Origins of Surveillance Technology in the United States

Abstract

This article traces the origins of surveillance technology in the United States from nineteenth-century telegraphy to twenty-first-century biometric and pharmaceutical monitoring. Background: Popular accounts treat mass surveillance as an artifact of the digital age, yet its institutional logics and legal doctrines were established alongside the communication technologies of the nineteenth and twentieth centuries. Methods: The study synthesizes historical, legal, and surveillance-studies scholarships into a chronological account organized around three recurring patterns. Results: Function creep, crisis-driven expansion, and doctrinal lag appear repeatedly from the Civil War telegraph through post-9/11 bulk collection to present-day biometric and prescription-drug monitoring. The Fourth Amendment third-party doctrine serves as the central hinge permitting routine collection of personal records. Conclusions: The migration of surveillance from communications to the body—prescription drug monitoring programs and biometric health databases—represents continuity rather than rupture, and meaningful constraint requires structural, warrant-based limits keyed to the sensitivity of information rather than to the involved technologies.

1. Introduction

The dominant public understanding treats mass surveillance as an artifact of the digital age, a by-product of smartphones, social media, and the data economy. This framing is foreshortened. The technologies that define contemporary surveillance differ in scale and speed from their predecessors, but the institutional logics, legal doctrines, and political rationales that govern them were established long before the first packet of internet traffic was intercepted. The capacity of the state to monitor private communication emerged alongside the communication technologies themselves, and the legal architecture erected to regulate that capacity has been reacting, always belatedly, ever since [1].

This article traces the origins of surveillance technology in the United States from nineteenth-century telegraphy to twenty-first-century biometric and pharmaceutical monitoring. It is a work of synthesis, drawing together historical, legal, and surveillance-studies scholarships to argue that the trajectory of American surveillance is best understood not as a series of discrete technological ruptures but as the working-out of three recurring patterns.

The first pattern is function creep: surveillance capabilities authorized for one narrow purpose are repurposed, over time, for broader ends [1]. The second is crisis-driven expansion: moments of national emergency—war, terrorism, epidemic—produce durable enlargements of surveillance authority that rarely contract when the crisis passes [2]. The third is doctrinal lag: the legal rules meant to constrain surveillance are calibrated to the technology of an earlier era and consistently fail to anticipate the next [3].

Holding these patterns together is a single legal hinge—the third-party doctrine—the principle that information voluntarily disclosed to another party carries no reasonable expectation of privacy and therefore falls outside the Fourth Amendment’s warrant requirement. This doctrine, more than any statute, explains how a constitutional order ostensibly committed to protecting private life came to permit the routine collection of its citizens’ records.

The argument proceeds chronologically, from the telegraph and the early law of wiretapping, through the constitutional turn of the mid-20th century and the intelligence exception that grew beside it, to the bulk-collection programs revealed after 2001 and the judicial corrections that followed. It then turns to the biometric and algorithmic technologies that target the body rather than its messages, and finally to the domain of health, where prescription drug monitoring compels the pharmacy to generate a record of the body that the state may query. The destination is deliberate. The logics that governed the acquisition of the telegram copy and the wiretap now govern the prescription database, and the migration of surveillance from the wire to the body is continuous with what came before.

2. Materials and Methods

This article is a work of interpretive synthesis rather than primary empirical research. Its method is the qualitative, theory-guided integration of three bodies of evidence—legal, historical, and sociological—into a single chronological account, an approach that joins doctrinal–legal analysis to the analytical-narrative tradition in comparative-historical scholarship. No human subjects, datasets, or new observations were involved; the study reasons over publicly available primary and secondary sources. Its aim is explanatory and structural: to assess whether the surveillance practices commonly attributed to the digital age are better understood as the continuation of dynamics established alongside earlier communication technologies and, where they are, to specify the mechanisms through which that continuity operates.

The source base comprises three categories. The first is primary legal material: decisions of the United States Supreme Court and the federal courts of appeals, federal statutes and their legislative history, executive orders, and the rules and reports of administrative agencies. The second is secondary scholarship: histories of communications surveillance, legal scholarship on privacy and the Fourth Amendment, and the theoretical literature of surveillance studies. The third is documentary and industry material: regulatory filings, oversight-body reports, corporate disclosures, and contemporaneous reporting on the firms that build and operate surveillance infrastructure. All sources are publicly available, and the analysis produces no new data.

Within each category, sources were located by following the principal legal, historical, and surveillance-studies literatures on each episode and the primary materials they cite, together with the leading cases, statutes, and oversight reports on point; they were screened for direct relevance to the analytic arc and for authority or representativeness. They were retained where they illuminated one of the mechanisms under study rather than for comprehensive coverage of any single episode. The selection is accordingly purposive and interpretive rather than systematic. No formal search protocol or exhaustive database enumeration was applied, a limitation the analysis shares with interpretive-synthetic work generally.

Cases and episodes were selected purposively to trace one analytic arc—the migration of surveillance from the communications network to the body—across roughly a century and a half of United States history. The chronological spine is anchored on the landmark doctrinal moments that mark shifts in the legal treatment of intercepted information—among them Olmstead [4], Katz [5], the third-party-doctrine decisions, and their partial qualification in Carpenter [6] and Chatrie [7]—because these decisions are the hinges on which the larger argument turns. Around that spine, the article assembles illustrative episodes in which the same dynamics appear in practice rather than in doctrine: The mass interception of private telegrams in the 1930s, the construction of the emergency-call location architecture, and the successive pharmaceutical and genomic frontiers. The selection is deliberately illustrative rather than exhaustive—it privileges episodes that reveal mechanism over comprehensive coverage—and it is bounded to the United States so that legal–doctrinal continuity can be traced within a single constitutional order, with comparative material introduced only to situate that case. Two of the strands traced here—the foreign-intelligence regime treated in Section 5 and the biometric and algorithmic systems of Section 10—are developed more briefly than the others, as surveys that establish doctrinal and technological context rather than as case studies of the depth given to the wiretap, third-party, and emergency-location material. They are included because the argument’s arc requires them, not because the treatment exhausts them.

