The dossiers exist. The names are in the database. The movement records are in the cloud. The intercepted communications are on a server in a building someone owns. The archive is already built. The question is not whether it was collected. The question is whether it remains cheap to read.
What deletion assumes
GDPR Article 17 gives you the right to erasure. You request deletion. The holder complies. The data is gone. The model is clean, simple, and built on assumptions that hold for a spreadsheet and fail for a surveillance archive.
Deletion assumes the data is locatable. A DHS “tiger team” built dossiers on about 100 people, most of them identified through Canary Mission, Politico reported the testimony, NBC News confirmed it, is locatable. You can find it. You can request its deletion. The holder can refuse, and the refusal is the political fight. But the data is there to fight over.
Deletion assumes the data is still in a form that can be deleted. A movement-tracking system that logged license plates, locations, and timestamps for a year of protests produces a structured database. The database is deletable. The records are rows. The rows can be purged.
Deletion assumes the holder will comply. This is the assumption that breaks first. A government agency that built a deportation pipeline from a private doxxing database is not going to delete the database because a privacy law says it should. The agency will cite national security, law enforcement exceptions, ongoing investigations, data retention requirements. The deletion request becomes a legal fight that takes years and costs more than the surveillance did. The archive survives the request. The request is the theater. The archive is the reality.
What encryption does that deletion cannot
Encryption does not ask the holder to delete the archive. Encryption asks the holder to make the archive unreadable without a key. The archive still exists. It is just no longer cheap to read.
The distinction matters. The political fight over deletion is a fight over whether the archive should exist. The holder has every incentive to keep the archive: it was expensive to build, it is useful, and the people it tracks are not the people the holder answers to. The political fight over encryption is a fight over whether the archive should be accessible. The holder can keep the archive. The holder cannot keep reading it without producing the key.
This is the cost-imposition theory. You cannot force the holder to delete the data. You can force the holder to encrypt it, so that every access requires a deliberate, logged, accountable act of decryption. The cost is not the encryption. The cost is the friction. A database that can be queried in milliseconds is a database that can be abused in milliseconds. A database that requires key retrieval, decryption, and re-encryption for every access is a database that can only be abused slowly, deliberately, and with a trail.
The EFF’s position is that encryption is a human rights issue. Access Now frames it the same way. Both are correct. But the specific demand for retroactive encryption is narrower: make the archive that already exists expensive to read, because the cheapness of reading is the vulnerability, and the vulnerability is the liability.
The form of the data was a choice
The pattern named plaintext liability shifts the burden. It is not the subject’s fault for having data that was exposed. It is the holder’s fault for storing it in a form that made exposure trivial.
Canary Mission never had to be breached. It assembled dossiers of names, photos, and affiliations and published them. Asked about the deportation cases, the group told NBC News that it had no contact with either administration and pointed out that its database is public, which is the part that matters here. When a DHS team used those dossiers as a lead source, nothing had to be cracked or leaked, because the reading had already been made free. Publication is the furthest end of the pattern. The cost of access was driven to zero deliberately, because zero was the product.
Flock Safety sits at the other end, and it is the more instructive case. Its evidence policy says the movement records are encrypted at rest with AES-256, and its FAQ says the encryption is KMS-based, with access to the keys limited. That sounds like the demand already being met. It is not. The customer that owns the records, such as a police department, searches them through Flock’s platform and can share that access with other agencies. Flock says it will redirect any subpoena, court order or warrant to that customer instead of answering it, and the customer can download what it finds. Encryption at rest changes how the data sits on a disk. It leaves the cost of reading it, for everyone the customer lets in, where it was.
So the frame asks a harder question than whether the data was encrypted. It asks what one read costs, and who pays it. The holder benefits from cheap reads: fast access, easy sharing, no key management. The subject bears the cost of cheap reads: exposure, breach, deportation. The asymmetry is the pattern. The fix is not to ask the holder to apologize for the asymmetry. The fix is to make the asymmetry expensive to maintain.
Retroactive, not forward-only
Forward-only encryption protects new data. It does nothing for the archive that already exists. A surveillance system that begins encrypting tomorrow leaves a decade of earlier records exactly as readable as they were. The historical archive is the liability. The historical archive is also the asset: it is what the holder built the system to produce.
Retroactive encryption encrypts the existing store. The archive is not rebuilt. It is not purged. It is encrypted in place, so that the records that were once trivially readable now require a key the holder must deliberately produce. The archive still exists. It is just no longer free to read.
The technical details vary. Encryption at rest with key custody separated from data custody is stronger than encryption at rest with the holder keeping the keys. Trusted execution environments are stronger than software encryption. But the political demand is the same at every level: the archive that already exists must be made expensive to read. The expense is the protection.
Why the holder will resist
A holder that built its system around cheap reads will resist retroactive encryption, because taking custody of the keys away from the holder breaks the fast access the system was sold on. The resistance is the tell. A holder that will encrypt its archive but not give up the keys is a holder that planned to keep reading it.
The resistance will come dressed in operational language. “Encryption at rest degrades query performance.” “Key management introduces single points of failure.” “Law enforcement partners require real-time access.” Each of these is a statement about the holder’s convenience, not about the subject’s safety. The translation is simple: the holder wants to keep reading the archive cheaply. The subject needs the archive to be expensive to read. The political fight is over the cost.
The holder will also cite law enforcement exceptions. A surveillance database that is encrypted at rest is still accessible to law enforcement, with a warrant, with a key, with a deliberate act. The encryption does not prevent access. It prevents casual, unlogged, unaccountable access. If the holder’s argument is that encryption prevents access, the argument is that the holder needs access without accountability. That is the argument to refuse.
What this establishes
The archive is already built. The lever is not delete. They will not delete it. The lever is cost. Encrypt the archive so the subpoena returns ciphertext. Encrypt the archive so the breach returns ciphertext. Encrypt the archive so the rogue employee, the partnering government, the future administration that inherits the database returns ciphertext unless they produce the key.
The theory is not erasure. The theory is expense. The archive survives. The access does not. The cost of decryption is the protection, and the protection is the right of the subject to have their data exist in a form that is not trivially weaponizable against them.
The question is not whether the archive should exist. It exists. The question is whether it should remain cheap to read. The answer is no.
