The Quest for the Transparent Citizen II

Obey or Be Disconnected

A few weeks ago I wrote that the new mobile-line registration system was not really a policy against crime. It was a policy against anonymity.

I still retained, however, what was probably a naive form of scepticism. I did not doubt the authoritarian will of the Mexican government. I doubted its capacity to execute a policy so absurd, so badly designed, and so plainly incapable of delivering what it promised.

Would they really go through with it? Would they really try to suspend millions of lines? Would they really turn a mobile phone into a condition for access to banks, platforms, messaging, work, and part of economic life? Would they really impose an obligation that not even the operators themselves seem capable of implementing correctly?

I thought perhaps they would back down. Not out of respect for freedom, or constitutional modesty, or because they suddenly understood the difference between security and mass identification. I thought they would back down out of simple incompetence. But everything indicates they will not. And maybe that was my mistake: assuming that a policy must work for a government to want to apply it.

In a propaganda machine, the practical result can be secondary. What matters is the announcement, the figure, the portal, the campaign, the official report, the photograph of the official explaining that now extortion really is being fought. If lines later appear registered under false identities, companies unable to comply, citizens disconnected, numbers linked to people who do not use them, and criminals operating exactly as before, there will always be an explanation. The fault will lie with users, companies, operators, those who did not follow the procedure correctly. Never with the policy.

The first AT&T messages were quite clear:

“By official order, you must link your line. If you do not, you will lose it.”

There was no invitation, no presentation of guarantees, no explanation of proportionality, necessity, information security, or real oversight mechanisms. There was an order and a consequence.

Register.

Or lose the line.

For weeks I received different versions of the same message: “By official order, you must link your line; if you do not, you will lose it”; “Go to your AT&T store”; “You need INE and CURP”; “Never by phone call”. The threat was not implicit. It was literally the content of the message.

Then something curious happened. Since a considerable part of the population seemed not to be responding with the expected obedience, the tone changed. They then began offering data packages in varying amounts and durations in exchange for voluntarily entering the system I had already been ordered to enter under threat of losing service.

First they said:

Obey or we disconnect you.

Then they added:

Please obey. We will give you data.

The sequence is almost comic. The political monopoly issues the decree, the company transmits the threat, the citizen does not respond, and then the promotion appears, as if the problem were that we had not yet understood the marvellous commercial opportunity. As if our resistance might be due to the fact that no one had yet found the correct price. How much is waiving a constitutional objection worth? How much does it cost to accept that the government will forcibly link our civil identity to the device we carry in our pocket? For AT&T, apparently, enough to turn a threat into a data campaign.

And when the promotion ends, the threat remains.

There is no consent in this. There is an order dressed up as marketing. The carrot does not remove the club. It merely tries to make it more photogenic.

A few hours ago I received another message:

“SUCCESSFUL LINKING: Your line was successfully linked, is ACTIVE and ready to use.”

I did not link any line.

The message did not come from AT&T’s usual sender. It does not show a telephone number. It appears only under the name “Bienvenido”. AT&T, meanwhile, continues offering me help to complete the registration.

I then searched the tools available from AT&T and Telcel. I did not find a clear explanation of what had happened to my number. The guidelines require providers to offer consultation mechanisms, and the Comisión Reguladora de Telecomunicaciones (Telecommunications Regulatory Commission, CRT) gathers the corresponding links on its portal. But there is no central consultation there that allows a person to enter a CURP or RFC and discover, without previously knowing the company (and there are hundreds), which lines appear linked across the whole system.

To consult, the user must first select the operator. And that was precisely the piece of information the message did not provide.

My line is still working and continues to appear as an AT&T line. However, in AT&T’s tool it does not appear as linked. The “SUCCESSFUL LINKING” SMS also does not identify another company or offer a path to find out who carried out the supposed operation, through what procedure, or on what basis.

I do not know whether the message was fraud, an error, confirmation of some different service, or an attempt to register the number. Nor can I rule out, with the tools the system itself makes available to the citizen, that the supposed linking occurred somewhere else. And I do not intend to pretend that I know what I still cannot prove.

But the scene perfectly sums up the quality of this policy. The citizen must hand over a verifiable identity to a fragmented infrastructure that does not allow him to verify with the same ease what was done with it. In the middle of a campaign supposedly intended to eliminate uncertainty about the identity of lines, I receive an identity confirmation whose identity I cannot verify.

The message announcing transparency is opaque.

The system that promises attribution produces confusion. The citizen must identify himself. The sender may simply call itself “Bienvenido”.

This Is Not Just a SIM Card

The most frequent defence of this policy consists of pretending that we are only talking about telephony: “it is a mobile line”, “you can live without it”, “they did not exist before”, “you can always use a computer”, “you can always go to the bank”. The argument would be less insulting if it did not depend on deliberately ignoring how contemporary life works.

A mobile number no longer serves only to make calls. It is an improvised credential, an authentication key, an identifier demanded by banks, platforms, messaging systems, shops, transport apps, accommodation services, and account-recovery mechanisms.

For years, companies and governments promoted that dependency. They convinced us to install applications, abandon branches, stop using physical cards for certain operations, accept codes sent by SMS, trust telephone numbers as proof of identity, and move payments, reservations, conversations, documents, and work to mobile devices. After building that dependency, the government appears to declare that access to the infrastructure is conditional on the line being linked to our identity under its rules.

And they still expect us to discuss this as if it were about preserving the right to make telephone calls.

No. It is about who controls the key.

My bank has already explained it to me inside its own app. I must link the line in order to “keep operating normally” the services that use the phone as a verification method.

