Explosive leak in the USA shows how financial data is used to create citizen profiles – how far has Europe already come?

What previously sounded like a Minority Report is apparently already part of real police work in the USA: A little-known unit of the US border protection agency analyses financial activities and other data of citizens in order to filter out those who, from the authorities’ point of view, might be “worth” closer scrutiny – even though they are not suspected of any specific crime.

The investigation by 404 Media describes so-called Predictive Intelligence Targeting Teams (PITT) of the US Border Patrol. These units analyse financial data and other information and then pass their findings on to local law enforcement agencies. These agencies can then, for example, stop the person in traffic.

The crucial point is not the personal traffic stop. It is the reversal of a centuries-old principle of the rule of law: no longer does a concrete act create suspicion – data creates the suspect.

From citizen to data profile

404 Media had previously documented that US Customs and Border Protection (CBP) used location data from commercial online advertising systems. Data from ordinary smartphone apps – including games, dating, or fitness apps – can be used to track mobile phone movements.

When such movement data is combined with financial information, vehicle data, travel patterns, and government databases, something qualitatively new emerges. The citizen becomes a calculable data profile.

An unusual flow of money here, a trip there, a specific movement pattern, a vehicle in a particular location – each potentially completely harmless in itself. However, in an algorithmic risk model, these can create patterns that bring someone to the attention of the authorities.

And this is precisely where it becomes interesting for Europe as well.

Europe is by no means far removed from this development

It would be wrong to claim that the EU already operates an identical American PITT system. There is no evidence for this. However, the necessary infrastructure is growing.

European law enforcement agencies can already exchange financial information and analyses from national Financial Intelligence Units under certain conditions; Europol can also request corresponding bank account and financial information or analyses.

Even more remarkable is where this journey is headed.

The European Commission has proposed a comprehensive expansion of the Europol framework for 2026. The draft includes, among other things, advanced criminal analysis data environments, the processing of large datasets, and the use of AI-powered tools. According to the proposal, Europol should even be able to develop and train its own AI tools and support member states in their deployment.

This provides essential building blocks: financial data, police data, cross-border information exchange, large data rooms and AI-powered analysis.

These systems are still legally separated from one another. Technically, however, it is becoming increasingly easy to link data together.

The AI Act provides protection – but not as comprehensively as one might think

At first glance, it seems that Europe has prevented precisely this development. The EU AI Act does indeed prohibit AI systems that predict a person’s risk of committing a crime solely based on profiling or personal characteristics.

The crucial word, however, is: alone.

The AI Act permits AI systems to support human investigations when there is already objective and verifiable evidence directly related to criminal activity. Furthermore, the EU classifies various AI applications in law enforcement as “high risk” rather than prohibiting them outright.

Even systems for detecting suspicious financial transaction patterns do not automatically fall under the prohibition of predictive policing, according to the guidelines. However, if such transaction data is enriched with personal information and individual profiles are created from it, stricter high-risk rules may apply.

That is a crucial difference: “high risk” means regulated – not prohibited.

The dangerous shift

No one needs to decide on a European “social credit score” in Brussels tomorrow. The development can occur in a much less spectacular way.

A database here. An exchange of information there. Financial surveillance to combat money laundering. License plate recognition to fight crime. Biometrics for border security. AI to analyse massive amounts of data.

Each measure can be justified in terms of security, combating terrorism, or organized crime. Only when these systems are interconnected does the potential power become apparent.

Europe should take a very close look

The irony is that the EU has simultaneously created one of the strictest AI regulations in the world and is providing its security authorities with increasingly powerful data and analysis tools.

One is intended to protect the citizen. The other is intended to make the state more efficient.

This model works as long as both goals remain compatible. However, as soon as security interests are expanded, the boundaries can quickly become blurred.

The American PITT research should therefore be understood by Europe less as an exotic story from the USA than as a warning about a future that is already technically possible.

At least on paper, the rule still applies: first suspicion, then surveillance.

The real danger begins where this order is reversed: first comes the surveillance – and the suspicion then arises from the collected data.

Then we wouldn’t just have digital policing anymore. We would have a society in which every citizen constantly produces data, from which a system could eventually decide who appears worthy of closer scrutiny.

And you don’t need a Chinese “social credit score” for that. All that is needed is a Western security apparatus that connects enough data.

 

yogaesoteric
September 25, 2026