"Nothing to Hide": Why Ordinary People Benefit from Better Security

“I have nothing to hide” is probably the most common thing I hear when this topic comes up with people who aren’t journalists, activists, or security professionals. It sounds reasonable. It isn’t.

The problem isn’t that the statement is dishonest — most people saying it genuinely believe it. The problem is that it misunderstands what surveillance is, who conducts it, and what the harm actually looks like. You don’t need to be doing anything wrong for your data to be used against your interests.

What surveillance actually is

We tend to picture surveillance as a targeted thing — a government agency watching a specific person for a specific reason. That’s one model, and it exists. But the much larger and more pervasive model is mass, automated, indiscriminate collection: not watching you specifically, but harvesting everything from everyone and storing it indefinitely.

This matters because the harm isn’t always immediate. Data collected today gets used, leaked, subpoenaed, or breached later. The threat model for your 2025 data includes whoever has access to it in 2030, under whatever laws and political conditions exist then. “I have nothing to hide now” isn’t a claim you can make about the future.

It also matters because surveillance enables control that doesn’t require targeting. When people know they might be watched, they change their behaviour — they self-censor, avoid certain searches, don’t attend certain events. The effect is real even when the watching isn’t.

The actual threat landscape for ordinary people

The threats most people face aren’t nation-state intelligence operations. They’re more mundane and more immediate:

Data brokers aggregate your location history, purchasing behaviour, browsing habits, and social graph and sell it to anyone willing to pay — including employers, landlords, insurers, and stalkers. This is legal in most jurisdictions.

Credential breaches are so routine that you have almost certainly had passwords exposed in one. If you reuse passwords, one breach becomes access to everything. This isn’t hypothetical — it happens continuously at scale.

Targeted harassment and stalking increasingly depend on information that is technically public or easily purchased. Your home address, your workplace, your daily routine — all of it is available through data brokers or extractable from metadata you don’t think about.

Opportunistic account takeover — phishing, SIM swapping, credential stuffing — doesn’t target you specifically. It targets whoever is reachable. If your accounts are easier to compromise than average, you’re more likely to be hit.

Platform policy changes mean that data you gave to a service under one privacy regime may later be handled under a very different one — through acquisition, regulatory change, or policy update.

None of this requires you to be interesting to a government. It just requires you to exist on the internet.

What actually helps

The good news is that the baseline improvements are not difficult or expensive. They don’t require technical knowledge to use, and they meaningfully reduce exposure to the most common risks.

A password manager is the single highest-impact change most people can make. Unique, strong passwords for every account eliminate the credential reuse problem entirely. Bitwarden is free, open source, and works across every device. 1Password is good if you’d prefer to pay for something. There is no good reason not to use one.

Two-factor authentication via an authenticator app — not SMS — on any account that matters. Email, banking, anything with payment details attached, social accounts. An authenticator app (Aegis on Android, Raivo on iOS, or Authy if you want something cross-platform) is significantly harder to intercept than SMS codes.

Signal for sensitive conversations. Not because your conversations are secret, but because the default messaging infrastructure — SMS, standard email, most social DMs — is trivially accessible to third parties through legal process and often through breach. Signal is end-to-end encrypted and available to anyone with a phone number.

Full-disk encryption on your devices. On modern iPhones and Android phones this is on by default. On Mac, enable FileVault. On Windows, enable BitLocker or use VeraCrypt. This protects you if a device is lost or stolen — your data is inaccessible without your PIN or password.

Browser hygiene: use Firefox or a Chromium fork with sensible defaults rather than Chrome where possible, install uBlock Origin, and be deliberate about which sites get persistent logins. These reduce tracking surface substantially without requiring any particular technical knowledge.

This isn’t an exhaustive list. It’s the floor — the set of changes that take an afternoon to set up and reduce your exposure to the most common and impactful risks.

The friction argument

The other common objection is that security tools are inconvenient. Some of them are. But the ones listed above add friction measured in seconds per day: opening a password manager to autofill a login, opening an authenticator app to copy a code.

The friction of not using them is paid later, in bulk, when something goes wrong — a compromised account, an identity fraud, a leak that surfaces data you didn’t know had been collected. That friction is much larger and not distributed conveniently across your calendar.

Where this doesn’t go

This piece doesn’t cover threat models that require considerably more: anonymity tools, device compartmentalization, or protecting against targeted surveillance by well-resourced adversaries. Those exist and require different approaches.

If your situation involves those risks, the Electronic Frontier Foundation’s Surveillance Self-Defence guide is a good starting point, and organizations like Access Now’s Digital Security Helpline offer direct support.

KIBERNETIKANTO runs operational security workshops for journalists, activists, and organizations. If you’re interested in a session for your team, get in touch at [email protected].