The conference room/makeshift office television was on, with BBC covering the Americans invading Iraq. Shock and awe indeed. God help us all. Joanne Gittens turned it off. Now was not the time to become absorbed in the news.
She scanned the next log file. By now, the pattern was familiar; she could have written an automated script to grep all the logs under study for the offending IP Address. Hundreds of systems were interacting with it. But the mystery was why. Why was a construction company from Wolverhampton, UK trading data with somebody in China?
Her supervisor, Roger Harris, and even the managing partner himself, Sir George Patel, had advised her not to pursue these irregularities. The lecture still burned in her ears.
“As an intern, even from such an impressive university as Oxford, your function on this audit team is to scan the logs and call any apparent irregularities to the attention of your supervisor. You are not to contact the client, offer any opinions, or attempt any remedial action. Consider it a privilege that we allow you access to this project to further your education. Do not misuse that privilege.”
But when she brought it to Mr. Harris’s attention, he instructed her to ignore it. But how could she ignore this? English construction companies had no reason to interact with China, and even if they did, most of the interaction would be over email and SMTP. Or maybe UDP streams for VOIP calls. But the packet logs from the period under study showed an obvious pattern of outbound SSL traffic to an IP Address in China with no corresponding DNS entry.
Thus the mystery. Why were hundreds of systems from Cartillion Construction offices across England and Canada interacting with a Chinese secure web server with no name? Everyone knew Cartillion was the company that remodeled the Queen’s bedroom. And managed all kinds of other secure government buildings. The only answer that made sense was a malicious software infection. But were the Chinese spying on England through the construction company that built England’s most secure buildings, or was this garden-variety malware?
Roger Harris and Sir George Patel be hanged, she would get to the bottom of it. Her own brother was marching to Baghdad with the Americans against Saddam Hussein, and if the Chinese were stealing secrets about the most secure buildings in England, she didn’t want to think about the consequences. His safety was more important than any managing partner’s wishes.
Digging for Details
“Cartillion Construction, how may I direct your call?”
“Good morning Poppy, this is Joanne. I know I’m in the conference room down the hall, but I’m calling you at your receptionist desk from my mobile.”
Poppy laughed. “Ah. Discrete are we?”
Joanne glanced out the conference room door. The hall was clear. “Yes. I wanted to thank you for the kindness you’ve shown me by inviting you to lunch. I’m buying.”
“How does an intern afford lunch?”
Joanne laughed. “Savings. And a stipend from my parents.”
“Well, thank you. I shall accept your offer and we’ll go somewhere affordable.”
At lunch at a nearby pub, Joanne laid out what she had uncovered.
“I do not pretend to understand the technological marvels all around us,” Poppy said. “So, let me summarize what I think you just told me. You’re worried the Chinese are stealing information from our computer systems because you’ve observed suspicious telephone traffic. Well, not exactly telephones, I guess, internet traffic, with China. Is that correct?”
Joanne nodded. “Yes. That summarizes it nicely.”
“Well, then I’m gobsmacked.”
“So am I. And that’s why I need your help.”
Poppy pursed her lips. “But I’m only a receptionist.”
Joanne leaned forward. “And I’m only an intern. But didn’t you tell me your younger brother is also in Iraq with the Americans?”
Poppy leaned back and took a breath. She exhaled through her mouth. “Yes.”
“Well, then, if somebody is stealing secrets from your company, our brothers could be in trouble.”
Poppy sipped her water. “What do you propose?”
“Let me examine your computer during off-hours. If I can find a copy of the offending software, perhaps I can disassemble it and report it.”
“You never told me anything is wrong with my computer.”
“I don’t know if it’s on your computer or not. But I’ve seen it coming from computers across your company, and so it’s probably on your computer.”
Poppy nodded and looked down. “I’m not a senior at Oxford with my whole life ahead of me. I’m a mum with three mouths to feed. I could lose my job.”
Joanne leaned back. “I could also lose my internship and possibly even be thrown out of college.”
Poppy sipped some more water.
Joanne chewed another bite. “How about this. We’ll tell them I wish to know more about your job and you’ve agreed to spend some time with me after work. I’ll look through your computer and copy anything I find to my private ftp site.”
“Why would a senior at a prestigious university, interning with the largest auditing firm in the UK be interested in the receptionist’s job at a construction company?”
Joanne nodded. “That’s an excellent question. I wish to have a career as a pen tester.”
“A pen tester?”
“Yes. Someone who tries to penetrate a company’s defenses to help them stand up to cyberattacks.”
“Ah. Spy stuff, is it? Madam Double Oh Seven.” Poppy chuckled.
Joanne smiled. “Well, hardly that dramatic. But the truth is, I really am interested in your job. It’s been my observation that receptionists are the center of activity in any office and know more about the comings and goings than anyone else. Is that accurate?”
Poppy smiled. “Of course.”
“Well then, where better to find holes in the defenses? Also, examining your workstation will help me bring this matter to my management, who can then bring it to your management’s attention.”
“Your proposal sounds exciting. But I have kids at home.”
“Is there a husband who can watch them tonight?”
Poppy shook her head. “No. Not any more.”
“Oh, no, don’t be. He pays his share of child support. And they adore him.”
