What disclosure achieves¶

Less than it should, in a city with this particular political geography. The MCLU publishes this assessment not to discourage disclosure but because accurate expectations are more useful than optimistic ones, and we have spent enough years in this work to know the difference.

The limits of public knowledge¶

Disclosure does not retrieve the data already transmitted. It does not restore clients to a position of informed consent retroactively. It does not, on its own, compel any party to stop, explain, or be accountable. The arrangement existed before this report. The data flowed before this report. Those facts are not altered by the report existing.

What changes is the category in which the information sits. Before this publication, the arrangement was known to the parties involved, suspected by some adjacent parties, and unknown to the clients and the public. After this publication, it is known. These are meaningfully different states, even if the practical consequences of the difference take time to materialise.

Known information is harder to manage than quietly known information. Parties who previously operated on the assumption that the arrangement would remain undisclosed must now operate on the assumption that it will not. Decisions made on the basis of continued non-disclosure will need to be revisited. Actions that were reasonable when the arrangement was private become less reasonable now that it is not. This is not nothing, even if it is not everything.

What it creates for those who can no longer claim ignorance¶

Disclosure creates obligations for parties who are now aware of the situation and have responsibilities that awareness activates.

Other clients of the cloud provider who have not yet assessed their exposure now know that an assessment is necessary. Failing to conduct one is a choice, and choices made after awareness carry different weight than failures that preceded it.

Regulatory bodies with relevant mandates, to the extent that such bodies exist in functional form in Ankh-Morpork, are now on notice. The MCLU has submitted formal notifications to the bodies we have been able to identify. We note, with the precision that characterises our reporting, that “submitted formal notifications” and “received any acknowledgement” are not the same thing, and that the gap between them is itself informative.

Parties who know about the arrangement and have professional obligations that may require them to act on that knowledge, lawyers, auditors, guild officials, and others, are now in a position where inaction is a considered choice rather than an uninformed one. The MCLU cannot compel anyone to act on their obligations. We can ensure that the information needed to recognise those obligations is available.

The history of similar disclosures in this city¶

The MCLU has published findings of this kind before. We can report, with the equanimity that comes from repeated experience, that the immediate response is typically a period of silence followed by a period of managed acknowledgement in which the facts disclosed are accepted while the characterisation of those facts is disputed, followed by a longer period in which some but not all requested remedies are partially implemented, followed by the arrangement continuing in a modified form that addresses the most visible element while leaving the structural problem intact.

We publish anyway. The structural problem becomes harder to leave intact each time it is named clearly. Progress in this work is measured in years, not responses, and the MCLU has been registered long enough to take the longer view.

Why this still matters¶

The clients deserve to know. This is, in the end, the plainest argument for disclosure and the one that does not require any assessment of likely consequences. The clients handed their infrastructure to a provider on the basis of a representation that was incomplete. They are entitled to know that, whatever follows from knowing it.

The public record should contain accurate information about how surveillance arrangements operate in this city. That record is built one disclosure at a time. This is one of them.

The arrangement continues, as far as the MCLU can establish, to operate. Disclosure does not stop it. It makes stopping it more possible than silence does, which is the only claim the MCLU is making on its behalf.