The Five Virtues of a General

Sun Tzu, Fushan, and the Person Who Defends Digital Rights

We devoted the first article in this trilogy to strategy. “The Art of War” as a guide for the digital age. Victory through knowledge, not force. Acting from calm, not from anger.

The second — to tools. The HAR file as an evidentiary base. GDPR articles as the legal language for technical facts. The gap between those who see a violation and those who know how to classify it.

This article is about something different. About what kind of person someone should be, to apply all of this. Not what they do. Who they are.

Because strategy without character is a map without a compass. Tools without character are a weapon in the hands of someone who doesn’t know why they’re holding it.

Sun Tzu listed five virtues of a general. Intelligence. Trustworthiness. Discipline. Courage. Humanity.

The great Chan master Fushan added something important to this list. Not just a set of qualities — an understanding of how they connect to one another. How each one, without the others, becomes either useless or dangerous.

“To possess humanity without intelligence is like owning a field and never cultivating it. To possess intelligence without courage is like getting shoots but never weeding them. To possess courage without humanity is like knowing how to reap without knowing how to sow.”

This metaphor is more precise than any modern leadership manual. And it bears directly on what happens when a person decides to defend digital rights — their own and others’ — in a world built against them.

Let’s break down each virtue. Not in the abstract. Concretely.

The First Virtue. Intelligence

Sun Tzu placed intelligence first. Not by accident.

Intelligence isn’t intellect in a general sense. It’s the ability to see a situation as it actually is. Without illusions. Without substituting what you wish were true for what actually is.

In the context of digital rights, intelligence means one specific skill: understanding the system from the inside, not the outside.

From the outside, the system looks like this. There are platforms that provide free services. There’s advertising that funds those services. There are cookies that help make the advertising relevant. All of it is described in privacy policies anyone can read. All of it is lawful, all transparent, all voluntary.

From the inside, the system looks different. There’s an RTB auction that concludes in 100 milliseconds — faster than an eyeblink — in which dozens of companies receive your profile and bid for the right to show you an ad. There’s fingerprinting that identifies you with over 99% accuracy even without cookies, even in incognito mode, even after clearing your history. There are data brokers you’ve never heard of, who hold 1,500 characteristics about you, and who sell access to you hundreds of times a year.

This isn’t conspiracy theory. It’s documented architecture. It’s described in IAB technical specifications. It’s visible in the HAR file of any browser. It’s acknowledged by the companies themselves — in documents they’d rather not put on the front page.

Fushan wrote: “To possess humanity without intelligence is like owning a field and never cultivating it.”

A person who wants to defend digital rights — with the best of intentions, with a genuine desire to help others — but who doesn’t understand how the system they’re trying to change actually works technically — is a field left uncultivated. The energy is there. The intent is there. There’s no result, because there’s no understanding of exactly where to apply the effort.

Intelligence isn’t an innate quality. It’s a practice. Opening a HAR file and working out what’s written there — that’s intelligence in action. Reading the CJEU ruling in Breyer and understanding why an IP address is personal data — that’s intelligence in action. Understanding the difference between Article 13 and Article 14 of the GDPR — and knowing when each applies — that’s intelligence in action.

Intelligence, in Sun Tzu’s sense, isn’t academic knowledge. It’s operational knowledge. The kind that changes the quality of every decision, right now.

The Second Virtue. Trustworthiness

Sun Tzu wrote that trustworthiness lets a general earn the loyalty and obedience of his subordinates. But trustworthiness isn’t just about relationships with people. It’s, first and foremost, about a relationship with the truth.

A trustworthy person says what they’ve verified. Asserts what they can prove. Doesn’t draw conclusions that don’t follow from the facts. Doesn’t exaggerate for effect. Doesn’t simplify into untruth for the sake of clarity.

In the context of publicly working with data on violations, this is a fundamental requirement. Not an ethical one. A strategic one.

The system you’re criticizing has resources, lawyers, and PR teams. One inaccurate fact in a publication, and attention shifts from the violation to the error. The company doesn’t respond to the question of Quantcast firing at +347 milliseconds before consent. It responds to the question of you getting one IP address wrong in one line. And the reader walks away with the impression that everything’s now in doubt.

This is a classic tactic. Discrediting through details. It only works if the details give it grounds to.

