All Our Service

All our service
In every point twice done and then done double
Were poor and single business to contend.
—Macbeth I.vi

Being a hacker, I’ve always had an impulse to hide my identity. As a result, I’ve never put my real name on the Internet. I’ve never put my own photo on a social site. I’ve never indicated in my profile where I live, how old I am, or even my sex. I have very few “friends” online and they mostly know me by one of my aliases and not by name.

Amazingly, I’m still pretty active and think of myself as even a little vulnerable on-line. I have a dozen email addresses, carefully concealed behind various identities. My passwords for those accounts are randomly generated and changed every 30 days. I create temporary email addresses through anonymous host sites and then create permanent addresses using the temporary one as a reference. Then I delete the temporary account. My security software is the best I can find, but because I’ve cracked it myself, I place little trust in its ability to keep my systems safe.

I don’t use WiFi in my office or my home. I use a cellular modem to connect my computers through encrypted packet data on a virtual private network. That makes my activities almost undetectable as my IP address changes with every location from which I connect.

It also makes everything damn inconvenient.

I am a digital fortress, and even I am afraid of being spied upon. It really irritated me that in my first day at CCS, I’d found two devices set to spy on me as I worked. And the thing is I figured there would be more.

I hadn’t opened email after logging in yesterday. I’d simply stared at the computer screen watching the security camera outside my office continue its 360 degree pan every four minutes. Who monitored that camera? After I shut down the laptop and removed my smartcard, I picked up my briefcase and wandered aimlessly down the corridor. All through the office I could see monitors on people’s desktops displaying images from security cameras. Occasionally I would see myself on a screen as I walked by, but the cameras were apparently located all through the building. That amount of visual data would take truckloads of digital space to store, even after high compression. But I had to admit, the simple reminder that I was being watched at all times had a Big Brother effect on my willingness to commit any grave sin in the office. It probably had the same effect on every other employee.

I left the building and wasn’t sure that I ever wanted to go back.

The keyboard was tapped. The camera was watching. What other types of surveillance were in place? I had to bet that the laptop I was assigned had monitoring software installed on it—very likely in places that I couldn’t touch. So Tuesday morning when I went into the office at 8:30, I swiped my ID against the reader and went straight to my desk. I attached a foldable keyboard to the laptop, and did a network boot, avoiding accessing the hard drive at all. As soon as I reached the “repair” screen, I slotted in my smartcard and gave the commands to format the hard drive and reinstall the operating system and standard company issued software. That should take care of any malicious software on the computer. The fact that I’d never know what was there was irritating, but not worth bothering over if I wanted to start exploring the company networks.

After the disk was formatted and the system was up and operating again, I’d have to figure out how to put my own protection on the computer. I was pretty sure the network security protocols would prevent me from installing any software that wasn’t on the official list—that was typical of both financial and government offices—but I was pretty sure I could find an unprotected network computer where I could install and run it remotely. If not, I had a way of running the programs remotely that I’d use, though I’d rather have it right here.

While the system was installing, I tapped into my own VPN on my cell phone and started a series of probes at the company’s firewalls from outside. If there someone was getting through from outside, then the card fraud they were worried about might not be employee-based at all.

I timed the rotation of the camera outside my office and while it was turned away, I used a small bug detector to sweep the rest of my office. There were two—a listening device in the lamp and a bug on the phone. Those, I simply wouldn’t tolerate. I removed them and went out of my office to the restrooms and flushed the two devices down the toilet. With luck, no one would have been listening that early in the morning and they’d just hear silence from that point on. But I didn’t care. They would all know by now that I’d detected the devices and cleaned house. And good luck to them trying to break my password to reinstall. I’d memorized the sequence last night and burned the reminder. For me, memorizing sequences of numbers and letters has never been a problem. Forgetting them after I discarded them wasn’t a problem either.

I wasn’t surprised to find that when the screen-saver kicked in on the computer, I was once again viewing a security camera, but it wasn’t the same one. I’d read my company handbook the night before and discovered that CCS had decided on mass monitoring of security cameras and cameras were assigned randomly to computer monitors each time the screen-saver kicked in. I was willing to bet, though, that the camera monitored on my screen the previous day had not been chosen randomly. Someone was making sure I knew I was monitored. The question was whether it was a friend or foe. After all, Arnold had told me when he hired me that I’d be watched. Throwing me the camera might simply have been a way of driving the point home.

I wasn’t about to let it slow me down, though. They’d as much as challenged me to show I was smarter than they were. I was going to do it.

I opened my email and scanned through the messages that came through yesterday and early today. If this was any indication, It was a wonder anyone got any actual work done with the number of messages they got a day. I put a miniature drive in an open slot on the computer and moved my mailbox to it. I planned to keep nothing on this drive at all. When I turned it back into them after I was done here, the computer would look like it had been unused.

