Personal privacy and the personal sphere were fundamentally changed when we moved from an agricultural to an industrial society, and maybe it was especially changed when we moved from village to city – from the social organisation that sociologist, Ferdinand Tönnies, called Gemeinschaft to the city’s Gesellschaft, from community to society. In the village, villagers lived in almost full transparency. Identity was strictly joined to the collective’s judgement about the individual, and it was difficult, if not impossible, for those who had taken a risk and fallen into trouble to start over. The roles and positions that one took were defined strictly by others, and social mobility was consequently quite limited. With the move to the city came the ability to define oneself, and the opportunity to be someone other than the person you had to be. We see it in the novels and literature, in Jane Austen’s stranger, perhaps best depicted in John Willoughby, with his dark past about which no one knows – a past from which it was easy to distance himself, when the Atlantic steamer was a ticket to a blank slate, a new career, a new me. When things begin to heat up, he disappears into the shadows of the city, and it is only with considerable research and effort that Austen’s hero finds out about Willoughby’s past and reveals the scandals that this new mobility allowed him to escape. There is a link here to the image of a self-made man – an almost literal link because the city’s anonymity, for the first time, gave us the opportunity to remake ourselves without our past standing in the way. The entrepreneur, who almost by necessity must fail – business is risky, difficult, and often fails – therefore emerges onto the scene on a much larger scale. We get a new type of risk-taking in the shadow of the city’s anonymity, which enables and interacts with industrialisation and thus contributes to the veritable explosion in economic growth that followed. Privacy and growth are intertwined in complex processes of urbanisation. But, up to the rise of the modern city’s anonymity, the notion of an isolated, discrete and impenetrable personal sphere was an anomaly. Now we are perhaps facing a second shift, not back to the community but to something new, where we again see the individual’s ability to control information about them transformed. What does that mean, and what is really at stake if we do not find a balance between how we manage our own identity and how it is reviewed by others? And what does the institutionalisation of the supervisory gaze of the security services, in its comprehensive programmes and projects, mean for us? Often when the discussion concerns the value of personal integrity, of the personal sphere, we emphasise autonomy. The idea is simple to understand: those who feel themselves to be transparent have less ability to make their own decisions, because we all worry about what others think, and how they will react to what we do. It is an old insight into human psychology. Augustine argued that the best way to correct our behaviour was to imagine that God’s gaze constantly rests on us. In Zen Buddhism, it is recommended that the practitioner, even in a dark room, behave as if he had a revered guest and that the gaze really matters – the other’s gaze that constantly studies us and curtails our discretion. Melissa Bateson, Daniel Nettle and Gilbert Roberts conducted psychological experiments with different images of eyes above a contribution jar in a workplace kitchen, with the request to pay what each considered the drink to be worth. Angry eyes and stern looks yielded more revenue than pictures of flowers – the difference more than doubling contributions in some cases. The gaze disciplines. Jeremy Bentham’s famous prison, carefully constructed precisely from that realisation, his ‘Panopticon’ – a building in which the detainees at all times know that there is a certain probability that they are being observed by the guard. In the modern analysis of Foucault, the question is raised of whether we are currently building ourselves into a panopticon. David Brin wrote in his acclaimed book, The Transparent Society, that we are indeed, but that it does not matter, because we can take turns to sit in the tower in the middle of this circular building, and help monitor each other. That, he says, is the only possible future for democracy – a transparent state where everyone knows everything about everyone else. A village at the global level – a return to Tönnies’ Gemeinschaft. Critics point to the implications for autonomy: how it would curtail everyone’s freedom of action, and the risks it would create for misuse if the data fell into a dictator’s hands. We must, they say, build societies so that if democracy collapses, it does so in a way that makes it difficult for a dictatorship to control the citizens. As a design principle, it is a wonderful thought, but when put into practice, it is often difficult to apply. How do we build an open welfare society on digital technology that cannot collapse into an Orwellian nightmare? And therein lies perhaps one of the most difficult questions about the future of privacy: if we think we need some monitoring to ensure safety, how can we design this monitoring so that we do not one day wake up in Bentham’s captivity? When monitoring in the open society operates on a scale that clearly contradicts the public perception of fairness and reasonableness, when data collection occurs at levels that defy all legitimacy, we cross a line: suddenly, views are polarised to the point that it is no longer about how we design safety in society, but about the very existence of safeguards and monitoring themselves. This binary approach to surveillance is increasingly evident in the current debate, and it has no exits or solutions. In that debate, we either tear down all surveillance or we leave all the power over the individual to a faceless government with unclear motives. Tertium non datur. This in turn leads to an unsustainable situation, and a growing opposition between power and citizen, which erodes trust in technology, the web, and eventually perhaps also in the community. Surveillance’s clearest victim is social capital. When Richard Posner, in his famous The Economics of Justice, argues that privacy must be viewed with suspicion, as it ultimately is nothing more than an individual’s right to hide himself, it is precisely that point he misses: that personal integrity does not defend the right of individuals to hide themselves, but instead is a mechanism that expresses confidence in the individual, and thus allows for a universal foundation for trust. Without integrity, no confidence. Confidence requires that we do not have the right to know everything about each other, but that we trust each other even without this right. It is only then we can meaningfully speak of trust. Everything else is a form of risk analysis, a mathematical reduction of confidence to an expected