Trustworthiness is the defense against this tactic. When every statement is confirmed. When every timing is checked against the HAR file. When every quote from a privacy policy is verbatim, in the original language, with the date it was read noted. When every citation to a GDPR article is precise, not approximate.

Then there’s nothing to attack. There are facts. They’re verifiable. Anyone can reproduce the session in the same browser and get the same results.

But trustworthiness doesn’t only function as a defense against attack. It functions as the foundation of trust.

A reader who read one publication and checked the facts trusts the next one. Not because they blindly believe the author. Because they’ve confirmed the author isn’t deceiving them. This is slow. It takes time. But it’s the only kind of trust that holds up.

Platforms and companies spend enormous sums manufacturing an image of trustworthiness. They hire PR agencies, publish transparency reports, build “our values” pages. This is the fast way to create the appearance of trustworthiness.

Real trustworthiness is built slowly. Through consistency. Through precision. Through refusing to exaggerate even when exaggeration would be more persuasive.

Sun Tzu understood this. A commander who isn’t trusted cannot lead an army. Not because he lacks authority. Because authority without trust is coercion. And coercion is the least effective form of leadership there is.

A person who documents violations and writes about them publicly is operating without an army. All they have is their own reputation. And trustworthiness is the only capital that genuinely matters over the long run.

The Third Virtue. Discipline

Discipline, in Sun Tzu’s sense, isn’t harshness toward others. It’s, first and foremost, demandingness toward yourself.

A commander who is strict with subordinates but not strict with himself loses authority immediately. Because people see the gap between what he demands and what he demonstrates himself.

In the context of defending digital rights, self-discipline means several specific things.

First — don’t publish what hasn’t been verified. Sounds simple. In practice, it requires constant effort. There’s always the temptation to write faster. To share a finding before finishing the analysis. To draw a conclusion from incomplete data, because the conclusion seems obvious.

Discipline says: no. Verify first. Publish after.

Second — don’t draw conclusions that don’t follow from the facts. This is a fine line. A HAR file shows a request went to a server in the US before the user’s consent. That’s a fact. The conclusion: a violation of GDPR Article 6(1) — that’s also a fact, with legal grounding. The conclusion: “the company is deliberately spying on users” — that’s an interpretation of motive. That’s not in the HAR file. Discipline doesn’t let you mix the two.

Third — apply the same standards to yourself that you apply to others. If you’re auditing government sites for undeclared trackers, your own digital footprint has to meet the principles you’re declaring. This isn’t just ethically correct. It’s strategically necessary. Any inconsistency becomes an argument against you.

Fourth — discipline in process. Every step documented. Every date recorded. Every response saved. Not because it’s needed right now — but because six months from now, when a regulator requests additional materials, that documentation will prove indispensable.

Discipline is discipline with no audience. When no one’s watching. When you could cut a corner and no one would notice. And you still don’t cut it.

This is the hardest of the five virtues. Because it produces no immediate result. Its fruits only become visible over the long term. When your materials get cited, because they’re trusted. When a regulator takes your complaint seriously, because your previous ones were flawlessly documented. When a company can’t find a single factual error to attack.

Discipline is an investment with deferred returns. The most reliable investment there is.

The Fourth Virtue. Courage

Courage — a word easy to say and hard to live.

In the context of defending digital rights, courage doesn’t mean heroism in its theatrical sense. Not fiery speeches. Not dramatic gestures. Not public confrontations.

Courage here means something quieter and more demanding.

It’s the willingness to keep going when the system is pressing on your exhaustion. When the company doesn’t respond for three months, and four months, and five months. When the regulator asks for clarifications a third time. When an algorithm shadow-bans content that’s inconvenient for the platform. When people around you say it’s pointless, that you can’t win against big companies, that the system is built so attempts like this don’t produce results.

Continuing, not because it’s easy. Continuing, because it’s right and because the facts are on your side.

That’s courage, in Sun Tzu’s sense.

But there’s another aspect that matters more. Courage to examine what’s uncomfortable to examine.

A government site isn’t an advertising broker no one’s heard of. It’s an agency with resources, a legal department, political connections. Reviewing a government site with concrete documented violations is an action that creates discomfort for specific people in specific positions. They may react. In various ways.

