The Witness Protocol

A wise man, therefore, proportions his belief to the evidence.

— David Hume, An Enquiry Concerning Human Understanding (1748)

The letter named its subjects, but not its author. It reached the police in Bloomingdale, Illinois, in May 1978, alleging that Lance and Susan Gates sold drugs and describing journeys through which they supposedly replenished their supply. Susan would drive to Florida, leave the car, and fly home. Lance would fly down and return with the drugs. The letter also alleged that drugs were stored in their basement. There was enough detail to investigate, and nothing to establish who had supplied it or how that person knew.¹

Police inquiries confirmed parts of the account. Lance Gates had booked a flight to Florida. Federal agents watched him arrive and go to a hotel, where he entered a room registered to Susan. The following morning he and a woman left in a car with Illinois plates and headed north. Detective Mader set out the investigation in an affidavit and attached the anonymous letter. A judge issued a warrant to search the Gateses' house and car. On their return, police found marijuana in the car and further contraband in the house.

The discovery makes the story look more settled than it was when the warrant issued. At that earlier moment, the police had confirmed travel, not seen the proposed purchase or transport of drugs. One prediction was wrong: Susan was coming home in the car rather than flying back. The search was challenged, and the courts in Illinois held that the showing had been insufficient. The United States Supreme Court reversed them. Its majority accepted the combined force of the anonymous information and police corroboration under an assessment of the total circumstances. The letter alone, it said, would not have been enough.²

Justice Stevens, joined by Justice Brennan, thought the mistake in the itinerary mattered more. A couple returning together from Florida could have been on holiday. Moreover, the letter's account had implied that one of them would remain at home; if the house contained a valuable supply of drugs, their simultaneous absence raised a further difficulty. The journey back might look suspicious in light of its duration, but the police had not known that duration when they sought the warrant. Nor could what they found afterward repair the grounds on which permission had earlier been given. Stevens distinguished the possible justification for searching the car from the warrant to search the house.³

The disagreement concerns an inference, not just a missing name. For the majority, the capacity to predict substantial parts of a private journey lent credibility to the allegation that accompanied the prediction. For the dissent, the confirmed details remained compatible with an innocent explanation, while a prediction contradicted by the surveillance weakened the proposed one. The majority answered that an informant need not be infallible. Neither position required pretending that the author had become known. The dispute survived the police's ability to say which observations they had made, and it would not have disappeared if those observations had been entered in a more complete form.

This is an inconvenient case for a strong doctrine of witness. It contains a real investigation, an unidentified originator, newly acquired grounds, an authorized search, and a serious objection to the authorization. The eventual discovery does not entitle us to dismiss the objection. Equally, the objection does not entitle us to say that anonymous information can never become evidence on which an institution may act. The difficult question is what the institution has learned in addition to being told, and how far that additional knowledge permits it to go.

Who must be known

The historical cases have encouraged us to look for a person, credential, or office to which a consequential assertion can be attached. There are good reasons to do so. It is harder to demand an explanation from a name that cannot be found; a liability written against nobody will be poorly collected. Yet this practical preference becomes misleading if it requires every justified use to preserve an answerable original speaker. An institution may acquire sufficient grounds of its own. The responsibility for acting on them can belong to people who did not originate the allegation.

In Gates, anonymity did not mean that the receiving process had no provenance. There was a letter, an account of police inquiries, an affidavit, and a judicial act. Each could be examined without discovering who wrote the letter. The anonymous author and the officer who sought the warrant occupied different positions in the argument. Assigning duties to the second did not identify the first, and the officer's willingness to accept those duties did not, by itself, make the allegation more likely to be true. The supporting inquiry had to do that work, to whatever extent it succeeded.

Binding must therefore be used with some care. It can concern the origin of a statement, continuity with a credential, or the person who has undertaken to answer for a use. These connections are often worth preserving together. They are not interchangeable. We saw in Mata how fully a submission could be attributed while its supposed authorities did not exist. Here we encounter the converse possibility: support may be developed for a claim whose first speaker remains unidentified. In both cases, the recipient's act has to be judged on its own grounds and under the duties that attend it.

