The Art of War in the Digital Age

There’s a book that’s two and a half thousand years old. It was written by a Chinese strategist named Sun Tzu, believed to date to the 5th century BC. It’s short — thirteen chapters, a few thousand characters. It’s studied at the military academies of West Point and Saint-Cyr. It’s read at the business schools of Harvard and London. Lawyers, negotiators, intelligence officers, and politicians cite it.

It’s called “The Art of War.”

Not metaphorically. Literally. Because what Sun Tzu described two and a half thousand years ago — the asymmetric conflict between the one who knows and the one who doesn’t, between the one who’s calm and the one governed by emotion, between the one who acts strategically and the one who reacts impulsively — is exactly the structure of the conflict between a person and the data-collection system of the 21st century.

The system knows everything about you. You know almost nothing about the system. The system acts calmly, methodically, without emotion. You react — with irritation, with exhaustion, with helplessness, sometimes with anger.

That’s exactly what the system is counting on.

Sun Tzu wrote: “He who is skilled in combat does not give way to anger. He who is skilled in achieving victory does not give way to fear.”

This isn’t a moral lesson. It’s tactical guidance. And it works in 2026, and will keep working, just as precisely as it worked in the 5th century BC.

First. A War You Never Declared

Sun Tzu opens the treatise with a simple idea: “War is the way of deception.”

Not brute force. Not superior numbers. Deception. Whoever can prevent the opponent from understanding what’s happening has already won before the battle begins.

Look at how the data industry is built through this lens.

You go to a website. You think you’re reading the news, or buying tickets, or checking the weather. You don’t think you’re taking part in a conflict. You don’t think that, right at this moment, dozens of companies you’ve never seen are receiving data about you, building your profile, selling access to you at an auction that closes faster than you can blink.

The war is already underway. You just don’t know it.

This is exactly “the way of deception,” applied to the digital age. Not lying in the crude sense — though that too is present, when a privacy policy says “we don’t share data with third parties” and a HAR file shows forty-seven outbound requests. But above all — the invisibility of the conflict itself. The person doesn’t know they’re a participant. Doesn’t know there are rules. Doesn’t know they have rights.

Ignorance is the system’s first weapon. And its most effective one.

Sun Tzu: “He who knows the enemy and knows himself will win a hundred battles. He who knows himself but not the enemy will sometimes win, sometimes lose. He who knows neither himself nor the enemy is doomed to defeat in every battle.”

Most people online fall into the third category. They know neither themselves — their rights, their data, their digital footprint — nor the enemy — how the technology works, who receives the data, what happens to it.

Informing people isn’t education for the sake of a nice gesture. It’s a strategic necessity. The first step toward moving from the third category to the first.

Second. Emotion as the Weakness That Gets Exploited

“In ‘The Art of War,’ emotion is defined as the primary cause of defeat.”

This isn’t Eastern philosophy about detachment. It’s a specific tactical observation. A commander driven by anger makes decisions that benefit the opponent, not himself. A commander driven by fear fails to act when action is necessary. A commander driven by vanity takes risks the situation doesn’t warrant.

Carry this into the context of digital warfare.

The data-collection system deliberately produces specific emotional states in users. This isn’t a side effect — it’s an architectural choice.

The cookie banner is designed to produce irritation. A small gray “decline” button, a large green “accept all” button, three settings screens if you try to sort it out yourself. An irritated person clicks “accept all” just to make it stop. This isn’t accidental — it’s the result of A/B testing optimized for the maximum number of acceptances.

The social-media feed is designed to produce anxiety, anger, envy. Not because anyone wants to make you unhappy. Because an anxious, angry person spends more time on the platform. More time — more data. More data — a more valuable profile. A more valuable profile — more money in the ad auctions.

Your emotions are a commodity. They’re manufactured deliberately, sold deliberately, exploited deliberately.

And in this context, Sun Tzu’s words read like an instruction manual.

“He who is skilled in combat does not give way to anger.”

A person who reads about surveillance and flies into a rage is doing exactly what the system is counting on. They react emotionally — and don’t act. Or they act chaotically, impulsively, without strategy. They write an angry comment. They delete one app and install another that does the exact same thing. They tell their friends “it’s all terrible” — and keep clicking “accept all,” because exhaustion won out.

A person who reads about surveillance and stays calm starts to act. Opens the HAR file. Reads the privacy policy with a specific question in mind: “where’s the Article 13 violation here?” Writes an Article 15 request. Notes the date it was sent. Waits thirty days. Notes the absence of a response. Files a regulatory complaint.

This isn’t heroism. It’s methodology. Calm, consistent, effective.

Third. Victory Without Battle — the Highest Art

“The wise win without engaging in warfare, while the ignorant fight in order to win.”

