Cyber Knights 1.0

1

Richard Graham never looked forward to spending his evenings in a hospital, sitting about in a room that was as inviting as the waiting area of a train station, while trying to make small talk with a woman whose mind was long gone. As he battled his way home through the late-afternoon traffic, he thought about how, had he had any choice in the matter, a real choice, he would have stayed home with the children. Unfortunately, like so much in his life, he didn’t.

As he had for the past two weeks, as soon as they had finished their dinner, Richard Graham had driven his wife to pay a visit to her mother, a woman who had all but made the private Kirkland Hospital her second home. It wasn’t as if Graham was henpecked. Ellen, his wife, wasn’t the nagging sort. Her weapon of choice was silence, which at times could be just as annoying, not to mention unnerving. At least in a stand-up, no-holds-barred argument, Richard had a chance of figuring out what he’d done to piss her off.

Pausing outside the room where Ellen was entertaining her mother by telling her what the children were up to, how she had spent the day, and rendering her version of the latest family gossip that was going around, Graham took a moment to glance at his watch. Although he expected he wouldn’t be missed if he held back going in just a little longer, standing about in the corridor was even less inviting than sitting about listening to a fresh rendition of the same chatter he heard every evening. Besides, the nurse at the desk at the end of the corridor kept looking over at him, sporting what he took to be a questioning stare, one that was starting to make him nervous. Deciding there was no point in putting off making an appearance now that he’d finished checking his e-mails and delaying his return for as long as he dared, Graham drew himself up before manfully pushing open the door and entering his mother-in-law’s private room.

Looking over her shoulder when she heard the door open, Ellen Graham smiled. “Ah, there you are. I was beginning to wonder if I needed to dispatch a search party.”

“Um, sorry,” Richard muttered sheepishly as he glanced between his wife and his mother-in-law, both of whom were wearing smiles that were disturbingly similar. For a brief moment, he stood there, rooted to the spot as he found himself wondering if, over the course of time, the woman he had married would eventually look like the decrepit wretch in the bed, the one who had not only come to dominate their lives but was beginning to put an intolerable strain on his relationship with Ellen.

Coming to her feet, Ellen took up her purse from the nightstand next to her mother’s bed and made for the door. “I’ve so got to use the loo,” she muttered as she made her way past Graham. “Do be a dear and keep an eye on Mother.”

Before he could ask why Helen Walton, a woman who was hooked up to monitors and IV drips rendering her as helpless as a newborn, needed to be watched, his wife was gone, leaving him standing there like the hapless dupe he imagined he was quickly becoming.

From her bed, Helen looked over at Graham and gave him that smile, the one that was beginning to irk him. “How are the children?” she asked.

Though he had little doubt Ellen had already gone over every conceivable detail of what their children had done in the past twenty-four hours, Graham saw he had no choice but to tell the old woman again. With a sigh, he made his way over to the chair his wife had vacated, sat down, and pitched into his account with as much enthusiasm as he could, which, at the moment, wasn’t much.

Just as she was about to enter the clinic, Anna Morgan, the head night nurse, found she was forced to jump back, lest she be smacked in the face by the clinic’s door that a man had brusquely shoved open. He was followed by a woman who was snapping at his heels. Without missing a beat, the woman, whom Anna recognized as being the daughter of Helen Walton, took up a running argument the pair had obviously been engaged in before leaving the building. “She’s my mother, you self-centered bastard,” the woman barked without breaking stride. “Dear God, she’ll be gone soon enough.”

Having heard and seen it all before, Anna didn’t need to wait to hear how the man responded. Someone, she snickered as she stepped up to the door and entered the clinic, was going to be spending a cold, lonely night on the sofa.

After checking in with the head nurse currently on duty, Anna made straight for the pharmacist’s office. It was the first of the month, the day when all the passwords to the hospital’s computer systems were changed. She’d need to retrieve the unique password Christine Alsop had assigned her for the month, one that would allow her to access the spreadsheet where all the dosages for their patients’ medications and the schedule by which they needed to be administered were recorded.

Upon finding the door to Christine’s office unlocked, Anna shook her head and chuckled. In the morning, she’d have to remind the woman she needed to be more careful, lest the hospital administrator, a retired Royal Army Medical Corps officer, cited her for being lax with security again. Finding the lock to the lower left-hand desk drawer had been jimmied didn’t come as a surprise, either. Besides holding paper copies of all medications the current patients required, it was where Christine locked her purse away during the day when she was working in the clinic’s pharmacy. No doubt, Anna told herself, the woman had up and lost yet another key. Fortunately, the pharmacist, a woman who was otherwise a perfectly switched-on professional, would need to go to someone else to replace the lock.

After taking a seat in the pharmacist’s chair and pulling the drawer out, Anna leaned over as far as she could before reaching deep into the opening. Ever so carefully, she took to feeling about the rear of the drawer with her fingertips, wrapping them over the rear panel until they lit upon a Post-it note stuck to the back of it. Taking great care, Anna removed it, sat up, and read the password scribbled on it, pleased the pharmacist had taken her time to write it out, rather than using the illegible scrawl she so often used when jotting out prescriptions. When Anna was sure she had it memorized, she took her time replacing it and ensuring it had stuck before sliding the drawer back in place and heading out to relieve the evening nurse.

Hours later, the earsplitting squawk of a cardiac monitor shattered the early morning silence. As if jolted by an electric shock, Anna Morgan and the auxiliary nurse with her all but leaped out of their seats. The flashing of a light above the door and the rapid blinking of the computer screen told them the patient in room six, a fortyish gentleman of Arabic persuasion, was in cardiac arrest.

They didn’t waste any time wondering how an otherwise fit man who was recovering from surgery to piece together a compound fracture had managed to slip into cardiac arrest. That was not their concern; keeping him alive was.

