The Trust Tax
The trade-off for democratized credit was constant surveillance.
— Josh Lauer, Creditworthy (2017)
In the early nineteenth century, a merchant deciding whether to extend credit to a distant shopkeeper could pay to investigate, rely on letters and reputation, or accept the risk of ignorance. The transaction might not support the cost of a journey. The gap between what he needed to know and what he could afford to check had a price.
Every intermediary's price embeds a cost that cannot be eliminated and a premium that can. Someone must perform the work of composing local truth into global coherence; that work is the coherence fee. A notary's skill in drafting an instrument that a foreign court will recognize, a correspondent's means of distributing handwriting specimens and pricing currency risk, a database's work of maintaining consistency across millions of records: each has a real price. The surcharge collected for occupying the only authorized position is the trust tax. The Champagne fair wardens provided a genuine verification service and extracted a toll for their monopoly at the crossroads. A credit score can compress information while creating a dependency its owner monetizes. The two charges are often tangled, and the operator who profits from the tangle has little reason to clarify it.
That tangle is what the Philadelphia wholesaler paid. Part of his cost was thermodynamic: someone had to verify the Cincinnati shopkeeper, and verification is work — work of a particular kind here, because there was no standing test the shopkeeper could be checked against. Whoever would sell verification at scale had first to construct the standard itself, and checking became cheap only after that construction. Part was positional: whoever controlled the verification infrastructure could charge for access to it, and no alternative existed.
Frank Verboven and Biliana Yontcheva, studying European notarial markets for the Centre for Economic Policy Research, found that in jurisdictions where entry was restricted, notarial profits exceeded what the skill and labor of the work could explain. Surplus was sustained by the restriction itself, not by the quality or indispensability of the service. The intermediary's defense is always the same: without me, coherence dissolves. It confuses the cost of coherence with the price of monopoly, and that confusion is the business model.
The Industrialization of the Witness
The bill of exchange worked as a verification system because it carried its own evidence, but it worked at the scale of individual transactions between parties who had access to the correspondent network. Our wholesaler in Philadelphia had no bill to inspect. He had no correspondent in Cincinnati. He had a name, a rumor, and a choice: extend credit to a stranger or lose the sale. Commerce expanding across the American continent in the early nineteenth century created a verification problem structurally identical to the one the Champagne fairs had solved for medieval Europe, but at a scale that required a different kind of institution.
Lewis Tappan's Mercantile Agency, founded in New York in 1841, industrialized the correspondent function. It recruited local informants and compiled reports on the assets, debts, habits, and character of distant merchants for subscribers deciding whether to extend credit. The Library of Congress identifies it as the first commercial credit-rating agency in the United States; the Baker Library preserves the ledgers and traces the service's growth after the Panic of 1837.1
Value lay not in any single report but in the aggregation. A wholesaler in New York could send a clerk to the Agency's office, where the clerk would sit at a desk, request the ledger for Cincinnati, and read the reports on the shopkeeper in question. Informants had biases and reports were sometimes outdated. But the system allowed a merchant to make a credit decision about a stranger a thousand miles away at a cost that made the evaluation economically rational for transactions that would previously have required either blind faith or a physical visit. The cost of trust had been reduced through an industrial verification infrastructure that replicated the Champagne fairs' function at continental scale.
From Tappan's narrative assessments to the FICO score, a specific transformation occurred: the compression of the correspondent function into an algorithm. Narrative assessments (rich in context and judgment, dense with the observations of a specific person in a specific community) gave way to numerical summaries processable at machine speed. Three digits could encode what a thousand-word report had contained, and three digits could be integrated into automated decision systems processing millions of applications per year. But compression was also concentration. FICO became the standard because it was cheap to compute, easy to integrate into automated underwriting, and sufficiently predictive for mass-market lending: suitability as an input to systems that needed numerical thresholds rather than qualitative judgment.
Prevalence created dependency, structurally indistinguishable from the dependency the Champagne fair wardens had created. Institutions that adopted the score stopped training loan officers in the qualitative assessment that Tappan's correspondents had performed. They stopped reading narratives. They read numbers. And individuals whose scores were incorrect discovered that correcting a number was harder than correcting a reputation had been in Tappan's era, because the score was maintained by an institution that had no relationship with the individual and no particular incentive to get the correction right.
Here is how the circle closed. An individual disputed a score by submitting a form to a bureau that processed millions of disputes per year. The bureau investigated by sending an automated query to the data furnisher. The data furnisher (usually the creditor that had reported the information) investigated by checking its own records, which were the same records that had produced the error. The system that created the error was the same system that investigated the error, and the individual who was harmed by the error had no authority to break the circle.
