From the living person to the digital architecture of Citizenstar
The person behind the profile
A person enters the digital world in fragments. A name opens an account; a document establishes age or nationality; a password grants access; a message, purchase or journey becomes part of a behavioural history. Modern law gathers these fragments under the broad category of personal data, which includes information capable of identifying a living individual directly or indirectly. It also recognises profiling: the use of data to evaluate or predict aspects of a person’s work, finances, health, preferences, reliability, behaviour or movements.
Each fragment may be accurate and useful. Their accumulation, however, produces a representation that can begin to act upon the person it describes. A profile can determine what someone is shown, what price is offered, whether a transaction appears suspicious or whether access is granted. The question of privacy therefore begins before secrecy. It begins with the relation between a living agent and the informational image that increasingly speaks in that agent’s name.
This is the question that gives Citizenstar its philosophical purpose. If a digital network is to carry communication, identity, memory and value, it must decide whether those elements belong primarily to the system that records them or to the human being whose life they express. Aristotle’s account of the soul supplies a precise language for framing what is at stake — not as an exercise in ancient philosophy, but because it identifies something that contemporary digital architectures routinely overlook. For Aristotle, the soul is not a detachable object housed inside the body; it is the first actuality of a natural organised body possessing life potentially — the living activity through which a person perceives, deliberates, desires and chooses. If the soul just is that activity, then wherever that activity leaves traces — in browsing habits, purchase histories, communications, movements — something intimately connected to the person’s inner life is being captured. The digital environment has produced what may be called a digital soul: the comprehensive behavioural image assembled from the totality of a person’s online activity, an image that increasingly substitutes for the living person in the judgements that institutions, algorithms and commercial platforms make about that person. The question Citizenstar poses is whether an architecture can be built that allows verified persons to participate in digital life without surrendering the behavioural truth of their inner activity to systems that monitor, predict and ultimately reshape it.
The soul as living activity and its digital exposure
In the three books of De Anima, Aristotle defines the soul as the form and first actuality of a natural organised body possessing life potentially. The definition is not metaphorical. Matter is what is capable of being organised; form is the principle through which the thing becomes what it is and can perform the activities proper to it. The soul, on this account, is not a substance separable from the body’s life; it is the very organisation that makes life possible — the capacity to nourish, perceive, imagine, desire, deliberate and act. What matters for the present argument is the consequence: if the soul is identical with the living activity of the person, then every system that captures, stores and acts upon the traces of that activity is handling something that belongs to the person’s most intimate constitution.
Aristotle’s example of the eye makes the point concrete. If the eye were an entire living being, sight would be its soul. An eye that has permanently lost the capacity to see remains an eye only in name, like an eye painted on a statue. The shape is preserved while the activity that made the organ what it was has disappeared. The analogy extends directly to the digital domain. A database can preserve images of everything a person has seen, but it cannot see. An archive can retain every message someone has written, but it does not remember, intend or understand. A behavioural profile can record every choice a person has made, but it cannot deliberate or choose. The trace is not the activity; the record is not the soul. Yet the danger of contemporary digital architecture is precisely that it treats the trace as though it were the activity — as though a sufficiently complete behavioural record could stand in for the living person and authorise decisions made in that person’s name.
Aristotle’s distinction between first and second actuality develops the point. A person who knows a language possesses that capacity even while silent; speaking or reading exercises it. The soul is the first actuality that makes the activities of life possible, while life is realised through the exercise of those capacities. Identity, on this account, cannot be reduced to a static inventory. It belongs to an organised being capable of perception, memory, desire, imagination, thought and action.
Aristotle was not writing a theory of digital identity. The connection is an interpretation, not an attribution. His account nevertheless establishes an essential limit: data are not the soul, and a complete digital duplicate would not become the person whose life it recorded. Data are traces, descriptions and instruments; their meaning depends upon the living agent from whom they originate. That limit, however, also reveals the gravity of what occurs when digital systems disregard it. When the entirety of a person’s online activity — searches, messages, purchases, movements, hesitations, corrections — is captured and assembled into a predictive profile, the system does not merely record behaviour; it constructs a shadow of the soul’s activity and then acts upon that shadow as though it were the person. The question is no longer whether data are the soul. The question is what happens to the soul when its every outward expression is monitored.
