Things Writers Need To Know About Security & Concealment

---

Reasons people might want to keep something concealed

There are five main reasons people typically want to keep something concealed:

To prevent people from countering or stopping them: In warfare, if an enemy faction knows where you plan to launch your next attack, they can mount their defenses to stave it off. In business, a competitor who finds out that you want to put your next store building on a piece of prime real estate might just try to outbid you to make sure they own the land so you can't.

To prevent people from competing with them: In warfare, keeping an enemy faction from knowing how your superior weapons are made keeps them from making those weapons for themselves and fighting you with them. In the business world, keeping a competing company from knowing what kind of product you're developing prevents that company from trying to make a similar product to sell at lower cost and thus potentially lose you buyers for your product.

To prevent people from taking their assets: In warfare, an army is done for without clothing, weapons, medicine, and most of all, food, and Secrecy can prevent the enemy from stealing or sabotaging supplies that could mean the difference between defeat and victory. In business, it can prevent people from stealing goods and/or money, resulting in loss of profit.

To keep nonessential people out of the way. Even if they don't mean any harm, curious looky-loos can still present a liability. They might unintentionally interfere with important tasks or operations, or accidentally damage something, or unknowingly transmit information that people with worse intentions might be able to use. Depending what's going on, they might even be putting themselves in harm's way, and it's in everyone's best interest to make sure that the odds of anyone needlessly getting hurt or killed are minimized.

To protect their images. Knowledge of an ethical breach or a foul-up somewhere can make people view the guilty party as incompetent, uncaring, or even malevolent. In politics, this can mean less support for a person or group - or worse, a revolution. For a producer or company, this can mean a loss in profits. However, it must be noted that this sort of thing can completely backfire (and often does) when the truth finally does come out.

So if your characters are supposed to have something they're trying to keep secret, think it through - do they have a good reason (or at least think they have a good reason) for trying to keep it secret? Or are you just giving them things to keep secret merely for the sake of making them seem foreboding or mysterious? You probably want to aim for the first moreso than the second - because a bunch of people who keep pointless secrets for pointless reasons don't exactly look clever.

What security & concealment might entail

Depending on what kind of setting your characters are in, and what your characters would reasonably have access to, here are some methods they might use to keep themselves and their stuff hidden:

Barriers. Whether it's walls, fences, or even just difficult-to-cross distances/terrain, barriers can make it harder for the opposition or for nonessential people to reach critical locations.

Camouflage. You're probably familiar with the concept of making objects blend into the scenery with natural colors and patterns, but this is only one type of camouflage. At its core, camouflage is about concealing something - anything - by making it indistinguishable from something perfectly ordinary. You could potentially "camouflage" a file by giving it a name that sounds like an OS system file, then sticking it among those files - EG, a file named "BootShell.log" stuck into C:\Windows. (Many viruses have files named and placed thus to keep the average computer user from easily finding and deleting its files.) Another example of camouflage is the classic book safe, where a hollowed-out book placed on a shelf among other books is impossible to distinguish from the rest.

Diversions & decoys. Attention can be kept away from important objects or data thus. A great example of this is found in the history of the Cullinan Diamond. When sending the diamond from South Africa to England, a decoy was sent out on a steam ship, guarded with the sort of security one would expect for an object that precious. But in reality, the diamond was simply mailed to its destination, where it arrived safely. A similar trick was used to send the diamond to Amsterdam for cutting - the heavily-guarded box on the Royal Navy ship was a decoy; the actual diamond was transported on a passenger ship in someone's pocket.

Euphemisms & codewords. These can help prevent people from knowing exactly what it is you're up to, even if they do overhear or read something important. For example, film studios might use working titles to mislead competing studios as to what they're actually making, or to keep fans and journalists from trying to break in and make nuisances of themselves. Likewise, if you refer to your new secret weapon as "paintball pellets," it's not going to be a huge deal if someone overhears a discussion about it.

Encryption. The art of encoding data so that cannot (or at least will likely not) be read except by the intended recipient. There are many ways to do this, some more secure than others. (The only truly unbreakable encryption system - and if it's done right, it is truly unbreakable - is the Vernam cipher, or one time pad.) But even imperfect encryption is far from useless - it can still keep a lot of people from accessing one's information, plus anything that can delay the enemy can buy valuable time for you.

Locks & passwords. Another way to stop or delay people from accessing critical information, systems, or items. Different types of locks and password systems have their individual strengths and weaknesses.