The Fair Credit Reporting Act of 1970 did not give bureaus blanket immunity. It required reasonable procedures for accuracy, created dispute and reinvestigation duties, limited some state-law actions, and preserved liability for negligent and willful noncompliance. The statutory bargain still reveals the asymmetry: reporting at national scale is treated as a valuable infrastructure, while the injured person must navigate a specialized correction process before the consequences of an error fully propagate.2 The coherence fee is the work of aggregation and correction. The trust tax appears when control of that process lets its operator shift delay and error costs onto the subject.
The Stasi Configuration
Timothy Garton Ash remembers the woman first. Not her name (the Stasi file gives him that, along with her code name and her handler's name and the dates of every report she filed), but the person. Someone he had been close to during his years as a young researcher in East Berlin. They had drunk coffee together. They had talked about books, about politics, about the small frustrations of daily life in a city divided by concrete and razor wire. She had listened with a sympathy he now understands was professional.
After German reunification, Garton Ash read his file. Hundreds of pages. Reports from colleagues at the university, from acquaintances, from the woman. Each report was individually banal: he went to a particular café, he mentioned a particular book, he expressed a particular opinion about a particular policy. A neighbor noting that a light burned late. A colleague mentioning that a western radio station had been playing. None of it, taken alone, would interest anyone. Composed into a structured dossier and maintained over years, these trivialities became something no individual observation contained: a portrait of his life more comprehensive than anything he could have assembled about himself.
The Ministerium für Staatssicherheit accumulated records on millions of people. By 1989 it employed roughly ninety-one thousand staff and directed about 189,000 unofficial collaborators, approximately one for every ninety residents of the GDR.3 The system instantiated much of the witness pattern, not because the archive is less than horrifying, but because condemnation without analysis leaves us unable to recognize a recurrence.
Every entry was bound to a source: the IM who filed it received a code name, a handler, a file reference. When the woman reported on Garton Ash, her report was attributed, classified but traceable, maintained with bureaucratic scrupulousness. The system specified conditions for its own operation: criteria for opening a file, thresholds for escalating surveillance, categories of suspicion that governed what actions the apparatus could take. The IM who reported on a colleague's reading habits did not decide on his own what to report. He followed instructions, filled out forms, operated within a framework whose internal rules were as elaborate as any bureaucracy's. Stakes were embedded at every level: consequences for the subjects ranged from denied educational opportunities to denied travel privileges to imprisonment, and consequences for the informants ranged from rewards to coercion to the ever-present threat that their own files would be opened if they stopped cooperating. And the system achieved composition at remarkable scale: a report from an IM in a Leipzig church combined with a wiretap transcript from a Dresden apartment and a travel-application denial from a Berlin office, fragments gathered by different observers in different contexts at different times, assembled into a portrait that none of its individual components could have produced.
What the system lacked was recourse. Garton Ash could not access his dossier, could not challenge the accuracy of what was collected, could not appeal the consequences that flowed from it, could not even confirm he was being watched. Absence of recourse was not an oversight. It was the system's central architectural feature. Everything depended on the subject's inability to inspect or contest the record.
The betrayal Garton Ash describes was not in the surveillance alone but in the asymmetry: they could see him and he could not see them, and the accumulated effect of many banal observations, composed into a structured dossier by a system with perfect memory, was a comprehensive map of a human life, maintained by a power invisible to the person it mapped.
The Stasi archive demonstrates that the five witness properties are not inherently benign. A system that achieves binding, conditions, stakes, and composition but degrades recourse is not a failed verification system. It is a surveillance architecture. Properties work as designed; they simply work for the operator rather than the subject.
And the parallel to modern data architectures is not rhetorical. It is structural. A platform that maintains a comprehensive behavioral profile of each user (cross-referenced across services, accessible to the platform but not to the user, with consequences flowing from the profile without disclosure of the profile's contents) has implemented four of the five witness properties. Data is bound to the user. Conditions for collection and use are specified, somewhere, in forty thousand words of terms of service. Consequences follow: a score adjusted downward, an advertisement targeted, a price differentiated, an opportunity withheld. And composition operates across contexts the user never consented to combining: purchase history merged with location data merged with social connections merged with browsing patterns, producing a portrait as comprehensive as anything the Stasi assembled and considerably more granular. What has been degraded is recourse: the user's ability to see the profile, challenge its accuracy, contest the consequences. Architecture does not require benevolent intent to produce the effects the Stasi archive produced. Effects follow from structure, not from the intentions of the operator.
