Don’t You Know That’ll Get You Put on a List?
State Surveillance Capabilities as we Know Them in America
This explanation is built from public evidence: declassified documents, leaks (especially the Snowden archive), congressional reports, investigative journalism, and court records. I’ll focus on techniques that are known to have been used against domestic political activists, protesters, and dissident communities in the United States—not just theoretical capabilities.
1. The legal architecture that makes it possible
Before the techniques, understand the legal loopholes that allow domestic surveillance of Americans:
· FISA Section 702 (Foreign Intelligence Surveillance Act)
Meant to target non‑US persons abroad, but it sweeps up massive amounts of American communications “incidentally.” The NSA can search those databases for US person identifiers without a warrant. If you communicate with a foreign friend, use a service whose data travels overseas, or are simply mentioned in a monitored chat, your messages can be collected and read later.
Governs intelligence activities. Under this, the NSA can collect bulk data outside the US (including internet backbone traffic) and then share it with the FBI or CIA. Data on Americans travels globally; that’s often enough to pull it in.
· National Security Letters (NSLs)
The FBI can issue these without court approval to get transactional records (phone logs, email metadata, subscriber info, financial records) from companies. They come with a gag order. The standard is mere “relevance” to an investigation, not probable cause.
· USA PATRIOT Act / USA FREEDOM Act
Bulk phone metadata collection under Section 215 was officially ended, but the government can still get call detail records from carriers with court orders, and the NSA can query the old data. The legal machinery for large‑scale collection has been reshaped, not abolished.
2. NSA: Signals intelligence and bulk collection
The NSA does not officially target Americans inside the US without a warrant, but its overseas collection inevitably captures domestic communications, and it assists other agencies with technical tools.
The NSA taps directly into the fiber‑optic backbone of the internet—undersea cables, major switches, internet exchange points. By intercepting raw data streams, they can vacuum up emails, web browsing, voice calls, and chat messages as they transit. “Upstream” search terms (selectors) are targeted at foreign numbers or email addresses, but if an American is in the “about” line of an email or their message traverses that cable, it’s stored. The XKeyscore system gave analysts the ability to search this raw traffic reservoir with little prior authorization.
Under court compulsion, major tech companies provide the NSA with direct access to user data for accounts associated with a targeted selector. Originally for foreign targets, but data of Americans communicating with those targets arrives in the same pipe. The FBI, CIA, and NSA all query PRISM. For dissidents, this means that if a single person in your chat group is a foreigner under surveillance, the whole group’s messages may be pulled.
Phone metadata and call detail records
Though the bulk domestic program was legally modified, the NSA can still acquire massive volumes of US phone metadata through shared databases with the FBI and other agencies. In addition, the agency’s overseas collection of foreign phone networks picks up US‑to‑international calls. Pattern analysis on metadata reveals your social network, sleep cycles, protests attended, and confidential sources.
Cell‑site location tracking
The NSA “incidentally” scoops up mobile phone location data from international collection, but it also feeds into FBI operations. A leaked document described the NSA’s CO‑TRAVELER tool, which uses location data to map who moves together—ideal for linking activists suspected of coordinating.
The NSA has invested heavily in breaking or bypassing encryption: BULLRUN (undermining encryption standards), exploiting weak implementation, and using supercomputing to crack keys. They’ve also pressured companies to install backdoors. The current stance is “collect it now, decrypt it later” by storing encrypted traffic until quantum or other breakthroughs. For dissidents, this means that using Signal, Tor, or VPNs doesn’t automatically make you invisible—metadata, endpoint compromise, and correlation attacks are still in play.
3. FBI: Domestic intelligence and active targeting
The FBI is the primary agency for investigations inside the US, and it often classifies dissent as “domestic terrorism” or “extremism” to apply powerful tools.
Joint Terrorism Task Forces (JTTFs) and the “domestic terrorism” label
The FBI runs JTTFs across the country that blend federal, state, and local law enforcement. Since 2020, internal documents and whistleblower reports show they have broadly labeled Black Lives Matter demonstrators, anti‑fascist groups, and environmental activists as “violent extremists.” Once a group falls under that umbrella, the FBI can use the full suite of counterterrorism techniques.
Confidential human sources (informants)
The FBI systematically recruits and inserts informants into activist organizations. They may be paid, facing legal trouble, or ideologically converted. Informants wear wires, attend strategy meetings, and provoke illegal actions (entrapment disputes are common). The FBI has been known to run multiple informants in the same group, creating a chilling effect and sowing paranoia.
Old‑school: agents in cars, cameras on poles near meeting places, pole‑mounted license plate readers. They’ll follow organizers, note who meets whom, and map networks. Physical surveillance is often combined with technical surveillance to build a target profile.
Cell‑site simulators (Stingrays / IMSI catchers)
These devices mimic cell phone towers, forcing all phones in an area to connect. They can capture IMSI numbers (unique phone identifiers), location data, and sometimes call content. The FBI uses them at protests to sweep up who is present—whether or not those people are suspected of any crime. The Department of Justice requires a warrant now for federal use, but state/local partners in JTTFs might operate under looser rules, and the devices can still be deployed to map crowds in real time.
