The CIA that isn't spying on you: confidentiality, integrity and availability in an ordinary day

Wednesday, 17 September 2025, 7:10 a.m. Your phone buzzes on the bedside table before the alarm. It's an email from HR: "Mandatory CIA training, today at 5 p.m., 45 minutes, attendance tracked". For a few seconds, one eye still shut, you consider the possibility that your company has been acquired by American intelligence. Then you remember the colleague who last year clicked the link in the fake parking fine and took the servers down for three days, and it clicks: it's the security training.

In security, CIA doesn't mean Langley. It's the initials of three words: Confidentiality (only those who should know, know), Integrity (things are the right things and nobody has tampered with them) and Availability (things are there when you need them). It's the triad the whole of information security rests on. The idea is old: back in 1975 two researchers, Jerome Saltzer and Michael Schroeder, split security problems into three families: someone reads what they shouldn't, someone changes what they shouldn't, someone stops you using what's yours.

The training is at five. You have a whole day to discover that you meet the real CIA every ten minutes. And it has nothing to do with computers.

7:40 a.m., the key under the doormat

You leave home and, like every morning, notice that your second-floor neighbour keeps the spare key under the doormat. The most famous hiding place in the world, just ahead of the flowerpot by the door and the top of the door frame. A secret everyone knows, including those who shouldn't, isn't a secret: it's a habit.

At the main door, the entry code is 1-9-7-0. You know because someone has written it in pen on the wall, right above the keypad, "for couriers". And here's the first principle of confidentiality: a secret is only as safe as the weakest place it's written down.

If that sounds like a problem for your building only, think about suitcases. The "TSA-approved" locks sold at airports have one feature: American airport security owns master keys that open all of them without breaking anything. In November 2014 the Washington Post, for an article on how luggage travels, published a high-resolution photo of those keys lying on a table. The photo was taken down, but too late. In September 2015 someone worked out the exact cuts from the image and published files online to 3D-print them. Within hours people were opening their own suitcases with a plastic key printed in five minutes. All it took was a photograph.

Best practice: don't photograph or post keys, documents, boarding passes, tickets and badges. And if a secret is shared, ask yourself with how many people and in how many places.

8:20 a.m., the café and the conclave

At the café you pay for your cappuccino by card. The card reader sits on the counter, facing the queue, and as you type your PIN you feel the breath of the person behind you, watching the keypad with the attention normally reserved for a penalty shoot-out. It's called shoulder surfing, and it's the oldest, cheapest and most effective attack there is. Cover the keypad with your other hand. It isn't rude: it's confidentiality.

If you want to see how the professionals do it, think back to May. Before the conclave that on 7 May 2025 brought 133 cardinal electors into the Sistine Chapel, the Governorate of Vatican City announced that from 3 p.m. that day the mobile phone transmitters on its territory would be switched off. The cardinals handed in their phones, the chapel was swept for bugs, and everyone, including some eighty staff, swore an oath of secrecy. That's confidentiality in three layers: people (the oath), things (no phones) and the channel (no signal). Three layers, because a single one sooner or later gives way.

9:30 a.m., the post and the queen

You stop at the porter's desk to pick up a registered letter. The porter asks "Are you Mr…?" and you say yes without showing anything. The letter is handed over. The channel (the porter) trusts you, and you trust the channel. It works perfectly, until the channel starts working for someone else.

In 1586 Mary, Queen of Scots, had been a prisoner in England for eighteen years. She was secretly in touch with a group of conspirators led by Anthony Babington, who were plotting to kill Elizabeth I and put Mary on the throne. The letters were enciphered, and went in and out of the castle hidden in the stoppers of beer barrels. A perfect system, with one flaw: the courier, Gilbert Gifford, worked for Francis Walsingham, Elizabeth's spymaster. Every letter was copied and passed to Thomas Phelippes, a cipher expert, who decoded it. When Mary replied approving the plan, her fate was sealed, and Phelippes even added a forged postscript to her letter to get the names of the other conspirators. Mary was executed on 8 February 1587.

