How this site handles the identity of a child

The problem this is solving

A child prosecuted at fourteen is an adult for sixty years afterwards. Most legal systems recognise this and restrict reporting, seal records, or allow a name to be expunged — and then a reference site republishes the material a decade later, permanently, indexed, and undoes all of it. The harm is not hypothetical and it is not reversible.

The obvious safeguard is an editorial rule: do not publish the name. Editorial rules fail the way all rules that depend on attention fail — on the day someone is working quickly, or pasting a paragraph from a source, or importing a batch, or handing the job to someone who has not read the rule. So the rule is not the safeguard here. The safeguard is that there is nowhere to put the name.

The four layers

They are arranged so that each one catches a different kind of failure, and so that the first one cannot be circumvented by carelessness at all.

Layer one

The schema has no column for a child's identity

The table that holds a juvenile case has fields for the citation, the court, the year, the legal principle, the holding and the significance. It has no field for a defendant's name, a date of birth, an address, a school, a photograph or a case-file number. A name cannot be stored carelessly because storing it would require someone to alter the database schema, write a migration and deploy it.

The validation layer closes the adjacent gap. A payload arriving at any form, import script or endpoint carrying a key named defendantName, childName, dateOfBirth, schoolName or any of the other identifier-shaped names on the list is rejected entirely — the whole request fails, with a message pointing at this page. It is not sanitised and the field is not quietly dropped. A rejection is noticed and fixed; a silent drop teaches whoever sent it that it is fine to keep sending.

What this layer cannot do: it cannot stop identifying detail written into a narrative field in prose. "The boy, then fifteen, from a school in the town of X" fits in a field that legitimately exists. That is what layer two is for.

Layer two

Every piece of free text is scanned on the way in

Before anything is saved, each free-text field is scanned for the shapes identifying material takes: personal names, exact dates of birth, street addresses, named institutions and schools, phone numbers, email addresses, national identity numbers, social handles, and case captions that look like a name but are not on the list of published precedent. Each hit is recorded with the field, the kind, the position and a severity.

The scanner has one deliberate and important limitation: it is a flagger, never an authoriser. A clean scan is not clearance. It has no authority to approve anything, and nothing in the system treats "no flags raised" as permission to publish. This matters because a pattern cannot understand context, and a design in which a regular expression can say "yes" is a design that will eventually say yes to the wrong thing.

Everything the scanner raises, and everything a reviewer removes, is written to a separate log: what kind of thing it was, which field, who decided, why, and what the outcome was. The log never stores the removed text itself. It exists so that anonymisation here is an auditable process with a record, rather than a claim on a page.

What this layer cannot do: it cannot recognise identifying detail that does not look like anything. A description specific enough to identify one child in one town — an unusual combination of age, offence and date — will not trip a pattern. Only a human reader catches that, which is why the next layer requires one.

Layer three

The publish gate, which fails closed

Nothing becomes public by drift. Moving an entity into the published state requires, all at once:

• A named person's anonymisation sign-off. Not a checkbox — a name, recorded against the record, so the decision has an author.
• Zero blocking flags. A blocking flag has to be removed from the text; it cannot be waved through, and a reviewer has no power to clear one.
• Every lower-severity flag individually reviewed and cleared, with each clearance tied to the exact flag it answers, so a re-scan cannot inherit an old approval.
• At least one attached source. An unsourced entity cannot be published at all.

Every ambiguity resolves to "no". An unrecognised status is not publishable. A missing sign-off is not publishable. A flag whose clearance cannot be matched is not publishable. The cost of that asymmetry is that publishing takes longer than it might; the cost of the other asymmetry would be paid by a child.

Layer four

The render filter

Every query that serves a public page filters on the published state, and the check is exact equality against a single shared constant rather than a comparison written out at each call site. The option that would return unpublished rows exists only for the administrative interface, and its default value is the safe one: a developer who forgets to pass it gets the public behaviour, not a leak. The direction of that default is the entire point — forgetting must fail closed.

The same filter governs the sitemap, the feeds and the dataset exports. There is no parameter, header or URL that returns an unpublished row from a public endpoint, because the flag is not reachable from one.

The public-precedent distinction

Decided, publicly reported case law is cited by its official caption. Roper v. Simmons and In re Gault are settled precedent whose names the courts themselves published, which every law school teaches and every citation in the field uses. Refusing to name them would make the site useless without protecting anyone.

A living, identifiable child in an anonymised proceeding is a different thing entirely. If the court wrote R v. D.B., so do we — including where journalism later published the child's name, and including where the name is trivially findable. What a search engine surfaces is not our standard; what the court decided to withhold is.

The list of captions treated as published precedent is maintained by hand, one entry at a time. It is deliberately not a pattern. "Looks like a case name" is precisely how a real child's name would be admitted, and a rule that generalises is a rule that will.

How the cases are written

A case page here is about a legal principle. It records what the court decided, what proposition the judgment established, and what followed from it. Facts are summarised only as far as the legal reasoning requires.

There is no detailed description of an offence, no victim detail, and no narrative reconstruction of what a child did. That restraint costs the pages some of their readability, and it is not an accident: the moment the writing becomes engaging in that way, the subject has shifted from the law to a person, and the person is a child.

What this does not claim

None of the above makes a mistake impossible. The schema cannot stop an identifying description in prose. The scanner cannot recognise what it has no pattern for. The publish gate depends on a reviewer reading carefully. The render filter protects what the earlier layers decided, not what they missed.

What the layers do is make the likely failures harmless and the harmful failures require deliberate effort. The remaining risk sits with a human being paying attention, and the last safeguard is you telling us.