The Nation-State

TL;DR: A nation-state sits at the top of the ladder for two reasons a corporation cannot match. It can legally compel companies to hand over your data, and it can buy the same commercial tools and data those companies sell, then add classified capabilities like zero-click spyware and signals-intelligence infrastructure. Most people are never individually targeted, but metadata is retained and commercially bought data can place you. If you are a journalist, activist, immigrant, protester, or dissident, model for a higher and more direct risk.

The other adversary tiers describe people and companies. This one describes the entity that can pass laws about the other three. A lone individual works with free public tools. An organized group pools money and buys databases. A corporation aggregates data at industrial scale and sells that capability to everyone else. A nation-state can do all of that, and then it can compel the corporation to produce what it holds and buy the corporation to acquire what it sells. It also holds a category of power that money alone cannot buy: legal compulsion, classified exploit development, and signals-intelligence infrastructure wired into the internet backbone itself.

The honest framing matters. Almost no reader of this page is individually targeted by a state, and treating yourself as if you were is its own kind of distortion. The point is to understand the ceiling of the ladder so you can locate yourself accurately below it, then apply defenses that are proportionate to your actual situation.

What a nation-state can do

State surveillance is not one capability but a stack of them, each operating at a scale and a level of legal cover that private actors cannot reach. The four below are representative, not exhaustive.

OSINT and social-media monitoring at contract scale

Open-source monitoring is not unique to governments, but the budgets are. Reporting on an FBI procurement filing indicates the bureau acquired roughly 5,000 licenses for Babel Street\'s Babel X social-media monitoring tool in a contract that could be worth up to $27 million, tasked with gathering data across platforms including Twitter, Facebook, Instagram, YouTube, LinkedIn, VK, Telegram, and the dark web. ^[1] (The original report is paywalled; the figures are corroborated through consistent secondary quotation of the same procurement filing.) Immigration enforcement runs similar programs: contracts obtained through FOIA litigation show ICE\'s Homeland Security Investigations division purchased licenses for ShadowDragon\'s SocialNet and OIMonitor tools, including a June 2021 purchase of OIMonitor access for approximately $171,250. ^[2]

The more consequential capability is inference. Documents from the Los Angeles Police Department show the vendor Voyager Labs marketed the ability to map a person\'s social network and infer the strength of their ideological beliefs, identifying people described as most invested in a stance emotionally, ideologically, and personally. The LAPD trialed the tool for four months in 2019. ^[3] This is the difference between reading what you posted and predicting what you believe.

Zero-click spyware

The signature nation-state capability is a phone compromise that requires no mistake by the target. In 2021 the Citizen Lab captured FORCEDENTRY, a zero-day, zero-click exploit against Apple\'s iMessage used to deliver NSO Group\'s Pegasus spyware onto the phone of a Saudi activist, meaning no click, download, or interaction was needed for infection. ^[4] Amnesty International\'s Security Lab found that Pegasus has used zero-click attacks since at least May 2018 and continued to do so through 2021, including against a fully patched iPhone 12, as part of what it documented as widespread, persistent, and ongoing unlawful surveillance of human rights defenders and journalists. ^[5] A fully updated device does not, by itself, guarantee safety against this class of attack.

Facial recognition across agencies

Facial recognition reaches state scale when a private tool is wired into many agencies at once. A leaked client list showed Clearview AI had been used by people associated with 2,228 law enforcement agencies, companies, and institutions, who collectively ran nearly 500,000 searches. ^[6] A U.S. Government Accountability Office audit later confirmed that five federal agencies, including U.S. Customs and Border Protection, reported using Clearview AI during a survey period covering April 2018 through March 2020, with the U.S. Capitol Police using it to generate investigative leads after the January 6, 2021 attack. ^[7] A photograph posted years ago can become a match today.

Signals-intelligence infrastructure

The capability with no corporate equivalent is collection built into the network itself. Documents leaked in 2013 revealed the NSA\'s PRISM program, which gave the NSA and FBI access to emails, stored data, and other communications from nine major U.S. internet companies under a broad FISA authorization rather than an individual warrant for each target. ^[8] Earlier, an AT&T technician\'s sworn declaration in a civil-liberties lawsuit described a secret room, known as Room 641A, in a San Francisco facility where a fiber-optic splitter copied internet backbone traffic into a Narus semantic traffic analyzer capable of deep packet inspection at backbone speed. ^[9] This is surveillance at the level of the plumbing, invisible to the user and independent of any single company\'s cooperation.