Two lessons in one story. First: encryption is useless if the channel is in enemy hands. The second you'll see shortly: that forged postscript was no longer a confidentiality problem. It was an integrity problem.

11:00 a.m., the pharmacy seal

At the pharmacy you buy a bottle of cough syrup. At home you open it and find that foil disc under the cap, the one that's a pain to peel off and that you curse every time. Before cursing it again, here's where it comes from.

At the end of September 1982, in the Chicago area, seven people died after taking Tylenol capsules, a common painkiller. Someone had taken packs from the shelves, put cyanide in them and put them back. The culprit has never been found. Within weeks the US Food and Drug Administration required over-the-counter medicines to have packaging that makes any tampering visible: seals, films, caps with a ring that breaks. The manufacturer went back to the shops with a triple-sealed pack.

Here's the most important point about integrity: often you can't stop someone tampering with a thing, but you can make sure you notice. It's the same principle as the wax seal on a king's letters, the lead seal on a gas meter and the button on a baby-food jar that goes "pop". If the seal is broken, you don't trust it. Simple, and it saves lives.

12:15 p.m., the changed bank details

Accounts call. An email has arrived from your paper supplier: "Please note that from this month our bank details have changed, here is the new account number". Right logo, right signature, polite tone. The invoice is twelve thousand euros. What do we do?

Before answering, a Portuguese story. In 1925 Artur Virgílio Alves dos Reis, a Lisbon con man, had a brilliant idea: instead of printing fake banknotes, he had real ones printed. With a forged contract, supposedly from the Banco de Portugal, he persuaded Waterlow & Sons of London, the very printer that produced Portugal's genuine 500-escudo notes, to print a new batch. The notes were authentic: same paper, same plates, same printer. Only the order was fake. The house of cards collapsed at the end of the year, when notes with duplicate serial numbers turned up, and Portugal's central bank sued the printer and won.

That swindle follows the same pattern as the bank details email. You don't need to forge the money or the invoice: you just forge the instruction. And the cure is as old as the telephone: verify the request on a different channel from the one it arrived on. You call the supplier on the number already in your contacts, not the one in the email. If the account really changed, they'll confirm in thirty seconds. If it didn't, you've just saved twelve thousand euros and a very awkward meeting.

1:00 p.m., cups, grams and a plane without fuel

At lunch you try an American recipe that says "one cup of flour". You use the scales, and the result is a brick. Nothing was tampered with: the data was right, but the unit was different. That's an integrity problem too: information that's correct in one context becomes wrong in another.

On 23 July 1983 a brand-new Air Canada Boeing 767, flight 143 from Montreal to Edmonton, ran out of fuel at 41,000 feet. The 767 was the airline's first aircraft to measure fuel in kilograms instead of pounds, and its fuel gauges were out of order. On the ground the fuel was calculated by hand with a conversion factor, 1.77, which turned litres into pounds, while everyone believed they were getting kilograms. The result: the plane took off with less than half the fuel it needed. The pilots, Robert Pearson and Maurice Quintal, glided it down to Gimli, an old military base in Manitoba. The far end of the runway had become a drag-racing strip, and that weekend the drivers and their families were camped there in tents. The plane stopped before reaching them. Of the 61 passengers and 8 crew, nobody died and nobody was seriously hurt. Ever since, that aircraft has been known as the Gimli Glider.

The board of inquiry didn't blame a single person but a chain: broken gauges, unclear procedures, no cross-checks. Best practice: when a number changes hands, it must travel with its unit and someone must check it again. That goes for fuel, and it goes for flour.

4:00 p.m., who has the archive key?

In the afternoon you need a paper contract from the archive. The archive is locked. Only one person has the key, and they're on holiday in the Canaries until Monday. The contract is safe, nobody has read it and nobody has changed it. Confidentiality and integrity are perfect. Shame you need it now.

