Showing posts with label digital detective. Show all posts
Showing posts with label digital detective. Show all posts

24 October 2021

The Digital Detective, Wall Street part 4


When corporations upgrade large computer systems, they typically run the old and the new in parallel a few weeks or months until the bugs are shaken out. Occasionally events take a turn as discussed last week.

Mutual Admiration Society

Back in New York, our mutual funds firm (not so fondly referred to as MuFu) faced a different problem. They had completely rewritten the primary application, changing over from Cobol to C, and it hadn’t gone well. Four months after parallel commenced, they were experiencing glitches and crashes.

The sizeOf problem I’d caught wasn’t a contributing cause. An unidentified problem was triggering errors, an oversight so simple it would boggle the mind.

Robert, their very defensive senior C expert, hadn’t told me about a front-end program written by yet another programmer. I had to figure that out for myself. The bug wasn’t in the program they’d assigned me; it was introduced by what came before.

Front end and Back end Processing
Front end and Back end Processing

As previously mentioned, Cobol reads like English and C… well, C is sometimes great and often horrible. C had become the most recent fad and application programmers were feeling the bite of its double edge sword.

The staff was comprised of university C students and the last Cobol member on her way out. Machine language (and assembler) weren’t in their purview and when they dismissed John, ‘the old guy’, they'd rid themselves of their only person who could poke around in memory (RAM) to determine what went wrong.

And memory was a problem. The program used customer numbers to index into a table and reference records in storage… in theory. In practice, I soon learned the customer was occasionally wrong, wildly wrong, trying to access a memory location off in the wilds of Kansas.

Cobol could detect out-of-bounds matrix subscripts; C could not. Thus it took me a little while to figure out the bogus account code was coming from a front end program. That preprocessor queued submitted entries, performed minor verification with a check digit, converted the input to binary, and passed the record on to the back-end program I first investigated.

In short, sometimes the data entry folks included dashes in the account number (e.g, 7654321-1) and sometimes they didn't. The Cobol app extracted only the digits; the C program didn’t. Both programs tentatively vouched for the account number (7654321) using the check digit (1), indicating it resided in the realm of possible valid numbers. Unfortunately, the newly written C routine included the hyphen when attempting to convert the number to binary. Both versions then ‘piped’ (passed along) the massaged data to the back-end program where hell and fury would erupt when a bad number with the mashed-up hyphen was passed along.

For all the grief it caused, correcting the C front end was trivial. Worryingly, the front-end program, instead of creating the transaction serial number, left that task for the back-end program. Bad, bad, error-prone design. And, as I would discover, prone to manipulation.

I returned the program to service and turned my attention back to the mysterious ‘sizeOf’ conundrum.

Faith, Hope, and Charity

Many organizations buy into mutual funds for long term storage of their money. City, county, and state governments store tax revenues, fines and fees there. Churches and charities divide money between money market and mutual funds.

In the mutual funds program, a template field labeled IRS501C was data-typed binary in the old Cobol Record data division and as boolean in the matching C Struct.

When I returned to the section with the anomalous ‘sizeOf’ routine, I could see this field being referenced, but I didn’t know why. A library search for original source code for sizeOf and the parent routines turned up nothing.

Growing more suspicious, I asked operations to dig through their archives and find the code. “Don't hold your breath,” they said.

Next day, the IT director gave me the conference room to spread out my work. I mapped binary instruction after instruction, recreating an assembler code version of the program. C could fool the eye, but machine code, even in the absence of context, revealed details of what was going on– if I could figure it out.

I constructed charts of data structures, trying to figure out what was taking place. At last when I spotted buried instructions trimming fractions of a cent from daily interests earned, I knew I’d stumbled upon skulduggery.

Figuring out the sleight-of-hand was mind-bending, but I got a break. Like so many magic tricks, the chicanery was breathtakingly simple. Only the surface artifice was complex.

I had accumulated a suite of experimental data to test extremes of the system. It contained only a dozen records but I noticed the audit log reported thirteen. What? A record with a proper transaction serial number had materialized like a magic trick.

As mentioned previously, the front-end processor should have been creating the transaction serial number, not the back end, but apparently no one here knew better. That oversight facilitated the deception, allowing crooked code to create records undetected.

