The expansion ratchet

Capabilities create constituencies for continued use

Once an institution has paid for collection systems, compliance teams, classifiers, identity gates, or monitoring infrastructure, reusing them for a new purpose becomes cheaper than building something new. The result can be secondary use even without a secret master plan.

Vague risk language expands discretion

Terms such as “dangerous,” “harmful,” or “high risk” can be necessary categories, but they are not self-limiting. A definition becomes a safeguard only when an independent reviewer can determine whether a specific intervention was actually authorized.

Reversibility must be engineered

Sunsets, deletion schedules, narrow data schemas, independent review, public reporting, and separated systems reduce the cost of saying “this authority is no longer justified.” A safeguard that can only expand is poorly designed even if its original purpose was legitimate.

Efficacy must be measured against marginal benefit

The relevant question is not whether the underlying threat is frightening. It is whether the chosen intervention reduces that threat enough to justify its privacy, error, exclusion, and chilling costs compared with narrower alternatives.

Do not confuse caution with fatalism

History includes both expansion and rollback. Treating abuse as inevitable can be as intellectually lazy as treating institutions as permanently benevolent. The useful lesson is to design exit ramps before a crisis makes them politically inconvenient. 10