The Innocence Infrastructure - Protecting Yourself from False Positives in an Age of Data-Driven Enforcement

We live in an age in which governments and institutions have become extraordinarily capable of finding wrongdoing.

That is, in many respects, something to celebrate.

Sophisticated fraud rings can move money through layers of businesses and accounts. Identity thieves can operate across jurisdictions. Healthcare fraud can involve thousands of claims and hundreds of participants. Organized criminal enterprises can hide relationships that would have been nearly impossible to discover through conventional investigation alone.

Modern data analysis can help investigators see what individual investigators could never see by themselves.

But there is a corresponding problem that deserves much more public attention:

The more powerful our systems become at finding patterns of wrongdoing, the more important it becomes to distinguish a pattern from proof—and an association from participation.

That is the problem of the false positive.

And it means that law-abiding people may need a new form of civic literacy: not learning how to evade legitimate investigation, but learning how to preserve enough identity, context and documentary continuity that an innocent person can be distinguished from the person or activity actually under investigation.

I call this the innocence infrastructure.

Vigilance has casualties

Law enforcement agencies have legitimate reasons to be vigilant.

The enormous 2026 national healthcare-fraud takedown demonstrates why. The U.S. Department of Justice announced hundreds of defendants and billions of dollars in alleged fraudulent healthcare claims. Large-scale operations of this kind require sophisticated investigative techniques precisely because modern fraud can be distributed across people, organizations, transactions and jurisdictions.

The public should want serious fraud to be discovered.

But there is another side to technological vigilance.

When an investigative system searches for relationships, it inevitably encounters people who are not themselves perpetrators.

A legitimate customer may have done business with a fraudulent company.

An employee may work for a company whose executives are under investigation.

A landlord may rent property to someone committing fraud.

A person's identity may be stolen and used by someone else.

A family member may share an address, device, account, or financial connection with someone who becomes the subject of an investigation.

A person may receive a completely legitimate payment from someone later accused of wrongdoing.

A name may resemble another person's name.

A database may contain an inaccurate address.

An algorithm may recognize a pattern without knowing the story behind the pattern.

The system may be correctly identifying a connection while incorrectly inferring its meaning.

That distinction matters enormously.

A pattern is not a person

Imagine an investigative system discovers this:

A → B → C → D

A is fraudulent.

B has a business relationship with A.

C receives a payment from B.

D shares an address with C.

A pattern-recognition system can quite reasonably flag the network for investigation.

But the meaning of each relationship still has to be established.

Perhaps B knowingly participated.

Perhaps B was an innocent vendor.

Perhaps C was simply paid for legitimate work.

Perhaps D is C's roommate and has absolutely nothing to do with C's business.

The data structure may be accurate while the interpretation is wrong.

This is why we should maintain a fundamental distinction:

Investigative relevance is not guilt.

And neither is:

suspicion = accusation = charge = conviction.

Those are different stages with different evidentiary implications.

A healthy society needs both sides of this equation.

We need institutions capable of discovering sophisticated wrongdoing.

And we need institutions capable of recognizing when an innocent person merely happens to appear somewhere inside the investigative perimeter.

The Innocence Infrastructure

What can an ordinary, law-abiding person actually do about this?

Not much of it involves trying to anticipate what law enforcement or an algorithm might think.

In fact, trying to “look innocent” can become its own form of unhealthy behavior.

A better strategy is much more mundane:

Make your legitimate life coherent, your identity secure, your boundaries clear, and your ordinary records available when they legitimately matter.

That creates an innocence infrastructure.

1. Keep your identity information consistent

Make sure important records use accurate and consistent identifying information.

This can include:

• government identification

• banking information

• tax records

• employment records

• insurance

• leases

• registrations

• professional records

• important contracts

If you discover a discrepancy, resolve it through the appropriate institution rather than simply living with contradictory information.

The objective isn't to create a perfect bureaucratic life.

It is to minimize opportunities for an innocent person to be confused with someone else.

2. Preserve the boring records

One of the most valuable forms of evidence is often the least exciting.

Receipts.

Invoices.

Contracts.

Bank statements.

Tax documents.

Employment records.

Rental agreements.

Travel records.

Emails.

Appointment confirmations.

Ordinary correspondence.

These things can establish context.

Suppose an investigator sees a payment from an entity under investigation.

The payment itself is only a data point.

A legitimate invoice, contract, receipt, and corresponding service can transform that data point into a comprehensible event.

The principle is simple:

Don't destroy the mundane evidence that explains your legitimate life.

This does not mean keeping every scrap of paper forever. It means developing sensible recordkeeping appropriate to your finances, work and circumstances.

3. Don't lend your identity

One of the strongest practical protections is also one of the simplest:

Don't casually allow other people to operate through your identity.

Be cautious about allowing someone else to use:

• your bank account

• debit or credit cards

• email account

• phone number

• online financial accounts

• government identification

• business credentials

• computer

• cloud storage

• mailing address

A request that sounds harmless—

“Can you just let me receive this for you?”

or

“Can I use your account for a minute?”

—can create a documentary trail that later appears to belong to you.

The problem isn't that the person necessarily intends to harm you.

The problem is that records don't necessarily preserve the informal explanation you had in your head when you agreed.

Boundaries create clarity.

4. Separate your accounts from other people's activities

Collaboration doesn't require identity entanglement.

If you work with someone, use appropriate permissions and accounts.

If you operate a business, distinguish personal and business finances.

