First they came for the Muslims, and I did not speak out – Because I had no idea.

Last night, the audience at MIT CIS’s Starr forum cheered our local councilperson’s invocation to protest in the streets the moment a “Muslim Registry” is announced [1].

Later, a professor whose parents were imprisoned in camps in this country said, “The Japanese American community learned a lesson. And it’s not just to protect our community. You don’t let this happen to anyone.” [2]

Amen.

But we just might let it happen, and not for apathy or unwillingness to come out from behind keyboards or any other shortcoming of commitment or vigilance.

We might let it happen behind our backs. The prospect even more terrifying than a show-up-and-be-recorded registry is that governments and private companies already have all they need to secretly create that registry overnight.

The Internet and the most popular services that run on top of it were never intended to hide who we communicate with, only what we say to them (and even then, only sometimes). Sadly, who we communicate with is all you need to build to a registry.

You need a startlingly small amount of that who-talks-to-who information to identify what groups people belong to. And – even better if you happen to be targeting a movement – you get to sweep up the group’s close associates and sympathizers in your dragnet with no extra work required.

Using just data drawn from my own personal email account, you can get this color-coded graph of the people and groups I associate with. You can even see my friends that straddle the boundaries between different groups (you know, the sympathizers). This didn’t take specialized nation-state software, an intelligence agency, or Google’s AI team, just a small amount of straightforward math and seconds of computation on a cheap computer.

Graph theory (think “social network graph”, not “bar chart”) makes it easy to identify who associates with who. And the fact that we each communicate with thousands of other people, web sites, services, and apps makes it all but impossible to hide. If even one communication channel or a small fraction of databases are compromised and even if it’s only temporary, you can gather enough information to build a reliable graph on a huge group of people… even the people whose communications weren’t explicitly compromised like my friends who appear in the data from my e-mail account.

Spurred by statements made by the president-elect and his advisors, many smart people have been recommending a range of measures for self-protection for activists, journalists, and targeted groups. Using a confidential email provider, 2-factor authentication, encrypted communications, Tor, a password manager, and not carrying sensitive information at protests is great advice.

But none of those things can protect you or anyone else from the information we’ve already let slip. Who you communicate with is out there. All it takes is the will to run the algorithm and we have a “registry” of Muslims or any other “undesirable” group [3] .

It can be comforting to think encryption and cryptography can empower Davids threatened by Goliaths. Sometimes it can. But not here. There are zero ways for individuals to defend themselves against a Muslim registry based on this data.

The only protection from this dystopian “naughty and nice list” is brave, explicit legislation and careful citizen oversight. We need to take seriously the long-time warnings of privacy advocates and restrict the ways our government can collect and use this information.

P.S. If you’re the kind of person ready to take to the streets or register yourself, but want to do more in the face of this more insidious threat, consider donating to the Electronic Frontier Foundation. They’ve been presciently fighting this battle for decades.

[1] I know this sounds alarmist. Maybe it is. But consider this comes from a man called “Hamas on the Charles” by Breitbart, the news outlet the president-elect’s chief strategist runs.

[2] Paraphrased until the video is posted and I can pull exact wording

[3] Personally, I’m an optimist and don’t expect this to come to pass. History though, shows wisdom in vigilance. It’s not a matter of if we’ll see a government make a list of targeted people, only when.