Public Record
Luxembourg published 260,000 companies. I am going to draw every one of them.
Note added 5 May 2026. The number 1,524 in this essay turns out to need context. The figure was assembled from the open-data sources Luxembourg makes available, sources that do not carry current company status. Many of those entities have been dissolved. The correction is not a smaller number; it is the entry to a deeper finding about how the Luxembourg Business Register is structurally calibrated against citizen-rate analytical access. I have written about it here: A Country I Cannot See.
I took this photograph on February 18, 2018, in front of a building in Luxembourg City.
On the left, two slots identified by strips of plastic label tape. The tape reads PARLEMENT EUROPÉEN and COMMISSION EUROPÉENNE. Behind those two slots live the Luxembourg branches of the European Parliament and the European Commission, the legislative and executive bodies of a union of 450 million people.
On the right, a single slot for Hutchison Whampoa Europe Investments Sàrl, a Luxembourg holding company. Below the slot are brushed-metal engraved plaques listing forty subsidiary companies that share the same mailbox. Hutchison Ports in Spain, the Netherlands, Poland, Sweden. Hutchison 3G in Ireland, Austria, the UK. AS Watson. Marionnaud. Accipiter Finance. UK Rails. Forty names engraved on plates the size of a textbook.
The public institutions are identified with tape. The private holding company has plaques. The size of the sign is inversely proportional to the presence of the entity behind it.
I thought about this photograph for several years without doing anything with it. Then earlier this month I drove past another building on Avenue J.F. Kennedy, in the Kirchberg business district. Half of its facade was covered by a banner advertising office space for rent. That address, according to the Luxembourg company register, is the legal seat of more than a thousand companies.
I have walked past mailboxes like the one in that photograph my entire life without thinking much about what they meant. Dozens of company names on a single plate screwed to a vestibule wall. Holdings, SICAVs, SARLs, funds with numbers in their names. You see them and move on. One day I stopped and tried to count. It came out to something like forty.
I wanted to know how many buildings in this country have plaques like that one. How many addresses hold dozens of registered entities, or hundreds, or more. Whether the city I grew up in is partly paperwork. The register is public. That is a statement of law, not of marketing. So I thought I would look.
This is a record of what happened when I tried.
The Register
The register is established by law (loi modifiée du 19 décembre 2002 concernant le registre de commerce et des sociétés). Article 1, first sentence: “Le registre de commerce et des sociétés est public.” The register of commerce and of companies is public. Any citizen may look up any company. The law is old. What it imagined was a counter, a clerk, and a ledger.
What exists today is a website operated by the Luxembourg Business Registers. A search form. A field for a company name or an eight-digit registration number. You type, you submit, you receive a result. One company at a time.
I wrote a small program to do the same thing, faster. Look up B1, save the result. Look up B2, save the result. Continue until B260000. The way the website allows. One at a time.
It lasted four lookups.
Before each search, the website requires your computer to solve a cryptographic puzzle. Not a picture of a fire hydrant, but a complex computation. The browser grinds through millions of hash operations until it finds a number that satisfies a difficulty target, and only after that number is handed over does the page accept the name you want to search. On my laptop this was almost invisible: the puzzle solves before the page finishes rendering. But when I moved the program to a small server I had rented in Germany, the same puzzle took two minutes. Then the server was identified as a data center and served a blank white page with no explanation.
I was confused. The data is public, the law says so, and I was reading it exactly the way the website allows: through the search field it offers, solving the puzzle it demands, one entity at a time. The only difference was that I was not sitting at my kitchen table.
What the State Rations Is Not Data
What the state rations is not data. It is time.
I installed a VPN on the server. The traffic went out through a residential-IP VPN exit, the kind of address the firewall trusts. I was in. Then the server ran out of memory. The puzzle, the browser, and the VPN encryption together exceeded what the little machine could hold. I went to bed. In the morning, the thing had been rebooting itself all night. Eighty-one companies collected. I deleted the server.
