“Does this CDR keep track of who accessed what documents? Is there a log?” Jeremy asked.
“Yes, absolutely,” Mason confirmed. “We have checked the CDR logs for anyone accessing the file in question and there are several names. Sixteen to be exact, who have gained access to that file in the past two weeks.”
“Did you cross-reference those names with the van travelers?” Alex said.
“Yes, just did that this morning, and I think we caught a break,” Mason said, “our first break since this whole mess started. There wasn’t a single name on the first team, the team of six engineers who used the van in the morning, who had accessed any laser cannon documents. That team worked on ballistic systems, not on the laser weapons. That tells me we’re down to one team, the five engineers who used the van right after lunch.”
“Yes, that is a safe assumption to make and one big break,” Alex said smiling, visibly relieved. “I was having serious concerns about my ability to infiltrate two teams.”
“How about sharing?” Jeremy asked. “Can you pull a file, for example, and share the use of it with me, since we’re colleagues on the same floor?”
“N — no,” Mason replied. “Technically, no. It’s against procedure and there isn’t a single reason why someone would risk that type of breach just to save a colleague a trip to the CDR.”
“All right, I think I got it,” Alex said cheerfully, taking another sip of coffee. “Let’s talk copier procedures next. Who gets to copy documents and how’s that controlled?”
“A few years ago we replaced all our copiers with modern equipment that only works if you enter your personal code,” Mason started to explain.
“All copiers?” Jeremy probed, looking up from his notepad where he was jotting notes.
“Yes, all of them. It was a company-wide measure we took to increase the control over the duplication of our secret documents. Before we rolled out the coded copiers, documents were copied freely, sometimes even recklessly, and the risk of leaks was significant. So we controlled the risk with the coded copiers, or at least we thought we did,” Mason summarized, a trace of frustration showing on his immobile face.
“How about faxes?” Alex probed.
“We don’t have traditional faxes anymore, haven’t had them in the building since 2006. These coded copiers handle everything: copying, scanning, faxing — both inbound and outbound.”
“Do you keep a log of users and what they do with the copy machines?” Jeremy wanted to know.
“Yes, there’s a procedure everyone must follow to duplicate or scan any restricted document. Before copying, any restricted document duplication request must be entered in a database, complete with document name, restriction class, number of pages, and reason for duplication. Then an approval is issued. This approval is a numeric code. Then the user goes to the copier and enters his personal access code to unlock the copier, followed by the approval code. Only then, can the user actually copy the document. Once the copy job is finished, the code is invalidated.”
“Are your copiers integrated on your network? Do they communicate with the database of approvals?” Alex asked.
“Yes, precisely so,” Mason confirmed.
“I’m assuming all documents, faxed or copied, are stored in the machine’s memory?”
“Yes, they are. We have a special document security team who pulls random copy and fax jobs and checks the restrictions, access codes, everything.”
“What if someone wants to copy an unrestricted document?” Alex asked.
“Then they only use their personal code.”
“So what keeps the user from copying restricted documents without approvals?” she probed on.
“We have several layers of security to ensure that doesn’t happen. First, the copiers have an OCR system — that’s optical character recognition — that scans each page searching for the classification stamps,” Mason replied.
“Classification stamps, as in TOP SECRET?” Alex asked.
“Yes,” Mason replied. “If the OCR recognizes a classification mark in the absence of an approval code, it will stop the machine and page systems security with the personal access code of the offender who started the copier in the first place.”
“Hmm…” Alex muttered, at a loss for questions. “So, there’s really no way anyone could have copied the damned thing, is there?”
Mason frowned a little, surprised by her choice of words. He was probably not used to anyone swearing in his office. He seemed so proper, so perfect, Alex thought. They all did — all the employees she had encountered, all of them seemed perfectly contained, procedural, almost robotic in their restraint and perfection. Hotheaded and many times slipping an oath here and there, especially when frustrated, she wished she could be more like them. But only on the outside, she thought. I’d suffocate if I had to live like this, think like this, act like this all the time. Brrr… She almost shuddered. I wonder if there’s something brewing under these perfect images of professionalism.
“No, there’s not,” he said quietly.
“Huh?”
“Just responding to your comment,” Mason said politely, “there’s no way that document could have been copied without us knowing about it.”
“And yet it was,” Sam said his first words that morning. “How else could that have happened?”
Silence took over the small office; no one had an answer to that.
“Before we attempt to answer that million-dollar question, here’s another one, much easier,” Alex said. “When the fleet manager found the document, everyone knew instantly it wasn’t an authorized copy. How did they all know that?”
“Oh, that’s simple,” Mason replied. “When the copier duplicates a restricted document under an approval code, it automatically prints the word ‘copy’ faded in the background of the document — a watermark — and the approval code at the bottom of each page. So if we see a document that has a classification in black and white, without being marked as an approved, registered copy, we know immediately that stamp was run through a copier without proper authorization. That’s how we knew.”
“Ingenious,” she said. “Pretty thorough and very secure, I’ll give you that.”
“Then what scenarios make sense for unauthorized copies? How could someone copy a file in this building?” Sam asked.
“No one enters the premises with any cameras or personal phones. We have lockers on the main floor where employees have to leave their personal gadgets during the day. Then they are screened, just like in an airport. Nothing makes it in.”
“Maybe you have a hacker in your midst, someone who could have overridden the copier’s configuration; that’s one scenario,” Alex offered. “I’ll ask Louie how hard that would be.”
Sam nodded. “That’s a good idea,” he confirmed.
“Who’s Louie?” Jeremy asked.
“He works with me, at The Agency,” Alex replied. “I’ll also ask him if it could have been done remotely.”
“I’ve also tasked a security team to inspect every office, closet, restroom, and conference room in this building,” Mason said.
“Looking for what?” Alex said.
“Not sure, some forgotten piece of equipment, maybe. I might be overreaching, but it’s a big building,” Mason said apologetically, seeing the reaction on their faces. “We have more than 6,000 employees; we have a lot of offices.”
“That could spook your spook, pardon the pun,” she said.
“True,” Mason agreed. “I’ll instruct them to go easy and be careful.”
“No,” Alex said abruptly. “Ask them to wear insignia and protective wear with your pest control vendor’s markings, and leave some spider traps here and there.”