Computer hours were reduced that day. Being the first of the quarter, month-end and quarter-end reports took priority. Idling, I suddenly wondered if month-end had anything to do with the mysterious symptoms I was witnessing. Once again I nagged operations about searching archives for source code.

An hour later found me wrestling with that data cleverly hidden beyond the end-of-data marker. An impatient operator slapped a cartridge on my work table. "Try this," he said.

Former employee John had made a rare oversight. He’d deleted the source files, but… Each evening, operations backed up everything, and that included John’s source code. It filled in gaps.

No comments, of course, but lo, I beheld the twisted mind of a criminal genius. The routines were rife with indirection and misdirection. The ‘sizeOf’ trick merely hinted at the scam iceberg. While the obfuscated C code suggested one thing, the meticulous machine instructions I’d decoded step by step helped me understand what was really happening.

The scheme launched from a database record under MuFu’s own name and address, 100 Maiden Lane. The registered agent was listed as K. King, address 103rd floor, 350 Fifth Avenue, Manhattan, New York 10118. Midtown… I looked it up… Empire State Building. The street address was legitimate, but 103rd floor?

interest truncation example

Greed Kills

The charlatan routine skimmed thousandths of a cent or so following rounding errors– interest and binary-to-decimal trailing digits after rounding high. On average, the algorithm could have siphoned a quarter of a cent per transaction without setting off alarms, but our sneaky programmer apparently wanted to stay well below nets cast by auditors. Those fractions of a penny accumulated in the bogus MuFu self-owned bucket until the end of the month. Dollars– thousands of them– and been created out of thin air.

I fully expected John’s wife or a friend had opened another account to receive the transfers, but as I traced the code, it invoked a random number generator to index into an entry in the hidden part of the file, just one binary field,  which turned out to be an account number. At month end, the subversive routine transferred out between $1200 to $5000 a month from the bogus MuFu in-house account to the account selected by the random number generator. But why only certain accounts? What was special about them? How was John profiting?

As always, I sat outside on the ferry shielded by a bulkhead. As I started at the lights of Brooklyn, the answer hit me, knocking sleep out of the equation. I rode the ferry back.

With suppressed excitement, I extracted the account numbers and checked the first indicated record. Bingo. And the next one. And the next. And then the 20th and the 100th. Bingo, bingo. Every case showed the IRS501C non-profit tag.

Damnation. I’d unmasked a freaking Robin Hood. John– or should one say Little John– was stochastically selecting non-profit accounts to donate to. That generated the thirteenth record.

Fascinatingly, the audit trail reinforced the fraud’s legitimacy rather than exposed it. Only a paper trail might suggest a missing document, but who was going to dig through reams of flattened dead trees?

If United Way or Scouting USA or Bethune Cookman read their statements at the end of the month, they might have scratched their heads but concluded they surely made a deposit and misplaced their record of it.

I made copious notes and documented everything. When presented to the firm’s CIO, she looked disbelieving, then doubtful, and finally bewildered.

“I know your reputation,” Loretta said, “but this can’t be possible. Besides, IT claims John had aged beyond usefulness. He couldn’t keep up. He barely finished this, his last project, before we let him go.”

“If so, he put effort into making a final masterpiece.”

“Leigh, darling, can you fix it?”

Call me darling and I can fix anything. I yanked the too-clever code out by its roots and their senior programmer, Robert, fixed the hole and, upon my recommendation, moved the transaction serializer to the front-end.

“What will you do about the spurious deposits?” I asked.

“They go back months. We wouldn’t look good demanding hospitals and heart foundations return money deliberately deposited into their accounts. John gave away money we couldn’t detect was missing. We’ll leave it that way.”

“What about John?”

Loretta sighed. “Same reasoning. Arresting him will bring nothing but bad publicity. Can you imagine the Times or the Journal with headlines about a Wall Street Robin Hood? That’s bad enough, but a sympathetic soul would raise issues about ageism. No, we can’t win there. Thank God we discovered it.”

“Can you get me John’s contact info?”

“What? No, maybe, yes, why not. I’ll discreetly ask HR for it.”

Robbin’ Robin

I phoned ‘John’ and invited him to lunch.

