[Creative Award 2026 Business Category Entry][Memory and Records] Chapter 6 | Do Records Disappear, or Do They Leak?
Memory and Records—Why Do Humans Keep Records?
Chapter 5 | Why Does Team Memory Always Break?
Up until the previous chapter, I have written about the value of records. I have considered from various angles the meaning of designing records—how records with context compensate for the limitations of individual memory, pass on organizational knowledge, and assist the work of our future selves and colleagues.
However, another question arises here.
Will those records truly continue to exist?
Records have two fundamental risks: the risk of disappearing and the risk of leaking. No matter how carefully a record is designed, it is meaningless if it disappears. And if a record that should be protected leaks, it can become a blade that harms the organization.
In this chapter, I will consider the question of "protecting" records.
And this question is not merely about technology. Throughout the 5,000-year history of humanity engaging with records, the meaning of protecting them has been questioned time and again. Against accidental loss, against intentional destruction, and against modern information leaks—each era has found its own answers. By tracing that history, we can see what we must do now.
Records disappear by accident
In Chapter 2, I wrote about how the ancient Library of Alexandria was lost to fire. A major repository of human knowledge was helpless before the flames. That is why monasteries dispersed manuscripts to multiple locations, Gutenberg enabled mass reproduction, and modern cloud services have come to make records redundant across data centers worldwide. To protect records, humanity has refined the wisdom of "copying and dispersing."
However, there are situations in the modern digital age where that lesson has not been sufficiently learned.
During the Apollo program, NASA recorded vast amounts of lunar exploration data on magnetic tape. Decades later, however, it was discovered that some of those tapes had deteriorated and become unplayable. Data from the historic moment when humanity first landed on the moon was lost due to the physical lifespan of the medium. This is a classic example of how the assumption that "digital is safe" leads to the loss of records.
You may have experienced a SaaS you were using suddenly ending its service, taking your records with it. Documents, data, and communication histories accumulated in the cloud—once the service ends, there are times when nothing remains after the data export period passes. The assumption that "it's safe because it's in the cloud" is also dangerous. You are, after all, entrusting your records to another company's service.
The obsolescence of formats is also a risk that is often overlooked. Files from software widely used in the 1980s cannot be opened on modern computers. The record exists, but it cannot be read. This is different from physical disappearance, but the result is no different from a "lost record." Keeping records in highly versatile formats (text files, CSV, PDF, etc.) is an important design decision from the perspective of long-term preservation.
The permanence of records must be designed not only with the perspective of "can be read today" but also "can be read 10 years from now." And a "record that exists in only one place" is only a hair's breadth away from being lost.
Records are intentionally erased
However, the disappearance of records is not caused only by accidents. Looking back at history, records have been repeatedly and intentionally erased.
In 213 BC, Qin Shi Huang ordered the "burning of books and burying of scholars." He burned Confucian texts and buried scholars alive. By physically erasing the records of thought, he sought to control the interpretation of history. This is one of the earliest instances of organized destruction of records in human history. Rulers feared records. If records exist, past facts can be referenced. Without records, history is rewritten by the memories of those who tell it.
In 1933, Nazi Germany publicly burned books in squares. Books by Jewish authors, communists, and authors inconvenient to the regime were burned. By showing the destruction of records in front of the public, it was an act of declaring "what is the correct memory." The flames burned the books, but at the same time, they sought to engrave into society a "fear of possessing records."
Stalin chose a more subtle method. He erased purged individuals from official photographs. Instead of destroying records, he falsified history itself by rewriting them. Human memory fades over time and is dragged along by "official records"—power calculated that weakness. If a falsified photograph spreads as the "authentic record," eventually no one will be able to remember the "original photograph."
Here, we can see the essential meaning of records.
Power has always feared records. Memory fades over time and can be manipulated. But records remain and argue back. That is why they have been erased. The very existence of a record means it possesses a counter-power against authority. Court evidence, historical testimony, scientific refutation—records can become a fortress that protects the truth even when memories are distorted.
As I wrote in Chapter 1, human memory is rewritten little by little each time it is recalled. Memory is weak against the pressure to make inconvenient facts 'never have happened.' However, records do not change so easily. That is why the very existence of a record can be inconvenient for those in power.
Even in the modern era, this problem continues in different forms. Digital tampering has become far easier than Stalin's photo retouching. Fake news and deepfakes create massive amounts of things that look like records but are not. The question of 'what is a reliable record' is becoming increasingly important in the digital age.