What happens is distortion. Michel Foucault’s analysis of the panopticon — the architectural model in which a single unseen observer can surveil every inmate without the inmates knowing whether they are being watched at any given moment — describes the mechanism with precision. The decisive effect of the panopticon, Foucault argued, is not punishment but the internalisation of surveillance: the subject begins to regulate his own conduct according to the expectations of an authority he cannot see, producing a state of conscious and permanent visibility that assures the automatic functioning of power. The internet, as it is presently constituted, operates as a panopticon of unprecedented scale. The user enters digital life under the largely popular and massively acquired acknowledgement that the internet itself spies on you. Aware of the constant danger and invasive nature of scrutinised internet traffic, the individual tends subconsciously to bend to the will of the incumbent, faceless authority that governs the network. The result is a falsification of the true nature of the person’s real intentional drives and habits online. The user abides passively to a form of conforming status quo and silent compliance, without truly gaining a voice in case of dissent — except for adversarial comments easily diluted and then dissipated by the prevailing power structure. What is lost is not merely data security but something far more fundamental: the behavioural genuineness of the individual, the capacity to act online as one truly is rather than as the invisible architecture of surveillance requires one to appear.
The person’s interiority under digital threat
Jacques Maritain identified the root of the problem with a clarity that anticipates the digital age. In his account of the human person, Maritain insisted that the person possesses an interior life — a universe unto itself — that is irreducible to any external observation or social function. The person is not merely an individual instance of a species, a unit to be counted and administered; the person is a whole, endowed with intellect and free will, whose dignity consists precisely in the capacity for self-governance and self-donation. That interiority, Maritain argued, is the foundation of every genuine right: rights do not originate in the state’s concession but in the person’s nature as a being whose inner life exceeds every institutional claim upon it. When a digital architecture systematically captures the behavioural expressions of that inner life — the searches that reveal curiosity, the hesitations that reveal doubt, the communications that reveal affection, dissent or vulnerability — it penetrates the very interiority that Maritain placed at the centre of human dignity. The profile does not merely describe the person from outside; it reconstructs the interior from its traces and then acts upon that reconstruction without the person’s knowledge or consent.
Charles Malik, whose philosophical contribution to the drafting of the Universal Declaration of Human Rights was decisive, grounded the Declaration’s protections in the conviction that the human person possesses a rational and moral nature that precedes and limits every form of political and institutional power. Article 12 of the Declaration — which prohibits arbitrary interference with privacy, family, home and correspondence — was not conceived as a mere procedural safeguard; it expressed the substantive claim that there exists a sphere of personal life into which no authority, however powerful, may legitimately intrude without justification. Mary Ann Glendon, in her study of the Declaration’s drafting and legacy, has shown how this principle was forged through the convergence of diverse philosophical and cultural traditions, each recognising in its own terms that the person’s inner life demands protection not as a privilege but as a condition of human flourishing. Glendon has also warned that rights language, when divorced from the concrete institutional structures that give it effect, risks becoming merely rhetorical — a declaration without architecture. The digital age vindicates that warning. The right to privacy, proclaimed in international instruments and domestic legislation, is rendered hollow when the technical infrastructure through which persons communicate, transact and associate is designed to extract and monetise the very behavioural data that privacy is meant to protect. A right without an architecture capable of sustaining it is a right in name only.
