Three Can Keep a Secret

“Three may keep a Secret, if two of them are dead.” Benjamin Franklin, Poor Richard's Almanack, 1735. It survives because it is a joke with a slope hidden in it. The line does not say that keeping quiet is hard; it says the difficulty climbs with the number of people involved, and climbs viciously — that going from one person to three is not three times worse but something worse than that. Everybody who repeats the line agrees with the slope. Almost nobody has ever asked what it is.

In January 2016 a physicist at Oxford asked. David Robert Grimes published a short paper in PLOS ONE that does one thing: it turns a headcount into a shelf life. Feed it how many people are in on something and how often any one person talks, and it returns the probability that the secret has broken by year t. It was read, on arrival, as a debunking machine — a piece of arithmetic that finally settles the moon landing.

That is not quite what it is. The formula runs in both directions, and the direction nobody quotes is the one worth having. The tool below is the paper's model, running live. Drag the headcount and watch the entire curve slide across the chart.

One person, times everybody

The model makes two assumptions and then does nothing clever, which is the best thing about it. First: one person talking is enough to end it. Second: people talk rarely and independently, which makes exposure a rare event in time — the same shape of problem as cars arriving at a traffic light, and handled the same way, with Poisson statistics.

From there it is one line of arithmetic. Call p the chance that any given person in on it talks in any given year. Then 1 − p is the chance they keep quiet, and that number multiplied by itself once per conspirator — (1 − p) to the power of N — is the chance that nobody in the room talks. Subtract it from one to get the leak rate per year, run it through the Poisson expression, and you have the probability the secret is out by year t. Two inputs. How many people, and how leaky each one is.

That exponent is where all the drama lives, and it is an old friend. It is the same arithmetic as a chain of argument, where seven links you are each 90% sure of leave you 48% sure of the conclusion — except here the chain runs across people rather than steps, and the links are far stronger. Each conspirator is a 99.9996% link. It does not save them.

The trouble is never the link. It is that a product of numbers below one only goes one way, and it goes there faster than anyone's intuition for it.

Where the leak rate comes from

Everything hinges on p, and p is not something you can look up. Grimes estimated it from three affairs that were exposed and where both numbers — how many people, how many years — are a matter of public record. Assume that on the day each one broke it stood at roughly even money, invert the formula, and out comes a leak rate.

• The NSA and PRISM. Up to 30,000 people, quiet for 6 years until Edward Snowden in 2013. Implied leak rate: 1 in 244,000 per person per year.
• The Tuskegee syphilis study. Around 6,700 in the US Public Health Service; penicillin withheld from infected men from 1947 until Dr. Peter Buxtun forced it open in 1972, so 25 years. Implied rate: 1 in 238,000.
• The FBI forensics scandal. About 500 lab and agency staff, 6 years from the point the Bureau knew its hair analysis was unsound to exposure in 1998. Implied rate: 1 in 4,082.

The first two are the interesting part. Two institutions with nothing in common, on opposite sides of the twentieth century, running completely different kinds of secret, land within 3% of each other. That is either a real regularity about human beings in organizations or a very good coincidence, and there is no third case tight enough to tell you which. The FBI number is sixty times looser and gets set aside.

Grimes then takes the tightest rate of the three — about one person in 244,000 talking per year — and uses it for everything. That is a deliberate handicap: he is building the best possible world for the conspirators and seeing whether they can survive even that. The headcounts are stacked the same way. The Tuskegee figure is the entire Public Health Service, which is far more people than were ever within a mile of Alabama; the PRISM figure is every NSA employee. Inflating N makes the crowd look better at staying quiet than it was, which drives the estimated p down, which is the direction that flatters the conspiracy.

The four famous ones

With the leak rate pinned, headcount is the only input left. So Grimes counts mouths: 411,000 for a faked moon landing, being peak NASA employment in 1965. 405,000 for climate change as a hoax, from the membership rolls of the scientific bodies that endorse the consensus. 22,000 for a vaccine cover-up, taking the CDC and the WHO alone, or 736,000 if the eight big manufacturers are in on it too. 714,000 for a suppressed cancer cure, from those same eight companies' peak staff.

Run the numbers and the answers are almost comically uniform. Under the most generous leak rate on record, a faked moon landing is 95% likely to have broken within 3.7 years. A suppressed cancer cure: 3.2 years. A vaccine cover-up with the manufacturers in it: 3.2 years. Climate change as a hoax, with the scientific societies included: 3.7 years. Not decades. Not a lifetime. One presidential term.

Then Grimes does something the coverage mostly skipped. He runs two of them again with a smaller cast. Count only the 29,083 scientists who have actually published on climate, and the hoax survives 27 years. Count only the CDC and the WHO and leave the drug companies out of it, and the vaccine cover-up survives 35 years — comfortably longer than the belief has existed.

The answer moved by a factor of ten and the only thing that changed was who you decided had to know.

Which tells you what the machine actually is. It does not evaluate conspiracies. It converts a headcount into a lifespan, faithfully and without opinions, and every interesting disagreement about it is a disagreement about the headcount you fed in.