The phrase is carefully cowardly. It does not say I will lose my money, that they will cancel my account, or that the government forbids me to participate in the financial system. It only warns that things may stop operating “normally”. Some degraded route will always remain: online banking from a computer, a visit to a branch, an in-person procedure, a request for clarification, a queue, office hours, a call from another phone.

Bureaucratic freedom consists of preserving an alternative so inconvenient, slow, or incomplete that it allows one to deny that coercion exists.

I can legally keep my account and, at the same time, lose functions necessary to use it as before. I can keep a physical card and be unable to generate the digital card or dynamic code required for certain purchases. I can own my money and depend on an application whose activation or recovery requires a functioning mobile line. I can have formal rights and lose operational capacity.

This is one of the State’s favourite fictions: confusing the legal existence of a right with the material possibility of exercising it. My property remains mine. I merely have to ask permission in a more complicated way to use it.

The dependency is not limited to the bank. Uber, Airbnb, Didi, Rappi, government apps, e-commerce services, and messaging systems often require a number to create accounts, recover access, confirm devices, or authorise movements. Some platforms allow it to be changed by email. Others keep sessions active for a time. Many offer partial alternatives. But the existence of an emergency door does not make closing the main entrance voluntary.

And those who designed this measure know it. They know that a mobile line is not an isolated luxury. They know that suspending it affects family relationships, work, payments, reservations, and accounts. They know that millions of people will end up handing over their data not because they trust the policy, but because they cannot risk losing normal access to the tools on which their subsistence depends.

That is precisely the function of punishment. They are not seeking to persuade. They seek to raise the cost of refusal until refusal becomes impracticable. Then they will be able to publish a compliance figure and call it citizen acceptance.

The word “consent” has been emptied until it means the opposite. To consent should imply the real possibility of rejecting a proposal without suffering a disproportionate reprisal. Here the State commands: give me the information, allow your identity to be linked to the line, accept the procedure, or lose the service. And because the service functions as a key to other services, the threat multiplies through a network of dependencies that the State itself does not need to administer directly.

AT&T suspends the line; the bank loses a verification method; the application stops working normally; the platform cannot send you a code; the account becomes harder to recover; the reservation becomes complicated; the client cannot reach you; the family loses a channel of communication. Each institution can wash its hands. The company is merely complying with an official order. The bank is merely explaining the consequences. The platform is merely applying its security policies. The government is merely fighting crime.

Coercion is distributed so that no one appears to exercise it in full. But the citizen receives all of it.

That is what is truly modern about the mechanism. A police officer does not have to come to my house to force me, confiscate my money, forbid me to publish, or close my business. It is enough to intervene in the layer of access. Contemporary power does not always destroy what it wants to control. Sometimes it merely administers the credentials.

People close to me have told me that I am exaggerating because companies already ask for data to contract other services. That when internet is installed in a home, one also provides a name, address, and certain information about the account holder. The comparison fails because not every transfer of data is identical.

It is not the same to provide an address in order to physically install a cable as to be compelled by the government to link a civil identity to a portable line that accompanies our movements, serves as an authentication mechanism, and connects much of our digital life. The difference lies in its capacity for correlation: identity, number, device, location, schedules, relationships, applications, banking, work, messaging. The danger does not lie in each fragment being completely unknown, but in all of them being joined with less effort.

This is the reasoning of someone who observes that a house already has windows and concludes that removing the walls does not matter. Privacy also consists of separation, difficulty, limits of purpose, and the obligation that different institutions not be able to automatically join everything they know. Fragmentation is not a flaw. It is a form of protection. And the search for the transparent citizen consists precisely in destroying it.

The Impossible Case

The policy becomes still more absurd when it tries to confront reality.

A friend of mine runs a company that uses dozens of mobile lines to provide internet at large events. Not to operate an extortion centre, not to conceal a criminal organisation, but to connect networks shared by thousands of devices. A single line can serve as the link for an entire network. The administrative account holder is not the author of every communication. The owner of the company is not the person who visited every page. The employee who installed the router did not write every message. The identity associated with the SIM card may be thousands of users away from the concrete activity that passed through the connection.

This is not an exotic exception. It is a legitimate and ordinary function of telecommunications. Companies, hotels, universities, cafes, offices, event organisers, and government agencies provide shared access every day.

Yet when the person responsible for that company tried to comply with the new obligation, the operator could not offer him a functional procedure to correctly register his business lines. This was not a customer’s refusal or an attempt at evasion. It was a company asking how to obey. The infrastructure was not ready. The staff did not know how to solve it. The obligation existed. The procedure, in practice, did not.

And then something happened that sums up the whole policy better than any theoretical critique. According to the testimony I received, staff from the company itself suggested registering the lines using the identities of employees, acquaintances, or neighbours.

That is: to comply with a policy whose supposed objective is to correctly associate each number with an identity, the operator recommended producing associations that do not reflect the actual user.

The official solution to the problem of false identities was to manufacture false records.

Not necessarily false documents. That would have been too crude. Real people, real CURPs, real IDs, false relationships. The system could then celebrate that each number had been linked. The report would show compliance. The database would contain names. The authority would have a figure. And the information would be materially useless for determining who used each connection.

But the policy would have worked. At least in the only dimension that seems to matter to the bureaucratic apparatus: the form would be filled out.

This is the difference between truth and administrative legibility. Truth would mean recognising that a line can have multiple users, that a network can carry activity from thousands of people, and that contractual ownership does not prove authorship. Administrative legibility only needs a box with name, CURP, number, and linked status. The system does not need to understand reality. It needs to reduce it to fields it can count. And when reality does not fit, it does not modify the policy. It forces reality to lie. Then it uses that lie as evidence of success.