Welcome to the third letter, availability. It's the most underrated, because when it works nobody notices. The enemy here has a technical name, single point of failure: the one element that, if it breaks, stops everything.

Sometimes the single point of failure is a tree. At three in the morning on 28 September 2003, during a storm, a high-voltage line in Switzerland arced to a tree and tripped. The power shifted to the other lines into Italy, which overloaded and tripped one after another, like dominoes. Within minutes the whole of Italy was in darkness, Sardinia excepted. Rome was holding its White Night, with the streets full of people until dawn, and the city went dark in the middle of the party.

Sometimes the single point of failure is a ship. On 23 March 2021 the 400-metre container ship Ever Given wedged itself sideways in the Suez Canal and blocked it for six days. According to Lloyd's List estimates, around 9.6 billion dollars of goods were held up every day. One ship, one canal, and a huge slice of world trade in a queue.

And sometimes it isn't clear at first who's to blame. On 28 April this year, just after half past twelve, Spain and Portugal lost power for hours: traffic lights off, trains stopped, lifts stuck, card payments impossible. In June the Spanish government's report pointed to a cascade of overvoltages the grid couldn't control, and ruled out a cyberattack. The people who coped best that day were the ones with a battery radio and some cash in their wallet.

Best practice: for everything important, ask "what if this isn't there?". A copy of the key left with a second trusted person. Important documents in two different places. A torch that actually works, not the one with batteries flat since 2019. And above all: test the backup plan before you need it. An emergency generator you've never switched on isn't a generator: it's an ornament.

5:00 p.m., the training and the three quarrelling letters

The training starts. The trainer shows a slide with a triangle, and by the third slide you realise you've already lived through all of it. But there's one last thing the triangle doesn't spell out: the three letters don't get along.

Think of your grandmother's safe, the one whose combination only she knew. Maximum confidentiality: not even the grandchildren know what's inside. Then grandma forgets the combination, and availability drops to zero. You call a locksmith, who drills it open: now the safe is available, but no longer confidential, and no longer intact.

Every security choice shifts weight from one letter to another. The more people hold the archive key, the more available it is and the less confidential. The more checks you put on payments, the more intact they are and the slower they go. Security isn't about maximising all three letters, which is impossible. It's about deciding, for each thing, which of the three matters most. For a medical record it's confidentiality, for the dose of a drug it's integrity, for the oxygen in an operating theatre it's availability.

The trainer finishes with a quiz. Question one: "What does CIA stand for?". You answer without thinking: the neighbour's doormat, the conclave, the queen in the beer, the cough syrup, the Lisbon con man, the Gimli Glider and the ship sideways in the canal. The trainer looks at you, puzzled. You explain you were summarising.

The checklist for your fridge

Confidentiality

• No keys under the doormat, no codes written next to the keypad. The PIN doesn't go on the back of the card (not even "backwards to confuse thieves").
• Cover the keypad when you type a code, at the cash machine as at the front door.
• Don't post photos of keys, documents, boarding passes, badges, tickets. A high-resolution photo is a copy.
• Give information only to those who need it, when they need it. "I'll tell everyone, just to be safe" is the opposite of safe.

Integrity

• Broken seal or odd packaging? Don't use it, take it back.
• Changes of bank details, address, instructions: always verify on another channel, with a number you already had.
• Numbers travel with their units, and important calculations get checked by a second person.
• Signature and date on important documents, copies kept. The original must be comparable.

Availability

• Every important key has a copy, left with another trusted person.
• Nobody should be the only one who knows how to do something essential: write it down, and teach someone else before the holidays.
• Torch, batteries, a little cash, a radio, important numbers on paper too.
• Test plan B. At least once. Beforehand.

And if tomorrow you get an email inviting you to NSA training, call HR before clicking. On the number already in your contacts.