There is a fact that becomes clear from this history. The force that tries to destroy records has existed in every era. But at the same time, the force that tries to protect records has also continued without interruption. Monks protected manuscripts, librarians carried books out of war zones, and modern archivists continue to digitize degraded magnetic tapes. The act of protecting records is also an expression of the human will to connect memory to the future.
The fact that academic papers are assigned DOIs, patents have registration numbers, and blockchain technology is attracting attention as a mechanism for tamper-proof records is a manifestation of humanity's continuous effort to guarantee the reliability of records. Stalin was able to tamper with photos because he monopolized access to the original records. The more records are distributed and made referenceable in multiple locations, the harder it becomes for a single entity to tamper with them. Redundancy in records is a measure against both disappearance and tampering.
Records leak
Conversely to disappearing, records also carry the risk of 'leaking'.
Confidential organizational information, customer data, unpublished research results, inventions before patent applications—there are those with whom these should be shared and those with whom they should not. As records become more organized, the design of access must also be questioned.
In the field of research and development, this problem exists on a daily basis. Experimental data that must not be known to competitors, details of inventions that must not be disclosed before patent applications, information that can be shown to joint research partners but should be kept private from the general public—the design of who to share records with and who to protect them from is directly linked to protecting intellectual property.
The value of information sometimes depends on its scarcity. While there are records whose value increases by being disclosed to the world (academic papers, patents), there are also records whose value is maintained by being known only to a limited number of people (unpublished research results, trade secrets). Even if they are the same 'records,' their nature changes fundamentally depending on the scope of sharing.
In recent years, particular attention must be paid to sending data to generative AI. Pasting documents containing confidential business information into external generative AI services for processing carries the risk of unintentionally sending information outside. If the content entered into the AI as a prompt can be used as training data for the service, it can amount to an information leak.
As touched upon in Chapter 5, utilizing RAG (Retrieval-Augmented Generation) to have AI reference organizational records has great potential. However, at that time, the design of which data to let the AI read and which data not to let it read is essential. AI is a convenient librarian, but it has no sense of keeping secrets. Allowing AI unlimited access to records containing confidential information carries the risk of leaking them externally.
As a response to this problem, the operation of AI models on-premises (within the company) and the use of private cloud environments are attracting attention. Cloud services like Azure offer options to operate LLMs in an isolated environment dedicated to the company, making it possible to design a system that receives the benefits of AI without sending data externally. Utilizing AI while simultaneously establishing access control design—this balance is required in modern record management.
Generative AI is a very convenient tool, but the AI itself cannot distinguish between 'reliable records' and 'records that must not be leaked.' That judgment must be designed by humans. Which data to let the AI read and which not to—this is a security issue and, at the same time, a problem of 'wisdom' in the DIKW hierarchy seen in Chapter 3. The judgment to master technology is also required in the design of records.
In terms of a library, this corresponds to the distinction between a reading room that anyone can enter and a stack room that only authorized personnel can enter. Not all records are disclosed at the same level. The design of how far to open and where to protect guards the safety of records.
What I have felt as a researcher
There is an event that made me realize how close and how serious the 'risk of records leaking' is.
When developing a new business, we sometimes provide evaluation samples to joint development partners or companies that are potential future customers. It is a very natural business act of saying, 'Please try our material.' Whether free or paid, providing samples is a common occurrence.
However, there is a pitfall here that is easy to overlook. The moment that sample leaves the company, the 'novelty' of the patent may be lost.
A patent is a right granted to an invention that is disclosed to the world for the first time. Handing a sample to another company is equivalent to disclosing the content of the invention. If you provide a sample before filing for a patent, you run the risk that the patent will not be registered because it is considered 'already publicly known.' No matter how innovative a material you develop, if it gets out before it is fixed as a record called a patent, it will not become your company's exclusive strength.
However, writing a patent is not something that can be done overnight. Accurately verbalizing the content of the invention, designing the scope of the claims, and explaining the differences from prior art—this is a task that takes even skilled engineers weeks to months. On the other hand, if the provision of samples is delayed, you might be beaten to the punch by competitors. The pressure from the business side to 'get it out quickly' and the constraints from the intellectual property side to 'not yet' are constantly in conflict.
In the midst of this, a request to send a sample arrived from a promising client company to a young employee.
The employee did not have any malicious intent. They were trying to respond sincerely to the customer's request. However, they did not fully understand the legal implications of providing a sample before a patent application. Just as they were packing the sample into a box and about to arrange for courier delivery, their supervisor happened to notice.
