Two stories dropped this week that, read together, form a complete theory of the body in 2026: Canadian fintech app Duc left thousands of driver's licenses and passports exposed on an open Amazon server, while ICE confirmed it purchased Paragon spyware to surveil suspects via their personal devices. One story is about a careless leak. The other is about a deliberate intrusion. Both treat the human body, its documents, its voice, its data as infrastructure.

Biometric Leaks and State Surveillance: The Same Problem

The Duc exposure is a mundane horror: no password, no encryption, just a misconfigured S3 bucket full of identity documents. The Paragon story is a different flavor of the same rot. ICE framed spyware acquisition as a drug-trafficking necessity, but the underlying logic is identical to Duc's negligence: biometric and behavioral data is a resource to be harvested, stored, and queried without the subject's meaningful consent. A 2026 paper in arXiv CS.CY by Richard J. Mitchell argues that AI-driven systems increasingly operate beyond symbolic control, making genuine human oversight architectures not just desirable but structurally necessary. That framing applies equally to surveillance capitalism and to state spyware. The oversight is missing in both cases.

When Kintsugi Shuts Down, Who Wins

Layer in the Kintsugi shutdown, a startup that spent seven years trying to get the FDA to approve AI that detects depression from voice patterns, and the picture sharpens. The regulatory apparatus that failed to protect Duc customers or constrain ICE's surveillance appetite somehow became an insurmountable wall for a clinical tool that might have genuinely helped patients. The body is surveilled with impunity when the surveiller is a state or a negligent startup. It is protected from measurement when the measurer is trying to help. . The FDA's caution is defensible. The asymmetry is not.