The FBI asks Google and other companies to provide data on every device that was inside a defined geographic area during a specific time window. The company discloses account identifiers and then (with additional legal process) user information. This has been used to identify participants in protests and riots, including peaceful attendees, by retroactively turning a whole square block into a suspect pool.
National Security Letters (NSLs)
FBI agents issue NSLs to internet service providers, phone companies, banks, credit agencies, and social media platforms, demanding:
· Subscriber name, address, billing records
· Email header metadata (to/from/time, not content)
· IP logs, browsing history (depending on what the provider stores)
These become a dragnet for mapping a dissident’s entire online footprint without a judge’s approval.
The FBI has contracts with third‑party data miners that scrape public posts. Bought datasets can include “threat scoring” from companies that assign risk levels to individuals based on their online speech, group membership, and connections. Internal FBI guides show analysts are trained to monitor social media for protest organization, even if the speech is protected First Amendment activity.
Beyond informants, the FBI deploys undercover agents who pose as sympathetic supporters, journalists, or co‑conspirators. They may offer resources, encourage cross‑state travel (to trigger federal jurisdiction), or introduce weapons or tactics—raising entrapment concerns.
No‑knock raids and pre‑dawn searches
These are not surveillance per se but rather the enforcement end. Dissidents’ homes are raided based on surveillance‑derived evidence, often targeting multiple individuals simultaneously. Electronics are seized, providing a wealth of offline data even if online accounts were encrypted.
4. CIA: Limited domestic role, but technical tools leak into domestic use
The CIA is legally barred from domestic spying, but two key overlaps matter.
Technical assistance and tool transfer
The CIA’s cyberspying capabilities are world‑class. Those tools—malware implants, zero‑day exploits, remote access trojans—are shared with the FBI through the Intelligence Community. The FBI can deploy them domestically with a warrant. The CIA’s “Vault 7” leak (2017) revealed frameworks like “Hive” (multi‑platform implant) and “Weeping Angel” (Samsung smart TV microphone activation). If such tools are in the FBI’s hands, they can be used against domestic targets. There is no public policy barring the FBI from using CIA‑developed software exploits inside the US under court order.
Incidental overseas targeting
If an American dissident travels abroad, the CIA can monitor them directly. The CIA also operates “black site”‑style monitoring at US borders and airports through liaison with DHS—though this is mostly in the domain of the FBI’s Joint Terrorism Task Force. The CIA’s interest in international links of domestic protest movements (e.g., environmental activism with global networks) means your international travel and foreign contacts are likely noted.
Circumventing domestic restrictions is possible by having partner agencies (e.g., GCHQ in the UK, CSE in Canada) target Americans and share the intelligence. Leaked files confirm this happens. The NSA can request foreign agencies to collect on US persons “to minimize US collection.” The attorney general must approve, but these approvals are granted in secret.
5. How these techniques come together: A typical dissident scenario
Imagine you help organize a national climate protest. Here’s what likely happens:
· FBI opens a “Domestic Terrorism” assessment based on rhetoric about pipeline sabotage or civil disobedience.
· An NSL goes to your email provider and phone carrier, getting your address, call records, and IP logs.
· A geofence warrant goes to Google for the location of the planning meeting café.
· Confidential informants are dispatched to attend your meetings. One may be an agent provocateur.
· Stingrays are deployed during the protest, sweeping IMSIs.
· Social media monitoring flags all your public posts and associates you with others.
· UPSTREAM/PRISM might capture your private Signal messages if a foreign contact is monitored, or if the message crosses a tapped cable. Metadata like “who talks to whom when” is logged.
· If the FBI finds probable cause, a FISA warrant (for international terrorism) or a Title III warrant (domestic) can authorize wiretapping your phone, remote computer intrusion using CIA‑developed tools, and monitoring your encrypted apps via keyloggers or screenshot capture.
· The NSA shares any relevant intercepts with the FBI.
6. What we don’t publicly know
Many capabilities remain classified. Based on leaks and procurement records, additional techniques likely include:
· Predictive analytics: behavior‑based algorithms on social media and financial data to forecast “radicalization.”
· Drone and aerial surveillance over protests (FBI has acknowledged using aircraft).
· Facial recognition from street cameras and social media scrapes, run through databases like the FBI’s Next Generation Identification (NGI).
· Malware for mobile devices that activates microphones or cameras covertly, requiring only minimal interaction or a server‑side push (if the target’s device is vulnerable).
Despite all this, the state does not monitor everyone, everywhere. Resource constraints, legal pushback, and internal oversight do exist—however inconsistently. The goal of this explanation is not to induce terror but to give you an honest map of the threat landscape. Security culture for dissidents therefore must assume that any digital communication, movement in public, or association can be recorded, whether legal or not. The techniques listed here are documented and have been deployed against protesters, environmentalists, anti‑war organizers, Muslim communities, racial justice activists, and whistleblowers.
Knowledge of that architecture is the first step toward informed resistance.