It was a close call.
If they had sent it as it was, the patent might not have been registered. The technology that the company had spent years developing might have become something that competitors could also use freely. Before it was protected as a record (a patent), the information had leaked.
What this incident shows is that the 'risk of leaking' a record does not necessarily stem from malice. It happened because of a lack of knowledge. The wisdom that 'you must not send a sample before a patent application' was not in that employee's memory. And that wisdom was not recorded anywhere.
The problem of tacit knowledge, which I wrote about in Chapter 5, rears its head here as well. The knowledge of the 'relationship between patents and novelty' exists in the minds of experienced researchers and intellectual property staff. However, it had not been passed on to the young employee. This is not anyone's negligence, but a problem of the organization lacking a design that says, 'This knowledge must be shared as explicit knowledge.'
In order to protect records, the knowledge itself of 'what must be protected' must also be kept as a record.
How to think about a design for protection
The problems we have looked at so far can be organized into 'the risk of disappearing' and 'the risk of leaking.' And for each, there is a corresponding design.
We prepare for the risk of disappearing with redundancy and diversification. Important data should be saved in multiple locations. Between cloud and local, between different services, and in different physical locations—not concentrating records in one place but distributing them is the wisdom of humanity learned from the lessons of the Library of Alexandria. A 'record that exists only here' is only a hair's breadth away from being lost.
We prepare for the risk of leaking with access control and classification. Instead of giving all records the same access rights, limit who can access them according to the confidentiality of the information. Databases like PostgreSQL have mechanisms for permission management. GitHub also allows you to choose between private and public repositories. Notion and SharePoint also allow you to set access rights for each page. Designing 'who to show it to' at the same time as creating a record protects the security of the information.
What is important is that the risk of disappearing and the risk of leaking are often in a trade-off relationship. The more you distribute records across locations, the lower the risk of disappearing, but the higher the risk of leaking. If you keep records completely secret, the risk of leaking is zero, but the number of people who can access them is limited, and their function as a record is lost. The design judgment of where to place this balance is the core of designing for the protection of records.
In Chapter 2, I listed 'remaining, searchable, and unchanging' as the three conditions for a library. After reading this chapter, a fourth condition is added: 'protected.'
Remaining. Searchable. Unchanging. Protected.
Only when these four are present does a record truly function. Creating a record and protecting a record are inseparable design problems.
Libraries have been implementing these four over many years. Books are stored in multiple locations (remaining), searchable via catalogs (searchable), contents are not overwritten (unchanging), and valuable materials are kept in locked stacks (protected). When we work on organizational records, we are trying to implement this design philosophy, which libraries have polished over hundreds of years, using digital tools.
Protecting records is protecting memory
Having read this far, there is something you notice.
The risks of records disappearing and records leaking are both connected to the fundamental problem of the 'limitations of human memory'.
Human memory fades over time. That is why records are necessary. However, records also carry the risk of physical disappearance. That is why copying and redundancy are necessary. Records can be tampered with. That is why reliability design is necessary. Records can leak. That is why access control is necessary.
Every time one problem is solved, the next question arises. This is because the act of recording is fundamentally an attempt to continuously confront human imperfection. We record because memory wavers. We copy because records disappear. We control because copies leak—this chain is the very history of the human will to protect knowledge.
And as we saw in Chapter 2, humanity has spent 5,000 years refining this chain. From cuneiform clay tablets to monastic manuscripts, letterpress printing, libraries, digital databases, and cloud services—the tools have changed, but the human will to 'protect records' has not.
From this perspective, the design of records is not just a matter of operational efficiency, but can be seen as part of a larger endeavor to pass knowledge on to the future. When we standardize Excel naming conventions in the workplace or set access permissions for a database, those actions are on the extension of 5,000 years of recording history.
To remain. To be searchable. To be immutable. To be protected. Records that satisfy these four conditions transcend the limits of individual memory, transcend time, and continue to live on as the assets of an organization or society. Protecting records is protecting memory. And protecting memory is deeply connected to humans continuing to be human.
To the next chapter
We have considered the risks of record loss and leakage. However, through the discussion so far, another question emerges.
When records are protected and accumulated within an organization, who is it that masters them? And how is AI attempting to answer that question?
In the next chapter, we will consider generative AI, which is attempting to act as a bridge between memory and records, from the perspective of a researcher.
Continue here👇
Read from the beginning👇
#CreativeAwards2026 #BusinessCategory