What Keeps a Record Standing

Preserved, Public, and Powerless

The record existed the whole time. The institution behaved as though it didn't.

In April 1994, the chief executives of the seven largest American tobacco companies testified before Congress, under oath, that they believed nicotine is not addictive. Their own companies' research had reached the opposite conclusion decades earlier, in internal documents that were in their files at that very moment. The evidence was preserved. It was even, in fragments, already public. And for half a century it corrected nothing.

What changed was custody. Copies escaped exclusive control: a paralegal removed internal files that reached researchers and Congress, and litigation forced millions of pages into public archives that settlement terms locked open. In 2006, a federal court found that the industry had engaged in a decades-long scheme to defraud the public, and it cited the industry's own documents to do it. The record did not prevail because it was true. It had been true and losing for fifty years. It prevailed when copies reached custodians the companies did not control, attached to parties with standing to compel production and levers to apply when they got it.

Preservation is not standing. A record can be perfectly kept and perfectly powerless.

The Standing Problem

Elsewhere on this site, a companion program, Making Standards Matter, studies how a published criterion acquires practical force. This program studies the same property from the other end: once evidence has standing, what allows it to keep that standing when an actor with authority, money, access, or communicative power has an incentive to take it away?

The naive threat model is deletion, and deletion is the least of it. A record can be attacked without a single page being destroyed. Its contents can be revised with no trace of the prior state. It can be seized into exclusive custody, or withheld while its existence is denied. Its provenance can be attacked so that the document survives and its authority does not. An institution can leave the record fully intact and place an authoritative interpretation beside it that reverses what the record is taken to establish. Authentic evidence can be drowned in manufactured volume until it is one claim among thousands. And, in the mode this program considers most dangerous, a record can be intact, public, and universally inspectable while the surrounding structure loses the capacity to act on it. Everyone can see it. Nothing happens.

Record preservation solves none of this. These are attacks on epistemic standing, and they succeed routinely against evidence that is authentic, available, and correct.

The question is what lets a true record keep correcting a system that would prefer not to be corrected.

Realis publishes standards and studies the conditions that let records, verification, and authority bear load over time. Every one of those conditions inherits this problem. So the lab has opened a research program on the question directly: under adversarial load, what structural conditions allow a verified record to retain its capacity to correct the system that it describes?

The Candidate Threat Taxonomy

The program begins where a structural discipline has to begin, with a taxonomy of the attack surface rather than a protocol for defending it. The candidate taxonomy groups the known modes into three families, by what they target.

This is a candidate taxonomy, and the program treats it as one. The families may be wrong, the modes may collapse into one another under coding, and the inventory is almost certainly incomplete. It is published at this stage for the same reason the companion program published its architecture before results: so that the predictions it generates are on the record before any case is scored, and so that people who know these attacks from the inside can correct it while correction is cheap.

Readers meeting this territory for the first time can begin with I Believed in Mermaids, which describes the same attack surface in ordinary language, applied to shared public reality: a record held in common.

Candidate defense mechanisms exist in the literature and in practice: distributed custody, independent archives, attributable revision history, statutory disclosure, standing to compel production, professional custodial obligations, consequence channels owned by parties with opposing exposures. The program lists these as hypotheses and declines to rank them, because none of them has yet been earned against the case bank. A cryptographically perfect record that no one has standing to invoke is an extraordinarily trustworthy paperweight, and the program intends to find out, rather than assume, which mechanisms separate the archive that moved a system from the archive that decorated one.

What the Program Is Doing

The research runs on matched historical pairs: evidence of comparable authenticity and comparable threat to its custodian institution, retaining force in one arm and losing it in the other, so the truth of the record is constant while the surrounding structure varies. Corporate research archives that surfaced with consequence against archives suppressed without one. Safety reporting that altered operations against near-identical reporting that was filed and inert. Government records that survived custody transitions against records that did not survive their custodians. Cases are coded against pre-registered predictions about which structural conditions were present in the surviving arm, with a stopping rule frozen before scoring that specifies the result under which the taxonomy is wrong as such. If the model fails, the failure will be published under the same documentation discipline the corpus asks of the institutions it studies.

