Social Engineering is Forever

by NAH

"One more try," I say to the security guard at the Borden headquarters in Columbus, Ohio.  It's 1995 and I'm skateboarding in front of the building.  There are several brick circular tree planters, seemingly tailor-made for me to kick flip across as I make my way down to Front Street, that I have to hit every time I pass the building.  Usually it's a one-and-done scenario.  No second tries, because the security here is on point.  Pretty much all the time.  Today is no exception.  He was coming out of the door as soon as the sidewalk cement on Broad Street turned into the brick plaza with the huge illustrated cow sign.  My wheels going from the familiar hollow whoosh to the clack-clack-clack-clack signaling my arrival.  As expected, the minimum-wage corporate denizen was on it.  No words today though.  Just the rush outside and the flagging down.  Perhaps a dismissive wave.  Possibly, remembering who I am and expecting me to be on my way (as per usual).

The guard started to head back inside as soon as he gave me the universal double-hand-wave that's supposed to be the signal to leave.  I ask for one more.

"Huh?"  He pauses but is still half turned away as he turns his head to look at me.

"One more try."  I hold up an index finger to illustrate.

He turns around.  "You can't do that here."  There's no real enthusiasm or power in this declaration.  It's his job, yes.  But the job sucks.  The pay sucks.  I probably look like I'm having more fun that him.

"One more try and I won't come back for the rest of the day."

This makes him turn around.  Eyebrows raised.

"Huh?"

"I'll leave.  Just go inside and I'm going to circle around one more time.  Whether I land anything or not, I'm out.  And I won't come back."  This isn't the full truth.  I'm not planning on coming back, but I'm not coming back this way regardless.  My homie parked at Dodge (across downtown) and I'm meeting him there for a ride home.  So it's a moot point.  I can tell the guard is considering.  Maybe a four second pause.  Eye roll.  Walk away.

"Whatever, but if I see you again I'm calling the cops."  He goes inside.

F*ck yeah!  I circle around and hit the front planter but don't come close.  No matter.  It worked.  I got another try when there should have been no more tries.

Side note - the threat to call the cops has always made me laugh.  All you did was give me a set amount of time before I can leave.  Think about it: you have to go inside and dial the police.  Unless you're a complete asshole, you're not calling 911 for this.  You're calling the non-emergency line, and then telling the person on the other end your name, location, what's wrong, blah blah blah.  There's a couple minutes spent right there.  Then, the dispatcher has to find a patrol car, then radio them, then they have to decide priority, then they have to make their way to that location.  If they even care.  Nearest patrol might be dealing with something, or eating lunch, or whatever.  So you're calling the cops?  Sweet, now I know I have like a half-dozen tries left.

But that's not the point of this article.  The point is this:

When Poor Richard said, "Would you persuade, speak of interest, not reason," he was telling us that people's personal preferences will trump logical arguments.  Did the security guard really give a shit that I was there?  No.  He was just doing his job.  And my one more try wasn't getting in the way of him going back to his desk and reading magazines or drinking coffee or whatever he does to fill his days.  If I stayed and argued, or showed attitude, or tried to convince him of the lack of victims of my crime, I would have made no progress.  But I didn't do those things.  I appealed to interest and won.  Go sit down, and I'll be gone.

I'm walking through an emergency room at a hospital.  I'm not a patient.  I'm working.  I go to hospitals for my job and they are more and more secure with each passing year.  I go to secure areas so there are passcodes and door locks, security check-ins, all the fun stuff.  Sometimes it's a pain to make those trips and many hospital systems still don't give out any kind of third-party or vendor credentials.  So I have to make this trip a few times a day when I have some complicated problem to work on.

Give someone a heads up that I'm running outside.  Go outside.  Come back in.  Get buzzed in.  Show credentials.  Call my contact to escort me back into whatever secure area.  I think of an idea - all I really need is one of the employee's badges so I can run in and out.  Now obviously - that's a huge security flag, not to mention potential HIPAA violation (I work in areas where patient results are displayed along with related personal info), so I'm not even going to suggest such a thing.  However, I can still appeal to interest.  I hate bothering the other hospital employees.  They don't mind being bothered, but at the same time, they also have work to do.

Workaround: I bother them a bunch until they get exasperated and just hand me their ID.  I'm in and out as much as I need.  HR would not be pleased.  I and the aforementioned employee, however, are both good with this scenario.  It should be noted that as a personal matter - I never do anything but exit and enter.  I keep said credential secure and return it promptly.

I'm at a show in Detroit.  I have a VIP package which includes access to the sound check as well as some extra merch.  I'm sitting at the bar, after sound check, waiting for the theater doors to open.  I hear a couple behind talking about "some VIP standing area" which I didn't see or hear of.  Sounds like BS to me, but I listen.  They're going back and forth with each other debating whether said area exists, making different points.  I realize it would be faster to just ask.  I get up and go over to the theater door.  Dude posted up chilling.  SECURITY t-shirt, dreads, beanie.  Sweet.  I ask about this phantom VIP area.  He says it was just the sound check.  I say nothing but nod.  He looks around, says, "Yeah, I don't know."

Now, I have to think for a second.  Although this sounds different than the first scenario, it's very similar.  I can say something to appeal to interest instead of reason, and maybe get a benefit.  So I don't ask.  No, because I'm assuming his interest is in keeping this job.  If I ask, then he has the power to say no because he wants to protect his interests.  I wait.  He then says it might be okay for you to go in again, I mean you were already in there once.  So I take a shot in the dark and go the direct route.

"I do have VIP..." I show him my wrist.  "... hook me up."  I'm making a huge stretch to appeal to the cool-guy aspect of this whole venture.  It works.  He shrugs and lets me in.  I have the next 20-something minutes to myself in the venue before general admission.  Minor reward, but still a success.  I get a point.

Why am I telling you this?  Why does it matter?  Why do you care?  Because you can use this same technique.

Disclaimer:  I am not suggesting you do illegal, unethical, or immoral things.

However, the point still stands.  People generally have their own interests first.  That's not a comment on selfishness, but of survival.  We have to look out for ourselves first before we can do anything for others.  And therein lies the opportunity for intrusion.  Well, maybe not intrusion.  How about - opportunity for an opportunity.  Whatever that might be.

The gist is - just ask.  But not blindly.  Think about the person in front of you.  What are they doing?  What do they want?  Do their interests align with yours, however temporary?  Identify a commonality and go in.  Who knows, you might both get what you want.

Thanks for reading!