The Art of Deception_ Controlling the Human Element of Security - Kevin D. Mitnick [78]
Yes, he said, that was fine. He took down my name, department, and extension number and said he’d take care of it.
We drove up to the gate a little after two, I gave Tom Stilton’s name, and a sleepy guard just pointed to the door we should go in and where I should park.
When we walked into the building, there was another guard station in the lobby, with the usual book for after-hours sign-ins. I told the guard I had a report that needed to be ready in the morning, and this friend of mine wanted to see the plant. “He’s crazy about helicopters,” I said. “Thinks he wants to learn to pilot one.” He asked me for my badge. I reached into a pocket, then patted around and said I must have left it in car; I’ll go get it. I said, “It’ll take about ten minutes.” He said, “Never mind, it’s okay, just sign in.”
Walking down that production line—what a gas. Until that tree-trunk of a Leroy stopped us.
In the security office, I figured somebody who didn’t really belong would look nervous and frightened. When things get tight, I just start sounding like I’m really steamed. Like I’m really who I claimed to be and it’s annoying they don’t believe me.
When they started talking about maybe they should call the lady I said was my boss and went to get her home phone number from the computer, I stood there thinking, “Good time to just make a break for it.” But there was that parking-lot gate—even if we got out of the building, they’d close the gate and we’d never make it out.
When Leroy called the lady who was Stilton’s boss and then gave me the phone, the lady started shouting at me “Who is this, who are you!” and I just kept on talking like we were having a nice conversation, and then hung up.
How long does it take to find somebody who can give you a company phone number in the middle of the night? I figured we had less than fifteen minutes to get out of there before that lady was ringing the security office and putting a bug in their ears.
We got out of there as fast as we could without looking like we were in a hurry. Sure was glad when the guy at the gate just waved us through.
Analyzing the Con
It’s worth noting that in the real incident this story is based on, the intruders actually were teenagers. The intrusion was a lark, just to see if they could get away with it. But if it was so easy for a pair of teenagers, it would have been even easier for adult thieves, industrial spies, or terrorists.
How did three experienced security officers allow a pair of intruders to just walk away? And not just any intruders, but a pair so young that any reasonable person should have been very suspicious?
Leroy was appropriately suspicious, at first. He was correct in taking them to the Security Office, and in questioning the guy who called himself Tom Stilton and checking the names and phone numbers he gave. He was certainly correct in making the phone call to the supervisor.
But in the end he was taken in by the young man’s air of confidence and indignation. It wasn’t the behavior he would expect from a thief or intruder—only a real employee would have acted that way ... or so he assumed. Leroy should have been trained to count on solid identification, not perceptions.
Why wasn’t he more suspicious when the young man hung up the phone without handing it back so Leroy could hear the confirmation directly from Judy Underwood and receive her assurance that the kid had a reason for being in the plant so late at night?
Leroy was taken in by a ruse so bold that it should have been obvious. But consider the moment from his perspective: a high-school graduate, concerned for his job, uncertain whether he might get in trouble for bothering a company manager for the second time in the middle of the night. If you had been in his shoes, would you have made the follow-up call?
But of course, a second phone call wasn’t the only possible action. What else could the security guard have done?
Even before placing the phone call, he could have asked both of the pair to show some kind of picture identification; they drove to the plant, so at least