How AI security is building the capability to turn dissent into threat intelligence
You are not an activist.
At least you have never thought of yourself as one.
You have a job. A mortgage. Kids. A lawn that needs mowed. You complain about grocery prices more than you complain about politics.
Then somebody announces that an enormous AI data center is going to be built three miles from your house.
At first, you barely notice.
Jobs. Investment. Technology. Whatever.
Then you hear about the tax abatement.
You read that data centers can consume enormous amounts of electricity and water. Somebody at work tells you their cousin lives near one and their electric bill went up. You have no idea whether that is actually connected, but now you are paying attention.
A Facebook group appears.
Citizens for Responsible Development.
You join.
There are a few hundred members.
Most of the posts are boring.
Someone posts the planning commission agenda. Someone else uploads a map. A retired engineer writes four paragraphs about transformers. A woman is furious about groundwater. Another guy thinks the whole thing is some kind of globalist plot.
You roll your eyes at that one.
You are not against technology.
You use ChatGPT. Claude too sometimes.
You just don’t understand why your town should give a multibillion-dollar company a tax break to build something that might make your electricity more expensive.
So you attend a county meeting.
You sit in the back.
You do not carry a sign.
When your turn comes, you walk to the microphone and ask whether the commissioners have modeled the project’s effect on residential electricity rates.
That’s it.
You go home.
A month later there is a protest outside the site.
You almost don’t go.
Your wife thinks it is a waste of a Saturday.
But the organizers say they are expecting a couple hundred people, and one of the county commissioners might be there, so you decide to stop by for an hour.
You bring your phone.
Of course you bring your phone.
You drive there.
You park.
You stand around with people carrying signs about electricity prices, water use and tax incentives. Somebody hands you one.
OUR POWER. OUR WATER. OUR SAY.
Fine.
You hold it.
There is a guy twenty feet away holding a much angrier sign.
You don’t know him.
Someone takes pictures.
Someone else records video.
Your phone is in your pocket the entire time.
You leave before lunch.
Nothing happens.
At least nothing you can see.
Your phone was near a demonstration.
Your license plate passed cameras on the way there and back.
Your name appears in the Facebook group.
Your public posts show that you have become increasingly critical of the project.
Your name also appears beside hundreds of other names, some belonging to people much angrier than you are.
None of this means anything by itself.
That’s the point.
A few weeks later, the electric company announces another rate increase.
Now you’re pissed.
You open Claude.
You have used it for recipes, emails, vacation planning, fixing your dishwasher.
Tonight you type:
Give me five questions that will force these people to answer for what they’re doing.
You mean the commissioners.
You mean questions.
The computer sees words.
Maybe the prompt becomes one more signal.
Not an accusation.
Not a crime.
A signal.
The system already knows there is a protest movement surrounding the project.
It knows where demonstrations are scheduled.
It knows some members of that movement have used violent rhetoric.
A security analyst sees your name.
Your public posts are pulled.
Your associations are mapped.
Nothing individually looks particularly alarming.
But viewed together?
You attended two meetings.
You attended a protest.
Your rhetoric has become more hostile.
You associate online with people whose rhetoric is much more hostile.
You recently asked an AI system for help forcing officials to answer for what they are doing.
A file exists now.
Not because anyone proved you are dangerous.
Because someone wants to know whether you might become dangerous.
Three months later, you attend another public meeting.
When it ends, you walk toward your car.
A police officer approaches you.
“Can I talk to you for a minute?”
Sure.
“Have you made any threats toward anybody involved with this project?”
No.
Of course not.
“Are you planning anything?”
Planning what?
The officer says he is just following up on some information.
You ask whether you did something wrong.
No.
You ask whether you are under investigation.
He says he can’t discuss that.
You get in your car.
And for the first time since this whole thing started, you are scared.
Not because you did something.
Because you suddenly realize someone, somewhere, has been deciding what everything you did means.
You haven’t done anything yet.
That is the point.
⸻
That story is fictional.
The machinery isn’t.
I have found no evidence that Anthropic has placed an ordinary homeowner under surveillance because he attended a zoning meeting, joined a Facebook group or peacefully protested a data center.
I have found no documented case of an ordinary political question typed into Claude being added to Anthropic’s security files.