There is nothing unprecedented in recognizing the recipient's contribution. Coady's account of testimony makes our dependence on others central to the economy of knowledge; Craig asks what our practices of identifying knowledgeable people are for; Lackey resists treating testimonial knowledge as something simply passed intact from a knowing speaker to a hearer.⁴ Their disagreements need not be settled to recognize the limit they place on an easy metaphor of transmission. What arrives can occasion knowledge that the original speaker did not possess. It can also occasion confidence which the evidence does not deserve.

The question for this book is more particular. When a claim moves into a new institution, what can that institution carry forward, what must it establish again, and what does it take upon itself by acting? A preserved source can spare work and reveal a weakness. Independent corroboration can sometimes compensate for what is missing. Neither should be assumed adequate merely because it is available. In Gates, the observations were probative only through an account of why this journey supported this suspicion. The disputed step lay between the observations and the proposed search.

That step gives conditions their importance. Grounds sufficient to begin an inquiry may be insufficient to authorize a search, and grounds sufficient for a search may be insufficient for conviction. The claim need not change its wording as it passes through these uses. What changes is what the recipient proposes to do with it. A record which preserves every word and omits that difference has preserved less than it appears to have.

What loss can teach

Stakes are a different matter. An endorser's contingent liability on a bill of exchange placed a possible loss on an identifiable party, under terms that could include presentment, notice, and protest. The obligation was neither a general punishment for being wrong nor an automatic liability running through every name on the paper.⁵ It helped allocate the consequences of a specified failure. Whether such exposure also induced care, deterred an unreliable endorsement, or excluded a competent person without sufficient means is a further inquiry.

The distinction is easily lost when all serious circumstances are counted as stakes. A dying person's statement may be received under an exception whose rationale concerns the speaker's belief that death is near. Whatever weight that belief deserves, impending death is not a penalty imposed if the statement proves false. The American federal rule specifies the subject of the declaration, the declarant's condition, and the proceedings in which it may be received. Admission under the rule does not demonstrate that the account is accurate.⁶

Nor did the reasoning accepted in Gates depend on discovering a loss that would be imposed on the letter writer if the allegation failed. We do not know what that person feared or wanted. Inventing a motive would not supply the missing condition; calling every possible motive a stake would make the condition impossible to test. The police's duties were real, but they belonged to the police. They cannot be placed retrospectively upon the anonymous author.

A contingent penalty is thus one means of organizing reliance, rather than an ingredient without which evidence cannot warrant it. Penalties may deter, insurance may compensate, professional discipline may govern conduct, and a procedure may catch an error before anyone suffers a loss. These arrangements can assist one another, but they can also pull apart. A well-insured claimant can be wrong. A witness who cannot afford a bond can be right. If the grounds can be checked independently, the recipient may have a reason to believe that does not depend on the producer's exposure at all.

This does not dispose of the economic question. It makes it less symmetrical. The cost of finding an error, the cost of the error itself, and the loss assigned to the person who supplied the claim need not fall on the same participant. In Mata, much of the omitted checking was eventually performed by the adversary and the court. A design can improve that allocation without proving a proposition about the necessity of producer stakes. It must show whose work it changes and what happens when the new arrangement fails.

The stubborn measure

Kula found local measures that persisted for centuries. Their endurance could protect customary claims and expectations, while conflicts of interest helped keep a measure stable. The Florentine staio, for example, had a remarkably long continuity. Local usage was not simply confusion awaiting the arrival of a rational standard.⁷

This matters to an argument inclined to admire portability. A new equivalence may ease exchange and still alter what a person is entitled to receive. To preserve a quantity is not necessarily to preserve the obligation in which that quantity figured. The old measure can be cumbersome for the visitor and intelligible to the parties whose relation it expresses. There is work in making it travel, and occasionally there is something the parties have reason to prevent from traveling so easily.

