I nodded my thanks and hurried away up the corridor to the lift. But when I stepped inside and pressed the button for the third floor, nothing happened, and I realized to my dismay that it was swipe-card protected.
I stepped out of the lift and stood for a moment, considering my options. I had my rucksack with me, more for want of a place to leave it than because I’d particularly wanted to bring it—it was a little too big to look right as a commuter bag, but I’d had no choice. Now I was extremely glad.
Ducking behind a convenient potted plant, I dug in the pack and pulled out the sling I kept balled at the bottom for emergencies like these, then looped it over my head and put one arm, my right, into it. In my left, I held the rucksack, since I now couldn’t wear it on both shoulders. Then I straightened up and pressed the lift button again, praying that it wouldn’t arrive empty this time. My luck held. A kindly-looking guy in his late forties was already inside.
“Going up?” he asked as I stepped inside, and I smiled and nodded, and then began patting my pockets, miming hunting for my pass, almost dropping the rucksack as I did, and wincing as if the jolt had jarred a sprained wrist.
“Let me,” the man said swiftly, and reached forward with his employee pass, touching it to the card reader. “Which floor?”
“Three. Thank you so much. I am so fed up of this wrist. I’m never ice skating again.”
“I sprained my shoulder playing squash last year,” the man said conversationally as the lift began to rise. “Absolute pain in the… well, I was going to say arse, but that’s the wrong end, ha ha!”
I laughed, and the lift stopped at the second floor.
“Well, this is me,” he said. “Hope the wrist is better soon.” And he stepped out.
“Nice to meet you,” I said with a grateful smile that was considerably more real than my sprained wrist. And then, as the lift door closed behind him, I shrugged hastily out of the sling, straightened my shoulders, and prepared for the final hurdle.
* * *
WHEN I STEPPED OUT OF the lift doors on the third floor, my first impression was that the Sunsmile call center was like every other office I’d ever pen tested, but louder and larger. A small labyrinth of desks and pods stretched away in a complex hierarchy that encompassed hot-deskers, people with little glassed-in booths, and the favored elite few with access to a door that shut and a window with real daylight.
The level of chatter was insane, and I fought the urge to put my hands over my ears as I wove my way among the booths, looking for someone kind to ask. At last I picked a girl who’d just put down her phone and was midway through the act of dialing someone else. Busy people were always the best—too distracted to ask the right questions.
“I’m so sorry,” I said apologetically. “I can see you’re tied up, but can you point me in the direction of Keeley Winston?”
“Keeley?” the girl said vaguely. “Think she’s off sick, but her desk’s over there.” She pointed towards the corner of the floor. “Can’t miss it, it’s plastered with gonks.”
For a minute I thought I’d misheard.
“Sorry, did you say… gonks?”
But the girl was talking into her headset again, and so I shook my head and moved away, towards the corner she’d indicated. Keeley must have been reasonably senior, because she had a half booth and a window—and when I drew closer, I saw what the girl had meant. The little booth was full of what I supposed must be the “gonks” she had referred to—little troll dolls with fluffy upswept hair and grinning faces. There were girl gonks and boy gonks, baby gonks and granny gonks. The effect was deeply unsettling and somehow also made me want to laugh—but I couldn’t do that right now.
Instead, I sat down in Keeley’s chair, fired up her computer, and looked around. What I’d been hoping for was the lottery win of pen testing—a password written on a Post-it and stuck to the monitor—but if Keeley did write down her passwords, she wasn’t stupid enough to leave them in plain sight. Instead, I picked up the phone, took a deep breath, and dialed the number Gemma had given me. It rang. And rang. And rang…
I was on the point of giving up, sick with disappointment, when there was a click and the phone was picked up. Instantly I heard a baby wailing on the other end, and my heart lifted. The only thing better than someone busy was someone busy and distracted.
“Hello?” Keeley’s voice was brusque and a little worried. “Who is this?”
I took a deep breath. Do not fluff this.
“Hi, Keeley,” I said, making my voice as warm and professional as I could. “Sorry, you’re probably wondering why it’s your own number calling you! This is Kate from IT. There seems to be a problem with some of the computers—bit of malware’s got into the system somehow—so we’re having to do a manual scan on the affected machines. I’ve been trying to catch you all week and it’s getting… well, it’s pretty urgent, to be honest. I’m at your desk right now, is there any chance you could pop up and log me in?”
“Well, I don’t know how it could have been me.” She sounded a little defensive. “I’ve been off all week with Harry. He’s got chickenpops.”
Pox, I thought but didn’t say. Cardinal rule of phishing: Do not piss off your target.
“Oh, what a nightmare!” I said instead, filling my voice with sympathy. “I’ve got twin boys and they both had it a couple of months ago. I swear, I didn’t sleep for a fortnight.”
“Oh my God, tell me about it,” Keeley said ruefully, and I could tell from the change in her tone that I’d succeeded in making a connection. “Bloody nightmare, isn’t it.” The wailing in the background intensified. “Look, Kate, sorry, this isn’t a great—”
“Oh, totally, of course,” I said. “Shit—I hate to drag you into the office for something that’s not your fault, but I have to run this scan. It’s a security issue.”
“I can’t come in!” Keeley sounded alarmed. “There’s no one else who can take him. My mum’s doing chemo; her doctor said she can’t have him until the spots scab over.”
“Look,” I said confidentially, with the air of someone making up their mind. I lowered my voice. “This isn’t completely… I mean, we’re not supposed to do it this way, but I can see you’re in a tricky situation. Do you want to give me your password and I’ll do the scan without you coming in? Just—don’t tell my boss. We’re really not supposed to do this.”
“Oh God, sure,” Keeley said, the relief in her voice palpable. “They’re all on my Rolodex under Harry Winston, but the main one is Harry24Sept. God, thank you so much, Kate. I really appreciate you doing this. I’m sorry, I would have come in if I possibly could, but—you know what it’s like.”
“Yeah, blokes don’t get it, do they? My boss thinks I can just drop anything. I’m like, it doesn’t work that way, dude!”
Keeley gave a shaky laugh and the wailing rose again in the background.
“Look, I’ll let you go,” I said warmly. “Take care, Keeley. Make sure you get some sleep too!”
“Thanks, yeah, I’d better go, Harry’s kicking off World War Three. Take care, Kate. Bye.”
“Bye!” I said brightly, and there was a click and the phone went dead.
I resisted punching the air in triumph, logged into the computer, and while it booted up, turned to the card marked Harry Winston on Keeley’s Rolodex.
It was a treasure trove. Passwords to every single system neatly logged with not even the barest attempt at disguising them.
I closed my eyes, sending up a silent prayer of thanks to overly complex IT systems with unmanageable numbers of passwords and to distracted parents everywhere, and began trying to figure out the call-handling database.
The hard part was working out which icon on Keeley’s very crowded desktop was the relevant one, and I had several false starts with a car insurance database and something that seemed to be some kind of employee intranet—but at last I fired up one that displayed a home screen with the Sunsmile logo and the legend Sunsmile Life Insurance—a friend for life. Pressing the search icon took me to a screen that said Search by customer ID number, policy number, name, postcode.
My heart was thumping as I typed in our postcode.