Designed Forgetting
For most of recorded history, forgetting was the default. Parchment decayed. Witnesses died or moved or lost interest. Registers were destroyed in fires, floods, and wars, or simply misfiled in cellars that no one cleaned. The medium's mortality was the mercy that made institutional memory bearable. No one built it. No one had to.
In 1551, Margreth Auerhamerin was accused of witchcraft in the Prince-Bishopric of Eichstätt but did not confess under interrogation. The authorities expelled her from the bishopric. Once she crossed into a neighboring jurisdiction, her accusation record remained in Eichstätt's local archive. There was no mechanism for it to follow. This was not exceptional: in the imperial city of Rothenburg ob der Tauber, nine of forty-one individuals involved in witch trials between 1561 and 1652 were banished, forced by court order to start fresh in another jurisdiction. In the fragmented Holy Roman Empire, with its hundreds of autonomous territories each maintaining separate court records, information stayed where it was recorded, accessible only to those who knew where to look and had reason to look there. The register did not have legs. This was not a design choice. It was a consequence of the substrate, as unintentional as the softness of vellum and as consequential.
She did not become innocent in the eyes of everyone who had watched the trial. Some neighbors would remember. Some would whisper. But whispers require mouths, and mouths can be tired, fearful, or unsure. In the next village, the accusation would have to be told again, and telling it would require someone willing to stake a reputation on it. The record stayed in the courthouse. Forgetting was not mercy. It was friction.
What Forgetting Required
When the medium no longer forgets on its own, when records are permanent, composable, and available to any system that can query them, forgetting must be designed. The juvenile record seal is the legal system's most deliberate attempt to reproduce, by conscious choice, what the physical medium once provided for free.
A court finds a sixteen-year-old guilty of a crime. Entered through process, supported by evidence, adjudicated by a judge, subject to appeal, the finding is real. Sealing follows: the institutional apparatus is commanded to behave as if something it knows to be true is no longer available for ordinary inspection. A court order can still unseal it, a safeguard against the possibility that sealing could itself produce injustice. But the default is obscurity.
The person who committed the crime and the person who stands before the employer are connected by biological continuity but separated by time, experience, maturation, and the possibility (which the legal system considers valuable enough to protect) that people change. Available regardless of subsequent behavior, the seal embodies a principle about the relationship between a record and a life: the record captures a moment, and the life exceeds the moment.
Bankruptcy discharge performs the same function for financial obligations. A debtor's failures are documented with full formality: schedules of assets, proofs of claim, hearings, judicial findings. The discharge does not erase them. It places a temporal boundary on their consequences. After a specified period, the record of failure can no longer deny credit, employment, or standing. Bankruptcy discharge is the financial system's mercy threshold: the point at which the system acknowledges that a person is more than the worst documented thing that has happened to her.
Article 17 of the European Union's General Data Protection Regulation extends the principle beyond criminal and financial domains to the general information environment. A person may request erasure of personal data under specified conditions, but the right yields to the public interest, particularly where the data subject holds public office or exercises public power. The asymmetry is deliberate and constitutional in spirit: those who wield authority forfeit the claim to obscurity in proportion to the authority they wield, while those who live private lives retain it.
These instruments share a structural feature more demanding than deletion. Designed forgetting is the presence of a record together with a constraint on its use, harder than erasure because the system must maintain two states simultaneously: the state in which the information is known and the state in which the information is treated as though it were not. A sealed juvenile record still exists in the court's archives. A discharged bankruptcy still appears in certain databases. A "forgotten" search result may persist in its underlying source while vanishing from the search index. The system must behave contrary to what it knows, indefinitely, on behalf of someone it may never encounter.
The Portrait That No One Assembled
Over ten years, twelve documented events accumulate across seven institutional domains in the life of a single person. An emergency-room visit for a hiking injury (chart filed, insurance billed, visit unremarkable). A speeding ticket on an interstate, paid on time, fourteen miles over the limit, no points because the jurisdiction allows online mitigation. A mortgage application, approved at a favorable rate. A layoff during a company-wide downturn (standard separation agreement, two months' severance, not a termination for cause). A political opinion about municipal zoning, posted on social media, mildly controversial in the neighborhood, forgotten within a week. A condominium sale at market value. A tax filing, correct, on time, unremarkable.
Each event is locally innocuous. Each institution collected its own data for its own legitimate purpose and disclosed it to its own authorized parties. Now compose them. A system with access to all seven domains sees a person who visited an emergency room (health risk), was cited for speeding (risk tolerance), applied for a mortgage (financial exposure), lost a job (employment instability), expressed a political opinion (ideological signal), sold property (liquidity event, possible financial distress), and filed taxes at a specific income level. Each parenthetical flag is defensible on its own terms. None of the underlying facts is false. But the composition produces a profile that no single fact contains: a quantified assessment of health risk, behavioral tendencies, financial trajectory, employment stability, and ideological orientation. A portrait assembled at the boundaries, in the systems that aggregated the disclosures, exceeding any individual system's jurisdiction.
The profile may adjust an insurance premium, decline a future mortgage application, rank her below a candidate whose composite looks cleaner, target advertising calibrated to an inferred emotional state, flag her for secondary screening at a border crossing.
