Chapter 4: A Sheep in Wolf’s Clothing

Evergreen Financial Corp., or EFC, was one of a number of independent credit card issuers that had sprung up about twenty-five or thirty years ago. It had never made it as big as its chief rival, because it adamantly refused to align itself with any mainline bank. Instead, it issued credit cards under private labels for various associations, unions, and even churches. It looked like a prime take-over candidate to me, but miraculously it had staved off attempts by big banks during the great consolidation wave. It kept to its niche market, offered good services, and was semi-privately held. Though technically a publicly traded company, the vast majority of its stock was held by a small number of large investors who seemed of like mind when it came to maintaining their independence.

To those in the right circles, it was also held to be a fortress regarding personal information and computer security. The very thought that the company had become vulnerable to cyber-attack grated on the nerves of management and IT. Lars suspected the company’s unusually proactive movement had other motivations as well. Financial organizations are not required to report incursions into their systems unless customer data has been compromised. Most do what they can to cut off the threat and silently swallow the losses rather than have them made public. The fact that EFC was calling in a consultant meant they thought the threat might be internal.

Monday morning, I was up and dressed by eight, having taken care not to cut myself with my new razor. It was going to be difficult to maintain the little strip of whiskers on my upper lip. Shaving close to it without cutting it off would be a daily challenge.

At half past nine, I was sitting in the plush twenty-third floor offices of Evergreen Financial Corp. on 3rd Avenue in Seattle. I’d checked in with the receptionist, a woman about my age with an extraordinarily pleasant voice. She asked me to have a seat and I heard her call to say I was in the lobby. Her tone in dealing with the person on the other end of the line was one that would calm a tornado. I heard her answer another line in the same calm, reassuring tone.

“Evergreen Financial. I’m sorry, Mr. Drake is out of the office until two o’clock today. May I take a message?”

Take a message? No connecting to voicemail? If I ever have a business that involves a lot of incoming phone calls, I want her answering them. Well, that day was so far away I couldn’t even see it on the horizon.

A woman came through the security doors on the left and stopped to speak to the receptionist. They conversed in low tones for a minute before she approached me. She wore a dark suit and white blouse with one of those long collars that tie into a bow at the neck. Her skirt was cut scarcely above her knee and the one-inch heels she wore clearly stated that she was here on business. I silently thanked Cali for my new suit and stylish tie as I stood to greet her.

“Mr. Hamar? I’m Darlene Alexander, Mr. Dennis’s admin.” Well, that answered my first question. She wasn’t the executive I was interviewing with. “His meeting is taking a few minutes longer than expected and he asked that I get you situated in his conference room. Would you come with me, please?” I acknowledged her greeting and agreed to follow—almost before she turned and marched back to the security door. She waved her badge at a black box on the frame and the door clicked to allow us through. On the way to the conference room we passed a small kitchen and she asked if I would like a cup of coffee. I stopped myself from automatically saying yes. I asked if I might have a glass of water instead and she quickly showed me the cooler and glasses. I filled a glass and continued to follow her to a room next to the corner office with a round table and four chairs. I selected the chair that faced the door and after I sat down the admin departed. It was a great view, out across the Sound. I turned away from it and faced the door, relaxing in my chair.

The executive who was going to walk through that door any minute now was the crook. I’d decided that even before being told exactly what the job was. As far as I was concerned, the guy was guilty just because he was a vice president. That’s my version of “the butler did it.” I supposed I’d have to investigate everybody in the company in order to prove it.

I didn’t have long to stew about it. The door opened and a slightly balding man a little shorter than me strode through the door with purpose. He closed the door and then turned to me.

“Hamar? I’m Arnold Dennis. Don’t get up.” I’d begun to rise when he entered the room, but settled back. This was not a man who beat around the bush. I needed to hang on for the ride. “Good references. Let’s talk about Henderson.”

“Okay.” That wasn’t what I expected. Why would he be interested in my former employer?

“It’s one thing to identify that a fraud is taking place. How did you pinpoint who was moving the money?”

