What a Privacy Breach Teaches About Protecting Creative Work

This is Part 2 of “A Creator’s Story.” Part 1: The Artist Who Was Never Paid for Her Art.

Of all the conversations I have with creators, the hardest ones are about privacy breaches. They tend to begin the same way: the contact came out of the blue. An account behaving strangely. A document that seems to have been opened. And then the long, slow, frightening stretch that follows — a breach reaching into accounts, documents, and the early, unregistered versions of work someone spent years imagining.

I’m going to write about this gently and without forensic details, because the details are not the lesson. Anyone who has been through anything like it already knows: the exhaustion of not knowing how they’re getting in, the months of methodically re-securing every account and device, the strange grief of deleting apps and changing numbers, the quiet relief when the noise finally stops. It is a violation that follows a person around for a long time.

What I want to share is what a breach teaches — because those lessons became the blueprint for everything ScriptShield does.

Lesson one: your unreleased work is your most vulnerable work

A published book has a public record. A released app has a launch date the whole internet witnessed. But the manuscript in your cloud drive, the pitch deck in your inbox, the prototype on your laptop — those exist in a strange in-between where they are at their most valuable and least defended. Early-stage work has no public footprint to anchor it to you. If it leaks, is copied, or resurfaces somewhere else, the question “who made this first?” has no ready answer.

That is the fear that keeps creators up at night — not just the intrusion itself, but the realisation that if early work surfaced under someone else’s name, there would be remarkably little to point to.

Lesson two: security protects access. It does not prove authorship.

Everything can eventually be secured — new numbers, new accounts, hardened devices, better habits. But everyone who has stood in that wreckage comes to understand something that most security advice never mentions: even perfect security only controls access. It says nothing about authorship. If a copy of your work escaped yesterday, today’s stronger password cannot help you show it was yours.

Authorship needs a different kind of protection: an independent, dated, tamper-evident record that a specific work existed in your hands at a specific time. That is what a cryptographic fingerprint and a trusted timestamp do — and they keep doing it whether or not anything bad ever happens.

“We write to taste life twice, in the moment and in retrospect.”

— Anaïs Nin, The Diary of Anaïs Nin

Nin meant it about memory, but it is also true of evidence. A record made in the moment lets you return to that moment later — with proof instead of recollection.

The practical habits I keep now

None of this requires being a security expert. The Australian Cyber Security Centre publishes plain-language guidance that covers most of it. Here is the version I live by as a creator:

The turn: from fear to infrastructure

Somewhere in those conversations, the fear quietly changed shape and became a design brief. Nobody can un-live a breach. But every creator can make sure that from today forward, every version of everything they make has a fingerprint, a date, and a place in a chain of records that nobody — not an intruder, not a copycat, not time itself — can quietly rewrite.

That practice became a system. The system eventually became ScriptShield. Not because a record can stop a bad actor — it can’t, and I won’t pretend otherwise — but because a record means a bad actor no longer controls your story.

Resources

Australian Cyber Security Centre — practical personal security guidance. eSafety Commissioner — support for serious online abuse. IDCARE — identity and cyber support service for Australia and New Zealand. Copyright monitoring for independent creators — what watching the internet for copies realistically involves.

Next in this series: Part 3 — Why Protecting Your Work Shouldn’t Cost $450 an Hour.