She cannot see the composite, because no single institution holds the complete picture. She cannot challenge it, because each institution defends only its own fragment. She cannot outlive it, because the digital medium does not decay, does not lose interest, and does not move to a different city. When she applies for a job, the background-check service composes her employment history with the credit report and the social-media archive. When she applies for housing, the screening service composes the eviction record with income data and the criminal-background search. Each compositor assembles a different portrait from overlapping subsets of the same underlying records, weighting the fragments differently, and no two will produce the same picture. She is assessed as a collection of documented events whose interpretation belongs to the assessor.
She is followed not by a detective or a dossier but by a distributed record whose fragments reassemble wherever she presents herself to an institution that queries the record. Medieval parchment rotted, and a medieval exile could walk to another city and begin again. Her record does not rot, and she cannot walk far enough.
Five Operations
The five witness properties, implemented without a forgetting mechanism, produce this pathology necessarily. Composition without temporal limits is how a system that remembers everything becomes a system from which no person can escape. The cruelty is structural, the natural consequence of a protocol that provides no mechanism for a person to outlive the worst moment it has recorded.
Weakening the protocol is not the answer. A system that cannot compose claims across boundaries cannot coordinate at scale, and coordination at scale is the problem the protocol exists to solve. The same composition mechanism that enables surveillance of individuals also enables oversight of institutions. What is needed is directed composition: mechanisms that limit it when the claims are about persons while preserving it when the claims are about power.
Those mechanisms take five forms: the minimum architectural toolkit for a system that verifies comprehensively but does not remember vindictively.
Records of individual conduct carry a temporal boundary after which they are no longer available for composition. Her speeding ticket expires from insurance algorithms and employer background checks after a defined period; the record persists in a court archive accessible only by judicial order. Expiration withdraws it from the composable pool, not from existence, because circumstances may arise in which its absence would produce injustice. What expires is availability to automated systems that compose profiles across domains; the boundary varies with the severity and relevance of the event (a traffic violation sooner than a felony conviction).
Some records require stronger protection. A dismissed juvenile charge (if she had one) would be sealed: placed beyond the reach of ordinary queries while remaining available for specific, judicially authorized purposes. The system that stores it returns a null result to the employer, the landlord, the credit bureau: the query lacks authorization, though the record remains. Sealing operates at the protocol level, enforced by architecture rather than by the discretion of its operator.
Even unsealed, unexpired records can be constrained in how far they travel. Aggregation limits specify that no single system may compose records across more than a defined number of domains without explicit authorization from the data subject or a judicial determination that the composition is necessary for a specified purpose. Her twelve events across seven domains can each remain available to the institutions that created them without being composable into a single portrait by a system that has no relationship with the subject and no accountability for the portrait's consequences. The limit is structural, enforced by the protocol, because discretion yields to commercial incentive.
Separation prevents cross-context bleeding. Her hospital visit may not inform her credit score. Her political opinion may not inform an employment decision. Her traffic violation may not inform a medical evaluation. Separation is the informational analogue of the constitutional separation of powers: dividing the record into domains that cannot be reunited without authorization, because the reunification produces a portrait that exceeds any single domain's legitimate purpose.
And when an entire category of conduct no longer warrants consequences, amnesty operates collectively. A new administration determines that certain convictions were unjust, not because the convicted were innocent but because the law under which they were convicted has been repudiated, or because the passage of time has rendered the offense obsolete. Amnesty does not erase the past. It limits the past's jurisdiction over the future, for a category rather than an individual, as a political act rather than a judicial one.
These five operations are necessary but not sufficient, because each requires a decision about when to apply it, and that decision resists automation. When should a record expire? When should a seal be applied? When should aggregation be limited, separation enforced, amnesty granted? Each judgment requires encounter with particularity: this person, this record, this moment, this consequence. An algorithm can implement the decision once made. Only a person, standing in the presence of the consequences, can make it.
Civic Asymmetry
The five operations share a principle that none of them names on its own. Each constrains what can be done with information about persons while leaving intact the composability of information about power. Her medical record is separated from her credit score. A government agency's pattern of loan denials across demographic groups is not. Her political opinion is sealed from her employer's background check. A legislator's voting record is not. The constraint runs in one direction: toward opacity for persons, toward transparency for power.
Power must be transparent to those it governs, while persons must remain opaque to systems that cannot be held to account for how the transparency is used. This is civic asymmetry, and it is what separates a receipt regime from a police state. Both use the five witness properties. Both achieve composition. A receipt regime directs transparency toward power and opacity toward persons. A police state reverses the direction. Mechanism identical, constitutional direction everything.
Civic asymmetry also explains why the five forgetting operations are so difficult to implement in practice. Every operator of a composable record system faces a standing temptation: to extend the composition of persons (commercially valuable) while limiting the composition of power (institutionally threatening). Designed forgetting requires the operator to constrain the commercially valuable direction and preserve the institutionally threatening one, the opposite of what incentive dictates. The constraint must therefore be structural rather than discretionary, built into the protocol itself, because goodwill cannot be relied upon to limit power. A person whose record is forgiven only at the operator's pleasure lives under the operator's will; that dependency is unfreedom regardless of whether the operator exercises the power harshly or gently. Designed forgetting must be a structural guarantee rather than a discretionary gift.
Elena will stand before an arbiter who has her complete record and must decide whether it should determine the answer.