UEBA: The Tech-Oligarch Pre-Crime Machine and the Systematic Punishment...
...of Non-Compliant Americans. User and Entity Behavior Analytics. "Our Democracy."
The "keyword" dragnet was always just the training wheels. The NSA's room 641A at AT&T's Folsom Street facility in San Francisco — that titanium-and-glass shrine to warrantless bulk collection, exposed by AT&T whistleblower Mark Klein in 2006 — now looks quaint, almost sentimental.
That was surveillance as fishing net. What has replaced it is something far more intimate, far more surgical, and far more total: User and Entity Behavior Analytics, or UEBA. Not a net. A fingerprint reader that never stops reading.
UEBA is not a product. It is an industry. Splunk, IBM QRadar, Microsoft Sentinel, Securonix, Exabeam, LogRhythm — these are the corporate names behind what the government and Silicon Valley together market as "cybersecurity infrastructure." The Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) is the federal coordinator.
The NSA feeds signals intelligence in. The FBI's Cyber Division acts on the outputs. The sixteen "Intelligence Community" agencies all share the data lake.
Fusion centers in all fifty states — over eighty of them, co-funded by DHS and state governments — are the local distribution points for behavioral risk scores generated by these systems. You are not supposed to know any of this is connected. That is by design.
UEBA works by establishing what the industry calls a "behavioral baseline" — a statistical model of how a "normal" user interacts with digital systems. How fast do you type? What hours do you typically log in? How long does your mouse hover over certain categories of web content? What search queries do you run, in what sequence, at what intervals? The system ingests all of this and more: email metadata, calendar patterns, VPN usage, file access rhythms, application switching habits. Then it watches for deviation from that baseline. Deviation is the flag. Deviation is, in the language of the machine, risk.
This is not hypothetical architecture. It is live. It is running right now.
Consequences:
Loan denials (e.g., Sandra, the nurse, denied refinancing due to attending protests).
Job rejections (e.g., Marcus, the developer, blacklisted by a hidden UEBA flag).
Insurance hikes (e.g., Maria, the teacher, flagged for speaking at a school board meeting).
Housing discrimination (landlords use these scores to screen tenants).
No Recourse:
The Fair Credit Reporting Act (FCRA) doesn’t cover behavioral scores.
No transparency: You can’t access or contest your score.
No due process: The system operates preemptively—punishing you preemptively.
I AGREE.
The federal government deployed UEBA across its own workforce beginning in earnest under Executive Order 13587 (Obama, 2011), the "Insider Threat" framework that metastasized after the Chelsea Manning leaks. Every federal agency was ordered to establish an Insider Threat Program. Every agency. The Office of the National Counterintelligence and Security Center (ONCIX) oversees compliance. The National Insider Threat Task Force (NITTF), a joint NSA/FBI operation, sets the standards. Splunk and IBM QRadar won the bulk of the initial federal contracts. By 2017 the framework had been extended, quietly, beyond federal employees to federal contractors — which means millions of private-sector workers at Booz Allen Hamilton, SAIC, Leidos, Northrop Grumman, Raytheon, and hundreds of smaller firms now have their digital behavior continuously profiled under the same system that flagged Edward Snowden as an anomaly before he ever walked out the door with a thumb drive.
After Snowden the systems got faster and the definitions of "anomalous" got broader.
Now understand where the technology went next: into the private sector, and then into the infrastructure of daily civilian life, and then — because the data flows were too valuable and the contracts too lucrative to keep compartmentalized — back into the government's hands through the mechanism of public-private partnership. This is the loop. This is the machine.
The Score You Don't Know You Have
Palantir Technologies, founded with In-Q-Tel (the CIA's venture capital arm) seed money, and co-founded by Peter Thiel, built its fortune on exactly this loop. Palantir's Gotham platform ingests behavioral data and outputs actionable risk profiles. Its clients include ICE, the FBI, the CDC, the CDC, the Army, the Air Force, the NHS in Britain, and dozens of metropolitan police departments including New York, New Orleans, and Los Angeles. Palantir does not describe its product as a surveillance tool. It calls it "decision infrastructure." The semantic firewall is always the first one they build.
Clearview AI — founded by Hoan Ton-That, backed by Peter Thiel and Palantir investors — scraped over thirty billion facial images from Facebook, YouTube, Instagram, Venmo, and millions of other websites without consent, built a facial recognition engine, and sold access to over six hundred law enforcement agencies in the United States, plus agencies in Australia, Canada, the UK, and Saudi Arabia. Their product doesn't just identify your face. Integrated with UEBA platforms, it links your physical movements to your digital behavioral profile. You walk into a grocery store. The camera identifies you. That identification is time-stamped and logged. The log is matched against your digital baseline. If you were just reading about a protest or browsing an "anomalous" political topic, the system now has a physical-world anchor point for that behavioral flag.
