Dedicated to Grace Murray Hopper, who taught a machine to read English
so that ordinary people might read what the machine writes;
and to the millions who have waited in queues they did not design,
for benefits they had already earned.
When the heavens were re-centered from the Earth to the Sun, nothing in the sky moved an inch — but everything in how humans saw the world changed. So too with COBOL: when we re-center the administrative state from the agency to the person, not a single line of legacy code needs to vanish, but the justice produced by that code is transformed.
Grace Hopper did not write COBOL because she loved mainframes. She wrote it because she believed business logic should be legible to the people whose lives it governs. Sixty-six years later, 70–80% of the world's financial transactions still run on COBOL; and yet the very same clarity-of-language principle that birthed COBOL is the principle we must now carry forward into the post-quantum, genomic, algorithmic era. This book is an attempt to do exactly that.
There is a river that runs through the American administrative state. It was designed to carry people from injury to remedy, from diagnosis to support, from need to the means of living. For most of the twentieth century, it moved with a certain bureaucratic sluggishness — slow, but forward. In the twenty-first century, the river has backed up. It has become a pond, then a swamp, then a place where people go to wait and some of them do not come out.
The Social Security Administration's disability adjudication system is not a failure of malice. It is a failure of scale — a system designed for a world of paper and human clerks, now processing the claims of a nation with the tools of a bygone era. The numbers are stark: over one million claims pending, average waits measured in hundreds of days, and deaths — tens of thousands per year — among those waiting.[1,2] These are not abstract statistics. They are the human cost of a system that cannot see the people inside its queue.
This book is about a response to that failure — and to a cluster of related failures that share a common root. The root is this: the institutions that hold the most sensitive information about us — our genomes, our neurophysiology, our administrative records, our financial identities — are constrained by instruments drafted for a world in which such information was either impossible or expensive to collect. The genome is the clearest case. It is immutable, it identifies without being intended to identify, it implicates relatives who never consented, and the statute that governs it reaches only health insurance and employment. The gap between the sensitivity of the data and the enforceability of the duty is not a single wrong. It is a structural under-protection that appears as a civil-rights claim in one forum, as an evidentiary problem in another, and as a queue in a third.
The response described in this book is called the MERCY Protocol — a name chosen not for sentiment but for precision. Mercy, in the administrative sense, is the act of seeing a person where the system sees only a case number. The Protocol is a stack of systems that together attempt to do four things:
Each layer is necessary. None is sufficient alone.
The book is organized as a narrative, moving from the wound to the architecture to the implementation. Along the way I use diagrams and cinematic metaphors to make the systems visible, because the only way to hold a system this large in a human mind is to see it as something else: a river, a ledger, a flock, a heart, a ramp.
Imagine a hospital where the triage nurse has been replaced by a clock. Everyone who arrives is given a number. The number is the time of arrival. The clock advances. When your number is called, you are seen. The clock does not care whether you are bleeding, whether you are unconscious, whether you have hours or years. It only knows the order of arrival.
This is the SSA disability queue. It is fair in the narrow sense: it treats everyone the same. It is lethal in the broader sense: it treats everyone the same regardless of how much the delay will cost them.
The Government Accountability Office documented that over a decade, more than 110,000 appellants died while their claims were pending.[1] The SSA's own Office of the Chief Actuary estimated 33,270 deaths in FY2023 among those awaiting a decision at the DDS or ALJ level.[2] The average wait for an ALJ hearing exceeded 230 days in FY2024, up 86 percent from 2019. The federal court remand rate — the proportion of cases sent back because the agency got it wrong — rose to 62 percent. Of those remanded, roughly two-thirds were ultimately awarded benefits. The delay itself is the denial mechanism. A claim that is approved after two years is not a claim that was approved. It is a claim that was denied for two years and then, belatedly, recognized.
Result. The system has no mechanism to ask: "Who among these is most likely to die before their number is called?" It is formally fair, treating everyone identically. It is substantively lethal, because identical treatment is not equitable treatment when the people are not identically situated.