I rented a bigger one. Sixteen processor cores. The puzzles solved in seconds. I ran eight scrapers in parallel.
For four and a half hours, it worked.
Then the puzzles got harder.
The system had noticed. A puzzle that had taken seven seconds was now taking 136. Within an hour, the puzzles stopped being solvable at all. All eight scrapers died. I tried again fourteen hours later, with a clean browser, from a fresh IP, and the puzzles immediately came back impossible. The system had a memory.
The anti-bot software behind this is called FriendlyCaptcha. Its operator describes the mechanism as adaptive: difficulty is increased based on how often requests come from an address. Looking up one company is easy. Looking up a hundred is slow. Looking up all of them is arithmetically impossible in the time a human lifespan allows.
Somewhere during those weeks, renting servers and writing puzzle-solving code and watching hash rates converge on thresholds, I noticed I was starting to feel like I was doing something wrong. That body feeling you get when you are somewhere you are not supposed to be. I was reading a public database through the interface it provides, and the system was treating me like an intruder.
That feeling is the point. The architecture of access does not only prevent you from reading the register in the aggregate. It makes you feel that you should not be trying. The puzzle, the firewall, the scaling difficulty, the silent white page: these are not merely technical barriers. They are a message. The message is that this is not for you.
The Other Door
There is a faster way. The LBR offers a paid programming interface for professional users. It does not publish its pricing and conditions.
The European Union disagrees with this arrangement. Commission Implementing Regulation (EU) 2023/138 of 21 December 2022, in force since February 2023, lists company register data among the “high-value datasets” that member states must make available free, via an application programming interface, and as bulk downloads, under an open licence. The required fields are listed in the annex: company name, legal form, registration number, address, status, date of registration. The implementation deadline was 16 June 2024.
Luxembourg reported compliance. The compliance report cited the publication of annual financial accounts, which is a different dataset. The registration data, the actual register of who is where, was not included.
I sent a message to the LBR help desk in Luxembourgish. I asked whether the data could be downloaded by category, or by time period, or in any form that would let me read more than one entity at a time. The contact form required my full legal name, email address, telephone number, and consent to terms of service that claim intellectual property over the entire database.
They politely answered the same day.
“Every search must be downloaded company by company, based on a company name or RCS number. A search to see all companies is unfortunately not possible.”
Not “not yet.” Not “we are working on a solution.” Not possible.
They did not mention the paid interface. As far as we know, there are two systems. One where the register is bulk-readable: an API sold to professionals. One where it is not: a web search, behind a puzzle, one company at a time. They did not fail to build the bulk download. They built it, sold it to corporations, then installed a wall around the other entrance, and then added a mechanism that makes the wall grow taller the harder a citizen pushes.
The Back Catalog
Before 2016, every company formation, every address change, every director appointment, every liquidation and dissolution had to be published in an official gazette called Mémorial C. The legal requirement went back decades. The archive sits today on a government server. Thirty-eight thousand PDFs, one per issue, indexed by date. No captcha. No authentication. Direct HTTP. I downloaded all of them in an afternoon.
In June 2016, Luxembourg migrated the gazette to a new platform. The platform is called RESA, run by the LBR. The legal requirement did not change. The data did not change. The architecture around it changed. For any publication after June 2016, you have two options. You can consult company by company through a search form, and each search demands a puzzle. Or you can click a button labeled “bulk download” that promises an entire day’s publications compiled into one document.
I clicked the bulk download button. It produced a PDF. The PDF is 1.1 megabytes. Inside: a RESA logo, a header, an embedded font, and no content at all. Every business day since the migration, every working day since 2016, the same empty PDF. The embedded font is called Source Sans. A source of nothing.
So there have been two Luxembourgs of the corporate gazette. Before 2016, the state delivered the publications as legible files on an open server. After 2016, it delivered a captcha wall for citizens, an invoiced API for professionals, and a decoy export that produces an empty file. The infrastructure the state built to restrict access in the present sits downstream of a past it forgot to delete.