“I see,” I said. “Officially, I held the encryption key to the back-up data at Henderson. When the police took the disks, I decrypted them. The evidence was there.”

“Data isn’t knowledge. What led you to believe it was the C-levels who were doing the work?”

“There are confidentialities involved.”

“You don’t want me to know the how.”

I looked at the guy. This was not the interview I was prepared for. I didn’t really want to go into my techniques for nailing the CEO. Evidence appeared. It was turned over to the police.

“I use a combination of techniques that fit the parameters of the job I’m assigned. If one technique fails to produce results, there are others that I can fall back on. The real question is what you want me to find and what you don’t want me to find,” I said. I kept my voice even and pitched low. Arnie Dennis was leaning forward to hear me better. He was buying and I was selling. He didn’t strike me as a man that many people stood up to. He paused as he considered me and I looked him in the eye.

He smiled.

“Good. Here’s the situation. Our losses due to fraud are increasing. Every credit card company assumes some risk of fraudulent card usage. We expect it and plan for it. Most fraud losses would cost us more to prosecute than the loss itself. Frankly, you can’t even call it fraud most of the time. Usually it’s a spur of the moment decision by someone who is desperate and sees what they think is an opportunity. Could be as simple as finding a credit card and charging a shopping spree to it. Sometimes we still get the captured number and signature used by an unauthorized person. Occasionally it’s something more serious like a raid on a series of card numbers for charging porn. The Internet makes it more difficult to track some of those uses, but we are vigilant about protecting the customer and where we can make an impact we prosecute the offender.”

It was what I expected. Both State and Federal Laws are specific about the responsibility of financial institutions to protect their customers from fraud. But they weren’t required to press charges. Business crimes occur every day and wasting their money on small cases isn’t profitable for an institution’s shareholders. But losses are something every manager at every level is responsible for—whether they are in banking, designing software, or selling shoes. If losses were increasing, however moderately, it was going to raise red flags.

“A basis point is one-hundredth of a percent of the company profit. It is a tough market out there and a downward shift of a single basis point could mean millions of dollars in losses. I’ve been given the authority to investigate and remedy the situation.”

“Why, if I may ask, does that fall to the Chief Technology Officer and not to the Chief Financial Officer?” I asked.

“Good question, with two answers. First, we believe our losses are specifically tied to incursion into our systems. It’s my job to plug that kind of leak. Secondly, technology is now fundamental to every job in our company. Every single employee has a computer and is tied into our network. Our employees and our network are our greatest vulnerability. Finance will be watching my every move on this, but Tech has the ball.”

“Don’t you have inside people who can trace network use?” I asked.

“Yes. But anyone inside the company could be a suspect. And that pisses me off. It pisses me off that I’m a suspect. You are here to get into the network and sniff out the vulnerabilities,” he said. Apparently, I’d been hired. “I’ll call you my Technical Assistant. That will give you unfettered access to everything on the network. Everything. You will have read access for every single computer and server on the network. I want to know whose pocket every missing penny lands in.”

I’m licensed and bonded, but it was sounding like I was just being given the keys to the kingdom. What company was going to give an outsider complete access to their financial documents, strategies, marketing, and technology? Not only that, but this company had an entire division that handled fraud. Those folks certainly wouldn’t be happy about having an outsider looking over their shoulders. There had to be a catch somewhere. Arnold’s smile was back on his face. He looked like he’d just caught me with my fingers in the till.

“You’ll be watched,” he said simply. “I’m not about to launch anything like this without safeguards that I have personally put in place. I will know where you go and every file you touch. I can’t do the investigation myself, but I can be damn sure that you will be monitored. And challenged.” I nodded. That made sense. I’d spend the next few hours pondering exactly how they were going to watch me. Then I’d figure out how to get around it. I don’t like being watched.

“If you are ready to go to work, I’ll have Darlene get you down to HR. She’ll introduce you to my Director of Network Security, Don Abrams. He’ll get you a computer and logon. You’re going to be an employee—full benefits and the works. Of course, I’ll pay your agency a fee as well, but no one in the company is to know that you are an outside consultant or the precise nature of your job. As far as anyone else is concerned, you are doing specific technical investigations on my behalf regarding the impact of new technology on the financial world. There’s a cross-departmental team that does that and you’ll become a member. I hope you can hold your own in a conversation about the Fed’s new policies on electronic record maintenance. Darlene has the position number and employee job req.”

