Be the Serpent-Part 2

It was 2:00 by the time I was actually seated at a desk and staring at a computer. The morning had been filled with paperwork and briefings by Human Resources. I had forms for filling out 401k deductions, health insurance, and membership in the Puget Sound Health Club. I’d received my security badge/keycard and as soon as I arrived back at Darlene’s desk she made a quick tour of the office and gathered together the other members of Arnold’s “team” to head out for lunch. Wild Ginger has great food, but it’s never a quick lunch, especially when trying to meet and memorize the faces of half a dozen new people.

I paid close attention. These were the players. I’d met Don Abrams earlier in the day and he assured me there would be a computer waiting on my desk as soon as I finished with HR. He was Director of Network Security and apparently Arnold’s go-to man. Allen Yarborough sat across from me at lunch and asked a ton of questions that probed my knowledge of system administration. That figured since he was the Systems Admin Manager. It turned out that he was the one directly responsible for issuing my laptop and having me registered on the network. What became obvious after just a few minutes, though, was that whatever interview process I avoided with Arnold, I was being subjected to over lunch. When Allen had finished hammering me about systems admin, Phil Jackson, Manager of Fraud Detection, took over. His questions focused on my knowledge of attacks that were specific to credit fraud. As it turned out, my work on the Henderson case came in handy. Part of what brought the company down was the default on a sizable loan they’d received from a private lending company. If the loan had been through a mainline bank, there would have been a long waiting period while the wheels of justice spun up. Since the lending company was privately held, the default action went from zero to sixty in no time flat. It didn’t give the execs enough time to hide their tracks before the police had been called in.

Ford McCall took over the questioning at that point. Ford was a low-level employee compared to the managers at the table. I was still curious as to how this so-called team was put together. They didn’t seem to have a common manager below Arnold himself. They were at a number of different hierarchical levels. Ford was a researcher. His level of interpersonal skills had probably kept him from being on a management track, but it turned out that he knew something about just about every development in technology that had taken place in the past twenty years. His questions were random, sometimes asking about the credit industry and sometimes about programming in C#. He asked questions about the breakability of different operating systems and went so far as to ask me point-blank if I’d ever hacked a UNIX system. I was going to be watching this guy like a hawk.

That left the two women at the table, the Admin, Darlene Alexander, and Jen Roberts. Jen didn’t give her title when she introduced herself and no one seemed inclined to fill in the blank. She asked if I was familiar with matrix management techniques. Things started to click. Most companies have a purely hierarchical structure. If you are an engineer, you work for an engineering manager who works for an engineering director who works for an engineering vice president. You know exactly how many levels separate you from the president of the company. In matrix systems, there may be a hierarchical structure on the boards, but teams are organized according to projects and the individuals on the team might be from several different departments. It turned out that Central Card Services was a hybrid system, but that most of the high level work was done by matrix teams who reported to a team manager and had little to do with the hierarchical structure. In fact, some team members had titles of “Director” but had no direct reports. It was far more typical of the financial industry in which directors and vice presidents were given their titles to show status and not responsibility. It had to do with their decision-making authority, not with their management chain. Jen Roberts was our team lead.

And that brought me back to Darlene. The rest of the team jumped up from the table before the check arrived, scurrying off to various meetings, appointments, and tasks. Darlene motioned for me to stay while she took care of the check with a Platinum credit card.

“So, what do you think of your team, Mr. Hamar?” she asked as we left the restaurant.

“Do you prefer to be called Ms. Alexander?” I asked.

“Oh no. Darlene is just fine.”

“Then please call me Dag.”

“Okay Dag. But the question still stands.”

“My team. Exactly what is my roll on this team? It’s not something that Arnold mentioned to me,” I said. In fact, I was beginning to wonder how I was going to carry out a covert mission in this company if I was going to be assigned a bunch of random investigations on the part of the team. I’d imagined that I would work in relative isolation.

“You will be assigned a long-term project on behalf of Mr. Dennis. The results of your research will be delivered to your teammates in regular weekly reports. You will show progress for however long it takes to accomplish the real task that he has assigned you.” She paused and looked at me expectantly, but I decided to do no more than nod. I didn’t know yet how much she actually knew about my mission. Arnold had led me to believe that no one knew the real reason I was brought on, and certainly the lunch conversations seemed to confirm that. Seeing that I wasn’t going to provide any input at this stage, Darlene sighed.

“Well, I should have expected that,” she said. “I won’t press you for details. I’ve had stranger job requests. Here’s how it’s going to work. My job is to make sure that there is nothing standing in the way of Mr. Dennis doing his job. That means that it is also making sure there is nothing impeding your progress. I know only that your real job has nothing to do with the position on our team that you’ve been introduced to. Every morning I’ll give you a brief email synopsis of what your ‘research’ is revealing. That way if you encounter any of your teammates, you’ll have something to say when they ask you questions. Each Thursday night I’ll provide you with a short paper discussing the progress. You’ll study it that night and be able to talk intelligently about it during your Friday morning team meeting and one-on-one with Jen. Your project is ostensibly Internet Security Protocols, which I take it you are reasonably well-versed in anyway, so you should be able to fill in at least a few of the blanks. Just watch out for Ford. Somehow that guy knows everything that has ever been published on every subject. I think his brain is wired to the Internet.”