The Counter-Case: The Diamond Bourse
Lisa Bernstein's study of the New York Diamond Dealers Club documented a system of private arbitration, reputation, and communal sanction that often resolved disputes without ordinary litigation. It matters because it shows conditions under which a centralized external intermediary can become less important, though it does not establish that the trust tax vanished.
The Club governed a five-billion-dollar annual trade in rough and polished diamonds through private arbitration, reputation-based enforcement, and communal sanctions. Disputes were resolved not by courts but by a panel of diamond dealers who applied trade customs rather than state law, and decisions were enforced through the credible threat of exclusion from the Club, which meant exclusion from the trade because the Club was the marketplace. A dealer who violated the Club's norms could be barred from the trading floor, and a barred dealer had no alternative market of comparable scale.
Four conditions held simultaneously, and the failure of any one would have compromised the whole.
Membership was bounded: a defined group, numbering in the hundreds, known to each other by face and reputation, whose entry and exit were controlled by the membership itself. The bounded membership made the information problem tractable: every participant could, over time, develop a reliable picture of every other participant's character, because the community was small enough for direct observation and stable enough for reputations to accumulate.
Information traveled at the speed of conversation over lunch. A dealer who cheated one counterparty would be known to every other counterparty within hours, because the trading floor was a single room and the dealers sat at tables next to each other. Gossip, in this context, functioned as a verification mechanism: distributed monitoring performed by the community as a side effect of ordinary social interaction.
Assets were inspectable. A diamond's quality could be verified by anyone with expertise, and expertise was distributed across the membership rather than monopolized by an authority. When a dealer claimed a stone was a particular grade, another dealer could take a loupe, examine it, and render an independent judgment. Inspection was portable with the skill of the examiner, not locked behind an institutional credential.
And the exit penalty was severe. Exclusion from the Club meant economic death in the diamond trade, and the severity of the penalty kept incentives aligned: the cost of cheating exceeded the benefit by a margin wide enough to make honesty the rational strategy even for the purely self-interested.
The diamond dealers show that the trust tax is not fixed. Disputes were resolved and reputations maintained through a bounded community that governed its own market. But the club itself controlled a chokepoint, and exclusion could be severe. Communal ownership changes who governs the gate; it does not abolish power at the gate.
The case also shows how demanding those conditions are. As participants and venues multiply, a bounded community loses some of its information advantage. Laboratory-grown diamonds weaken the sufficiency of traditional visual inspection because natural and synthetic stones can share the optical and physical properties visible to a dealer; authoritative identification may require advanced testing.4 Online markets create routes around the physical floor. Each change creates demand for laboratories, platforms, and other certifiers whose own power must then be examined.
The Limit of Verification
A system that verifies comprehensively, permanently, and without the limitation that recourse provides is a system that produces a peculiar form of cruelty: justice that cannot let go. The Stasi archive verified comprehensively. Credit bureaus verify comprehensively. A platform that profiles user behavior across all interactions verifies comprehensively. In each case, the record persists beyond the moment of its creation, composing observations into a portrait that is both accurate in its fragments and inescapable in its totality. Digital records do not decay, and the digital subject cannot walk far enough to escape the composition of her own history.
Verification without forgetting is verification without mercy. The forgetting that once made verification bearable was never designed. It was borrowed from the medium: parchment that rotted, registers that were lost, memories that faded. When the medium becomes immortal, the mercy must be built by design or it will not exist at all. That architecture (what forgetting requires when the substrate no longer forgets on its own) is the subject of Chapter 4.
And the chokepoint holds. An individual who disputes a credit score submits a form to the bureau that created the score. The bureau queries the creditor whose report produced the error. The creditor checks its own records. The circle closes where it began. The cost is not the checking (the checking is cheap) but the monopoly on the checking, and the monopoly persists because there is nowhere else to go.
An intermediary's premium can combine a real coherence fee with an extractable trust tax. Cheaper verification can shrink the tax without abolishing the work of composition or the rents protected by a chokepoint.
The empirical research program has already narrowed this claim. Its present evidence supports the coherence fee as a measure of disclosure and omission inside the tested receipt structures; it does not establish the fee as a general predictor of operational failure. The distinction remains useful, but its broader predictive reach is conjectural.
Notes
1. Lewis Tappan Papers, Library of Congress; Baker Library, Harvard Business School, "Buy Now, Pay Later: The Mercantile Agency". ↩
2. Federal Trade Commission, Fair Credit Reporting Act, current statutory text and agency summary. ↩
3. Bundesarchiv, Stasi Records Archive, "The Unofficial Collaborators of the MfS". ↩
4. Gemological Institute of America, "Man-made Diamonds: Questions and Answers". For the club's governance, see Bernstein (1992). ↩