Three recurring patterns serve as the interpretive lenses through which the assembled material is read. The first is function creep, the incremental extension of a surveillance capability beyond the purpose for which it was authorized [1]; the second is crisis-driven expansion [2], the tendency of emergencies to produce durable enlargements of governmental authority that rarely contract once the emergency passes; and the third is doctrinal lag [3], the recurring gap between the capabilities of a new technology and the legal rules available to govern it. Here it is useful to distinguish genuine conceptual lag—the gap that separated Olmstead from Katz, where a new technology outran the very categories available to describe it—from the more mechanical extension of a technology-neutral rule, as when the logic of the third-party doctrine was carried from the pen register to the cell tower. Kerr’s [3] account of Fourth Amendment “equilibrium-adjustment” helps mark which movements reflect genuine technological surprise and which reflect a rule applied past its rationale. The Fourth Amendment’s third-party doctrine operates throughout as the organizing legal hinge—the mechanism by which information disclosed to an intermediary loses constitutional protection. Each episode was examined against these constructs to identify both the continuities they predict and the ruptures, chiefly judicial, that interrupt them, and the resulting account is framed by the surveillance-studies conception of convergent monitoring systems as a single, distributed assemblage. Alongside these descriptive patterns, the analysis is read through a public-choice account of regulation—the expectation that concentrated and well-organized interests will shape rules to their advantage while the diffuse costs of surveillance fall on the unorganized—which helps explain why its distributive burden settles where it does [8,9].

Two features of this design bound its claims. First, the account is interpretive and theory-guided, and therefore necessarily selective; by foregrounding continuity it risks underweighting genuine discontinuity, and the analysis accordingly treats the moments at which courts and legislatures have arrested surveillance—Riley [10], Carpenter, and the curtailment of bulk telephony metadata among them—as evidence against the thesis as much as for it. The argument would be weakened by episodes in which a surveillance capability expanded and then durably contracted without external constraint, or in which legal doctrine anticipated rather than trailed a new technology; the contention here is that such episodes are the exception. Second, the study is United States-centered and makes no claim to causal identification in the statistical sense. Its warrant rests on the convergence of independent legal, scholarly, and documentary sources on the same pattern, and its conclusions are offered as the most coherent reading of that convergent evidence rather than as a demonstration of necessity.

3. From the Wire to the Wiretap: Telegraphy and Telephony

Samuel Morse demonstrated a working electric telegraph in 1844, creating for the first time a national network across which private messages traveled in a form that a third party could intercept and read. By the time of the Civil War, both the Union and the Confederacy had recognized the military value of tapping enemy telegraph lines, and wiretapping entered American practice as an instrument of statecraft well before it became a tool of domestic law enforcement [11].

The same vulnerability that made the telegraph useful to commanders made it attractive to police, private detectives, and corporate rivals. As telephone networks spread in the decades that followed, interception migrated from the telegraph key to the switchboard, and a patchwork of state statutes—some prohibiting wiretapping, many silent—governed a practice that federal law had not yet squarely addressed. The technology had outrun the rules, a condition that would recur at every subsequent stage.

The Supreme Court first confronted telephone wiretapping in Olmstead v. United States (1928) [4]. Federal prohibition agents had tapped the telephone lines of a suspected bootlegging operation without entering any private premises, splicing into wires in the streets and in the basement of an office building. The Court, in an opinion by Chief Justice Taft, held that the Fourth Amendment reached only physical searches and seizures of tangible things. Because the agents had committed no trespass and seized no material object, there had been no search at all, and the evidence was admissible.

Justice Brandeis dissented in terms that would outlast the majority. He invoked what he called the right “to be let alone,” and argued that the framers had conferred against the government a comparable protection for the private life of the citizen—one that could not be confined to the physical trespass familiar to the eighteenth century. Surveillance, he warned, would only grow more subtle and more pervasive as technology advanced, and a constitution read to ignore intangible intrusions would fail precisely as the threat became most acute.

Brandeis’s argument had intellectual roots in an essay he had written four decades earlier with Samuel Warren, which articulated a right to privacy grounded in what they called inviolate personality—a right to control the dissemination of one’s private affairs [12]. Olmstead would govern for nearly forty years, but the dissent’s reasoning supplied the seed of its eventual reversal.

In the years after Olmstead, the executive branch demonstrated what the unconstrained interception of communications could accomplish at scale. As David Beito documents, in 1935 the Roosevelt administration encouraged the Senate to create a Special Committee to Investigate Lobbying Activities—the ‘Black Committee,’ after its chairman, Senator Hugo Black of Alabama—nominally to examine lobbying against New Deal legislation. Working in tandem with the Federal Communications Commission (FCC), the committee issued catch-all dragnet subpoenas to the telegraph companies and combed through copies of millions of private telegrams sent by and to anti–New Deal critics, journalists, and lawyers—by some estimates roughly five million messages—with virtually no judicial supervision or individualized suspicion [13]. Analytically, this is the compelled acquisition of communications records already held by the carriers rather than contemporaneous interception. The two raise distinct legal problems and keeping them separate strengthens rather than weakens the continuity traced here. The distinction returns in Section 11, where it places the prescription record on the same side of the line as the telegram copy. The episode prefigured nearly every structural feature this article traces: surveillance conducted through records held by a third-party carrier and obtained without the senders’ knowledge; a licensing agency repurposed as an investigative instrument; and the rationale of a legitimate inquiry stretched to authorize comprehensive monitoring of political adversaries. It unraveled only when the dragnet became public and the courts intervened—suits brought by William Randolph Hearst and others produced 1936 rulings that curtailed the committee and rebuked the FCC—an early demonstration that legal constraint tends to arrive only after the surveillance it addresses has already done its work. That Black was elevated to the Supreme Court the following year is at most suggestive on this point. An appointment cannot by itself establish that such methods had been absorbed into the ordinary machinery of governance, and the claim of normalization is better rested on evidence that the practices, or their rationales, persisted.

