Safety or Privacy

On the night of 27 March 1943 a group of men in borrowed police uniforms talked their way into the Amsterdam population registry on the Plantage Kerklaan, a former concert hall across from the zoo. They overpowered the guards, moved them out of the building so they wouldn't burn, set explosives among the files, and left. The building burned. When the fire brigade arrived, firemen who knew what the night was about poured water on the records for as long as they could plausibly keep at it, to ruin what the flames had missed.

It didn't work very well. The registry held a card for every person in the city, and the attackers had hoped to destroy enough of them that forged identity papers could no longer be checked against the originals. Most of the cards survived, packed so tightly in their cabinets that the fire couldn't get between them. Within weeks the occupying authorities had the registry running again, and most of the men who carried out the attack were caught and shot that summer.

The cards in those cabinets weren't made by the occupiers. They were the pride of the Dutch civil service, built across the 1930s by an inspector of population registers named Jacob Lentz, whose office motto was registreren is dienen, "to record is to serve." A Dutch person's card followed them from municipality to municipality, from birth to death, and recorded name, address, family, occupation, and religion. It was the most complete population register in Europe, and it was built for every reason a government gives: to plan schools and housing, to run elections, to find men for military service, to keep order. Nobody who designed it was planning a deportation. The Dutch government that commissioned it fled to London in May 1940 and left the register behind, intact and up to date.

Lentz went on serving. In 1941 he designed an identity card for every adult, with a photograph, a fingerprint, and watermarked paper so hard to forge that the resistance gave up copying it and started raiding the offices that held the blanks. From 1942 the cards of Jews were stamped with a black J. About three in four Dutch Jews were murdered in the Holocaust, the highest proportion in western Europe. In France, which had stopped asking about religion in its census after 1872, about one in four were. Many things separated the two countries, geography and the kind of occupation among them, but historians of both have kept coming back to the cards.

The dial

The usual way to talk about safety and privacy is as a dial. Turn it one way and the state knows more and can protect more. Turn it the other way and people keep more of their lives to themselves at some cost in protection. Every policy argument then becomes a dispute about where to set the dial, and each turn of it toward safety looks small and reasonable on its own terms. A camera at an intersection where children were struck. A reporting rule for large cash deposits, to catch the trade in drugs. A registry of addresses so the schools know how many desks to order.

The dial hides something. It treats privacy and safety as two different goods, one personal and one collective, and asks how much of the first to give up for the second. Privacy is a kind of safety, though: safety from whoever holds the record. A file on a person protects that person from some dangers and exposes them to another, the danger of the file itself, in the hands of whoever comes to control it. So the dial doesn't trade privacy for safety. It trades safety from one party for safety from another, and the party it makes people less safe from is usually the one doing the collecting.

The holder who isn't present

The case for collection is always made by the present holder, about the present purpose. The town clerk wants to count desks. The bank regulator wants to catch traffickers. The police chief wants to find stolen cars. Each is sincere, and each is talking about a record they will hold for a few years and use for one thing.

Records outlast their purposes, and they outlast their keepers. The government that commissioned Lentz's cards was gone within days of the invasion, and the cards stayed. A record is safe only as long as every future holder of it is benign, and the people deciding whether to collect it are the only ones who can't be part of that judgment. The future holder is never present when the dial is turned. That party might be an occupying army, a new administration, a hacker, an ex-spouse with a friend in the department, or a prosecutor in another state.

There's a second asymmetry in the accounting. The safety gained from a record is visible now: a car recovered, a deposit flagged, a crime solved and reported in the newspaper. The safety lost is a possibility, spread across everyone in the file and realized only later, if ever, by whoever turns out to hold it. One side of the ledger is counted and the other is a scenario, and an institution that gets credit for what it counts will keep turning the dial in one direction. The Report Was Always Going to Win traced the same lopsided ledger in a fight over a single tree. Here it runs over whole populations.

Collection that grows by standing still

Some of the dial's turns happen without anyone touching it. The Bank Secrecy Act of 1970 required banks to report cash transactions over ten thousand dollars to the federal government. In 1970 ten thousand dollars would buy a house in much of the country, and the rule reached drug traffickers and almost no one else. The threshold has never been adjusted for inflation. Ten thousand dollars today is a used car or a few months of rent in Santa Clara County, and the same unchanged rule now files reports on ordinary people doing ordinary things, millions of them a year. Nobody voted to watch them. The watching grew by standing still while the money shrank around it.

The cameras on the corner

Automated license plate readers are the newest version, and Flock Safety has become the name people use for them. A city buys a few dozen solar-powered cameras on poles at its edges and main roads to find stolen cars and cars tied to warrants. Each camera logs every plate that passes, with the time, the place, and a description of the car, and keeps it for a set number of days in a system the company runs. Departments can open their cameras to other departments on the network with a few settings, and so many did that a single search could reach tens of thousands of cameras across the country.

