A real Catch-22 does not merely offer two unpleasant choices. It makes each choice invalidate the other.
Imagine learning about a serious problem inside an institution. Speak before the record is complete and you are called reckless. Wait for every piece and you may be accused of knowing and remaining silent. Obey the chain of command and the chain can absorb the warning. Bypass it and your disobedience becomes the story. If the work is secret, you cannot explain yourself. Reveal the secret and the revelation becomes a separate offense.
Every door returns you to the same room.
This is often described as corruption, cowardice, or conspiracy. Sometimes it is. But the more durable problem is architectural. An institution can produce a trap even when most of the people inside it believe they are acting responsibly.
Plausible deniability is a routing system
Plausible deniability is usually treated as something a powerful person possesses: the ability to say, truthfully or otherwise, “I did not know.”
I think it is more useful to see it as a routing system for knowledge.
One person receives an observation but lacks authority. Another has authority but sees only a summary. A third controls the classification boundary. A fourth controls the budget. A fifth interprets the law. Each person receives just enough information to perform a local role and not enough to own the complete consequence.
The information exists. Responsibility exists. Yet no single route joins them.
This arrangement can be deliberate, but it does not have to be. Specialization, secrecy, legal compartmentalization, contracting, automation, and ordinary hierarchy can create the same result. The organization knows something that none of its members can safely say the organization knows.
That is not ignorance. It is distributed knowledge without a distributed mechanism of conscience.
The two maps do not agree
The trap becomes sharpest when a person must follow two incompatible maps.
The first is the public map: law, policy, constitutional limits, professional ethics, contractual obligations, and the declared mission of the institution.
The second is the operational map: relationships, exceptions, informal authority, security boundaries, strategic necessity, and the practical need to keep a large system stable.
Most of the time, these maps overlap well enough. Then a difficult case arrives. The public map says an action is prohibited. The operational map says the action is necessary. The person caught between them cannot fully obey either without betraying the other.
From one side, loyalty means protecting the institution. From the other, loyalty means protecting the principles that justify the institution. Both sides can accuse the same person of betrayal.
This is why moral slogans are inadequate. “Follow the rules” does not help when different rules govern disclosure, secrecy, employment, citizenship, safety, and verification. “Do the right thing” simply renames the problem.
Uncertainty can become power
Complex systems genuinely contain ambiguous reports, incomplete observations, conflicting interpretations, and consequences that are difficult to foresee.
But uncertainty can also be cultivated. A decision can be divided among enough committees that no one made it. A model can be hidden behind a vendor. A recommendation can be generated by software whose inputs no one person selected. A risky action can be described in a vocabulary that prevents outsiders from recognizing it. A warning can be acknowledged without being accepted.
Nothing has to be explicitly denied. The system merely prevents a statement from becoming definite enough to demand action.
This resembles a measurement problem, but it is institutional mechanics. Permissions, interfaces, and incentives separate observations from the people who can act on them, whether by design or by accident.
The question is not only “Who knew?” It is:
- Who could combine the observations?
- Who could name the consequence?
- Who could stop the action?
- Who could protect the person who raised the problem?
- Who would remain accountable after the organization changed personnel?
If the answers point to different people, the Catch-22 has already been built.
A system needs an exit
An institution must design an exit from this room before anyone is trapped inside it.
The exit begins with a protected route that joins information to authority without requiring public disclosure. It needs independent review, not merely another layer in the same hierarchy. It needs a way to record dissent before the outcome is known. It needs rules for distinguishing a good-faith warning from a public accusation. It needs proportional disclosure: enough information to examine the warning without unnecessarily exposing people, operations, or private data.
Most importantly, it needs named responsibility.
Distributed work does not require responsibility to evaporate. A system can record which observations informed each decision, which questions stayed open, who accepted the residual risk, and when the decision must be revisited. This is ordinary model design applied to power.
No process can guarantee courage. No ledger can make every conflict simple. But architecture can decide whether courage has somewhere to go.
Loyalty needs a direction
I do not accept the easy division between loyal insiders and righteous outsiders. A person can care about law and stability, secrecy and accountability, national interest and individual rights. The conflict is real precisely because all of those things can matter.
The answer is not to pretend that one map is pure and the other is evil. It is to expose where the maps diverge and decide which principles constrain power when they do.
A Catch-22 survives by forcing each person to face that divergence alone.
A better system makes the contradiction visible before it becomes personal. It gives observations a route, dissent a record, authority a name, and loyalty a direction that can be defended in daylight.