A senior executive at a large enterprise once came to me with what he thought was a simple ask. He had a video (internal forecast and planning content for his sales team) and he wanted to distribute it without any possibility of the content leaking outside the company. Could our internal streaming platform give him that level of control?
I told him what he didn’t want to hear. No platform could guarantee that. Yes, we could authenticate access, restrict the stream to authorized employees, and log who watched it. But all anyone needed to do was point a phone at their screen and hit record. The analog hole is undefeatable. If photons hit a display, the content is copyable by anyone in the room with a common communications device in their pocket.
I walked him through what actual containment would require. Set up a physically secured room. Invite only the people who need to see the material. Have a single trusted operator manage the presentation on a projection screen. Require every attendee to leave personal electronics at their desk. Monitor the outbound email gateway for a window after the session, because most people who leak information aren’t sophisticated about it.
He realized his sales forecast video didn’t justify that level of information control. He used the streaming platform and trusted his people. I told him if a leak did happen, we could easily enough request a scan on outbound e-mails over the time span and that would in all likelihood identify the person. That was the right call, and the sales team proved out our trust in them. But the conversation stuck with me, because it was the first time I clearly articulated something I’d understood for years but never had to spell out for someone else: the gap between perceived control and actual control over information is almost always enormous, and people consistently get it wrong in both directions.
They get it wrong trying to keep things in. They also get it wrong assuming things will stay gone.
Years prior, I posted questions on the Usenet, under various email addresses over the years, in various newsgroups. These were conversations I had akin to ones you would have in a hallway gathering, maybe around the water cooler. Newsgroups where maybe a few hundred readers in one group as regulars, no broader reach, no thought about permanence one way or the other, it was public and that was really as far as the thoughts went. The posts were forgotten within days, that’s how most people used the Usenet.
Then a company acquired an archive of the full historical Usenet feeds and made them searchable. In a single afternoon, I was able to reassemble every email address I’d ever posted under and read the full text of every conversation I’d ever had across every newsgroup. For a lot of us those first few weeks this was a kind of sport… can you find your oldest post online. Nothing I’d posted reflected poorly on me, I wasn’t worried about that, but the lesson was immediate and in my face. Information I had treated as historical, transient speech, that realistically many of us expected was being saved somewhere by someone with enough storage space, along with the time and money to maintain it, had actually been collected, warehoused, acquired, and indexed, and was now fully searchable in a new medium, retrievable by anyone on Earth. And when you add modern real-time language translation interfaces on that dataset, it’s now got a global reach that was never considered.
I had made no mistake. I had simply applied an intuition that information stored within one platform would be contained to that platform. The surprise (if one can call it surprise) was the proof that the platform is just an interface to the data and can ultimately take any form.
Those two experiences sit at opposite ends of the same problem. One is about overestimating your ability to contain information. The other is about underestimating how far and how long information travels. Both miscalculations come from the same root: we think about digital information as if it behaves like physical objects. It doesn’t. Physical objects stay where you put them. Digital information migrates.
The personal cost of this lesson came in two separate events, years apart.
In the first, I sold a personal asset with speculative value during a period of hardship. Someone with a minor online platform decided to make public sport of the sale. I made the mistake of reaching out to him privately, explaining the personal circumstances behind my decision. He responded with hostility. I responded in kind. He then published the entire private exchange on his website for entertainment.
His site eventually went dark. He had no crawl permissions, so the content never made it into any web archive. But that exchange is still out there somewhere, on someone’s hard drive, in someone’s cache, and I have no way to retrieve it or remove it. Ultimately it was more the embarrassment of a private dispute being used for entertainment that was the distress for me in this case. The lesson was blunt: private communication is only private if both parties agree it is. I was operating under social norms. He was operating under “content is content.” The moment I hit send, I handed a hostile actor material I could never take back and became the brunt of a joke.