Courage is doing this review anyway. Not out of a desire for confrontation. Out of an understanding that the law makes no exceptions for government agencies. That a citizen who logs in via eID on a government portal deserves the same protection as a citizen using a commercial service. That “government” doesn’t mean “above the law.”

Fushan wrote: “To possess intelligence without courage is like getting shoots but never weeding them.”

This is an exact description of the situation where the knowledge exists, the analysis is done, the violation is documented — but the publication never goes out. The complaint never gets filed. Because it’s scary. Because it’s uncomfortable. Because “better not to get involved.”

The shoots are there. The field is unweeded. There’ll be no harvest.

Knowledge without action isn’t knowledge in the strategic sense. It’s information that produces no result whatsoever. Courage is what turns knowledge into action.

But there’s a balance here that Sun Tzu described very precisely. Courage doesn’t mean recklessness. A commander who attacks without assessing the situation isn’t courageous. He’s reckless. And these are different things.

Courage, in the strategic sense, is action that’s grounded. Where you understand the risks. Where you’ve assessed your position. Where the facts are on your side. Where the law is on your side. And where you act despite the pressure it creates — because grounded action from a correct position produces results over the long term.

This isn’t blind bravery. It’s bravery built on knowledge. The fifth virtue without the first is dangerous. The fourth without the first, too.

The Fifth Virtue. Humanity

This is the most important of the five. And the one most often overlooked in conversations about strategy and tools.

Humanity is the answer to the question: who is all of this for?

Not for defeating an opponent. Not for demonstrating competence. Not for public recognition. Not for view counts.

For a specific person. Who doesn’t know what’s happening to their data. Who clicks “accept all” because they don’t understand what they’re agreeing to. Who thinks a government site is safe by definition. Who doesn’t know their medical searches are visible to Google Analytics on a hospital’s site. Who doesn’t know their voice can be synthesized from three seconds of a social-media video.

That is humanity. Not abstract. Concrete. Directed at a specific person you’ll never meet, but for whom you do this work.

Fushan wrote: “To possess courage without humanity is like knowing how to reap without knowing how to sow.”

A person who knows how to act, who has knowledge and courage, but doesn’t understand who they’re acting for, reaps what they never sowed. Or reaps the wrong thing. Or reaps correctly — but at the wrong time, in the wrong place.

Humanity gives direction to everything else.

It explains why it matters to write plainly rather than technically. Because a technical text is accessible to technical people. A plain text is accessible to everyone. And it’s exactly those far removed from technology who need this knowledge most. They’re the most vulnerable. The least protected. And they least often hear that they have rights at all.

Humanity explains why three audiences matter — the teenager, the adult, the retiree. Because each one has a different point of entry into the subject. A different language. Different fears. Different consequences that hurt them most. One body of knowledge — three languages to convey it.

Humanity explains why a shadow-ban on content about platform surveillance isn’t just a personal inconvenience. It’s a restriction on other people’s access to information they need. It’s grounds to file a request under GDPR Article 22 — not because you personally were harmed, but because thousands of people who could have read this text never got to.

And humanity explains why consistency matters. Not for the sake of your own reputation. Because a reader who’s confirmed you can be trusted will bring this text to their elderly parent, or their teenage kid, or a colleague who asked yesterday why the ads are so precise. And the chain continues.

That’s sowing. Slow. Invisible in the moment. Producing a harvest you won’t always personally see.

But it happens.

The Five Virtues as a System

Fushan didn’t just list five qualities. He showed they only work together. Each one, without the others, is either useless or dangerous.

Intelligence without humanity is expertise without purpose. A person who understands the system better than anyone — but uses that understanding for their own gain, or simply accumulates knowledge without applying it. A field left uncultivated.

Humanity without intelligence is good intent without result. You want to help people — but you don’t understand how the technology harming them actually works. You don’t know what rights they’ve been deprived of. You don’t know how to explain it so they understand. A field left uncultivated, from the other direction.

Intelligence without courage is knowledge that never becomes action. You see the violation. You understand its legal nature. You don’t publish. You don’t file the complaint. Because it’s scary, or hard, or “who even needs this.” Shoots left unweeded.

Courage without humanity is action for its own sake. Or worse — action for the sake of a show. Aggression instead of strategy. Confrontation instead of a precise strike in a precise place. Reaping without knowing how to sow.

