Fiction: Shakedown

by Peter Wrenshall

I recently watched the video Freedom Downtime, and it reminded me of a hacker alert that I got involved in, or at least would have gotten involved in if the whole thing had not turned out to be hype.  In the end, I didn't get to see any black hat hackers, but I did get a lesson in how hysteria can be used to blind otherwise intelligent people to the truth.

I was working for an IT support firm, and one of their foreign clients, a French cosmetics company, was having network problems.  My manager wanted me to fly out to deal with it.  Most people would have probably jumped at the chance of a paid break in Paris, but I had been on company trips before, and was wary.  They were always hectic, last-minute arrangements.  The only sight-seeing you got to do was the inside of a server room, and the only advantage to having irate clients taking their frustrations out on you was that you learned to swear in a foreign language.

"Sorry," I said, "but I'm stuck on project work that I need to finish before my Christmas vacation."

"Everything else can wait," my manager said.  "This has the highest priority."

Nothing new there: company trips always had the highest priority.  You had to drop everything and go.  And when you came back, there would be half a dozen other managers asking you why their work was late.  I had to get out of going.

"Did you ask Bridget?  I bet she'd enjoy a trip to Paris."

"I need you on this one, because of your documentation skills."

"Seriously though, I've got customers screaming at me.  I need to get everything done before we close for the holidays."

"This is more important.  The client has already called in their lawyers, and now they're talking about bringing in the police."

I stopped aiming the desktop missile launcher at the target I had drawn on the white-board and sat up.

"Did you just say 'police'?"

"Yes."

"What's going on?"

"The client's lawyer has convinced them that they've got a hacker in their network."

I didn't quite laugh.  Though I have never done any hacking myself, it was a subject that interested me.  The image I was getting of some hacker bragging about breaking into a network to steal a chart detailing 256 different shades of lipstick was amusing.

"Why would someone want to hack into a cosmetics company?  I mean, do they have any evidence?"

"They've had a series of network issues..."

"We have network problems all the time."

"Not like this.  Someone is targeting executives."

I sat for a moment, trying to figure it out.  I couldn't get stuck on this job.  Apart from the traveling, it sounded like it had gone critical, and I didn't want to be around when it went into meltdown.

"Okay," I said, "but if the problem is not because of hardware, and the client does have a hacker in the network, then don't you need a security expert to look at it?"

"No.  All you'll need to do is to document the background - everything the help-desk and support people have done so far - and then hand it over.  The police will handle the rest.  The SA on this is Friday.  Can you do it?"

"The service agreement is probably workable, if all I have to do is a write-up.  It's the idea of going all the way to Paris at this time of year, just to work on a document that I could email to them."

My manager said nothing, and there was a silence while I tried once again to get my head around it all.  Anyway, I wasn't sure the client had been hacked.  My first guess was that one of our own people had messed up somewhere.  It had happened before.  I needed to figure out what had gone wrong and who had made it go wrong, and then everybody could stop panicking about phantom hackers.

"You know," I said, "there's another possibility here.  We could have goofed somewhere down the line, and what the client is seeing is a side effect.  It's going to be embarrassing if a month-long police investigation turns up a server with a glitch that someone should have spotted.  If you can stall them for a couple of days, that would give me time to remote in.  Maybe I could find the problem-"

"Sorry, that's not possible," my manager interrupted.  "I wish I could put it off, but it's urgent.  And, in fact, you might as well go home right now and start packing.  The client already has you on an early flight."

"Tomorrow?  Tuesday?"  I accidentally hit the mouse button, sending a sponge missile toward the white-board.  The missile missed the target, bounced off the wall, and dropped behind the cabinet.

"Yes.  The hand-over date is Friday."

I groaned.  I'd been with the company for sixteen months, and up to that point I had managed to maintain a blemish-free record.  But I could see what was going to happen.  I would be the engineer with his name at the top of the hand-over document, and the bottom of the help-desk fault list.  I was the last guy to touch it.  I was the reason it all went sour.  I would be the one to blame.

"Sorry," I said.  "It's too short notice.  I can't just drop everything and fly to France tomorrow."

But I could, and I did.

I was up at 4:00 the next day, and by 6:30 I was on a plane, dressed in my good suit and the duty-free tie that I bought on the previous trip.  When the pilot announced there was going to be a delay, I took out the help-desk logs, and began to read up about the saga.  And, to my surprise, things started to get interesting.