outcome value to be calculated on the basis of previous interactions in a repeated game. It is only when we trust without knowing someone that we build the foundation for sustainable social capital. The great debate that remains after the most recent surveillance scandals – and they are scandals in that their extent shocked us, perhaps more than the existence of the monitoring programme itself – is how we can move out of the impasse of this polarisation. The real question of how we protect our open society remains unanswered and will be no less urgent if we instead devote ourselves to a debate on a false dichotomy between freedom and security – that freedom is the very condition for security and vice versa is obvious, but we lose too often our hold on that realisation in the eagerness to defend one or the other value. How can we justify the measures taken to protect the open society? The first and perhaps most important answer to the question is about the transparency of how the free society chooses to protect itself. All democratic states could easily answer questions about what kinds of monitoring methods they use, to what extent and how they ensure that these methods meet all reasonable requirements of proportionality and legal safety. These are questions that no dictatorship could answer, and thus we can drive a wedge into the horrible arguments that have lately become increasingly common: that there would be no difference between the monitoring programmes in Western democracies and those in dictatorships around the world. Such value-relativism leads possibly to an ironic satisfaction, but also leads to a ‘relativisation’ of thousands of people’s suffering under a surveillance that is not designed to protect an open society, but only to protect a small, limited elite’s claim to power. The transparency of the monitoring should be of a standard, comparable form; it should be accounted for often and in as much detail as is humanly possible – and it should be regularly examined by the parliament, the judiciary and independent third parties. Only through this approach can we ensure that the protection of the open society does not turn into a kind of corrosion of the ideals it espouses. What is lost if we lose personal integrity? It is evident that we would lose the opportunities that we have today to autonomously form an identity. Equally obvious is that we would lose the freedom to form the views that we later want to use against others’, when we exercise our freedom of speech. Privacy is, in both cases, a fundamental prerequisite for the right to one’s own identity and expression. Without privacy, we can hardly develop the individuality that later gives rise to artistic expression, and thus intellectual property rights are also dependent on – the creativity itself depends on – the integrity of a complex chain of causalities. And that is why we find it so difficult to value it, or point to exactly what is damaged if it disappears – it is when it is realised in the loss of these other rights that its real value comes into its own. But we are losing more than that. In a society where surveillance has lost all legitimacy, confidence is also lost in the social system, and the only reasonable answer to this is the development of a new kind of formal lie, built on new technologies and practices that are now no longer aimed at autonomy and identity, but are primarily intended to erect a wall between the watcher’s gaze and the citizen. The integrity that was constructive – that built up other rights and created the conditions for an agile individual – suddenly turns into a defensive mechanism, an integrity that does not hold together, as the word suggests, but instead seeks to hide, conceal and withhold the individual. There is a real risk in the developments that we are witnessing. That we eliminate the constructive integrity that exists in today’s society, a tool for the individual to construct and manage his mask in public (to borrow images from Goffman), and replace it with the caricature of integrity as Posner develops it in his economic analysis: a simple right, whose sole purpose is to give us a license to lie – from the integrity of freedom to the integrity of a lie. This is the offence, the shift, that undefended and indefensible surveillance is driving – an understandable backlash, but one that cannot build the meaningful social capital upon which integrity was built over centuries. The entrepreneur’s ability to start over, the possibility of failing and seeking a new happiness in the relative anonymity that the city allowed, was also due to privacy being a natural part of the social community. It was a sort of prerequisite that we could not know everything about everyone – a given fact about how we organised ourselves into societies. When personal integrity is transformed from an axiomatic social fact to a choice that depends on technology and special precautions so the privacy we enjoy is transformed from being an input value to being a painstakingly constructed defence. The mask appears as just a mask and suddenly the free market’s naive anonymity is turned into a terrifying, conscious and costly masquerade, where trust disappears completely. At the same time there is also a possibility. The development in which individual identity can be freely formed, managed and transformed by technology in, for example, social networking, allows us to develop privacy’s value and its importance in accordance with the core values ??that we want to protect. If we transform the mask from a defensive measure to a tool in a freer process where identity and integrity can be formed differently for different contexts and purposes, we can perhaps strengthen the integrity that is the basis for the open society. The technology is not, in itself, a threat to privacy. It is, of course, a controversial thesis, and it remains to be proven. But there is probably a difference between the horizontal identity that individuals build up between themselves on the open market and the vertical identity that exists between citizens and state. Vertical identity and integrity precede the horizontal – and forestall it. If it is lost or breaks down, no positive identity can be built up thereafter. The vertical identity is primary – that is why the question of monitoring remains central. If monitoring precludes trust by forcing us to hide ourselves, might we also miss out on the security that is based on our trust in society, sharing with us the information and participating in a joint effort to protect the open society? Perhaps the situation is this: what is at risk of being lost in the shadow of surveillance is more than an individual right. It is the social foundation for the open society’s trust, and thus an absolute prerequisite for the security that surveillance supposedly would strengthen. Nicklas Lundblad is a social counsellor at Google and has a PhD in informatics. The views expressed in this article are his own.