What resources add over a corporation

This is the center of the tier. A corporation can be enormous, but it operates inside the law and inside a market. A nation-state operates on the law and above the market. Four powers separate the two.

Legal compulsion. A company can refuse a private buyer. It cannot refuse a lawful order. FISA Section 702 statutorily authorizes the government to compel U.S. electronic communications providers to hand over the communications of targeted non-U.S. persons abroad, without an individual warrant. ^[10] The scale is not marginal: during calendar year 2022 alone, approximately 246,073 non-U.S. persons abroad were targeted under the program, a figure that has grown sharply over a decade. ^[10] Compulsion also operates physically at the border. Under CBP policy, officers may conduct a basic manual search of any traveler\'s device with no suspicion required, and a more intrusive advanced forensic search, connecting external equipment to copy and analyze the contents, with only reasonable suspicion, a far lower bar than the warrant normally required inside the country. CBP\'s own statistics record approximately 41,567 device searches in fiscal year 2023 (an approximate figure, as agency totals for the year vary slightly between sources). ^[11]

Buying corporate data to bypass the Fourth Amendment. Where compulsion is the stick, purchase is the shortcut. A declassified assessment by the Office of the Director of National Intelligence conceded that persistent location data, which under Carpenter v. United States would generally require probable cause to obtain directly from a provider, is openly for sale to the general public from data brokers. ^[12] The same report warned that this commercially available information, absent proper controls, can be misused to cause substantial harm to U.S. persons. ^[12] The significance is precise: the government can buy from a broker what it would need a court order to demand from a carrier. The corporate tier is not just something the state can compel. It is a marketplace the state can shop.

Unlimited budget for classified capability. The zero-click exploits described above are not off-the-shelf products; they are the output of budgets and vendor relationships that private actors rarely sustain. ^[4][5] The same budget buys bespoke systems through sole-source contracts: in April 2025 ICE awarded Palantir a $30 million sole-source contract to build a system, ImmigrationOS, giving the agency near real-time visibility into deportations and visa overstays, justified on the basis that Palantir was the only source able to deliver it in time. ^[13]

Signals-intelligence infrastructure. No company holds a splitter on the internet backbone or a program like PRISM. ^[8][9] This is the one capability that cannot be bought at any price by a lower tier, because it is a function of sovereign authority over the network itself.

Put together, the picture is unambiguous. The nation-state does not sit at the top of the ladder because it invents a wholly separate kind of surveillance. It sits there because it can buy the corporate tier\'s tools, compel the corporate tier\'s data, and add legal powers and network-level collection that no one below it can obtain.

Model your own risk

Accurate threat modeling means resisting two errors at once: assuming a state is watching you when it is not, and assuming it never could when your circumstances change. For most people, the direct probability of individual state targeting is low, and the more realistic exposure is structural. Metadata about your communications is retained by providers and can be compelled or acquired, and the commercially bought data described above can place you at a time and location without anyone ever obtaining a warrant.

The calculus shifts if you are a journalist protecting a source, an activist or protester, an immigrant navigating enforcement, or a dissident from an authoritarian state operating abroad. For those readers, the working assumption should be that metadata is retained, that commercially available data can corroborate your movements, and that facial-recognition and social-monitoring systems may already hold records tied to you. A useful first step is to find out which systems actually contain you rather than guessing. Our guide to checking surveillance databases walks through how to look yourself up in facial-recognition, watchlist, and broker systems and what you can do about what you find.

How these techniques work

Each capability on this page is covered in depth elsewhere on the site. Rather than repeat the mechanics here, use these as entry points calibrated to what you want to understand.

• The OSINT and monitoring vendors: our explainer on how police use OSINT maps the specific tools and contractors behind law-enforcement social-media monitoring.
• Zero-click phone spyware: the Pegasus spyware deep dive explains how zero-click infection works and who has been targeted.
• The spyware supply chain: Israel\'s surveillance-technology complex traces where much commercial state-grade spyware originates.
• Network-level tracing: how governments trace Tor shows the limits of anonymity tools against an adversary that can observe large parts of the network.

Defend against state surveillance

No realistic defense makes an ordinary person invulnerable to a determined, well-funded state. That is not the goal. The goal is to raise the cost of routine collection, close off the cheap paths, and shrink the data that can be bought or compelled about you. These measures are proportionate for the higher-risk reader and sensible hygiene for everyone.