“So what you are saying is that you are going to be doing my official job while I’m doing my real job?” I asked. She nodded. “Isn’t that a little beyond what an Admin would normally be uh…”

“Qualified to do?” she asked, raising an eyebrow. I hadn’t wanted to go there, but yeah. How exposed was I going to be if an office administrator was supplying all the research that I was supposed to be doing because of my high level of expertise? “Mr. Dennis and I have worked together for 20 years. I was a co-worker when we were first hired, but as he rose in the company, I hitched my wagon to his star. I became his administrator as soon as he reached a level that allowed him to have one. He’s been talking about hiring a technical assistant for the past three months. No matter what it might look like on the outside, the job you are filling had to be defined, vetted, a position number assigned through HR, a job description agreed upon by the executives, and budget approved for hiring. Everyone knew he had someone in mind for the position before he announced plans to hire.” That was news to me. I’d only known about this for three days. Arnold Dennis was rising on my list of suspects again. If he was devious enough to plan three months ahead of time, then he would have had plenty of time to hide his tracks, or even point evidence at someone else in the company.

“During that time, he’s also been researching the latest in Internet Security Protocols and supplying me with an unending list of resources and papers. He asked me to keep quiet about all that until he’d hired his Tech Assistant, but to make sure I was familiar with the process he was going through. So, as I supply you with data, I’ll be cross-checking it against any new developments over the past three months, but all the heavy lifting has already been done.” Darlene paused and we walked the rest of the block in silence. Before we entered the building, though, she stopped me.

“Something has been bugging Arnie for the past six months or more,” she said. It was the first time I’d heard her use his first name. She looked at me with an intensity that I found unsettling. “Whatever you are here to do, it’s supposed to put his mind at ease. I will do everything in my power to make you successful at that. Don’t you dare let him—or me—down.”

***

Twice today, I’d been admonished to not let someone down. I’d seldom seen such intense devotion to an employer and I wondered if there was more to their relationship than met the eye. It would bear investigation. But more, I’d realized that people here were really into other people’s business. Every person I’d met today could potentially be the person “keeping an eye on me,” and most of them had the ability to use techniques that would be hard to spot. Whatever I did, someone would be watching me, just as I was watching them.

Darlene showed me to my desk. I was surprised to find that I had a small, but comfortable window office just down the hall from Darlene and Arnold. That made sense, I supposed. I was his direct report, even if my “team” functioned in a matrix. What really surprised me was that my name and title were already on a placard on the door. On the desk was a large laptop computer docked to an even larger flat-screen monitor. A sheet of instructions for initial registration on the network was next to the computer. The rest of the room was sparsely furnished. One desk. One desk chair. One guest chair. One credenza. One lamp. The view out my window was not of the Sound, though if I looked as far left as I could out of it, I could get a glimpse between the buildings. Directly out the window, across the street was another tall office building and I could faintly see movement behind some of the windows.

It wasn’t an executive desk. Like most tech companies, Central issued the exact same basic furnishings for every office and every cubicle. It was a flat surface with metal legs and a wrench that would adjust the height by cranking a bolt in a hole on the top. The desk faced the window so my back would be to the door when I sat at it. That was the first thing that would change. I swung the desk around perpendicular to the window with my back to the wall. The window was on my right and the door on my left. I could see both. I pushed the credenza against the other wall and pulled the guest chair around to the end of my desk so visitors would sit beside me with their back to the door.

In the process of moving the furniture, I surreptitiously checked under the surface of the desk for any listening devices or electronics that might go unnoticed. That’s a nice thing about this kind of furniture—there’s really no place to hide anything unless they hollowed out the desktop and inserted something. I tapped on the solid surface just to make sure.

Satisfied that the furniture was secure, I turned to the computer itself. I suppose I was being paranoid, but after my lunch and briefing with Darlene, I was inclined to distrust everyone. I turned the device over and examined it closely, from the RFID asset tag on the back to the stickiness of the keys. Without actually starting the computer, I opened it and began typing on the keyboard. For the most part, I was simply testing the touch of the keys to see if there was any oddity that would indicate the keyboard had been tampered with. But I started with entering my alias and a fake password. Then after a moment, I typed Darlene’s alias and then a brief note: “Thank you for lunch today and for introducing me to the rest of the team. I’ve got my team meeting and one-on-one with Jen on my calendar. Could you set up a weekly one-on-one with Arnold for me? I’ll keep my schedule clear, but will not be in the office on Wednesdays. Please let me know what would be convenient.” I figured that would be an adequate amount to be picked up if there was a sensing device attached to the keyboard of my computer. I still wasn’t ready to turn it on, though. I popped the battery out of the computer and examined it and the channel it fit in. Then, I pulled my toolkit out of my briefcase and unscrewed the memory slot. The computer was well-equipped with RAM, but that’s where I found the bug.

