The first part introduced us to all the different ways we provide data, willingly or otherwise. The information we give is quite extensive and already compromising in nature, but each surveillance technique is still a single puzzle piece. The puzzle piece is very informative on its own but fitting it with other pieces creates the final picture can tell more about a person than what even the person knows about themself.
Data Agglomeration
Surveillance sources store data. The first task would be to ingest the large amount of data produced by these sources and narrow down the useful parts. Ingestion of these datasets could happen through application programming interfaces (APIs) , database connections, exported files, event streams, logs, or other authorized data-sharing mechanisms. Every source generates data in a different format and one source could show the same thing in a completely different way. For example:
CCTV: 23/08/2026 10:32:15Wi-Fi: 2026-08-23T10:32:15+05:30GPS: 1692766935
All of these sources show the exact same thing but they are structured very differently. These need to be converted into a common timestamp representation.
Moving onto creating a combined dataset which is a structure capable of representing information from all these different systems. For instance look at the mock dataset given below.
In the data given we have three people that we are interested in: P123, P343, and P789. The devices, cards, and vehicles captured by monitoring systems have a relationship with these people, so we will need proper identification.
Next step is entity resolution, where the aggregation system attempts to establish relationships between different data points. For example, if a particular device and access card repeatedly appear together at the same locations and times, the system may associate them. We can run a simple program to figure out the confidence levels for allocating a person with a device or gadget. The information is stored in a system that can maintain relationships between entities. Keeping track of where each point of information came from helps in inference. The latest villain of technology, artificial intelligence, can help in identifying relationships.
The excel file containing the relationships can be viewed below:
This excel sheet is very difficult to look at and decipher manually, so we can make a network graph using the Networkx module in python.
We can see that some devices are attributed to multiple people with varying confidence levels. This can happen with proximity so we can just filter out the data points we do not actually need and only include the best matches in a separate graph.
At a glance one can tell which device belongs to which person, it seems like P123 has two vehicles or that person was inside two different vehicles. This presents an interesting conundrum since we cannot determine whether the person owns both, or whether it is shared/rented. Maybe the person used CARD-81 to rent or pay for the vehicle? More data will be required to figure out the exact nature of the relationship.
Tracing a timeline
Our data is now established and relationships are made clear. The relationships do not give us a coherent series of events if one wants to map out a person’s daily schedule. The graph that was created will help us immensely in our task ahead. Using the relationships, filtering out datapoints with low confidence and using only the timestamps we need is much easier.
← Scroll horizontally to explore the timeline →
P123 has the most dense timeline of all; we can start labelling devices and people they meet with a few days’ more data.
← Scroll horizontally to explore the timeline →
← Scroll horizontally to explore the timeline →
Profiling
Creating a one page profile of a person from the multitudes of data we gathered is surprisingly simple. If there were data points from multiple days we would easily map out the person’s daily routine, close associates, devices, and a variety of other information accurately. The device, card, and account we identified have markers in them which can be used to figure out the model of the phone or the details of the bank account.
Why would anyone do this?
It is a lot of work to gather this much data about a person from multiple sources. No one would go to such lengths to compile such a comprehensive dataset on someone unless they were either very famous or very infamous. A drug kingpin, a criminal mastermind, or a political opponent may get such high surveillance put on them but not on someone like you or me.
So why even go through all this trouble to write and present all this data to you dear reader? Let me demonstrate the power of one datapoint. Let us say I have developed an app that requires me to connect to other bluetooth devices and I put in a clause about reading your bluetooth connection history and a clause pertaining to sharing this data with third parties. You, being the naive customer, agree to the sharing. I can now sell your connection history data to data brokers who will sell it further to marketing firms who will use it for targeted advertisements.
Yes, dear reader, all this hassle just to give you ads. Say you connected a Bose headset to your iPhone, that data can be used to give you ads on other headsets. All of this song and dance was for companies to reach into your pocket. Don’t you get that uncanny feeling when you talk about a product and you suddenly start getting ads regarding that product? You know the answer now.