A criminal who wants to evade attribution will still have options: stolen identities, front people, other people’s devices, public or business networks, intermediary services, corrupt officials, or shell companies. The registration system does not eliminate those possibilities. It only increases the costs for those who were not trying to hide.

The criminal already treats evasion as part of his activity. The ordinary citizen does not. He uses the same number for years, gives it to his bank, shares it with his family, registers it on platforms, links it to an email, carries the same device, returns every night to the same address, publishes from persistent accounts, keeps histories, pays bills. He leaves legitimate traces because he is not committing a crime. That is why it is much easier to identify him. Not because the State is extraordinarily competent. But because the normal citizen has already done almost all the work.

To find an extortionist who uses a stolen line, someone else’s identity, and a shared network, one needs to investigate: follow money, cross-reference evidence, request orders, identify networks, protect witnesses, confront bought police officers and officials, distinguish the administrative account holder from the actual user. To find a person who published criticism from a habitual account, the path can be much shorter: platform, provider, number, schedules, metadata, and location approximate routines.

One does not need to read every message to reconstruct a life. The content may be encrypted. The fact of the communication is not necessarily so. Surveillance does not need omniscience. It needs correlation. And the registration system reduces the cost of correlating the citizen who lives openly.

That is why this policy can be useless against the criminal and dangerously effective against the dissident without any contradiction. The professional criminal designs his activity to produce false attributions. The journalist, the activist, the opposition figure, and the critical citizen use ordinary infrastructure. They are not fleeing justice. They are exercising freedoms that supposedly should not require going underground.

That is the moral inversion of the system: whoever commits a crime already knows he must hide; whoever thinks and speaks freely discovers that perhaps he should too. And then the government presents the need to take precautions as evidence of guilt.

“Why do you need privacy?” “What do you have to hide?”

The answer is simple. I need privacy precisely because I do not trust those who ask that question.

Truth, Forms, and Simulation

Perhaps the registration system will not reduce extortion. Perhaps criminal lines will continue to operate through stolen identities, front people, shared networks, or disposable devices. Perhaps the databases will contain errors. Perhaps millions of associations will not correspond to the actual user. Perhaps the system will produce more leaks than successful investigations.

None of that prevents the policy from working on another level. It can work as propaganda.

The government will be able to announce how many millions of lines were linked, show percentages, boast of a platform, publish photographs of service centres, declare that “anonymity is over”, and credit itself with firm action against crime.

The existence of the mechanism will replace proof of its results.

That is the machinery of simulation. It does not need to produce security. It needs to produce recognisable signs that the government is acting: a law, a registry, a portal, a campaign, a deadline, a rising figure, an official in front of a microphone, a new database. The problem can continue intact, even worsen, while the response remains visible.

Simulation does not mean that nothing happens. The consequences are real: suspended lines, citizens without normal access, interrupted companies, leaked data, expanded surveillance. What is simulated is the relationship between those consequences and the stated purpose. Administrative activity is produced and presented as equivalent to solving the problem.

Registering is not investigating. Identifying the account holder is not identifying the user. Linking a CURP does not prove authorship. Suspending a line does not dismantle a criminal network. Filling a database does not produce justice. But in the official report all those differences can disappear. The policy will have been “implemented”, the citizen will have been “linked”, the authority will have “complied”. And if extortion continues, the explanation will appear later: crime adapted, cooperation was lacking, some people evaded the system, companies did not do their part, citizens did not report. There will never be a shortage of external causes to preserve the policy’s innocence.

Institutional simulation needs statistics, but not necessarily truth. A line associated with a name counts. A suspended line counts. A line linked under pressure counts. An employee who lent his identity counts. A company that improvised records to avoid collapse counts. They all appear in the same number: compliance.

The figure does not distinguish consent from coercion, accuracy from convenience, user from account holder, security from obedience. But the figure looks clean. And a clean figure can sustain a lie for a long time.

The Mexican government has an old relationship with this kind of representation. It confuses budget with service, programme with result, coverage with quality, a case file with an investigation, an operation with security, an election with representation, consultation with consent, registry with truth. The current administration did not invent that tradition; it inherited it and perfected it in certain respects. It also recovered something the old regime understood very well: the importance of the official narrative. It is not enough to exercise power. It must be presented as popular will. It is not enough to impose. The imposition must be described as protection. It is not enough to demand obedience. Compliance must be called participation.

That is why I do not think it prudent to judge this measure only by its stated effectiveness. Even a policy useless against crime can be valuable to power. It produces information, normalises identification, builds infrastructure, establishes precedents, reduces spaces of anonymity, trains the population to accept that access depends on registration, accustoms private companies to executing political orders, and turns banks and platforms into indirect guardians of compliance.

And, above all, it redefines the relationship between citizen and State. It is no longer the authority who must justify why it needs to know something. It is the individual who must justify why he wishes to keep it to himself.

The policy may fail completely in its stated objective and triumph extraordinarily in another: making surveillance seem like an ordinary obligation of citizenship.

Inverted Conversion

As I have argued before: Mexico does not lack institutions. It lacks results. It has police forces, prosecutors’ offices, courts, commissions, systems, budgets, protocols, specialised units, and offices designed to address practically any problem one can imagine. It has laws to combat extortion, protect victims, prosecute financial crimes, sanction abuses of authority, protect personal data, guarantee freedom of expression, and watch those who should be watched.

