Chapter 5: Once a Hacker

Being a hacker, I’ve always had an impulse to hide my identity. As a result, I’ve never put my real name on the Internet. I’ve never put my own photo on a social site. I’ve never indicated in my profile where I live, how old I am, or even my sex. I have very few ‘friends’ online and they mostly know me by one of my aliases and not by name.

Amazingly, I’m still pretty active and think of myself as even a little vulnerable online. I have a dozen email addresses, carefully concealed behind various identities. My passwords for those accounts are changed every thirty days. I create temporary email addresses through anonymous host sites and then create permanent addresses using the temporary one as a reference. Then I delete the temporary account. My security software is the best I can find, but because I’ve cracked it myself, I place little trust in its ability to keep my systems safe.

I don’t use WiFi in my office or my home. I use a cellular modem to connect my computers through encrypted packet data on a virtual private network. That makes my activities almost undetectable as my IP address changes with every location from which I connect.

It also makes everything damned inconvenient.

I am a digital fortress, and even so, I am afraid of being spied upon. It really irritated me that in my first day at EFC, I’d found two devices set to spy on me as I worked. And I figured there would be more.

I hadn’t opened email after logging on. I’d simply stared at the computer screen watching the security camera outside my office continue its 360 degree pan every four minutes. Who monitored that camera? As I left for the day, I wandered aimlessly down the corridor. All through the office I could see monitors on people’s desktops displaying images from security cameras. Occasionally, I would see myself on a screen as I walked by, which meant the cameras were located all through the building. That amount of visual data would take truckloads of digital space to store, even after high compression. But I had to admit, the simple reminder that I was being watched at all times had a Big Brother effect on my willingness to commit any grave sin in the office. It probably had the same effect on every other employee.

I left the building and wasn’t sure that I ever wanted to go back.

The keyboard was tapped. The camera was watching. What other types of surveillance were in place? I had to bet that the laptop I was assigned had monitoring software installed on it—very likely in places that I couldn’t touch. So, Tuesday morning when I went into the office at half past eight, I swiped my ID against the reader and went straight to my desk. I attached a portable keyboard to the laptop and did a network boot, avoiding accessing the hard drive at all. As soon as I reached the ‘repair’ screen, I slotted in my smartcard and gave the commands to format the hard drive and reinstall the operating system and standard company issued software. That should take care of any malicious software on the computer that was directed only at me. The fact that I’d never know what was there was irritating, but not worth bothering over if I wanted to start exploring the company networks. Of course, EFC might be monitoring everyone’s computers and have software built into the network install. Que sera, sera.

After the disk was formatted and the system was up and operating again, I’d have to figure out how to put my own protection on the computer. I was pretty sure the network security protocols would prevent me from installing any software that wasn’t on the official list—that was typical of both financial and government offices—but I was confident I could find an unprotected network computer where I could install and run it remotely. If not, I had a way of running the programs that I’d use remotely, although I’d rather have it right here.

While the system was installing, I tapped into my own VPN on my cell phone and started a series of probes at the company’s firewalls from outside. If there was someone getting through from outside, then the fraud they were worried about might not be employee-based at all.

I timed the rotation of the camera outside my office and while it was turned away, I used a small bug detector to sweep the rest of my office. There were two—a listening device in the lamp and a bug on the phone. Those, I simply wouldn’t tolerate. I removed them and went out of my office to the restrooms and flushed the two devices down the toilet. With luck, no one would have been listening that early in the morning and they’d just hear silence from that point on. But I didn’t care. They would all know by now that I’d detected the devices and cleaned house. And good luck to them trying to break my password to reinstall.

I wasn’t surprised to find that when the screen-saver kicked in on the computer, I was once again viewing a security camera, but it wasn’t the same one. I’d read my company handbook the night before. EFC had security camera feeds as the standard screen-saver for all network computers. The feeds were randomly assigned and changed to a different camera each time the screen-saver kicked in. I was willing to bet, though, that the feed I’d seen on my screen the previous day had not been chosen randomly. Someone was making sure I knew I was monitored. The question was, “Who?” After all, Arnold had told me when he hired me that I’d be watched. Throwing me the camera might simply have been a way of driving the point home. There was no reason to believe I had a strong ally anywhere in this company. Yet.

They’d as much as challenged me to show I could get around them. I was going to do it.

I opened my email and scanned through the messages that came through yesterday and early today. If the number of messages in my inbox was any indication, it was a wonder anyone got any actual work done. I set my mailbox up on a removable drive. I wasn’t keeping anything on the company computer. When I turned it back into them after I was done here, it would look unused.