“Well, problem solved then. Would he be willing to take them for an evening?”
“He might. His weekend with them starts tomorrow morning. I’ll ring him and see if he’ll take them after work today.” After a few minutes on her cell phone, she nodded at Joanne and smiled.
Joanne nodded back and mouthed, “Thank you.”
That evening, Joanne sat in front of Poppy’s computer. Its assigned IP Address matched one of the systems interacting with China. It was infected. But a virus scan reported it clean.
“Why is that?” Poppy asked.
“Because the antivirus software can only find known signatures. They’ve probably not seen this one yet.”
“A wealth of investigative tools are available for Windows, but none are installed here. Perhaps I can clone your hard drive and examine it more closely in our lab at university.”
“What does that mean?”
“I can copy the hard drive inside your computer onto a different hard drive, and then connect that hard drive to a computer in our lab and analyze it. My lab computer will be a clone of your computer.”
“How does that work?”
Joanne pulled a computer hard drive and a CD from her purse. “We’ll open up your computer and attach this empty hard drive. We’ll boot from the CD and run a special program to make a block for block copy of your hard drive onto my hard drive. And then we’ll put your computer back the way it was and I’ll analyze all this data in our lab at Oxford.”
“Joanne, I don’t know. Tampering with the company’s computer equipment could get us both in trouble.”
“We won’t be tampering. We’ll copy your hard drive and that will be the end of it. I promise, it’ll be fine.”
“Okay. Just, please, do it quickly.”
Joanne shut down Poppy’s computer and crawled under the desk and examined the case. She pulled a small flashlight from her purse. Three thumbscrews held the side panel in place. She undid the screws and pulled the panel away. She studied the computer insides for a few seconds.
“Poppy, would you happen to have a few books and perhaps some scratch paper?”
“I need to fashion a temporary shelf for my hard drive and I may need the paper for static isolation.”
“I have a box of tissues. Would that work?”
Joanne set her hard drive on the tissue box and examined the setup. “Yes. But I need a few more inches.” She looked over the top of the desk and found a pencil cup. “May I use this?”
Poppy nodded. “Of course.”
Joanne set the tissue box on the cup and shook her head. “No. It’s unstable.” She scanned the desk. “Ah – brilliant. An Oxford Advanced Learner’s Dictionary. Yes, this will do nicely.” She set the 1800 page dictionary on the floor, the tissue box on the dictionary, and the hard drive on top of the tissue box, and connected the computer cables.
Poppy laughed. “Bugger me. It looks like something from Rube Goldberg.”
“Shall we?” Joanne said.
“Be my guest.”
Joanne powered up the computer and inserted her CD into the CD tray. After it booted, Joanne typed,
dd if=/dev/sda of=/dev/sdb
“And now, we wait.”
It finished thirty minutes later. Joanne put the computer back together and booted it. Poppy logged in. All worked as expected. “Bugger me, Joanne, you did it.”
Joanne laughed. “Was there ever a doubt?” She put her things back in her purse. “I’ll let you know what my analysis turns up.”
Joanne walked past a row of desktop computers and seventeen inch CRT monitors in the Oxford computer lab. Even though it was Saturday morning, Professor Ascroft would be in his office. He was always here on Saturday mornings.
She knocked on his door.
“Ah, good morning Joanne. How is the internship coming along?”
“Professor Ascroft, I need a computer and spare hard drive for a project related to my internship. I may also need your help.”
He leaned back in his chair and crossed his fingers behind his head. “I see. And what might this project entail?”
She told him about the malware she suspected had invaded the Cartillion Construction computers, and then showed him the hard drive in her purse. “I have an image of the hard drive from one of their computers and I wish to copy it to a spare system here and closely inspect it.”
“Yes. I think we can arrange for a system to do that. I presume you’ll want to connect it to a DMZ network so it’s isolated from systems here but can still interact with the internet.”
“Yes, of course. Thank you.”
If you find anything of significance, I should think you’d want to write a paper about it.”
“I hadn’t thought of that.”
“It would be a feather in Oxford’s cap to find and eradicate a computer virus in England’s most important construction company.”
“Perhaps. But Sir Patel instructed me not to take any action on this.”
“Ah. That is a bit of a sticky wicket then, isn’t it.”
“Yes. I’ve already violated his instructions by copying Poppy’s hard drive.”
“Well then, let’s see what we can uncover and then we’ll decide what to do about it. Perhaps I’ll have a conversation with Sir Patel myself about this.”
“Thank you, Professor.”
“Please, call me William. William Ascroft, at your service.”
Joanne paused. “Ah. Well then, thank you, prof– um, William.”
After installing an empty hard drive in one of the lab computers, Joanne imaged her hard drive with the contents of Poppy’s computer onto the fresh hard drive inside the lab computer. She ensured it was not connected to the network, booted it, and watched it install several drivers. It came up a few minutes later, missing a few USB devices, but fully functional.
Joanne installed Process Explorer, Autoruns, and other tools from the Windows Sysinternals package and went to work. By lunchtime, she found two suspicious programs. One was a user task named Windows Search Assistant, the other was a kernel driver calling itself BIOS Updater. She smiled. Nice touch, naming malicious software modules after important functions.