Coming to their feet, the two nurses were about to take off at a run when two more monitor alarms began to sound. Realizing there was no way they could handle the unprecedented emergency they were faced with, Anna ordered the auxiliary to call for every able-bodied person on duty to report to their floor stat.

Anna didn’t waste any time trying to work out the whys or hows of the situation she had to deal with. Her entire being was focused on making the decisions many medical professionals have nightmares over but few ever have to face. What she did appreciate was that in the next few seconds, she would need to decide which patient she would go to first and who would have to wait. It was a decision she knew could very well turn out to be a death sentence to those Anna did not choose, but there it was. All she could do was what she was trained to do as best she could, as quickly as she could.

For Helen Walton, Anna Morgan’s best simply was not good enough.

2

As he rounded the bend of the jogging track, Andy Webb smiled to himself when he realized his timing, as it was more often than not, was pitch perfect. Slowing his pace the second he spotted the tall redhead with a lean runner’s physique, he did his best to pretend he wasn’t eyeing the woman as she went about finishing up her stretching. The redhead knew he was watching her. And he knew she knew. But it was a game both enjoyed as evidenced by the bright smile and wink she flashed him as she stood upright before turning and setting off at an leisurely pace, one she increased bit by bit as she settled into a well-measured stride.

Ever a sucker for a girl with red hair, Andy picked up his pace to match hers as he gamely followed the bobbing red ponytail, mesmerized by the way it fluttered gaily about in rhythm with the girl’s hips, arms, and legs. The idea of actually catching up with the woman and chatting her up had never entered his mind. To have done so would have spoiled the game for both of them. As they did each time they “happened” upon each other, the two runners simply settled into a comfortable pace, engaging in a harmless spot of fun, the kind most people would never understand and even fewer would be able to appreciate.

On this day, Andy’s pursuit of happiness was short lived, for a unique ringtone that was as annoying as it was unwelcome set his iPhone squawking. The idea of not answering, of ignoring the call from a man who had a maddening habit of ringing him up at the damnedest of times and continuing along the shaded jogging path in pursuit of a fluttering red ponytail was tempting, but it was one Andy was unable to give in to. Slowing his pace to a walk, he veered off the jogging track while smoothly pulling the mobile out of the little holster that was nestled in the small of his back. It was in the exact same spot where he had once hidden his Walther P5K when the people he was chasing were not quite as alluring as the redhead who was now moving farther and farther out of sight.

Mashing down on the Talk button, Andy brought the phone up to his ear. “This had better be good, mate. Otherwise, you’re in for it.”

“Interrupting something important?” Edward Telford asked, trying to make his question sound as innocent as he could but failing miserably.

“No, not really,” Andy replied, making no effort to check the disappointment he felt as he lost sight of his redhead.

“Well, if that’s the case, how about meeting me at the usual spot?” Telford shot back.

“I will, provided you pay for lunch.”

“Andy, dear boy, must I remind you I am a poor civil servant, a pathetic wage slave who labors away on what is for a prosperous entrepreneur like yourself little more than pocket change?”

“Save those crocodile tears for someone who gives a damn about your pitiful lot in life, Edward. Give me an hour.”

“An hour it is.”

With that, Telford rang off, leaving Andy standing off on the side of the jogging track looking off in the distance to where the redhead had disappeared. “Oh well,” he muttered to himself before turning away. “There’s always tomorrow.”

Despite his need to shower, change, and slog his way across London to the small pub just off of Whitehall, Andy was there at the appointed hour and well into his first pint by the time Edward Telford wandered in like he had all the time in the world. Looking up at the six-foot-four career civil servant, Andy grunted. “You do realize you’ve been on the clock for the past ten minutes.”

“Um, let’s see,” Telford mused as he averted his gaze upward while doing some math in his head. “Assuming you bother to work a full eight hours like normal human beings do, at eight hundred a day, that’s a hundred an hour, which means I owe you a tad over sixteen pounds fifty.”

Pulling back, Andy furrowed his brow. “You’re forgetting I’m not a desperate corporate flak who’s trying to make a quota you can bargain down with your slick talk and threats to go elsewhere. It’s eleven hundred a day and a favor, nonnegotiable.”

Staring across the small table, Telford sighed. “Has anyone ever told you you’re a cruel, heartless bastard?”

“Yeah, you,” Andy shot back. “Now, what’s so bloody important that compelled you to drag me all the way over here?”

“Are you familiar with the alleged mercy killings that took place over at Kirkland Hospital earlier this week?” Telford asked as he took the drink delivered to him without his needing to place an order.

“How can anyone who’s still drawing breath not know about the Home Counties’ very own Angel of Death,” Andy muttered in disgust. “You’d think there wasn’t anything else going on in the world besides that. What’s that got to do with you, and why have you called me away from something I was in the process of running to ground?”

Ignoring his friend’s comment, Telford proceeded to explain. “The chief administrator of the clinic is an old friend of mine, a retired RAMC officer I met in Ireland. You might know him — Kyle Lewis.”

“You forget, unlike you, I never had any need to bother with anyone associated with that lot. The whole bunch of them do nothing all day but hang out with sick people and look after eager young subalterns who haven’t got the sense to duck when they’re being shot at.”

“I’ll have you know I was ducking at the time.” Telford sniffed. “The bastard who shot me was behind me.”

“That’ll teach you to pay attention to what’s going on all about you.” Andy snickered.

“If you don’t mind, could we get back to the issue at hand? I’d rather like to keep the outrageous cost of your services down by avoiding any useless chatter or painful trips down memory lane.”

