A Veteran’s Word Is Worth Fifty Meters

In August 1998, a presidential directive made a promise. The Gulf War had ended seven years earlier, and veterans were coming home sick without being able to prove where they had been or what they had breathed. A presidential advisory committee had spent eighteen months on the problem. The directive that followed, A National Obligation, quoted the President’s commitment plainly:

“Every soldier, sailor, airman, and marine will have a comprehensive, life-long medical record of all illnesses and injuries they suffer, the care and inoculations they receive, and their exposure to different hazards.”

Beneath the promise sat a more technical objective, and it is the one that matters here. Objective 1.2 called for “maintenance of the capability to identify and link exposure and health data by social security number and unit identification code.”

Not more data. The capability to link.

The system built to keep that promise is called the Individual Longitudinal Exposure Record. It launched in 2019, twenty-one years later. It now draws on sixteen Defense and Veterans Affairs databases and registries, holds more than 155 million records, and covers roughly 11.9 million service members and veterans. In March 2026, service members were able to see their own records for the first time. Veterans were told to expect access in October.

Its individual location data begins in January 2001.

Which means that for the Gulf War veterans whose illnesses produced the directive, the system can say where their war was. It cannot say where they were.

A veteran signs in and sees a page about themselves: where they served and when, what hazards were recorded near those places, which registries they appear in, what health assessments they had. It has the appearance of a file that someone maintained across a career.

No one maintained it in that form. The person-centered view is assembled by ILER from records created and held in systems built separately, for different purposes, by different offices, and never designed to speak to one another. The Individual Exposure Summary it produces is therefore not a retrieved source document. It is a system-produced representation of relationships among source records.

The assembly works like this. One set of records says where each person was, day by day. Another says where hazards were measured. The system matches them by distance, and sorts the result into confidence bands: within ten meters, an exposure is “confirmed or probable”; within fifty meters, “possible”; beyond a hundred meters, “supplementary ambient data.” An individual’s exposure history is, at its foundation, a proximity calculation between two tables.

Which makes the location table the load-bearing element. Without knowing where a person stood, no distance can be computed and no inference drawn. That table comes from the Defense Manpower Data Center, and in 2024 the Government Accountability Office published its coverage window along with those of every other contributing source. DMDC’s data in ILER runs from January 2001 to the present.

The rest of the inventory tells the same story. Four sources held about 94 percent of the records then in the system, and their coverage begins in 2001, 2006, 2012, and 2012. Under five percent of the corpus predates 2001, and it is composed almost entirely of registries: Agent Orange, Gulf War, Ionizing Radiation, Khamisiyah, the Gulf War Oil Well Fire and Smoke Registry, Airborne Hazards and Open Burn Pits.

Eric Ketelaar gave us a word for what this pattern reveals. Before anything is archived, he argued, something has to be archivalized — a society has to decide, often without noticing the decision, that a thing is worth inscribing at all. Preservation is the second question. The first is whether a record was ever made.

A society has to decide, often without noticing the decision, that a thing is worth inscribing at all.

Every registry in that pre-2001 remainder exists because a hazard was contested until the government was compelled to constitute a record series about it. Agent Orange. Khamisiyah. The oil well fires. Burn pits. These are not a monitoring program’s routine output. They are the sediment of arguments that veterans won, one by one, usually late.

So ILER’s reach into the past is bounded not by what survived but by what someone had already been forced to write down. An exposure that was never archivalized left no registry, and therefore leaves no trace — and the system reproduces the boundary of past inscription as though it were the boundary of past events.

The Defense Department does not dispute the gap. Its officials told GAO that deployments “take place during times of conflict, so efforts related to recordkeeping and documenting toxic exposure events are not always the first priority,” and GAO noted that prior federal reports had criticized this deficit “particularly for the 1991 Gulf War and earlier conflicts.” Staff behavior follows the data: claims and clinical staff told GAO they use the location search for veterans who served before September 11th, “as older exposure records are not as easily found by searching by individual.” For older veterans, the record cannot be about a person, so the people using it make it about a place.