The netstat program showed the “Windows Search Assistant” interacting with that same Chinese IP Address. Joanne killed it, and then watched it restart a few seconds later and reconnect to China. The kernel driver probably watched the user task and restarted it if it disappeared.
They had talked about kernel drivers and viruses in one of her classes, but watching it all in action made her spine tingle. She could remove the driver and user mode programs by booting into safe mode and deleting them, but first she needed to find out more. How did they get onto Cartillion’s systems? What information did they access? How did they propagate? What else did they do? And for that, she needed to look at the source code, which meant she needed a way to decompile them. Not something they taught in undergraduate computer science compiler classes.
Eighteen hours later, after trying Windbg and at least half a dozen freeware tools, all with glowing reviews from community support forums, all she had to show for her efforts was a headache. As the sun rose over London to the east, she stumbled through the computer lab, past system after system performing a Saphas virus scan, to her dorm room for some sleep.
There was something about the Saphas virus scan. With Saphas just seven miles south in Abingdon, Oxford and Saphas had forged a partnership. Saphas used Oxford as a research facility and beta test site, in return for free antivirus protection. But why was the normal Sunday morning virus scan special?
Joanne’s world went black the second her head hit her pillow.
Dreams and Inspiration
Joanne faced a whiteboard filled with notes and flow diagrams in the Cartillion conference room.
A child’s voice behind her said, “It should be obvious, shouldn’t it?”
Joanne turned. “Who are you?”
“Poppy is my mum. You made me stay with my father last night.”
“Don’t be. But if a child like me knows the answer to your question, surely you can figure it out.”
Sir Patel stepped in front of the child. “It’s not your fault. Your brain doesn’t have the equipment to make you a true engineer. You’re just a girl. You should give up your slot at Oxford for a deserving young man and go have a baby.
“But . . .”
“No buts. If you had what it takes, you would have already solved your problem.”
She stood in the middle of the computer lab, watching the virus scans progress.
“How does the antivirus software know what a virus looks like?” Poppy asked. Now, Joanne was next to Poppy at the Cartillion receptionist desk.
“By comparing what’s on the system to virus signatures.”
“And how do they determine virus signatures?”
Joanne’s eyes popped open. Of course! She lifted her head and an anvil pounded her brain into mush. Probably a dehydration headache. Or maybe jet-lag. Probably some of both. It was noon and she was starving. She chuckled. Which sent waves of pain through her head. That’s what happens when you forget about time in front of the keyboard for eighteen hours. She needed water and food. But first, she needed to make a phone call.
“Saphas technical support, my name is Darren. What is your customer ID, please?” The voice on the phone sounded Australian.
Joanne downed a swig of water. “I don’t know. But I’m here at Oxford University and I hope you can help me analyze a virus sample.”
“Ah. Oxford. In the UK? Our corporate headquarters is near you, you know.”
“Yes, I know. And my professors say we have a partnership. Are you in the headquarters building?”
“No, love, I’m in Oz, down under. But if you’d like to send us your virus sample, we’ll have a look at it.”
“Yes. Thank you. I spent all night trying to decompile it without success.”
“I’m afraid decompiling these things is somewhat of an art form. But we do it every day here. It’s how we keep our signatures up to date.”
“Yes, I just realized that. How do I do send this to you?”
Darren gave Joanne a URL and credentials for an upload site. Joanne began uploading and told Darren how she came into contact with these virus samples.
“I also have a disk image of the system where these two images came from. Perhaps I could drive it to the headquarters building.”
“One step at a time. Let me get this to our researchers and let’s see what we’ve got. It’s fortunate Sunday overnights are usually slow.”
“What time is it there?”
“Well, let’s see. Not quite 1 A.M. Happy Monday.”
“Still Sunday here.”
After trading contact information, Joanne and Darren finished the call and Joanne found some food. This would be another long day.
Three hours later, she saw an email from Darren.
You came across something of significance. I alerted our incident response
team and we would very much like to see the disk image from the infected
system you found. If you're willing, please do bring your hard drive to our
office in Abingdon, where our team will make a copy for analysis. They'll
be expecting you. Ask for Paula.
One hour later, Joanne stood at the Saphas Antivirus main entrance and dialed Paula’s number from Darren’s email. Paula met her at the door a minute later.
After shaking hands, Paula said, “Darren and I talked extensively about your malware sample. Your suspicions were correct. It scours every directory to which the system it’s running on has access, scoops up all spreadsheets and documents, compresses them, and sends them to China. The SSL connections you saw in your network logs were the data transfers. Who is the end-user customer, and what other background can you give us?
Joanne filled her in on what she found and what she had done so far.
“What should I do next?”
“You can certainly tell the manager of your audit firm you uncovered a find of significance. All of England, and maybe the Americans too, may owe you a debt of gratitude. Thank you for bringing this to us. This hard drive image will take a few minutes to copy. Why don’t I show you around while we wait?”
“I would like that. Thank you.”
After the tour and copy finished, Joanne and Paula stood at the main entrance, in front of a darkened Sunday afternoon receptionist desk.
“Thank you for the tour.”
“Thank you for sharing this information with us. Your managers and your customer should be grateful for what you uncovered. Be sure to alert them, and we’ll be in touch.”