In the second, I maintained an account on a content platform where I followed professional comic book, anime and video game artists. I’d come up through media and gaming earlier in my career, and tracking the digital art world had simply transitioned from a professional activity to a personal one as my career moved into IT management. The interest didn’t change. The context around it did. Ten years earlier, that feed would have been perfectly on-brand. But careers move. Your digital footprint doesn’t.
Then someone pointed out that the watchlist was publicly visible by default. When searching for me on Google, my profile page and watchlist was the first result… not my LinkedIn, not my company bio, but a content platform featuring a feed of comic book and game art as the highlighted content. To anyone searching my name in a professional context, the first impression wasn’t an IT executive. It was someone who appeared to work in an entirely different industry. A complete identity mismatch, indexed and presented as the definitive result.
I hadn’t posted anything. I hadn’t commented on anything. I had used a platform feature exactly as designed. The platform simply made my activity public without any clear indication, and default visibility turned a private hobby into a public statement, decontextualized and permanently indexed. I changed the settings, cleared the watch list, and quit using the platform. But I have no idea how long it was visible. Not that it matters ultimately.
Here’s what none of these stories are: lessons I needed to learn. I’d been working in copyright, fair use, and information management long before any of these events took place. I was the person organizations brought into the room to explain how this stuff works. I already knew containment was theater when the executive asked me about his video (that was me teaching, not learning). I already understood digital permanence when my Usenet posts resurfaced. I already knew private communication isn’t secure when I emailed a hostile stranger. I already knew platforms make visibility decisions without telling you when my watchlist went public.
Knowing didn’t matter. The physics don’t care what you understand. Information moves the way it moves, and being the expert in the room doesn’t make you immune. All it means is you recognize what happened to you faster than most people would.
At some point (not a single moment, more like a gradual release of tension) I stopped being frustrated by this. Not because I’d learned some final lesson, but because fighting the physics had simply become exhausting. You can know that water flows downhill and still spend years building dams. Eventually you stop building dams. Not because you’ve been defeated, but because you’ve finally asked yourself what you were actually trying to protect.
Once you ask that question honestly, the answer gets very small. Not the information itself… that was never yours to hold. What you can protect is exactly one thing: provenance.
When my wife completed a piece of research that produced genuinely novel findings, we faced a familiar problem. The knowledge itself couldn’t be patented (it was a research finding, not an invention). It couldn’t be trademarked (it was a methodology, not a brand). There was no traditional IP mechanism that fit.
But the research had been expressed as a graphical work, a personally and meticulously crafted piece of visual art she created that contained and communicated the technical information of her work using the visual languages of the practitioners who came before her and informed her destination. And a graphical work can be copyrighted. So that’s what I helped her do. We registered the copyright on the image.
The copyright registration itself specifies MIT-0. No attribution required. Use it however you want. The work is completely free.
The copyright doesn’t prevent anyone from learning what the image teaches. It doesn’t restrict access to the knowledge. What it does is create a timestamped, legally registered record that says: this work existed, these people created it, on this date. It establishes provenance. Origin. Priority.
Here’s the move that makes it all work: her image isn’t just a technical diagram with a copyright stamp on it. It’s a piece of compelling visual art. Something people might actually want to share, repost, use. And because it’s MIT-0, there’s zero friction. No license to check, no attribution to remember, no permission to ask. Just take it.
Every person who shares that image is broadcasting the provenance flag to a wider audience. Every repost, every use, every appearance in someone else’s context increases the visibility of the underlying copyright registration. The distribution doesn’t dilute the protection… the distribution is the protection. The more people who have seen that flag, the harder it becomes for anyone to credibly claim they haven’t seen it.
After watching information escape every container anyone has ever built for it, I stopped fighting the current. The image wants to move? Let it move. Make it want to move. Make it beautiful enough and free enough that people carry it everywhere. And let the copyright registration sit quietly underneath, doing the only job that matters: proving who planted the flag and when.
You don’t need walls. You need a flag that travels.
Plant your flag. Open the gate. Let the work move.
