Fundamentals

Mass Surveillance: What It Is, How It Works, and Why It Needs Limits

By Daniel Sardá · Published on October 22, 2026

7 min read1,362 words

Mass surveillance observes or analyzes data from broad populations without prior individualized suspicion. Understanding its scope helps assess its risks, justifications, and safeguards.

Sending a message, moving about with a phone, or accessing a digital service leaves data behind. When a public authority systematically collects, retains, or analyzes information about a broad population without starting from individualized suspicion, this is, in operational terms, mass surveillance.

The word “mass” describes more than volume. What matters above all is how people are selected: a large universe of communications or records is first brought into the system, and patterns, connections, or signals are then sought within it. This definition helps structure the debate, although it is not a single, settled legal category.

Nor is the issue resolved by saying that all surveillance is impermissible. Crime prevention and national security can be legitimate aims. The question is whether those aims justify observing people who have not been individually linked to a threat, and under what rules that power may be exercised.

Key idea: What makes surveillance mass surveillance is not only the quantity of data, but the absence of an individually grounded selection before data are collected or analyzed.

Not all surveillance is the same

A targeted investigation begins with a defined object—a person, account, or device—and a specific justification. For example, an authority may seek access to a particular account on the basis of evidence and for a defined period. Mass surveillance reverses that order: it retains data from a broad network and then applies search criteria to identify possible targets.

It is also useful to distinguish surveillance from interception. Intercepting a communication is a technique for obtaining it while it is being transmitted. Surveillance is a broader process: it can include collecting, retaining, combining, querying, and analyzing data, as well as inferring relationships or conduct. Surveillance can concern stored information without anyone listening to a conversation in real time.

Another important distinction is between content and metadata. Content reveals what was said or written. Metadata can reveal who communicated with whom, when, from where, for how long, or how often. According to the Office of the United Nations High Commissioner for Human Rights, aggregating metadata can expose conduct, relationships, preferences, and identity. Calling them “just metadata” therefore understates what they can reveal when combined.

Finally, state collection should not simply be equated with commercial profiling. Companies process data for different purposes and within a different relationship with the user. That phenomenon, sometimes discussed as surveillance capitalism, raises problems of its own. It can intersect with public surveillance when an authority requests, purchases, or receives private data, but state authority adds a coercive dimension that calls for distinct analysis.

How it works: a chain, not a single act

The image of an official reading messages is too narrow. A surveillance system may operate through several stages: data capture, filtering, querying, automated analysis, retention, sharing with other bodies, and use in a decision. At every stage, both the purpose and the people who can access the information may change.

This matters because the risk does not arise only when someone examines content. Collection and storage already enable later searches, cross-database matching, and inferences about networks of contacts. Likewise, a rule that restricts collection but leaves retention periods or sharing conditions undefined does not control the whole process.

Technological scale makes it possible to apply selectors to vast sets of data. But technical capacity does not by itself answer the institutional questions: what information may be obtained, about whom, for how long, for what purpose, and with what opportunity for review.

Security, legality, and proportionality

Article 17 of the International Covenant on Civil and Political Rights protects against unlawful or arbitrary interference with privacy and correspondence. The distinction matters: a measure’s being provided for by law does not prevent it from being arbitrary if its limits are vague or the interference disproportionate.

The Human Rights Committee’s General Comment No. 16 stresses that authorized interference must comply with precise circumstances. In practice, a serious assessment raises at least four questions:

• Legality: Is the rule public, accessible, and sufficiently precise to constrain official action? General laws are one way to limit arbitrary power.
• Purpose: Does the measure pursue a legitimate, defined objective rather than enable indeterminate future uses?
• Necessity: Is there a demonstrated connection between the chosen means and that objective, and have less intrusive alternatives been considered?
• Proportionality: Are the scope, duration, and use of the data related to the specific harm the measure seeks to prevent?

This test does not allow one to declare, in the abstract, that every broad system is lawful or unlawful. In Big Brother Watch and Others v. the United Kingdom, the European Court of Human Rights held that bulk interception does not in itself violate the Convention. At the same time, it required end-to-end safeguards, including initial independent authorization and controls of necessity and proportionality at different stages. This is a standard within a specific regional framework, not a general license for any program.

Key idea: A legitimate aim explains why an authority wants to act; it does not show that any scale, technique, or duration is necessary.

Beyond privacy: how the space for freedom changes

Privacy protects a sphere in which people can think, associate, and make decisions without constant observation. It is not the same as concealing unlawful conduct. It is a condition for testing ideas, seeking information, consulting a professional, joining an organization, or dissenting.

For that reason, indiscriminate surveillance can also affect expression and association. A report by the UN High Commissioner for Human Rights warns that it can have a chilling effect and encourage self-censorship. This does not mean that every person will necessarily change their conduct, but the possibility of being observed changes the setting in which people exercise their freedoms. Self-censorship can begin before any formal sanction.

From a liberal perspective, the central concern is institutional: a power capable of reconstructing the habits and connections of entire populations creates opportunities for uses beyond its original purpose. The risk does not require assuming bad faith on the part of every official. It is enough to recognize that vague powers, concentrated information, and a lack of review expand state discretion.

What safeguards a surveillance system needs

Operational secrecy may be necessary to avoid compromising an investigation. Yet operational secrecy does not mean the absence of public rules or accountability. A framework compatible with the rule of law needs safeguards before, during, and after the intervention:

• a precise law that defines purpose, scope, and the competent authorities;
• prior authorization by an independent body, with enough information to assess necessity and proportionality;
• rules governing selectors, queries, retention, sharing, access, and deletion;
• records and audits that make it possible to reconstruct who used the data and on what grounds;
• independent oversight with real capacity to inspect and correct;
• aggregate transparency that does not disclose specific operations but makes the system assessable;
• effective avenues for challenge and redress when rights are violated.

Judicial authorization is an important safeguard, but it does not replace this entire chain. An initial approval loses force if no one later controls searches, retention, or the transfer of information. Similarly, an oversight commission will be inadequate if it lacks independence, access, or the authority to require changes.

Key idea: Effective oversight follows data throughout their lifecycle: from collection to deletion, including every query, analysis, and exchange.

The decisive test is verifiable limits

The debate over mass surveillance is often presented as a choice between security and privacy. That opposition is incomplete. Security is a legitimate function of the state, while rights and safeguards determine how it may fulfill that function without turning the entire population into a permanent object of observation.

The right question is not whether an authority deserves unlimited trust or should lack all tools. It is whether its powers have a defined purpose, a necessary scope, a proportionate duration, and independent safeguards capable of detecting and remedying departures from those limits. When those limits can be verified, security is subject to law. When they do not exist, or depend only on the authority doing the watching, an exception risks becoming an ordinary capacity of power.