Skip to content
TODD BROWN
« The Anatomy of Corruption and Corrigibility IV — The Applications · Chapter 12

Public Institutions

A state environmental agency holds public hearings four times a year. It publishes an annual report with charts and a letter from the director about renewed commitment to the mission. It has an inspector general's office with its own letterhead and its own budget line. By every visible measure, it is accountable: the meetings are open, the filings are timely, the paperwork exists.

The same wastewater treatment plant has been cited for the same violation five times in three years. Each time, the agency's response is a warning letter and a compliance deadline. Each time, the deadline passes, the violation continues, and a new letter goes out. Nobody at the agency is hiding this. It is in the public record, in the annual report, in the numbers the inspector general's office collects and no one acts on. A junior investigator flagged the pattern eighteen months ago. Her supervisor told her the file was "under review." It is still under review.

Nothing here is a conspiracy. No single person decided to let the plant keep polluting. The permits officer follows the permit process. The compliance officer follows the compliance process. The director gives a speech about protecting the watershed and means it. Every part of the machine is doing its job. The machine has simply stopped correcting itself, and everyone inside it has learned to read that as normal operation rather than as a failure to notice.

This is what makes institutions the hardest test of everything in this book. A group that recruits one person at a time can be seen, eventually, by someone standing outside it. A captured agency or a movement that wins its fight and loses itself operates at a scale where almost nobody stands fully outside. The forms of self-correction survive long after the function has gone, and the people paying the cost are the public that chartered the institution in the first place. The tools built in earlier chapters (the telon, sucralosis, cancrity, corrigibility and its failure mode contracorrigibility, the telonic audit, the collegium) were built at a scale small enough to see clearly. This chapter asks whether they hold up where the stakes are highest.

Agency capture

Every regulatory agency has a mandate: a law, a charter, a founding statute that says what it exists to do. That mandate does not come from the agency. It comes from the public, through a legislature, and the agency exists to serve it. In the vocabulary from Chapter 11, the agency's goals are downstream of the public that constituted it. The public is upstream, the agency is downstream, and the agency's job is to stay answerable to what created it.

Capture is what happens when that relationship runs backward.

It rarely happens as a single event. It accumulates through ordinary, individually defensible decisions. An agency needs technical staff who understand a complicated industry, so it hires people who worked in that industry. Who else would know the equipment? Those staff need career paths, and the best-paying jobs in the field are in the industry they came from. So people leave the agency for industry jobs, and industry people arrive at the agency. Over a few years, the agency's expertise and the industry's are held by the same rotating group of people, who know and respect each other and see the regulated companies less as subjects than as colleagues one office over. The pipeline is measurable. A 2016 study in The BMJ tracked 55 people who reviewed blood-cancer and cancer drug applications at the US Food and Drug Administration between 2001 and 2010. Of the 26 who left the agency, 15 later worked or consulted for the biopharmaceutical industry. Nobody in that pipeline needs to be doing anything but pursuing a reasonable career. That is the point: the flow is structural, not personal.

The metrics compound it. An agency under budget pressure starts reporting "cases closed" instead of "harm prevented," because cases closed is countable this quarter and harm prevented is not. It's the familiar substitution from Chapter 4, a proxy standing in for an end nobody stopped believing in. Closing cases fast means closing them the easy way: settlements instead of contested violations, warnings instead of fines, technical compliance instead of remediation. The dashboard goes green. The plant keeps discharging.

None of this requires anyone at the agency to believe they have stopped serving the public. The inversion doesn't feel like betrayal from inside; it feels like professionalism, expertise, realism about how the industry works. The tell is not what people say about their mission. It is the third question of the telonic audit from Chapter 8: who inside this system has the standing to say the mandate has been inverted, and what happens to them? The junior investigator with the flagged file is the test case. If raising the pattern gets her a promotion and a task force, the agency still has a working correction channel. If it gets her reassigned, or her finding buried in "further review," the agency has told you which way the coupling runs. Not through anyone's confession, but through what it does to the person who asked.

It's worth being precise about what capture is not, because the word gets thrown at every agency that hires anyone with industry experience. A regulator that recruits engineers who used to build the equipment they now inspect has not been captured by that fact alone; expertise has to come from somewhere. The line is the coupling, not the résumé. An agency that hires from industry and still fines its former employers, still revokes permits, still produces findings the industry lobbies against, is staffed by insiders and remains answerable to the public that chartered it. That's goal conflict between two intact systems, industry wanting one thing and the agency insisting on another, and it is exactly as healthy as it looks. Capture shows up when the fines stop, the findings soften, and nobody inside can say why without risking their next job.