Those are the rungs I am extrapolating.
I am telling you that now because the distinction between what I know, what I infer and what I imagine matters.
But the officer?
The officer may have been one of the least speculative parts.
The Microphone
Darren Blanchard is a farmer in Oklahoma.
On February 17, 2026, he attended a Claremore City Council meeting concerning Project Mustang, a proposed data center. Residents had raised concerns about issues including water, electricity, noise and the project itself.
Blanchard got three minutes to speak.
He went a few seconds over.
When officials told him his time was up, he argued that applause had consumed part of it and attempted to finish his remarks. Police approached. Blanchard stopped speaking and put the microphone down. He was arrested for criminal trespass. 404 Media later obtained the body-camera footage and police records.
That is the clean case.
The others are messier.
They should be presented that way.
In April, Ismael Arvizu was removed from an Imperial County, California, meeting concerning a proposed 950,000-square-foot data center. The Los Angeles Times reported that Arvizu, 26, said he was charged with trespassing, disturbing the peace, resisting arrest and threatening a public official.
In May, Pablo Payan attempted to address the Hobart, Indiana, Plan Commission during a meeting involving an Amazon/NIPSCO data-center project. Officials asked for his name and address. Payan refused. The commission and the city’s legal department refused to let him speak, and he was later removed and arrested. FOX 32 noted that Indiana law did not specifically require a speaker to identify himself, although municipalities may adopt reasonable rules governing public comment.
Then in July, Emporia, Kansas, physics teacher Lux Claridge was arrested after clapping during a city commission meeting on a proposed data center. Commissioners had warned attendees against disruptive behavior, including clapping, snapping and rude comments. Claridge continued after a final warning and was arrested.
None of those cases proves a national campaign to arrest data-center opponents.
That is not my argument.
What they establish is more basic.
Ordinary citizens opposing data centers are already encountering police at the place where Americans are supposed to settle these disagreements: public meetings.
And that started before 2026.
On December 2, 2025, three women were handcuffed and removed from a Port Washington, Wisconsin, Common Council meeting amid fierce opposition to the proposed Vantage Data Centers Lighthouse Campus. Police said they were later ticketed for disorderly conduct.
Keep Port Washington in mind.
We are coming back to it.
Because before those arrests occurred, the city had already changed something.
It had moved its meetings.
Their Term, Not Mine
On September 9, The American Prospect published a story with an extraordinary headline:
“Anthropic Is Building a Predictive Surveillance System to Monitor Activists.”
I am going to make a narrower claim than the headline does.
The reporting establishes an expanding corporate-security operation using real-time protest intelligence, OSINT, individual threat tracking and a stated movement toward predictive and preventative threat management.
Whether all of that constitutes a single automated “predictive surveillance system” is less clear.
I don’t need the stronger claim.
Because buried inside the reporting is something more important.
“Person of interest” is not my phrase.
The Prospect reported that Anthropic told The Wall Street Journal, “We track concerning behavior over time through a person-of-interest process, allowing us to catch escalation patterns early.” The Prospect also reported that several individuals involved in incidents referred to police had already been tracked by Anthropic security.
So the title of this article is not a dystopian phrase I invented for effect.
It is corporate-security terminology.
That does not mean Anthropic’s “persons of interest” are ordinary political dissidents.
The documented cases involve people Anthropic considered genuine threats.
That distinction is enormous.
But so is the existence of the process.
Activism
Anthropic’s Global Safety, Intelligence and Security operation—GSIS—covers intelligence, investigations, executive protection, security operations and related functions.
A recent job posting described an Enterprise Intelligence Specialist role paying between $180,000 and $230,000 and called for someone to “identify, assess, track, and investigate” threats including geopolitical instability, terrorism, crime, nation-state targeting—
and activism.
Read those words again.
Terrorism describes conduct.
Crime describes conduct.
Espionage describes conduct.
Activism describes participation in political or social advocacy.
Obviously activism can intersect with threats.
So can religion.
So can employment.
So can divorce.
The significance is not that Anthropic believes every activist is a terrorist.
There is no evidence that it does.
The significance is jurisdiction.
Once activism becomes a category inside a corporate intelligence function, perfectly lawful political behavior can become relevant information to a security analyst.
That is a different thing.