If another person needs access to a resource, give them the appropriate authorized access rather than handing over your master credentials.

If someone needs to send money to a business, have the money go through the appropriate business channel rather than through an unrelated person's account.

This isn't about anticipating criminal investigations.

It's ordinary administrative hygiene.

But it has an important side effect:

Your records remain more accurately representative of your actual conduct.

5. Protect your devices

Your phone and computer can contain an astonishing amount of contextual information.

Use:

• strong, unique passwords

• multifactor authentication

• automatic security updates

• device locking

• reputable security software

• appropriate encryption

• separate user accounts when others legitimately need computer access

And be particularly careful about giving other people access to accounts that remain logged in on your devices.

This is partly cybersecurity.

It is also identity integrity.

If another person can operate through your accounts, the resulting digital activity may not clearly distinguish their actions from yours.

Context is a form of protection

We tend to think about privacy as protection from exposure.

But in a data-driven world, another property becomes equally important:

context.

A piece of information can be technically true and nevertheless misleading without its surrounding circumstances.

A payment is real.

A phone call occurred.

A person visited an address.

Two people communicated.

A computer accessed a website.

A transaction occurred between two accounts.

A person worked for an organization.

All of those facts may be true.

But none of them necessarily explains why they happened.

Context does.

This suggests a useful hierarchy:

Identity protects against confusion.

Security protects against unauthorized activity.

Boundaries protect against other people's conduct.

Documentation preserves context.

Context protects against misinterpretation.

Together, these constitute an innocence infrastructure.

Don't start performing innocence

There is an important danger on the other side.

Once people become aware that sophisticated systems can analyze their behavior, they may begin asking themselves:

How would this look to an investigator?

Occasionally, that's a reasonable question.

Taken too far, however, it becomes psychologically corrosive.

People may begin changing ordinary behavior because they imagine that some unseen algorithm is watching.

They may delete innocent records because they are afraid of how something could look.

They may move money around to make their finances appear different.

They may construct elaborate explanations for ordinary events.

They may become afraid to interact with other people.

That is not security.

That is performing innocence for an imaginary audience.

A healthier principle is:

Don't perform innocence. Live legitimately.

Maintain reasonable records.

Protect your accounts.

Keep your boundaries.

Don't participate in conduct you don't understand.

Don't allow other people to use your identity casually.

And otherwise, live your ordinary life.

When something really does go wrong

Sometimes preparation isn't enough.

Identity theft happens.

Records contain mistakes.

People have similar names.

Addresses become outdated.

Government databases can contain errors.

An innocent person can become entangled with someone else's activity.

If you discover that you are actually being confused with another person or have become involved in a serious investigation, the appropriate response is not to launch your own counter-investigation.

It is to become calm, factual and deliberate.

Preserve relevant records.

Don't destroy evidence.

Don't fabricate explanations.

Don't contact questionable third parties in an attempt to “fix” the situation.

Don't assume that deleting something makes the problem disappear.

And when the consequences are serious, obtain appropriate legal advice.

There is a major difference between ordinary preventative administration and responding to an actual investigation.

The former can be handled as a matter of good personal organization.

The latter may require professional legal counsel.

The false-positive problem is ultimately a human problem

Artificial intelligence, data analytics and network analysis can dramatically increase the ability to find suspicious patterns.

But a pattern is not a biography.

A database does not necessarily know why two people met.

A financial record does not necessarily know why money changed hands.

A device does not necessarily know who was holding it.

An address does not necessarily know who actually committed an act there.

A relationship does not necessarily establish participation.

This is why technological sophistication should increase—not diminish—the importance of human judgment.

The more efficiently we can identify possible wrongdoing, the more carefully we must distinguish:

signal from coincidence,

association from participation,

anomaly from wrongdoing,

identity from resemblance,

and ultimately,

allegation from proof.

The civic bargain

There is no contradiction between supporting strong law enforcement and caring deeply about due process.

We should want investigators to uncover billion-dollar fraud schemes.

We should want sophisticated criminal organizations dismantled.

We should want stolen identities protected.

We should want public money protected.

And we should simultaneously insist upon a system capable of saying:

“This person was caught in the pattern, but the evidence does not establish that this person participated in the wrongdoing.”

That is not weakness.

That is what competent enforcement looks like.

The public doesn't benefit from a system that is incapable of finding criminals.

Nor does the public benefit from a system that becomes so convinced by its own pattern recognition that innocent people become interchangeable with the people it is trying to find.

The goal should be precision.

A new kind of civic literacy

Perhaps this is the lesson we need to teach more explicitly.

Citizens in the twenty-first century need more than traditional privacy advice.

We need to understand identity integrity.

We need to understand data trails.

We need to understand account separation.

We need to understand documentary continuity.

We need to understand context collapse.

And we need to understand the difference between being associated with something and being responsible for it.

This isn't about teaching innocent people how to evade government scrutiny.

Quite the opposite.

It is about making legitimate conduct legible.

A clean record isn't merely something that protects a person after something goes wrong.

It is a form of everyday civic infrastructure.

And perhaps the best personal rule is the simplest:

Live legitimately. Keep your boundaries. Protect your identity. Preserve ordinary context. Don't unnecessarily entangle yourself with other people's activities. And don't mistake vigilance for certainty.

Powerful systems can help society find hidden wrongdoing.

But powerful systems also make something else necessary:

the ability to recognize the innocent person standing inside the same data pattern.

That is the real purpose of an innocence infrastructure.