4. People, Not Places: Katz and the Statutory Response

In Katz v. United States (1967) [5], the Court abandoned the trespass framework. Federal agents had attached an electronic listening device to the outside of a public telephone booth from which the defendant placed calls relaying wagering information. Under Olmstead, the absence of physical penetration would have ended the inquiry. The Court held instead that the Fourth Amendment protects people, not places, and that what a person seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected.

Justice Harlan’s concurrence supplied the test that courts have applied ever since: A search occurs when the government intrudes upon an expectation of privacy that the individual has actually exhibited and that society is prepared to recognize as reasonable. The reasonable-expectation-of-privacy standard relocated Fourth Amendment analysis from the geography of trespass to the sociology of expectation, a move that expanded protection in 1967 but that would, in later hands, prove double-edged.

Congress responded the following year with Title III of the Omnibus Crime Control and Safe Streets Act of 1968 [14]. Title III established a detailed warrant procedure for law-enforcement wiretaps: applications required probable cause, particular description of the communications to be intercepted, a showing that less intrusive methods had failed or would fail, judicial authorization for limited periods, minimization of irrelevant interception, and subsequent reporting. The statute became the template for lawful electronic surveillance in the criminal context, translating Katz into an administrable code.

5. The Intelligence Exception: FISA and the Two-Track System

Title III governed criminal investigations but said little about surveillance conducted for foreign-intelligence purposes, an arena in which the executive branch had long claimed inherent constitutional authority to act without judicial warrant. Through the middle decades of the twentieth century, that claim underwrote extensive domestic surveillance whose targets were chosen less for suspected crime than for political dissent.

The Church Committee’s investigations in 1975 and 1976 documented the scope of these programs: the FBI’s COINTELPRO operations against civil-rights leaders, antiwar activists, and political organizations; the National Security Agency’s (NSA) interception of international communications; and decades of surveillance directed at Americans who had committed no crime. The revelations established that an unconstrained intelligence apparatus would, predictably, turn inward.

Congress answered with the Foreign Intelligence Surveillance Act (FISA) of 1978 [15], which created a specialized court to review government applications for intelligence surveillance and required a showing that the target was a foreign power or an agent of a foreign power. FISA thus established a two-track system: criminal surveillance proceeded under Title III’s demanding probable-cause standard, while intelligence surveillance proceeded under FISA’s separate and more permissive regime. The gap between the two tracks was tolerable so long as the categories remained distinct. After 2001, that distinction would erode, and the intelligence track would expand to encompass collection on a scale its drafters had not contemplated.

6. The Third-Party Doctrine: Voluntary Versus Compelled Data Surrender

While the wiretap cases concerned the content of communications, a parallel line of decisions addressed the records about communications and transactions—and produced the doctrine that would prove most consequential of all. In United States v. Miller (1976) [16], the Court held that a bank depositor had no legitimate expectation of privacy in financial records held by his bank, because those records were the bank’s business records and the depositor had voluntarily conveyed the information to the institution in the ordinary course of business.

Three years later, Smith v. Maryland (1979) [17] extended the principle to telephone records. The police had installed a pen register to record the numbers dialed from the defendant’s home. The Court reasoned that a telephone user voluntarily conveys dialed numbers to the phone company to complete calls and therefore assumes the risk that the company will reveal them. Together, Miller and Smith established the third-party doctrine: Information knowingly exposed to a third party loses Fourth Amendment protection, regardless of any expectation that the third party will keep it confidential.

Congress softened the doctrine’s edges with the Electronic Communications Privacy Act of 1986 [18], which extended statutory protection to stored electronic communications and transactional records. But the statute set thresholds below the warrant standard and contained numerous exceptions, so that records stripped of constitutional protection by Miller and Smith received only the partial and qualified shelter of statute.

The doctrine has able defenders. Orin Kerr has argued that it is more sensible than its critics allow [19]. It preserves a measure of technological neutrality by treating information the same whether held by a person or by an intermediary, it prevents wrongdoers from placing evidence beyond reach simply by routing it through a third party, and it supplies clear ex ante rules that police and courts can apply without case-by-case balancing. On this account the doctrine is not a loophole but a defensible allocation of the burdens of an information society.

Critics respond that the doctrine rests on a fiction of voluntariness, since participation in modern life requires disclosing vast quantities of information to banks, carriers, and platforms that no one meaningfully chooses to surrender. Daniel Solove has dismantled the “nothing to hide” intuition that often underwrites the doctrine [20], showing that the harms of surveillance extend well beyond the concealment of wrongdoing to encompass aggregation, exclusion, and distortion [21]. Neil Richards has argued that surveillance is dangerous precisely because it chills intellectual exploration—the reading, thinking, and communicating through which people form beliefs—a value he terms intellectual privacy [22]. The disagreement is not merely doctrinal; it concerns what privacy is for.