There is an earlier layer still. Some of the evidence underneath all this began on paper and was scanned. Federal authority permits destroying a paper original once digitization has been verified — and in July 2016 the Court of Appeals for Veterans Claims looked hard at what that means in practice. In Robinson v. McDonald, pages were missing from a veteran’s official electronic file while the Secretary maintained that the surviving paper had become “duplicates or non-records.” He offered a vendor accuracy rate exceeding 99 percent, and asked the court to assess the digitization program in the aggregate — quoting the principle that a procedural framework “need only be sufficient for the large majority of a group of claims in order to be constitutionally adequate for all.”

The court declined the invitation, and did the arithmetic instead. In a 5,000-page claims file, 99 percent accuracy means “50 pages will either be scanned incorrectly or will not be scanned.” Those pages, it noted, “might include a handwritten ‘buddy statement’ from a veteran who is now deceased or private medical records from a long-retired practitioner—evidence that is wholly irreplaceable.” It found that VA “has a fiduciary duty to maintain and protect these records,” and was “not convinced that the Secretary’s safeguards are sufficient.” Nor was this abstract: the court cataloged findings from VA’s own Inspector General, including an April 2016 audit of ten regional offices that identified 69 of 155 claims-related documents “improperly scheduled for destruction.”

The court also read the disposition authority — a NARA approval granted in September 2010 and carried into VA’s records control schedule. It provides that VA “may destroy” originals after conversion is verified and “when no longer needed for legal or audit purposes, or to support the reconstruction of or serve as a backup to the electronic records.” Permissive, and conditioned. The Secretary, the court observed, had identified no federal regulations establishing the reproduction standards that would let a copy stand as an original in the first place. A concurring judge added that the Secretary had not claimed the presumption of regularity — the ordinary assumption that officials have properly discharged their duties — and, on this record, “may find it difficult to demonstrate that the presumption attaches.” He quoted an older case: “If it appears irregular, it is irregular.”

A record can become a duplicate for disposition purposes without becoming redundant as evidence. Digitization preserves a record’s content. What ILER depends on is a record’s relationships.

ILER breaks respect des fonds on purpose. It takes records accumulated by sixteen offices in the course of sixteen different functions and reorganizes them around the person who was exposed. For anyone who has watched a veteran try to assemble their own history from a dozen agencies, this is plainly an advance. Provenance as an organizing principle serves the creator. ILER serves the subject.

The difficulty is what replaces it.

When the system joins a personnel record to a monitoring report and produces an assertion — this person was probably exposed to this hazard, here, then — the assertion rests on a relationship that exists nowhere else. Luciana Duranti and the InterPARES tradition call this the archival bond: the relationship among records is not metadata about the record; it is what makes them records at all. In ILER, the bond is a distance threshold. Ten meters is confirmed or probable. Fifty is possible. A hundred is ambient.

No agency schedules a database operation, and no one should ask it to. But an operation with evidentiary consequences leaves records, or ought to: the rule that governed the linkage and the version of it in force; the resulting association of person, place, time, and hazard; the summary generated from that association; the provenance sufficient to reproduce it; self-reported additions; correction history; and, where an assertion has been relied on in a decision, some fixed account of what it said at that moment.

Records entering ILER come from systems with their own records-management contexts. What I have not been able to find is a disposition authority that appraises the evidence of the transformation.

This matters because the 1998 directive did not ask for sixteen better databases. Objective 1.2 asked for the capability to link. The linkage is what the government set out to build.

The paperwork that does exist is instructive in a different way. ILER’s foundational system, the Defense Occupational and Environmental Health Readiness System – Industrial Hygiene, is covered by a system of records notice designated EDHA 19, published in November 2013 — six years before ILER launched. Its retention statement reads: “Disposition pending (treat records as permanent until the National Archives and Records Administration approves the proposed retention and disposition).” A February 2026 privacy assessment describes that system as “the foundational system” for ILER and calls ILER itself “the authoritative system (since 2019).” The person-centered record that supports clinical and benefits decisions is publicly described through the privacy notice of its source system, issued six years before ILER existed.