The convergence of these accounts — Aristotle’s identification of the soul with living activity, Foucault’s analysis of how surveillance produces conformity, Maritain’s insistence on the irreducibility of the persons interiority, Malik’s grounding of privacy in the rational and moral nature of the human being, and Glendon’s warning that rights require institutional architecture — defines the problem that Citizenstar undertakes to address. The contemporary internet does not merely collect data; it reshapes the activity from which the data originate. The person who knows that every digital act is observed, recorded and potentially used against her does not act as she would if unobserved. She does not search as freely, communicate as candidly, dissent as openly or explore as broadly. The panoptic structure of the network converts the living activity of the soul — in Aristotle’s sense, the full range of perception, deliberation, desire and choice — into a performance calibrated to the expectations of an unseen audience. The digital soul is not merely monitored; it is deformed by the monitoring itself. Privacy, understood in this light, is not a luxury or a preference. It is the condition under which the person’s behavioural genuineness — the correspondence between inner intention and outward act — can be maintained.
Helen Nissenbaum’s theory of contextual integrity supplies the operative principle. Privacy is not total concealment; it is the appropriate flow of information within a given relationship or social context. A doctor may need information that an employer does not. A payment system may need confirmation that funds are available without acquiring a complete history of the payer’s life. An online service may need to know that a participant is a real person without learning every fact capable of identifying that person. The violation of privacy occurs not when information is disclosed, but when it flows outside the norms appropriate to the context in which it was originally shared. The architecture of the contemporary internet violates contextual integrity systematically: data disclosed for one purpose are aggregated, repurposed and sold for purposes the person never contemplated, assembling a behavioural portrait whose very existence distorts the activity it purports to describe.
Citizenstar: protecting the interiority of the verified person
The distinction between privacy and anonymity is central to Citizenstar’s proposal. Anonymity withholds the identity of the actor. Privacy allows an identified person to retain authority over what is revealed, to whom and for what purpose. A trustworthy network may need to establish that a participant exists and possesses certain rights; it does not follow that the network must expose the contents of that participant’s communications or assemble every disclosed attribute into a permanent behavioural profile. The point is not to hide the person but to protect the person’s capacity to act genuinely — to restore the conditions under which online behaviour can correspond to authentic intention rather than to the silent conformity imposed by pervasive surveillance.
Citizenstar presents its model in these terms: absolute privacy with verified identity. It describes a decentralised peer-to-peer network whose nodes are operated by verified people, with files encrypted, fragmented and distributed so that no individual node holds the complete file. Its published materials state that users should be able to see, move or destroy the information they share and that no central authority should be able to read, sell or delete it. These are the project’s stated architectural and technical claims; their implementation and security must ultimately be established through independent technical evaluation.
The philosophical significance of Citizenstar’s architecture lies in the relationship between rights and structure that Glendon identified as decisive. A proclaimed right to privacy means little if the technical environment in which the person acts is designed to defeat it. Citizenstar proposes to embed the right within the architecture itself: encryption ensures that the content of communications remains inaccessible to intermediaries; fragmentation and distribution across nodes operated by verified persons ensure that no single point of failure can expose the whole; the absence of a central authority capable of reading, selling or deleting user data ensures that the behavioural traces of the person’s activity are not aggregated into a profile that escapes the person’s control. The architecture does not create the person’s interiority — that belongs to the living soul in Aristotle’s sense — but it creates the digital conditions under which that interiority can express itself without being captured, distorted or commodified. In Maritain’s terms, it is an institutional structure ordered toward the common good of persons, not toward the administrative convenience of the systems that serve them.
Technology now functions as a practical extension of the body. A person does not physically travel through the network; a device carries the person’s speech, instructions and choices into spaces the body cannot occupy. The machine acts as a prosthesis of agency. Yet the source of the action remains the person, whose reasons and purposes determine what the technological extension ought to do. When a digital system silently collects and repurposes the traces produced by human action, the prosthesis begins to appropriate the activity it was meant to extend. The person’s outward expressions — which in Aristotle’s account are the very operations through which the soul realises itself — are redirected toward ends the person has neither chosen nor understood. The result is the condition Foucault described: the subject, aware of being observed, ceases to act from genuine deliberation and begins instead to perform for the observer. The prosthesis no longer extends the person’s agency; it disciplines it. Citizenstar’s architectural response is to ensure that the prosthesis remains subordinate to the person: that the network carries the person’s activity without claiming authority over it, and that the traces of that activity remain under the person’s control rather than becoming the raw material of an external power’s predictive apparatus.