This is, perhaps, Sun Tzu’s most famous idea. And the most often misunderstood.

It’s interpreted as a call for pacifism, or avoidance of conflict. That’s not it. Sun Tzu isn’t proposing to avoid conflict. He’s proposing to resolve it before it becomes a matter of force. Through knowledge. Through position. Through creating a situation in which the opponent makes his own mistake or withdraws on his own.

In the context of digital rights, this sounds like this.

A person who understands their rights and knows how to apply them doesn’t need a lawsuit to achieve a result. A properly drafted request under GDPR Article 15 — citing specific identifiers, with exact dates, with references to the violated provisions — creates a situation in which it’s easier for the company to fix the violation than to explain it to a regulator.

This is victory without battle. Without a lawsuit. Without a media scandal. Without years of proceedings.

In 2014, Gonzalo Fuentes didn’t sue Google. He filed a complaint with the Spanish regulator. The Spanish regulator requested Google’s position. Google refused. The regulator referred the matter to the CJEU for clarification. The Court issued its ruling. It became the right to be forgotten for 450 million Europeans.

One person. One complaint. No anger, no army of lawyers, no media campaign.

Victory through knowledge, not force.

The Austrian activist who complained about the use of Google Analytics didn’t organize a boycott of Google. Didn’t create a petition. He wrote a complaint to the Austrian regulator with a precise description of the violation. The Austrian regulator found that the use of Google Analytics violated the GDPR. A wave of similar rulings followed across Europe. Hundreds of thousands of sites were forced to change their analytics tools.

This is exactly “victory without engaging in warfare,” in Sun Tzu’s sense. Not passivity. A precise action, in a precise place, that creates a systemic effect.

Fourth. Know the Enemy. Fully

Sun Tzu placed enormous emphasis on intelligence. Not as a supporting function — as the foundation of all strategy. “The enlightened ruler and the wise general conquer the enemy whenever they act — their achievements surpass those of ordinary people — because they possess foreknowledge.”

Foreknowledge. Not knowledge acquired after something happened. Beforehand.

In the context of data, this means: understanding the system before it has processed you. Not after you’ve noticed the ads are too accurate. Not after you’ve been denied a loan for reasons you don’t understand. Before.

What does it mean to know your enemy in the digital war?

Knowing how an RTB auction works. Understanding that the moment any page with advertising loads — within 100 milliseconds — dozens of companies receive your profile and bid for the right to show you a banner. This isn’t paranoia — it’s standard advertising-industry architecture. It’s documented. It really works exactly this way.

Knowing what fingerprinting is. That even without cookies, even in incognito mode, even after clearing your history — your browser has a unique combination of characteristics that identifies you with over 99% accuracy. Browser version, screen resolution, installed fonts, GPU behavior — all of it together creates a fingerprint that doesn’t change until you switch devices.

Knowing who the data brokers are. That Acxiom holds profiles on 2.5 billion people — a third of Earth’s population. That there are, on average, 1,500 individual data points per person in the database. That these profiles are sold hundreds of times a year to different buyers — insurance companies, banks, advertisers, employers, government agencies.

Knowing what a HAR file is and what’s written in it. Because that’s exactly where everything the system does in real time is recorded. Not what it declares in its privacy policy. What it actually does.

This is foreknowledge. Reconnaissance before the battle.

Without it — you’re in Sun Tzu’s third category. Knowing neither yourself nor the enemy. Doomed.

With it — you’re in the first. Able to act precisely, without wasted motion, with a predictable result.

Fifth. Position Matters More Than Strength

“A skilled warrior puts himself in a position where defeat is impossible, and doesn’t miss the moment to defeat the enemy.”

This is one of Sun Tzu’s key concepts. Not superior resources. Not numerical advantage. Position. The right place, at the right moment.

In the digital war over data, position comes down to one word. Consistency.

A person whose words match their actions, and whose actions match their principles, occupies a position that’s extremely difficult to attack. They have no vulnerabilities for the system to exploit — no gaps between what they say and what they do, no contradictions that can be used against them, no fears that can be triggered.

The surveillance system controls people through gaps. You say you value privacy — but you click “accept all.” That’s a gap. The system exploits it. You say you don’t trust platforms — but you keep uploading photos to an American corporation’s cloud. That’s a gap. The system uses it.

A person without gaps is an inconvenient target for the system. They can’t be controlled through fear, because there’s nothing to hide. They can’t be controlled through vanity, because they don’t need the algorithm’s approval. They can’t be controlled through exhaustion, because their actions are consistent — they don’t require overcoming themselves anew each time.

This isn’t idealism. It’s strategy.

Palantir, predictive-analytics systems, risk-scoring algorithms — all of them search for gaps. Discrepancies between what a person declares and what they actually do. That’s exactly where the system finds its points of entry. That’s exactly where it builds its behavior-prediction models.