Klein supplies a useful restraint here: specify the transformations before announcing what remains invariant. But the restraint should survive the borrowing. Institutional changes of medium, office, and jurisdiction have not been shown to form a mathematical group; binding, conditions, stakes, recourse, and composition have not been derived from one.⁸ A cylinder seal and a digital signature can each support a limited continuity between an act and a credential. That comparison becomes useful when it tells us which continuity is at issue. It becomes extravagant when the resemblance is allowed to carry identity, authority, and legitimacy along with it.

The same difficulty attends the historical sample. A merchant's manual can describe several functions operating together without recording the order of their invention. Pegolotti gives us a mature commercial world, not an experiment in which the functions were added one at a time. Commercial and legal practices also traveled between the societies whose records survive. Their recurrence is evidence worth explaining, but their connection and survival prevent us from treating them as independent confirmations.⁹

Nor should the abundance of commercial documents decide in advance what a successful institution must look like. Oral traditions and wampum diplomacy complicate an account in which persistence means inscription detached from performance. Knowledge may endure through people charged with renewing and interpreting it. The cases do not establish that such arrangements reproduce the same five functions under other names.¹⁰ They oblige the comparison to say which use it is discussing and what evidence would count against it.

The second proceeding

Recourse presents a sharper difficulty because two reasons for wanting it are so easily joined. Challenge can uncover a mistake. It can also protect a person against an action whose factual premise is correct. The second reason remains after the first has no work left to do.

In Specht v. Patterson, an existing conviction became the trigger for a distinct proceeding under Colorado's Sex Offenders Act. The new disposition required a finding beyond the offense already established. The United States Supreme Court held that it could not be imposed through the procedure used, without the hearing and protections the new determination required. The earlier conviction did not become false. It also did not establish the additional finding merely because both concerned the same person.¹¹

The case is not evidence that the psychiatric assessment was right or wrong; the Court did not decide that question. It shows why the ability to prove one proposition does not settle what may be done on its strength. A record can remain accurate and relevant while the institution uses it to avoid an inquiry it is required to undertake. Eventual reversal can correct the disposition. It does not show that the original proceeding supplied the missing opportunity.

This is why recourse cannot be defended only as a machine for improving accuracy. A person may accept the recorded facts and dispute the office's authority, the inference it has drawn, or the consequence it proposes. Even where a decision happens to be factually sound, that person can have a claim to be heard. The constitutional argument concerns the terms on which power is exercised over someone; it does not depend on demonstrating that every unheard objection would have changed the facts.

The Stasi files already encountered make the danger visible from the other side. Administrative force cannot establish evidentiary quality. Attribution, templates, cross-referencing, and penalties can make reports useful to a ministry while coercion and strategic reporting make them unreliable. An accurate entry would not cure the subject's exclusion from the process. An inaccurate entry would add another injury.¹²

There are dependencies here, but they belong to specified arrangements. To contest a refusal to pay, a holder needs to identify the obligation and bring the refusal before someone able to change a consequence. To dispute a classification, a person may need access to the evidence and the rule under which it acquired force. The appropriate disclosure, forum, and remedy will differ. A route for filing an appeal may exist while the information needed to make it effective remains inaccessible. Conversely, restricted access to one source need not mean that every avenue of challenge has disappeared.¹³

Calling these relations a general hierarchy would promise more than they establish. Some sources remain unknown; some losses are not placed on producers; some true and useful evidence exists where affected people have no effective voice. The five functions help identify what an institution has arranged and what it has neglected. Their presence does not make a decision sound, and their apparent completeness does not make the institution just.

After the handoff

Composition brings the distinctions together without resolving them. A later recipient may inherit adequate grounds, inherit grounds that no longer fit the use, or acquire new grounds when the old ones cannot be recovered. These are different achievements. A downstream custodian cannot certify an undocumented interval merely by keeping an excellent record afterward. But it does not follow that every later conclusion is barred: independent evidence may establish what the missing interval otherwise leaves uncertain. Where it cannot, the uncertainty remains.