The architecture exists. The problem appears when one tries to convert it into something real.

A complaint does not become an investigation. An investigation does not become a sentence. A sentence does not necessarily become reparation. A budget does not become security. A prosecutor’s office does not become justice. A commission does not become protection. A reform does not become capacity.

The Mexican State receives immense amounts of money, authority, and information and returns a miserable fraction of the public goods it promises to produce. That is one of the central problems of impunity: the low capacity for institutional conversion.

But the mobile-line registration system reveals that incapacity is not uniform. There are things the State does know how to convert. It knows how to convert an administrative obligation into a threat, citizens’ dependency into compliance, private companies into executors of a political order, banking applications into channels of institutional propaganda, everyday access to services into leverage, and a phone line into a file.

When it comes to finding the extortionist, all the limitations of the public apparatus immediately appear: there is a lack of personnel, coordination, evidence, timely access to information; the case file is delayed, the competent authority is someone else, the platform did not respond, the call came from a false identity, the phone was stolen, the money has already been withdrawn, the investigation does not advance. But when it comes to identifying millions of citizens, an extraordinary capacity for execution suddenly appears. Then there are deadlines, national campaigns, repeated messages, coordination among operators, banks, and authorities, threats with automatic consequences, and the capacity to suspend.

They cannot guarantee that a complaint will produce justice. They can guarantee that a phone line will stop working.

They cannot prevent a criminal group from using false identities. They can prevent an honest person from using an unlinked identity. They cannot protect the person who reports. They can punish the person who does not hand over his data.

This is not an absolute absence of capacity. It is selective capacity.

The State is weak in the face of those who can answer it with violence, money, influence, or networks of protection. It is strong before someone who keeps a bank account, an address, a job, a family, a phone line, and something to lose. Authority is not always exercised over whoever represents the greatest danger. It is exercised over whoever is easiest to administer.

For decades we have been told that the problem of the Mexican State is that it “cannot”: it cannot investigate, coordinate itself, fight crime, prevent corruption, control its police, or guarantee justice. But that description is incomplete. The Mexican State can collect, fine, close businesses, deny permits, block accounts, impose impossible deadlines, transfer its errors to the citizen, and turn its own incapacity into someone else’s fault.

That is not weakness. It is a specific form of strength. A strength that almost always points downward.

In a free society, power should justify every invasion of the private sphere. It should demonstrate that the measure is necessary, suitable, proportional, that controls exist, that the expected benefits outweigh the risks, that there are no less intrusive alternatives, that the information cannot be reused for other purposes, and that anyone who abuses it will face real consequences. Here the opposite occurs. The citizen must justify his refusal: why he does not want to register, what he fears, what he has to hide, why he distrusts.

The moral burden is inverted. The State, responsible for too many leaks, abuses, espionage, and security failures, does not need to prove that it deserves trust. The citizen, who has committed no crime, must explain why he wishes to preserve a fraction of privacy. The government is not obliged to present results before expanding its powers. It is enough for it to invoke a real problem: extortion exists, violence exists, organised crime exists; therefore, we must all become more legible.

State incapacity thus becomes an inexhaustible source of power. Each failure justifies a new power, each system demands more data, each database creates new risks, and each risk generates another regulation. And when nothing improves, the conclusion is never that the control was badly designed. The conclusion is that it was still not enough.

Impunity and surveillance are not opposites. They can grow together. Impunity protects those who have resources, connections, and violence to escape the system. Surveillance makes legible those who still live within it. A State can be almost blind before criminal structures and, at the same time, observe the ordinary population carefully: lose the murderer and keep the victim’s metadata; ignore the corrupt official and register the number of the person who reports him.

Not because it is omnipotent. Because its capacities are not distributed neutrally.

The force of the State rarely falls with the same weight on everyone. The powerful find doors, criminals buy exits, officials reserve files, citizens fill out forms. Impunity is opacity for those who capture the system. Transparency is obligation for those who must obey it.

That is not a contradiction. It is the design.

The Third Bill

In other texts I have written about the double bill of impunity. The first is the official one: we pay taxes to sustain police forces, prosecutors’ offices, courts, penitentiary systems, prevention programmes, and administrative structures that supposedly guarantee security and justice. The second appears because the first does not work: we pay for cameras, bars, alarms, insurance, guards, backup systems, alternative transport, longer routes, legal fees, losses from fraud or theft, extortions, closed businesses, wasted time, fear, and silence.

We pay the State to produce security. And then we pay again to survive its inability to produce it.

The mobile-line registration system adds a third bill. Now we must also pay to administer the suspicion that the State itself places on us: investigate how to keep access to the bank, review which services depend on the number, back up accounts, change authentication mechanisms, go to branches, wait in stores, hand over documents, correct errors, request clarifications, and accept the risk of leaks. Companies must devote staff to registering lines; operators must improvise procedures; employees must explain policies they do not understand; users must solve incompatibilities no one foresaw.

And if something goes wrong, the cost falls again on the person compelled to comply. The government designs the policy, the company executes the suspension, the bank degrades access, the platform rejects the number, the citizen absorbs the consequence, and the authority keeps the power. All the rest of us pay for its implementation.

The case of business lines shows the full perversity of that transfer. A legitimate company tries to comply; the operator does not know how to process its situation correctly; the procedure fails; the improvised solution consists of using third-party identities. If the entrepreneur accepts, he feeds the system with misleading information. If he refuses, he risks the continuity of his operation. If the lines are suspended, he loses capacity to work. If he looks for alternatives, he pays again.

At no stage does the institution that created the problem assume the cost of having created it.