It had all started two months earlier, when a couple of executives had suddenly and mysteriously lost the documents they had been working on.  They reported the "crash" to the help-desk, who remoted in and ran a bunch of tests to see what was wrong.  The tests turned up nothing out of the ordinary, and the incident was eventually put down to a "cockpit error" (help-desk code for user stupidity).  But a few days later, the same thing happened to half a dozen other management stiffs, and that started phones ringing.  More tests and scans were run and, eventually, it got explained away as a network glitch.  But over the next two weeks there were two more incidents.  At that point, the client escalated the problem and we, the company, had to pay for a French consultant to go in and do his own tests.  And while he came up with nothing suspicious, except his invoice, it at least stopped the suits from barking.  And for a little while, everything was quiet.

Then one night, the CEO had been working late when she got hit by it.  The error messages told her the network connection had died, taking the "business critical" document she had been working on with it.

She tried a few remedial actions to rescue it, including screaming at the help-desk, and threatening the shift manager, but dead is dead.  The next day she called in the lawyers, who started using phrases like "breach of contract."  The company fired back, saying that neither they nor the French consultant had found any technical issues.  At that point, the lawyers started talking about network security and hackers: cosmetics companies came out with new formulas all the time, and some of them were worth millions.  We had, the sharks said, a duty of care for both the network and the commercial data on it.  They persuaded the CEO to call in the French equivalent of the Cyber Crime Division.

So, despite my initial cynicism, it looked like there was a hacker in the network after all.  Interesting.  My manager had asked me to write it up, but I had already decided to go one better: I would write it up for myself, putting it all into a book.  Years before, I had read a best seller, The Cuckoo's Egg, which was about a network break-in, and since then I'd been thinking about doing something similar.  Maybe, I thought, this corporate hack that I had stumbled onto was my material.  If I could get a publisher interested in it, I'd be switching to a new career.  Hackers were still very much in the public interest, and I knew there was good money to be made out of the talk-show circuit.  If I did things right, this could be my ticket out of computer support.

True, I only had a few days to get involved, but a quick trip to the server room to make a few unofficial "adjustments" would solve that problem.  Clients were always doing that: finding new problems, just as you were packing up, ready to get out the door.  So I knew how to invent work for myself.  And then, since I would be staying in Paris for an extra couple of weeks, there would no doubt be an opportunity for me to get unofficially involved.  I might even end up working with the cops, getting an "insider" view.  Fired up, I got out my laptop and started a journal, so I would have something to refer to when I got home and started writing my best seller.

I landed in Paris just as it was waking up, and by 9:12 I was sitting in the reception area of the client's office, waiting.  On the wall was a photo of a French actress I had seen in a movie a few months before.  She was modeling the company's new eyeliner, and I noticed the tagline was in English, though I had seen the same ad back home, but in French.  A few minutes later, I was met by the head of security.  He was stocky with a shaved head, and, in shaky English, he thanked me for coming and said that the CEO wanted to see me.  On the way up to the top floor, he told me how "urgently important" it was for the company to get this problem dealt with as soon as possible.  Everything had been locked down for days.  The help-desk was getting endless complaints.

We walked and talked until we got to the executive area, a place where every stuffed suit had their own office, and every office had its own unique personality.  Here was the top of the fashion world, where visionaries dared to dream of a redder lipstick, and marketers dared to dream of agency kickbacks from the supermodels who would get paid millions to be seen wearing it.  The CEO was a tall, neatly dressed woman in her forties who said that she was happy to see me, though obviously not happy enough to smile.  She asked me if I wanted a drink, I said yes, and then she surprised me by saying, "I am told you are the top guy in the computer department."

For a moment, I thought that something must have gotten lost in the translation.  Then I realized that my boss had obviously talked me up, to try to calm her.  I nodded, noncommittally.  Besides, it wasn't that far off the mark.  In the previous six months, I had not missed a single project deadline or failed a help-desk SA.  The other staff thought this was hilarious and assumed that I was some fanatic, and they had nicknamed me "100%."  Nothing gets office clerks talking more than the presence of someone who is working his way to the top, rather than playing the game.  But I still had memories of pedaling to work in the rain to keep me overachieving.

We all got drinks, and then we sat and chatted.  As expected, they unburdened themselves of their frustrations, telling me about how they felt let down, and all the rest of it.  The security guy fired questions at me, which I fielded, and then the CEO took her turn.  They wanted reassurance from me, and I said that they would have their hand-over document by Thursday afternoon, or Friday morning at the latest, and that seemed to satisfy them.