It was time to start earning my keep.

***

It was a new city and the streets were unfamiliar to me. Usually when I tracked someone, I knew the streets and I could eliminate the background noise. Here, everyone I saw looked like a suspect, and everyone I couldn’t see looked like a threat.

I could randomly pick doors and walk in hoping to find something interesting, but I was pretty sure some of the doors I could see had security systems that would sound alarms all over if I just busted in. And even then, there was nothing saying that would be the door that led to a perp. What I was going to have to do was start learning how this city was organized. Where did people live and where did they play? And most importantly, where did they keep their treasures? If I was going to catch a thief, I needed to know where there was something worth stealing.

Every bit of information on the Internet—every file on a company server—has value. The problem is making it transactable. If I buy artwork for my home for $1,000, one day it might be worth $10,000, but only if I can find a buyer who will pay that much. The same thing is true of information. It is worth what a buyer will pay for it. So, in looking for something to steal, the first place to look is not at what people are guarding most heavily, but at what people are most willing to buy.

I headed for the marketplace.

It was more like a medieval village than a shopping mall. Random booths were set up throughout the square offering goods for sale. Auction blocks competed for attention as everything from slaves to weapons, to artwork was offered to the highest bidder. Hawkers barked out their spiel for the benefits of their products. Crowds pushed and shoved, individuals clambering for attention. But these were the sellers. The buyers stood around the perimeter, usually silent. Occasionally one would step up to buy, often haggling over the price. These were bargain-hunters. I wasn’t interested. Demand drove prices up. If the price was going down, it wasn’t worth stealing.

In the side-streets off the market I found people asking for goods and services. They weren’t there to bicker about a price. What they wanted had value to them. It was worth going after. These were the people who could inspire theft.

I wasn’t there to engage, but lurked in the shadows watching transactions and proposals taking place. Nonetheless, a shadowy figure attached itself to me and spoke quietly.

“Buying or selling?”

“Depends,” I answered. “What do you need?”

“Bank accounts would be nice.”

“Wouldn’t they though?”

“You don’t have any to sell? Go away.”

“I didn’t come to you. You came to me.”

“Go away.”

I decided it was in my best interest to go away. I left the alley and circled around to it by a different direction. I could feel the presence nearby, though it didn’t approach. I moved out again and came back a different way. It was definite. I was being watched.

***

I escaped and dropped into the real world a moment before a tousled redhead with black rimmed glasses poked through my doorway. Ford McCall was trying to get my attention. I waved him in.

“I like your furniture arrangement,” he started. “It’s good Feng Shui. These offices make it difficult to find a position where your back is neither to the door or the window. Nice solution.”

“Thanks. You a decorator?” I’d had nearly the same conversation with Eric after we’d painted my apartment black and he’d convinced me to go to IKEA for furniture. When there are windows or doors on three sides of a room, it gives few options for positioning yourself so that you don’t have your back to one or the other. But, I guess that would make Wild Bill Hickock a Feng Shui expert as legend said he never sat with his back to a door or window while playing poker.

“No. Just read a lot. Speaking of which, did you see the article in TechCrunch on the upcoming meeting of the standards committee for IPSec? You should put in for a field trip. Arnie’s serious about improving security all the way around, so I’m sure he’d fund the travel.” I could see that Darlene’s assessment of Ford’s connection to the Internet and reading every article on every subject was probably true. I’d have to be careful what subject I engaged him on as I was sure he probably knew more about anything than I did. Still, the fact that he was standing in my doorway as I was being followed through the company’s twisted intranet marketplace meant that it wasn’t him that was following me, didn’t it?

I thanked him and said I’d take a look at that and see what Jen thought before I approached Arnie about it.

“Yeah. Well, if you talk to her, put together a spreadsheet that shows how much the whole venture will cost, where you’ll stay, who you expect to talk to, and a list of objectives for the trip with a dollar value attached to each one. She may look like a woman, but she’s just a suit. If there isn’t a bottom line, there isn’t a reason.” There was a little bitterness showing through Ford’s comments, as if he’d tried to convince her of a venture with no success. “Oh, Allen says we’re going out for a beer Thursday night. I understand you aren’t in on Wednesdays, so I’ll see you then.”

With that the smartest and most socially inept man I’d ever met left the room. I glanced at my clock and was surprised to find it was already past 5:00. I’d been so absorbed in my exploration of the network that I hadn’t had lunch. My stomach was now starting to complain. I shut down my computer, unlocked the security cable that fastened it to my desk, and packed it in my briefcase.

I wouldn’t be in the office tomorrow, but I’d be doing a lot of work before I showed up here on Thursday morning.