The government wrote down the risk itself

The US Secret Service published a privacy impact assessment for a system called Helix, and the interesting part is not the surveillance. It is the sentence where the government describes its own risk.

What the system does

Helix brings together video of individuals, facial images and biometric templates, license plate numbers, and the time and location metadata attached to all of it, then applies analytics across the combined set in a single environment. It operates around the White House complex, the Capitol area, and the Naval Observatory. The assessment notes that available footage can include adjacent public streets, sidewalks, parks and entrances.

Then it says something I did not expect to read in a compliance document. That combining these sources increases the privacy impact beyond the original collections.

A federal agency writing down, in its own assessment, that the whole is more invasive than the sum of its parts.

That is a more candid statement about data fusion than most of what the private sector publishes about its own products.

None of the parts is remarkable

This is what makes the sentence worth paying attention to rather than just noting.

In 2026, none of the individual capabilities in Helix is technically interesting. Video is video. Automated plate reading is twenty year old technology that works reliably in the rain. Face matching against a gallery is a commodity, available as an API and as an open weights model. Any one of them, deployed alone, is unremarkable engineering that a competent team could stand up in a quarter.

The capability appears when they share context.

A plate at a gate, a face at a door, and a timestamp are not three facts. They are a trajectory. That is an enormous jump in analytical power, and precisely the same jump in exposure, and it happens at the integration layer, which is the one part of the stack nobody audits and no benchmark measures.

Where the argument about computer vision actually is now

For most of the last decade the public conversation about this technology was about accuracy. Does it work. What is the false positive rate. Is it biased across demographics. Those were the right questions when systems frequently did not work.

Benchmarks are close enough to saturated on the common tasks that arguing over a couple of points of mean average precision misses what has changed. We have written elsewhere about how a saturated benchmark can make a model look better than it is, which is its own problem.

The question that actually matters now is what happens when five accurate systems are permitted to talk to each other, and who decided they could.

Nobody publishes a leaderboard for that. There is no metric for how much inference a joined dataset supports. And because the individual components each pass their own review, the composition tends to arrive without ever being reviewed as a whole.

Which means purpose limitation has to be structural

Here is the design conclusion, and it applies to our own product as much as to a federal one.

If two detectors can be joined later by anyone with database access, they are effectively already joined. A policy that says they will not be is a statement about current intent, not about capability. Intentions survive until the next reorganisation, the next contract, the next emergency, or the next person who inherits the credentials.

So the boundary has to live somewhere a policy change cannot move it.

For DHI that means the raw video does not leave the site, and the thing that crosses the boundary is an event rather than a stream. There is no central pool where one customer's detections could be joined with another's, because the pipe that would fill such a pool does not exist in the architecture. Which detectors run at all is selected per deployment and enforced in the platform's use case registry, not asserted in a document.

We build cross camera reasoning, and it is powerful for exactly the reason it needs limits: it links things that were separate. So the limit belongs in the architecture, because a limit that lives in a policy is one reorganisation away from gone.

Credit where it is unusual

It is worth being explicit that the Secret Service assessment did something most product documentation does not.

It named an emergent risk that arises from the vendor's own design choice, in a document the public can read, without hedging it into meaninglessness. Whatever you think about the system being described, that specific sentence is more honest than the majority of privacy language written by companies selling video analytics, including language I have read from competitors that says a great deal while committing to nothing.

The engineering lesson is available to anyone regardless of where they sit on the underlying policy question. Combination is the capability. Combination is therefore the risk. And if you want a limit to hold, you have to build it into the part of the system that cannot be edited by whoever is in charge next year.