It was tiny. Whoever had planted it knew a lot about electronics and cutting edge tech. I suspected this baby might even be black market. The device was just below the keyboard and could record and transmit every keystroke. I wasn’t sure if the bug would record the message I’d just pretended to send or if it would require the electronics of the keyboard to be turned on. I guessed the latter.

Most people don’t realize that keyboards are tiny computers themselves. They have their own processors separate from the computer CPU. That’s what makes a keyboard programmable for different languages. But more importantly it confirmed my suspicion that someone was watching me through electronic surveillance. All someone needed was a computer set up to receive my keystrokes and they would be able to see on screen everything I typed.

By the time I’d finished my physical examination of my office and computer, it was nearly 5:00. I suspected that this group would be looser about the hours they kept, but we were in the financial industry and experience told me that most of the office would close up and go home before 6:00 at the latest. Someplace in the building there would be people just arriving who were in synch with the Japanese markets. I was pretty sure a contingent was leaving about the time we got back from lunch, indicating a shift that was synchronized with New York. And then there was the 24-hour customer service and security teams. Tomorrow I’d do a floor by floor tour of the entire building. But I was about ready to call it quits for today.

“Dag? Excuse me, but I couldn’t help but notice you haven’t logged into the network yet. Is there a problem with your computer?” Allen Yarborough was poking his head through my doorway. As Systems Admin Manager, he would have access to knowing who had logged into the network. That made sense. But that he’d been watching for me to log in gave me the creeps.

“No problem, Allen. HR just gave me a ton of paper to go over after orientation this morning. You know, benefit elections, policies and procedures, all that. I just never got around to logging in.”

“Well, it’s almost quitting time for today. Let’s get you logged in so I know everything works, then go have a beer.” I’ll bet he wanted to know everything works. Okay, I could play this game. I powered up the computer and it came immediately to the log-in screen. “It goes more quickly if you use your smartcard the first time you log in. You’ve already set a password when you got your ID,” Allen said helpfully. I slotted my ID card into the reader on the computer. It identified my user name and I typed in the password. The screen went directly to the official SCC desktop and I was on the network. I smiled at Allen.

“Seems like everything works,” I said. “Network connection is fine and I’ve been recognized.”

“Great. The first time you open email, it will install and record your settings. Takes about five minutes to get the test message sent through. By this time you probably already have a day’s worth of email backlog, so you’ll have your work cut out for you tomorrow. Now let’s go get that beer.”

“Oh. Hey, sorry about that. I can’t make it tonight. I’ve got an appointment at 6:00 to see a dog I’m thinking of adopting. Let’s make it another evening. Anytime but Wednesday or Friday.”

“No problem! I’ll see if there’s some other guys I can introduce you to. Maybe Thursday. What kind of dog?”

“A, uh… greyhound. Rescue, you know?”

“Oh yeah. I’ve heard about that. Let me know how it goes.” He left, looking for all the world like he was just a helpful teammate. Hmmm. New candidate at the top of my list.

As soon as he was out of sight, I used my mouse to navigate to the change password settings. I had a random character generator app on my cell phone. I generated 12 characters and wrote them on a piece of paper. I don’t use passwords that are related to any personal information. By morning, the slip of paper would be burned and I’d have memorized a new password that was virtually unbreakable. I called up a virtual keyboard on screen and used the mouse to click on each character. My physical keyboard was bugged, but it was a lot harder to track mouse clicks.

When I was satisfied that I had thwarted any attempts to capture my log-in information, I sat back in my chair to contemplate my first day at work. I had a whole list of suspects, and I had a feeling Arnold had put this team together specifically for me to watch. It probably included his entire list of suspects and whoever was assigned to keep an eye on me. I decided to leave the keyboard bug in place in the computer and to bring a detachable keyboard into the office with me tomorrow. I’d just let my spy stare at a blank screen for a day and see what came about. While I was contemplating this, my screen went dark and then switched to screen-saver mode. Didn’t take long—less than five minutes. One of the company policies that had been driven into my head during orientation this morning was the importance of not leaving your desk with an active screen. The screen saver, however, surprised me.

In place of my desktop, I saw a video feed. Of me. Sitting at my desk. Right now. I didn’t immediately swivel around. I could see the direction of where the camera was located as it was shooting straight through the glass door and window of my office. What I was looking at was a live feed from a security camera in the hallway just outside. After about 20 seconds, the camera panned to the right 30 degrees and held that position. Then right another 30 degrees so I was looking across the cubicles across the hall.

If I had left my desk in the position it was in when I arrived, whoever monitored that camera could have seen everything that appeared on my screen. Someone was serious about watching.

But why show me the video?