The full arc under study runs in four movements: how evidence acquires standing, how it survives, how it retains standing under attack, and how it regains the ability to move the system after standing has been lost. The companion program owns the first movement, and the corpus's work on memory continuity addresses the second: the record survives. This program exists because survival is necessary and insufficient. It owns the last two movements, where the surviving record either keeps its standing or loses it.

One boundary is structural and is stated here so that no collaborator has to discover it later. The program codes cooled cases only. It does not adjudicate live political controversies, certify any current party's account, or lend the lab's instruments to disputes still in motion, and it reads any administration, corporation, or institution by the same coding scheme. This is a constraint of method, not of courage: a case can only be coded against its outcome once the outcome exists, and an instrument that takes sides in the fight is no longer measuring it. The live cases that make this program feel urgent are stress previews. The science runs on the ones that have settled.

Neighboring Work

The questions next door.

The nearest neighbor to this program is Michael Power's sociology of audit. The Audit Society examines verification as a social technology: how organizations are made auditable, how checking comes to operate on systems of control, and how the ritual of verification produces assurance and legitimacy for those who rely on it. The mode this program considers most dangerous, a record intact and universally inspectable while nothing happens, has a near relative in his account of verification producing assurance through the structures of audit even where assurance and substantive condition can come apart. None of that is rediscovered here.

The boundary between the two inquiries is the object each takes. Power's is the institutional technology of verification itself: how assurance is produced and what authority it acquires from the structures around it. His deepest challenge to this corpus, that audit of the administrative kind never began in pure correspondence testing, is an argument about verification's origins, and this program is positioned where it cannot reach. Its object is the verified record after the finding exists: whether it retains the capacity to correct the system it describes when interests move against it, through recognition, access to an actor able to act, and consequence attached. Verification is not self-executing; what happens to its product after that point is the ground this program tests.

Michael Power, The Audit Society: Rituals of Verification (Oxford University Press, 1997).
Michael Power, The Audit Explosion (Demos, 1994).

Who This Needs

The knowledge this program requires is already distributed across professions that rarely see themselves as parts of one structure. Archivists and records managers know how custody actually changes hands. Discovery and public-records litigators know which compulsion pathways function and which exist only on paper. Journalists on document-driven beats know what flooding and recontextualization look like from inside a story. Inspectors general, auditors, and safety-report custodians know the distance between a finding that moves and a finding that files. Provenance researchers know how authenticity is attacked and how it is defended. Each of these fields has part of the answer to a question none of them is positioned to ask alone.

Collaborators can attack the taxonomy, supply matched cases and prior art the program has missed, name the constraints inside their own custody and compulsion channels, and prototype components within them. As with the companion program, no one is being asked to adopt anything of Realis's. An archivist can document a custody chain, a litigator can test a compulsion pathway, a records officer can pilot an attributable revision practice, and the components work severally, with no center and no coalition for the lab to operate. The lab's role is to characterize the machinery and publish enough of the design that the people who already possess its component capabilities can build independently.

A record cannot defend its own standing. Something in the structure around it has to.

The program's commitments are published in full before any results exist: Record Standing Under Adversarial Load: A Candidate Threat Taxonomy and Pre-Registered Research Design, a pre-results working paper recording the taxonomy, method, case bank, predictions, and stopping logic, with its results sections gated until the research earns them.

Contact Realis Institute to challenge the taxonomy, contribute a matched case, or prototype a component in your channel.

Banner: a National Transportation Safety Board investigator with the flight data recorder recovered from Miami Air Flight 293, Jacksonville, Florida, 2019. NTSB photograph, public domain. The choice is deliberate. A flight data recorder is a record engineered on the assumption that its own catastrophe is coming: armored against impact and fire, painted orange so it can be found, placed where the destruction is least. And the engineering is only half of it. The photograph shows the other half. The recorder has force because a structure is ready to receive it: an investigator with statutory authority to take custody, a mandate to read it, and consequence channels that turn what it says into what changes. Even the label on the unit knows this. It says ne pas ouvrir, do not open, because extracting what it recorded without destroying it belongs to a laboratory built for exactly that. A perfect record with none of that attached would just be orange. The device is the shortest possible statement of this program's finding-in-advance: survival is designed, and standing is designed separately.