A highly motivated person may go through the trouble and hassle of building a profile of an individual, if that individual is blackmail worthy. For ordinary people like you or me, it is simply overkill, unless we live in a police state. Monitoring journalists and opposition members are all crimes that can be committed through the use of surveillance. For a more personal flavour, we have identity fraud, account takeover, financial fraud, tax fraud, insurance fraud, property fraud, doxxing, blackmail, and so much more. The use and abuse of surveillance techniques are limitless.
Can I avoid constant monitoring?
How do we avoid this complete deconstruction of our life, you might ask. It is quite simple, just renounce modern society and go into the woods. Villages, and rural areas are getting a facelift with cell towers on a global scale. A person cannot function in regular society without a mobile phone in his/her pocket, even your washing machine needs an account now. Every smart device, or any device connected to the internet, can be used as a monitoring gadget against you.
The best part about all this is that we post so much of ourselves on social media or a professional networking site like LinkedIn that one does not need to go through the difficulty of gaining access to your data when it gets displayed so brazenly. Go and check OSINT for more detail on this.
Where does that leave us?
Some groups and bodies have been created to counter and monitor surveillance usage. The Electronic Frontier Foundation (EFF) is the most important organization in this initiative. They created the Atlas of Surveillance, a database that can be used to read about the technologies used by domestic law enforcement agencies in the U.S.A. If you ever feel that this technology cannot be used against you, the police are here to prove you wrong. I hope no police officer has a grudge against you.
Privacy International is another big organization working towards the same goal of reducing the penetration of surveillance in our society. They uncovered quite a staggering discovery about menstruation apps like Period Tracker by Leap Fitness Group and the like. These apps take your data about your health, sexual life, mood and more to provide you with the best fertility period and predicting period cycles. Free apps always make money from some source; these apps made money by selling your highly confidential data to FaceBook, They tested 36 apps, out of which 61% sent data automatically. Feel exposed yet?
Taking precaution and safeguarding your digital life is as important as protecting your real life in this era. Keep resetting your device identifier and always limit ad personalization and cookie usage. Monitoring and surveillance techniques will only get better and better, so must your knowledge against these threats.
First part: Surveillance: Making a person out of bits and pieces (Part 1)
Frequently Asked Questions (FAQ)
Ques: What is an application programming interface (API)?
An API is a set of rules that allows different software applications or systems to communicate with each other. It lets one application request data or services from another without needing to know how the other system works internally. For example, a mapping application can use a map provider’s API to obtain location and route information.
Ques: What is entity resolution?
Entity resolution is the process of determining when different records or pieces of data refer to the same real-world entity. For example, records containing “Rahul Kumar,” “R. Kumar,” and the same phone number or email address may be linked to one person. In surveillance analysis, entity resolution can combine information from different sources to identify devices, accounts, vehicles, or people that are likely connected.
Ques: What is the difference between monitoring and surveillance?
Monitoring generally means observing or checking something over time, often for a specific purpose such as security, performance, or safety. Surveillance is more systematic and is usually concerned with collecting information about people, activities, or locations, often to identify patterns or track behaviour. The distinction can depend on context, but surveillance generally implies broader or more persistent information collection.
Ques: What is an identity graph?
An identity graph is a network of data points and relationships used to connect different identifiers to the same person or entity. It can link information such as names, email addresses, phone numbers, devices, accounts, IP addresses, locations, and browsing activity. By connecting these identifiers, an identity graph can provide a more complete picture of an individual’s activities across different systems.
Ques: What are targeted advertisements?
Targeted advertisements are advertisements selected for a particular person or audience based on information about their interests, behaviour, demographics, location, or online activity. Advertising systems may use data such as browsing history, searches, app activity, or inferred interests to decide which advertisement to show. The goal is to make advertisements more relevant to the individual and increase the likelihood that they will interact with them.
Ques: What is OSINT?
Open-Source Intelligence (OSINT) is the process of collecting, analyzing, and connecting information that is publicly available from sources such as websites, social media, news articles, public records, maps, forums, and government databases. Although individual pieces of information may appear harmless, combining them can reveal detailed information about a person, organization, location, relationships, or activities.
Leave a Reply