Destroy the key

Two requirements that both look non-negotiable appear to rule each other out. A system that has to prove what it did keeps an append-only history, because a ledger that can be edited is not a ledger; the ordering, the hashes, and the unbroken chain are the whole of its evidentiary value. A person whose life is described inside that history has a right, in European law since 2018 and in ordinary decency for longer, to have their part of it erased. Delete the entry and the chain breaks. Keep the entry and the right is theatre.

The resolution is to stop treating the record as one substance. Personal content goes into the log encrypted under a key belonging to one person and stored somewhere else entirely, and what the permanent record holds is ciphertext, or a token pointing at a vaulted mapping. The mechanism is that erasure then operates on the key rather than on the history, so destroying the key leaves the sequence, the hashes, and every downstream computation’s ability to be replayed exactly intact while the personal content inside them becomes unrecoverable. The security literature calls this crypto-shredding. NIST’s media sanitization guidance calls it cryptographic erase and treats it as a legitimate sanitization technique wherever the key management holds up.

We did not go looking for this pattern. It arrived three times, from three unrelated directions, in research written for three different problems. A study of forensic provenance reached it by asking how an audited decision could still be replayed after a name had been taken out of the log, and answered with a vaulted pseudonym map whose destruction erases the person while leaving the audit whole. An event-replay architecture reached it by asking what deletion can possibly mean in a system where deletion is forbidden and every change has to be a compensating event. A submission-contract study reached it by asking how an append-only multi-tenant log complies with an erasure request at all. Different questions, same answer, and convergence like that is the closest thing engineering has to a second opinion.

The caveats travel with the technique or the technique is a lie. Cryptographic erasure is exactly as strong as the key management underneath it, and a key that was ever copied to a backup, escrowed with a third party, or wrapped under a second key you still hold has not been destroyed, it has been filed. Its permanence is also a statement about the present state of cryptanalysis rather than a law of nature, which means the honest form of the promise is that the content is unrecoverable now and by any means presently known. Saying that out loud is part of the technique rather than a qualification of it, because a right to be forgotten implemented by people who overstate what they accomplished is not much better than one implemented by people who accomplish nothing.

What earns the trouble is the kind of promise it lets you make. Most privacy commitments are behavioral: we will not look, we will not keep it past the date we told you. This one is structural, and its structure is the point, since after the key is gone there is no version of the company, no successor, no acquirer, and no subpoena that can change its mind. A system built to remember everything can still be taught to forget one person completely, and that is what an ending looks like when it is engineered rather than promised.