Schneier argues that 25 years in, the promised safety dividend from mass surveillance never materialized, while the collection apparatus became the default architecture of the internet. He calls for concrete rollbacks: sunset Section 702, ban government purchase of data that would otherwise require a warrant, and make data minimization a legal default rather than a policy aspiration.
By submitting Schneier's essay to HN where it reached 840 points, this submitter surfaced the argument to a technical audience. The high vote count suggests strong resonance with the position that the surveillance status quo is untenable and needs legislative correction.
Schneier's central analytical move is refusing to treat NSA collection, FBI data appetite, and ad-tech tracking as distinct issues. He argues data brokers sell to cops, cops subpoena tech companies, and tech companies buy from brokers — producing a de facto general warrant that no legislature ever authorized.
The editorial reframes Schneier's policy piece as a direct challenge to working developers, arguing that every third-party analytics SDK, 400-day log retention default, and vendor data-sharing arrangement is a brick in the same wall. The position holds that technical choices are political consequences, and dismissing surveillance as 'a policy problem' is precisely how the current architecture became inevitable.
Bruce Schneier — the cryptographer who has been the adult in the room on surveillance policy since before most of your dependencies were written — has published a long-form post marking 25 years of the post-9/11 surveillance apparatus. The thesis is blunt: a quarter-century in, the bargain doesn't pencil out. The programs that were sold as narrow counter-terrorism tools became the default architecture of the internet, and the promised safety dividend never showed up on the balance sheet.
The piece walks through the familiar landmarks — the Patriot Act, Stellar Wind, Section 702, the Snowden disclosures in 2013 — but the frame is what matters. Schneier isn't relitigating any single program. He's making the aggregate argument: the NSA's collection posture, the FBI's data appetite, the intelligence community's public-private plumbing, and the ad-tech industry's tracking infrastructure are no longer separable systems. They co-evolved. Data brokers sell to cops. Cops subpoena tech companies. Tech companies buy from brokers. The result is a de facto general warrant that no legislature ever voted for.
His proposed remedies are unfashionably concrete: sunset Section 702, ban the government from buying data it would need a warrant to seize, and — most relevant to anyone reading this — treat data minimization as a legal default rather than an aspirational bullet point in a privacy policy.
It's tempting to file this under 'policy piece, not my problem.' Don't. The surveillance stack Schneier is describing is the same stack you ship every time you add a third-party analytics SDK, wire up a logging pipeline that keeps everything for 400 days, or hand a vendor a feature flag on your customer data. The choices are technical. The consequences are political. Pretending otherwise is how we ended up here.
Consider the trajectory. In 2001, keeping a year of full HTTP logs was expensive and weird. By 2011, it was cheap and normal. By 2021, it was the retention default in half the observability tools on the market, and 'we'll figure out what we need it for later' had quietly become an architectural principle. LLM training in 2024–2026 accelerated this by another order of magnitude — every scraped forum post, every leaked support ticket, every 'anonymized' event stream is now a candidate training set. Schneier's point is that this isn't a bug of capitalism or a quirk of intelligence agencies. It's what happens when storage gets cheap and nobody says stop.
The counter-argument, which has been made honestly by people like Stewart Baker and less honestly by every DHS press officer since 2002, is that specific programs have plausibly disrupted specific plots. Schneier grants some of this and then asks the right follow-up: at what cost, and compared to what alternative? The Privacy and Civil Liberties Oversight Board's 2014 report on Section 215 — the bulk phone records program — concluded it had not been essential to a single counter-terrorism success. That finding never made it into the Congressional debate that reauthorized the surveillance regime in 2020, and it certainly hasn't made it into the current 702 renewal fight.
The community reaction on Hacker News (840 points, top of the front page) is worth reading not for the takes but for the resignation. The top comments aren't 'this is wrong' — they're 'this is right and nothing will change.' That's the tell. When a technically literate audience treats surveillance infrastructure as a natural phenomenon rather than a set of engineering decisions, the engineers have lost the plot.
The practical implications for developers are less abstract than the framing suggests. Three concrete places to look:
Retention defaults. If your logging pipeline's default retention was picked by whoever set up Datadog in 2019, it is almost certainly wrong in 2026. Every log line is a subpoena target and a breach liability. The right default is short — 30 days for app logs, 90 days for security-relevant events, indefinite only for things you can defend line-by-line. 'We might need it' is not a defense; it's a confession.
Third-party SDKs. The analytics vendor, the session-replay tool, the feature-flag service, the error tracker — each of these is a party you've quietly added to every law-enforcement request that touches your users. Most of them retain data longer than you do and answer subpoenas without telling you. Audit the list. Kill the ones that don't earn their seat.
Data brokers in your supply chain. If you use enrichment APIs — the 'give us an email, get back a LinkedIn profile' kind — you are downstream of the exact broker ecosystem Schneier wants regulated. When (not if) the FTC or a state AG comes for that industry, your product is going to have a hole in it. Have a plan.
None of this is new advice. What's new is that the political weather is finally shifting. The EU's Digital Services Act is biting, California's Delete Act goes into full effect this year, and even the current Congress is making noises about data-broker regulation that aren't purely performative. The 'store everything, decide later' architecture that has been the free default for two decades is starting to have a price, and that price will land on whoever's name is on the deploy.
Schneier's piece won't change any policy on its own — he'd be the first to tell you that. But it's a useful marker. Twenty-five years is long enough that the people who built the surveillance stack are retiring, and the people inheriting it are the ones who'll pay the political and legal bills. If you're writing infrastructure today, assume the retention defaults you pick will outlive the administration that lets you get away with them. Build like the subpoena is already in the mail. It might be.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.