7. Crisis and Bulk Collection: Surveillance After 11 September

The attacks of 11 September 2001 produced the most consequential instance of crisis-driven expansion in the history considered here. It was not, however, the first time that national emergency had turned the machinery of communication to the government’s purposes. During the First World War, a Censorship Board, acting under the Trading with the Enemy Act of 1917 [23], read and suppressed the cable and wireless traffic passing between the United States and the world. During the Second World War, the Office of Censorship, created under the First War Powers Act of 1941 [24], extended that practice across the whole of international communication—cable, telephone, and radio—examining messages on an enormous scale [25]. Each regime was justified by the exigency of war, and each reached ordinary communication far beyond any suspected agent of a foreign power, carrying the Civil War’s interception of the telegraph forward into the era of the cable and the wireless, an earlier turn of the same crisis-driven ratchet the post-9/11 period would repeat. The USA PATRIOT Act, enacted within weeks, amended numerous surveillance authorities [26]. Among them was Section 215 of the USA PATRIOT Act, which permitted the government to compel production of business records and other tangible things relevant to a foreign-intelligence or terrorism investigation, a provision whose breadth would later be construed to authorize collection on a scale the public did not suspect.

Under a secret interpretation of Section 215, the NSA collected telephone metadata—the numbers dialed, and the time and duration of calls—for millions of Americans who were suspected of no wrongdoing. The legal theory rested directly on Smith v. Maryland. Because metadata had been voluntarily conveyed to carriers, it was a business record outside the Fourth Amendment, and its bulk collection raised, on this view, no constitutional difficulty [27]. The third-party doctrine, devised for a single pen register in 1979, had become the warrant for a database of national scope.

A second authority operated in parallel. The FISA Amendments Act of 2008, in Section 702, authorized the targeting of non-U.S. persons reasonably believed to be located abroad, implemented through programs that collected communications from internet providers and from the backbone of the network itself [28]. Because targets abroad communicated with persons in the United States, the communications of Americans were incidentally collected as well. Beyond the FISA framework, Executive Order 12333 governed the broader signals-intelligence enterprise, much of it conducted overseas and subject to little external review [29].

The scope of these programs became public in 2013. An independent oversight body subsequently concluded that the telephone-records program lacked a viable statutory basis and recommended that it be ended, finding that it had provided little unique value [30]. The same body found the Section 702 program lawful but identified serious concerns about the incidental collection and retention of Americans’ communications [31].

The courts divided. In Klayman v. Obama (2013) [32], a federal district court found the bulk-metadata program likely unconstitutional, describing the technology as “almost Orwellian” and doubting that a 1979 precedent could govern collection of such breadth. In American Civil Liberties Union v. Clapper (2015) [33], the Court of Appeals for the Second Circuit held on statutory grounds that Section 215 had never authorized bulk collection at all, avoiding the constitutional question. Congress then enacted the USA FREEDOM Act of 2015, ending the government’s bulk telephony-metadata program and substituting a system of targeted production from the carriers [34]. Laura Donohue has argued that the programs, in their indiscriminate sweep, amounted to precisely the general warrants the Fourth Amendment was designed to prohibit [35].

8. Dialing for Help: Emergency Response and the Architecture of Location

A parallel strand of the location story begins not with an investigator but with a caller in distress. The number 911 was designated as a national emergency code in 1968, and the first call was placed that February in Haleyville, Alabama; for its first decades the system did little more than connect a caller to a dispatcher, and it spread slowly, reaching only a fraction of the population through the 1970s and 1980s [36]. Basic 911 was a public-safety convenience of the most unobjectionable kind. The surveillance significance of the emergency-response system lies entirely in what was required to make it work better.

To dispatch help, a call center must know who is calling and from where, and Enhanced 911 (E911) supplied both automatically through Automatic Number Identification and Automatic Location Identification—the caller’s number and physical location delivered to the dispatcher as a built-in feature of placing the call. The structural move is the one this article has traced repeatedly: the service is provided on the condition that identifying information is generated and conveyed to a third party. The dialed-number logic of Smith v. Maryland (1979) [17]—that information handed to the carrier in the ordinary course of using the network carries no expectation of privacy—maps onto a system engineered so that location is transmitted whether or not the caller can speak it.

The consequential expansion came with mobile telephony, which severed the link between a telephone and a fixed street address on which wireline E911 had depended. The Federal Communications Commission responded in 1996 with rules requiring wireless carriers to locate 911 callers, phased in over time: Phase I obligated carriers to report the cell site or sector and a callback number, and Phase II required far more precise latitude and longitude, accurate to within a specified distance and rolled out beginning in 2001 [37]. Congress reinforced and generalized the mandate in the Wireless Communications and Public Safety Act of 1999, which designated 911 the universal emergency number for both wireline and wireless service and directed deployment of the location infrastructure to support it [38]. To meet these requirements, carriers engineered location-determination capability—handset satellite positioning, network-based triangulation, and hybrid methods—into the cellular network itself. The capacity to fix the position of any handset, continuously and with increasing precision, was not an incidental by-product of mobile telephony; it was a regulatory requirement, justified by the genuine and compelling interest in answering calls for help.

That capability, mandated to save lives, is the same capability on which location surveillance now depends. The cell-site location information whose warrantless acquisition the Supreme Court would later confront exists because carriers were required—for emergency response and ordinary network operation alike—to know where their subscribers’ devices are. That knowledge is not incidental but architected. Ordinary operation already yields a record of which tower each handset uses—the cell-site location information later at issue in Carpenter—because a device must register with the network to function; and to meet the Phase II mandate, carriers layered onto that a purpose-built positioning capability, computed within the network core from tower measurements or the handset’s satellite receiver and routed to the dispatcher through the carrier’s mobile switching center. The same switches and towers that carry a call are thus equipped, by regulation and by operational necessity alike, to fix its origin and to surrender it.