The same machinery can capture a whole public conversation, not just one agency. Chapter 6 walked through that case without taking a side, and its test is the one that matters here too: if the description only ever brings to mind people you disagree with, the instrument has stopped measuring the world and started measuring you.

The terminal-goal trap

A movement can organize itself around what it opposes or around what it intends to build. The first is faster to rally people behind, because everyone can feel the wound the villain caused. It is also fragile in a specific, predictable way.

Chapter 1 introduced the distinction between a terminal goal, which has a finish line, and a persistent telon, an ongoing orientation with no finish line at all. A movement organized entirely around defeating an opponent has, whether it admits it or not, adopted a terminal goal: defeat the regime, pass the bill, win the election, force the resignation. The diagnostic question from Chapter 1 applies at full force: what happens to this system on the day it wins?

Picture a resistance movement that spent a decade organizing against a repressive government. Its members share nothing else quite so strongly as their enemy: different classes, different regions, different visions for what should come after, unified by what they are against. The regime falls. The next morning, the thing that organized every meeting, every risk, every friendship inside the movement is gone. It doesn't fade. It vanishes on the day of victory, which is the day people expected to feel whole.

What fills the vacuum is rarely nothing, because the movement still has the machinery it built for opposition: the vigilance, the suspicion of insiders, the reflex of treating disagreement as a threat to root out. That machinery doesn't go dormant because the original target is gone. It is ready-made and idle, and idle machinery built for finding enemies tends to find new ones. Historians of revolution have described this repeatedly; Crane Brinton's classic comparative study of four revolutions traced how, after the old order fell, power tended to pass to the most militant faction, followed by a period of enforced orthodoxy. This is not a claim that resistance movements are secretly the same as what they resist, nor a verdict on anyone who joins one. It is a structural tendency, the same failure shape recurring in different machinery each time. An identity built entirely on opposition holds a terminal goal wearing a persistent telon's clothing, and terminal goals leave nothing behind when they're achieved except the muscles built to pursue them.

The contrast is the polio charity from Chapter 1, the March of Dimes, founded in 1938 as the National Foundation for Infantile Paralysis. When the Salk vaccine arrived in 1955, it did not dissolve into confusion about its purpose. It had a broader orientation underneath the terminal goal, closer to "protect children's health," and it pivoted to birth defects and later premature birth.

The design lesson generalizes. If you are organizing against something (a captured agency, a corrupted institution, a bad law), the question to ask before the fight is won is not only "how do we win" but "what are we building, and does it already exist in some form?" A movement that can answer before victory has somewhere to land. A movement that cannot is one win away from a crisis it won't recognize as a crisis, because from the inside it will feel like arrival.

Designing for correction

Most of what has been said so far diagnoses failure after the fact. This section asks a more useful question: what would it take to build an institution that keeps correcting itself on purpose, instead of hoping it does?

Chapter 3 named the property that separates a collegium (a system that coordinates through shared standards and distributed oversight, like a functioning court or a serious engineering culture) from a system that has only kept the collegium's paperwork. The defining property is not expertise or prestige. It is that a collegium can be wrong and knows how to find out. Chapter 9 named the anatomy that makes that possible: correction channels that get used, not just installed; enough internal variety to notice when something is drifting; identity kept separate enough from current belief that updating a belief doesn't cost anyone a self. Earlier chapters described these mostly as things healthy systems tend to have. At institutional scale, they need to be treated as design requirements, written into the org chart the way a building code specifies load-bearing walls, because nothing about human incentives builds them by default.

Four requirements, each addressed to a failure already covered.

Build in exercised dissent, not just permitted dissent. A red team with no power to delay a launch, a minority report nobody has to read, an ombudsperson with no budget: these are the machinery Chapter 9 described as atrophying from disuse until it is indistinguishable from machinery that was never installed. A dissent channel only counts if using it has, on the record, changed an outcome at least once. Rotating people through roles on a predictable schedule keeps a monoculture of opinion from forming. That's Ashby's requisite variety, cashed out as staffing policy: an institution needs at least as much internal variety as the range of problems it might face, or it will be blind to whichever problem falls outside the range its people already share.

Make changing course a promotion, not a demotion. In most institutions, the safest career move is to defend the last decision; the fastest way to end a career is to be the person who said, loudly and early, that the last decision was wrong. That incentive guarantees that the people with the clearest evidence of a mistake have the strongest reason to stay quiet. Reversing it, rewarding the analyst who caught the error over the one who avoided catching it, keeps identity separate from belief at the institutional level: nobody has to lose standing to be right about something new.