And then there is LexisNexis Risk Solutions and Thomson Reuters Special Services — not the legal databases you know, but their risk intelligence divisions, which compile "risk scores" on hundreds of millions of Americans from court records, social media, utility payment history, location data purchased from data brokers, and behavioral analytics. These scores are sold to landlords, employers, insurers, and banks. They are sold to ICE. They are sold to local police. You have one. You cannot see it. You cannot contest it. It updates continuously.
TransUnion, Equifax, and Experian, the three credit bureaus, have all expanded into behavioral risk analytics that go far beyond credit scores. TransUnion's TrueVision and Equifax's Interconnect suite now incorporate non-financial behavioral signals. Your cell carrier's location data, purchased through aggregators like Veritone and X-Mode (rebranded as Outlogic after public exposure), tells them where you go, when, and how often your movement patterns shift from your established routine. A shift is an anomaly. An anomaly is a flag.
This is how Sandra, a forty-three-year-old registered nurse in Albuquerque, New Mexico, applies for refinancing on her house and gets denied without explanation. Her credit score is 714. But her "risk index" — the composite behavioral score that LexisNexis sold to her lender — reflects that she attended two public health demonstrations last year, that her reading patterns on her phone shifted toward "alternative health information" during a three-month window, and that her location data placed her at two gatherings the fusion center in Santa Fe had flagged as "persons of interest" events. None of this is disclosed to Sandra. The Fair Credit Reporting Act does not yet cover behavioral risk indices derived from location data and reading habits. The lobbyists made sure of that.
This is how Marcus, a twenty-six-year-old software developer in Atlanta, submits seventeen job applications over four months and hears back from three. His GitHub is clean. His portfolio is excellent. But the background screening company his prospective employers use — HireRight, owned by General Information Services, which processes over thirty million background checks per year — has ingested a behavioral flag from a UEBA system he interacted with during a previous contract job at a DHS subcontractor. The flag is classified. Marcus cannot see it. He is told only that there are "items of concern" in his background report that he can dispute in writing within thirty days. He disputes. Nothing changes.
It is insipid, invisible, highly harmful, utterly UnAmerican.
Who Built This and Who Profits
CISA, the Cybersecurity and Infrastructure Security Agency created by the CISA Act of 2018 (signed by Trump, expanded aggressively under Biden's National Cybersecurity Strategy of 2023), is the civilian-facing coordinator of this apparatus. Its founding director, Chris Krebs, came from Microsoft. Its current framework is built on contracts with Microsoft (Azure Government cloud, which hosts classified federal data), Amazon Web Services (the CIA's $10 billion C2E cloud contract), Google (DoD partnerships through Google Federal), IBM, and Splunk.
The revolving door between these firms and the agencies they serve is not a bug in the system. It is the system. Keith Alexander, the former NSA Director who presided over the bulk collection programs Snowden exposed, left government in 2014 and immediately founded IronNet Cybersecurity, which sold behavioral analytics products back to the government and to private banks. Alexander was paid as much as $1 million per month consulting for major financial institutions during his initial post-NSA period, according to reporting by The Guardian. James Comey, before becoming FBI Director, was General Counsel at Bridgewater Associates and a board member at HSBC. Robert Mueller went to WilmerHale. John Brennan went to Beacon Global Strategies. The pipeline flows in both directions, continuously, and the only thing moving through it besides people is data on you.
The financial sector — JPMorgan Chase, Bank of America, Citigroup, Wells Fargo, Goldman Sachs — runs its own parallel UEBA infrastructure, mandated in part by the Bank Secrecy Act and anti-money-laundering regulations, but extended far beyond legal compliance into competitive behavioral intelligence. FinCEN (the Financial Crimes Enforcement Network, a bureau of the Treasury Department) collects Suspicious Activity Reports from these banks — over three million per year — and shares them with the FBI, DHS, and the intelligence community. Your bank is watching how you spend money, in what sequence, at what hours, in which geographic pattern. Deviation flags a Suspicious Activity Report. The SAR is filed without your knowledge. You are not notified. The bank does not have to tell you. The Bank Secrecy Act prohibits the bank from telling you.
