Don’t say anything to Steven, Sarah reminded herself. Don’t breathe a word. Just gaze vacantly toward your screen as if you’re waiting for something to happen. Watch, and listen. She heard his approach, the jingling of his keys, the drawer opening and slamming shut, the click of the laptop settling into its docking station. Now, concentrate. Start.
His habit of using the full-size desktop keyboard, from a standing position, made the task that much easier, Sarah mused. Not easy, but not quite impossible. Seated, he would be all but invisible, and the flat pad of the laptop was almost silent. But there was his login ID clattering in, and his left hand at the top of the screen; then the capital, and bang-bang-bang-bang-bang-bang-bang, the alphas before the first numeric. Two more alphas, number-alpha-number-alpha. Fifteen characters in total. Sarah told herself not to think about calculating the number of combinations. She touched the Stop button of her phone’s Voice Recorder app.
The phone on Steven’s desk rang, and after an initial dismissive glance he answered it. “Yeah, hi, Jakob. Yes, I can. Two minutes.” With pursed lips he locked the screen again, then abruptly left.
Sarah rehearsed the attitude of Steven’s arm as he hit the keys, mostly one-fingered. The capital was one of those on the left, probably from the top row. Could he have used a special character? Unlikely, she thought. There might even be a rule against it. She could confirm that independently if necessary. And a long word, or more than one? No, it had to be just one. Spaces and hyphens were invalid, specifically forbidden, and an underscore would require the awkward shifting operation again. One long, memorable word, with numbers substituted for three letters. I’m practically there, she said to herself. She already had two sound recordings of the process. Hurry back and let me hear it again.
It was a devious scheme indeed. Someone was not just constantly amending the horrible Transfer code, they were doing it in plain sight, in full view of anyone who knew how to look. The trick was that nobody did know how to look. A number of standard Repository functions had been subverted to look like one thing while doing another; in particular, any request to read or update the Transfer module was treated differently from other calls. Sarah and Jakob had verified this much indirectly, comparing the elapsed times with the progress bars and measuring the file sizes. There was no two ways about it. All those CheckOut and CheckIn requests, even the Views, were taking more than twice as long to execute as they had a right to. Something was happening to the Transfer code on its way out from and back to the Repository.
Steven had been the Team Lead for implementing the Code Repository.
Could there be a separate, secret Repository? With a hidden door, a clandestine interconnecting passage, that nobody but Steven knew anything about? It was almost beyond belief. But Jakob had been around at the time it all happened, and knew that none of the contractors had lasted beyond the end of the project. Many had not made it even that far. One had actually died, after a Friday night drinking session that got out of hand. “Nothing suspicious,” Jakob assured her, “just contractors being their usual selves.” Sarah was unconvinced.
And their indirect evidence, while circumstantially convincing to themselves, was no proof at all of misdemeanour, far less of anyone’s guilt. They needed hard corroboration, and needed to obtain it without Steven’s knowledge. His laptop was the obvious place to look: physically available, thanks to Sarah’s finding the spare key, but still cybernetically secure. For now.
Steven returned to his desk wearing his favourite superior half-grin. “Compliance,” he snorted to anyone within earshot. “Bunch of tossers.” He did not elaborate. Sarah bit her tongue and touched Start again.
It was fascinating and exhilarating to be spending time with Jakob, all the more so because it was Saturday morning and they were in his flat. Sarah watched as he loaded her recordings into the visualisation software and lined them up. The waveforms were remarkably similar: Steven’s six-character ID — “d9zetx,” said Sarah, “everyone knows that” — followed after a gap by that long password.
“Good,” Jakob said, “now we can start to calibrate the model.” He split the six-character substring into its components and began sliding the first along the length of another long string that represented his own typing of every key on Steven’s keyboard. “They’re very similar,” he admitted. “This could be difficult.”
“Automate it,” Sarah told him. “That’s how the pros do it. May I?” She eased him aside and started typing. “What do we want, best-match, all probables? Let’s start with anything over 90%.” Jakob smiled admiration as she took over what amounted to project design and execution. “There.” A display started scrolling upwards.
It was soon completed. “D or F; nothing; Z or X; an E; R or T or Y; Z or X or C,” Jakob read out. “How does that compare?”
“Not bad,” Sarah enthused. “It’s a shame the number doesn’t match at all. But the E is right, and the rest are all in the ranges.” She looked up at him, eyes shining. “We can do this!”
“It’s still three hundred and sixty combinations,” Jakob sighed. “For the password it’s between two-to-the-fifteen and three-to-the-fifteen. A needle in a haystack. We’ll need a lot of luck.”
“We’ll need to be good at guessing,” Sarah said. “And you know who’s the best guesser I know?” She paused, sure of his full attention. “I am.”
There were fifteen occupied columns on the spreadsheet. At the top, a few rows contained all the probable matches for each character in Steven’s password. Apart from the E in position 6, every letter column had several entries. The three numerics were blank. “How many, really?” Jakob asked as Sarah worked on the formula that would concatenate the characters into words.
Sarah tapped the screen in front of her. “This can cope with over a million rows,” she said brightly. “Enough to be going on with.” She dragged the formula cell and watched it accelerate downwards, then found herself yawning. “I’ve been at this too long,” she said, looking around herself. “Excuse me.” Still holding down the mouse button with one hand, she used the other to pull the pin that held the knot in her hair, and tossed her head to shake it out.
Her hair flowed like water, reaching well below the back of her seat, nearly to the floor. “Wow,” Jakob said. “You’re like Rapunzel.”
“Who?”
“Rapunzel. You know, Rapunzel,” Jakob said, enunciating carefully. “In the fairytale.”
“Don’t know it,” Sarah said, shaking her head slightly. Water flowed like silk.
“How can you not know about Rapunzel?” Jakob was clearly astonished, if not disbelieving. “She’s imprisoned in a tower, grows her hair and lets it down for a prince to climb up.”
“That’s a fairytale? Sounds a bit naughty.”
Jakob stopped. “Well, I suppose it is, but… didn’t you ever read it, or have anyone tell it to you? When you were a kid?”
“Never,” Sarah confirmed. “Father’s never been one for tales, and neither have I.” She felt an urge to explain. “My mother died when I was tiny. There was just my father and me, in a cottage out on the flats, miles from our nearest neighbour. No grandparents.”
“But you read, surely?”
“I read everything in the house,” Sarah told him. “Over and over. Mostly that meant my mother’s old programming manuals.” She leaned back, remembering. “I was writing IBM-360 Assembler when I was seven. Shame I didn’t have anything to run it on.”
“No children’s storybooks?”
“There was something called The Cat In The Hat that was supposed to be a storybook. It was an illustration of infinite and converging series.” The scrolling display slowed, and Sarah released the mouse. “You fancy making us some coffee?”
Over steaming mugs they considered the long list of meaningless character-strings. Few looked anything like words. “Maybe we should just pull all the fifteen-letter words out of the dictionary,” Jakob suggested. “See which ones match our patterns.”
“Now you’re talking!” Sarah exclaimed. “Where’s a good online dictionary?”
[End of part 3. Part 4 continues:
]
