Privacy preserving electronic surveillance

Can protocols make privacy concerns no longer clash with security imperatives, by satisfying both? The former seems to preclude the widespread collection and sharing of data about individuals and their activities, whereas the latter (especially national security and law enforcement) seems to require it. This paper gives a step in the direction of satisfying both, by giving protocols that make the data-sharing about individuals and their actions conditional on these individuals being already on a list of known suspects, deadbeats, criminals, etc. More formally, if we call U the set of all identities, S the subset of U for which monitoring is authorized, Alice the monitoring agency (that alone knows S), Bob any of the data-collection entities, p e U the identity whose activity Bob has just observed, then the outcome of the protocol is that Alice learns the activity of p if and only if p e S, and Bob does not learn anything about the membership of p in S.