Discipline without humanity is paralyzing perfectionism. Never ready enough. Never verified enough. Publication endlessly postponed, because there’s always one more thing to check. The field is dug over, but never planted.

Trustworthiness without courage is reputation with no application. Everyone knows you can be trusted. You never do anything with that trust.

The five virtues work as a system. Remove one, and the system fails. Add all five in the right balance, and something qualitatively different emerges. A person who knows, who trusts themselves and is trusted by others, who is strict with themselves, who acts despite pressure, and who does all of it for the people who need it.

This is a general, in Sun Tzu’s sense. Not a title. Not a position. A character.

About What Can’t Be Delegated

Strategy can be learned from a book. Tools can be mastered through practice. Knowledge of GDPR articles can be accumulated in a few months of careful reading.

Character can’t be delegated. Can’t be borrowed. Can’t be performed convincingly enough, for long enough, that it becomes real.

This is the one thing the system cannot copy. Advertising brokers can buy the best lawyers. Platforms can hire the best technical specialists. Government agencies can bring in PR agencies to manage their reputation.

But they cannot buy consistency. They cannot hire humanity. They cannot fake a self-discipline they don’t have.

That’s exactly why one person with all five virtues is strategically stronger than a team of specialists working from different motives. Not because he’s smarter than each of them. Because he’s whole. And wholeness creates a strength that doesn’t crumble under pressure.

Sun Tzu knew this. His treatise isn’t a manual on tactics. It’s a manual on what kind of person you need to be for the tactics to work.

Applying This to the Digital War, Right Now

There’s a practical question that arises after all of this. How does this apply today. Specifically.

Intelligence is studying the system from the inside. Opening DevTools. Recording a HAR file. Reading one GDPR article a week — not all at once, one at a time — and understanding its specific application. Looking at what an RTB auction is at a technical level. Understanding why an IP address counts as personal data, per the Breyer ruling. Doing this not because there’s an exam to pass — but because it changes the quality of every subsequent decision.

Trustworthiness is checking before asserting. Every time. No exceptions. Cross-checking against the HAR file before writing down a timing. Reading a privacy-policy quote verbatim before paraphrasing it. Not writing “they’re deliberately violating this” — writing “a violation was documented.” A small difference on the surface. Enormous in substance.

Discipline is documenting everything. The date of the request. The date of the response, or its absence. A screenshot of the page with the date. A HAR file with timestamps. Not because it’s needed right now. Because six months from now, it becomes the evidentiary base.

Courage is acting despite the pressure the system creates. Publishing a government-site review when it’s ready — not when it “feels safer.” Filing a regulatory complaint once the violation is documented — not waiting for someone else to do it first. Continuing when a company stays silent for a month, two months, three — and recording that silence as a violation in its own right.

Humanity is remembering who this is for. Not abstractly. Specifically. The elderly person who was called by a voice imitating their grandson and wired money. The teenager whose psychographic profile has been built since age six, through educational platforms the school itself recommended. The citizen who logged into a government site via eID and never knew their data went to Google in that moment. The woman who visited a domestic-violence support site and never knew that visit was recorded by advertising trackers.

These are real people. With real consequences from real violations. When you remember this, every action gets its proper scale.

One Last Thing. About Victory That Doesn’t Look Like Victory

Sun Tzu wrote about victories that don’t look like battles. About results created not in the moment of conflict — but long before it, during preparation, during the building of the right position.

The five virtues are exactly this: the building of the right position. Every day. With no audience. With no immediate result.

15,000 views a month under a shadow-ban isn’t an accident. It’s the result of the content being real. Of the facts being verified. Of the author being consistent. Of work standing behind every word, not a declaration.

Twenty-plus active cases aren’t the result of one decision. They’re the result of every previous case being handled with the same discipline as the next. Of every HAR file being saved. Of every date being recorded. Of a company’s silence being documented as a violation in its own right.

This is the five virtues in action. Not in theory. In real work. Every day.

The great Chan master Fushan lived in the 17th century. He wrote about generals and armies. About the China he knew.

But what he described is a universal principle about a person who wants to change something in a world built against them. And about the fact that the only way to do it is to become someone who holds all five virtues at once. Not three out of five. Not four. All five.

Because only then will the field be cultivated, the shoots weeded, and the harvest gathered at the right time.

This is exactly what Sun Tzu taught.

This is exactly what Fushan meant.