The expression soul economy can now be stated in terms of the argument advanced here. It does not mean that a soul is converted into information. It names the growing sphere in which representations of identity, memory, intention, relationship and value are stored, exchanged and acted upon — a sphere in which the behavioural expressions of the person’s inner life acquire economic value and institutional consequence. The danger is not that the soul is digitised but that the person, knowing that every digital act contributes to an externally controlled representation, begins to live inauthentically within that sphere. The digital soul — the aggregate of one’s behavioural traces — ceases to reflect the living person and begins instead to reflect the person’s adaptation to surveillance. Aristotle observed that the phantasmata — the interior images consolidated from sensory experience — are indispensable to thought but are not thought itself; they furnish the material from which the intellect draws out intelligible form. Digital data occupy an analogous position: they are necessary instruments through which the person acts at a distance, yet they are never identical with the living intelligence that gives them meaning. The task of a soul economy worthy of the name is to organise that sphere so that the data remain instruments of the person’s genuine activity rather than instruments of the person’s conformity to an external will.
Restoring the conditions of authentic digital life
The decisive question is not simply whether a system knows who its user is. It is what the system does with the knowledge of who the user is and, more fundamentally, what effect that knowledge has upon the user’s own behaviour. Does verification remain a limited credential connected to a defined purpose, or does it become the entrance through which the whole person is made transparent? Does the person retain the capacity to act from genuine intention, or does the awareness of constant observation produce the silent, pervasive conformity that Foucault identified as the panopticon’s true achievement? The philosophical tradition examined here converges on a single answer: the right to privacy — grounded by Malik in the rational and moral nature of the person, by Maritain in the irreducibility of the person's interiority, and given institutional force through the concrete embodiment that Glendon rightly demands — protects not merely a preference for solitude but the very conditions under which authentic agency can be exercised. And if Aristotle is correct that the soul is not a thing to be stored but an activity to be sustained, then the adequacy of any digital architecture must be measured by whether it preserves or deforms that activity.
A digital architecture should therefore be judged by the activity it enables and the end it serves. It serves human life when it allows persons to communicate, remember, exchange and form relationships while remaining the authors of those actions — when it preserves the behavioural genuineness of the individual against the deforming pressure of surveillance. It ceases to serve them when the profile becomes more authoritative than the person, when technological prediction closes the space in which choice can still occur, and when the user’s awareness of being watched converts every digital act into a performance rather than an expression of authentic will.
Citizenstar can therefore be understood as a proposal for the protection of the digital soul — not in the sense that it safeguards a metaphysical substance, but in the sense that it undertakes to preserve the conditions under which the person’s living activity can express itself authentically in the digital domain. Its philosophical claim is that verification need not require dispossession, that participation need not require the surrender of one’s private interior, and that the behavioural genuineness of the individual — the correspondence between what one truly intends and what one does online — can be maintained only when the architecture itself is designed to prevent surveillance from deforming the activity it records. Aristotle placed the soul in the living form and activity of the person: tending outward toward the world, returning inward through reflection, never fully captured by any record of what it has already done. Foucault showed that when observation becomes permanent and invisible, the subject ceases to act freely and begins to perform for an unseen authority. Maritain insisted that the person’s interiority is the ground of all rights. Malik and the drafters of the Declaration affirmed that privacy is not a concession but a recognition of the person’s rational and moral nature. Glendon warned that rights without institutional architecture are rights without effect. Citizenstar’s ambition is to supply that architecture: a structure in which digital information retains its vital but subordinate role, carrying the person’s agency without claiming to replace its source, and in which privacy is not merely proclaimed but built into the operative form of the network itself.