Sixty Minutes
This is not theoretical.
The Prospect describes a 2025 podcast conversation involving Samdesk CEO James Neufeld and Anthropic security managers Keon Ellison and Zach Melvin.
Ellison described an Anthropic executive traveling to a major city where a protest was scheduled.
The protest time changed because of permitting issues.
According to Ellison, Samdesk detected the change and gave Anthropic roughly 60 minutes of additional warning.
Anthropic changed the executive’s route and brought the executive into a hotel through a service entrance instead.
Nothing happened.
Which was the goal.
I do not find that anecdote sinister.
If I were responsible for protecting an executive receiving credible threats, I would want that information too.
That’s what makes this interesting.
The system worked.
A planned protest was identified.
Changes among the organizers were detected.
That intelligence altered the physical movement of an executive before the protesters arrived.
Every decision in that chain is reasonable.
And that chain is exactly what predictive security looks like when it works properly.
In the same interview, Anthropic’s security program manager described the goal as transforming operations from reactive information gathering toward “proactive and predictive and preventative threat engagement and management.”
Again: not Minority Report.
No magic computer announcing who will commit a murder Tuesday at 4:17.
The much more realistic version is mundane.
Collect more signals.
See them sooner.
Look for escalation.
Intervene earlier.
The Threshold
On August 14, 2026, at about 2:30 p.m., according to a San Francisco police report obtained by The San Francisco Standard, a Claude user allegedly wrote that he had purchased an AR-15 and had Anthropic CEO Dario Amodei “in his sights.”
The following Tuesday, Anthropic contacted San Francisco police. According to the police report, the Anthropic employee told officers the person “was going to kill everyone at Anthropic” and had purchased a firearm with the intent to kill employees.
Then something interesting happened.
The officer asked to see the messages.
Anthropic refused.
The police report says the employee declined to show the officer the messages because of Anthropic’s company policy. The Anthropic employee also told police he was not immediately concerned for safety but wanted the event documented.
Anthropic reported the user to police and, at the same time, declined to hand over the underlying conversation.
Both decisions are defensible.
Reporting what the company believed might be a serious threat is defensible.
Refusing to casually surrender a user’s private conversation to police is defensible too.
The user later told The Standard he had been “just fucking around.” He was not identified because he had not been arrested or charged with a crime.
I don’t know what he intended.
Neither do you.
And if somebody tells an AI that he bought a rifle and has the CEO of the AI company in his sights, I am not going to pretend Anthropic had an easy decision.
Imagine the alternative.
Anthropic does nothing.
The man carries out an attack.
We would all ask why nobody acted.
This is the problem.
The easy examples don’t tell us where the boundary is.
The difficult ones do.
Anthropic’s published policy says it does not disclose information about customers or end users to governments except through valid legal process. It makes an exception if it believes there is an emergency that may result in imminent physical harm or death and that providing information without delay may avert the emergency. It also says it evaluates requests for legal validity and may reject ones that are overly broad or vague.
But the San Francisco case is more useful than the policy page.
It shows the boundary being exercised in real life.
Call the police.
Do not hand over the messages.
Two connection points.
Two different answers.
Keep that in mind.
The Surveillance Market Already Exists
Now go back to our fictional homeowner’s phone.
In December 2024, the Federal Trade Commission alleged that data broker Mobilewalla had collected more than 500 million unique consumer advertising identifiers paired with precise location data between January 2018 and June 2020.
According to the FTC’s complaint, Mobilewalla also used audience data to produce a June 2020 report analyzing people who protested after the death of George Floyd, including protesters’ racial backgrounds and whether they lived in the cities where they demonstrated.
The phone-near-a-protest beat in my opening isn’t science fiction.
The FTC has already alleged a commercial company did something strikingly similar at enormous scale.
The FTC’s case against X-Mode Social and Outlogic is equally revealing.
The agency announced a proposed settlement in January 2024 and finalized the order in April. Among other requirements, the final order required procedures to prevent recipients of location data from associating that data with political or social demonstrations or protests, or from using it to determine the identity or location of a specific individual.
Why write that prohibition?
Because the capability exists.