The pattern is the one this article calls function creep, here operating at the level of physical infrastructure, a network built to be locatable for the dispatcher is locatable for the investigator as well. A second statute made the dual character explicit. The Communications Assistance for Law Enforcement Act of 1994 (CALEA) required telecommunications carriers to design interception capability directly into their networks, ensuring that the migration to digital switching would not erode law enforcement’s wiretap access [39]. Read together, the emergency-location and lawful-intercept mandates produced a communications system that is, by regulatory design, both locatable and interceptable—its surveillance affordances built in at the level of the switch and the cell tower, long before any particular investigation invokes them. Nor does the infrastructure that performs this location and routing reside in public hands. It is operated in substantial part by a single private vendor, Intrado—which describes itself as having supplied the foundational 911 infrastructure of North America and maintains the largest such footprint in the country—and since 2023 that business has been owned by Stonepeak, an infrastructure-investment firm that acquired it for $2.4 billion [40]. The capacity to locate any handset in the network is thus not merely built in by regulatory mandate but held, at its core, as a privately owned and commercially managed asset, the emergency-location layer of the cellular network positioned to be folded into the proprietary, revenue-seeking logic that Zuboff identifies [41]. Private ownership alone, however, does not establish that the emergency-location data is being commodified in the manner that account describes.

The trajectory has continued as the emergency system has grown more capable. Next Generation 911, the ongoing migration to an internet-protocol architecture, expands what the system can receive from a voice call and a location to text messages, images, video, and telematics streamed from vehicles and devices, widening the envelope of information that flows through public-safety infrastructure [36]. A single vendor illustrates how far this enlargement reaches. Carbyne, a leading provider of cloud-native NG911 call-handling, supplies dispatchers with a caller’s precise location, a live video feed from the smartphone camera, audio, text, and telemetry drawn in parallel with the voice call, and integrates additional streams from connected devices and sensors—delivering, by its own account, hundreds of millions of data points each year [42]. The destination of that capability is more telling still: In late 2025, Carbyne agreed to be acquired by Axon Enterprise, the dominant supplier of police body cameras, conducted-energy weapons, and digital-evidence management, in a transaction valuing the company at $625 million, folding the emergency-response data layer directly into the commercial infrastructure of law enforcement [43]. The emergency call and the police case file, once institutionally distinct, converge in a single corporate platform—an instance, at the level of ownership, of precisely the rhizomatic integration of once-separate data streams that the surveillant assemblage describes [44]. Common ownership creates the conditions for such integration but does not, by itself, establish that the corresponding data streams have in fact been combined in operation. The emergency-response system thus reproduces, in miniature, the central dynamic of this article: A function of unquestioned public value—summoning aid to a person who may be unable to summon it—becomes the occasion for building a standing capability whose reach extends well beyond the emergency. As with the prescription-monitoring programs examined below, the life-saving benefit is real, and it is precisely that benefit that makes the accompanying surveillance capacity so difficult to see and so resistant to constraint. What the emergency-location mandates built, the law would be left to govern only afterward—and the question whether the resulting location record could be obtained without a warrant fell to the courts.

9. The Court Adjusts: Jones, Riley, Carpenter, and Chatrie

As the bulk-collection controversy unfolded, the Supreme Court began to register the inadequacy of doctrines built for an analog world. In United States v. Jones (2012) [45], the Court held that attaching a GPS device to a vehicle and tracking its movements for nearly a month was a search. The majority rested on a revived trespass theory, but five justices, writing separately, embraced what has come to be called the mosaic theory. The aggregation of individually public movements over time can reveal an intimate portrait and therefore constitute a search even where no single observation would.

Two years later, Riley v. California (2014) [10] addressed the search of a cell phone seized incident to arrest. A unanimous Court held that the warrant requirement applied, reasoning that modern phones contain the privacies of life in a quantity and variety without physical analog. The decision marked a judicial recognition that digital data differs not merely in degree but in kind from the contents of a pocket or wallet.

The turn became explicit in Carpenter v. United States (2018) [6]. The government had obtained, without a warrant, months of cell-site location information revealing the defendant’s movements. The Court held that accessing such comprehensive location records is a search requiring a warrant, and—critically—declined to apply the third-party doctrine mechanically merely because the records were held by a wireless carrier. The holding was narrow, confined to its facts, but its logic was pivotal. It acknowledged that some categories of third-party records are too revealing to be stripped of protection by the fact of disclosure.

Carpenter was the first genuine crack in the doctrine that had governed since the 1970s. That crack has since widened. In Chatrie v. United States (2026) [7], the Supreme Court confronted the geofence warrant, an order that, rather than naming a suspect, compels a technology company to identify every device present within a defined area during a defined interval. Investigating a bank robbery, police had directed such a warrant to Google, requiring it to search the Location History of hundreds of millions of users and, through a staged narrowing, to disclose the identities of those near the scene. The Court held that acquiring an individual’s Location History is a Fourth Amendment search, because a person retains a reasonable expectation of privacy in the record of his movements even when that record is held by a third-party company and even when only a few hours of it are sought. Extending Carpenter, the Court observed that Location History is if anything more revealing than cell-site data—more precise, logged more frequently, and treated by the user as a personal record—and it again declined to let the third-party doctrine control, rejecting the government’s argument that a user who enables such a service has thereby surrendered the whole of his movements. Chatrie confirms that Carpenter was not confined to its facts. For a second time, the Court has refused to allow disclosure to an intermediary to extinguish constitutional protection for comprehensive location data.