A government can impose an absurd obligation because it does not pay for the hours lost at a counter, transport, the lost reservation, the banking code that does not arrive, the business at risk, the modems that must be reconfigured, or the possibility that the information ends up leaked. It is very easy to declare a policy reasonable when all its frictions will be absorbed by others. And it is even easier to call it free.

The procedure has no cost, they say. As if time, risk, and the loss of autonomy had no value. As if the obligation to reorganise one’s own life around a bureaucratic decision were not already a form of payment.

Nothing is free when it is imposed. Someone absorbs the cost. The government simply prefers not to count it.

In Whose Hands

Up to this point it might seem that my objection is purely abstract: a discussion about privacy, an ideological difference over how much the State should know, an almost aesthetic resistance to the growing transparency of modern life. It is not.

The question is not only what information a mass-identification infrastructure can reveal. The truly important question is who controls it and within what system it ends up circulating.

We are not evaluating the risk of handing these data to an imaginary institution, populated by impartial officials, effective controls, and real consequences for every abuse. We are talking about the Mexican State: an apparatus with security failures, leaks, abuses, markets for personal information, and blurred boundaries among authority, party, local boss, protected business, and criminal organisation, precisely in the places where exposure is most dangerous.

There is no need to believe that all officials are criminals or to imagine a secret office devoted to reviewing every criticism published against the party. The problem does not require a perfect conspiracy. It requires sufficient access: an informal query, a poorly protected database, a captured prosecutor’s office, a local police force, or someone with contacts capable of turning an administrative datum into concrete pressure.

Surveillance systems rarely become dangerous because one person can see everything. They become dangerous because too many people can see enough.

In Mexico, critical communication can become dangerous long before it touches national interests. Organisations such as the CPJ and Reporters Without Borders continue to document killings, threats, disappearances, and impunity against journalists in the country, especially in local contexts. Behind that warning are people who investigated a local official, documented an abuse, ran a municipal news page, or published information that someone with power preferred to keep out of circulation. Not all of them ran major newspapers. Not all of them had national audiences. Sometimes it is enough to inconvenience the wrong person in the wrong territory.

The threat does not always come from the president of the Republic or from an order signed in a federal office. It can come from a mayor, a commander, a businessman with political relationships, a police corporation, a locally protected criminal group, or someone with enough impunity to find out an address and act afterwards. The absence of a national conspiracy does not make the population safe. In a fragmented and opaque system, it may be enough for central power to build or tolerate the infrastructure that others will use.

I do not need to be an investigative journalist to understand that threat. I do not even need to consider myself a journalist. I write about systems, incentives, institutions, and political fictions. For a long time I thought that placed me outside the territory of risk: I do not reveal who received a contract, I do not identify a commander, I do not publish photographs of a criminal network, I do not accuse a specific person of ordering a murder. I write ideas.

But one characteristic of authoritarian systems is that they end up confusing criticism of the structure with a personal aggression against those who administer it. The party presents itself as government, the government as people, criticism as attack, and disagreement as suspicion of betrayal. Criticism is not forbidden. Its cost is modified.

I have not received a direct threat that I can prove. That must be said clearly. There is no recorded attack against me. I have no proof that an institution is surveilling me because of what I write. It would not be honest to present a possibility as if it were persecution already under way.

But neither do I begin from complete ignorance of how these systems work. Years ago I taught courses and gave advice on information security. Part of that work was with people connected to environmental activism, who had real reasons to protect communications, identities, devices, and routines. I learned then something that now seems necessary to recall: security does not begin when the threat appears. If one waits until receiving it, one has usually already handed over too many pieces: the address, the number, the schedules, the main account, the contact list, the photographs, the places frequented, the devices used, the relationships between a public identity and a private one.

A minimal separation is not built because there is certainty of being persecuted. It is built because it is prudent to prevent any future conflict from finding a person’s entire life organised around a single identifier.

I have also received responses that did not seem like ordinary discussions. They were not explicit threats and did not contain a verifiable promise of harm, but they had that particular tone of someone who is not trying to refute an idea, but to remind you that certain ideas can have consequences. Maybe they were only partisan fanaticism or online verbal violence. I do not know who they were or what capacity they really had. Precisely for that reason it is not wise to exaggerate.

But it is also not wise to act as if the Mexican context did not exist. Risk assessment does not work through absolute certainties. It works by observing vulnerabilities, capacities, and consequences. The probability that someone may want to harm me because of an essay may be small. The consequence of having unnecessarily joined my publications, my number, my address, my routines, my accounts, and my family may be enormous. When the cost of preserving some distance is reasonable, I do not need to wait for someone to prove his intentions to me.

In my life I have known people beaten, arbitrarily detained, threatened, or deprived of liberty by authorities. One of my teachers was held for days by police officers. He tried to report it. He tried to turn to the institutions responsible for responding to abuse. He achieved practically nothing. It happened many years ago. Someone might say it belongs to another Mexico, to the old regime, to the country before the promised transformation. I am not convinced.

The colours, vocabulary, and slogans have changed. The essential machinery remains. The same monopoly retains the power to detain, investigate, register, charge, surveil, and decide which versions of events deserve to be recognised. The current administration did not dismantle that machine. It occupied it. It also recovered part of the old regime’s moral language: the identification among party, State, and popular will; the reduction of criticism to a form of disloyalty; and the creation of an official narrative in which results matter less than the capacity to affirm that the transformation has already occurred.