The insurance industry has its own variant. FICO, best known for credit scores, now sells a "FICO Score XD" that incorporates behavioral data beyond traditional credit history. Verisk Analytics, the insurance data conglomerate, maintains behavioral risk models that inform homeowners' insurance, auto insurance, and life insurance underwriting. LexisNexis Risk Solutions sells its "Insurance Risk Score" to insurers that incorporates publicly available data, claims history, and behavioral signals purchased from data brokers. Your premium goes up. The letter says "based on information in your consumer file." You request the file. You receive forty pages of address history and a notation that additional proprietary scoring models informed the decision and are not subject to disclosure.
The Billionaires, The Oligarchs, “Our” Elected “Leaders,” at your service.
What the Pre-Crime Designation Actually Does to You
The word "pre-crime" sounds like science fiction because Philip K. Dick made it sound like science fiction in 1956. In 2026 it is a procurement category in federal contracting databases. The Department of Justice's National Institute of Justice funds "predictive intervention" research. The Chicago Police Department ran a "Strategic Subject List" — an algorithmic pre-crime score ranking individuals by their likelihood of being involved in a shooting before any crime occurred — that resulted in people being visited by police, placed on gang databases, and subjected to increased surveillance based on a score they were never shown and could never contest. The RAND Corporation evaluated the program. The ACLU sued. The program was renamed. It was not ended.
PredPol (now Geolitica), ShotSpotter, Axon (the Taser company, now a full surveillance-and-AI platform), Motorola Solutions, and Genetec are the vendor names behind predictive policing systems currently operating in hundreds of American cities. These systems do not predict crime in the abstract. They predict that specific individuals in specific locations are likely to commit crime. Those predictions are fed into patrol routing software that then sends officers to locations where those flagged individuals live, work, or congregate. The flagged individual does not know they are flagged. They begin noticing increased police presence in their daily life. If they are Black or Latino — and the algorithmic bias studies, including research published by the University of Southern California and Stanford's Computational Policy Lab, consistently show that these populations are disproportionately flagged — they already know what increased police attention means in terms of material outcomes: stops, searches, arrests for minor infractions that would not be discovered without targeted surveillance, charges that compound into criminal records that then trigger the LexisNexis risk score, the HireRight flag, the loan denial, the insurance surcharge, the housing application rejection.
The pre-crime designation does not announce itself. It reveals itself through accumulating friction in your daily life. Credit tightens. Job interviews don't come back. Your landlord says the application was "competitive." Your health insurance renewal comes with a 23% premium increase and a letter about "updated risk assessment methodologies." Your Google search results shift subtly toward mainstream sources and away from the independent publishers you used to read. You are not banned. You are dimmed. The machine does not need to delete you. It just needs to make everything you try to do slightly harder than it is for people who score within the baseline.
This is what the industry calls "friction-based compliance." It was described without irony in a 2019 DHS Science and Technology Directorate research grant solicitation as a method of "reducing the incidence of radicalization-adjacent behavior through environmental modification of digital and physical access pathways." Translation: make life harder for people who deviate from the behavioral norm until they stop deviating.
The Smith-Mundt Removal and the Narrative Layer on Top of All of This
None of what is described above is unknown to the federal government. It is built, funded, and coordinated by the federal government. The Smith-Mundt Modernization Act of 2012, buried in the National Defense Authorization Act, removed the prohibition on the State Department and the Broadcasting Board of Governors directing propaganda at domestic American audiences. This matters here because it means the information environment in which you try to understand UEBA is itself a managed environment. The Global Engagement Center, CISA's "countering foreign influence" task force, and the FBI's Foreign Influence Task Force all operate within a legal framework that now permits domestic audience targeting with government-produced or government-amplified messaging.
When CISA's Mis-, Dis- and Malinformation (MDM) team — exposed by the Missouri v. Biden litigation and the ensuing "Twitter Files" and "Facebook Files" disclosures — coordinated with social media platforms to suppress or reduce the reach of content the government deemed problematic, it was not doing something the law prohibited. The Smith-Mundt wall was already down. The suppression of content about behavioral surveillance, about the risk-scoring apparatus, about UEBA itself, fits neatly within the operational logic of a system whose continued effectiveness depends on the governed not understanding it is in place.
The Trusted News Initiative — a partnership between the BBC, Reuters, AP, the Washington Post, the New York Times, Google, Facebook, Twitter, and Microsoft — was formed in 2019 ostensibly to combat "health disinformation" and election interference. In practice its working group coordinates content suppression decisions across member platforms in real time. Independent journalists and alternative news outlets whose behavioral analytics coverage contradicts the "cybersecurity infrastructure" framing favored by CISA find their reach throttled, their search rankings degraded, and their YouTube channels demonetized or removed. This is not paranoia. The BBC itself published the Trusted News Initiative's operational framework. The suppression is the product. The product is consent manufacture.
