Campaign Living Archive

Nobody has to steal the city’s secrets. They have only to wait for the city to pack them up for safekeeping. The Grand Trunk and the Golem Trust both run under strict continuity mandates: every transaction, every deployment log, and every ministerial dispatch is mirrored to an off-site yard for disaster recovery. The system is healthy, the compliance logs are clean, and the morning would be unremarkable, except that the secondary yard chosen for the autumn backup cycle sits on land the city ceded to Quirm two years ago.

The night shift

  • The Office of Civil Surveys: which drafted the continuity mandate requiring all state intelligence to be held three copies deep, and is now watching the bandwidth logs with a quiet, growing sickness.

  • Golem Trust Computing: the provider. It ran the backup perfectly, using the legitimate administrative tools already installed on the staging servers.

  • The Civic Defence Establishment: whose classified readiness ledgers, troop dispositions, and courier routes were swept into the archive by a continuity rule that drew none of the distinctions the sealed cellar draws. The one tier the backup could not reach was the sealed one, because it had never been in a yard to copy.

  • The Civil Observers’ Society: which notices that the keys used to seal the backup container were generated by a utility updated two days before the cycle began.

The backup window

The operation raises no security alert, because it uses no exploit. The Trust’s automated maintenance window opens at midnight. The job runs on clacks-sync, the native, trusted utility built into every tower to manage replication. The data moves down the primary lines at routine priority, wrapped in the standard administrative certificates.

The morning report reads: backup window completed, no errors.

The discovery comes when an analyst in the Surveys office sees that the replication did not stop at the city’s hardened baseline. It kept going, down a legitimate routing alias left in place for regional alliance sharing. The adversary did not break into the vault. They logged into the scheduler with a valid clerk’s token and added a comma and a second destination to the weekly housekeeping routine. The city’s highest-grade material has spent six hours travelling down the Trunk, neatly packed, compressed, and optimised for transit by the city’s own software.

Decision points

  • Whether to abort the job mid-line. Killing the replication stops the leak and leaves the city’s live databases un-backed-up, unindexed, and unstable, and it tells the adversary the tap has been found before anyone can trace who signed the routing alias.

  • Whether to revoke the certificates clacks-sync runs under. It closes the channel and ends the automated housekeeping of every tower on the continent, turning a quiet exfiltration into an immediate regional standstill.

  • What to assume about the copy already sitting in the Quirm yard. The container is encrypted, but the utility that packed it was updated by the same hand that altered the script, so the city decides between assuming the adversary already holds the key and spending three days on the hope that they do not.

  • Whether to admit the mandate was the vulnerability. The rule that forced the creation of one central, all-inclusive archive is the exact reason a single night was enough to clear the shelves.

The replication buys theft with no signature at all. The adversary ran no scanner, dropped no payload, and tripped no intrusion rule. They let the city’s own fear of losing its records carry the records out the door.

The wider leak

  • The keys were rotated mid-cycle. The automated script generated a new key during the backup window, so the city is locked out of its own archive while the copy in Quirm stays readable to whoever holds the new token.

  • The alliance backed itself up too. A sister capital’s continuity system checked the Ankh-Morpork registry for its weekly sync, found the new destination, and mirrored its own defence ledgers to the same foreign yard, on schedule and without a hand on it.

  • The weather covered the exit. The network slowdown during the leak was explained, helpfully, as bad weather on the Trunk, so the city spent a day using the sky to hide the adversary’s tracks.

Inside the archive