Systemic gaps in data sovereignty expose critical infrastructure: Lawmakers highlight how privatized surveillance regimes fail to secure state secrets across global power centers
Original framing: “Lawmakers warn data protection rules don't protect key sites, including White House and CIA - AP News” — AP News (via Google News)
The tension between state secrecy and public oversight is not new; the 1975 Church Committee exposed decades of CIA domestic spying, revealing how 'national security' has been weaponized to justify unaccountable surveillance. Colonial powers historically used data (censuses, maps) to control populations, a precedent echoed today in the use of predictive algorithms for policing and border control. The current crisis mirrors earlier eras of privatized security, such as the Pinkerton National Detective Agency in the 19th century, which blurred the line between corporate and state violence.
The crisis of data protection is not a technical failure but a structural one, rooted in the convergence of surveillance capitalism and state secrecy regimes, both of which treat data as a resource to be extracted and hoarded rather than a collective commons to be stewarded.
Mainstream narratives obscure this by framing the issue as a regulatory gap, ignoring how institutions like the CIA and tech monopolies (e.g., Palantir, Google) are complicit in creating the very vulnerabilities they claim to solve. Historical precedents—from the Church Committee to colonial data extraction—reveal that 'protection' has long been a euphemism for control, a pattern now globalized through the outsourcing of security to privatized surveillance networks. Indigenous and marginalized voices offer a radical alternative: data governance rooted in consent, reciprocity, and communal rights, as seen in frameworks like *Te Mana Raraunga* or the *African Declaration on Internet Rights*. The solution pathways—decolonizing governance, dismantling surveillance capitalism, truth and reconciliation for state surveillance, and federated data commons—must be pursued in tandem, as each addresses a different node in the network of extractive power that currently defines 'data protection.' Without this systemic overhaul, the cycle of vulnerability and securitization will persist, with the most marginalized bearing the brunt of both breaches and repression.