The work can also change rather than disappear. A bill's transfer may spare the holder from negotiating anew with the original parties while leaving presentment and recourse dependent on law and practice. A laboratory report may spare another office from repeating a test without establishing that the tested property decides the question before that office. The useful object is neither a bare conclusion nor a demand that every recipient repeat the entire inquiry. It is enough of the relevant grounds, limits, and history for the recipient to judge the new use, with a clear account of whatever must still be supplied.

Computation can make parts of this work extraordinarily cheap. A digital signature permits repeated checking of the relation among a message, a public key, and the signature. It does not establish the signer's civil identity or entitlement to act. Event ordering and tamper evidence address other particular problems under their own assumptions.¹⁴ They deserve to be judged by what they establish. A valid transfer following key theft does not refute the cryptography; it exposes a question about entitlement for which that result is insufficient.

Formalization offers the same bargain. The Proofs can establish results in models with specified objects and assumptions. Encoding a challenge mechanism can clarify what it would do. It cannot establish that every institution requires the mechanism, that a person will be able to use it, or that the five historical functions form a necessary ordering. Those claims need evidence and argument of their own.¹⁵

The name protocol belongs, on this account, to an inquiry conducted at the point of reliance. It asks what supports the claim for the intended use, whose act that use becomes, which consequences have been assigned, and what can be done when the grounds or the authority are disputed. The answers need not take the same form in every institution. The inquiry should be exact enough to expose a missing connection, and modest enough to recognize an adequate arrangement it did not anticipate.

There is still a cost to asking. Sources must be examined, identities established where they matter, objections understood, and decisions revised. Some work can be avoided because an earlier institution has done it well and made its grounds available. Some must be done again because the question has changed. A service that lowers the cost of checking may also control access to the record or the means of appeal. Nothing in the speed of the check tells us whether its price pays for necessary work or for a position from which others can be excluded.

The next question is therefore about the division of that work. It matters whether a machine has reduced the labor of verification, moved it to a later recipient, or helped an institution stop noticing that it remains undone. These possibilities cannot be distinguished by the presence of a witness field. They require an account of the whole passage from evidence to action, including the places where a capable institution should decline to proceed. Computation will rearrange costs again. It does not abolish the problem of making a consequential claim answerable after it crosses a boundary.

---

Footnotes

1. Illinois v. Gates, 462 U.S. 213 (1983), pp. 225–27. The account follows the majority's statement of the letter and investigation; it invents neither the author's motives nor the circumstances of composition. The letter's author is distinct from the confidential informant mentioned in the police address inquiry. Quantities and an inconsistent printed month in the opinion's narrative are unnecessary here and omitted. ↩

2. Gates, pp. 227–29, 238–46. The warrant preceded discovery. Probable cause authorizes a bounded investigative intrusion; neither the holding nor the discovery is offered as proof that every inference in the application was sound. The Court rejected bare ratification of conclusory allegations as well as the previous rigid application of the informant tests. ↩

3. Gates, pp. 291–95 (Stevens, J., dissenting, joined by Brennan, J.); majority response at pp. 245–46 n. 14. Stevens considered a separate basis for the automobile search and would have remanded for its consideration. The prose preserves the disagreement over the home warrant rather than treating the dissent as a general denial that the police had discovered evidence. ↩

4. C. A. J. Coady, Testimony: A Philosophical Study (1992), especially the inquiry summarized in the publisher's overview; Edward Craig, Knowledge and the State of Nature (1990), overview and chapter V, pp. 35–44; Jennifer Lackey, Learning from Words (2008), chapter 2, pp. 37–71. These are antecedents to the problem, not authorities for the five-function ordering. The specific uptake argument and its institutional application belong to this chapter. The source note accompanying the candidate records the limits of access to the books. ↩

5. James Steven Rogers, The Early History of the Law of Bills and Notes (1995), chapters 3 and 5; Bills of Exchange Act 1882, sections 47–55. These are the pinned manuscript's governing sources for contingent liability, notice, and protest. The Act supplies a particular codified arrangement, not rules silently projected backward onto every medieval instrument. ↩