A person with no gaps leaves the system nothing but a pattern of consistent behavior. That pattern is predictable. But predictability, in this case, isn’t a vulnerability. It’s a strength. You do what you say, you say what you think, you think what you believe. The algorithm can predict this — but it can’t control it through it.

Sun Tzu called this “the invulnerable position.” Not because you’re invisible. But because you have no weak point to attack.

Sixth. Speed and Timing

“In the art of war, speed matters. Use what the enemy hasn’t used. Go where he doesn’t expect. Attack where he isn’t ready.”

The surveillance system is inert in one sense. It responds slowly to legislative pressure. Between a rule being adopted and it actually being enforced, there’s always a window. Companies stall. They wait for precedents. They hope the regulator won’t check them specifically.

This window is the moment to act.

The GDPR took effect in 2018. Most sites still violate its consent requirements. Not because they don’t know the law. Because they’re betting the probability of them specifically being checked is low. That most users don’t know their rights. That even those who do won’t bother filing a complaint.

A person who knows the law, has the technical skills to document violations, and acts — is using exactly this window. They attack where the opponent isn’t ready. Not because they have more resources. Because they act, while most don’t.

The AI Act took effect in 2024. Its requirements on recommender systems and algorithmic transparency are only starting to be applied. This is a new window. A new moment. Companies haven’t yet developed standard responses to complaints under this law. Regulators haven’t yet built up settled practice. Precedents are still being made.

Right now, one person’s actions can become the precedent for thousands.

Right now, a complaint with precise legal classification under a new law carries maximum weight. Because the system hasn’t yet built up an immunity.

Sun Tzu called this “the swiftness of water” — water has no fixed shape, it finds a path through any obstacle, it moves where there’s no resistance. Precise action at the precise moment is the strategy of water. Not a frontal assault on fortified positions. Movement toward the opening.

Seventh. Spies and Information. Whoever Knows, Wins

Chapter thirteen of “The Art of War” — the last, and, in the view of many scholars, the most important. It’s devoted entirely to intelligence. Sun Tzu wrote about five types of spies, about the importance of information, about how no numerical superiority compensates for ignorance.

“The enlightened ruler and the wise general conquer the enemy whenever they act — because they possess foreknowledge. Foreknowledge cannot be obtained from spirits, cannot be deduced from analogies with the past, cannot be obtained through astrological calculations. It must be obtained from people who know the enemy’s actual situation.”

From people who know. Not from abstraction. Not from assumption. From concrete knowledge of a concrete situation.

In the context of digital warfare — this is knowledge of exactly how a specific system works. Not “platforms surveil us” in a general sense. But: on this specific site, at this specific moment, this specific request went out to this specific server in the US, with status 200, before the consent banner appeared, and here’s exactly why that violates GDPR Article 6(1).

This is foreknowledge, in Sun Tzu’s sense. Concrete. Verifiable. Actionable.

Auditing sites through a HAR file is reconnaissance. In the literal sense of the word. You enter the opponent’s territory, quietly, leaving no trace — incognito mode, a clean session — and document everything happening there. Then you leave. And you have the data.

This data isn’t for personal satisfaction. It becomes the basis for a complaint. For a public review. For building a database of patterns. For understanding the system at a level that allows you to predict its behavior.

Sun Tzu valued spies above everyone else. “There is no place where espionage is out of place. There is no undertaking where spies are not useful.”

The HAR file is a reconnaissance tool. Open. Free. Built into every browser. Used by a handful of people — because most don’t know it’s there.

Eighth. There’s No End Without Victory. But No Victory Without Strategy

Sun Tzu was a realist. He didn’t promise that knowledge guarantees victory in any specific battle. He spoke about systemic advantage. About how the right strategy, applied consistently, produces over the long term a result impossible for someone acting chaotically.

“A victorious army wins first, and then goes into battle. A defeated army goes into battle first, and then tries to win.”

This describes the difference between two approaches to defending digital rights.

The first approach — reactive. A person learns their data leaked. They get angry. They try to do something. Don’t know what exactly. File a complaint with no evidentiary base. Get a boilerplate response. Get tired. Give up.

That’s “going into battle first, then trying to win.” No preparation. No knowledge. No strategy.

The second approach — proactive. Understanding how the system works before it’s touched you. Knowing your rights before they’re violated. Knowing how to document a violation before it’s become irreversible. Knowing where to file and exactly how to write the complaint before you start writing.

That’s “winning first, then going into battle.” Victory is achieved at the level of preparation. The battle itself is already a formality.

That’s exactly why informing people isn’t an abstract noble goal. It’s creating the conditions for the second approach. A person who’s read and understood how an RTB auction works has already taken the first step toward a position from which victory is possible. A person who knows what a HAR file is and how to read it has taken the second step. A person who knows the five key GDPR articles and how to apply them to a specific situation is ready.

