrical power relationships into cooperative arrangements. Citizens are not described as subjects of observation. They are described as beneficiaries of protection. Monitoring becomes a defensive act rather than an exercise of power. This framing is particularly effective because it draws upon genuine fears. Crime, terrorism, and social instability are real concerns that governance systems must address. The myth does not invent the threat. It harvests it, using legitimate security concerns to generate political consent for infrastructure whose reach extends far beyond any specific threat it was introduced to address.
Once security narratives dominate public discourse, questioning surveillance infrastructure becomes structurally difficult. Those who raise concerns about monitoring systems can be positioned as indifferent to public safety. The debate shifts away from structural questions about authority, who controls the infrastructure, how data is used, what safeguards exist, toward questions about risk tolerance. The architecture of observation is removed from democratic scrutiny by being placed inside the frame of protective necessity.
The Myth of Temporariness holds that surveillance systems introduced during periods of crisis or for specific operational purposes remain bounded by their original justification. The historical record does not support this. Surveillance technologies introduced during exceptional circumstances have consistently become permanent components of governance. CCTV networks expanded during specific crime waves and remained. Counter-terrorism data collection frameworks introduced after specific attacks became routine intelligence infrastructure. Contact tracing systems built during public health emergencies generated data architectures that persisted after the emergency ended. The myth of temporariness makes each expansion appear bounded while the accumulated infrastructure grows without bound.
The Myth of Accuracy holds that surveillance systems, being technological rather than human, are objective. The error rates documented in facial recognition systems, the feedback loops embedded in predictive policing algorithms, and the class and racial differentials in workplace monitoring deployment all contradict this claim directly. The myth of accuracy is particularly dangerous because it
the political choices embedded in surveillance infrastructure through the language of technical neutrality. The system flagged it. The algorithm identified it. The data showed it. Each formulation removes human judgment, and therefore human accountability, from decisions that carry significant consequences for the people they affect.
The Civilisational Pattern
The use of observation infrastructure as a tool of governance over populations defined as requiring special supervision is not a feature of the digital age. It is one of the oldest instruments of administrative power.
Colonial governance developed sophisticated surveillance systems long before digital technology existed. Pass systems in Southern Africa required Black populations to carry documentation of their movements and employment status at all times, creating a continuous observational infrastructure that tracked, categorised, and controlled the movement of entire populations. Anthropometric systems recorded the physical characteristics of colonised peoples in databases that served both administrative and racial classification functions. Intelligence networks monitored the political activities, associations, and communications of independence movements across multiple continents simultaneously.
These systems were justified through security narratives. Colonial populations required management. Instability threatened the safety of all. Observation was protective. The mythology of security served colonial surveillance with the same structural function it serves contemporary digital surveillance: it converted the architecture of control into the vocabulary of protection, and made those who questioned it appear to be arguing against safety rather than against power.
The digital infrastructure of contemporary surveillance has transformed the scale, speed, and analytical capacity of observation beyond anything colonial administrators could have deployed. The underlying logic, that certain populations require more intensive observation, that the infrastructure of observation is neutral and protective rather than political and extractive, and that questioning it is irresponsible rather than necessary, has not changed in its essential character.
The Question
The European AI Act's surveillance restrictions, and the immediate proliferation of applications for the exceptions those restrictions contain, reveal something important about the relationship between democratic governance and observational infrastructure. Legislation follows deployment. By the time legal frameworks arrive to govern surveillance systems, those systems are already embedded in administrative processes, contractual relationships, and institutional dependencies that make their removal practically and politically difficult.
The real question is not whether societies should pursue safety. It is who governs the systems that claim to provide it, on whose populations those systems are most intensively deployed, and through what mechanisms the communities most thoroughly observed retain any meaningful authority over the architecture of their own observation.
Security is a legitimate objective of governance. Surveillance infrastructure, as currently designed, owned, and operated, is not primarily a security system. It is a power system that uses security as its legitimising vocabulary. The myth does not protect populations. It protects the infrastructure from the populations it observes.
