Panopticon Emergency Management and the Chilling Effect of Surveillance

Written July 2020, revised 2026.
Written during the first wave of pandemic contact tracing, when emergency powers were expanding faster than the oversight around them. The argument — that surveillance changes behaviour whether or not anyone is watching — is the reason we treat collection scope as a design constraint rather than a setting.

Jeremy Bentham’s panopticon is a symbol of surveillance, and has been a notorious architectural, disciplinary and philosophical concept for years. Essentially it was designed to coerce prisoners into adjusting their own behavior through the perception of constant surveillance. Bentham envisioned this morphology as a “new mode of obtaining power of mind over mind,” as the quite literal “looming” threat of constant surveillance, would have a chilling effect on a prisoner’s state of mind.

As a metaphor, Bentham’s ‘panopticon’ has been used as a way to trace the surveillance tendencies of disciplinarian societies. More recently the term ‘panopticon’ has been commandeered by a seemingly never-ending supply of memes all playing off a collective anxiety over digital surveillance by corporate advertisements tailored to our specific Google searches and Amazon shopping history. Though customers have become more digitally savvy and protective over their digital privacy, in times of crisis it is not uncommon for citizens to forgo privacy for the sake of safety, or of being better informed. However, the recent global lockdown also revealed the emergence of trends and technological capabilities that have the capacity to shape our modern conception of digital privacy rights. Without carefully understanding these capabilities and ensuring proper safeguards we risk giving tacit approval to a new panoptical model that could have a chilling effect on a citizen’s digital voice.

The Architecture of Surveillance

The phrase, “health preserved-industry invigorated” is not the new marketing campaign slogan for the iWatch in a post-COVID era, but rather some of Bentham’s own words on the panopticon. Through the perception of constant surveillance, Bentham believed all citizens could be altered. “Morals would be reformed, health preserved, industry invigorated,” and so on — as we would be all subject to observation. The topology of Bentham’s panopticon was quite simple. Bentham envisioned a central tower surrounded by cells. In the central tower are the guards. In the cells are prisoners. The tower shines bright light so that guards are capable of being able to see any prisoner in any of the cells. The light also serves the dual purpose of preventing the prisoners from seeing the guards. Thus, prisoners have no concept on the number, motives or focus of the surveillance, -and therefore have to assume that they are always under observation. In many ways the panopticon was a manifestation of Bentham’s belief that power should be visible and unverifiable.

The French philosopher Michel Foucault modernized the concept of the panopticon in his 1975 book Discipline and Punish. Foucault used a panoptic model as a way to illustrate the proclivity of societies to inadvertently chill the behavior of its citizens through asymmetrical surveillance. As Foucault put it, “He is seen, but he does not see; he is an object of information, never a subject in communication.” As a consequence, this arrangement has a chilling effect on a citizen’s authentic behavior. The citizen, fearing what surveillance might produce, begins to police himself — and in doing so chills the authentic responses that make up his own freedom.

Hyper-normalizing Surveillance

In a post-Snowden era, aspects of government surveillance programs came to look almost panoptic, if not to feel that way. However, corporations stand to make enormous amounts of money capitalizing on our digital footprint to which, our personal privacy is often seen as an inconvenient obstacle. The growing interconnection between objects in our homes, cars and cities has only exacerbated the erosion of our digital secrets. We’ve seen it in sponsored ads on your social profiles when something you recently searched starts populating your social feeds not too long after; it’s how the most powerful algorithms online function and update at rapid paces. Social media plays a role in speeding up the erosion as well. From tweets to posts, our data is being captured by these applications and fed back to us through marketing campaigns designed to speak to our inner selves. But these campaigns are not secret. Everyone seems to understand and agree, at least on some level, the trade of using these platforms for outreach, communication and establishing a social platform. But what about trading our digital privacy for safety?

As technology continues to evolve, there is an overwhelming movement to apply cutting-edge capabilities to problems thrown up by a crisis. The COVID-19 pandemic showcased some of the most promising technological trends arguably in the last decade. The rush to productise some of them was not without controversy. For instance, if you’ve been online during COVID-19, you’ve likely seen the controversial articles and discussions circling COVID-19 cell phone tracking. A process where governments on a global scale are tracking travel patterns, social distancing, and even contact tracing. In another example, the Australian government launched a smartphone app called COVID-Safe to find and alert the contacts of people infected with COVID 19. Prime Minister Scott Morrison made a hard sell to the public. “The more people who download this important public health app … the sooner we can safely lift restrictions and get back to business and do the things we love,” he said in a 26 April press release. Two million people downloaded it in the first 24 hours it was available. Both of these solutions have the potential to save lives. However, what work has been done to safeguard the sensitive data collected from these applications? To answer this, it is important to understand the underlying architecture behind these applications. In a recent Forbes article, contributor Zak Doffman stated, “The stream of coronavirus infection maps has been joined by social distancing maps — and that’s all based on mobile data and tracking.” The safeguards attributed to third party applications that leverage social distancing maps rely on primary vendors to have security framework in place. Unfortunately, these frameworks are sometimes missing or clearly misunderstood.

