PHION
Files 10 Uptime 309d Latest 0d

Storage, cloud and AI without the surveillance default (Techno-fascism, Part 5)

By burt Published 2026-07-27 Class Power & Society Read 11 min

This is Part 5 of 5 in the techno-fascism series: Part 1, the machinery of surveillance capitalism, Part 2, private messaging, Part 3, browsing and search, and Part 4, social media and news. This part covers storage, cloud services and AI assistants — the layer where most people keep their photos, documents and increasingly their conversations with a chatbot.

In February 2021, a father in San Francisco, referred to in court records only as Mark, photographed his toddler’s groin at his doctor’s request, ahead of a video consultation about an infection. The photos synced automatically to Google Photos. Google’s scanning system matched the images against known child sexual abuse material and flagged the account. Within a day, Google disabled Mark’s Gmail, Google Fi phone service, and all his photos and contacts, and reported him to the National Center for Missing and Exploited Children, which passed the case to the San Francisco Police Department. Detectives investigated, obtained his full Google account history, and closed the case: no crime had occurred. Google did not reinstate his account. A second father, Cassio in Houston, was flagged the same week for the same reason and suffered the same permanent lockout, as first reported by the New York Times and detailed by the Electronic Frontier Foundation.

This was not a one-off. In February 2026, PiunikaWeb documented a fresh wave of reports of Google Photos users permanently banned after automated CSAM classifiers flagged innocent family photos — in one case, a freelancer’s six-year-old account was disabled overnight after he backed up around 6,000 photos of nieces and nephews, taking with it his access to Fiverr, Upwork, Payoneer banking, website hosting and home security cameras that all relied on the same Google login. The EFF has said the true number of false positives across Google’s user base “could be hundreds, or thousands.” In March 2026, US Senator Josh Hawley opened a Senate Judiciary subcommittee investigation into Google’s CSAM detection and removal practices, though that inquiry is aimed at the opposite failure mode — content that should have been caught and wasn’t.

The mechanism is the same in every case: an automated classifier scans content the moment it reaches the provider’s servers, and a match — real or false — can end your access to everything tied to that account, with no appeal that has proven reliable. This is what “the cloud” means in practice: a company’s server is the first place your data becomes readable to something other than you, and readable data gets scanned, sometimes trains a model, and can be used against you by a policy you did not agree to in any specific sense.

What actually watches your cloud storage and your AI prompts

Apple planned a similar CSAM-scanning system for iCloud Photos, announced in August 2021, then abandoned it in December 2022. Apple’s own reasoning, laid out when it later expanded iCloud’s end-to-end encryption instead, was that scanning infrastructure built for one type of content inevitably becomes a general-purpose surveillance tool: “scanning every user’s privately stored data would create new threat vectors for data thieves to find and exploit,” and the same infrastructure could be repurposed to search for other content by any government that demanded it. Google and Microsoft continue to run this kind of scanning on their consumer cloud storage.

The same pattern now applies to AI. In May 2024, Slack was found to be training machine learning models on customer messages and files by default, with no in-app toggle — opting out required a Workspace owner to send a manual email, and the only public disclosure was a line in the privacy policy. Slack maintains the training only touches usage metadata and de-identified content, not raw DM or private-channel text, but the opt-out-by-email mechanism is itself the point: consent was assumed, not asked.

Google’s current position, published on its Workspace AI privacy page, is that it does not train Gemini or other generative models on Gmail or Drive content “without permission,” and that this data is not reviewed by humans outside the customer’s own domain. What actually governs this in practice is the “Smart features” toggle in Gmail and Workspace settings — leaving it on lets Gemini read your mail and files to summarise and search them; turning it off removes that capability. The privacy boundary here is a settings toggle, not a structural guarantee, which is a meaningfully weaker position than data that never reaches Google’s servers in a readable form at all.

Self-hosting your files and photos

The most direct way to remove a third party’s classifier from the loop is to not send it your data. Self-hosting means running the storage software yourself, on hardware you own, so a service provider is never in the path at all.

Nextcloud is the broadest option: an open-source suite covering file sync, a LibreOffice-based collaborative office suite, video calling (Talk), calendar and contacts, that Nextcloud says scales “from a Raspberry Pi with 2 users to globally distributed installations.” It is a general file server first, and a photo manager second — face recognition and AI tagging need extra apps bolted on.

Immich is purpose-built as a Google Photos replacement instead: automatic background backup from iOS and Android apps, face recognition and clustering, and CLIP-based semantic search — you can type “dog on a beach” and it will find the photo without any tag ever being applied by a cloud vendor. It’s released under the AGPL-3.0 licence and runs on anything from a Raspberry Pi 5 to a dedicated NAS. Immich’s own documentation is explicit that it is not a backup solution on its own and recommends a 3-2-1 backup plan (three copies, two media types, one off-site) regardless.

For simpler needs, Syncthing skips the server model entirely — it syncs files directly between your own devices over an encrypted peer-to-peer connection, with no central copy stored anywhere.

None of this requires enterprise hardware. An old laptop, a Raspberry Pi, or a small NAS box is enough for a household’s worth of photos and documents. What it does require is accepting that you are now the person responsible for backups, updates and security patches that a cloud vendor previously handled — the trade is a platform-ban risk for a self-discipline risk.

Encrypted cloud storage, if you still want someone else’s server

Self-hosting isn’t for everyone, and off-site backup is still good practice even if you do self-host. The middle ground is storage where the provider only ever holds ciphertext.

