Every system that runs modern life leaves a trail. The elevators that move millions record their every trip. The machines that make the goods record their every cycle. The software that processes the transactions logs every decision. The infrastructure that carries water, power and data measures itself constantly.
These traces are evidence — evidence about how systems behave, when they fail and why. Almost all of it is collected. Very little of it is examined.
The record that already exists
The striking fact about modern infrastructure is that it is already instrumented.
Industrial machines report vibration, temperature and load. Buildings report energy use and occupancy. Networks report traffic, errors and latency. The data exists, often in vast quantities, stored and archived. The infrastructure has been measuring itself for years, in many cases without anyone asking it to.
This is a revolution in evidence that has happened almost silently: the material for investigating how the world works is already being collected, waiting to be read.
What the traces reveal
Read correctly, the traces reveal what no one intended to record.
A machine’s vibration data shows the weeks of deterioration that preceded a failure. A building’s energy pattern shows when it was occupied and what was happening inside. A network’s logs show the sequence of events around an outage. The traces capture behavior that no human observer could watch — continuous, precise, impartial.
The evidence is not just about failures. It is about normal operation: how systems actually run, as opposed to how they are assumed to run. The gap between the two is often the most interesting finding.
The forensic turn
The existence of the traces has created a new kind of investigation: digital forensics applied to physical systems.
When an incident occurs, investigators no longer rely only on witness accounts and physical inspection. They can reconstruct the sequence from the logs — what the machine did, second by second, in the lead-up. The trace becomes the primary witness, and it does not forget and does not lie.
This has transformed the quality of failure analysis. The question “what really happened?” now has an answer that can be checked against the record.
The gap between collection and analysis
And yet the great majority of the collected evidence is never examined.
The logs accumulate; the records are archived; the sensors keep measuring. But the analysis capacity — the people and tools to read the traces — is scarce. Most organizations store their evidence and never go looking in it. The gap between what is collected and what is examined is one of the largest underused resources in the modern economy.
The gap has a cost: the warnings that are buried in the traces go unread. The deterioration that the data showed, the anomaly that the logs recorded, the pattern that preceded the incident — they were there, and no one was looking.
The privacy boundary
The power of the traces comes with a boundary that must be drawn carefully: privacy.
The same records that reveal system behavior can reveal the behavior of individuals — where they were, what they did, who they contacted. The evidence that makes systems accountable can also make people surveillable. The boundary between the two is contested, and the way it is drawn will determine whether the trace revolution serves accountability or control.
The question is not whether the traces exist; they do. It is who can read them, under what rules and with what protections.
The discipline of reading
What is needed, then, is not more data but the discipline of reading it.
The organizations that benefit from their traces are the ones that make a practice of examining them: reviewing the anomalies, investigating the near-misses, asking what the record shows that no one reported. The practice is unglamorous and continuous. It does not wait for the incident; it reads the traces as they accumulate.
This is the difference between an organization that is surprised by its systems and one that is not: the second reads the record.
The quiet conclusion
The systems we rely on have been telling us about themselves all along, and most of the telling has gone unread.
The evidence is there, in the logs and the meters, the records and the sensors. It is the most complete account of how the modern world works that has ever existed — and it is sitting, mostly unexamined, in the archives of the systems themselves.
The task of the coming decades is not to collect more evidence; it is to learn to read what is already there. The traces have been written. The question is whether we will turn the page — before the next incident, and the next.