• Device hygiene and updates. Patch promptly, restart devices regularly, and enable the strongest lockdown settings your phone offers. Patching will not stop every classified exploit, but it removes the cheaper ones and raises the cost of the rest.
• Encrypted messaging. End-to-end encryption protects message content even when providers can be compelled to produce records. It does not hide metadata, so treat who and when as still exposed.
• Minimize what brokers hold. The same data brokers that states buy from are the ones you can opt out of. Reducing your broker footprint directly reduces what commercially bought data can reveal.
• A border-crossing plan. Carry minimal data on a clean or travel device, power devices off before you reach the checkpoint, and understand the basic-versus-advanced search distinction before you travel.
• OPSEC for high-risk work. Compartmentalize identities, separate devices by purpose, and plan communications around the assumption that metadata persists.

Two guides go deeper. Our OSINT guide for journalists and activists covers source protection and operational security for people who are plausibly targeted, and the surveillance-resistant digital life guide builds a sustainable, layered routine for everyone else.

Frequently Asked Questions

Is an ordinary person likely to be targeted by a nation-state?

Most people are not individually targeted by a state. Classified tools such as zero-click spyware are expensive and reserved for specific targets. The realistic exposure for most readers is indirect: retained metadata and commercially bought data that can place them. Journalists, activists, immigrants, protesters, and dissidents face a higher and more direct risk, and should model for it.

What can a nation-state do that a corporation cannot?

Two things stand out. It can legally compel a company to hand over data, for example under FISA Section 702, and it can buy the same commercial data and tools that corporations sell, then add classified capabilities such as zero-click spyware and signals-intelligence infrastructure. It sits at the top of the ladder because it can purchase the entire corporate tier and add legal powers no company has.

Can the government buy my location data instead of getting a warrant?

A declassified U.S. intelligence assessment acknowledged that location data which would generally require probable cause to obtain directly from a provider is openly for sale from data brokers. Buying it can sidestep the warrant process. Reducing what brokers hold on you is one of the few levers you actually control here.

What powers do border officers have over my devices?

Under U.S. Customs and Border Protection policy, officers may conduct a basic manual search of a device with no suspicion at all, and an advanced forensic search that copies device contents with only reasonable suspicion, a lower bar than the warrant normally required inside the country. A realistic plan is to cross with minimal data on a clean or travel device, power devices off beforehand, and know your rights in advance.

Do strong security practices help against a state?

They raise the cost. Keeping devices patched, using encrypted messaging, and shrinking your data-broker footprint will not make you invulnerable to a well-funded state, but they push routine collection and cheaper exploits out of reach and reduce what commercially bought data can reveal about you.

Sources

1. The Washington Post. "The FBI is spending millions on social media tracking software." April 5, 2022. washingtonpost.com
2. Brennan Center for Justice. "Third-Party Vendors of Social Media Monitoring Tools for Law Enforcement Agencies." brennancenter.org
3. Brennan Center for Justice. "LAPD Documents Show What One Social Media Surveillance Firm Promises Police." brennancenter.org
4. The Citizen Lab, University of Toronto. "FORCEDENTRY: NSO Group iMessage Zero-Click Exploit Captured in the Wild." September 13, 2021. citizenlab.ca
5. Amnesty International Security Lab. "Forensic Methodology Report: How to Catch NSO Group\'s Pegasus." July 18, 2021. amnesty.org
6. BuzzFeed News. "Clearview AI Has Been Used By The Justice Department, ICE, Macy\'s, Walmart, And The NBA." February 27, 2020. buzzfeednews.com
7. U.S. Government Accountability Office. "Facial Recognition Technology: Federal Law Enforcement Agencies Should Have Better Awareness of Systems Used By Employees." GAO-21-105309. July 13, 2021. gao.gov
8. The Washington Post. "NSA slides explain the PRISM data-collection program." June 6, 2013. washingtonpost.com
9. Electronic Frontier Foundation. "Public Unredacted Klein Declaration, Hepting v. AT&T." Filed May 25, 2006. eff.org
10. Privacy and Civil Liberties Oversight Board. "Report on the Surveillance Program Operated Pursuant to Section 702 of the Foreign Intelligence Surveillance Act." 2023. pclob.gov
11. U.S. Customs and Border Protection. "CBP Directive No. 3340-049B: Border Search of Electronic Devices." Effective January 4, 2018. cbp.gov
12. Office of the Director of National Intelligence. "Declassified Report on Commercially Available Information." January 2022, released June 2023. dni.gov
13. Axios. "ICE pays Palantir $30M to build new tool to track and deport immigrants." May 1, 2025. axios.com