That same assessment assigns the foundational system’s mission records to General Records Schedule 2.7, item 040 — and the assignment is difficult to reconcile with the schedule.

GRS 2.7 is titled Employee Health and Safety Records. NARA’s scope statement for it says it applies only to civilian health records, in civilian and military agencies alike, and that military healthcare management “follows very different processes and creates records that are unique to only a few agencies. Therefore, these records are not covered in the GRS.” The schedule’s own conditions send mission-related monitoring for environmental protection, occupational safety, and public health to agency-specific authorities. NARA’s scheduling guide points agencies to items 040–043 for workplace monitoring and exposure records for federal employees. Item 040 itself covers area and general occupational exposure monitoring, and expressly excludes employee-specific exposure records belonging in individual medical files.

Meanwhile, the same privacy assessment calls ILER the authoritative system for extracting individual exposure information from that foundational system and making it available for medical care and claims adjudication.

What can be documented, then, is not that ILER is scheduled under GRS 2.7. It is that a Defense Department privacy assessment asserts that authority for these records. Whether the authority reaches them is precisely the question — and it is a question about military exposure records that a schedule for civilian employees was never written to answer.

Terry Cook spent a career arguing that appraisal should follow function and the citizen–state encounter, not the office where paper accumulates. Here the schedule follows the creator — industrial hygiene monitoring — while the consequence follows the user. Since January 2023, VA has required claims staff to consult ILER for certain toxic exposure claims. Claims staff have been its dominant users ever since. Exposure summaries load automatically into claims folders at a rate of about 110,085 a month. And in December 2025 Congress wrote ILER into statute at 10 U.S.C. § 996, directing that its information be provided to the Under Secretary for Benefits for use “regarding compensation and benefits for service-connected disabilities or death.”

Terry Cook spent a career arguing that appraisal should follow function and the citizen–state encounter, not the office where paper accumulates.

For records-management purposes, ILER can no longer be understood as an industrial-hygiene system that happens to assist adjudication. It remains formally multipurpose — care, research, claims — but it functions as an adjudication instrument, and its distinctive adjudicative output appears to be appraised as neither.

The retention period compounds the difficulty. Item 040 permits destruction no sooner than thirty years after monitoring, and the schedule cites its source: OSHA’s rule on access to employee exposure and medical records, which provides that “each employee exposure record shall be preserved and maintained for at least thirty (30) years.”

That standard was written for a workplace. Its architecture assumes an employer, an employee, a regulated substance, and a job site. Invoking item 040 would apply a thirty-year workplace exposure rule to records supporting a system whose subject is military exposure across a service career.

Mesothelioma does not consult a personnel file. Agent Orange claims are still adjudicated fifty years on. The floor measures time in employment; the harm measures time in latency; nothing reconciles them, because the standard was written for a workplace the claimant never worked in. And the promise it is being asked to serve was for a record that would be lifelong.

ILER is better at provenance than critics of such systems usually assume. Its landing page tells a staff user which sources feed the system, what date ranges each covers, and when data were last transferred. Search results arrive in sections labeled by source with per-source counts. Somebody thought about this.

The question is whether any of it leaves the screen.

Because the record does leave. A veteran’s Individual Exposure Summary is a discrete artifact, generated and transmitted. A Department of Veterans Affairs privacy assessment documents the mechanism: a VA interface service “receives an HTTP Payload from an external DoD ILER application” and passes it into a document store, over REST across HTTPS with certificate exchange. In the Defense Department’s electronic health record, an automatic alert appears when a patient’s ILER record shows a documented exposure above a threshold — a derived clinical assertion, produced by rule, surfaced at the point of care.

At each of those moves, something is packaged. Whether the package carries the source attributions, the coverage windows, and the transfer dates that the landing page displays is not established anywhere in the public record. It is the most consequential open question about the system, and it can be stated in one line: is the screen where provenance stops?