Limiting access and/or awareness. Every individual who has access or knowledge of something increases the risk of a breach or leak. (And for the curious, the math has been done on this.) Optimally, as few people as is feasible will have knowledge of or access to critical information, goods, or systems. This can often be managed with classification/clearance systems, where things are shared only on a need-to-know basis.

Cleanup. The act of removing things that would give away critical information so others cannot access them - EG, deleting files, cleaning up trash that would indicate that someone has been someplace or has done a particular deed there, etc. However, it must be noted that trying to remove some things can actually backfire, either because the absence of something might not be much less damning than its presence, or because the act of trying to remove it draws even more attention to it.

There is no truly flawless system of security/concealment. Somewhere there is always a risk or tradeoff of some kind. But this does not mean it's necessarily worthless - far from it. A good system can potentially reduce what could have been a fatal disaster into a manageable inconvenience, significantly reduce the overall number of breaches and/or leaks one has to contend with, and in general increase one's odds of success significantly.

The downsides of security & concealment

Keeping things secret can come with some complications and drawbacks, many of which aren't often addressed or acknowledged in fiction. Here are a few possible downsides:

Highly compartmentalized organizations can run into coordination problems. Even though making sure nobody has the whole picture can keep a lot of secrets from spreading around, there are a few ways it can backfire. Different departments might end up working on the same problem, thus creating resource-wasting redundancy or leaving other problems unmanaged. Two different departments might end up inadvertently sabotaging each other if they don't realize they're on the same side.

It can result in the loss of valuable assets. If an accident or disaster involving classified assets occurs, it may not be reported to proper authorities or to those who could lend assistance for that very reason. As a result, the assets may be lost entirely.

It can cost money. Decent locks, fences, security software, etc. don't come free. People are probably going to have to be paid to install all of that, and people are probably going to have to be paid to design whatever security protocols are going to be used. And if you've got a whole organization devoted to keeping things concealed - well, the power bills alone can cost millions!

It can cost time. Security scans or questionnaires, trying to remember passwords, unlocking complex locks, etc., all take some time. Too much time wasted, and vital efficiency might be lost.

It can result in bureaucracy. Someone's got to be in charge of and figure out who gets to know what and who is allowed where, after all. The larger the organization, the more people this will take, and the more convoluted and sluggish the whole system will get.

It can make whoever is trying to keep the secrets look insecure and paranoid. A person or group who tries too hard in some way - such as by treating a relatively harmless breach as if it's a code red disaster or treating information that basically amounts to useless trivia as some sort of vital secret - can come off like this. Behavior like this often indicates that someone's ability to keep things under control is very tenuous and that the whole thing could go toppling with very little effort. People may lose faith in this individual/organization's competence and judgment. Enemies may take it as a sign that now is the time to strike, and may deliberately play into the paranoia to try to provoke the leader into taking actions that compromise the group's efficiency or stability. (EG, making the leader suspect that members are planning treason to spark a useless investigation and perhaps even get some members terminated.)

It can create mental stress. Particularly for secrets that must be kept in the long-term. There may be topics that one might like to talk or vent about to others, but can't. Having to lie to friends and loved ones may create feelings of guilt and distance. And then there's the simple effort of having to keep track of what can be said and done around whom.

What good security/concealment practices entail

In fiction, security/concealment is often handled so poorly that what the characters are doing and how they go about doing it would realistically leave disastrous messes everywhere and invite all manner of complications, so here's a list of what good practices involve:

Good practices do not needlessly provoke curiosity and intrigue. Imagine Beth looks out the window at four in the morning to see the neighbors, wearing jeans and hiking boots, busy loading up coolers, folding chairs, and a tent into an old truck. She'll most probably going to assume that they're getting an early morning start on a camping trip and think nothing of it. After awhile, she might even forget about it entirely.

Now imagine Beth looks out at four in the morning to see the neighbors wearing black suits, loading up shiny steel boxes into the back of a sleek black sedan. Suddenly she's wondering, who are they? Are they government agents? Foreign spies? Domestic terrorists?

Now Beth has motivation to start gossiping with the other neighbors and to possibly call the police - and if any of these people are in contact with any intelligence groups, they'll be relaying that information to them. She'll also be much more alert and aware now - whether consciously or unconsciously, she'll be paying far more attention to her surroundings. This increases the odds she'll see something else in addition to what she's seen already. And if someone comes along later on asking people if they've seen anything strange going on, Beth is much more likely to have a very juicy answer to give.

Good practices do not needlessly draw attention to themselves. Let's say that Beth meandered outside at four in the morning, and our mysterious team (we'll call them the M-Team) decided that she saw too much and had to be disposed of. Thus poor Beth met her untimely demise.