Joanne called Poppy before driving back to Oxford. “Hello. I’m unable to answer right now, so please leave a message and I’ll return your call shortly.”
“Poppy, this is Joanne. I have both wonderful and horrifying news. I found the offending programs on your computer and went to Saphas Antivirus to help decompile them. We did find something of significance, and we need to warn everyone in your company about it. I have classes in the morning and I’ll be in your office tomorrow afternoon.”
Security guards met Joanne at the Cartillion main entrance when she arrived after lunch.
“Where is Poppy?”
“Ms. Thane is no longer affiliated with this organization,” one of the guards said. “Come with us, please.”
They escorted her to her makeshift office in the conference room, one guard in front, one behind, and one beside her. Roger Harris, Sir George Patel, and another man in a suit were waiting.
“What’s this?” Joanne asked.
“Joanne, we understand you did some work with Cartillion’s receptionist, one Poppy Thane on Friday after work, ” Harris said.
“Yes. After I noticed an unusual pattern of network traffic with China, I suspected malicious software was rampant in this network and I asked Poppy’s assistance to help find it. We imaged her computer Friday after work and I spent the weekend analyzing it. I found two malicious files and shared them with Saphas Antivirus to decompile. The engineers at Saphas confirmed my suspicion. The Chinese have compromised many systems here and are stealing your secrets as we speak.”
“Why was this intern, this young girl, allowed access into our systems?” Mr. Suit asked. “When I agreed to allow her into this audit, you promised you would manage her and she would have no access into our systems. You said her purpose on the team was only to peruse certain log information and report on their contents. And yet, somehow, you allowed her to persuade our former receptionist to share intimate details of our operation, not only with her, but with God-only-knows who else?”
“Why is she your former receptionist?”
“Not that I need to justify my decisions to you, but as of this morning, Ms. Thane is no longer employed with this firm. Because of you, Ms. Gittens, she exposed our entire company to any number of confidentiality breaches. You have done incalculable damage to our operations, and Ms. Thane paid a price for your incompetence. Sir Patel, what in God’s name convinced you to send this, this female intern to do a man’s job?”
“Sir, the network logs you asked me to peruse found several systems interacting with China…”
“Of course they interact with China. We’re bidding on contracts with the Chinese and trading emails and specifications all the time. Not that it’s any business of an intern. Sir Patel, I will sue your firm for every pound of revenue you’ve ever generated unless you return by the end of the day today with non-disclosure agreements signed from everyone who had access to our data.”
“That doesn’t explain . . .”
“I want this intern off my company’s property. Immediately.”
Patel spoke next. “On behalf of our entire company, I want to apologize to both you personally and Cartillion overall for our oversight in not adequately supervising our intern. I promise you, we will immediately reevaluate our policies around how we use interns. Roger, would you please escort Ms. Gittens to our office? I’ll catch up with you shortly.”
Harris gestured toward the door. Joanne stood and faced Mr. Suit. “Your explanation does not match the network traffic I analyzed, nor does it match . . .”
“Get out of my conference room and off my company’s property. Now.”
Joanne stood her ground. “You are putting British soldiers and my brother at risk. If my brother comes to harm–“
Harris wrapped his hand around Joanne’s mouth and pulled her out the door. Joanne resisted. Two security guards grabbed her arms and legs and carried her down the hall, through the receptionist area, and out to the parking lot.
Mr. Suit followed. “If she tries to re-enter the building, call the police.”
Harris and the security guards put Joanne on her feet in the parking lot and escorted her to her car.
“He’s wrong. Doing business with China does not explain the network pattern I saw, and does not explain why those programs all across the company were interacting with a website with no DNS entry.”
“Get in your car and drive away,” Harris said. “Our temporary office for this audit is at the Westin. We’ll talk about your future with our firm in my hotel room, room number four-seventeen.”
“Are you blind? He is allowing Chinese attackers to steal information over the internet.”
“We’ll discuss it at the hotel.”
“Joanne, please come in.” Harris was in his socks. His tie was loose.
“I’m uncomfortable coming into your hotel room.”
I invited you here because I know your heart was in the right place, and I want to help rescue your career. Commuting back and forth from London is much too burdensome, conference rooms are difficult to book, and so this is my temporary office.” He gestured to the desk in front of the bed. “Please, come in and sit.”
Joanne poked her head in. Harris’s suit jacket was draped over the bed, next to an open briefcase. For all practical purposes, the room looked like an office. Yes, with a bed, but then private offices often have couches. What’s the difference?
“I do have another meeting soon and I’ll need a minute to freshen up.”
She entered and sat at the desk in front of the bed. Harris sat opposite her.
“You made quite the scene. Why did you ignore my instructions?”
“Because they’re putting all of England and my own brother at risk. And Poppy’s brother.”
“Did you not stop to think we may have presented this issue properly with Cartillion’s management?”
Joanne pounded the table. “I needed to gather more information.”
“And your action cost Cartillion’s receptionist her job.”
“I can’t believe they fired her. Is there a place in our firm for her?”
“I’m afraid not. It would represent a conflict of interest. But we need to discuss your future. I can see you’re upset.” Harris walked behind Joanne and put his hands on her shoulders.”