It matters because of what the empty parts of the page cannot say.

If ILER shows nothing for a location, the reasons are not distinguishable. No hazard may have existed. No one may have measured. The measurement may sit on paper that was never scanned, or was scanned imperfectly. The mission may have been classified — ILER contains no classified data, and Congress has now required the Defense Department to brief four committees on how it intends to change that. The unit’s location data may be wrong. Or the source system may simply not reach back that far, which it does not for anything before 2001.

In a join between two tables, an unrecorded exposure and an exposure that never happened produce identical output. The system cannot distinguish a hazard the government declined to monitor from a hazard that was absent. It does not merely inherit the archive’s silences. It renders them as values — a blank that arrives at an adjudicator’s desk looking like a finding.

The program said so itself. A 2020 briefing by ILER’s Defense and VA sponsors carries a slide headed ILER LIMITATIONS: “Data will be missing. Less data is available from the past — Don’t assume lack of data means no exposure.“

That is the whole argument, stated by the people who built the system, six years before GAO reported it as a live concern among veterans’ organizations. VA policy now instructs adjudicators not to deny a claim merely because ILER documents no exposure, and the adjudication manual directs staff to weigh personal statements, buddy statements, unit histories, and news articles alongside the database. This is the correct response. It is also an admission: the warning is necessary because the interface cannot deliver it.

And the warning lives in a slide deck and a procedures manual. It does not live in the record.

The consequences are not hypothetical. GAO found that claims staff have had to correct decisions after a supervising reviewer located ILER records the original adjudicator had missed “due to an unsuccessful search.” A failed search and an absent record look the same. How many were not caught by a reviewer is unknowable, which is the point. Staff at all four regional offices GAO visited also said the information “does not clearly indicate which exposures were over normal limits or occurred during a veteran’s active duty service.”

Sometimes the system does record its own failure, which is better than not recording it — and stranger than it sounds. When the claims system queries ILER and cannot match the veteran, a document lands in the claims folder titled ILER IES Record Unavailable Response, carrying the message: “The EDIPI requested is not in the ILER system.” VA’s training material explains to staff what that actually means. The response “does not necessarily mean that the Veteran is not in ILER—it simply means they were unable to be found based on the EDIPI,” and staff is told to log in and search manually.

So a document now sits in the file. It appears to be about exposure. It is about identity matching. Whether anyone reading that folder in forty years will know the difference depends on whether a training slide outlives the record.

That document has already reached a courtroom. In February 2025, the Board of Veterans’ Appeals took up a veteran who said he had fallen during basic training in 1992, lost consciousness, and been taken by ambulance to a Navy clinic in Orlando. The Board had already ordered VA to find the clinic’s records and to verify their non-existence if they could not be found. What came back was a search reply on which someone had written their initials and the word “Neg,” with — as the Board noted — “no additional detail provided regarding the search.” Alongside it, dated November 2024, sat the ILER IES Record Unavailable Response.

The Board sent it back. Initialing a box, it held, “with no indication of efforts made, and no indication that further attempts would be futile,” does not satisfy the duty to assist. What the file contained was not an answer about a fall in 1992. It was two documents recording that two systems had been asked and had not produced anything, in forms that do not distinguish: we looked and found nothing, and we could not look.

Into this gap, the government has invited the veteran.

Since March 2026, service members can add to their own records — garrison and deployment locations, registries, incidents, possible exposures — through a function called Add To My ILER. Their additions are flagged in the interface as self-reported.

That flag deserves credit. It preserves the distinction between an institutional assertion and an individual one instead of silently merging them, which is exactly what a trustworthy record should do. It also changes what the system is. When a service member writes that they were at a location in the spring of 2004 and believe they breathed burn pit smoke, that assertion may exist nowhere else in the government’s holdings. ILER is no longer only aggregating records. It is creating them.