Measure presence, not just absence. "No scandals this year" looks identical whether an institution is healthy or whether its correction channels have stopped generating anything to report. That's Chapter 9's point about absence-based health metrics, restated at scale. Two hospitals can both report zero medication errors for a quarter. One has a culture where nurses catch and log near-misses before they reach a patient. The other has a culture where nobody reports anything because the last nurse who did got written up for it. The dashboards are identical. The institutions are not. A healthier signal counts active correction: complaints that got resolved and changed a policy, dissenting reports that were read and answered, audits that found something and led to a change. An institution with zero findings for ten straight years is not obviously the safest one on the list. It may be the one where nobody is looking anymore.

Route the whistleblower channel around the people it might implicate. This is the rootkit lesson from Chapter 6: a correction system that reports to the office it might need to correct is not a correction system. It is a mirror with a badge on it. A hotline that funnels every complaint about a department through that department's own management has been designed to fail exactly when it matters most. Aviation has a working version of the fix. Since 1976, pilots, air traffic controllers and other aviation workers in the United States have been able to report a near-miss or a procedural error through the Aviation Safety Reporting System. It is run not by the Federal Aviation Administration, the regulator that can pull a license, but by NASA, which has no enforcement authority over the people filing. Reports are confidential, federal rules bar the FAA from using them in enforcement, and a timely report can earn the reporter limited immunity from penalties for an unintentional violation. The design choice is the whole lesson: the office collecting the confession is not the office that can punish the confessor, and the two are kept apart on purpose. The fix elsewhere has the same shape: an external ombudsperson, a channel that bypasses the chain of command it might need to flag, protection that survives the whistleblower's manager finding out.

None of this makes an institution incorruptible. These four requirements raise the cost of capture; they don't remove the possibility. An institution is a pattern, not a fortress, and every pattern drifts if nothing tends it. Designing for correction buys more chances to notice drift before it becomes permanent. It does not buy a final answer, because there isn't one. The maintenance is the job, indefinitely.

Grounding at civic scale

One defense doesn't have to wait for any institution to redesign itself. Call it telonic grounding: an identity spread across enough plural, revisable commitments that no single membership's loss would dissolve the self holding it. Chapter 14 develops it at the scale of one life. Here is the civic version.

Picture someone whose sense of who they are runs entirely through one political identity: one party, one feed, one set of causes, held not as commitments but as the whole self. For that person, evidence that cuts against the party's current position is not information to weigh. It is a threat to the only self available. There's no other ground to stand on while reconsidering, so reconsidering feels like falling.

Now picture someone whose politics are one commitment among several: a trade they're good at, a running club or a congregation or a family that doesn't care how they voted, neighbors they trade favors with regardless of the yard signs. That person can hear "the position you've held for years turns out to be wrong about this" and lose an argument without losing a self. The running club doesn't care who won. The neighbor still needs help moving a couch on Saturday. This is not a claim that plural commitments make anyone more likely to be right. It is a claim about what makes someone able to update at all. The diagnostic travels: if leaving your political side would mean you no longer knew who you were, the capture has already started, whichever side it is.

The instrument

Three angles on the same tools, depending on which seat you're in.

If you're organizing a reform effort: before the fight is won, ask what you are building, not only what you are fighting. Does the replacement exist in some form already, or only the opposition to what's there now? If the honest answer is "nothing yet," build something, even something small, before the old enemy is gone. An answer you can't give yet is a warning, not a failure; it means the work isn't finished.

If you're designing or auditing an institution, including one you run, four questions do most of the work:

  • Has the dissent channel changed an outcome recently, or does it only exist on an org chart?
  • Does changing your mind in public cost anyone their next promotion, or does it earn one?
  • Does the health metric count active correction (complaints resolved, findings acted on), or only the absence of scandal?
  • Does the whistleblower channel route around the people it might need to flag, the way the aviation reporting system routes around the regulator?

If you're a citizen: name three sources of identity that have nothing to do with your politics: a craft, a faith, a family, a friendship, a place. If you can't name three, that's the finding, not a failing grade. A portfolio can be built starting today, one commitment at a time, and it is the one repair in this chapter that doesn't require anyone else's institution to change first.

What's next

Institutions are where these failures cost the most and where the fixes are hardest, because the scale that makes the stakes public also makes any one person's leverage small. The environmental agency in this chapter's opening will not be fixed by one investigator, no matter how many files she flags. That is the honest limit of this chapter: naming the mechanism raises the cost of ignoring it, and it does not, by itself, move a dollar or repeal an incentive.

But almost nobody meets sucralosis, capture or a hollowed correction channel for the first time in a government agency. Most people meet it first in a smaller building with a more familiar name on the door: the place they go to work, five days a week, long before they think to call it an institution at all. That's next.

Sources

Contents · Glossary · How this was written