After sharing a chuckle with Andy, Telford continued. “As I was saying, Lewis is convinced the nurse the police are pinning the deaths on at his hospital is innocent. She claims she administered the prescribed dosages of medication called for by the schedule the pharmacist had left for her. Unfortunately, the toxicology reports for all the victims tell an entirely different story. None of the levels found in any of them even comes close to what the pharmacist had prescribed.”

“Well, that’s an easy one, Sherlock,” Andy replied dismissively. “I am assuming the clinic has a centralized computer system that records and tracks all the care each patient receives, including a schedule of medications.”

“Naturally,” Telford replied as he eased back and took a sip of his drink. “Unfortunately for Anna Morgan, the so-called Angel of Death, when the police checked the system’s audit logs, they found everything was spot on. The dosages of medications in the computer file matched those the pharmacist had prescribed.”

“Who checked out the system?” Andy asked.

Knowing his friend was going to ask this question, Telford reached into his pocket, pulled out his mobile, and scrolled down to the notes he’d made. “A detective sergeant by the name of Marbury, Hannah Marbury of the Yard’s computer crimes unit.”

Upon hearing this, Andy grunted before taking a sip of his pint as he mulled something over in his head. “She’s good. I imagine if there was something to be found in the system, she would have found it.”

“Lewis thinks otherwise,” Telford countered. “He believes his nurse’s story. That’s why he asked me if I knew someone who could take a look at the system and see if the police somehow missed something.”

Without any need to give the matter a whit of thought, Andy nodded. “I have just the person who can find any glitches in a system like that, provided there is one.”

“Please tell me it’s not that odious little dwarf of yours,” Telford moaned as he set his drink down. “Lewis runs a respectable hospital that caters to an extremely exclusive clientele, who right now he’s fighting very hard to keep.”

“Not to worry, mate,” Andy replied with a cheeky grin. “Karen Spencer is as respectable and discreet as can be. She’s what the Americans call a military brat. Her father is a retired U.S. Air Force colonel who works for Symantec. She used to, as well, until I poached her from them.”

Satisfied, after placing their order with a waiter without bothering to consult a menu both knew by heart, Telford gave Andy all the details he would need to get started.

Pleased to find no one in the Calico Row office she shared with Andy Webb and Tommy Tyler, Karen Spencer decided this was as good a time as any to do something she’d been itching to do for days. Snatching up the trash bin next to her desk, she carefully sneaked across the floor toward Tommy’s desk even though she was alone. Once there, she began to clear away the trash and clutter her coworker merrily accumulated all about his workstation and on the floor around it.

Doing so was no easy task, for not all the crumpled pieces of paper were rubbish. Some were notes Tommy wrote to himself in an indecipherable code and handwriting only he understood. Then there were the unidentifiable sticky bits that caused Spencer, whom Andy and Tommy called Spence, to wrinkle her nose in disgust as she was picking them up with the very tips of her fingers. How anyone could stand being surrounded by such a mess, let alone do anything productive in its midst, was beyond her. The only thing she was thankful for was her boss, a man who reminded her in so many ways of her father and who was like her when it came to neatness and organization.

She wasn’t quite finished when a voice from across the room startled her. “You know, Tommy is going to be royally pissed when he’s seen what you’ve been up to.”

Jumping even as she was spinning about to face Andy, who was standing in the open doorway, Spence scrambled to hide the nearly full rubbish bin behind her back. “I wasn’t doing anything,” she stammered in a high-pitched voice that betrayed both surprise and guilt.

Andy said nothing. He had no need to. His half smile and the look he gave the youngest member of Century Consulting was enough. It reminded Spence of the look her father gave her whenever he caught her in the midst of violating any of the rules he imposed upon her in a well-meaning but often stifling effort to raise her without the benefit of a mother or anything resembling a stable home life as they wandered the globe from one posting to the next.

Determined to finish what she’d started, consequences be damned, Spence went back to carefully picking through the clutter Tommy Tyler nested in, clearing away as much as she could as quickly as she could, for he would not be nearly as forgiving as Andy had been if he found her disturbing the unique, if somewhat hideous, ecosystem he found comforting.

For his part, Andy made no effort to stop the fastidious young woman wearing a frumpy gray Keep Calm and Carry On T-shirt from finishing her self-appointed task. Besides appreciating the fact it saved him from having to badger Tommy into doing it himself, Andy enjoyed watching the sparks fly whenever his two employees, who were rapidly becoming more family than subordinates, went at it like a pair of Kilkenny cats. Though he never dwelled on it, he appreciated they were the closest thing to children he would ever have, so he enjoyed their antics as a father would whenever the opportunity to do so came his way.

Only when she was finished clearing away as much as she dared and while she was washing her hands at the small sink set in a counter where they kept their tea, biscuits, and such did Andy inform her he had a new mission for her.

“I’m not quite finished translating that programmer’s guide from geek-speak to English yet,” she replied as she gave her hands a quick shake over the sink before toweling them off.

“That can wait. Besides, this shouldn’t take all that long,” Andy added as he watched Spence saunter back over to her desk and flop down into her chair with an ungainliness he found to be lamentable when he saw it in a young woman who had as much going for her as Spence did.

Setting that sad thought aside, Andy went on to the matter at hand. “The chief administrator of Kirkland Hospital has asked if we would do a top-to-bottom security inspection of his facility’s IT system. You’re to pay particular attention to those workstations and devices that are used to manage medications.”

“Anything in particular I’m looking for?” Spence asked innocently.

Holding her in a steady gaze for a moment, Andy found himself wondering if she was being serious or simply winding him up. Only an appreciation that Karen Spencer was not in the habit of joking when discussing a case kept him from responding with a flippant comment. “Kyle Lewis, the chief administrator, believes the woman the media has taken to calling the Angel of Death is innocent.”