Which raises a question the feeder systems cannot answer, because the statement never existed in a feeder system. And it changes what authenticity means. The archival question about such an entry is not whether the exposure was real. It is whether we can demonstrate that this person made this assertion, at this time, through this system, and that it has not been altered since without documentation. An authentic record can contain a claim that is disputed, uncertain, or wrong. What a trustworthy system preserves is the status of knowledge — documented, self-reported, corroborated, disputed, corrected, rejected, unresolved — rather than resolving everything toward a single value that looks like truth.

But the architecture has already assigned that status. In ILER’s confidence model, self-reported exposures and symptoms sit in Tier 2: Possible. Tier 1 is defined by individual monitoring data measured against exposure limits. Testimony cannot reach it, not because an adjudicator weighed it and found it wanting, but because the data model placed it there before anyone read it.

A veteran’s word is worth fifty meters.

Say the veteran is right, and the record is wrong. What then?

ILER cannot fix it. The program office is not staffed to validate corrections and must route them to whichever of the sixteen source systems supplied the error. At the time of GAO’s review, no one had a working correction path at all: service members were told to expect one by September 2026, veterans by October — and after a change of approach in June, veterans will be able to request corrections but not to add self-reported entries of their own. The population that can supplement the record is the one not yet filing claims. The population filing claims can only ask.

Suppose the request succeeds. A personnel system amends its data, ILER refreshes, and a new summary is generated. Meanwhile, the earlier summary may already sit in a claims folder, and a decision may already have been made on it. If the system simply resolves to the corrected value, the database is accurate, and the record of the institution having been wrong is gone. For accountability, the correction history may matter more than the corrected value.

Where any of this ends up depends on something no one designed: whether the veteran is alive.

While a veteran lives, the claims folder is governed by a system of records notice calling compensation and pension records “retained indefinitely” — an operational fact, not an appraisal decision. When VA receives proof of death, the folder is reprefixed and becomes an XC file, and the appraisal becomes unambiguous. A 2010 disposition authority makes deceased veterans’ claims folders permanent, with a cutoff annually and transfer to the National Archives at sixty years.

That authority was written to carry a permanent appraisal across a change of medium, not to invent a new one. It makes the paper folder permanent and the digitized folder permanent. It provides expressly for the “Transfer of electronic XC Claims Folders,” with VA and the Archives settling medium and format at the time of legal transfer. It even specifies the resolution at which a permanent image is constituted — 200 pixels per inch before March 2010, 300 after — and adds that records recalled from the Archives “may not be reformatted and must be returned … in their original state.” A separate item lets VA destroy the paper source once images are verified; that is the provision the court read in Robinson. Since 2007, federal schedules have been media-neutral by default, and this one bridges on purpose.

So there is an archival endpoint, and going digital did not disturb it. The claims record becomes permanent on the day the claimant dies, in whatever medium it happens to be.

What changed is not the disposition. It is what the folder can hold.

A paper XC folder could not have contained an Individual Exposure Summary, because no clerk could have produced one. The summary is not an electronic version of an older document. It is a newly generated assertion, computed across sixteen systems, at a moment, under a rule — and it enters a series appraised in 2010, under an authority whose lineage runs back to folders assembled by hand since 1918.

Which does not make ILER permanent. What becomes permanent is whichever ILER artifact happens to be in the folder, and that depends entirely on whether a query occurred and what came back. Four folders, all permanent, could preserve four different things: a summary generated at one particular moment from one particular state of sixteen databases; an ILER IES Record Unavailable Response meaning an identifier did not match; nothing, because no one queried; or nothing, because the veteran died before ILER existed.

The National Archives will preserve the assertion. Nothing yet establishes that it will preserve the machinery that produced it — which sources were consulted, in what state, under which matching rule, at which version, corrected how many times since. A permanent record of a conclusion is not a permanent record of how the conclusion was reached.