“What are you doing?”
“This may help relieve the tension.” He massaged her shoulders.
Joanne stood and shook Harris’s hands off her shoulders. “Mr. Harris, this is inappropriate.” She turned to face him.
He moved the chair away, put his arms around her waist, and drew her close. “We need to focus on your career. If you help me, I can help you rescue it.”
Joanne stomped on his toe. Harris jumped back and reached for his toe. Joanne punched his face. Harris stumbled and crashed against the back wall. He scrambled to his feet while Joanne ran out the door.
Joanne slammed the door behind her and paused in the hallway. What just happened? I can’t believe he did that! She shivered and ran to the elevator. A man on the other end of the hallway walked toward her. She turned and ran to the other end of the hall and down the stairs.
At the first floor, she stopped and composed herself. She took a deep breath and walked into the first floor hallway. The walls surrounded her like a prison. She shivered again. Eyes behind every closed door watched her pass. Her head said this was paranoia, but her heart only pounded harder. She sped away, fighting tears.
As she entered the front lobby, people waiting for elevators followed her with their eyes. Passing the front desk, people in front, behind, and all around gawked. Joanne Gittens, the fool. Everyone could see it. She wrapped her arms around her body and hurried through the revolving front door and out into the parking lot. She pulled her car keys from her purse and dropped them on the pavement in front of her car. Her hands shook. Holding the keys in both hands, she fumbled with the lock. She finally unlocked the car and climbed into the driver’s seat.
She slammed the car door shut and closed her eyes. Thousands of people surrounded her car and pointed. Some laughed. Others shook their heads. “First you destroyed Poppy’s job, and then you led on your manager. What’s wrong with you?” The whole world knew, and they were all staring. And commenting. And laughing. She opened her eyes. The parking lot was filled with empty cars. And one elderly couple a few rows away climbing into a vehicle. She drove away.
“This is rubbish.” Sir George Patel stood and paced. “I mean, look at her. She should be serving coffee or having babies at home. Leave the work to someone who knows what they’re doing. I don’t know what possessed me to accept her as an intern on my team.”
Joanne folded her arms more tightly around her stomach and tried to press herself into her chair and disappear. Professor Ascroft sat next to her. Roger Harris, still sporting a black eye a week after the hotel incident, sat opposite her. Kevin Bruley, Oxford Dean of Students, and Percy Filmore, HR representative from the audit firm, were also at the table in a conference room adjacent to the Dean’s office on campus.
“Sir Patel,” Dean Bruley said, “I assure you, Oxford University values our relationship with your firm, and we wish to resolve this matter as quickly and quietly as possible. However, when one of our students alleges inappropriate behavior, we must investigate. I’m sure you understand.”
Patel sighed and sat.
Filmore spoke next. “Ms. Gittens, isn’t it possible you misread the situation? It was a stressful time, and your supervisor says he was just trying to comfort you.”
Joanne’s stomach churned. “By assaulting me? And insisting that having a physical relationship with him would save my internship?”
“Will somebody please teach this girl how to address her supervisor in a civilized manner?” thundered Patel. “Roger, what do you have to say for yourself?”
Harris faced Joanne. “First, I am truly sorry you misinterpreted my attempts to comfort you during this stressful period. I only wish the best for you, but you simply cannot traipse about and deck your supervisor in a business setting because a difficult customer situation upset you. It is inappropriate.”
“What do you call wrapping your arms around my waist and trying to pressure me into sex, Mr. Harris? Is that appropriate?”
“I did no such thing.” Harris looked at Patel. “As I’ve stated repeatedly, I came around to her side of the table, put my hand on her shoulder and tried to tell her we would look for another assignment to finish her internship. The next thing I knew, she turned and punched me.”
“Why did you invite her to your hotel room?” Ascroft asked. “Why not any number of conference rooms your firm used at the hotel?”
“With hindsight, yes, I should have used one of the conference rooms. I do apologize for that. I use my hotel room as a working office and invite people up there frequently. It saves time from coordinating meetings in a conference room on a different floor. Still, this was a lapse in judgement when meeting with a young, female intern, and I do apologize for it.”
Dean Bruley spoke next. “And so, Mr. Harris, your version of events says you did nothing to imply or even hint at anything inappropriate. You were trying to console an upset female, she misinterpreted your actions, and gave you a black eye?”
“And Ms. Gittens, your version of events says he tried to assault you, and you defended yourself, is that correct?”
Joanne fought tears. “Yes.”
“Well, then, we have a conundrum. He said, she said. How shall we resolve it?”
After a few seconds, Filmore spoke up. “Perhaps we should treat the matter as if nothing happened. Of course, we must terminate our relationship with Ms. Gittens, and we need to discuss guidelines for future internship opportunities we may offer. Perhaps allowing young women into such stressful situations is inappropriate.”
“You can’t be serious,” Ascroft said. “This young woman demonstrated initiative by spending her weekend uncovering a particularly nasty piece of malicious software. She did you a service.”
