Public infrastructure controlled by the state is subject to *state* surveillance, not *corporate* surveillance — but it is surveillance nonetheless. The concentration of identity, payment, and document systems in a single state-controlled stack creates surveillance capabilities that even the most po