Attempting to protect yourself from the National Security Agency’s snooping might just get you on the agency’s watch list. German investigators have discovered a rule in XKEYSCORE, the program that allows the NSA to monitor everything from private emails to website traffic, that makes anyone who visits websites for secure software tools like Tor targets for increased surveillance. In less technical terms: trying to find a bulletproof vest might just get you shot.

The rule is said to target websites devoted to providing some semblance of privacy, including Tor, an anonymous browsing service, Tails, a privacy-minded operating system, and other tools that promise to increase digital privacy like MegaProxy, FreeNet, and MaxMinion. Targeting that last one is particularly worrisome because its rule “matches all traffic to or from the IP address, a server located on the MIT campus.”

BoingBoing’s Cory Doctorow explains the difference between people who have had their data gathered as part of the NSA’s bulk surveillance systems and people who become “targets”:

Since the start of the Snowden story in 2013, the NSA has stressed that while it may intercept nearly every Internet user’s communications, it only “targets” a small fraction of those, whose traffic patterns reveal some basis for suspicion. Targets of NSA surveillance don’t have their data flushed from the NSA’s databases on a rolling 48-hour or 30-day basis, but are instead retained indefinitely.

This means that searching for ways to keep your metadata away from the NSA’s clutches doesn’t just attract the agency’s attention — it also ensures that the agency will gather more information than it did before and store it longer than it otherwise would have. The NSA has given people a devil’s bargain: Either go along with its programs and accept that some of your information will be collected, or attempt to resist the NSA and get labelled a “target” for caring about your digital security.

Cryptography expert Bruce Schneier says that it’s unclear how the people interested in these services are targeted:

It’s hard to tell how extensive this is. It’s possible that anyone who clicked on this link — with the embedded URL above — is currently being monitored by the NSA. It’s possible that this only will happen to people who receive the link in e-mail, which will mean every Crypto-Gram subscriber in a couple of weeks. And I don’t know what else the NSA harvests about people who it selects in this manner.

Whatever the case, this is very disturbing.

So all we know is that attempting to protect ourselves from the NSA’s surveillance programs — or from less politically contentious threats like hackers or thieves — might end up making us targets for further surveillance. We don’t know precisely what we have to do in order to become a target in the NSA’s eyes, nor do we know how we can avoid being lumped in with terrorists and the other people the NSA should actually target with its nigh-ubiquitous surveillance programs.

On the bright side, both Doctorow and Schneier suspect that this information (as well as some other information recently revealed) hasn’t come from Edward Snowden, the whistleblower who first revealed many of the NSA’s most controversial programs. Instead, they think that someone else with access to the agency’s information has decided to reveal what they know following Snowden’s efforts to expose the agency for the misuse of its incredibly vast resources.

Perhaps the agency’s new director should rethink his position on whether or not the sky is falling.

[illustration by Brad Jonas]