Hand-wringing about cyber war aside, the question that really needs answered is: what paradigm shift needs to happen before breaches stop being depressingly common, and why isn't that shift happening?
Reduce the value of a breach.
That is to say: minimize the records kept, minimize the amount of correlation that can be done between multiple sets of records (both internally and across multiple parties), minimize the damage a user can do to themselves or others at every single level of authorization.
>and why isn't that shift happening?
A subject's anonymity and independence are all antithetical to the system's profitability (and often to ease of development).
Finally: no one can steal surveillance records that don't exist. Maybe we think about ending the ubiquitous surveillance of the US population?
I’m thinking single purpose password token systems. Email just needs to be replaced by an entirely new, engineered for authority and privacy* from the grounds up communication protocol.
Edit-Also, a democratically managed whitelisting system. Something that home routers could use as a source of authority on classifications of IPs. Ie literally no way to masquerade a darknet resource as a whitelisted resource.
Edit two: added privacy to email replacement.
And I don't think we're close to doing either in the case of China.