First Step: Frighten the Person

When the unimaginable happens

September 11, 2001 shook the United States and much of the world. Almost overnight, the security paradigm changed.

On October 26, 2001, only six weeks after the attacks, the USA PATRIOT Act was signed into law. The official title of the Act itself states its purpose: to strengthen tools for interception, investigation and the prevention of terrorism. The law substantially expanded the state's investigative and intelligence powers.[1]

Later, the U.S. Privacy and Civil Liberties Oversight Board also documented the bulk telephone-records collection program under Section 215 of the PATRIOT Act and specifically examined its consequences for privacy and civil liberties.[2] The following year, the Homeland Security Act created an entirely new Department of Homeland Security. The department opened in March 2003 and brought together a large part of the federal security apparatus into a structure that had not existed in that form before the attacks.[3] This matters. Not because these documents prove who caused September 11. We do not need that here at all. They prove something else: a major trauma can alter the relationship between citizen and state in an extraordinarily short period of time.

What was politically difficult to imagine on September 10 became possible a few weeks later as a response to a new threat. And once new infrastructure is built, the world very rarely simply returns to the previous point.

Fear does not require a dictator. That is one of the most dangerous misunderstandings about the loss of freedom. People imagine that someone has to steal their freedom from them. In a crisis, they often surrender it themselves. Not because they are stupid. Not because they love authority. But because they are afraid. If you believe the next bomb could be on your plane, additional screening will look like a small price to pay. If you believe a deadly disease can spread from person to person, restrictions on movement, gatherings or entry will look different than they do in normal times. If you believe the country is facing military attack, you will accept a degree of centralisation, surveillance and secrecy that would have seemed dangerous a year earlier.

This is not a secret of human psychology. It is its logic. When the danger feels great enough, a person stops asking how much power they are giving away. First they want to survive.

Then came the pandemic

COVID-19 showed the same mechanism in a different setting and on a global scale. States restricted movement, border crossings, gatherings and other activities for public-health reasons. In the European Union, the EU Digital COVID Certificate was created, linking vaccination, test or recovery status with easier cross-border travel at a time when countries were restricting movement. The European Commission states that more than 2.3 billion certificates were issued.[4] This was infrastructure that had not existed in everyday European life only a few years earlier. It was established very quickly because a crisis existed. And here the story becomes particularly interesting.

The EU Digital COVID Certificate Regulation was extended for one year in June 2022[5] and did in fact expire on June 30, 2023.[4] That is important to acknowledge. Not every crisis instrument lasts forever. But the next day, on July 1, 2023, the World Health Organization adopted the technical framework of the European system as the first building block of its Global Digital Health Certification Network. The European Commission explains that the system is intended over time to support additional types of digital health documents as well.[4] Look at the pattern. A temporary legal regime can disappear. The technical infrastructure, standard, expertise and institutional practice can continue living in a new form.

That is far more important than the simple question of whether a particular crisis measure formally expired.

This is how the boundary of normality moves. That is the essence of the first step. Before a crisis, many ideas would seem excessive. During a crisis, they become necessities. After a crisis, they may disappear, remain, or transform into something new. But society has already proved that it can live with them. The first time is the hardest. The second time, a precedent already exists. The third time, the infrastructure exists. The fourth time, people barely remember that things were once different. The boundary of normality does not move a hundred metres at once. It moves centimetre by centimetre.

“Only temporary” is one of the most powerful phrases of authority. Almost no major crisis measure is sold as: you will have this forever. It is sold as an exception. As a temporary solution. As a bridge back to normality. And sometimes it really is temporary. But the crisis itself can create laws, institutions, databases, technical standards, personnel, contracts, new expectations and a new definition of what is politically permissible. That is why the question must never be only: When will this measure be abolished? We must also ask: What will remain after it? Which law? Which institution? Which database? Which infrastructure? Which standard? Which habit?

Which precedent? And above all: which boundary that was untouchable yesterday became negotiable today?

What if crisis becomes a method of governance?

Here we reach territory where a document alone cannot provide a final answer. What if modern society gradually becomes accustomed to living from one emergency to the next? Terrorism. Financial collapse. Pandemic. War. Energy crisis. Climate emergency. Cyberattack. The next disease. The next threat. Each can be real. Each can require a real response. But if each one also moves the state, technology and society one step further toward greater control, then a second question becomes almost more important than the origin of any individual crisis: where is the sequence of responses taking us? Perhaps the greatest danger is not that every crisis is planned.

Perhaps it is enough that the system has learned how effectively a crisis can be used. And what if power, industry, bureaucracy and technology then do what systems almost always do — use the opportunity to expand their reach? There is no need for one room in which ten people sit and plan the next disaster. It is enough that each crisis rewards the expansion of the same type of infrastructure.

First, you have to be afraid

Because a frightened person does not first ask: What will this mean in ten years? They ask: Will this protect me today? And between those two questions, an enormous amount of freedom can be lost. That is why the first step on the road to total control is not digital identity. It is not digital money. It is not a camera. It is not artificial intelligence. It is not an implant. The first step is much older and much simpler. Fear. Because only when you frighten a person enough may they begin asking for the very system they would have fought against in peaceful times. And once the first boundary has moved this way, the second step becomes easier. Because frightened people do not seek only protection. They also seek someone to blame.

And this is where the next stage of the road begins: Divide Them.