The decision is nonetheless a narrow and belated one, in a pattern this article has traced repeatedly. The Court resolved only that a search had occurred, remanding whether the warrant itself satisfied the requirements of particularity and probable cause, so the defendant may still be denied relief. Its ruling arrived only after the technique had matured and, indeed, after the provider had reengineered its systems so that the data could no longer be produced in response to such a warrant at all. The law caught up with the technology just as that technology was passing out of use.

10. From Communications to Bodies: Biometric and Algorithmic Surveillance

The technologies that emerged in the second decade of the twenty-first century shifted the object of surveillance from the message to the person. Face recognition exemplifies the change. A comprehensive survey found that roughly half of American adults already appeared in law-enforcement face-recognition networks, assembled largely from driver’s-license and identification photographs and operating with minimal regulation or oversight [46]. The accuracy of these systems is not uniform. Buolamwini and Gebru demonstrated that leading commercial classifiers performed markedly worse on darker-skinned and female faces, embedding demographic bias in the technology’s foundations [47]. Their study, it should be noted, examined commercial gender-classification systems rather than the face-identification systems police deploy—a related but analytically distinct task—so it is cited here for the demographic performance disparities it documents rather than as direct evidence of identification error in the field. For identification specifically, the NIST Face Recognition Vendor Test documented comparable demographic differentials across many operational algorithms [48]. The investigative account of Clearview AI later showed how a single firm assembled a database of billions of images scraped from the open web, offering identification at a scale that earlier privacy law had not imagined [49].

Predictive policing extended the logic from identification to anticipation. Brayne’s field study of the Los Angeles Police Department showed how big-data systems expand the reach of surveillance and entrench it, intensifying the monitoring of populations already subject to heavy policing and translating historical enforcement patterns into ostensibly neutral predictions [50]. Ferguson mapped the legal and institutional stakes of these systems, arguing that data-driven policing requires new doctrinal and democratic safeguards if it is not simply to automate existing inequities [51].

Forensic DNA databases trace the same arc of expansion. Murphy documented how the national DNA database grew from a registry of convicted offenders toward the inclusion of mere arrestees, and how the technology’s aura of infallibility obscured real risks of error and abuse [52]. The advent of forensic genetic genealogy widened the net further. By comparing crime-scene DNA against the profiles in consumer-genealogy services, investigators can identify suspects through their relatives, implicating individuals who never submitted a sample and never consented to any search [53]. The body of one person becomes a window onto the genetic information of an entire family.

The commercialization of surveillance accelerated the trend. Pegasus—the spyware produced by the NSO Group and traced by researchers at the Citizen Lab to operations in dozens of countries—targets the device rather than the body, but it belongs to this account as the commercial face of surveillance convergence: A market in which tools capable of turning a personal phone into a tracking and recording device are sold to states across the spectrum of governance [54]. At a broader level, Zuboff named the political economy underlying much of this activity surveillance capitalism: an order in which human experience is claimed as raw material for behavioral data, processed into predictions, and traded in markets for future behavior [41].

These technologies share a feature that distinguishes them from the wiretap. They target the body and its traces rather than its communications. A person can encrypt a message, lower a voice, or choose not to write; the face, the gait, and the genome are not so easily withheld. That migration—from what one says to what one is—reaches its logical end in the domain of health.

11. The Body as Record: Health and Pharmaceutical Surveillance

Nowhere is the convergence of surveillance and the body more advanced, or more widely accepted, than in prescription drug monitoring. Every state now operates a prescription drug monitoring program (PDMP), a database that records the dispensing of controlled substances and can be queried by prescribers, pharmacists, and, under conditions that vary by jurisdiction, law-enforcement and regulatory authorities [55]. Interstate data-sharing arrangements have knit these once-local registries into a system that approaches national scope, so that a patient’s controlled-substance history follows them across state lines.

PDMPs illustrate the genuine public-health stakes that surveillance can serve. Empirical research has associated their implementation with reductions in opioid-related mortality [56,57], and the case for them rests on a real and serious harm that has claimed enormous numbers of lives. The evidence base has developed considerably since the earliest of these studies, however, and measured effects vary with program design and with the rules governing access [58]. A responsible account cannot treat these programs as merely sinister instruments. The balance they strike between protecting patients and monitoring them is the very thing at issue, and the public-health benefit is not to be waved away.

The distinction drawn in Section 3 locates the pharmacy record within this history. The PDMP intercepts nothing. It compels the dispensing pharmacy to report each controlled substance transaction to a state registry, and it holds those reports for later query. Analytically, the program is the Black Committee’s telegram copies rather than the wiretap: The acquisition of records that a third party already holds, obtained by subpoena or by query and without the subject’s knowledge. The records line of Fourth Amendment doctrine, running from Miller through Smith, governs material of this kind, and it is the line the courts of appeals have applied. In United States v. Gayden (2020) [59], the Eleventh Circuit rejected a physician’s argument that, after Carpenter, the government needed a warrant to search a state PDMP, holding that Carpenter did not on its face reach his prescribing records. Two years later, in United States Department of Justice v. Ricco Jonas (2022) [60], the First Circuit tested the patient’s own interest and reached the same result. Applying the third-party doctrine to prescription records obtained by DEA administrative subpoena and concluding that Carpenter had not disturbed that doctrine. The Supreme Court declined to review the decision. Read as records decisions, the two cases are orthodox. The difficulty is that the premise of the records line fits the pharmacy counter less well than it fit the telegraph office. The third-party doctrine presumes voluntary disclosure. The Black Committee’s subjects had at least chosen to send their telegrams. The PDMP entry is created by statute, is never in the patient’s hands, and exists because the state requires the pharmacy to generate it. A patient who fills a prescription has not chosen to share that fact with the state in any meaningful sense. The doctrine devised for the bank ledger and the pen register now reaches a record whose creation is compelled, and it has held there.

