Sixty-one failures, one repeating fix
A one-page briefing for the Public Administration and Constitutional Affairs Committee.
The pattern
Sixty-one documented institutional failures — Horizon, the deleted WhatsApps, the carer pursued for a debt the state watched grow — have been rebuilt as machine-checked case studies and stress-tested against one thin protocol for public decisions. In fifty-two of the sixty-one, the harm ran through a record: one that was quietly absent, quietly altered, or quietly ignored.
The fix that repeats is not a new power or a new regulator. It is a record of each act of power that cannot be quietly absent (it must exist at the moment of the act, citing the rule it acts under), cannot be quietly altered (independent witnesses hold its fingerprints), and cannot be quietly ignored (its silence is itself a visible, datable fact).
Three cases this committee knows
Government by WhatsApp
Decisions were made and reasons destroyed by disappearing messages before any record existed. A required contemporaneous record turns the absence itself into the visible breach — dated, attributable, on the day.
Honest limit: the corpus marks this one broken — where substance is destroyed off-record, a log proves only that nothing arrived. The record must be made to be protected.
FOI slow-walking
Deadlines missed, public-interest extensions stacked, requesters profiled. Every one of those levers acts on the request — so the protocol removes the request. A record public by default cannot be slow-walked; there is nothing to ask for.
Honest limit: true for the acts it logs, not for reasoning kept off it.
Rewriting the minutes
An append-only log whose fingerprints independent parties already hold: rewriting any entry breaks a chain the world can check. The one case in sixty-one where the protection fully holds — because tamper-evidence is precisely what the machine is for.
Automated benefit decisions
An algorithm suspends a claim and cannot say why. Under the protocol every adverse decision must cite the rule it acts under — a model flag that has no reason produces a visible missing reason, on the record, appealable from day one.
Honest limit: it cannot judge eligibility or fix a biased model — it makes the missing reason a fact.
Carer's Allowance overpayments
The state held the earnings data while the debt grew, then prosecuted the growth. A logged duty-to-act makes the state's own delay part of every demand it later issues: the carer sees her breach the month it happens, not five years and £20,000 later.
Honest limit: it cannot abolish the cliff-edge or erase a real debt — it forecloses harm grown in silence.
Internal reviews of claimant deaths
Reviews buried, recommendations vanishing between reports. Each review becomes un-buriable and family-readable, and each recommendation is tracked to its fate: implemented, or visibly not — a number a committee can put to a Permanent Secretary.
Honest limit: it cannot compel implementation — it makes non-implementation count itself.
Police vetting failures
Nine warnings about one officer, each dismissed alone, none aggregated. The protocol keeps the file it refuses on any citizen — on the one who holds power: flags cluster visibly, and every dismissal must cite its reason.
Honest limit: it cannot judge whether a cluster warrants removal — it forecloses the untraced dismissal.
Citizenship deprivation
Citizenship removed without notice, discovered at a border. Deprivation becomes a noticed, appealable act citing its statutory power, escalated to rights review automatically — the secret removal is foreclosed.
Honest limit: the appeal still leads into a closed court, and the roll stays the executive's to edit.
Protest conditions without basis
Conditions imposed on the day, basis supplied later or never. Each condition must cite its legal basis at the moment imposed, and the missing basis is immediately visible to the assembly it restricts.
Honest limit: review moves at legal speed and a protest is one day — legibility arrives; the day may not.
Post Office Horizon
Twenty years of "trust the computer" — convictions on a record only the operator could see or silently correct. An append-only, witnessed accounting record makes a shortfall something you check, not something you take on an operator's word.
Honest limit: a bug's logged entry is still wrong — but it is checkably wrong, by the defence too.
The PPE VIP lane
Every contract was lawful; the lane was not. Each award logs the power it acts under and the referral that produced it — a hidden fast lane becomes a signed, contemporaneous, countable number instead of a two-year reconstruction.
Honest limit: legibility, not remedy — value for money stays this committee's judgement to make.
Carer's Allowance overpayments
The state held the data that would have stopped the debt at one pound, then spent public money recovering and prosecuting its growth. The record makes prevention's price visible next to enforcement's — the cheapest pound is the one never owed.
Honest limit: it cannot compel the timely act — it prices the failure to act.
What it cannot do
- It does not decide substance — who is right, what is true, what a policy should be. That refusal is structural: a machine that judged substance would be worth capturing.
- It reaches legibility, not remedy. A wrong made visible still needs a forum — this committee, a court, a regulator — willing to act on it.
- It binds only bodies that adopt it. Three preconditions recur: the record must be made; a forum must act on what it shows; the adopter must be willing. In eight of the sixty-one cases those fail, and the case is marked broken — the corpus counts its own failures.
One question it puts in this committee's hands
When a witness next says a record did not exist, was not kept, or cannot now be found: ask why it could not have been required to exist — at the moment of the act, citing the rule it acted under, in a form no one could quietly edit.