On 9 May 2025 a deputy in Johnson County, Texas, ran one of those searches across roughly eighty-three thousand cameras. The reason typed into the log, obtained later by 404 Media, read "had an abortion, search for female." The sheriff and the company said it was a welfare check on a woman whose family feared for her. Court records described a death investigation opened on a report of the abortion, and a police report showed officers discussing whether she could be charged. Among the cameras that answered were those of Columbus, Ohio, which the city had bought to find stolen cars. The future holder in this case wasn't an occupier. It was a deputy several states away, using records collected under Ohio's laws for a purpose those laws didn't share.

Audit logs pried loose by reporters and records requests turned up more searches like it. Local officers in Minnesota, Michigan, New York, and elsewhere ran lookups marked "immigration" on behalf of federal agents. California has barred its police from sharing plate data with out-of-state or federal agencies since 2015, and its attorney general still had to sue the city of El Cajon for doing it. In Mountain View, the police learned in early 2026 that a nationwide search setting had been switched on in their system without the department's permission or knowledge, and that federal offices from an ATF field office in Kentucky to Air Force bases in Virginia and Ohio had searched the city's cameras. The chief turned them off, said he no longer had confidence in the vendor, and the council cancelled the contract. Santa Clara County's supervisors voted three to two to keep the cameras out of the towns the sheriff patrols. By late summer one advocacy group counted some ninety cities that had cancelled or refused the cameras, and in October 2026 the Texas comptroller barred state grants from paying for them.

The fight over Flock is the dial argument run in public, in a single year, in hundreds of council meetings. The case for the cameras was made by present holders about present purposes, a police chief and a stolen car, and it was often sincere. Plenty of cities kept their cameras, and their police point to cases solved. The case against was made almost entirely about the future holder: the deputy in another state, the federal office nobody approved, the setting nobody knew had been switched on. Some of the cities that cancelled moved to another vendor, so their plates are still read. What changed was who could search them.

The bushes in the park

The same trade has been made at a smaller scale in the public park we walk through. Not long ago its paths ran past low thickets, and its corners held benches screened by shrubs, places where a person could sit a while out of view. Then the shrubs came out, nearly all of them, under a planning doctrine called crime prevention through environmental design. Its rule of thumb is two feet and six: shrubs cut below about two feet, tree canopies raised above six, so that nothing in the park blocks the view of whoever is watching it. Every corner can now be seen from the street. Whether anyone is safer for it was never measured. The case for it rested mostly on a feeling, that a place out of sight must be a place where something bad happens.

The people who used those corners lost a little privacy. The creatures that lived in the bushes lost everything. A low shrub is where a small bird goes when a hawk passes over, where a lizard waits out a crow, where insects shelter and breed and are hunted in turn by the small birds that forage there. With the shrubs gone, the small birds, the lizards, and most of the insects are gone too, not driven off by anyone watching but left in the open with everything that hunts by sight. A lawn under raised canopies gives a hawk a clear field.

Cover is what privacy is, for a small bird as for a person. A bush doesn't keep a sparrow safe by fighting anything off. It keeps it safe by breaking the line of sight between the sparrow and whatever is looking for it. The park gave up every one of those breaks for the comfort of whoever watches it, and the lives that depended on being out of view paid for that comfort with the only thing they had.

What was never collected

The French case points at the one protection that doesn't depend on every future holder being benign. A question never asked can't be answered later by anyone. When the census stopped asking about religion in 1872, nobody in the French bureaucracy was thinking about 1940. They were thinking about the separation of church and state, a principle this collection of essays has already argued belongs in a family with others. The occupiers and Vichy officials who wanted lists of Jews had to build them from scratch, by ordering people to register, and some didn't. A list assembled under threat in a hurry is a worse list than one kept up to date for seventy years by people who believed they were serving.

The familiar reply is that a person with nothing to hide has nothing to fear. That puts the question in the present tense, about the person and the holder as they are now. Most of the Jews of Amsterdam had nothing to hide in 1938. They had an address, a family, an occupation, and a religion, the same things on every card in the cabinet, and the cards were accurate. What made them dangerous had nothing to do with their content. It was the change in who held them.

Whose safety

So the question that arrives as safety or privacy is better put as safety from whom. A camera at the intersection makes a child safer from a speeding driver and makes everyone who drives past it less safe from whoever holds the footage, now and later. Sometimes that trade is worth making. A record that is narrow, kept briefly, and destroyed on schedule exposes people to little and for a short time. A record that is broad, permanent, and shared exposes everyone in it to every future holder, and no current official can promise who those will be.

After the war Lentz was tried for collaboration and sentenced to three years. He said in his defense that he had only been doing his job, which was to keep the records accurate, and by every account he had kept them very accurate indeed.

---

A note on how this piece was written: the argument that privacy is itself a kind of safety, and that the dial between them leaves out the future holder of the record, is ours, as is the direction of the essay. The sentences were drafted with AI assistance from that direction, then edited by hand.