They took a machinery of simulation built over decades and covered it with a vaguely progressive ideology. The result is not less authoritarian because it uses a left-wing vocabulary. Coercion does not become solidarity because the official announces it in the name of the people. Surveillance does not become social justice because the registration system appears accompanied by a campaign against extortion. The monopoly remains a monopoly. The club remains a club, even when they paint it the correct colour.

That is why I find it offensive to be asked for trust. Trust belongs to voluntary relationships. It is built through reputation, limits, reciprocity, and the possibility of exit. It cannot be decreed, it does not appear because a law says the data will be secure, and it is not born because an official promises that they will only be used against criminals. Much less can it be demanded under threat of disconnection.

“Trust us or you will lose the line” is not an invitation to trust. It is the confession that trust becomes unnecessary when one possesses enough power.

The situation is even more serious because metadata are not innocent residue. The encrypted content of a communication may remain hidden and, even so, a considerable part of life may be exposed through patterns: schedules, zones, frequency, duration, services used, changes of habit, accounts that appear before or after a publication, devices that travel together, persistent connections. No one needs to know every word to produce a hypothesis about a life, and that hypothesis does not need to be perfect to cause harm. It may be enough to identify a person, confirm an address, locate a workplace, recognise a routine, establish which family member travels with him, or decide where to apply pressure.

Surveillance does not need to deliver judicial truth. Sometimes it only needs to produce a lead for someone who is not interested in going before a judge.

That is a fundamental difference between the legitimate use of information in an investigation and its availability inside a captured system. In an investigation subject to controls, an authority should justify why it needs certain data, limit the scope of the request, document access, and answer if it abuses it. In a system of impunity, material access also matters: who can obtain an informal query, buy a leaked database, control a municipal police force, call a contact at the company, or disguise a political search as a legitimate investigation.

Written law does not by itself describe real power. That is one of the great fictions of our democracy of simulation: assuming that a power will behave according to the purpose for which it was drafted. On paper, the system pursues extortionists. In practice, it builds a tool. And tools end up in the hands of those who have access to them.

I do not claim that the mobile-line registration system will automatically provoke a new wave of political persecution. I do not need to claim it. The objection comes before that. A government should not receive an invasive capacity simply because every future abuse it could commit with it has not yet been demonstrated.

The burden of proof should be on the side of power. Whoever demands data must prove necessity; whoever concentrates information must prove security; whoever reduces anonymity must prove results; whoever asks for trust must prove that it punishes those who betray it. The Mexican State has demonstrated none of those things. It has demonstrated the opposite too many times: data leak, abuses remain unpunished, victims carry the burden of investigation, authorities can become aggressors, a complaint does not guarantee protection, and an institutional promise can coexist perfectly with a family waiting for answers.

And even so it pretends that the relevant fear is only fear of the criminal who calls by phone. As if public power could not also be a threat. As if Mexican history were not full of reasons to distrust. As if the citizen had a moral obligation to forget.

Distrust did not appear out of nowhere. They produced it.

The Right to Opacity

My resistance does not arise from a fantasy of invisibility. I know that my blog is not truly anonymous. I do not pretend that it is. Anyone with enough interest could probably connect the pseudonym to my identity.

D-503 is not a clandestine hideout. It is a layer. A minimal distance. A way of allowing the idea to appear before the civil file of the person who wrote it.

I am not trying to become impossible to find. I am trying to prevent finding me from becoming trivial.

That friction matters. It forces whoever wants to cross the distance between a text and a person to invest effort, justify interest, make mistakes, or leave traces. Absolute privacy may be impossible. Partial privacy remains valuable. A door that can be opened is not identical to a house without walls. And the fact that the State can identify me through a legitimate investigation does not mean I must hand it, in advance, a permanent correlation of my life.

I am not a criminal demanding impunity. I am a citizen demanding limits.

I do not want to hide what I think. I want to keep my family outside the immediate reach of the consequences that what I think may produce. I want to be able to criticise a system without automatically turning my address, my schedules, my accounts, and my relationships into annexes to the text. I want there to be a difference between publishing an idea and handing over a map.

That should be normal. It should not require knowledge of information security or lead a person who writes about institutions to wonder from which network it is prudent to publish. It should not turn a constitutional freedom into an exercise in threat modelling.

But doors do not exist only to hide crimes. They exist to sleep, talk, think, change one’s mind, go through a crisis without turning it into a spectacle, raise a child, write an idea still incomplete. They also work in the opposite direction: they not only prevent others from observing us, they also allow us to stop observing them. Closing a door means ceasing to be seen, but also ceasing to see, to hear every conflict, to receive every gesture, to continuously interpret what those around us do, feel, or expect.

I suspect that this separation fulfils an elementary function for the human mind. We need spaces where reciprocal surveillance stops, where it is not necessary to manage expression, anticipate judgments, respond to stimuli, or sustain an identity before an audience. A place where lowering one’s guard is not imprudent. A society without privacy does not only force everyone to live in front of a window. It also forces everyone to look through it.

Orwell understood this part of oppression well. The power of INGSOC does not depend only on the Party being able to observe the individual through the telescreen. It depends on the Party’s presence never fully disappearing from the room, the conversation, or consciousness. The citizen does not know when he is being watched and therefore must always behave as if he were. Surveillance ends up installing itself inside the mind.

Our situation is not identical. In 1984, the telescreen is an explicit, imposed instrument of the State. No one forcibly placed one in every contemporary home. Something more ambiguous happened: we ourselves acquired the device, carry it in our pocket, sleep next to it, and organise almost all ordinary life around it. It is phone, map, camera, bank, archive, calendar, work medium, entertainment, family memory, and channel of conversation. That is why it is so difficult to abandon.

