The argument being made by researchers Bruce Schneier and Jon Penney is not theoretical. The infrastructure they describe is already being built and used, and the people being caught in it are not just the targets these systems were publicly designed for.
In the US, immigration enforcement agencies are using AI tools to track not only undocumented immigrants but also citizens who attend protests. Federal agents are using a facial recognition app called Mobile Fortify, which draws from over 200 million images across DHS, FBI, and State Department databases. According to a lawsuit filed by Illinois and Chicago, that app has already been deployed in the field more than 100,000 times. Immigration agents have also purchased social media monitoring and location-tracking systems that are explicitly marketed for use at protests and other public gatherings.
One federal contractor, Palantir, received a $30 million contract to build a system for locating people flagged for deportation. That same system is now being used to sift through tips submitted to an immigration tip line. A separate $2 million contract went to an Israeli firm for spyware capable of infiltrating any mobile phone and bypassing encrypted apps like WhatsApp. That spyware has previously been used in two dozen countries to target journalists and activists.
The federal government is also pulling data from the IRS, housing agencies, and state DMV records, and seeking voter registration files, all feeding into a single surveillance infrastructure. The declared purpose is immigration enforcement. The reach is much wider.
The same dynamic plays out in the workplace. Over 60% of companies now use AI tools to score employee productivity, collecting data from keystrokes, mouse movement, email timing, and meeting attendance. About 67% collect biometric data. And yet only around 22% of employees report knowing they are being monitored online. The employee monitoring software market was worth $5.4 billion in 2024 and is projected to nearly double within a few years. This is a large commercial industry, not a fringe practice.
For business operators, this matters in two ways. First, your employees are already living inside these systems, whether you have deployed them or not. Research shows that employees in high-surveillance environments report significantly more stress, and more than half say they would consider leaving a job if monitoring increased. That is a real cost, and it sits against whatever productivity gain the tools promise. Second, if you operate across borders, you are managing different legal realities. The EU's AI Act now bans real-time facial recognition in public spaces and prohibits emotion recognition tools in workplaces and schools entirely, with fines up to €35 million. The UK has no law at all and is moving toward expanding police facial recognition to all 43 forces. The US has no federal law and a scattered patchwork of state rules.
The broader point Schneier and Penney are making is that surveillance does not need to catch you doing something wrong to change your behavior. The knowledge that you might be watched, that your social media posts could be read by an AI looking for unfavorable speech patterns, that your face could be matched against a government database at a protest, is enough to make people more careful, more cautious, and more quiet. A United Nations study reached the same conclusion: surveillance does not just affect targeted individuals. It leaves long-term, society-wide impacts that fall hardest on already-marginalized groups.
The regulation debate is moving, but slowly. The EU has the strongest rules on paper, though enforcement is inconsistent: Clearview AI owes over €100 million in European fines and has paid nothing. In the US, states like Illinois, Texas, and Oregon have passed biometric consent laws, but the federal government is simultaneously expanding its own surveillance programs beyond those protections.
For anyone running a business that crosses borders, employs people, or operates in regulated industries, the question is no longer whether AI surveillance affects your environment. It does. The question is which rules apply to you, whether your own monitoring practices are defensible under those rules, and whether the surveillance infrastructure around you is being used in ways that affect how your employees, customers, and suppliers behave.