Proton Drive, from Geneva-based Proton AG, uses end-to-end and zero-access encryption — Proton states plainly that “not even Proton can access your data.” Its free tier gives 5GB; Drive Plus is 200GB, and Proton Unlimited bundles 500GB with Proton’s Mail, Calendar and VPN products, at published pricing on Proton’s site. Tresorit, Swiss-based (via Swiss Post Digital), offers the same zero-knowledge model — files are encrypted on your device before upload, and Tresorit holds only the ciphertext and never the keys — across tiers ranging from 50GB up to several terabytes; check current pricing directly, as it varies by region and billing cycle.

If you’d rather keep an existing account with Dropbox, Google Drive or OneDrive but stop the provider from reading your files, Cryptomator sits on top of any of them. It’s open source, requires no account of its own, and creates an encrypted “vault” folder inside your existing cloud folder. Files and filenames are encrypted with AES-256 on your device before the cloud client ever touches them; the sync software still runs exactly as before, it just synchronises unreadable data.

Uploading a file to ordinary cloud storage leaves it in a form the provider can scan and potentially use to train AI models. Client-side encryption, whether built into the storage service or added afterwards with a tool like Cryptomator, encrypts the file before it ever leaves the device, so the provider only ever stores ciphertext.

Local AI instead of surveillance AI

A cloud AI assistant is the same shape of risk as cloud storage: your prompts, documents and pasted data pass through a company’s servers, under a policy that governs logging and training and can change. Slack’s default opt-in to training is the template most AI chat products have followed in one form or another — assume access is granted unless you go looking for the setting to remove it.

The alternative is running an open-weight model on your own hardware, where nothing leaves the device. Two releases changed what’s realistic here. In August 2025, OpenAI released gpt-oss, its first open-weight models since GPT-2 in 2019, in 120B and 20B parameter sizes under the Apache 2.0 licence — free to run, modify and redistribute commercially. Alibaba’s Qwen3 family, also Apache 2.0, spans a much wider range of sizes from 0.6B up to a 235B mixture-of-experts model, giving a genuine choice of model to fit whatever hardware you have.

Not every “open” model is actually open. Meta’s Llama models are widely described as open source but the licence is not recognised as such by the Open Source Initiative, which finds it fails the basic freedom to use the model for any purpose, discriminates against categories of user, and restricts fields of use — the most recent version also excludes people in the European Union from using the model at all, without explanation. Apache 2.0 models like gpt-oss and Qwen3 don’t carry these restrictions.

Running these models locally is handled by tools like Ollama or the underlying llama.cpp, which download a model, manage GPU memory and serve it through a local API or chat interface. The practical limit is quantization: models are normally trained at 16 or 32 bits per weight, and quantization formats like GGUF compress that down, trading a small amount of accuracy for a much smaller file. Q4_K_M, the commonly used middle ground, runs at roughly 4.5–5 bits per weight — an 8-billion-parameter model shrinks to around 4.5–6GB, fitting comfortably on an 8GB consumer GPU, while a 70-billion-parameter model at the same quantization needs roughly 38–40GB, which means either a professional-grade GPU or splitting the model across two consumer cards. Ollama itself remains free and fully local for this core use — the company added optional paid cloud tiers in 2026 for routing prompts to its own servers, so the privacy guarantee applies specifically to the local mode, not to every feature in the app.

Running a model locally is not automatically the same as running it privately. Microsoft’s Recall feature, which screenshots the screen every few seconds and stores the images and an on-device AI index locally on Windows, keeps that data off Microsoft’s servers — but security researcher Alexander Hagenah showed in 2026, with a tool called TotalRecall Reloaded, that a standard user-level process could ride along with Recall’s own rendering component to extract stored data without needing to break its encryption at all, as CSO Online reported. Microsoft did not classify this as a security boundary failure. The lesson carries over to any local AI setup: keeping data on-device removes the vendor as a party who can read it, but it doesn’t replace ordinary security hygiene — disk encryption, account separation, and keeping the software that touches that data patched.

Where your data actually goes

Service Who can read your plaintext Can it train an AI model on your content Who can lock you out
Google Photos / Drive, default settings Google’s automated systems and, on a flag, human reviewers Only with permission for Workspace; consumer terms differ and Smart features must be disabled to limit it Google, unilaterally, no reliable appeal
Self-hosted (Nextcloud / Immich / Syncthing) Only you No — never leaves your hardware No one but you
Proton Drive / Tresorit (zero-access encryption) Only you — provider holds ciphertext only No Provider can suspend the account, but not read or hand over readable data
Dropbox / Drive / OneDrive + Cryptomator Only you — vault contents are ciphertext to the provider No, for vault contents Provider can still lock the account, but the data inside the vault stays unreadable
Cloud AI assistant, default settings The vendor’s servers, for the duration of its retention policy Often, unless you find and use an opt-out Vendor, per its own terms
Local open-weight model (Ollama, llama.cpp) Only you — inference runs on your own hardware No No one but you

Limitations

Self-hosting makes you the system administrator. There is no vendor patching security holes for you, no automatic off-site backup unless you set one up, and a server left open to the internet is a server left open to attackers, not just to you.

Zero-knowledge encryption is unforgiving by design: if a provider genuinely cannot read your files, it also genuinely cannot recover your account if you lose your password. There is no “forgot password” flow that doesn’t compromise the model.

Local AI models on consumer hardware trail the largest cloud models on reasoning benchmarks and usable context length, and quantization trades away some accuracy for the file size that makes local inference possible at all — for some tasks that gap matters, for others it doesn’t.

None of the above defends against a compromised device. Client-side encryption keys and local model prompts are both stored on your endpoint, and if that endpoint is compromised, encryption in transit or at the provider offers no protection at all.

Sources