6. Federal Rule of Evidence 804, especially (a), (b)(2), and the advisory and legislative notes concerning that exception. The exception concerns an unavailable declarant's statement, made while believing death imminent, about its cause or circumstances; it applies in homicide prosecutions and civil cases. The notes include disagreement about reliability. Imminent death is not treated here as contingent liability, and legal admissibility is not treated as empirical validation. ↩

7. Witold Kula, Measures and Men, trans. R. Szreter (1986), chapter 15, pp. 111–13; chapter locator, digital primary-text reproduction consulted. The inference about portability and entitlement is the chapter's application. The passage does not imply that physical quantities lack properties independent of institutions, or that local custom is necessarily equitable. ↩

8. Felix Klein, Vergleichende Betrachtungen über neuere geometrische Forschungen (1872), the manuscript's klein1872 source. Institutional analogy does not establish closure, inverses, a group action, or a derived ordering among the five functions. ↩

9. Francesco Balducci Pegolotti, La Pratica della Mercatura, ed. Allan Evans (1936); Raymond de Roover, L'évolution de la lettre de change, XIVe–XVIIIe siècles (1953), pp. 38–50, 94–100. These inherited sources concern developed practice and changing instruments, not independent tests of necessity. The same caution protects Edwin S. Hunt's The Medieval Super-Companies (1994): its challenge to the simple Edward III explanation of Bardi/Peruzzi failure remains governing. That bankruptcy is not reused here as confirmation of a deficient sovereign stake. ↩

10. Jack Goody, The Domestication of the Savage Mind (1977); Ruth Finnegan, “Literacy versus Non-literacy: The Great Divide?” in Modes of Thought: Essays on Thinking in Western and Non-Western Societies (1973), pp. 112–44; Angela M. Haas, “Wampum as Hypertext: An American Indian Intellectual Tradition of Multimedia Theory and Practice,” Studies in American Indian Literatures 19, no. 4 (2007), pp. 77–100. These references preserve the original's limits on documentary selection; the chapter makes no new universal account of oral institutions. ↩

11. Specht v. Patterson, 386 U.S. 605 (1967), pp. 607–11. The Court described the conviction as the occasion for a distinct proceeding requiring a new factual determination, with notice, hearing, counsel, confrontation, an opportunity to offer evidence, and findings permitting meaningful review. It did not adjudicate the psychiatric report's truth. The successful later challenge must not be confused with adequate procedure at the original determination. ↩

12. Timothy Garton Ash, The File: A Personal History (1997), the case already developed in Chapter 3. The distinction between administrative capacity and evidentiary quality is retained; the example is not presented as a controlled demonstration that recourse alone determines reliability or legitimacy. ↩

13. Compare McCray v. Illinois, 386 U.S. 300 (1967), pp. 302–08, 311–14. The officers were examined and cross-examined at a probable-cause hearing; the Court did not require disclosure of the known informant's identity invariably under those conditions. This is a restricted source within a challenge procedure, not an absence of all recourse. Crawford v. Washington, 541 U.S. 36, 50, 61 (2004), supplies the original chapter's separate constitutional distinction between apparent reliability and a protected procedure. Neither case is evidence for a universal five-part hierarchy. ↩

14. The original's scoped technical references remain: Diffie and Hellman (1976); Lamport (1978); Nakamoto (2008); NIST, Digital Signature Standard, FIPS 186-5 (2023). A signature establishes a cryptographic relation under assumptions; it does not independently establish identity, consent, or authority. A hash-linked record needs an authenticated reference or other protocol grounds against which alteration can be tested. Bitcoin's settlement rules do not themselves provide a forum to reverse a valid transfer on an adjudication of underlying commercial entitlement. No new implementation or system-family impossibility claim is made. ↩

15. The Proofs, Chapters 15 and 29, A17 and A31: predicate-admission obligations and an explicit representation of event identity. These specifications distinguish an available capability from a guarantee enforced by an implementation. The Codex bridges distinguish the historical witness functions, formal objects and implementation receipt types; none supplies a universal necessity proof for the other. Appendix L identifies the exact-agreement limits of the formal account. ↩