The genome is not a medical record. A medical record describes what happened to you. A genome describes what you are, what you might become, and what you share with everyone to whom you are related. It is immutable — you cannot change it. It is uniquely identifying — your genome is yours alone. It is predictive — it carries probabilistic information about future disease. It is relational — it reveals information about parents, siblings, and children who never consented to anything. And it is persistently sensitive — as science advances, the same data reveals more.
The legal problem. Existing privacy frameworks (HIPAA, GINA) were drafted for a world of paper medical records and rare genetic data. The genome breaks every category:
The disability system does not simply delay. It recycles. A claim is denied at the initial level. It is denied again at reconsideration. It goes to an ALJ, who may deny it or approve it. If approved, a continuing disability review may later terminate it. If denied, it goes to the Appeals Council, then to federal court, then back to the agency. Each cycle costs time. Each cycle costs money. Each cycle costs health. The claimant is not moving through a system. The claimant is circulating through a system that has no exit.
Key evidence.
If the genome is a book that cannot be rewritten, the problem of genomic privacy is the problem of who holds the book. The current answer — a direct-to-consumer testing company, a research biobank, a hospital system — is inadequate because these entities can be breached, can go bankrupt, can be acquired, can be compelled by subpoena. The solution is not to trust them more. The solution is to make the book unreadable to anyone but its owner.
This is the purpose of the post-quantum cryptographic envelope. It is a lock designed to resist not only the computers of today but the quantum computers of tomorrow. The threat is called harvest now, decrypt later: an adversary records encrypted data today and decrypts it when a sufficiently powerful quantum computer exists. Because genomic data is sensitive for decades — for generations — a cipher whose security expires before the data does is a cipher that has already failed.
The standards. FIPS 203 (ML-KEM),[7] FIPS 204 (ML-DSA),[8] FIPS 205 (SLH-DSA),[9,10] SHA3-256 for Merkle-DAG hashing; AES-256-GCM for symmetric authenticated encryption.
Why lattices? Lattice problems (Learning With Errors, Shortest Vector Problem) are believed hard for both classical and quantum computers.[11] ML-KEM-1024 provides NIST security level 5 (AES-256 equivalent); ML-DSA-87 provides strong SUF-CMA unforgeability; SLH-DSA provides a conservative fallback based only on hash-function security.
If the envelope answers who can read the book, the audit ledger answers the complementary question: who did read it, when, for what purpose, and on whose authority? This is not merely a logging problem. It is an evidentiary problem. In an administrative proceeding, civil suit, or criminal investigation, the question "was this claimant's genomic data accessed in connection with their disability determination?" must have an answer that cannot be rewritten after the fact.
The ledger is a Merkle-DAG where every node is a tuple ⟨subject, actor, purpose, query, result-hash, t, σ⟩ committed under SHA3-256 and signed with ML-DSA-87. Each leaf is a single access event; each internal node batches a fixed number of leaves; the root is cross-signed by a quorum of trustees under SLH-DSA. Readers cannot alter a historical entry without breaking the hash chain and forging a post-quantum signature.
REQUIRE: Root R_t at time t, access entry e, witness path π
ENSURE: accept or reject
1: h ← SHA3-256(e)
2: (h', σ) ← final node of π
3: if h' ≠ h then reject // entry hash mismatch
4: if VerifyML-DSA-87(h', σ, actor-key) = false
then reject // actor signature invalid
5: r ← recompute root from π
6: if r ≠ R_t then reject // Merkle proof invalid
7: accept
The envelope cannot be absolute. A court may order disclosure; a public-health authority may need aggregated signal; a family member, in narrowly defined circumstances, may need to know about a transmissible risk. The Protocol therefore includes a judicial escrow: keys are Shamir-split among n trustees, any k of whom can reconstruct a key, but only pursuant to a warrant or written judicial finding logged to the ledger before reconstruction.
