"Don't be evil" versus "can't be evil"
For fifty years the fair information practice principles have told institutions to collect only what they need and use it only for stated purposes. The principles are right, but they have never been enforceable where it counts, because the systems permit every violation and policy merely asks officials not to commit it. Policies change with administrations, bend in emergencies and are interpreted by contractors. Architecture enforces; policy requests.
Four architectural mandates
- Purpose sequestration. Separate, purpose-limited data stores with no lateral sharing absent individual authorization or specific legal authority. This is the structural form of loyalty.
- Query-without-collection. Systems answer the question government is authorized to ask, such as "is this applicant eligible?" or "does this plate match an active warrant?", without copying or retaining the underlying data.
- Holder-controlled credentials. Government attests to facts on credentials the person holds and presents. The issuer is not told where, when or to whom a credential is shown.
- Zero Trust with complete records. Every access is authenticated, justified, authorized for that operation and logged where the person and reviewers can see it. Officials are trustees, not sovereigns.
Necessary government functions survive
The architecture is not a demand for weak government. Emergency medical response, fraud detection, coordinated services, guardianship, child welfare investigation and criminal investigation can each be performed without standing profiles of the population. In several cases the constitutional design is faster and more secure: a sequestered system limits what any single breach can expose. Data lakes are a procurement choice, not a technological necessity. See the six worked cases on the hard cases page, and the technical patterns for implementers.
Remedies a court can order
Because the wrong is architectural, the remedy can be too. Structural injunctions can require sequestration, the removal of cross-purpose capability, and query-without-collection designs, translating constitutional duties into specific, testable system requirements rather than case-by-case suppression.