“I don’t think so,” he said. “Who is this again?”

“Leigh Lundin.”

“Oh shit, you? What do you want?”

“Just a chat. Really.”

“You’re working for MuFu?”

“Yes, today I am; tomorrow, no. I’m wrapping up.”

“So you know…?”

“Lunch,” I said. “Let’s not do this on the phone.”

“Fraunces Tavern?”

“Whew! If you pay.”

He laughed. “Okay. If you accept that, you aren’t out to nail me.”

“I’m not. John, can you afford it?”

“I landed on my feet. Arthur Lipper knows me and his son hired me.”

I respected Lipper Inc. He chose well.

The Wolf Pup of Wall Street

We met in the pub where George Washington bade farewell to his troops. John looked like a mad Santa with puppy dog eyes and an Albert Einstein hairdo. I’d bet a dozen grandkids employed him as a stage for hundreds of adventures.

He said, “You’re not recording this?”

“No.” I kept my smile easy and relaxed my body language.

“I’m not admitting anything including this statement.”

“Hmm. Let’s talk hypothetically, this entire conversation, okay?”

“Sounds fair. What have you figured out?”

“Most of it, I imagine. Cancer research received a couple of grand on the first before I could stop it. That will be the last payment.”

“Good,” he said. “I mean, embezzling’s awful.”

I snorted. “SizeOf.”

He laughed. “I thought that was clever hiding in plain sight, but apparently not clever enough.”

“I overlooked it at first. John, what was going on? Why did our suppositional programmer take such a risk?”

He dropped the hypotheticals.

“They dismissed anyone approaching retirement, figuring to save paying pensions, I suppose. You heard about Walston?”

“I was there, John.”

“The MuFu bastards had a definite preference for young faces. I knew for months they were going to fire me, I could smell it in the air.”

“I know that feeling, John.”

“The staff treated me like crap, acting like I was in my dotage. They figured my brain had rotted along with Cobol, but they needed me to effect the conversion. I learned C until I knew it better than they did and then studied it more. Their superstars couldn’t read a dump or comprehend machine instructions during debugging. I turned the joke on their little experts.”

“Sheesh. I’m sorry you went through that, John.”

He shrugged. “What will happen to me now?”

“Far as I know, nothing. I think they’re too embarrassed. One or two, the CIO and the VP maybe, have shown a touch of grudging respect. They’re coming to grips with the senile grey-beard who fooled them.”

“Good, because I’m a coward. I’m not looking for fame and misfortune.”

“Don’t worry, John. Everyone but the sheriff loves a Robin Hood.”

Final Thoughts

And that is my favorite Wall Street crime case. I’m called when matters go mysteriously wrong, so Miss Marple-like, I occasionally stumble upon another puzzle and test of wits.

In this case, charities profited and the bad guy turned out a good guy. Some may object that a criminal avoided prosecution, but personally, I couldn’t imagine a better outcome.


Following are a few more tech notes.

17 October 2021

The Digital Detective, Wall Street part 3


I’m still astounded Fortune 500 companies and government facilities not merely allowed, but invited me, a 19-to-20-something freelance me to play with their very expensive computers. I mean work, not play, yeah, work is definitely the word. Reputation is everything. And okay, I have authority issues. So I’m told.

Striking off on my own meant no security blanket, no 401K, no pension, no profit-sharing. It meant scary months when I wondered if the phone would ring with a client and months when I wondered if the previous client was going to pay or not. That’s a concern– some companies withheld payment until they once again needed help. Sometimes managers wouldn’t like what I reported. My type of work– designing systems software– was specialized, so occasionally famine struck.

During one drought, camels were toppling over, birds fell from the sky, and my bank account appeared a distant mirage. Finally a call came in before the telephone company could cut me off. It was Wall Street again, a mutual funds house we’ll call MuFu. Loretta was their CIO, Chief Information Officer.

100 Maiden Lane, NYC © Emporis
100 Maiden Lane
NYC © Emporis

“Darling, are you available?”

“Personal or pleasure?”

“Are you saying personal isn’t pleasure?”

“You’re married.”

“Was, Darling, was.”

“Loretta, I’m sorry.”

“Don’t be, I’m not.”

