The shadow arrangement

Two steampunk scenes, divided by a jagged rip in reality. Left: A smiling cloud provider executive in ornate Victorian attire shakes hands with a trusting merchant client, bathed in bright, warm, promotional lighting; brochures display bold text: "SECURITY" "PROTECTION" "TRUST." Right: Through the rip, the same executive, in cold blue lighting, hands shimmering crystal balls of client data to shadowy figures bearing hidden guild insignias.

The investigation the MCLU has been running longest, and the reason the other briefs are shaped the way they are.

A cloud provider in Ankh-Morpork received surveillance technology from a third party. In exchange, the data that technology collects flows back to the third party. The clients were not told. They did not ask, because they did not know there was anything to ask about. That is the whole arrangement, and its simplicity is doing a great deal of work.

Nothing was written down. No memorandum, no contract, no termination clause. What we can establish about the order of events is that the capability was wanted before it was offered.

The tools watch traffic volume, timing and routing, and map who speaks to whom and by which route, which is more informative most of the time than whatever was said. They hold file integrity, which for a guild means membership rolls, and they build behavioural baselines over months. They also correlate activity across clients at once, which serves no single client and the aggregate very well. A security stack asks whether something is wrong. A collection apparatus asks what is happening. The clients were told they had bought the first.

They had bought it in writing. The agreement runs to nineteen pages, permits the provider to share data with “trusted partners” for “operational purposes”, and does not say who the partners are or what the purposes encompass. Terms of this kind are not written to be understood. They are written to have been agreed to.

The clients did everything asked of them and are exposed for it. The Royal Bank, the guilds, and the Home for Bewildered Beasts with its donor rolls all hold data carrying obligations to people who consented to none of this.

Then the complication. The apparatus detected external probing, characterised its intent, and forwarded the methods with everything else. It faces outward as well as in, and the MCLU has been corresponding and engaging advisors across that same network throughout.

Download the case file

Last updated: 17 September 2026