So I was reading about security clearances and...well...I couldn't help but wonder how classified information was handled and passed around before intelligence agencies implemented computers and started storing information in magnetic tapes/hard drives.
Nowadays you have different auth schemes (RBAC, APAC, etc) and you need an admin to put your user into a specific group in order to have permissions to do certain actions, there are logs and you can be notified if someone opened a file.
But, say, its 1952. I am an American intelligence analyst and I just finished writing a report on Soviet nuclear capabilities.
-Who is in charge of classifying this information? Wouldn't this person be a potential source for leaks?
-After classifying this info...who is responsible for handling the papers and storing them?
-If someone wants to access this information, how do they do it? They need to walk up to the front desk, show credentials and they are given the info?
-How does the person giving the info know that my creds are legit? Do they call someone?
-After giving the information...the fact that information was handed out, is recorded somewhere?
Then, as now, if you work for an agency that deals with classified information, there will be an Original Classifier from whom classification authority is derived. In practice, you would probably have some derivative authority, and be able to say, "this memo is classified 'secret'" or somesuch. Part of your training in being in your position would be in learning what levels of classification were appropriate, and if there were questions you would submit them to a classification officer who handled such questions for a living.
Everyone in a classified agency is a potential source for leaks. This is why the criteria for getting a clearance in the first place was meant to be very stringent. Then (as now) you would expect anyone in such a position to have an extensive background check (often by the FBI, but there were other agencies that did this, sometimes), and such people would in principle be under scrutiny for their entire lives.
Each agency had different procedures for how you would register a report, but the basic approach was that you had a part of the agency that was responsible for keeping track of reports, and they would assign it a number. You would probably, after authorizing the report, indicate its circulation status (e.g., many classified reports have a list at the end of different agencies or people who got a copy, and how many copies were made). There would usually be one or two copies that ended up in a classified reference library used by the agency, from which other people could request them.
The "credentials" in this case would be a security clearance, which would be made out of difficult-to-forge material, include a photograph of you, and have a cross referenced number that they could check against a master list of clearances. Frequently you required a "need to know" as well — someone more superior than you would need to vouch that you actually needed to see said report.
Any secret reports would definitely be logged. So if you saw a report, there would be a record of it. This would be used, of course, if a copy of that report ended up in enemy hands — you'd back track and figure out who had access to it.
All of this was done on paper, and cross-checking could be done with telegrams and telephones. It was not a fast system, and there were many complaints about how slow it could be to go through all of these things. It also put a heavy responsibility on the people who were in charge of collecting and distributing the reports.
The above is a generalization and exact procedures varied both by agency and over time. The best overall account of classification regulations and procedures is Arvin Quist, "Security Classification of Information" (2002), and it describes the legal, regulatory, and political structures that led to the modern classification system.