Comment by lotyrin
You justify surveillance in the wake of terrorist attacks, etc. and when public sentiment toward government is mostly good (the financial surveillance here is an example)
You make moves to constrict the available information and permitted behavior of residents and citizens in excess of what is defined by law through pressure on culture and public marketplaces, etc. and not legal action by government. (e.g. the stuff going on with erotic content on Steam recently, but not limited to stuff like that). You start with more questionable and controversial things like e.g. sexually explicit content, then progress to all content or ideas that are inconvenient to your regime.
You boil the frog of authority over the public at a rate where only a minority starts noticing problems and looking for solutions in educating themselves using politically inconvenient media (and flagging themselves as enemies in the surveillance tools) or taking action that is inconvenient to you
You start making court cases against these inconvenient people and start deporting them or incarcerating them. First with e.g. illegal immigrants or foreign national students that are saying things that are unpopular, but slowly escalate to all the people that disagree with you.
If you don't think all these things are well established, I'm not sure what to tell you.
Yes. Sadly, 9/11 is the classic case of terrorists having won :(