The contrast with the tracking line of doctrine should be stated with care. Carpenter and Chatrie v. United States (2026) [7] are decisions about the comprehensiveness of a movement record. Each declined to let disclosure to an intermediary extinguish protection for a continuous log of where a person has been, and neither purported to disturb the treatment of discrete transactional records. Ricco Jonas said as much. Chatrie therefore does not resolve Gayden, and it would misread both to treat it as though it did. What Chatrie does is sharpen the question the pharmacy record poses. If the operative principle of the tracking line is that a sufficiently comprehensive third-party record reveals the privacies of life whatever the formal act of disclosure, then the interstate PDMP is the case that tests whether the two branches can remain apart. A single dispensing entry is a discrete transaction. Aggregated over years and across state lines, the entries become a longitudinal chronicle of the body’s chemistry, as revealing in its own register as a log of movements. Whether that aggregation moves the prescription record from one branch of the doctrine to the other is a question no court has yet been asked in those terms, and it is the question the third-party doctrine now leaves open at the pharmacy counter.

Surveillance theory anticipated this convergence. Haggerty and Ericson described the surveillant assemblage, the coalescence of formerly discrete surveillance systems into a single flow that abstracts human bodies into streams of data and reassembles them as “data doubles,” decision-making proxies that can be sorted, compared, and acted upon apart from the persons they represent [44]. Gilles Deleuze earlier sketched the passage from disciplinary societies to societies of control, in which the individual gives way to the “dividual,” divisible into data points to be continuously modulated [61]. The prescription-monitoring database is an assemblage made concrete: the patient’s body rendered as a queryable record, the data double consulted at the pharmacy counter.

This matters because surveillance changes behavior. Penney documented a measurable decline in visits to sensitive Wikipedia articles following the 2013 surveillance revelations, evidence that awareness of monitoring suppresses lawful inquiry [62]. Marthews and Tucker found that internet users shifted their search behavior away from terms they feared might attract official attention [63]. Stoycheff showed that the perception of surveillance dampens the expression of minority opinions, reproducing a spiral of silence [64]. In medicine the analogue is grave: patients who fear that their controlled-substance records will be surveilled, or shared with law enforcement, may forgo legitimate treatment for pain, addiction, or mental illness. The direct evidence that surveillance itself drives patients from care is thinner than the online-behavior evidence on which the analogy draws, so the inference is offered here as plausible rather than demonstrated. It is not, however, unsupported, for a legal and qualitative literature documents the adjacent harms—forced tapering, dismissal from care, and patients driven toward illicit sources—that attend the enforcement of prescription surveillance [65]. The chilling effect, first identified in the domain of speech, migrates to the domain of care.

The frontier now extends past the prescription record to biometric and physiological data. As Ferguson observes, individuals cannot ditch heir DNA, heir cardiac rhythms, or heir neural activity [66]. The body cannot be changed like a password or left at home like a phone. Surveillance of the body is therefore categorically less escapable than surveillance of communications, and the doctrinal tools developed for the wire are correspondingly less adequate to the task of constraining it. What began as the interception of messages has become the monitoring of life itself.

12. Discussion: Continuity, Normalization, and the Comparative Frame

Read together, the episodes recounted here display the three patterns with which this article began. Function creep recurs at every turn: the pen register of Smith becomes the bulk metadata of Section 215; the DNA database expands from convicted offenders to arrestees to the relatives of suspects; the PDMP grows from a state pharmacy tool into a law-enforcement resource. Crisis-driven expansion recurs as well: the Civil War, the Cold War, the aftermath of 11 September, and the opioid epidemic each produced durable enlargements of surveillance authority. And doctrinal lag recurs persistently: Olmstead’s trespass rule, the belated correction of Katz, and the partial adjustment of Carpenter all arrived only after the technology had outrun the law. A fourth pattern is visible in what followed each of these episodes, and it runs in the opposite direction. When surveillance has been exposed as overreaching, the characteristic response in the United States has been structural and prospective rather than individual and retrospective—not redress for those who were watched but a new rule or institution meant to prevent recurrence. The Black Committee’s dragnet gave way to the judicial limits placed on it; the exposure of COINTELPRO produced the Church Committee and, in its wake, the Foreign Intelligence Surveillance Act of 1978 and its specialized court; and the disclosure of bulk telephony metadata produced the USA FREEDOM Act of 2015 and the sunset of Section 215. Each correction arrived late and each was partial, but together they distinguish the American trajectory from a simple ratchet. Exposure has repeatedly produced institutional reform even where it has not produced compensation, and that these reforms are structural rather than personal is itself a feature of the system this article describes.

What sustains the trajectory is normalization. Lyon argues that surveillance has become a culture, a taken-for-granted condition of everyday life rather than an external imposition resisted as such [67]. Foucault’s account of the panopticon supplies the mechanism: an architecture in which the mere possibility of observation induces those who may be watched to regulate themselves, so that discipline is internalized and the watchman becomes unnecessary [68]. The prescription database consulted at every pharmacy counter, the camera presumed to be recording, the search query composed with an eye to how it might appear—each is panoptic in exactly this sense.

A further pattern, latent in the technologies surveyed above, deserves to be named directly: surveillance does not bear upon the population evenly. It sorts. The claim is developed here through illustrative episodes rather than systematic measurement and is advanced with that limitation in view. In cataloguing surveillance as a mechanism of social sorting, Lyon showed that monitoring systems classify the watched into categories that allocate suspicion, risk, and opportunity, and that they do so along the contours of existing social hierarchy rather than across it [69]. The evidence assembled earlier in this article bears the claim out. Facial-recognition systems misidentify darker-skinned and female faces at rates far above the population norm [47]. Predictive-policing tools train their attention on neighborhoods already saturated with enforcement, converting a history of policing into a forecast of crime [50]. The burden of surveillance falls heaviest on the poor, on racial minorities, on immigrants, and on dissenters—on precisely the populations least equipped to resist the construction of the apparatus or to contest its application.

