The witness who cannot lie

A human witness is a fragile instrument. Memory decays, and what remains does not decay evenly — it smooths, simplifies, and quietly rearranges the past into a shape that is easier to carry. Under pressure, recollection bends toward the interest of the person doing the recollecting, not usually through deliberate lying but through the ordinary human tendency to remember oneself as having been more careful, more justified, more right than one was. We have known this about witnesses for as long as we have relied on them, which is why every serious system for establishing what happened treats human testimony as valuable but suspect, to be corroborated wherever it can be.

Set against this is the appeal of a record, and it is worth being precise about where the appeal actually lies. The obvious answer is that a record is more complete than memory — that it captures detail a person would forget. This is true but shallow, and it is not the deep reason a record can do what a witness cannot. A detailed record kept by an interested party is not obviously more trustworthy than that party's testimony; it is just a longer version of the same claim, and if the party can revise it after the fact, the length buys nothing. The real appeal of a record is something else entirely, and it has to do not with how much the record remembers but with whether its integrity can be established by someone other than the one who kept it.

Integrity you can check without trust

This is the property that changes everything. A record whose integrity is verifiable — one that is tamper-evident, so that any alteration after the moment of recording leaves a mark that anyone can detect — can be believed in a way that neither a witness nor an ordinary document can. Not because the party who kept it is trustworthy; the whole point is that you do not have to decide whether they are. You can check the record's integrity independently, without relying on the good faith of the institution that produced it, and having checked it, you know that what it says now is what it said then. The record's credibility no longer depends on trusting its keeper. It depends only on a check that anyone, including the keeper's adversary, can perform.

Consider what this makes possible. An institution produces a record of a decision. Later, that decision is challenged, and the institution would very much prefer that the record said something more flattering than it does. With a human witness, this is the moment the testimony begins, subtly, to shift. With an ordinary document, this is the moment it can be quietly amended, the inconvenient version replaced by a better one, with no one the wiser. But with a tamper-evident record, the institution is trapped by its own past honesty. It cannot revise the record without the revision showing, and so the record continues to say what it said at the moment of the decision — even against the present interest of the very party that keeps it. That is the witness who cannot lie: not incapable of having recorded a falsehood, but incapable of changing its story now to suit the teller.

A witness you must trust is only as good as your reasons to trust them. A record you can verify is good even when you have every reason not to trust its keeper.

The claim and the witness

This draws a sharp line between two things that look superficially alike. A record whose integrity cannot be checked is, whatever its detail and however official its appearance, merely a claim. It asserts that a decision happened a certain way, and you are invited to believe the assertion on the strength of who is making it. It has exactly the epistemic standing of testimony from an interested party, because that is what it is — testimony, written down, revisable by the teller, believable only to the extent you already trust them. Length and formatting do not upgrade it. The moment its keeper could have changed it without detection is the moment it stopped being able to bind them.

A record whose integrity can be checked is a different kind of object. It does not ask for your trust; it offers you a verification. It says: do not believe me because of who kept me, believe me because you can confirm, yourself, that I have not been altered since the moment I was made. This is the transformation from claim to witness, and it is not a matter of degree. It is a change in kind, in what the record is for and what it can do. The one asks to be trusted. The other makes trust unnecessary, which in any adversarial setting — which is to say, in any setting where accountability actually matters — is worth incomparably more.

The doctrine of admissible reality is built around exactly this distinction, because it is the distinction between a record that can bear weight and one that cannot. The point of insisting that a decision record be tamper-evident is not fastidiousness about integrity for its own sake. It is that only a verifiable record can be believed by the party who has every reason to doubt it — the person the decision went against, the regulator arriving skeptical and late, the future institution that has no reason to extend good faith to the past one. Provenance that can be checked independently is what lets a record speak to those parties at all. Without it, the record is speaking only to people who already agreed to trust its keeper, which is to say it is speaking to no one who needed convincing.

So the question to ask of any record offered as proof of what happened is not how thorough it is or how official it looks. It is whether its integrity can be established by someone who does not trust the party that kept it. If it can, you are in the presence of a witness who cannot lie, and its account will hold even against the wishes of the one who wrote it. If it cannot, you are holding a claim in the shape of a record — and you should weigh it exactly as heavily as you weigh the word of the party who could have changed it and simply asks you to believe they did not.

— Dispatches · Summit Cognitive