25 years of mass surveillance is enough