She lied. I could almost hear the sounds of tears leaking from her eyes. She was a nice lady who’d come up through the ranks.

“Loretta, what’s happening?”

“If you’re available, I need help.”

“Please don’t let it be application programming.” Even if it was, I desperately needed the work.

“Well… Did you hear we’re undergoing a conversion from Cobol to C?”

“You and every other firm with fresh university graduates.”

My professors, Paul Abrahams and Malcolm Harrison, were language experts. Abrahams was chairman of ACM’s SIGPlan and would eventually be elected president of the US’s professional organization, the Association for Computing Machinery. They received early releases of Unix and with it the C language. For my part, C was co-respondent in a love-hate relationship. It constituted a step up from assembler language, but I wanted more.

She said, “I know you’ll be simply shocked, but we’re experiencing crashes. We can’t cut over until we nail the problem. Nobody around here can read machine code. I know it’s not your thing, but nobody knows Cobol either.”

In the following, I’ve tried to trim back technical detail to make it more accessible and I apologize where I failed to restrain it. The gist should suffice.


Next day I took the Staten Island Ferry to lower Manhattan, where I strolled up Pearl Street and turned onto Maiden Lane. The mutual funds house took up a few floors of an older building, although the interior was done in chrome movie set futurism.

The glass room remained there running their big iron computer. Off to one side was a new server chamber covered in curved, blue plexiglass. Very spaceshipish.

Loretta blended 10% boss and 90% Cub Scout Den Mother, which made her a popular manager among the guys. She called in her lead analyst and chief programmer, Richard and Robert. The latter radiated lethal hostility.

“Leigh’s here to shoot that bug that’s killing us.”

“We don’t need help,” Robert said. “He’ll just waste our time.”

Loretta said evenly, “You’ve had months and it’s still not identified. Please give Leigh all the help he needs. He’ll likely work after hours to have the computer to himself.”

After Loretta departed, Robert said, “I know who you are. You used to be hot shit.”

“I’ve never heard it put so charmingly. Listen, I’m not here to take your job. I’m not here to threaten you. I’d like to get the job done and move on. Show me what’s going on.”

As predicted, the program started and died with an out-of-address exception– the program was trying to access memory that wasn’t there.

I asked for listings and a ‘dump’, formerly called a core dump, a snapshot of memory when the system died. The address of the failing instruction allowed me to identify the location of the link map, an org chart of routines that made up the program. Sure enough, the instruction was trying to reference a location out of bounds of its memory.

I took the program source listing home with me and spent a couple of days studying it. It was ghastly, a compilation of everything wrong with bad programming and especially in C. It contained few meaningful variable names and relied on tricks found in the back of magazines. Once in a while I’d see variables like Principle or Interest, but for the most part, the program was labeled with terse IDs such as LB, X1 and X2. This was going to take a while.

The company had no documentation other than a few layouts from the analyst. When I called in to ask a question, Robert stiff-armed me. I arranged my first slot for Friday evening with time over the weekend.

I began with small cleanup and immediately hit snags. I’d noticed a widely separated pair of instructions that read something like:

hash_cnt = sizeOf(Clientable);
      :
cust_cnt = abs(hash_cnt);

Wait. What was the point of the absolute value? C’s sizeof() returned the number of items in an array. It should never be negative. You could have five apples on a shelf or none, but you couldn’t have minus five.

As part of the cleanup, I commented out (disabled) the superfluous absolute value function. Robert dropped down as I compiled and prepared to test. I typed RUN and the program blew up. What the hell? Robert appeared to sneer, looking all too pleased.

He said, “That section was written by that old guy, John. We fired him because didn’t know crap, so no surprise it’s hosed up.”

I knew who he was talking about, a short, pudgy bear in his late 40s with Einstein hair. I’d never been introduced, but I’d heard him on a conference pane. John was no dummy, no matter what Robert said.

Robert smugly departed. I stepped through the instructions, one by one, studying the gestalt, the large and small. My head-smack arrived on Sunday. Curious why sizeof() would return a negative value, I traced how hash_cnt was used. As I stepped through the instructions, I saw it descend into a function called MFburnish().

I couldn’t find source code for MFburnish(). No one could. Without source, it would be very difficult to determine what happened inside it.