I wrote a parser for the Mémorial C archive. Each notice, when you strip the formatting, contains the company name, the legal form, the RCS registration number, the registered address, and the event type. Incorporation. Address change. Director appointment. Liquidation. Dissolution. Across twenty years of issues, the archive gave me not just names but addresses, and not just the living companies but the dead ones: every entity that published a liquidation or dissolution notice between 1996 and 2016 is in there, which lets me separate the active register from the defunct without ever touching the captcha wall.
Combined with the GLEIF dataset, a non-profit based in Basel that publishes Legal Entity Identifiers for the world, free, under an open licence, including most Luxembourg entities that have ever held an LEI, I had names, registration numbers, filing histories, and for most of the register, addresses. What the Luxembourg state refuses to hand a citizen, a foundation in another country hands out free. What the Luxembourg state walls off in the present was, until the migration, unwalled on its own servers. To get the addresses of the missing companies, I am running a slow automated request on my computer that will take weeks, probably months, to complete. The hardest part of this work is not the puzzle, not the firewall, not writing the parser. It is the waiting.
The addresses are the field the state built the wall around. Company names are available through every open door. Registration numbers are free. Balance sheets are free. The registered address, the one field that would let you see that 1,500+ companies share a single building on Avenue J.F. Kennedy, is what the puzzle guards. The system is not arbitrarily difficult. It is precisely difficult. Names are noise. Addresses are the signal. The architecture protects the signal.
The register is public. The architecture is not.
What the Plotter Draws
I have a pen plotter, a small mechanical drawing machine that moves a pen across paper under computer control. I fed it a list of the 1,524 companies registered at 49, Avenue J.F. Kennedy. The machine writes each name in a single-stroke font designed in 1967 by A.V. Hershey at the United States Naval Weapons Laboratory for exactly this kind of machine. A 0.2 mm pigment liner. No pause between entries.
The first pass fills the page top to bottom. Company names, legal forms, fund designations. You can read each entry. When the plotter reaches the bottom of the page it returns to the top and continues. The second pass writes over the lines of the first. By the fourth pass, the page is a striated grey field. Rows of text remain legible as structure. Individual names dissolve into accumulation.
One company at an address is a line of text. Over a thousand companies is a document whose density carries the architecture of the address. The drawing took twenty-one hours.
One of the companies registered at that address filed a notice last year. “Xcalibur Aviation Company,” a Luxembourg SARL, informing the public that its shareholder, a Mauritius entity, had changed its address. The notice is signed un mandataire, a representative. No name. An anonymous agent filing a notice about an anonymous shareholder of an aviation company at an address that advertises itself for rent. This is the public record.
Copyright
The terms of service I had to accept to send the LBR one Luxembourgish email claim intellectual property over the entire database. I am not permitted to redistribute the data. I am not permitted to reconstruct the register.
Commission Implementing Regulation (EU) 2023/138, which has been in force for over three years and whose implementation deadline passed almost two years ago, says the Luxembourg state must make this database available, free, open, machine-readable, in bulk. Luxembourg, a founding state of this same European Union, has decided to disagree with its own regulation.
I have a public database that I am not allowed to publish. I have a register that is defined by law as public but whose contents I cannot hand to you directly. The final architectural move of the Luxembourg company register is not to prevent me from reading it. It is to prevent me from showing you that I read it.
So here is a drawing of all the companies registered at one building in Kirchberg. You cannot read the names. Neither can I, at this scale. But the shape the names make together, a dense grey field on a sheet of A4 paper, is precisely the shape the architecture was built to hide.
The plotter is small and portable. The paper is cheap. The register is public. The street is public. I am drawing what Luxembourg published about itself, in the form that Luxembourg has not forbidden, on the street, one building at a time.
Pascal Piron is an artist based in Luxembourg working with pen plotters and computational systems.