Beyond mobile-data tracking, the harvesting of Biometric data has also become a tool to combat the virus. In China, tablets affixed to the back of bus drivers’ seats record passengers’ body temperatures and take snapshots of their faces. The photos are used later for contact tracing if a passenger tests positive for coronavirus. The Chinese company Wisesoft claims to have developed and deployed a 3D facial recognition application that can identify people wearing masks with 98% accuracy in addition to collecting body temperatures. And most recently in the US, threat-detection companies began offering “Fever Detection COVID19 Screening Systems” which deploy artificially intelligent thermal cameras to detect fevers and alert customers to the presence of someone who may be carrying the coronavirus.

While surveillance applications such as COVID-19 mobile-data tracking or biometric data analysis are designed to monitor and minimize the spread of the virus, the public is only now finding out the potential fallout in terms of data leakage and cyber security threats. Additionally, we are also only now beginning to understand potential abilities of digital surveillance technology and where deployment of that technology may come in conflict with our digital rights and privacy. It’s safe to say that the concept of Panopticism hasn’t ended with a prison and a single watchtower. In fact, as time goes on and technology continues to evolve, so does the disciplinary theory. Today, panopticism expands to the digital world, as innovative technologies have made mass digital surveillance not merely possible but imminent; and, it’s not just as simple as surveillance cameras around each corner. A digital panopticon is an invasive concept that not only continually monitors society’s behaviors, but accesses data and information instantly from just a simple web search, social media profile or emergency management application. Normalization in this way can have unintended negative results. The threat of digital exposure, even on a subconscious level, limits what a digital citizen is willing to advocate for. In this way hyper-normalizing surveillance of our digital footprint may limit our ability to safely develop, discuss, and potentially act on assertions that may have true democratic value.

Transparency and Data Governance

To mitigate the adverse effects of data and privacy infringement, transparency on government programs through data governance is critical. Data governance manages the availability, usability, integrity, and security of data in enterprise systems. An effective data governance system is especially necessary during a time of crises to ensure that all data is consistent, trustworthy, and doesn’t get misused. Such a system has explicit goals of utilizing more accurate analytics and blocks the potential for the misuse of personal data and other sensitive information.

Despite the scale of the public-health crisis posed by COVID-19, data stewards, chief information officers and privacy enforcement authorities have a key role to play in providing clarity on existing privacy and data protection frameworks. CIOs may need to offer innovative and forward-looking solutions, particularly when it comes to important questions of deletion and retention of personal data, and the potential limitation of government access. In many places this is already taking place. The United Kingdom Information Commissioner’s Office has, for example, announced that it will recognize the urgent public interest in the application of its data protection law and enable data controllers to balance their obligations with their capacity to respond to subject access requests.

As we have seen, there appears to be an increasing trend towards the use of more invasive collection, processing and sharing of large-scale personal health and location data to contain the spread of COVID-19. While some of these measures may prove to be necessary in helping contain the outbreak, CIOs and data privacy officers should ensure these tools are implemented with full transparency, accountability and a commitment to swiftly cease or reverse exceptional uses of data when the crisis is over. Some guidelines are:

• Organizations should consult data privacy officers and data stewards who have the tools to understand what data is sensitive, what safeguards exist, and which applications those datasets support.
• CIOs should be able to address regulatory uncertainty around logging, auditing and compliance frameworks; data catalogs should be updated to include data sensitivity, compliance frameworks which support and protect the sharing of personal information.
• Enterprises should adopt privacy-preserving solutions for data access and sharing and, where appropriate, be transparent and accountable for all actions they take in response to the crisis.

Governments should support the engagement and participation with a wide range of stakeholders, vendors and technology experts with a view to ensuring that the collection, processing and sharing of personal data serves the reasonable expectations of individuals whose data they safeguard.

What we built from this. DeepWatch treats collection as a governed act: data is meaningfully targeted, selectively acquired inside a declared perimeter, filtered for insight, and aggregated into one canonical shape. The perimeter is declared because an undeclared one is exactly the panopticon this essay describes. Explore DeepWatch.

An earlier version of this essay was published on Medium in July 2020. This version has been revised.