The infrastructure of observation became indispensable before the State claimed a more direct relationship with the identity of the person who uses it. And, apparently, everything was voluntary. An application avoided a queue. A shared location made it easier to find one another. A number simplified account recovery. A camera preserved family moments. A payment from the phone saved time. No isolated decision seemed to hand over too much. Concentration appeared as the result of thousands of small conveniences.

I do not claim that companies and governments designed a coordinated plan from the beginning to produce that dependency. I do not need to attribute intention where observing the result is enough. The phone became first useful, then habitual, and finally indispensable. When the obligation arrives to link it to a civil identity, the citizen formally retains the option to refuse. But he is no longer renouncing a device. He is renouncing a considerable part of the infrastructure through which he organises his life. Convenience does not cancel the coercion that follows. It prepares it.

That is precisely one of authoritarianism’s silent victories. It does not need to forbid speech. It is enough to force us to calculate it. Each sentence first passes through a small assessment: is it worth it?, who might read it?, who might be annoyed?, what account am I using?, from what connection?, what information about my family is nearby? No one has censored me. They have only taught me to censor myself first. And then they call the silence that remains freedom.

The word opacity is often used as an accusation. An institution is opaque when it hides contracts, risks, criteria, or decisions. In those cases, opacity protects the one who exercises power over others. But there is another form of opacity: that of the individual before power, that of the citizen who does not want every aspect of his life to become immediately available to institutions he cannot choose, audit, or abandon. That is not the opacity of the official who hides what he does with other people’s money. It is the opacity of someone trying to prevent power from turning his entire existence into administrable information.

Confusing the two is another of the traps of contemporary political language. The State demands transparency from the citizen while keeping secrets for itself. The citizen must prove who he is, where he lives, what number he uses, and under what identity he participates. The authority can reserve documents, deny files, hide criteria, hire opaque providers, and respond through automatic forms. Transparency flows in only one direction: upward. Never back down.

Privacy does not consist of not existing or of committing acts without consequences. It consists of limiting the capacity of others to observe, correlate, and reuse information outside the context in which it was given. When I give an address to a company to install internet, I do not authorise that address to be automatically linked to every text I publish. When I hand my identity to a bank, I do not grant the government a moral licence to connect that account with my habits, my friendships, and my opinions. When I use a platform, I do not accept that the phone number become a universal identifier capable of joining communications, movements, payments, and routines.

Each relationship should preserve limits. Each datum should have a purpose. Each institution should know only what is necessary to fulfil the concrete function that justified access. That is compartmentalisation. It is not paranoia. It is an elementary form of security. No prudent person hands his whole life to a single point of access. And yet that is exactly what we have built around the phone: a key for the bank, work, communication, and the recovery of other accounts. Now the government intends to claim the master key too.

Anonymity and pseudonymity have been essential to freedom of expression long before the internet. People have published under other names to avoid political persecution, social prejudice, workplace reprisals, family violence, or religious censorship; also to allow the text to be judged before the surname, sex, social class, or institutional position of the person who wrote it. A pseudonym is not always meant to deceive. Sometimes it seeks to order the relationship between the work and the person. D-503 works that way for me: it is not a secret identity and is not designed to withstand a specialised investigation. It is a minimal delay so that the reader first finds the argument and only afterwards, if truly interested, the person who formulated it.

That small delay matters because it introduces a cost before turning an opinion into a file. Without that distance, every sentence is immediately joined to name, address, family, work, and economic means, and discourse begins to shrink before an explicit prohibition appears.

That is why it is not enough to answer that “they can find you anyway”. Of course they can. But there is an enormous difference between doing so through a concrete investigation and having an infrastructure that makes correlation trivial. The difference between a house with a lock and a house without a door does not disappear because both can be opened. The lock does not guarantee invulnerability. It introduces a cost, forces a decision, leaves traces, distinguishes legitimate access from intrusion.

Information does not remain neutral inside a database. It becomes capacity. A list of addresses can be used to deliver aid or to locate opponents. A vehicle registry can help find a stolen car or reconstruct movements. A phone-line registration system can contribute to a legitimate investigation or reduce the cost of identifying a critic. The same infrastructure admits different uses because morality does not reside in the tool. It resides in the institutions that operate it, the controls that limit them, and the consequences they face when they abuse it.

And that is precisely where Mexico fails. We do not have a State that systematically punishes those who use public information for private purposes. We do not have prosecutors’ offices capable of independently investigating their own members. We do not have solid mechanisms to know who consulted a database, for what reason, and what they did afterwards with the information. We do not have an institutional culture in which data abuse produces swift and predictable consequences. We have impunity. And impunity transforms every legitimate capacity into a possibility of extraction.

Captive Subject

Anarcho-capitalism is usually caricatured as a naive defence of powerful companies against the State. My objection begins precisely from the opposite point. I distrust any concentration of power that cannot be abandoned.

A company can abuse, lie, leak data, or impose unfair terms. But, at least in principle, a commercial relationship should depend on consent and face the possibility of losing the customer, being sued, going bankrupt, or being replaced by a competitor.

The State eliminates that possibility. It writes the rule, defines the obligation, selects the executors, threatens the sanction, and controls the framework of appeal.

There is no equivalent exit. I cannot choose another government that recognises my line without demanding registration, hire a different jurisdiction to protect my privacy, or reject the contract and keep using an alternative under the same material conditions.

The relationship is not voluntary. That is why it is offensive to treat it as if it were an ordinary exchange of data between provider and customer.

I am not the State’s customer. I am its captive subject.