Whether or not the body is ever found, neighbors are going to catch wise to the fact that something untoward happened to Beth. Even if they don't immediately notice her absence, they will at least notice the police investigation when asked if they ever saw or heard anything suspicious. As a result, their own states of awareness will be heightened - because is there someone lurking around who might do the same thing to them? To their children? Between law enforcement and anxious neighbors, there are now a lot of people who might notice something.

As for the M-Team, if they weren't already planning leaving permanently, they'll probably have to now - because not only are the neighbors probably in a heightened state of awareness, there's also going to be law enforcement poking around. So not only have they lost themselves a perfectly good base of operations, but the moving process is going to delay their plans.

Let's say the M-Team was planning to leave town for good anyway. Even so, killing Beth might still not be in their best interests. Disposing of dead bodies takes time, which means delaying their getaway. Leaving a body proves that murder happened for sure, which means that the death will be immediately investigated as a homicide, rather than as a missing person case. Trying to stage an accident or suicide also takes up valuable time, and it's easy to leave behind evidence when one is in a hurry. Plus, it's possible that someone will witness something and report it. The fact that Beth's death/disappearance happened the same night that the neighbors mysteriously vanished won't go unnoticed and unappreciated by neighbors and law enforcement, either - and it certainly won't be missed by any intelligence groups who have connections to either and are keeping watch for any activity that might point to these people.

Good practices keep things simple. The fewer steps or components something requires, the quicker it can be done and the lower the odds are that something will go wrong somewhere. Let's say that Beth meandered outside to find her neighbors (very foolishly) tricked out like classic comic book agents. One option is to simply ignore her and let her be. If she asks questions, they might simply give the most basic of answers possible. ("Are you going somewhere?" "Yep, we're heading out." "Where?" "Morganville, for the show." "What show?" "Look, I'm sorry, but we're running late already and we gotta go.") As far as tying up loose ends goes, sometimes this is about as tidy as things can get.

Good practices offer actual benefit over the alternatives. What could Beth actually do with the scant information she has that would create serious problems for the mysterious team? About the worst that might happen is that she lets some intelligence agent know that they were someplace that they aren't anymore. And this would almost certainly happen when an intelligence agent realizes that a group of people whose physical descriptions/traffic camera pictures match the M-Team vanished the same night Beth disappeared or was found dead. Thus, killing Beth has no real advantage over leaving her alive, so there's just no point in killing her.

"But what if Beth is the agent?" you might ask. "Might they have a good reason to kill her then?" Actually, killing a spy often isn't all that useful, plus you still have all the complications that having a dead person on your hands creates.

So whatever your characters are doing, ask yourself: what's the real benefit of doing this over anything else? If they can't figure out a reason it would be better than the alternatives, then they probably shouldn't bother.

Good practices try to defend against whoever or whatever is most likely to be able to do the most damage. Now for an entirely different scenario! Let's say that Ted's base has a cache of high-tech weapons that he needs to protect from being stolen. There are a few groups who might be interested in stealing them, but the two most likely groups to try to break in are some gnomish thieves and some elven rebels.

Ted decides to against the gnomish thieves by setting gnome-detecting traps that will fire lasers of vaporizy doom at them. Any gnome that sets foot inside will be a cloud of smoke in a matter of seconds!

However, the gnomes are actually too small to even use the weapons, and it would take at least half a dozen of them to lift even one. While they might possibly be able to bring one to an elf, the odds that they could actually get one out without being noticed and stopped by a security guard are minimal.

Meanwhile, anyone who isn't a gnome who successfully reaches the weapons cache can walk into the room and take one out without fear of setting off the lasers - including the elven rebels, who can actually make use of the weapons and use them against Ted's people

Taking special measures to protect the weapons against tiny gnomes who are unable to use them and who are very unlikely to be able to successfully steal even one, but failing to do the same for the elves, is completely backwards! Unfortunately, this principle is violated all the time in fiction. For example, a weapon that can only be used by a particular non-human species might be protected by death traps that effectively keep out the humans, but only serve as a minor inconvenience to the actual members of the species despite the fact that there are members who have motivation to steal it.

So when you're trying to work out a system, stop and think of it from the perspective of those using it: who do they know about who could cause the most trouble if they got to whatever was being protected? That's who they should be prioritizing protecting against.