“Is that what you call it?” asked Patel. “She disobeyed my explicit instructions, she put our entire relationship with our client at risk, she punched one of my managers in the face and gave him a black eye, and now she tries to cover it up with a wild accusation against one of the most respected managers in our firm. Yes, I’d say she demonstrated quite a bit of initiative. Ms. Gittens, you should be the one charged with assault. My manager has to face his family every day and explain why a female intern chose to punch him in the face. Lucky for you, his disfigurement is not permanent.”
Joanne’s face flushed. Who does he think he is? She stood and glared at Patel, and then turned to Harris. “Be thankful, Mr. Harris, that I did not damage your ability to produce children. Try anything like that with me again and I’ll injure more than just your eye.”
Patel rolled his eyes.
“And that goes for you too, Mister Patel.”
“Mind your cheek, Ms. Gittens.” Bruley said.
Joanne stepped toward Patel. Ascroft raised a hand and caught Joanne’s attention. She stopped. “Somebody should put their foot up his–.” She took a breath. “But not me.”
All eyes turned to Dean Bruley. “Mr. Filmore, Mr. Harris, Sir Patel, gentlemen, thank you for your time. Would you wait in the corridor for me? I need to have a word with Ms. Gittens.”
Filmore, Harris, and Patel left the room.
“Please sit, Ms. Gittens,”
Bruley continued. “I am shocked and disappointed by what I’ve heard here today. I can understand and even applaud an intern who takes initiative and demonstrates a desire to succeed. However, you went too far. We covered this in your tutorial. Every student who chooses an internship for school credit must generate positive performance reports from said internship. If not, Oxford University simply cannot give you credit. It’s a pity, but losing this internship credit means you will be unable to graduate with your class.”
Joanne looked down, wiping away tears.
“Dean Bruley,” Professor Ascroft said, “surely, we can find a way to work this out. Ms. Gittens has been nothing short of exemplary in her career at Oxford. Are there no options?”
“There are always options. She can apply next fall to repeat her senior year if she wishes. Another internship is out of the question, but she should be able to earn enough credits to graduate with traditional class work.”
“Dean Bruley,” asked Joanne, “why do they get off scott-free and I suffer consequences? That man enticed me into his hotel room under false pretenses and then tried to assault me.”
“Perhaps he did. I have no way to tell. I do know Roger Harris is a respected manager in one of the premier London audit firms. Why didn’t you suggest a more appropriate business setting than his hotel room?”
“What difference would it have made?” Ascroft asked. “Whether she was alone with him in a conference room or a hotel room, same result.”
“Perhaps. But a young woman visiting the hotel room of an out-of-town businessman leaves too many opportunities for the wrong impression. Ms. Gittens, what were you wearing that day?”
Joanne gritted her teeth. “Blue jeans and a shirt, why?”
“Are you sure you weren’t wearing anything, um, provocative?”
“No. Of course not. And even if I was, what of it?”
“Well, it’s just that what we wear sends a message. And especially women, need to be careful with their wardrobes so they don’t send the wrong message.”
Joanne stood. “I sent no such message. That man suggested that he would take care of my career if I took care of him sexually. He is a monster and should be imprisoned.”
“He is a respected manager and a married man with children.”
After a few seconds, Professor Ascroft stood. “Perhaps we should turn our attention to helping Ms. Gittens finish her education with us.”
“Ms. Gittens has embarrassed this university. She violated our code of conduct and crossed an ethical line in her internship. Her record will reflect this conclusion. She is suspended the rest of this school year and not welcome on our campus until next fall. Since she cannot finish her classes, her record will reflect failing grades as well as an unsatisfactory internship.”
Ascroft extended his arms. “Kevin, no.”
“William, I am not without compassion. Ms. Gittens, I offer you a choice. I will allow you to withdraw from the university on your own. Call it a family emergency or whatever you wish to save face. I will withdraw you from your classes, and the official record will state you skipped this school year for personal reasons. Or the university can suspend you and the official record can reflect that suspension and its consequences. What is your decision?”
“I . . .”
“I need to smooth relations with members of our business community waiting in the hall. You and your faculty advisor can discuss this while I’m outside. Perhaps Professor Ascroft will earn his pay today and persuade you to make the smart choice.”
The man at the far corner of the bar finished his beer. He was obviously drunk. And upset. Joanne watched him as she picked up empty drink glasses and wiped down tables. The television above his head showed a replay of George W. Bush delivering his second inaugural address. A few patrons around the pub glanced at the screen; most just continued with their after work happy hour.
Joanne worked her way down the bar to the drunk man. A tactic the senior bartender had taught her; never approach a drunk aggressively.
“May I take that glass, sir?”
“Aye. And bring me another.”
“Perhaps you’ve had enough. May I bring you some coffee?”
The man shook his head.
Joanne set his glass in a tub. “Tell me your troubles. Perhaps talking about it will help.”
The man looked up and chuckled. “Nah. Why does a pretty girl like you work in a dump like this?”
Joanne laughed. “It was I who asked you to tell me your troubles, not the other way around.”
“Tell ya what. You tell me yours, and then maybe I’ll tell you mine. How’s that?”
Joanne smiled. “Fair enough. I was forced to withdraw from Oxford University almost two years ago, and now I’m working to earn enough money to finish my education. Now your turn.”
