Guaranteed secrecy

Why does a promise that can never be broken get told the things nobody would otherwise admit?

Some institutions promise a secrecy with no exceptions at all. The Catholic seal of confession is the starkest: canon law calls the sacramental seal inviolable and forbids the confessor to betray the penitent in any way, for any reason, with automatic excommunication reserved to the Holy See for a priest who breaks it directly. No court order lifts it, no gravity of the matter lifts it.

That looks like a mistake before it looks like a policy. Surely a rule allowing disclosure in the rare, terrible case beats one that forbids it always? Yet the exceptionless version is the one that receives the disclosures nobody makes anywhere else. Why would removing your own discretion increase what you are told?

Put yourself on the other side of the grille — not as the keeper of the secret, but as the person deciding whether to speak. When must you decide? Before. And what do you know at that moment? Only the rule's wording, not how this listener will read it in a situation neither of you has seen yet.

So the teller does not evaluate the rule's average behaviour. They evaluate its worst plausible reading, applied to the very thing they are considering saying. That single observation carries most of the argument.

Now write the humane exception into the rule: the secret is kept, unless it reveals grave harm. What does the teller do next? Disclosures falling clearly outside the exception — the trivial, the merely embarrassing — are still made, because they were never at risk. Those falling clearly inside it are not made at all. And the large ambiguous middle, where the teller cannot predict which side of the line their own case lands on, is decided by fear. The exception was drafted to capture the grave cases, and the grave cases are exactly what it deters from being spoken. An exception whose scope the teller cannot verify in advance does not filter what is told; it filters at the source, removing the very material it was written for.

Which is why the guarantee has to be unconditional to be credible, and credible to be worth anything. Its whole value is generated before it is ever tested, by someone who will never watch it being kept.

This is not a religious peculiarity. Aviation runs on the same design: the Aviation Safety Reporting System is administered by NASA rather than the regulator, reports are de-identified, and filing one carries limited protection from enforcement — so that a pilot who has just made a dangerous mistake describes it rather than hides it. Rules that kept their exceptions traded the other way: legal privilege yields to the crime-fraud exception, and therapist confidentiality in much of the United States carries a duty to protect third parties after Tarasoff v. Regents of the University of California in 1976.

The cost of the seal is not hypothetical. Australia's Royal Commission into Institutional Responses to Child Sexual Abuse, reporting in 2017, recommended removing the confessional exemption from mandatory reporting of child abuse, and several Australian jurisdictions legislated to that effect over Church objection. The mechanism described here predicts such a law will silence the confessions rather than surface the crimes. That is a falsifiable empirical claim, and the test is straightforward in principle — compare disclosure rates in the protected category before and after the exception — though the confidentiality under study makes the measurement extraordinarily hard, and I know of no evidence clean enough to settle it. Anyone confident about the outcome is guessing.

The most common misreading is that the seal expresses how enormously the institution values privacy. It is better understood as a commitment device: the holder's discretion is destroyed deliberately, because the discretion is what the teller fears. The penalty attaching to the confessor is aimed less at him than at the person in the pew, who needs to see that breaking it is not an option the listener possesses.

This is worth separating from two neighbouring puzzles here. Promising asks where an obligation comes from at all — how words alone can bind; guaranteed secrecy takes the obligation for granted and asks what unconditionality buys and costs, a question about design rather than origins. Keeping a rule against the case comes closer: there the argument is that a rule earns its keep through the pattern it sustains, so breaking it in the one favourable case erodes something. Here the structure is sharper than erosion. The good was generated entirely in advance, by someone reasoning about whether an exception exists — so a case-by-case exception does not wear the rule down over time, it removes the good before the first case arises. That anticipatory structure is the fixed point of difference.

Two real limits. First, the argument establishes that exceptions are costly, not that none is ever worth its cost — a society may rationally decide that preventing a class of grave harm is worth losing the disclosures about it, and nothing in the mechanism settles that judgement. Second, it only bites where the teller decides freely and knows the rule. Where disclosure is compelled anyway, or the teller is ignorant of the terms, the guarantee buys nothing and the case for keeping it must come from elsewhere — from the sacrament's own theology, say, rather than from incentives.

• Whether a guarantee that survives contact with a court is possible without a formal legal privilege behind it.

Every term the collection defines is gathered in the glossary.