And yet, as I sat there chatting professionally and sipping café au lait that tasted far too good to be decaf, some alarm bell was sounding far off in the back of my mind.  Something about what they were telling me didn't quite fit, and my initial doubts about them having a hacker returned.  To try to work it out in my own mind, I told the CEO and the security guy about my reservations.  I went into an explanation of the difference between an organized criminal who was in it for the money and a computer hacker who was in it for the technology.  But they weren't interested in theories or subtleties.  This was France, they said, and when the person was caught, organized or not, he would be sentenced to hard labor.

"There is a lot at stake here.  We are counting on you," the CEO said, as we stood and shook hands.  Then the security guy handed me a pass, and took me down to the IT support room in the basement.  He sat me in front of someone's desk, and then he went away, obviously happy to leave me to it.  The local skeleton crew IT staff said bonjour, and then both of them withdrew to the other side of the room.  I emailed my manager to let him know I had arrived and, before settling down to do the documentation, I made a start on my own unofficial investigation.

I began by visiting each of the comms rooms, which were placed next to the emergency stairs on every floor.  Inside were the familiar rows of network switches, with their blinking lights and whirring fans, and patching all this together was the usual spaghetti of network cables.  Was something loose somewhere?  I tugged a few cables.  But apart from the fact that there were various bits of abandoned gear left lying around, and half of the cabinets had no doors on them, everything was in order.

I decided that since I was on the top floor, I would walk around the exec suite with a port-tester, since I had to rule out everything.  I wandered through empty rooms, getting nothing but green lights.  One of the rooms was a conference suite.  It was a large room with a polished wood table in the middle surrounded by stylish chairs.  On the wall was a massive flat-screen display.  It looked like someone had translated the headquarters of a Bond villain into French.  At the table were two women, who both looked like they had been Photoshop'ed into their business suits.  They were obviously both in the wrong place: the last things they needed were cosmetics.

The dark-haired one said something to me, but the French language being what it is, she could have been swearing at me or she could have been reciting poetry.  From the way her dark eyes were blazing, I guessed the former.

"Pardonnez-moi," I said, trying to remember some school French.  "Parlez-vous anglais?"

She didn't answer, just put her hands on her hips, and looked at the other woman, who then turned to me.

"I'm sorry, this room is not available now," she said.  "I have to check the network ports.  It will only take a minute."  I dropped the CEO's name into the conversation, hoping to impress, but all that did was make the dark-haired woman bark louder.  The other woman turned to me again and said, "Please come back after one o'clock."

I looked at my watch, and realized that it was already afternoon.  I decided to get something to eat and followed the signs to the cafeteria.  All the smart comments about French women that I had heard before I left the office were wasted.  Apart from the clinking of cutlery, the place was as interesting as an insurance convention.  Welcome to the exciting world of cosmetics, I thought.

I ate my sandwich, and then, at 1:30, I went back to the conference suite.  The two women had gone and, as expected, the tests showed there were no defective ports, which meant the hardware was working as it should.  My little investigation had failed to throw up any obvious errors, and I started thinking about hackers again.  I decided to continue digging later, because I still had the documentation to write.  I went downstairs and fired up the word processor.

I started with the firewall and server logs from the time of the events, added some topology diagrams, mixed in a few buzzwords, and then wedged it all on the company stationery.  A few hours later, my official task was nearly complete.  All I had to do was proofread it tomorrow, and then hand it over on Thursday.  Full marks pour moi.

After that, I put all the boring details of the day into my takedown diary and, at 6:00, I left my laptop monitoring the network and took a taxi to the hotel the client had arranged for me.

I'd never stayed in such an upmarket place before, and was looking forward to it, but it was just a better class of boredom.  After dinner, I sat in a deserted hotel bar for an hour, and then went to my room and watched a movie about the first American settlers that was badly dubbed in French.  The bad guy was wearing a tall black hat with a buckle on it, and the women he was waving a bible at were all wearing bonnets.  The more fashions change, the more they stay the same, I thought.

I went out and wandered around Paris in the dark for an hour.  After that, I spent another half hour sitting on a snow-covered bench in the middle of a square, sipping decaf, and watching white flakes slowly drift down out of the darkness and onto people as they darted in and out of shops and restaurants.  Hundreds of years ago, this spot had been the site of a famous revolution, but everything seemed peaceful enough now.  I heard some tourists speaking English, and I was going to ask them where the famously romantic part of Paris was supposed to be, but they walked past.