“Innocent of what?”

This time, Andy simply couldn’t help himself. “Seriously, Spence, don’t you pay the least bit of attention to the news?”

“No. Should I?”

Rather than waste his time responding to her reply, Andy simply filled her in on all the background information he felt she would need, including the names of the members of Metropolitan Police’s Computer Crimes unit who’d conducted the initial investigation. “I don’t expect they missed anything, but one can never be sure,” he concluded. “When dealing with such things—”

“I know, I know,” Spence muttered before Andy was able to finish reciting one of the innumerable bits of wisdom he routinely peppered her with. “Two sets of eyes are better than one.” At least he’s using English today, she told herself as she set about gathering up what she’d need to take with her, and not Latin as he so often tends to when offering up what he considers sage advice.

3

Spence did not head over to the hospital straight off. Instead, after giving Detective Sergeant Marbury a quick call, she made her way to the New Scotland Yard building where the Met’s Police Central eCrime Unit, or PCeU, was based.

“I gather you’ve been brought in to conduct a security review of their system,” Hannah Marbury said as she nodded to Spence and handed her a mug of what the Metropolitan Police liked to pretend was tea. “My boss was not in the least bit pleased to be leaned on by the Home Office, but I guess with all those well-heeled foreign patients at Kirkland, it should have come as no surprise.”

She paused and smiled at the young woman she had first met at a British Computer Society meeting on “The Forensic Challenges of Steganography,” where the two of them had been the only ones still awake by the end of the presentation. They had struck up a companionable relationship right off, for Spence reminded Hannah of herself when she was just starting out as a young constable, and Spence saw in Hannah the sort of self-assured and successful professional woman she would love to be.

“Just as well I didn’t tell him you and I knew each other,” Hannah added. She took another sip of her tea and grimaced. “God, this is awful. How do you fancy a nice cuppa ’round the corner?”

“As I’m on expenses, that sounds good to me.” Spence grinned at the thought of Andy having to sign off her claim for a full afternoon tea at the very posh St. Ermin’s Hotel as the two women dumped their mugs and grabbed their bags.

An hour later, over a very elegant china cup of Earl Grey and an equally indulgent chocolate éclair, Marbury finally opened up about what she’d done to find out if there was any truth in the story the night nurse persisted in clinging to despite the evidence.

“She claims she followed the prescribed dosages to the letter,” Hannah explained before taking another bite while trying to keep the cream oozing out of the éclair from dropping down her blouse. “But I went through the audit logs on the SharePoint server — where the master drugs files are held — with a fine-tooth comb,” she continued after taking a moment to savor her sinfully rich pastry. “The master file matched the paper records to a tee. Neither had shown any indication of being altered. The only access made that night to the SharePoint server was from the iPads the medical staff use whilst on duty. The link between it and the system’s mainframe is an encrypted Wi-Fi connection. In order to access the system, the staff have to use two-factor authentication. Then, just to put the cherry on the cake, the whole system is air gapped from the Internet whilst every workstation tablet and laptop all have their USB ports and DVD drives disabled. The whole system and their procedures are pretty damned impressive.”

“So you think she did it?” Spence posed the question even as she herself was beginning to think Nurse Morgan’s alibi was looking decidedly shaky.

DS Marbury sighed. “To be honest, I don’t see any other explanation, and God knows I looked. She’d just come off sick leave for stress. She was breaking up with her boyfriend, and the audit logs showed no changes. It doesn’t take the brains of an archbishop to figure out with all that going on in her life her mind was elsewhere.” DS Marbury sighed again as she recalled all the times when her attention had been diverted by personal problems when she should have been focused on what she was doing. Then, with a shake of her head, she set those thoughts aside before helping herself to another éclair.

Later that afternoon, having learned all she could from Hannah Marbury and with a good idea of what she would be dealing with, Spence finally made her way to the hospital. While she was waiting at the receptionist’s desk for the hospital’s IT specialist to come out and meet her, Spence took a quick look about. Behind the receptionist was a big multifunction printer and a half dozen or so desks with workstations squeezed into an open-plan office space where the hospital’s admin staff worked. Entry into this area was achieved by passing through a secured door with a keypad lock just to the left of the receptionist’s desk.

“There’s no need to waste your time with the computers on the receptionist’s desk or in the admin area,” Marbury had advised Spence. “They’re on an entirely separate virtual local area network. The system used to manage each patient’s medical records, including current meds and prescribed dosages, is completely locked down and also secured in a locked and alarmed server room. The servers are virtualized on clustered blades with daily, weekly, and monthly backups before being transferred onto encrypted tapes for offsite storage. User access to the system is only via thin clients or iPads, so there’s no way to introduce malware, whilst the admins run a three-month patch cycle, but only after running all changes through their test rig.

“As you’ll find, the workstations, as well as the tablets the nurses use, are secured in areas that can be accessed only if you have the code for the electronic lock, which is changed weekly. The tablets themselves are stored in a locked high-security safe that serves as their charging station while all the workstations can only be accessed with the CAC unique to it.”

Though she couldn’t imagine Andy would send her off on a snipe hunt, based on what Marbury had told her, Spence could not discount the possibility her efforts would be a monumental waste of time. Still, she reminded herself as she looked about, she had her marching orders. Besides, even Hannah Marbury confessed in a high-profile case like this one it was best if a second pair of eyes went over what she’d done. “I may be good, but I’m not perfect,” Hannah had confessed as they were finishing their tea. “Not yet, anyway,” she added with a wink and a grin.

Spence was still going over the way in which Marbury had described her approach to the problem and what she would do differently when Liam Stapleton, the hospital’s full-time IT specialist, appeared and introduced himself. “I am at your disposal, Ms. Spencer,” Stapleton informed her with a casualness that struck her as being out of place given the reason she was there. “But before you get started, Mr. Lewis would like to speak to you, if that’s all right with you.”

