Counter-Surveillance as an Arms Race: Why the Durable Lever Is Legal, Not Technical

Every technical counter-surveillance measure shares a structural weakness, and recognising it changes what you conclude about the whole category. ## The asymmetry An adversarial pattern, a cloaking perturbation, a makeup technique — each is tuned against the systems that exist when it is made. When the system operator retrains on examples of the attack, the attack degrades or dies. The economics are lopsided in a specific way. **The defender must act continuously and the attacker must solve it once.** You buy new clothing, re-cloak your photo library, and keep up with model releases; the operator ships a model update. CV Dazzle worked against the detectors of 2010 and does not work now. Photo cloaking protects images not yet scraped and is undone by retraining. Adversarial patches are brittle across models, angles and distances. Sensor-level attacks resist this — infrared physics does not get retrained — but they are narrow, each defeating one capture mode. See IR-Blocking Eyewear and Retroreflective Clothing: Attacking the Sensor Instead of the Model. ## Three compounding problems **Face is one modality.** Modern identification also uses gait, body shape and proportion, voice, clothing and accessory recognition, and device signals such as Bluetooth and MAC addresses. Defeating facial recognition specifically leaves the rest untouched. Anonymity requires defeating all of them at once; the systems only need one to work. **The conspicuousness paradox.** Adversarial fashion is invisible to the classifier and conspicuous to humans. The classifier is not the last observer in the pipeline — a flagged clip gets reviewed by a person, and unusual clothing draws that review rather than avoiding it. In some settings, visible countermeasures are themselves grounds for attention. **The narrowness trap.** Each tool covers one camera type, in one condition, against one class of model. Real coverage requires stacking many partial measures, each with its own failure mode, and the combination is conspicuous, expensive and still incomplete. ## Why the durable lever is legal The regulatory route inverts every one of these asymmetries. A ban on facial recognition, or a biometric-consent requirement of the kind in Illinois' BIPA, does not degrade when a model is retrained — a better model is *more* illegal to deploy, not less. It does not require the protected person to do anything, buy anything, or notice anything, which matters enormously since the people most exposed to surveillance are least able to fund countermeasures. It covers all modalities at once, because it regulates the *use* rather than one sensing channel. And it reaches the part of the system where the harm actually concentrates: the identification backend and the biometric databases, not the camera. The technical measures are worth having as friction, and as demonstrations that raise the political salience of the problem. They are not a solution, and treating them as one substitutes an individual consumer purchase for a collective decision — which is precisely the substitution that leaves the underlying system untouched. The same conclusion arrives from the other direction in Two Axes of the Camera-Glasses Debate: Your Data Versus the Bystander's Consent: the effective interventions target the identification layer, not the device.