The next day was a carbon copy of the first.  Very little happened, and, in the basement, the two local support staff members were nowhere to be seen.  At home, there was always plenty of gossip in the office.  Every day there was some new story, about sales clerks going ape and throwing the company laptop at the wall, or the new woman who had just started working in the office, and that sort of thing.  But there was no danger of that here.  Nobody said anything.  The day was ten hours of silence.

On Thursday morning, I got a call from the CEO.  At the prearranged time, I went to her office, and found her and the security guy waiting expectantly.  I gave them each a copy of the hand-over document, and they kept me waiting while they read it.  After they had finished, they thanked me and said that they appreciated the work I had done, and how sorry they were to have dragged me away from home at this time of year.  They said that they would let my manager know that they were pleased with the service.

Shortly afterward, my phone rang.  It was my manager.  He had already heard from the CEO, and he was calling me to congratulate me on hitting another SA.  He wanted to know if I had done any additional investigation.  I didn't tell him that I'd been snooping around like the Hack Finder General, and just said that I had looked for technical faults and only found an unpingable DNS, and that I would see him on Monday.

After he had hung up, I went back downstairs, and sat in the silence.  I'd almost come to the end of my stay, and I hadn't seen any black hats, but I wasn't in a rush to get back to my hotel, so I hung around, filling in my hack-attack journal, which by then had turned into a full-on novel, since real life hadn't been interesting enough to fill a book.  I sat and typed all day, happily inventing exciting scenes, and wondering which actor would play me in the movie of the book.

It was after 6:00 when I noticed the time, and realized that I hadn't eaten.  I walked around the deserted corridors, looking for a vending machine, but didn't find one.  I went back to the office, and sat down at my desk.  I was just about to turn off my machine and go to the hotel, when I saw that a large segment of the top-floor network had vanished.

I paused for a moment, blinked, and looked again.  Yes, it was gone.  The thing I had been waiting days to see had happened at last, and I was sitting there with no idea what to do.  I jumped up and sprinted out of the office and up the emergency stairs to the top floor.  Whatever was going on, I was about to find out.  At the top of the stairs, I ran through the doors, got to the comms room, pushed open the door, and was just thinking "101%," when I saw something odd.

A woman was standing in front of the first rack.  I recognized her right away.  It was the woman from the conference suite on the first day, the one with the dark hair.  She had a surprised look on her face.  My first thought was, it is an inside job, after all.

"What are you doing in here," I was just about to bark, when I noticed something even odder.  The woman was staring at me with those big dark eyes, and, for some reason, I noticed that one side of her silk shirt was untucked.  And then I saw something else.  In the dark glass of one of the cabinets, I could see a reflection.  Someone else was in the room, standing behind the rack, out of sight.  A man.

I stood there for a moment, caught completely off guard.  The woman said nothing.  She didn't move.  She didn't appear to be breathing.  And then it dawned on me, and I realized what it was.  And I knew what had been interrupting the network service, and why it was only the execs who were getting hit.

"Er, pardonnez-moi," I said.  I backed out of there, and walked quickly back down to my desk.  So much for the big hacker takedown.  How much of the other stuff I'd read about hackers was just as hyped?  Hysteria sells.  And I had almost bought it.  Note to self: don't drink the Kool-Aid.

I got to my desk, and checked the network monitor.  Whatever had been knocked loose was back up again, and the network was fine.  I switched off my laptop, and then went outside.  I took a taxi to my Paris bench, and sat on it for an hour, watching the people go past.  I could see my breath in front of me, but the cold wasn't bothering me at all.  What was bothering me was what the thought of the next day's work.  It was not going to be enjoyable.  Not even slightly.

I got to see the CEO after 10:30.  The security guy was already there.

"I've retested the network and found the problem," I said.  "My initial thought was right.  It wasn't a hacker, just a defective network switch."

"Defective?" the CEO said.

"Broken."

"But all the switches have been tested," said the security guy said, with open hands.

"Yes."

The security guy and the CEO looked at each other, and their expressions didn't need translating.

"It's a good result," I continued, "because now you don't need to call in the police."

"Okay.  If you give me the serial number of the switch, I will call the manufacturer and have it checked."

Call the manufacturer?  I stood there, trying to figure it out, but my brain couldn't follow.  An image kept invading my brain, and wouldn't go away, an image of that woman, her shirt untucked, her gorgeous face flushed.

"Sorry, but I don't understand," I said.  "Why would you want the serial number?"

"Because the hardware is protected by a maintenance contract," the security guy said, not getting how I was missing the blindingly obvious.

Maintenance contract.  Right.

"No need for that, I've already fixed it."