He stood to leave but turned to look at me once again.

“Zack Henderson was a personal friend of mine.”

Damn! Zack was my former boss’s father and the founder of Henderson Associates. And my new boss was his friend? Zack committed suicide two months after his son was arrested.

“It wasn’t what you did that killed him. It was what you found. If you find that one of my partners in this company is raiding the bank, it’ll kill me, too,” he said. Did I believe him? “I’ve been here twenty-three years and I expect to be here another ten before I retire. Just remember this company is twenty times the size of Henderson. It’ll take twenty times the work.”

All right. Maybe I was too quick to condemn corporate executives.

Maybe.

It was two o’clock by the time I was actually seated at a desk and staring at a computer. The morning had been filled with paperwork and briefings by Human Resources. I had forms for filling out 401k deductions, health insurance, and membership in the Puget Sound Health Club. I’d received my security badge/keycard, and as soon as I arrived back at Darlene’s desk she made a quick tour of the office and gathered together the other members of Arnold’s ‘team’ to head out for lunch. Wild Ginger has great food, but it’s never a quick lunch, especially when trying to meet and memorize the faces of half a dozen new people.

I paid close attention. These were the insiders and as such, prime suspects. I’d met Don Abrams earlier in the day and he assured me there would be a computer waiting on my desk as soon as I finished with HR. He was Director of Network Security and Arnold’s go-to man. Allen Yarborough sat across from me at lunch and asked an endless stream of questions that probed my knowledge of system administration. That figured since he was the Systems Admin Manager. It turned out that he was the one directly responsible for issuing my laptop and having me registered on the network. Within a few minutes, I realized I was being interviewed by Arnie’s staff, which hadn’t been given the usual opportunity before I was hired. They were testing my mettle. When Allen finished hammering me about systems admin, Phil Jackson, Manager of Fraud Detection, took over. His questions focused on my knowledge of attacks that were specific to credit fraud. As it turned out, my work on the Henderson case came in handy. Part of what brought the company down was the default on a sizable loan they’d received from a private lending company. If the loan had been through a mainline bank, there would have been a long waiting period while the wheels of justice spun up. Since the lending company was privately held, the default action went from zero to sixty in ten seconds. It didn’t give the execs enough time to hide their tracks before the police were called in.

Ford McCall took over the questioning at that point. Ford was a low-level employee compared to the managers at the table. I was still curious as to how this so-called team was put together. They didn’t seem to have a common manager below Arnold himself. They were at a number of different hierarchical levels. Ford was a researcher. His level of interpersonal skills had probably kept him from being on a management track, but it turned out that he knew something about just about every development in technology that had taken place in the past twenty years. His questions were random, sometimes asking about the credit industry and sometimes about programming in C#. He asked questions about the breakability of different operating systems and went so far as to ask me point-blank if I’d ever hacked a UNIX system. I was going to be watching this guy like a hawk.

That left the two women at the table, the admin, Darlene Alexander, and Jen Roberts. Jen didn’t give her title when she introduced herself and no one seemed inclined to fill in the blank. She asked if I was familiar with matrix management techniques. Things started to click. Most companies have a purely hierarchical structure. If you are an engineer, you work for an engineering manager who works for an engineering director who works for an engineering vice president. You know exactly how many levels separate you from the president of the company. In matrix systems, there may be a hierarchical structure on the boards, but teams are organized according to projects and the individuals on the team might be from several different departments. It turned out that Evergreen Financial Corp. was a hybrid system, but that most of the high level work was done by matrix teams who reported to a team manager and had little to do with the hierarchical structure. In fact, some team members had titles of “Director” but had no direct reports. It was far more typical of the financial industry in which directors and vice presidents were given their titles to show status and not line management. A vice president had higher decision-making authority than a director. Jen Roberts—title unknown—was our team lead.