Another FTC complaint alleged that Gravy Analytics and Venntel claimed to collect, process and curate more than 17 billion location signals from roughly one billion mobile devices every day. The FTC alleged that the companies derived or sold sensitive characteristics including political activity and religious viewpoints from location data. The commission finalized a settlement order in January 2025.
And your car is not invisible either.
A Government Accountability Office review found that three selected Department of Homeland Security law-enforcement agencies had agreements allowing them to query or view third-party automated-license-plate-reader information, giving personnel access to a nationwide source of plate data. The agencies also reported using analytic software, including some based on AI, alongside other detection and monitoring technologies.
You do not need somebody sitting in a black van outside your house.
The black van has been replaced by databases.
Convergence
This may be the most important word in the entire article.
Convergence.
No one company has to possess everything.
One company has location.
Another has license plates.
Another monitors public social media.
Another tracks protests.
Another maintains corporate threat files.
Another operates the platform where people increasingly think out loud.
Security company Ontic published a 2026 guide titled From Activism to Geopolitics: Building a Converged Security Operations Model.
Its premise is explicit: activism, geopolitical conflict, insider risk and targeted violence can intersect across physical sites, digital channels, employees and public perception.
Its prescription is equally direct: centralize insider-risk signals, cyber indicators, physical threats and business context into a shared operating picture, and establish clear escalation protocols.
Connect the pieces.
Ontic describes this as good security practice.
It probably is.
Again, that’s what makes this difficult.
The dangerous architecture of the future does not have to be designed by dangerous people.
It can emerge because competent people keep solving legitimate problems.
The Critics Become a Security Category
The market is already responding to opposition surrounding AI.
In August, The American Prospect reported that private intelligence firms were marketing intelligence products concerning critics of AI companies and data centers.
RANE offered the Federal Energy Regulatory Commission an assessment of rising anti-technology sentiment and the risks that sentiment might pose.
Kroll marketed risk intelligence covering subjects including public controversy, labor tensions, executive visibility and activism.
Liferaft published an analysis based on online monitoring of anger toward AI executives, opposition to data centers and grievances about the resources those facilities consume.
That does not mean those companies are compiling secret police files on every person who dislikes AI.
It means political opposition has commercial intelligence value.
The translation happens quietly.
Opposition becomes sentiment.
Sentiment becomes risk.
Risk becomes intelligence.
Intelligence becomes security.
And security wants earlier warning.
In May, WIRED reporter Daniel Boguslaw published an investigation based primarily on more than 1,000 pages of records obtained through Freedom of Information Act requests. The documents showed federal intelligence agencies, fusion centers and domestic law enforcement circulating reports around a developing category of “anti-technology extremists” and “anti-tech violent extremism.” WIRED also reported that some of the material swept peaceful civic activity and ordinary criticism into the same broader intelligence environment as actual violent threats.
One of the examples was especially revealing.
WIRED reported that a SITE Intelligence report circulated through fusion centers flagged a video from the nonprofit More Perfect Union criticizing the effects of a Georgia data center on nearby residents. WIRED said nothing in the video advocated violence against people or property.
This is precisely where vocabulary matters.
Once a political movement produces violence at its edges, institutions have a legitimate reason to watch for the violence.
The question becomes how far from the violence the watching travels.
The Connection Points
Now we arrive at the rung I actually care about.
The unresolved question is not whether the pieces exist.
It is whether the connection points remain narrow.
There are reasons to think they might.
Law matters.
Technical barriers matter.
Institutional culture matters.
People saying no matters.
But there are also active proposals to widen some of those connections.
In August, Americans for Responsible Innovation—ARI, a nonprofit advocacy organization focused on public policy for emerging technologies—called on the president to designate artificial intelligence as a formal critical-infrastructure sector.
AI does not currently have that status.
ARI wants it to.
Its August 20 report argues that AI’s increasing role in government, national defense and existing critical infrastructure leaves the sector exposed because it lacks the public-private coordination mechanisms, information sharing, asset mapping and protection standards that accompany formal critical-infrastructure treatment.
ARI recommends designating a lead Sector Risk Management Agency, creating industry-wide coordination mechanisms, developing security standards, expanding public-private engagement and enabling intelligence agencies to share AI-sector risk assessments with industry where permitted by law.
There are entirely reasonable national-security arguments for doing this.
Sophisticated cyberattacks are real.