"Fixed it?"  Puzzled, he looked at the CEO, and then turned back to me.

"Yes."

"You were supposed to document the problem, not fix it."

"Yes," I replied.  What else could I say?

He continued.  "We needed some evidence, to show to the police.  Are you telling me you just got rid of the evidence?"  He made the open hands gesture again, only this time he accompanied it with a sound like "poof."

"Sorry."

The CEO and security guy had a French conversation that was so fast it sounded like two modems talking, and then turned back to me.

"But I do not understand."  The security guy continued.  "How can a broken switch cause such problems?"

It was a good question, and all last night I had been trying to think up some believable explanation that fit the facts, but had failed.

"Dust was blocking the fan, making it run hot and act flaky.  Completely random.  But I've cleaned it now, so it's okay."  Naturally, I cringed while giving out this garbage.

"Fan?" the security guy said, incredulous.  He wasn't buying it, and I didn't blame him.

"So what you are telling me is that you cleaned the dust out of a fan, and now there isn't any problem?  And this will not occur again?"

"Yes.  That's right."

The CEO looked puzzled, too, and there was another conversation in 56k baud French.  Then she turned to me.

"What I don't understand is that you didn't think to tell someone before you destroyed the evidence."

"I..."  I started, and then stopped.  I felt some sweat roll down my forehead.  I was having a mal jour.  The whole thing had caught me out.  I was going to level with them, to tell them what had really happened.  I had to.  The CEO slit her eyes and frowned, as if she suddenly had an insight.  She spoke slowly and quietly: "Is there something you would like to tell us?"

It wasn't that I cared if the cyber cops charged Mademoiselle Hacker with killing business critical documents, and then burned her at the stake.  It was something else.  When you've had the finger pointed at you, it gets more difficult to do it yourself.  Anyway, I generally leave that sort of thing to the politicians.  I shook my head.  No.

The CEO gave me a look that was colder than the snow outside.  "I have to say that I am disappointed," she said.  "I would like you to provide me with an email explaining everything, before you go home."  I knew that as soon as the door clicked shut behind me they'd be on the phone to my manager, and that my record now had a large black mark against it.  I could imagine the jokes when I got back to the office.

I went back to the honeymoon suite and went around all the cables and power connectors, pushing in anything that might have been knocked loose.  As I was leaving, my phone rang.  It was my manager.  I confessed everything, and got a sermon about the importance of not annoying the customer.  For an hour afterward, I sat at my PC, typing an email that, however I phrased it, made me sound like a goon.  I looked at my watch.  My flight was more than eight hours away, but I wasn't about to hang around.  I'd get a cup of real coffee, finish the email, and then head to the airport.

I took the stairs down to the cafeteria.  The breakfast crowd had already gone, and the place was silent.  I went to the coffee machine and pressed the button, and got a cup of steaming water, without coffee.  My phone beeped.  I had a message.  I opened it, and read it.  It said: 99%.  One of the office jokers.  I stood for a minute, looking grimly at the cup of hot water and thinking things over: all work and no play makes Jack a dull geek.  I made another note to myself: get a life.

Suddenly, I noticed that a woman was standing next to me.  I turned around and realized that it was the woman from the conference room, the one who had been working with Mademoiselle Hacker.  I stepped back, and gestured for her to go ahead.

"Enchantél;," she said, putting her curves between me and the coffee machine.

"Enchanté yourself," I said.  She turned her head, and smiled.

"No tea?" she said, looking at my cup of water.

"I don't drink tea."

"But you are English."

"Yes."

She placed a cup in the machine, hit the button, and got coffee.  Then she turned back to me.

"What part of England are you from?" she said.  I told her.

"Will you be in Paris long?"

"A few days."

She did one of those French gestures, and inclined her head.

"Too bad you are working."

"I'm not working this weekend.  Sightseeing."  She smiled again.

"Paris is lovely at this time of year," she said, looping her hair around her ear.  "Will you be visiting the Le Mas district?"

"I hadn't planned to.  Is it nice?"

"It's wonderful.  it has lots of history.  Hardly anything has changed over the years."

"Sounds interesting.  Are there any good restaurants?"

"Oh, yes..."

After I had finished my cup of coffee, I took a last trip to the server room, just to do a final check.  It was a good job I did, because I spotted a couple of server issues that had somehow previously been overlooked.

I phoned the help-desk to report the problem, and after some negotiation, they said that they wanted me to get the work completed by Monday at the latest.  I said that I would try my best, but I could see right away that this was one SA I was definitely going to miss.