The escrow is the price of political legitimacy. A system that refuses all lawful process is a system the state will eventually break. A system that provides lawful process under audit is a system the state has an incentive to preserve.
Seeing, in the administrative sense, is not the same as capturing data. A form captures data. A system sees when it can answer a specific, morally urgent question: "Which of the people currently waiting will die if we make them wait another ninety days?"
The answer is a vector: a mortality-risk score, a socioeconomic-vulnerability score, a procedural-history score, a wait-time score, and an anti-starvation term that grows without bound as wait time approaches a statutory ceiling. The vector is computed on data the agency already possesses — medical evidence, earnings records, zip code, age, prior denials — so the system does not need to collect new information in order to see. It needs permission to use what it has.
The most sensitive signals the system needs to "see" are medical. Treating-physician records, consultative-exam findings, and (where voluntarily released) neurogenetic biomarkers carry predictive weight. If those signals can be scored without ever being decrypted by the scoring engine, two things happen at once: privacy risk shrinks, and admissibility under administrative-evidence rules improves, because scoring logic can be published and audited without exposing patient data.
HSPA v3.0 is a Homomorphic Scoring Pipeline for Administrative triage that operates on ML-KEM-encrypted biomarker vectors, producing an encrypted score that is decrypted only inside the claimant's own HSM-protected envelope. The result is a number, not a record.
Every priority score the system produces must be traceable, line by line, to the evidence that justifies it. This is not bureaucratic formality; it is the condition under which a court will defer to the score rather than remand it as arbitrary and capricious under the APA.
Administrative amnesia is not a bug. It is the default. Files are lost, systems are migrated, examiners are rotated, and a claimant who re-applies three years after a denial often starts over as if the prior record did not exist. The whirlpool of Chapter 3 depends on this forgetting; without it, the same denial could not be issued to the same person three times in succession.
Remembering, in the MERCY Protocol, means three things simultaneously:
The audit ledger of Chapter 5 is the substrate; the institutional-memory layer adds retention policies, redaction receipts, and dual-write semantics. When an examiner writes a finding, it is committed to the ledger, signed by the examiner's ML-DSA key, and a signed receipt is returned to the claimant's envelope. When the claimant submits new evidence, it is committed on the claimant's side and a receipt is sent to the agency. Neither side can pretend not to have received what the other side sent, because both sides have a signed record of it.
This is not a radical proposal. It is the legal principle of service of process, elevated into software. The law has always required that the other side get a copy. The Protocol simply ensures that the copy cannot be denied.
A queue that orders only by arrival time is not a neutral queue. It embodies a moral theory: that the cost of delay is the same for everyone. The theory is false. Delay costs more for some people than others. A twenty-five-year-old claimant with a terminal diagnosis loses more from a two-year wait than a fifty-five-year-old with a stable condition loses from a six-month wait. To treat the two identically is not to be fair. It is to be wrong, with fatal consequences.
MORTAR — the Multi-Objective Risk-Triage and Assignment Regimen — replaces the single key (arrival time) with a composite score:
pi = α·ri + β·vi + γ·wi + δ·si
where si = max(0, wi − w̄) grows linearly once a claimant passes a system ceiling w̄. Weights are published, feature vectors are auditable, and the resulting ordering is Pareto-efficient under standard scheduling constraints.
REQUIRE: Claims pool C, weights α,β,γ,δ, ceiling w̄ ENSURE: Sorted priority queue Q 1: Q ← ∅ 2: for each claim i in C: 3: r_i ← HSPA-Score(i) // encrypted, decrypted in enclave 4: v_i ← VulnerabilityIndex(i) // zip, age, prior denials 5: w_i ← t_now − t_filed,i 6: s_i ← max(0, w_i − w̄) // anti-starvation 7: p_i ← αr_i + βv_i + γw_i + δs_i 8: append (p_i, i) to Q 9: sort Q in descending order of p_i 10: return Q
The agency must be able to show, to a reviewing court and to the claimant, exactly how the score was computed. This is not open-sourcing production systems; it is reproducible research applied to adjudication. Every MORTAR run produces a reproducibility receipt: the exact model version, the exact feature vector (medical detail redacted), the weights, and a hash of the binary.
