Marvel's Doom Had One Job. So Did the Perimeter.

Pillar 01 · Security

Bias declaration. I run a data sovereignty company. I think custody of data matters more than promises about data.

So Avengers: Doomsday has reportedly leaked online. The whole film. In 4K. Three months before release. Being passed around on Telegram like a cottage potluck recipe.

Unverified. Marvel hasn’t said a word. Fine. Let’s assume for a moment it’s real, because the lesson holds either way.

This is one of the most protected files on the planet. Watermarked screeners. NDAs thick enough to stop a bullet. Actors who get fake scripts. Tom Holland isn’t allowed to know what movie he’s in.

And yet.

I’m sure the policy binder was excellent. I’m sure there was a slide that said “Zero Trust” in a very confident font. I’m sure every vendor in the post-production chain signed something, attested to something, and passed an audit of something.

The file left anyway. Files do that. They are remarkably indifferent to your compliance posture.

The mechanism nobody wants to talk about

A modern film touches dozens of VFX houses, colour shops, dub studios and localization vendors across a dozen jurisdictions. Every one of them holds a complete, usable copy of something. Every copy is one bored contractor, one bad password or one court order away from being someone else’s copy.

You can’t leak what you don’t hold. Marvel’s vendors held everything.

Now swap “superhero movie” for “patient records”. Or “defence procurement data”. Or “every citizen’s tax file”. Same architecture. Same sprawl of third parties. Same binder. The only difference is that nobody on X runs your health record through an AI detector and posts the results with popcorn emojis.

Best part of the story? The debate online is whether the leaked images are AI fakes. A detector says 0%. So the one thing we can verify with confidence is that the stolen thing is authentic. Wonderful. Provenance works great after the theft.

Deterrence is not a control

If it’s real, the FBI will get involved. Last time a Marvel film leaked, someone went to federal prison. That’s the control model most organizations are still running. Deterrence. Find the guy afterwards. The data is still out. The guy being in jail does not un-leak it.

So what would actually have helped?

At SkyeConnex we start from a rude assumption. Every vendor, every host and every admin will eventually be breached, bribed or subpoenaed. Including us.

So there is no file. Data is encrypted on the client before it goes anywhere, then erasure coded into shards and spread across independent providers in different jurisdictions. No provider holds a usable copy. A shard on its own is noise. Steal one and you’ve stolen a very expensive random number.

There is no single point of access either. Keys stay with the customer. We can’t reconstruct the data. The hosts can’t. A court can order any one of us to hand over what we have, and what we have is useless. Shards only come back together inside the customer’s own boundary.

Then the audit piece. Every custody event goes into a hash-chained, Merkle-style ledger, signed with post-quantum signatures. Change an entry and the chain breaks. Delete an entry and the gap shows. Nobody gets to quietly tidy the logs afterwards, which is usually the first thing that happens.

Apply that to a film

The VFX house works on the shots it’s assigned. It never holds the movie. The colour shop never holds the movie. Nobody holds the movie until the owner puts it back together. And if someone pulls something they shouldn’t, the ledger tells you who, what and when. Marvel found out from a guy called MyTimeToShineHello.

Does it stop someone pointing a phone at a monitor? No. Nothing does. But a phone doesn’t get you 2160p.

Disney has more money for security than most governments. If Doctor Doom can’t keep a file inside the building, your “sovereign cloud region” with a maple leaf sticker on it is going to be fine, I’m sure.

Contracts don’t hold data. Policies don’t hold data. Whoever holds a complete copy holds the data. So stop letting anyone hold one.

Hell answers to Doom, apparently. The file server did not.

Ross Norrie
Founder & Architect, SkyeConnex
[email protected] · skyeconnex.com