Good practices don't try to fix what isn't broken. Let's say that the elf rebel Tina decides to steal some information from Ted's base. She disguises as one of Ted's people and thus infiltrates the base. While she's walking down the hall to her destination, she's stopped by a security guard who wants to know what she's doing here. She makes up a story about being needed to help move some things around. The guard buys the story and lets her move on. But then Tina turns and kills the guard, allegedly to "leave no witnesses."

But as the guard believed her story, she had no good reason not to just let things be - and now she's just increased the odds that she'll get busted before she makes it out with her haul. If she leaves the body where it can easily be found, people are going to realize sooner rather than later that an enemy is on the base. If she hides it, she risks being seen with it and blowing her cover immediately, or being found when a search for the missing officer is instigated.

Likewise, if what goes on at Ted's base is supposed to be a secret, there's no sense in killing or imprisoning people who accept the cover story that they're just breeding high-yield potatoes and that they're trying to keep people out who would steal their secrets and sell them to competitors. (And there's not much that's more suspicious and attention-grabbing than a string of mysterious disappearances or deaths!)

Good practices use as few resources as is feasible. Realistically, people only have so many resources to spread around, and the more they spend on one job is less they have to use on another. Even if whoever funds what's going on has a lot of money, costs can run up in a hurry if it involves highly-trained personnel (they didn't just train themselves for free!), vehicles, specialized equipment, and/or operating centers/offices. Consider that currently, the US spends over fifty billion dollars to fund intelligence programs each year - and that doesn't even include military intelligence! Also, take a look at how much money FEMA (as it's a group that needs a lot of equipment and personnel) has spent yearly from 2000-2010.

Ways a breach or leak might be managed

If your characters are supposed to be competent, they should only kill as a last resort and should kill as few people as possible. (If they went around killing anyone and everyone who might have seen the tiniest little thing, the deaths/disappearances they left behind would quickly ramp up far too high for anyone to miss or ignore!) What's more, having your characters go around killing people willy-nilly can make you look like you're trying too hard to shock your audiences or make your story seem "dark." So, here are some ways that your characters might effectively react to and deal with a leak or breach:

An assessment of how much the other party actually knows. For example, could what witnesses saw easily be rationalized or passed off as something it wasn't? So they saw a couple of guys in suits talk to some other guys and saw a fight break out. It could easily be nothing more than a drug trade that went bad. And a spy might have delivered enough data to give the opposition some idea of what you're doing, but is it actually enough that the opposition can do all that much about it? If it's not that big of a deal, then it's probably best just to let things be and carry on.

An assessment of how much risk the leak/breach actually presents. Is someone really and honestly going to be able to use that information to muck up your mission before it's done? If not, then there's no reason to take action. Is having a single song leaked from your album going to stop people from buying the whole thing? Nah; on the contrary, it might just get them excited for the rest.

Legally available means. Because people can typically be arrested and charged with trespassing and theft. Why risk getting into trouble for something illegal when there's a perfectly good legal solution right at your fingertips?

A plausible story. In 1947, when a USAF high-altitude surveillance balloon (designed to detect Soviet bomb tests) crashed in Roswell, New Mexico, the USAF claimed it was simply one of their weather balloons, an explanation which which left most people satisfied. And so interest and speculation in the matter died down. (At least until the 1970's when conspiracy theorists came forward with the idea that the "weather balloon" had actually been an alien spacecraft, but by that point the technology was long obsolete, anyway.)

An absence of definitive answers. On the other hand, a common way to handle possible breaches to the public is to issue a statement that one can neither confirm nor deny something.

A new strategy. Let's say a shaving cream company gets its formula stolen by a competitor, allowing the competitor to make a similar product. But there's no actual proof that they based their formula on the other company's, so they're in the legal clear. The first shaving cream company might launch a marketing campaign that presents its own product as the original (with the implication that it's the best), or paints it up as a tradition of sorts, or associates it with its target consumer's sense of identity.

Obsolescence. In the event that a new weapon is ultimately stolen and recreated by the enemy, it might be possible to roll out a better model (which was probably being developed already, anyway). Same for a product being sold - a product gets copied, it might be possible to make a better version of the product to put on the market.

A change of tactics. If the enemy gets hold of a weapon and figures out how to use or recreate it, then the best solution might be to switch tactics over to something that the weapon doesn't offer as much of an advantage against.

An examination and possible change of security/concealment practices. Anyone competent will make sure that the breach/leak is investigated and that two questions are asked: "Why, where, and how did our methods fail?" and "What can we do to reduce the odds that someone be will able to do something like this again?" From there, it can be determined whether there is a solution that can be implemented.