24. The Shelves of Silence
Domain: Data Security — Classification, States, DLP, Masking, Retention, Disposal POV: Quill Reading time: ~15 minutes
The Library had always classified its books, but the classification had been informal — a set of customs and traditions, passed down through generations of archivists, that determined which shelves were public and which were restricted and which were sealed so thoroughly that only the Chief Archivist held the key. The customs had worked, more or less, for centuries. Until Vale.
Quill stood in the Restricted Archive, surrounded by the evidence of what happened when informal customs were trusted to protect formal secrets. The annotated law-book was still on the table — Vale’s margin notes, the subtle corruptions, the quiet rewriting of the principles that the city depended on. The book had been here, in the Restricted Archive, protected by the door that asked questions and the authorization system that was supposed to verify every visitor. And Vale had walked in and out freely, because he was the Chief Archivist, and no one had ever questioned whether the Chief Archivist should be subject to the same verification as everyone else.
“The data classification system needs to be rebuilt,” Quill said to the council, and his voice was steadier than he felt. “Every document in the Library, every record in the Archive, every communication that crosses the city’s boundaries — all of it needs to be classified, explicitly and formally, according to its sensitivity. And the classification must determine how the data is stored, how it is transmitted, who can access it, and how long it is kept.”
The new classification system took the form of four tiers — not the four access levels that Quill had already established for the city’s personnel, but four categories of data, each with its own rules for handling and protection.
Public data: information that could be shared freely with anyone in the city, without restriction. The proclamations that Quill had written for the Shroud defense. The maps of the maintenance tunnels that Thread had drawn. The instructions for citizens on how to report suspicious activity. Public data was stored in the open galleries of the Library, accessible to anyone who walked in, and no verification was required to read it.
Internal data: information that was not secret but was not public — the day-to-day records of the city’s operations, the personnel files of its workers, the correspondence between magistrates about routine matters. Internal data was stored in the Library’s restricted sections, accessible only to authorized personnel, and its transmission across the city’s communication channels required verification of the recipient’s authorization.
Confidential data: information whose unauthorized disclosure would cause significant harm. The access logs that Sable had been compiling. The risk assessments that Kip had developed. The cryptographic keys that protected the city’s communications. Confidential data was encrypted at rest — stored in a form that could not be read without the correct decryption key — and encrypted in transit, so that even if a message was intercepted, the interceptor could not read its contents.
Restricted data: information whose unauthorized disclosure would be catastrophic. The Founding Laws themselves — the original text, unannotated, uncorrupted — which had been moved from the Restricted Archive to a new, more secure vault deep beneath the Spire. The master keys to the city’s cryptographic infrastructure. The identities of the compromised insiders who were cooperating with the investigation. Restricted data was stored offline — disconnected from the city’s networks, accessible only in person, with two-person verification required for every access.
“Data classification is not about secrecy for its own sake,” Quill explained, when the librarians and archivists gathered to hear the new system described. “It is about proportionality. The protections applied to a document should match the harm that would result from its unauthorized disclosure. A public proclamation requires no protection. A sensitive personnel record requires some protection. The Founding Laws require the highest protection we can provide. The classification tells us what level of protection is appropriate.”
The new system transformed the Library in ways that were both visible and invisible.
The most visible change was the rearrangement of the shelves. Books that had been shelved according to subject — civic governance here, natural philosophy there, history and geography and poetry scattered across a dozen different sections — were now shelved according to sensitivity as well as subject. The public galleries still contained everything they had always contained. But the internal shelves, the confidential vaults, and the restricted archives were now organized around the classification system rather than around the informal customs that Vale had exploited.
The less visible changes were, in many ways, more important. Every document in the Library now carried a classification label — a small brass tag affixed to its binding, indicating its tier and its handling requirements. Every archivist who handled classified documents was required to log their access — not in a single ledger that could be altered, but in multiple, independent records that could be cross-referenced. Every document that was no longer needed was disposed of according to its classification — public documents could be recycled, internal documents shredded, confidential and restricted documents destroyed through a process of cryptographic erasure that rendered their contents permanently unrecoverable.
“Data retention and disposal,” Quill said, when Sable asked about the destruction procedures. “One of the principles that the old system ignored entirely. The Library kept everything — every draft, every note, every fragment — because keeping everything was easier than deciding what to keep and what to discard. But keeping everything created a massive attack surface. Every document, no matter how trivial, was a potential vulnerability — something that an adversary could find and exploit. The new system requires us to decide, explicitly and deliberately, what to keep and what to destroy. And what we destroy, we destroy completely.”
“And the data that is still being used?” Kip asked. “The records that are active, the documents that people need to access every day?”
“Data in use is the hardest to protect,” Quill admitted. “A document that is being read cannot be encrypted, because encryption would make it unreadable. A record that is being edited is vulnerable to alteration, because the editing process creates a window of opportunity for corruption. The best we can do is minimize the exposure — limit who can access the data, log every access, verify every change, and ensure that the data is encrypted again the moment it is no longer actively being used.”
The data security system was tested, inevitably, by one of Vale’s remaining agents — an archivist who had not yet been identified as compromised, who attempted to exfiltrate a set of confidential documents from the Library’s internal shelves. The attempt failed, not because the archivist was caught in the act — she was careful, and skilled, and knew the Library’s passages better than most — but because the documents she had stolen were encrypted at rest. The brass tags on their bindings, which looked like ordinary classification labels, contained small cipher mechanisms that automatically scrambled the document’s contents whenever it was removed from its designated shelf. The archivist escaped with the documents, but the documents were unreadable — and when she attempted to decrypt them using a key that Vale had provided, the key did not work, because the encryption had been rotated the week before.
“The system worked,” Quill said, when the incident report was presented to the council. “The data was protected. The classification was enforced. The encryption prevented unauthorized access even after the physical documents were stolen.”
He paused, and his voice, when he spoke again, was quieter. “But the archivist escaped. She is still out there, still working for Vale, still looking for vulnerabilities to exploit. The data security system can protect the data. It cannot protect the people. And as long as Vale has agents inside the city, every person who handles classified information is a potential point of failure.”
The council was silent for a long moment, and then Penric spoke. “Then we continue the investigation. We find the remaining agents. And we continue to improve the systems — the classification, the encryption, the logging, the verification — so that even if an agent succeeds, the damage they can do is limited.”
Quill nodded. It was not the answer he had wanted. It was the answer that was possible, and in the months since the Shroud had arrived, he had learned to distinguish between the two. The data would be protected. The systems would be improved. The agents would be found, eventually. And the city would survive — not because it was perfectly secure, but because it was becoming more secure, incrementally, every day.