We should start treating surveillance like malware