The man shook his head. “Ah. The tribulations of youth. And why were you forced to withdraw?”
It was Joanne’s turn to look down. “Because during an internship, I refused a certain manager who wanted to have his way with me.” She smiled. “I understand it took a month for the black eye I gave him to heal.”
“So, you’re tougher than you look, then. Tending bar suits you.”
“I don’t know about that. Tending bar isn’t so bad. But I would rather be diagnosing computer problems, or testing computer networks for vulnerabilities.”
“Smart, tough, and good-looking. Not a bad combination.”
Joanne nodded. “And now, your turn.”
“I’m afraid my troubles are more of the adult nature. A little girl such as yourself would likely not understand.”
“I see.” Joanne removed her hairpin. Her blonde hair fell to her shoulders. “In that case, hand me your car keys.”
“You heard me, hand me your car keys. Maybe I’ll reward you if you do.” She unbuttoned the top button on her blouse.
The man smiled. He reached into his pocket and showed his keys to Joanne. “And what would that reward be?”
She leaned toward him. “Hand me the keys and find out.”
He laughed and gave her his keys.
Joanne turned away. “James, would you hang these on the wall, please?” The proprietor, senior bartender, HR Director, and nightime janitor smiled. Joanne nodded and smiled back. James took the keys and hung them high on the wall behind the bar.
Joanne buttoned her blouse and put her hair back up. She turned back to the man. “And now, your reward. James is calling you a cab. In the morning, your car will be right where you left it and you can come pick it up. Or if you have somebody at home tonight, we can have the cab pick them up and bring them here to drive you home.”
James laughed after the cab picked up the man. “I’ve seen you do that one thousand times, and it never gets old.”
“You taught me well.”
“Yes, I did, but you add a certain flair to it. It’s an art form, it truly is.”
“Come sit with me, please.” James gestured to a table where two other men sat.
“But who will watch the bar?”
“It will watch itself for next few minutes. Please. come sit.”
Joanne sat next to James, across from the two men.
“Joanne Gittens, please meet Greg Corbyn and Oliver Campbell. These gentlemen work for a company in Abingdon, I believe you’re familiar with. Saphas Antivirus. They wish to discuss some things with you.”
James nodded. “I’ll leave you to it. That bar isn’t going watch itself, you know.”
“Joanne, these gentlemen are customers and they’ve requested some time with you. Talk to them for a few minutes and then you and I will talk later.” James walked back behind the bar.
Joanne faced the two men. “Very well, how may I help you?”
Oliver pursed his lips. “I was wondering if you could tell me what would happen if I set up a server with multiple default gateways?”
“Chaos, of course. Setting up a system with multiple default gateways is nonsensical. For the life of me, I don’t know why any operating system even allows it.”
Bot men glanced at each other and nodded.
Greg was next. “James told us about how you handled a recent computer incident here at the pub. Would you care to tell us about it?”
“A recent computer incident; I’m not sure what you mean.”
“Apparently, you handled a malicious software infection.”
“Oh. I would hardly call that an incident. I spoke with James several months ago about about setting up a website to advertise our pub, and he needed an email service for people to contact him. We set up the website, and it’s amazing how many people around the world could find a pub in Oxford, England. I told James, perhaps we can use that notoriety to become a tourist destination. Well, somebody, claiming to represent James’ bank sent an email about a funds transfer, and James opened the attachment before I could stop him. I cleaned his computer. But I didn’t know the infection also contained a trojan horse until all that malicious software came back the next day. I dug deeper and found the reference in the Windows registry and removed it. Along with two kernel drivers and a user mode program.”
“Did James suffer any lasting consequences?”
“No. I made sure he contacted his bank and changed all his passwords. The bank gave him a new checking account number. I guess that’s a lasting consequence because he had to pay for new checks. But it was minor.”
“How did you know the computer was clean after you worked on it?”
“I believe Saphas offers a free virus scan service. I used it, and I also scanned with another one. And I spent most of a night booting and scanning it three times. I also checked
each time. It’s clean.”
“What about HKEY_LOCAL_USER?”
“Of course. And also the run_once keys.”
“Why three times?”
“Because most trojans manipulate those startup keys, so the computer doesn’t start behaving badly until the next boot. And three times in case there was something else behind those startup keys I may have missed.”
“Did you save the programs?”
“Of course. I copied them to a USB stick, and labeled it so I never launch those executables.”
“Some day, I may wish to try and disassemble them. I don’t have money for a lab at present, but maybe I can use the lab at university when I get back in.”
Oliver and Greg exchanged glances again. Greg nodded.
Oliver responded with a nod after a few seconds.”I’ve heard enough. Joanne, a few of us regularly play squash with James, and one day last week, the conversation turned to computer viruses. James mentioned an exceptionally bright bartender he’d hired and told a story about how you’d cleaned his computer. Although his telling was not nearly as detailed as yours.”
“We’re looking for technical support analysts,” Greg said. “And we offer a tuition reimbursement program for people interested in continuing their education. Would you be interested in applying for the job?
Joanne’s eyes widened. Her jaw dropped as she tried to blink away tears. James approached the table. She jumped to her feet and hugged him.
“Ah, well then, I assume the conversation went well.”
“I, I don’t know what to say.”