Never having had the opportunity to handle a case on her own from start to finish, Spence was a little nervous at the prospect of conducting the initial interview with a client. Wishing to make a good impression, as she and Stapleton were waiting outside Kyle Lewis’s office, Spence took a moment to glance at her reflection in the glass of a photo that hung on the wall over the multifunction printer she’d spotted while she’d been waiting. She was in the process of tucking her long hair behind her ear when a very enraged Richard Graham came storming out of the office. He all but pushed Spence out of his way as he barged through the door, stopping only to snarl back through the open doorway into the room he had just left without ever once turning to Spence and apologizing.

“You’ll be hearing from my solicitor, Mr. Lewis!” Graham snapped.

Equally thrown off his game by Graham’s behavior, Stapleton wasted no time in hustling Spence into Lewis’s office once Graham was gone. The only thing that was merciful about the stilted exchange of greetings and introductions that followed was it was brief, leaving Spence free to get on with doing what she did best: delving into the inner workings of a computer network.

For the next two days, with Stapleton hovering nervously over her shoulder, Spence waded through reams of policy and design documents, piles of risk and asset registers. This was followed by a review of patch states and change logs, vulnerability scans, and a check of the entire system using aggressive malware detection utilities. Apart from some minor recommendations she shared with Stapleton, when she was finished, Spence had come up with precisely nothing.

More disappointed than frustrated, when she had done all she could think of, Spence slumped down in the seat of the train carriage on the way back to the office, going over in her head everything she had done just to be sure that when she reported the results of her efforts she could do so with a clear conscience. Only the antics of a businessman who was busily tapping out an e-mail on his iPad and a scruffy youth who was equally busily hammering away at his laptop distracted her. Had the boy not kept glancing over at the businessman out of the corner of his eye every now and then before carefully readjusting what appeared to be a tube of Pringles crisps, Spence never would have suspected a thing. As it was, as the train began to pull into her station, she slowly made her way down the carriage past the young man and stole a glimpse at his laptop screen. Yep, she concluded. She was right; he was running a wireless packet sniffer. Satisfied, she continued on until she was alongside the businessman who was still engrossed in his e-mail.

“You’re being hacked,” she muttered softly after tapping his shoe with the toe of her sneaker.

Startled, the businessman looked up at her.

“The boy with the red backpack and laptop halfway down the carriage is monitoring your e-mail,” she said.

Whether the businessman believed her and stopped typing didn’t matter to her. As she had at the hospital, she’d done her best, which was all she could do.

“I’m sorry, Andy; it really looks as if she did it,” Spence lamented. She’d been dreading this moment all afternoon. It didn’t help that Tommy, who was hunched over his desk in the corner as he disassembled yet another perfectly innocent Android device, was doing a piss-poor job of pretending he wasn’t listening in. “Between what Hannah Marbury found and my review of the system’s security, I can’t see any other explanation.”

“You’re absolutely sure?” Andy asked, equally dreading the thought of reporting their results to Kyle Lewis. Notwithstanding a pathological hatred of failing, good customers were hard to come by, and a long-term contract with a private hospital would have been very welcome indeed in the current financial environment. Andy toyed with his pen for a few long moments, putting Spence in mind of her old school principal deciding whether or not her latest escapade required a call to her father. “Tommy? Have you got any ideas?”

Tommy continued to prod at the innards of the hapless device before him even as he spoke. “If Spence said she went through the software and documentation with a microscope, then she did. In theory, it’s locked down tighter than a gnat’s arse.” When he finally did look up, he grinned. “Trouble is, like you, I don’t put much stock in theory. As good as Tinker Bell is, she hasn’t been out in the real world long enough to be as paranoid, twisted, and devious as old buggers like you and me.”

Pausing, Tommy shot a quick glance over at Spence to see how she was reacting to his comments, particularly his use of a nickname he knew she despised. Only when he was sure she wasn’t about to bound up over her desk, rush across the room, and wring his neck did he look back at Andy. “I was thinking it might not be a bad idea if me and her take another look see, provided of course you think it’s worth the effort, boss.”

As much as he hated to undercut Spence, Andy knew Tommy had a point. As a young officer straight out of the commissioning course at Sandhurst, he’d found himself having to swallow his pride more than once when one of his NCOs came up behind him and whispered in his ear that he’d missed something that was obvious to anyone who’d been in the army more than a day.

4

Spence sat slumped over with her forearms resting on her desk while glaring at the monitor. She wanted to keep Andy and Tommy from seeing the scowl on her face as she tried to decide whether to be annoyed or relieved that Andy had sent them back to Kirkland for a second look. It bothered her that despite all she’d done since she’d joined the firm, he still did not have enough confidence in her work. Yet as bad as that was, the idea he would have Tommy, a misogynist SOB if ever there was one, look over what she had done just to be sure she’d not screwed up made things even worse.

She’d done everything at the hospital right. She had no doubt about that. If there had been a glitch in the system or an external hack, she would have found it. She’d told the hospital administrator as much. And yet, despite the care with which she had laid out her findings before him, he still persisted in believing the nurse’s story. About the only bright spot she could come up with was that Tommy would confirm her findings. Maybe then Andy would set aside the doubts about her competence he obviously harbored and have more faith in her in the future.

Lost in thought, Spence was startled when Tommy called out to her from his desk.

“Oye! Tinker Bell, stop daydreaming.”

Sitting upright, Spence gave her head a quick shake before looking over at Tommy. “Uh?”

When he saw the blank expression on her face, he grinned. “I said, get your kit together, girl.”