A fair triage system does not pull high-risk claimants out of the queue only to drop them into a new administrative cliff. The Protocol bundles triage with continuity: a claimant surfaced by MORTAR receives not only an expedited hearing date but an advocate, a medical-records coordinator, and — where benefits are ultimately awarded — post-award navigation to prevent the re-entry instability that feeds the whirlpool.
Sixty-six years later, the U.S. Government Accountability Office reports that the federal government continues to operate dozens of COBOL legacy systems, some dating to the 1970s, including Social Security, veterans' benefits, and tax processing.[15] Industry estimates place the share of global financial transactions processed in COBOL at 70–80%.[16] The queue of Chapter 1 is not a metaphor for a "digital-age problem." It is running, in significant part, on the language Grace Hopper built.
The fashionable reaction is to say "rewrite it." The MERCY Protocol's reaction is different. COBOL is not the bug. The bug is the belief that a new language automatically produces a new ethics. A Rust implementation of a FIFO queue is still a FIFO queue, and it will still kill people if its ordering rule is wrong. A blockchain is still a black box if its decision logic is not auditable. A "modernized" system can be as opaque as any 1970s mainframe if the principle of legibility is not written into its architecture.
The five Hopper principles that MERCY carries forward.
PARAGRAPH A-TRIAGE.
PERFORM VARYING I FROM 1 BY 1
UNTIL I > CLAIM-COUNT
COMPUTE PRIORITY(I) =
(MEDICAL-RISK(I) * ALPHA) +
(VULNERABILITY(I) * BETA) +
(WAIT-DAYS(I) * GAMMA) +
(OVERDUE-DAYS(I) * DELTA)
END-PERFORM.
SORT CLAIM-TABLE ON DESCENDING KEY PRIORITY.
A 1960s COBOL programmer could read this. A 2026 cryptographer could read its MORTAR equivalent. A claimant reading a decision notice should be able to read the reason that came out of it. That is the unbroken promise.
Systems built on appropriations expire when the appropriations stop. The MERCY Protocol is designed to outlive any single Congress, any single administration, any single vendor. That requires two things software alone cannot provide: a durable financial structure, and a durable legal structure.
The Protocol is capitalized through a two-tranche bond structure: a $500M senior tranche partitioned into a $300M liquid tranche (funding operations, advocate staffing, medical-records coordination) and a $200M Lombard tranche (held against highly-rated collateral, providing liquidity backstop without drawing down operating funds). Disbursements are governed by a three-tier governance framework separating investment decisions, operational decisions, and claimant-advocacy decisions.
Why not a foundation, why not an agency, why not an appropriation? Because foundations change boards; agencies change administrations; appropriations sunset. A bond indenture with an independent trustee, a published prudent-person standard, and a post-quantum audit trail is harder to unbuild than any of those.
The Protocol operates across three legal regimes simultaneously:
None of these regimes is sufficient alone. Together they form a Vault A / Vault B split: operational assets in one jurisdiction, cryptographic root-of-trust assets in another, such that no single political event can collapse the whole.
That scene is the north star of the Protocol. It is not a scene about technology. It is a scene about legibility. It is the scene Grace Hopper was describing in 1959. It is the scene the Copernican move makes possible, because the system is no longer built around the convenience of the center. It is built around the person at the edge.
The MERCY Protocol will not end disability, or genetic disease, or the administrative state. It will not make hard cases easy. What it aims to do is smaller and more important: to ensure that the river moves, that the ledger remembers, that the triage sees, that the code is readable, and that a person waiting for an answer is not, by virtue of waiting, made to disappear.