“Perhaps, start with yes,” James said.
“Are we doing happy hour in James’ pub tonight?” one of Joanne’s coworkers IMed to her group.
Joanne responded. “I can’t tonight. But give James my regards. I need to look into something.”
She re-read the email forwarded to her from an American named Jerry Barkley. He had found a malware infection that looked like it might be a variation of Stuxnet, the attack the Americans and Israelis never admitted launching against Iran. The antivirus industry discovered it in 2010, and everyone knew sooner or later, variations would surface. If this American was telling the truth, and his report looked credible, then Iran might be striking back. She needed to follow up.
She looked again at her inspiration shelf in her work cubicle. First was her picture, smiling with James, two weeks after meeting the men from Saphas and her last day as a bartender. Next to that was her brother’s wedding photo from 2006. He looked handsome in his British Marine uniform.
Next to her brother’s photo was a ziplock bag with an old computer hard drive inside. Behind it were two laminated newspaper articles from the London Financial Times late in 2005. One headline said, “Construction magnate indicted for treason.” The other said, “London audit firm rocked by management sex scandal.”
Note to readers
Thanks for reading my short story.
One of the first questions my wife asked after I made her read this story was, “What happened to Poppy?”
Good question. Joanne persuaded Poppy to help her break the rules and her actions had consequences. Considering the stakes, did Joanne do the right thing? This might be a good conversation for an ethics class.
Joanne Gittens is a minor character in my novel, Virus Bomb. But her backstory matches what’s been on my mind since James Damore wrote his infamous memo about women in tech in the summer of 2017, Google’s Ideological Echo Chamber. Damore’s memo ignited a firestorm of criticism across the internet, and Google eventually fired him.
It was a sad chapter for tolerance and inclusion on any side of the issue. But as a middle-aged bald guy from Minnesota, the whole episode also made me wonder if I carry any unconscious bias against women in the tech workplace.
After mulling it over, I don’t think so. I’m willing to sit down with anyone and talk about it, and if I hear a persuasive argument, I might modify my opinion. But first, anyone who suggests there are no biological differences between men and women doesn’t know what they’re talking about. Women carry babies. Men don’t. That’s not politics, it’s biology.
And sexism – well, it has no place in the tech or any other industry. I remember talking about sexism in the workplace back in corporate diversity training in the 1980s. I figured HR departments around the world had come up with ways to eliminate it. Kudos to the #meToo movement for showing me how wrong I was. Let’s hope it sticks this time.
And finally, here is a 2017 Chicago Tribune article I ran across from Megan McArdle. She started in the tech industry and switched to journalism. I like what she had to say on the subject.
These are early notes I used to develop Joanne Gittens’ character. I kept them to show how characters evolve with stories.
Joanne Gittens is a senior at Oxford University and interning for an auditing/consulting company. She’s on an IT security audit team, looking for vulnerabilities in a bank’s IT system. She finds a juicy vulnerability, but nobody believes her. After all, she’s a female intern. The only reason she’s here at all is a quota. She takes initiative, exposes a cyberattack in progress, and shuts it down.
After it’s all over, a senior manager invites her to lunch in his top floor office suite. He offers her a promotion and says he enjoys her company and is looking forward to more. He makes a move on her. She decks him and gives him a black eye. The manager spreads ugly rumors about her and she eventually has to leave.
Nobody wants to hire her; she’s a female and the company where she interned won’t give her a reference. With no where else to turn, and with student loans to pay and struggling parents, she gets a job as a waitress in a local pub to pay support herself. Instead of nailing computer viruses, she’s slinging beer. But she also oversees upgrading the restaurant’s POS system.
Saphas Antivirus’s world headquarters is in Abingdon Science Park, just down the street, and Saphas support engineers like to stop here for lunch and on the way home. She waits on a few regulars and gets to know them. She overhears a conversation about a nasty malware infection just reported; it’s spreading fast and will soon shut down millions of systems across the internet. But their top analysts are out sick today and they’re struggling trying to understand it.
She finds a copy of the virus in the wild by visiting a compromised website from a virtual machine and purposely “clicking here.” It’s every bit as bad as the researchers said. She disassembles it herself and studies the code. She finds a software “kill switch.” If it finds a domain name of a group of random-looking characters, it erases itself.
She spends 20 pounds and buys the domain name. She sets up a whois record and the malware on her computer eventually kills itself.
The researchers who frequent her pub find out and invite her to apply for a job. She applies, they hire her.
6 months later, she reads an article about how another audit company scooped up the audit/consulting firm where she interned for pennies on the pound after an insider trading scandal forced out the top management team.
Later, an email comes in with an interesting virus sample from an American named Jerry Barkley.
She worked at ***?, solved a tough tech problem. Senior manager offered her a promotion and then made a move on her. She decked him; gave him a black eye. The manager spread ugly rumors about her and she eventually had to leave.
Nobody wants to hire her; she gets a job as a waitress to pay bills. She happens to wait on some managers from Saphas AV and overhears a conversation and offers good advice.
They eventually invite her to apply for a job. She applies, they hire her.
6 months later, she reads an article about how the manager from ***? was arrested in an insider trading case and ***? declared bankruptcy.