And this points to a question the schedule was never written to answer. The Archives’ own test for whether records need fresh appraisal is not the medium; media neutrality settled that. The test is whether the informational content, or the function the records document, has changed. So: at what point does depositing computationally generated evidence into a media-neutral permanent series change the informational content enough to require appraising it again? A file that once held forms, letters, and a physician’s handwriting now holds the output of an inference engine. The folder’s disposition has not moved since 2010. What the folder means has.

There is a third direction, and it is the newest. Section 996 directs that exposure data be included in the service record — again a series with its own custody and its own path to the Archives. Whether the Defense Department has implemented that provision, and how, is the question I would most like answered.

What none of these files can currently say is whether the evidence was used. Exposure summaries load into claims folders 110,085 times a month, and GAO reports plainly that these figures “reflect the availability of veterans’ ILER records” but not “whether VBA staff accessed such records for claims processing.” A record of a decision needs to distinguish evidence that was available from evidence that was accessed, considered, cited, and decisive. Right now it distinguishes none of them.

Meanwhile, the parts of the system that would let it speak about bodies rather than places remain unbuilt. The 2024 development roadmap carries a labeled category — “Required Data Sources and Features that have not been Programmed / Resourced” — and under it: dosimetry for all three services, the VA clinical data repository, laboratory results, biomarkers, trauma and hearing injury registries, asbestos surveillance, separation health assessments. Two registries that track material lodged in the body, embedded fragments and depleted uranium follow-up, were excluded by decision rather than by funding.

Every one of those is individual biological evidence. Every source that did arrive is a place, an event, or a cohort. Tier 1 — the confident tier, the ten-meter tier — is defined by exactly the measurements that were never resourced. The system’s most authoritative band is its emptiest, and the program documented why in its own roadmap. Nineteen additional sources were announced for delivery within two years. Two arrived, and neither was on the list.

Which brings us back to the promise, and to how far it has traveled from itself. The same program briefing that lists the unfunded requirements states ILER’s purpose in benefits terms: it “will relieve the Veteran from ‘burden of proof’ disability evaluations and benefits determinations.”

Six years later, three veterans’ organizations told GAO they were concerned that the burden of proof “could shift to veterans, and veterans may feel like they must fix incomplete records in order to have a claim approved.”

A tool built to lift the burden of proof is now watched for signs that it may transfer it — because when the record is blank, the person who must fill it is the person it is about. And the safeguard against that outcome exists as adjudication policy rather than as a property of the record.

None of this requires anyone to have acted in bad faith, and reading it that way would make the finding smaller than it is. Bad faith is a story about people, and it is answered by replacing them. This is a story about a mechanism: institutional attention is finite, it lags harm, and it leaves its shape in the record. That is true of every recordkeeping regime, including the ones archivists build. What ILER offers is an unusually clear view of it, because so much is documented — the directive, the tiers, the coverage windows, the unfunded list, the limitations slide.

What the documents show is a government that decided to remember, and then could only remember where it had already been made to. That built a system to link exposure to health, and did not appraise the link. That designated the result authoritative while leaving it unable to correct itself. That claimed for a benefits instrument a disposition authority written for civilian workplaces, on a clock borrowed from employment law, for illnesses measured in decades.

And that has now asked the people in the records to help write them — a genuine expansion of who may create federal evidence, offered to a population being asked to supply what the state promised in 1998 to write down itself, and filed, when it arrives, as possible.

ILER is not a record of exposure. It is a record of the conditions under which exposure became recordable — presented to claimants as the history of their own bodies.

So the unresolved question is not whether ILER’s source databases are scheduled. It is whether anyone has appraised the evidence of transformation: the rules, relationships, provenance, versions, corrections, and derived assertions by which sixteen partial sources become an authoritative statement about one person’s past.

The archive is not inside the claim. It is the chain by which those partial records became an assertion — and that chain is the part no one has yet appraised.

A veteran filing in 2050 will be judged partly on what this system said, or failed to say, in 2026. Whether anyone will then be able to reconstruct why it said it — from which sources, under which matching rule, in which version, corrected how many times — depends on decisions that, as far as the public record shows, no one has yet made.