Ready doesn’t mean they’ll necessarily file complaints. Maybe they’ll just click the buttons differently on cookie banners. Maybe they’ll tell their kids about it. Maybe they’ll write one Article 15 request someday — and be surprised they got an answer.

Everyone does this at their own scale. Sun Tzu wasn’t demanding everyone become a general. He was talking about principles that work at any scale.

Ninth. About Strength That Requires No Demonstration

“Keep your friends close, your enemies closer.”

This phrase is often attributed to Sun Tzu — though it doesn’t appear in exactly this form in the original text. But the principle is present. Know what’s happening around you. Observe. Not from a position of fear or hostility — from a position of being informed.

In the context of data, this means: don’t avoid the system hysterically, but understand it from the inside. Don’t delete every account in a panic — but know exactly what they know about you. Request your data under Article 15. Look at what’s there. This isn’t just a legal tool — it’s reconnaissance. You see exactly what the system has collected about you. And that changes how you approach every subsequent interaction.

A person who’s seen their profile in Google Takeout — who’s seen the history of every search query for years, every place they’ve been with location on, every video they’ve watched — that person relates differently to the next app permission request. Not out of fear. Out of understanding.

Understanding is exactly the “closeness to the enemy” Sun Tzu described. Not naive closeness. Deliberate.

Tenth. Whoever Doesn’t Give Up Changes the Rules for Everyone

Sun Tzu wrote about war between armies. But his principles work at any scale of conflict — because they describe not the specifics of warfare, but universal patterns in the clash of wills, knowledge, and strategies.

The history of digital-rights protection in Europe is a history of people who applied these principles, often without knowing they were following Sun Tzu.

They didn’t act out of anger. Out of calm understanding that the violation was documented and that the law was on their side.

They didn’t seek an immediate win. They built a position from which victory became possible.

They weren’t stronger than the system in resources. But they knew the system better than the system knew that they knew.

And they didn’t give up when it got hard.

“The system is counting on you giving up” isn’t a metaphor. It’s literally an architectural choice. Long privacy policies are written so you won’t finish reading them. Cookie banners are designed so you’ll click “accept” rather than sort it out. Opt-out processes are made inconvenient on purpose, so most people stop at the first step.

This is Sun Tzu’s “way of deception,” applied to protecting a business model. Create enough obstacles that the opponent tires before reaching the goal.

The only answer to this strategy is consistency. Not a sprint. A marathon. Not one loud gesture. A series of quiet, precise actions, each adding a brick to the foundation.

One Article 15 request. Note the response. One site review with a HAR file. Publish it. One regulatory complaint. Note the outcome. The next request. The next review. The next complaint.

This doesn’t look like a war. Exactly why the system isn’t ready for it as one.

“The wise win without engaging in warfare” — victory through methodicalness, through knowledge, through consistency. Not through force, and not through anger.

Sun Tzu wrote this two and a half thousand years ago.

It still works.

Afterword. About the Inner War That Matters More to Win

There’s one thing Sun Tzu emphasized consistently throughout the treatise. Victory over an external opponent is impossible without victory over an internal one. Over one’s own anger. Over one’s own fear. Over one’s own vanity. Over one’s own exhaustion.

This isn’t a spiritual lesson about personal growth. It’s a pragmatic observation that a commander who doesn’t control his own states makes decisions that reflect his states, not the reality of the situation.

A person working to defend digital rights runs into this constantly. Companies don’t respond for months — and irritation builds up inside. A regulator asks for additional materials a third time — and exhaustion sets in. A publication gains traction despite a shadow-ban — and there’s a temptation to move to louder gestures, to rhetoric, to emotions that will grab more attention, faster.

Each of these states is a point of vulnerability. A moment when a decision gets made out of reaction, not out of strategy.

Calm isn’t passivity. Isn’t indifference. It’s an active state that requires practice. It’s a choice you have to make again, every time — before writing a response to a company that’s ignored a request for four months. Before publishing a review of a government agency’s site. Before deciding on the next step in a case that’s moving slowly.

Sun Tzu: “Defeat yourself, and you’ve defeated the enemy before he even knew it.”

15,000 views a month under a shadow-ban. Twenty active GDPR cases with the regulator. Reviews of government sites. Articles people read twice.

This is the result not of anger. Not of vanity. Not of fear. It’s the result of the methodical, calm, consistent work of a person who knows what they’re doing and why.

Two and a half thousand years ago, Sun Tzu wrote a manual for generals.

It turned out to be a manual for everyone who chooses knowledge over ignorance, action over reaction, and consistency over impulse.

Regardless of the scale of the battlefield.