When a system flags nearly two million people under one category, the question cannot simply be whether each individual citizen can prove themselves innocent of the discrepancy. It must also be whether the mechanism generating the discrepancy is sufficiently transparent and reliable.