Files Were a Great Idea in 1973

Pillar 01 · Security

A follow-on to the shadow data piece. What happens when you stop storing the object everyone is attacking.

Bias declaration up front: I run SkyeConnex. We build data custody infrastructure. Everything below is the argument for why we built it the way we did. Read accordingly.

Last time I wrote about shadow data. The short version: an entire product category now exists to find copies of your own data that escaped, and no amount of scanning fixes an architecture that produces copies faster than you can find them.

So let's talk about the architecture. Specifically, the file.

The oldest thing in your stack

Everything in your stack has been replaced since the 1970s. Networks, chips, languages, operating systems. Rewritten, virtualized, containerized, rewritten again.

The file made it through untouched. A named container of bytes, sitting in a location, fully readable by whoever reaches that location. That was the contract on a PDP-11. It is the contract in your cloud bucket this morning. We changed the address format and called it progress.

Every data security problem you have depends on that contract.

A breach works because the attacker who reaches the location gets a whole readable object. A subpoena against your cloud provider works because the provider possesses a whole coherent object to hand over. Shadow data exists because whole readable objects copy beautifully. Ransomware is a dispute over who holds the key to your whole readable object.

Different adversaries. Same gift.

Fifty years of guarding it

The industry response has never been to question the file. The response has been to guard it.

Perimeters around it. Encryption at rest, with the keys held by the same operator that holds the file, an arrangement that works fine until a statute shows up. DLP to watch the file leave. DSPM to find out where it went. Access controls to decide who gets near it, enforced by whoever runs the building.

Every one of those products accepts the file as a given. The object sits there, whole and readable, and you get billed annually to stand near it.

Look at the file differently

A file is two things. The industry treats it as one, and that is the whole mistake.

The first thing is the substance. In our custody model the substance stops existing as a whole object at ingestion. Client-side encryption, RS(5,2) erasure coding, shards dispersed across independent jurisdictions, zero-knowledge key hierarchy. No shard is readable. No host holds enough shards to matter. No operator holds keys, including us. The substance of your file has no location. It has a distribution.

The second thing is the shadow. Every object in custody casts exactly one, on purpose: a ledger-anchored fingerprint, ML-DSA-87 signed, recording every custody event. The shadow proves the file exists, who touched it, that it has not changed, and which policy and jurisdiction govern it. It exposes zero bytes of content.

Now watch which one behaves like a file. The shadow is what gets listed and queried. The shadow is what your auditor receives. Your compliance report is assembled entirely from shadows. For every purpose except reading the content, the shadow is the file. Reading the content is a reconstruction: momentary, policy-gated, at the edge, under your keys, logged in the ledger, leaving no whole object behind.

Nothing about your day changes

The obvious objection: fifty years of software expects files, and nobody is rewriting their stack for a philosophy lecture.

Nobody has to. The virtual drive in File Explorer shows you files. The S3-compatible gateway serves objects to your applications, and your databases talk to it like any other endpoint. Double-click still works. What changed is what sits behind it. An assembly performed on demand, under policy, instead of a warehouse of whole objects waiting for whoever shows up with credentials.

Run the adversaries again

The breach reaches a storage host and exfiltrates shards. Encrypted fragments of an object that never existed there. The attacker now owns confetti.

The court order arrives at a provider. The provider produces what it possesses: some shards it cannot read, and no keys. Compelled disclosure requires something disclosable.

The audit runs on shadows. Existence, custody, integrity, policy state, all cryptographically demonstrable without anyone going near content. You demonstrate control over data you provably cannot read.

Provider risk changes shape too. Lose a host and you reconstitute that shard node from surviving shards on another provider. The file outlives its landlords.

None of this required better guards. It required not storing the object.

Retirement

The file earned its fifty years. It gave humans a mental model and software a contract, in an era of one computer in one room holding data for the people in that room.

That assumption is now load-bearing under global infrastructure facing nation-state attackers, extraterritorial statutes, and machine-speed copying. We kept the assumption and built four industries to manage the consequences.

A file is substance plus shadow. The substance never needed to sit anywhere whole. The shadow could have been doing the talking all along.

Keep the double-click. Lose the object.