Foreign intelligence operations are real.
Concentrating increasingly important infrastructure inside a handful of companies creates real risk.
But look at the architecture from the opposite direction.
A private AI company has its own intelligence operation.
It monitors threats.
It monitors protests affecting executives and assets.
It tracks selected persons of interest.
It can refer cases to police.
Meanwhile, an AI-policy organization is asking the federal government to formalize the AI sector inside a framework built around stronger government-industry coordination and information sharing.
That does not prove abuse.
It proves the connection point is under active consideration.
Port Washington
Now go back to Wisconsin.
Before those three women were removed from the December 2025 council meeting, Port Washington had already changed its security posture.
Mayor Ted Neitzke later wrote that the city had moved meetings to a hotel conference center after people mobilized online and disrupted council proceedings.
Then he wrote four words worth remembering:
“We increased security.”
There was no Anthropic in that chain.
No Claude.
No Samdesk.
No predictive AI.
Just a city facing a contentious political dispute.
Real disruption and threats produce legitimate concern.
Legitimate concern produces heightened security.
Heightened security changes who comes into contact with police.
And the people put into that contact are the citizens who continue showing up at civic meetings.
Port Washington shows the mechanism without any AI company anywhere in it.
The security layer changes the relationship.
That’s the feedback loop.
Anthropic Has Drawn Lines
Here is the fact that makes this entire story more interesting.
Anthropic has already drawn lines against some of the surveillance uses its technology could enable.
In February 2026, during its dispute with the Department of War, Anthropic said it had sought two exceptions to otherwise lawful uses of Claude: mass domestic surveillance of Americans and fully autonomous weapons. The company said mass domestic surveillance would violate fundamental rights and later said “no amount of intimidation or punishment” would change its position.
Good.
I mean that without irony.
This is not evidence I need to explain away.
It is some of the most important evidence in the article.
Anthropic also says it generally requires valid legal process before disclosing user information to governments, subject to its emergency exception.
And unlike many corporate promises, we have at least one example of that restraint being exercised under pressure.
In the San Francisco case, Anthropic reported a user it believed posed a threat—and then refused an officer’s request to see the underlying messages, citing company policy.
That matters.
It means there are connection points where the company has said no.
And that gives my argument a falsification test.
If the systems cannot actually connect—because durable legal barriers prevent it, because technical segregation makes it impossible, because enforceable rules prohibit transfer, because independent institutions stand between surveillance and coercion—then the darker version of my interpretation gets weaker.
That matters too.
But voluntary restraint is not the same thing as structural restraint.
A warrant requirement is not the same thing as a company policy.
A constitutional limitation is not the same thing as an executive decision.
An institution saying we will not do this is different from an institution being unable to do it without satisfying an authority outside itself.
Which leaves us with the paradox at the center of the entire piece.
A company capable of saying no proves restraint exists.
A company that has to keep choosing to say no proves the connection point exists.
The Gaps Become Jurisdiction
This is how systems grow.
Not usually because twelve people meet in a room and decide to eliminate freedom.
There is a threat.
Someone gets responsibility for the threat.
Responsibility requires information.
Information produces monitoring.
Monitoring reveals precursors.
Precursors create demand for earlier warning.
Earlier warning requires more signals.
More signals create false positives.
False positives require context.
Context requires larger profiles.
Larger profiles require more information.
Nobody in that chain has to be evil.
Nobody even has to be wrong about the problem immediately in front of him.
The jurisdiction emerges from the gaps.
Who handles the thing nobody was previously assigned to handle?
Who owns the risk between “angry citizen” and “credible threat”?
Between “political movement” and “security problem”?
Between “concerning words” and “crime”?
Someone eventually does.
And every newly occupied gap becomes somebody’s normal job.
Look at the rails in this story.
Crisis: AI executives really have received threats, and companies have legitimate reasons to protect them. Anthropic’s police referral arose from one such alleged threat.
Moral framing: companies have an obligation to keep employees safe.
Convenience: commercial intelligence platforms make monitoring open-source activity faster and easier to operationalize. Anthropic’s own Samdesk anecdote is an example.
Funding: there is a market for intelligence concerning anti-AI and anti-data-center activity.