And the State does not need my trust while it retains the capacity to punish my refusal.

The phenomenon is not exclusively Mexican. Without searching for red strings on a corkboard, we can observe a more sober convergence: in the United Kingdom and in the European Union, mechanisms for age and identity assurance have been developed, tested, or proposed in order to access certain digital content or services. The purposes and designs are not identical to the Mexican registration of phone lines. Protecting minors from harmful content is not the same as registering phones under the promise of fighting extortion, and some systems attempt to certify only an attribute, for example being of legal age, without revealing the full identity. It would be dishonest to erase those differences.

But it would also be naive to ignore the common movement. Faced with different problems, different governments are arriving at a similar solution: turning identity, or one of its attributes, into a credential for crossing a digital door. Today a user is asked to prove age to see certain content; elsewhere a person is required to associate a name with a phone line. The justification and the mechanism change, but the same transformation remains: access ceases to depend only on the contract between user and service and begins to depend on a verifiable identity inside an infrastructure approved by the State.

I do not need to imagine an international conspiracy to find that movement worrying. Bureaucracies do not need to meet in secret when they share the same incentives. Each bureaucracy finds a real threat, promises to administer it through a new layer of identification, and presents the tool as a limited exception. Afterwards the infrastructure remains, learns to certify new attributes, and finds other uses.

That measures of this family also exist in European democracies does not make them automatically legitimate. On the contrary: it shows that the search for the legible citizen does not belong only to openly authoritarian or institutionally failed governments. It can advance under the language of security, child protection, convenience, and digital inclusion. And precisely because some of those purposes are reasonable, it becomes even more difficult to discuss the powers built in their name.

Powers do not exist in a vacuum. They are inserted into a political culture, a history, and concrete relations of power. In Mexico, history advises special distrust of any instrument that promises security in exchange for making the population more legible. Not because every official plans to abuse it. Because too many could do so without facing consequences.

The right to opacity also does not mean retreating from society. I do not want to do without banks, platforms, telecommunications, digital tools, public space, or contractual relationships. I want participation not to imply nakedness: to contract a service without authorising a total profile, to use a bank without accepting that my number function as a bridge to every aspect of my life, to write under an editorial name without the State interpreting that small separation as suspicious conduct.

I want to preserve the possibility of moving among contexts: father, author, customer, friend, citizen. Not because those identities are false, but because no person fits completely inside a single database. Absolute transparency destroys contexts. It reduces the person to a continuous file: the same name, the same number, the same device, everything connected, everything searchable, everything available to whoever has sufficient access.

That is not security. It is centralised vulnerability.

Perhaps the government will manage to force millions of people to link their lines, suspend those who do not, and publish impressive figures. Perhaps some crimes can be investigated more easily, extortion will continue the same, false records, errors, stolen identities, and leaked databases will appear, and a few years from now no one will remember the original promise.

But the infrastructure will remain. Temporary policies tend to become permanent systems. Collected data rarely return to the citizen. Extraordinary powers almost never shrink voluntarily. A database created for one purpose later finds another. A measure against extortion can end up linked to financial services, platforms, and administrative controls that do not yet exist. Not because every stage was planned from the beginning, but because an available capacity exerts its own attraction.

If the tool exists, someone will find a reason to use it.

I Do Not Want to Go Underground

I do not want to go underground in order to criticise the government. I do not want to learn how to hide every publication as if I were committing a crime. I do not want my wife, my son, my friends, or my clients to be dragged into a political discussion because my life was joined around a number. I do not want to have to choose between expressing myself and protecting my means of subsistence. I do not want speaking freely to require techniques I once taught to people who were truly threatened.

And yet here I am. Thinking about which connection to publish from, which accounts to separate, which numbers to keep, which services might stop working, what data I have already handed over, what part of my life can be reconstructed from them.

This is the most obscene victory of the policy. It has not imprisoned me. It has not censored me. It has not removed this text. It has forced me to think like someone who might need to hide.

Perhaps nothing will happen. Perhaps I will publish this entry and only receive insults. Perhaps the registration system will end up being another badly built database, full of errors and practically useless. Perhaps the campaign will disappear from public conversation after the first triumphant report. I hope so.

But freedom should not depend on power deciding not to use the capacities we build for it. Limits exist precisely because we cannot guarantee who will govern tomorrow, what crisis will be invoked next, or what official will have access to a tool created today. Privacy is not defended only when there is demonstrated persecution. It is defended before, when it still seems exaggerated, when it is still uncomfortable, when it is still possible to prevent an exception from becoming habit. Waiting until abuse is visible means accepting that someone will first have to become a victim.

I do not know what will happen with my line. I do not know whether the government will carry out its threat exactly. I do not know how many services will stop operating normally. I do not know whether I will have to reorganise part of my digital life around this policy.

What I do know is that I will not call consent what they obtained through coercion. I will not call security an infrastructure that identifies the ordinary, traceable citizen better than the evasive criminal. I will not call modernisation the concentration of data inside institutions incapable of protecting them. I will not call protection a threat transmitted by banks and telephone companies. I will not pretend to trust so that my distrust seems less uncomfortable.

The government demands transparency. I demand limits.

The government demands identification. I demand justification.

The government demands obedience. I preserve the right to say no, even when they have made exercising it materially costly.

In the first quest, the State wanted to make the citizen transparent. In the second, it discovers how to punish him when he refuses. And that difference matters.

Because a State that must threaten people in order to obtain trust has already confessed that it does not deserve it.

Sources and References

Related Posts

Leave a Reply

Your email address will not be published. Required fields are marked *