The half nobody quotes

Turn the crank the other way. Instead of asking how long a given crowd lasts, ask how big a crowd can survive a given stretch of time. Grimes puts this in a table near the back, and it is the most useful thing in the paper. At that same best-case leak rate, staying under a 5% chance of exposure:

• Five years: up to 2,521 people.
• Ten years: 1,257.
• Twenty-five years: 502.
• Fifty years: 251.
• A century: 125.

Read that list again, slowly. It is not a debunking. It is a spec sheet. One hundred and twenty-five people can keep a secret for a hundred years, at the tightest leak rate ever measured on a real one, with a 95% chance of getting away with it. Five hundred can hold one for a quarter of a century. A cabinet, a board, a small unit, a family firm — all of them sit comfortably inside the envelope, indefinitely.

Grimes says so himself, in a sentence that never made it into a headline: “While conspiracies do undoubtedly happen, their continued secrecy is probably more due to keeping the number of agents low than having an intrinsically small per agent per time leak probability.” The paper is not evidence that people can be trusted. It is evidence that crowds cannot, and that small groups have never needed to be.

The paper does not say conspiracies are impossible. It says they are small — and then it hands you the size.

Four ways this could be wrong

The leak rate was measured only on leaks. Every one of the three calibration cases is a conspiracy that failed, because a conspiracy that succeeds leaves no record to measure. This is not a fixable flaw; it is the shape of the subject. Grimes raises it himself and argues the overall bias runs the other way — his headcounts are so inflated that the true p is probably higher, not lower, than his estimate. That is a fair reply, and it leaves you with two large errors pointing in opposite directions and no way to weigh them. Neither of us knows the sign of the total.

A leak is not the same as exposure. The model treats the first word spoken as the end. In its own case files, that is not what happened. Dr. Frederic Whitehurst wrote several hundred letters to his superiors about the FBI's forensics between 1992 and 1997, and was, in Grimes's word, roundly ignored. Ethical objections to Tuskegee were raised in the mid-1960s and the study ran for years afterward. Because p is fitted to the year each thing actually broke, this is partly absorbed into the number — but it changes what the number means. It is not the chance somebody talks. It is the chance somebody talks and is believed, and an institution that can reliably not listen has a much lower effective p than one that cannot.

Everyone is assumed equally leaky, and independent. Real organizations are neither. Vetting, compartmentalization, money, fear, and self-selection all drive p down for some people and up for others, and the model has no room for the spread. Worse for the arithmetic: one person talking makes the next more likely to, which is precisely what independence forbids. Grimes grants the point and suggests agent-based modelling as the fix, which is another way of saying the simple version does not have it.

The headcount is the argument. This is the big one. 411,000 is everyone NASA employed at its 1965 peak, and putting that number in asserts that a fake landing requires every one of them to know. Grimes defends it, and the defence is the strongest passage in the paper: for a scientific fraud, the deception cannot be contained to the people who commit it, because falsified data gets checked by whoever reads it next. A rogue cell inside climate science does not stay a rogue cell; it stays a rogue cell until someone reanalyses the data, which is how actual scientific fraud is actually caught. So for these four claims specifically, the enormous N is defensible.

It is also, quietly, where the entire result lives. Feed the same machine 400 people instead of 411,000 and it stops saying four years and starts saying centuries. Any conspiracy claim can be rescued from this paper by shrinking its cast, and the honest version of the argument is therefore never about probability at all. It is about how many people would have to have known.

What it is actually for

Not as a verdict machine. The output swings by orders of magnitude on a parameter that cannot be observed even in principle, which is exactly the condition under which a confident number should be treated as a conversation starter and not a result. But the question it forces is excellent, and it survives all four objections above intact.

Both directions is the point. The same tool that makes a 400,000-person hoax collapse in under four years makes a 125-person one durable for a century, and history is not short of the second kind. Tuskegee ran for 25 years and it was real. PRISM ran for 6 and it was real. Both are in this paper as evidence, not as counterexamples — the model is calibrated on things that actually happened, which means anyone using it to argue that institutions do not do this has misread it at the first table.

The last honest thing in the paper

Grimes closes by conceding that none of it may work. He cites a Californian study in which countering anti-vaccination misconceptions was possible with clear explanation for some parents, and pushed the resolutely opposed further in. His own summary: for someone sufficiently convinced, “it is highly unlikely that a simple mathematical demonstration of the untenability of their belief will change their viewpoint.”

Which is the right note to end on, and not a defeatist one. Arithmetic like this was never for the person who is already certain. It is for you, at the moment a claim first arrives and before you have decided anything about it — when asking how many people would have to have kept quiet, and for how long costs nothing, sorts the outlandish from the merely uncomfortable, and does it without requiring you to trust anybody at all.

Run the headcount down through the thousands and watch a certainty turn back into a maybe. The Chain of Argument is the same multiplication running over the steps of a case rather than the people in a room, and The Fog Behind the Number is what happens to any confident answer that rests on a parameter nobody measured. When the claim is about how often something happens rather than who knew, How Common Is It, Really? is the place to start.