Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World

In Data and Goliath, Bruce Schneier argues that mass surveillance by both governments and corporations has reached unprecedented scale, and that society must act to rein it in before the damage becomes irreversible.

Schneier opens with a simple illustration: placing a cell phone in one's pocket each morning means granting a carrier permission to track one's movements at all times. Researchers demonstrated in 2012 that they could use such data to predict a person's location 24 hours in advance. In 2014, the Ukrainian government texted protesters informing them they had been identified as participants in a mass disturbance. Schneier broadens the scope beyond location data to encompass all personal information generated through digital interaction, from search queries and reading habits to financial transactions, and declares this era "the golden age of surveillance" (4). His central thesis is that mass surveillance enables discrimination, controls what people see and do, lacks meaningful checks and balances, and makes society both less safe and less free.

The book's first part describes how this surveillance society emerged. Computers constantly produce data as a by-product of their operation, and the rise of Internet-connected devices, from smart thermostats to fitness trackers, has multiplied this output enormously. Much of what computers generate is metadata: contextual information such as the sender, recipient, time, and location of a message. Schneier argues metadata is far more revealing than people assume. Meanwhile, the cost of storing data has plummeted, and the National Security Agency's (NSA) Utah Data Center can hold approximately 12 exabytes. Both corporations and governments shifted from collecting the minimum data necessary to collecting everything they can.

Schneier draws heavily on documents leaked in 2013 by Edward Snowden, a former NSA contractor, which revealed the scope of the NSA's surveillance programs. A Stanford University experiment showed that phone metadata alone could identify a person's medical conditions, firearms purchases, and even an abortion. Google CEO Eric Schmidt admitted in 2010 that the company essentially knows what users are thinking. Through "hop searches," the NSA collects data not only on surveillance targets but on everyone within up to three degrees of connection, meaning 117,675 active targets in 2013 expanded to cover more than 20 million people. Correlating different data sets makes true anonymity nearly impossible; computer scientist Latanya Sweeney found that 87% of the US population could be uniquely identified by ZIP code, gender, and date of birth alone.

Surveillance has become the dominant business model of the Internet. Companies offer free services in exchange for collecting and monetizing user data through personalized advertising. Data brokers like Acxiom compile comprehensive profiles from purchasing histories, public records, and online behavior, then sell them without users' knowledge. Schneier characterizes the relationship between users and Internet companies as feudal: Users have ceded control over their data and computing environments to powerful middlemen like Google, which controls two-thirds of the US search market, and Amazon, which controls roughly 70% of the e-book market.

Government surveillance operates in parallel. The NSA, formed in 1952 to consolidate US signals intelligence (the interception and analysis of electronic communications), expanded dramatically after the September 11 attacks. Schneier argues the agency stretched its legal authorities far beyond their intended scope. The FBI conducts extensive surveillance using National Security Letters, administrative subpoenas requiring no judicial approval, and IMSI-catchers, devices that mimic cell phone towers to intercept communications. Governments worldwide conduct similar operations: Russia's SORM system is built into its Internet infrastructure, and China monitors citizens with an estimated 20 to 30 million surveillance cameras. The NSA hacked an estimated 80,000 computers worldwide, and the US and Israel jointly deployed Stuxnet, the first known military-grade cyberweapon, against Iran's nuclear facilities.

Corporate and government surveillance are deeply intertwined. Through programs like PRISM, the NSA compels Internet companies to provide user data. International intelligence partnerships such as the Five Eyes alliance enable countries to share data and circumvent domestic restrictions on surveilling their own citizens. A 2010 investigation found 1,931 private corporations working on intelligence or homeland security in the US, and 70% of the intelligence budget goes to private firms. When the encrypted email service Lavabit received a government demand for its master encryption key, its owner, Ladar Levison, shut the company down rather than compromise all users' privacy, illustrating how completely the government can commandeer a private business.

The book's second part catalogs the harms of surveillance. Government surveillance chills free speech and political dissent; a Harris Poll found nearly half of Americans changed their research, speech, or writing habits because of NSA surveillance. Schneier argues that ubiquitous surveillance prevents gradual social shifts, like changing attitudes toward homosexuality and marijuana, that historically required periods of tolerated lawbreaking. He documents abuses of power from then-FBI Director J. Edgar Hoover's anonymous letter attempting to induce Martin Luther King Jr. to die by suicide, to surveillance of prominent Muslim Americans with no connection to terrorism. Corporate surveillance enables discrimination in pricing, manipulation of consumer emotions, and control over what information users see. In a 2012 experiment, Facebook manipulated the newsfeeds of 680,000 users to test emotional contagion, and a separate study showed the company could increase voter turnout by 0.4% through selectively displaying "I Voted" icons, raising the prospect that a platform could tilt a close election.

Schneier argues mass surveillance also harms security. Data mining is the wrong tool for finding terrorists: The rarity of terrorist plots means even highly accurate systems produce overwhelming false positives. The NSA's mass collection yielded only one conviction, that of a taxi driver who sent $8,500 to a Somali group. The NSA deliberately weakens Internet security by stockpiling software vulnerabilities, inserting backdoors into commercial products, and undermining encryption standards, leaving everyone more vulnerable to other governments and criminals. These revelations also caused significant economic damage: One study estimated $22 to $35 billion in lost revenue for US cloud providers over three years as international customers fled American services.

The book's third part proposes solutions grounded in several principles: Security and privacy are aligned, not opposing, values; systems should be designed for security rather than easy surveillance; and because everyone shares the same Internet infrastructure, security decisions affect the entire world. For governments, Schneier calls for reduced secrecy, stronger oversight of intelligence agencies, legal protections for whistleblowers, a return to targeted rather than bulk surveillance, and an end to subversion of commercial products. He proposes breaking up the NSA and placing counterterrorism surveillance under civilian law enforcement with standard judicial oversight.

For corporations, Schneier advocates liability for data breaches, regulation of both data use and data collection, individual rights over personal data including the right to deletion, and the establishment of "information fiduciaries," organizations subject to special legal duties of care analogous to those binding doctors and lawyers. For individuals, he offers practical advice: Use encryption tools, the Tor browser (which routes Internet traffic to help conceal a user's identity), and privacy-focused search engines; delete cookies (small files websites place in browsers to track users) regularly; and provide false information on unnecessary web forms. He stresses that technical measures alone are insufficient without sustained political action.

Schneier closes by arguing that meaningful change requires shifts in social norms. Fear of terrorism must be recalibrated, and privacy must be recognized as a fundamental human right rather than a commodity to be traded away. He frames data as the pollution problem of the information age: Just as early industrialists ignored environmental damage in their rush to build, the information age risks ignoring the harms of unchecked data collection. He expresses long-term optimism, identifying Snowden's disclosures as the beginning of a worldwide movement to make privacy a meaningful and enforceable right.