The asymmetry runs in the other direction as well. The intrusive monitoring routinely imposed on recipients of public assistance, Eubanks observes, takes forms that the affluent would not for a moment tolerate were the same tools turned upon them; the most punitive instruments of the data state are aimed at the poor [70]. Those with resources—legal, financial, and social—possess the means to evade surveillance and to blunt its consequences when evasion fails, so that the system’s costs settle on those least able to absorb them while those with the capacity to shape its rules secure, in practice, their own exemption. A surveillance architecture justified by universal and unobjectionable rationales—catching criminals, answering emergencies, protecting the public’s health—is in operation trained downward, watching most closely those least able to answer back.

This distributive asymmetry is not a malfunction of the system but its predicted equilibrium. This outcome is also what a public-choice account of regulation would predict: Concentrated interests with the resources to influence the rules will capture them, while diffuse and resource-poor populations bear the residual costs. For that reason, the asymmetry cannot be cured by the very mechanism that produced it—a case-by-case, interest-balancing adjudication that is itself most responsive to the parties with the most to spend. The protection the asymmetry demands is structural, that is, a constitutional rule that constrains surveillance uniformly, enforced by courts insulated from the bargaining the powerful are best positioned to win. The populations on whom surveillance bears hardest are those whose interests a structural constraint is best positioned to secure, because it does not depend on the bargaining that the asymmetry distorts. The American pattern is not unique, and comparison clarifies it. The Five Eyes alliance institutionalized the sharing of signals intelligence among the United States, the United Kingdom, Canada, Australia, and New Zealand, allowing each partner to draw upon what the others collect [71,72]. Such cross-border arrangements compound the problem of doctrinal lag, since information that domestic law constrains in one jurisdiction may be lawfully gathered by a partner in another and shared back, eroding limits that no single legislature can fully enforce.

At the opposite pole lies China’s social credit project, which aggregates financial, behavioral, and increasingly biometric data into integrated systems of reward and sanction [73,74]. It would be comfortable to attribute its operation to coercion alone, but survey research finds high levels of public approval within China, driven less by fear than by expectations of greater trust, convenience, and social order [75]. These findings, however, largely predate the program’s most recent consolidation, and the ‘system’ they measure is in fact a contested assemblage of national and municipal schemes whose institutional form would need to be specified before strong conclusions are drawn. The finding is a sobering one for any account of surveillance, because it suggests that the most durable monitoring is not the kind imposed against a population’s will but the kind a population welcomes.

Europe has charted a different course, and it is instructive. The General Data Protection Regulation imposes duties of purpose limitation and data minimization that strike directly at function creep, requiring that data collected for one purpose not be freely repurposed for another [76]. These duties govern general commercial and public-sector processing; law-enforcement and national-security processing fall under separate and more permissive European instruments—among them the Law Enforcement Directive [77]—and the comparison should not conflate the two. And in S. and Marper v. United Kingdom (2008) [78], the European Court of Human Rights held that the indefinite retention of the DNA profiles of persons who had been acquitted or never charged violated the right to respect for private life. That decision imposed a structural limit—keyed to the sensitivity of the information and the duration of its retention—of precisely the kind that American constitutional doctrine has largely declined to adopt.

13. Conclusions

The history assembled here supports a single thesis: The surveillance state did not arrive with the internet. It was built incrementally, across a century and a half, through the interaction of new technology, the politics of crisis, and a constitutional doctrine that treated disclosure to a third party as the forfeiture of privacy. The bulk-collection programs of the 21st century, the biometric databases that identify people by their faces and their genomes, and the prescription registries that track the contents of the body are continuous with the Civil War wiretap and the pen register, not departures from an older order but extensions of it.

That continuity carries a practical implication. Reform efforts pitched at a single technology—a statute for wiretaps, a rule for cell-site data, a carve-out for prescription records—are perpetually outpaced, because the underlying logics simply migrate to whatever technology comes next. What the pattern demands is structural: A warrant requirement keyed to the sensitivity and comprehensiveness of the information rather than to the device that captures it or the party that holds it. It would attach to the categories of information that lay a life open—the sustained record of movement, the data read from the body, and the aggregated trace of association and inquiry—and would treat the accumulation of records over time as its own trigger, protecting the mosaic even where no single data point would qualify. It would strip disclosure to an intermediary of its forfeiting force and cap the retention and secondary use of what is gathered, so that what the information reveals and how long it endures, not the formal question of who holds it, would govern. Such a rule reaches the government’s acquisition of information; the distinct harms traced here to privately owned and commercially integrated infrastructure—data commodification and cross-domain aggregation beyond the state’s own reach—call for complementary statutory limits of the purpose-limitation and data-minimization kind noted above, so that each remedy is matched to the problem it can address. Carpenter gestured toward such a principle, and S. and Marper embodied it, but in American law it has not yet been generalized.

The urgency is the greatest at the biological frontier. Communications can be encrypted, withheld, or conducted offline. The body and its data cannot be so easily reclaimed. A surveillance regime that reaches DNA, physiology, and the prescription record touches information that cannot be changed. Where the chilling of speech has been measured, the chilling of care has not, and Section 11 offers the second as a plausible extension of the first rather than as an established finding. If it holds, the cost of monitoring the body is paid in the treatment that medicine exists to provide. The doctrine built for the wire has not been adapted to that frontier. Adapting it, through structural limits rather than technology-specific patches, is the task that the history of surveillance now sets before law.