The Individual in the Machine
James, fifty-one years old, a former union electrician in Youngstown, Ohio, lost his job in 2022 when the manufacturing facility he worked at closed. He applied for retraining through a federally-funded workforce program and was required to create a digital profile on a state workforce management platform. That platform uses Salesforce Government Cloud and IBM Watson to assess "employment readiness" — which incorporates behavioral signals about how applicants interact with job listings, training module completion patterns, and consistency of engagement over time. James's pattern — sporadic logins, long gaps, inconsistent completion of digital training modules that he found difficult because he is a better hands-on than screen learner — generated a low "engagement score." The score determined the sequence and quality of job placements offered to him. He was placed in lower-wage positions than his skills warranted. He did not know why. The workforce counselor he met with for twenty minutes every two weeks did not know why either. The counselor sees what the algorithm shows her: a moderate-risk placement candidate.
Maria, thirty-eight years old, a high school civics teacher in Phoenix, Arizona, attended a school board meeting in 2023 where she spoke during public comment about surveillance technology in school hallways. Her name was entered into a DHS-linked database of "education sector persons of interest" by a local law enforcement liaison officer — a product of the DHS "See Something, Say Something" infrastructure that formalized community informant reporting. She does not know she is in the database. What she knows is that her application for a mortgage was denied, that her car insurance renewed at a rate 31% higher than the prior year, and that a job she applied for at a charter school network — which uses PeopleFacts for background screening — came back with "a matter requiring further review" that the HR representative could not specify.
These are not edge cases. These are the ordinary, expected, designed outcomes of a system that was built to produce them.
The Institutions That Could Stop This and Won't
The Consumer Financial Protection Bureau, under its current mandate, does not cover behavioral risk scores derived from surveillance data. Legislation to extend FCRA protections — the Fourth Amendment is Not For Sale Act, the American Data Privacy and Protection Act — has been introduced in multiple Congresses and died in committee each time. The lobbying expenditures of the data broker industry — LiveRamp, Acxiom (now part of IPG), Oracle Data Cloud, Nielsen, Verisk, LexisNexis, TransUnion, Equifax, and dozens of smaller firms — against privacy legislation totaled over $100 million between 2018 and 2024, according to OpenSecrets tracking. The legislators who sit on the committees that could regulate these firms receive campaign contributions from their PACs. The Department of Justice Antitrust Division has not brought a case against the data broker industry. The FTC has issued guidance. Guidance is not enforcement.
The ACLU, the Electronic Frontier Foundation, the Center for Democracy and Technology, and the Electronic Privacy Information Center (EPIC) file lawsuits. The lawsuits are important. The lawsuits are also chronically underfunded relative to the firms they target, take years to resolve, and result in consent decrees that the companies subsequently violate with minimal penalty. The FTC fined Facebook $5 billion in 2019 for Cambridge Analytica-related privacy violations. Facebook's revenue in 2019 was $70.7 billion. The fine was 7% of one year's revenue. The behavior did not change. The business model that required the behavior did not change.
The machine is not broken. The machine is working as specified. The specification was written by the people who profit from it, in legislation drafted with their input, overseen by regulators who came from their industry and will return to it.
What You Are in This System
You are a node. You are a data point. You are a behavioral profile assigned a risk score by algorithms whose training data, weighting parameters, and output thresholds are trade secrets protected from public disclosure by the same corporations that lobbied against the legislation that would have required transparency. You are pre-guilty until the machine's continuous reassessment moves your score into an acceptable range. You may never know your score. You will know it only through the texture of your life — through what becomes harder, what becomes more expensive, what stops being offered to you, what doors open slightly less wide.
Your hopes, your dreams, your ambitions – this is where they have led you to.
The Bill of Rights is not suspended. It is simply irrelevant to a system that punishes through economic friction, algorithmic invisibility, and bureaucratic delay rather than through prosecution. No warrant needed. No charges filed. No trial. No right to face your accuser because your accuser is a gradient descent function running on AWS GovCloud and the entity that trained it considers the training data proprietary.
Keylogging your rhythm. Timing your hesitation. Mapping your anomalies. Scoring your compliance. "Our Freedom."
The livestock don't know it's a Skinner Box. That's the design specification.
Got Behavior?
“And he causeth all, both small and great, rich and poor, free and bond, to receive a mark in their right hand, or in their foreheads:
And that no man might buy or sell, save he that had the mark, or the name of the beast, or the number of his name.
Here is wisdom. Let him that hath understanding count the number of the beast: for it is the number of a man; and his number is Six hundred threescore and six.” Revelations 13:16-18 KJV.