Operation Free Sample¶
The Home for Bewildered Beasts of Legend learned that its field workers had been tracked for a year and a half from a journalist, who had it from a data broker, who had given it away as a preview. No tunnel was cracked. No credential was reused. Nothing on the Home’s estate was touched at any point, which is why nothing on the Home’s estate ever showed anything, and why the incident review had no incident to review.
What the buyer received was ordinary: a per-device advertising identifier, a coordinate, a timestamp, and no name attached to any of it. The identifiers came out of the apps the field workers carry like everyone else, weather, maps, a messenger, a game one of them plays on the ferry. Sold in bulk for advertising, they are also a movement record of a welfare network that works by being where outsiders are not.
In the field¶
The Home for Bewildered Beasts of Legend: the Disc-wide network whose field presence is its whole method, and whose people carry personal phones because the Home has never been able to afford otherwise.
The field workers: welfare staff whose routes are the map of who trusts them, and who consented to nothing beyond a cookie banner in a hurry.
The keepers and correspondents: the people who talk to the Home about a creature in a cellar, whose safety rests on nobody knowing which farmhouse a field worker visits twice a month.
The Office of Civil Surveys: still the denied reader, and now unable to warn the Home about a market it would have to admit it had also looked at.
The buyer: unnamed, and likely to stay that way. A purchase carries no attribution, and the Home has no route to discovering who holds a copy.
Bought, not breached¶
The reconstruction runs backwards from the file rather than forwards from an intrusion.
An identifier that rests overnight at one address in Genua and spends three days a fortnight at a farmstead outside it has stated where a field worker lives and which keeper they are working with. Neither fact was written down anywhere the Home controls.
Two identifiers that appear together at the farmstead, then separate, name a meeting. Repetition over a season names a relationship, and a relationship is what the Home spends years earning and never records.
A third identifier turns up at the farmstead once, then at a border post, then not again. Absence in this data is not evidence of anything, which does not stop a reader treating it as evidence of something.
Precision is uneven inside one file. Some records place a device within a few metres, others within several kilometres, and the two look identical until they are plotted. A reader in a hurry will not distinguish them, and the consequences of the error land on whoever lives at the misplaced address.
Identification needs no exploit. An identifier that sleeps at one address and works at another gives a pair of coordinates; a public directory converts the first into a name, and a professional profile confirms the second. This is clerical work, and the journalist did it in an afternoon.
The Home’s own controls were not defeated. They were never in the path. A tenant hardened to the last setting, a tunnel replaced, a device policy enforced on the Home’s own handsets: none of it touches a record generated by a personal phone and sold by a party the Home has no relationship with.
Decision points¶
Whether to tell the correspondents. Telling them names the risk and may end the relationship that the risk is attached to. Not telling them leaves people exposed to a file the Home now knows exists.
Whether to change the field method. Leaving phones behind on sensitive visits works, in the sense that the data stops where the phone stops, and costs the safety that a phone provides to a lone worker in a bad part of a town.
Whether to issue handsets. A Home-owned device can be stripped of the identifier, kept off consumer apps, and governed by policy, which moves the problem rather than removing it: the worker’s own phone is usually in the same bag.
What to do about the year and a half already sold. Nothing recalls a file that has been delivered. Deletion requests reach the seller that answered them and not the buyers who hold copies, and the archive gets easier to read as later datasets arrive to join it.
Whether this is an incident at all, in the sense the Home’s insurers and regulators use the word. The answer shapes whether anyone is obliged to be told, and the honest answer is uncomfortable: no system was breached, and the exposure is total.
What surfaces, and how¶
Nothing surfaces from the collection. It leaves no artefact on any system the Home operates, generates no alert, and appears in no log the Home can pull. What can surface is the use, and it surfaces as knowledge that arrives from the wrong direction:
A caller who knows a field worker’s route before the worker has described it, in a conversation the worker leaves feeling helpful rather than suspicious.
A visitor who arrives at a branch office in the twenty minutes a week it is briefly unstaffed.
A keeper who reports being approached by someone who knew when the last visit was and asked, pleasantly, when the next one is.
A journalist, an activist, or a researcher who has bought a sample and recognises the pattern, which is how this one came out, and which is not a detection capability so much as luck wearing a press card.
Those signals belong to counter moves on the human layer rather than to any network telemetry, and they are the only place a defender gets to stand.
Behind the kindness¶
The exposure is a property of a market, not of an estate. The Home’s data stewardship can be excellent and the file still exists.
The asset is the same one the Office of Civil Surveys has always valued: the human terrain of half the Disc, in a detail no ministry could buy. The change is that now a ministry can, from a vendor, at a price a small office could approve without a meeting.
The technique from the adversary’s side, what a bought file yields and where it fails: ADINT as reconnaissance.
The feed and the network it belongs to: the Home across the Disc.
The impact family: when nothing breaks and the secret is already gone.
Last updated: 13 August 2026