Compliance-in-waiting: policymakers and advocacy organizations are proposing stronger government-industry coordination around AI infrastructure.
No master plan is required.
Each rail makes the next step reasonable.
Two Kingdoms
There is an older way to describe what bothers me here.
The state possesses coercive authority.
That is not inherently illegitimate. Civil order requires somebody who can restrain wrongdoing.
But because state coercion is dangerous, we surround it—imperfectly—with offices, laws, warrants, courts, elections, probable cause, constitutional limits, public records and avenues of appeal.
A private corporation has traditionally needed fewer of those restraints because it traditionally lacked coercive authority.
Anthropic cannot arrest you.
Samdesk cannot jail you.
A data broker cannot prosecute you.
But private actors can increasingly perform the work immediately upstream of coercion.
Identify.
Monitor.
Assess.
Escalate.
Refer.
Then the state arrives.
In the language of the Two Kingdoms, restraint through coercive force belongs to the left-hand kingdom: civil authority given an office for maintaining temporal order.
The problem is not that Anthropic called police about someone it believed might shoot its employees.
That is exactly the kind of situation where calling police can be appropriate.
The question is what happens as private institutions move farther upstream—toward deciding which people warrant attention before any crime has occurred—while retaining neither the vocation nor the accountability of the state whose coercive authority they may eventually trigger.
That boundary deserves far more attention than it is getting.
Back to the Parking Lot
Return to our homeowner.
He has not threatened anyone.
He has not sabotaged a transformer.
He has not trespassed.
He has not assaulted an officer.
He went to meetings.
He joined a Facebook group.
He attended a protest.
He complained about his electric bill.
He asked an AI system an angry question.
Every fact in the file is true.
That is what makes the file frightening.
No one needs to fabricate evidence about him.
The question is interpretation.
Does attendance become association?
Does association become escalation?
Does angry language become a precursor?
Does a precursor become a risk?
Does risk justify monitoring?
Does monitoring produce a thicker file?
Does the thicker file make the original concern look more justified?
Maybe not.
Maybe every boundary holds.
Maybe Anthropic keeps saying no.
Maybe regulators build stronger privacy rules.
Maybe courts draw bright lines.
Maybe companies deliberately separate systems that would be tempting to connect.
That would weaken the argument I have made here.
I hope it happens.
But I cannot reconcile myself to the idea that our freedoms are adequately protected because the people controlling the machinery currently promise to use it responsibly.
That is the argument I made in The “Not Yet” Is Now.
We surrender liberty cumulatively.
One reasonable compromise at a time.
One emergency.
One exception.
One database.
One safety measure.
One new category.
One information-sharing agreement.
One person who clearly deserves to be watched.
Then another who probably does.
Then someone we are not sure about.
Until one day the argument is no longer about whether the machinery should exist.
It is about whether you belong inside it.
The frightening part of this story is not that Anthropic secretly built Minority Report.
It hasn’t.
The frightening part is that nearly every component of the system our fictional homeowner encountered can already be found somewhere in the real world, usually built for a defensible reason.
The outstanding question is whether the barriers between those components remain narrow, durable and outside the discretion of the institutions that benefit from connecting them.
Because our homeowner didn’t become dangerous.
He didn’t become violent.
He didn’t even become particularly unusual.
He just became easier to see.
And somewhere between dissent and danger, someone acquired the jurisdiction to decide what that meant.
You are now a person of interest.
⸻
A Note on Sources
Three of the reports I have relied on here — the Anthropic security investigation, the reporting on private intelligence firms marketing analysis of AI critics, and the federal FOIA records concerning “anti-technology extremism” — are the work of the same journalist, Daniel Boguslaw, writing for The American Prospect and WIRED. That concentration is worth stating plainly rather than leaving for a reader to discover.
Where I could, I went to the underlying documents rather than the coverage: the San Francisco police report, the FTC complaints and final orders, the GAO review, ARI’s own published report, Ontic’s own guide, and Anthropic’s own public statements and policies. The arrest cases are sourced to contemporaneous local reporting and, in Blanchard’s case, to police records and body-camera footage obtained by 404 Media.
Sources
[Insert your existing numbered source list with inline hyperlinks here — I have not reproduced it, since I don’t have your verified URLs and would rather leave a marker than approximate them.]