Wincing when she realized her response hadn’t been the cleverest of replies, she gave her head another quick shake as if to clear away the mental cobwebs. “Why bother now?” she muttered dismissively. “All the IT staff have probably gone for the day.”

Tommy’s grin broadened. “Good. That means we don’t have to put up with a bunch of nosy parkers asking all sorts of stupid questions or getting in our way.” With that, he grabbed a ratty day sack containing his laptop and tools and started for the door, not bothering to look back as he did so to see if she was following. It was only then that Spence realized what he had called her.

“Tinker Bell!” she muttered under her breath as she snatched her laptop carrier that also served as her handbag and headed off after Tommy, who was already out the door. “I’ll strangle that little runt if he calls me that one more time. I swear I will.”

Behind her, Andy kept his face hidden behind his monitor, desperately trying to suppress a broad grin even after Spence slammed the door behind her.

“The problem nowadays is people forget about people,” Tommy opined as he swung his battered old Range Rover into the early evening London traffic with an absolute disregard for anyone else on the road. “They get too focused on their own little piece of the problem, whether it be hardware, software, or procedures. They tend to ignore the fact that there is no such thing as a foolproof security system or protocol since fools are so bloody ingenious.”

Clasping her laptop’s carrier against her chest in an effort to give her hands something to do lest she reach over and throttle Tommy as he tried to wax philosophical, Spence listened in silence as he droned on.

“I’ve found more often than not some lazy bugger who couldn’t be bothered doing what he’s supposed to do always finds a way for getting ’round it,” he continued, even as he was cutting off a chauffeur-driven Mercedes while chopping across two lanes to get onto Vauxhall Bridge, blithely ignoring the horns of at least two outraged drivers whilst Spence reached stealthily for the door handle.

“I’m sure you did a thorough job. Andy’s not the type who’d hire an idiot. But what’s on the system or in the manual ain’t always what’s happening in the real world. For example, did you check the mouse mats?”

It took all her strength to set aside the outrage she felt over Tommy’s last comment in order to respond civilly. “Why should I have checked the mouse mats?” she replied through clenched teeth. “They’ve nothing to do with the system.”

“Oh yes they have, dear girl.” Tommy snickered. “Bet you a fiver that within five minutes of getting there, I will have a log-on and password to the secure system.”

Thoroughly peeved, all Spence could do was gape at his arrogance while ignoring as best she could the way Tommy was throwing his Range Rover around like he was still in a tank. “How?”

“Post-its and mouse mats, girl. The two of ’em are the most dangerous threat to security since the French declared the Ardennes impassable to tanks.” Tommy paused as he took a moment to chuckle to himself at his own joke before turning his attention back to the serious business of scaring the living daylights out of any driver foolish enough to come within fifty yards of him as he pressed on with all the careless recklessness of a hussar charging a battery of Russian guns.

By the time they arrived at the hospital, Spence’s ire had been replaced by an acute feeling of queasiness brought on by Tommy’s driving. Fumbling her way out of the car, all she could do was stand there in the car park, collecting her wits while sucking in deep breaths of the cool night air.

Coming around from his side of vehicle, Tommy didn’t pause as he made for the hospital’s main entrance. “What are you doing standing there like a bleedin’ gork? We ain’t got all night to dillydally about. Now let the dog see the rabbit!”

With a sigh, Spence drew in a deep breath as she stepped off, leading the way to reception. There she pulled out her temporary contractor’s pass and showed it to the young woman at the desk. “We’re doing a follow-up to my earlier work for Mr. Lewis. I brought someone from our specialist team to assist,” she explained while nodding in Tommy’s direction as he prowled around the waiting area. Grudgingly, the receptionist allowed them in.

They’d not gone but a few steps when Tommy dug his elbow into Spence’s ribs.

“See the door?” he muttered while canting his head toward the security door leading to the admin area.

“The security door?”

“Not very secure now, is it?”

Having been caught up in her own thoughts and busy with the receptionist, Spence hadn’t noticed there was a mop and bucket wedging the door open. The sight of it caused her heart to sink as she realized Tommy had proved his point.

Suddenly feeling very uncertain of herself, Spence followed Tommy into the back office where he nodded amiably to a startled cleaner before he took to poking around the desks. “Ha! Bloody told you so,” he exclaimed a few moments later as he waved a mouse mat under her nose. That’s five quid you owe me.”

Spence’s eyes widened in shock at the sight of a Post-it note stuck to the bottom of the mouse pad. She was still trying to come to terms with how anyone could commit such a flagrant breach of the hospital’s security procedures even as Tommy plopped the mouse pad back where he’d found it — minus the Post-it note, which he’d stuck in his pocket — and moved on, poking around behind the various monitors and under the keyboards. After he’d finished his search of the desks, finding another Post-it note in the process, he turned his attention to the big printer at which Spence had stood before on the first day she’d come here. Pulling out a Maglite torch from his pocket, he twisted it on as he pressed himself against the wall the printer was set against in order to look behind it. Within moments, the grin was wiped from his face.

“Oh shit!”

Spence slowly eased up behind him. “What is it?”

Tommy didn’t answer her at first, concentrating instead on moving the printer out a smidge before bending over to take a closer look behind it.

“Tommy, what did you find?”

He still didn’t answer, at least, not her question. Instead, he straightened up and turned toward her wearing an expression that told her the fun and games were at an end. “Call DS Marbury now!”

Even as she was pulling out her phone, Spence eased around to where she could peer over Tommy’s shoulder in an effort to find out what had caught his attention. In the tight beam of the torch he still held focused on the rear of the printer, she could make out a small white stub sticking out of a USB port on the back of the printer. “Is that what I think it is?”

“Yep,” Tommy muttered glumly even as he came to appreciate his task had taken a deadly turn. “It’s a GSM dongle, sure enough, a big fat back door that’s left the whole system swinging wide open in the wind. With that little sucker plugged in, anyone with its phone number can hack the printer. From there it’s a hop, skip, and a cat-five cable to the servers, which is how I expect the bastards managed to hack their way into the medical files. So if you don’t mind, be a good girl and give Marbury a call. Tell her she needs to get her skinny little bum back down here, PDQ.”

The next morning, after making an entrance that would have startled a corpse while sporting a cat-who-got-the-cream grin, Tommy sagged when he saw Spence wasn’t at her desk. “Where’s Tinker Bell?”

Looking up from the report concerning the Kirkland Hospital incident that Karen Spencer must have dropped on his desk after he’d left, Andy frowned. “You know she doesn’t like it when you call her that.”

Tommy’s grin took on new life as he gave Andy a quick wink. “I know.”

Realizing he was hell bent on gloating over the way he had cracked the case, Andy eased back in his seat and watched Tommy as he made his way to a desk that was once more cluttered with a fresh layer of crumpled paper, sticky notes, sweet wrappers, and bits and pieces of computer hardware not even Andy was able to recognize. “I’d wish you would go easy on her,” Andy stated flatly. “She’s new to this twisted little world of cybersecurity that you and I have been dealing with for better than a decade. Given time, I expect she’ll not only be able to keep up with us, she’ll be able to run rings around us.”

Unlike Karen Spencer and — to a degree — Andy, who’d earned his master’s degree in cybersecurity compliments of the Army Reserves, Tommy was a graduate of the school of hard knocks. He’d learned his trade the same way he’d earned his stripes when serving in the Queen’s Dragoon Guards. Like everything else in his life that mattered to him, he’d done it the hard way. That, in his opinion, was the only way someone learned what was important when dealing with the majority of hackers, people who’d never read a book on cybersecurity in their lives. So he was far less willing to cut a novice like Karen Spencer any slack. Naturally, he didn’t tell Andy this. He had no need to since Andy already knew how Tommy felt, which was why he was issuing what, for Andy, was a gentle warning.

Deciding it would not do to start the day off on the wrong foot with the boss, Tommy nodded. “Okay, boss, you got it. Not a word about how I pulled Tinker Bell’s tiny toes out of the fire.”

Rolling his eyes, Andy gave his head a quick shake before going back to Spence’s report. He was more than pleased she’d made it clear that had it not been for Tommy’s suggestion to go back to the hospital and his discovery of the GSM dongle, the poor night nurse would have been rotting in jail. While Tommy would always be Tommy, Andy concluded, at least Karen Spencer was a team player who understood the need to work together, even if doing so required biting one’s tongue from time to time.

5

It was almost a year later when DS Marbury invited Spence to join her in court. Remembering when her first collar was sent down, she knew the younger woman would want to be there the day Richard Graham’s sentence was pronounced. From the back of the crowded courtroom, the two women watched as a somber-faced judge sentenced Graham to life for a crime the judge declared in sonorous terms was “so callous and so unthinkable that all right-minded people shudder. Your lack of remorse, your persistent denials, and an ardent refusal to identify you coconspirators leave me no option but to sentence you to the maximum penalty permitted by law.”

Leaning closer to Spence, Marbury whispered in her ear, “I expect like you, the most frustrating part of my job is I’m seldom able to be here when a little git like Graham is sent down. So whenever I have the opportunity, I damn well make the time to watch when a case like this is wrapped up.”

Spence sighed. “I appreciate you asking me along. I’ve never been involved in anything like this, let alone seeing the face behind the crimes. I expect seeing this can be so… so…”

Only when Marbury realized the young woman next to her was unable to find the right words, words that would not come across as unseemly or inappropriate to describe her feelings, did she finish Spence’s thought. “So glorious?”

Grinning, Spence peeked over at the detective sergeant out of the corner of her eye. “I was actually thinking sad, given what Graham did, but glorious works just as well.”

The two of them were on their way back to New Scotland Yard when Spence glanced at Hannah Marbury, who immediately understood what was behind her young friend’s mischievous little grin. “Tea again?” she asked as she began to grin, as well.

“I don’t see why not. I think we’ve earned it,” Spence replied airily. “Besides, we got a long-term contract with Kirkland last month. I don’t see how Andy could possibly object.”

“I don’t suppose that contract covers the cost of my dry-cleaning bill,” Marbury ventured. “You wouldn’t believe the grief I got the last time you and I had tea when I returned to the office with chocolate smeared on my blouse. To hear my inspector, you’d have thought I’d been nice to a politician.”

“There’s an easy work-around that’ll keep that from happening again,” Spence ventured. When she saw she’d suckered Hannah in, she tilted her head to one side and smiled. “Leave the éclairs alone this time!”

“You cheeky moo!”

They were still chuckling when the tea service arrived, and Hannah took it upon herself to serve them both. “I should be the one buying you tea,” she muttered somewhat shamefacedly. “I don’t know how we missed that dongle.”

“You and me both. I can’t tell you how annoying it is to have Tommy rub my nose in it every time Andy isn’t around. It’s seriously starting to piss me off.”

“You’ve got to give the devil his due. He did find it.”

“I know.” Spence sighed as she took her cup from Hannah. “Still, it irks me no end having to be grateful to an odious, knuckle-dragging Neanderthal like him. That’s the absolute cherry on the cake.”

“Sounds just like my first governor when I’d made detective constable. He was a bitter little jock with no time for women in the service, let alone as a DC.” Hannah paused in recollection for a moment. “I do have to admit, as much as I hate to, that by the time he was invalided out two years later, I’d learned a hell of a lot from that miserable bastard.”

Spence perked up. “How did he get injured?”

“Cirrhosis of the liver, dear. He really was an old-fashioned copper.”

While Spence and DS Marbury were still very carefully negotiating their way through a cream tea, Ellen Graham finally arrived home, for once blissfully deserted by waiting hacks and photographers. After putting the kettle on, she dug out a couple of chocolate digestives, drew the curtains, fixed herself a cuppa, and settled down on the sofa. Only then did she allow a smile to finally touch her lips.

Having played a role that swung from dutiful wife throughout her husband’s trial to an enraged daughter who’d lost the beloved terminally ill mother she’d spent months tending, Ellen Graham was in desperate need of a holiday.

The past few months and her need to keep her wits about her during the twin ordeals of a trial and a funeral had not been easy, she concluded as she pulled an old, battered laptop out from its hidden recess under the sofa, the same laptop she’d used to search for and hire someone to hack into the system at Kirkland Hospital. The hacker had helped her bring to an end both her mother’s suffering and the alarming drain those hospital stays had been putting on the inheritance to which Ellen felt she was entitled. As to setting up a scheme that would allow her to dispose of an annoying husband without the need to endure a messy and contentious divorce, well, that had been a chore she’d managed to take care of all on her own. The idea of using an old GSM dongle Richard had left carelessly lying about, a device she’d taken great care to ensure had his fingerprints on instead of running the risk of purchasing one on her own, had been an absolute stroke of genius.

Having accomplished all she’d set out to do and paid off a man who had helped her solve two insufferable problems in a single stroke, the time had come to book that well-earned holiday she had so been looking forward to. The Greek islands would be nice, she thought to herself as a little smile lit up her face.

GOODNIGHT GRANNY: THE STORY BEHIND THE STORY

This was an easy one. Like so many other aspects of life in the twenty-first century, computers have become an integral part of the medical systems in developed nations. My own medical records, which includes the medications I take and their prescribed dosages, are part of the Veterans Administration database. This allows anyone with access to that database to pull them up, review them, and — if I’m being treated at any one of the 153 VA hospitals, 773 outpatient centers, or 260 vet centers across the United States — refer to them. It is a useful tool, a tool that can be abused for any number of reasons.

During an interview with Dick Cheney on CBS’s 60 Minutes in October 2013, the former vice president candidly admitted one of his greatest fears was that assassins would remotely access the electronic device used to compensate for irregular heart rhythms and assassinate him by altering them. While we did not use this technique to do in dear old Granny, the method of attack we did settle on is just as viable if the hospital and the caregivers responsible for treating patients leave themselves open to manipulation or attack.

As systems become more complex with an ever-increasing number of people having access to a growing number of wired-in electronic devices, the vulnerability of either part of the system or the system as a whole increases. In 2011, there were 5,724 registered hospitals and 4,973 community hospitals in the United States. The next time you visit a hospital, either to visit someone or out of necessity, take a moment to look around and count the number of computers and electronic tablets that are being used by the staff, both medical and administrative. Then, if you have overly active and slightly twisted minds like ours, think of the many ways they can be accessed, manipulated, and altered. Scary, isn’t it?

HAROLD COYLE

GOODNIGHT GRANNY: THE TECHNOLOGY BEHIND THE STORY

We started with the idea that a Sherlock Holmes — type “locked room” mystery could equally apply to a computer system, and the fictional system for Kirkland Hospital could quite easily have been accredited to an international security standard like ISO 27001:2013.

First of all, it’s air gapped — that is, there is absolutely no connection between the hospital’s medical systems and the Internet. The key services are all run on multiple, separate virtual servers, and everything is backed up daily whilst the key systems are all clustered to ensure that even if a server does go down, a replacement kicks in immediately. Patching and upgrades to the operational systems takes place regularly every three months following exhaustive testing in a test environment. All user workstations are locked down so that no one can plug in a USB device, and there are no CD/DVD drives, except under the control of IT. The medical staff all use hospital-provided iPads that connect to a strongly encrypted wireless network. The wireless network itself is kept at deliberately low power so that it can’t be accessed from outside the hospital buildings, let alone the private grounds. Finally, the SharePoint server, containing the file with all the prescriptions, has full audit logging enabled so that any changes to either the server or any of the files on it are captured in a separate secure log within a separate server. On the night in question, there were no unusual entries in the audit log.

So how did our hacker break in and commit murder? As described, the initial attack vector was through one of the hospital’s multifunction printers. Once Ellen Graham had plugged the GSM dongle into the USB port, she let our digital assassin know it was in place. From there, the digital assassin dialed in and compromised the printer (because its firmware hadn’t been upgraded like the rest of the hospital’s IT) and was able to use the wired local area network to find and compromise the main Active Directory (AD) server (because of the three-month delay in the patch cycle). The AD server is pretty much the heart of the network; once you’ve rooted that, you’ve got everything. He then set up a new virtual server (easy enough), recovered the most recent backup of the SharePoint server, and installed it under the name TEST whilst, of course, deliberately messing up all the dosages. Finally, he temporarily swapped the address of the real SharePoint server with the doctored TEST server on the AD server, and Bob’s your uncle. When Anna the nurse logged on, it was recorded on the AD server, which then directed her to the newly renamed TEST server. The wrong dosages were given, and nothing appeared out of place on the real SharePoint Server’s logs.

Thankfully, in real life, nurses and doctors are trained to check and double-check dosages by hand and confirm each other’s work.

Finally, a quick note about the techniques Tommy used when he got to the hospital. Everything he saw I too have seen for real during security audits on equally secure systems. If a human being invents a secure process, it’s as sure as day follows night that someone else will find a way to avoid it and will then tell all his or her friends and colleagues.

And yes, I really hate Post-it notes!

JENNIFER ELLIS