I went back to the variable Clientable passed to sizeof(). The array was loaded from a file, Clientable. Both consisted of binary customer numbers. I spotted something odd.

C is peculiar in that it uses null (binary zero) to mark the end of arrays and ordinary file streams. This file had two nulls, one about the seven-eights mark and another at the absolute end.

At first, I thought the file had shrunk and the marker moved down while remaining in the same space. But when I looked at the file, it had the same defect… or feature.

As some point, I looked at the link map to check upon another routine and for the first time noticed what I should have spotted earlier. There amid C Library functions of isalpha(), isdigit(), islower(), isupper(); was sizeOf().

Double head-smack. First, C’s authors claim sizeof() is a unary operator like +n and -n. To me, sizeof() looks and acts like a function and nothing like a unary operator. But by their definition, it shouldn’t show up in a link map with real functions. On closer inspection, the program read not sizeof() but sizeOf(). Another annoyance of C is that it’s case sensitive, meaning sizeof and sizeOf and SizeOf and even SIZEOF are not the same thing. This kind of nonsense wouldn’t have been possible with their old Cobol system.

The deception seemed awfully abstruse, even by C standards.

interest truncation example

The Clientable contained account numbers of a sizeable fraction of clients. Why some customers and not others would take me a while to discover. Unlike sizeof(), the ginned-up sizeOf() showed the actual record position within the full file expressed as a negative number, hence the abs() function.

Someone had written deliberately misleading code. But why?

Money, of course. Moving backwards, I began to look at the code with a different eye. And there it was… not merely the expected interest calculation, but the conversion from binary to decimal, another Cobol to C difference. I suspected one of the company’s programmers had pulled off the oldest thefts in computerdom– siphoning off money by shaving points when rounding numbers.

This wasn't the problem Loretta had asked me to solve. Robert had directed me to the wrong program, which turned out to be a stroke of luck. Loretta had invited me to track down a program bug, but I suspected I had unearthed traces of virtual villainy.

Next week: The Confrontation

Following are Cobol versus C notes for the technical minded. Feel free to skip to next week.

03 January 2021

The Skating Mistress Affair, Part IIII


bank vault

Parts I-III provide the background of a unique bank fraud investigation.

In Part II, negotiations soured and in Part III, legal action failed miserably. The bank thought they were done for, but I wasn’t.


The Commentator

To continue developing and enhancing the software, I needed to understand it at least as well as the author. Nothing would do that like immersion in it, and nothing would aid in immersion like having to document the programs line by line, block by block, section by section.

Tedious. Refill the Ritalin, oil the exercise bike, and absorb.

Data Corp set up a pair of desks for me, not with their programming group but in a large room staffed with accountants, bookkeepers, and clerks. That made me the only guy amid thirty-some women.

pink office chair
 
pink Princess phone
Princess phone
 
boobs coffee cup
a slightly less risqué model
 
latex fingertip protectors
latex fingertips

Flirtatious and fun, the data center girls delighted in playing pranks on me. Some tricks were small, such as when they glued a dozen water-cooler cups together and hid the rest. Others were more ornate. They ordered a pink and gold chair for my desk, and installed a Playmate screen saver. My black office phone found itself replaced with a princess phone also in pink. A welcome gift box on my desk contained a coffee cup shaped like breasts.

My office mates flattered and flirted. Once, I asked a supervisor why the girls believed they could get away with such outrageous behavior. “You look easy to tease,” Shelly said. They read me like a Power Point slide.

They were also kind, sharing lunch with me. I never knew who installed a bud vase on my desk and kept its rose and water fresh.

One afternoon, the VP stopped by to pick up a couple of data cartridges. I opened my desk drawer… and immediately slammed it shut. I’d caught a glimpse of something lavender and lacy. Every eye was riveted upon me, watching what I’d do next.

“Er, maybe this drawer,” I muttered, only to spot another item, pink and frilly. The women had filled my drawers with, well, drawers, lingerie at least. I could feel the back of my neck burning.

“Er, I have to dash down to the computer room,” I said. “I’ll drop them off at your desk.”

“But…”

He peered after me suspiciously, knowing something was up. As I took off, he glanced around at the women who were all staring at him.

One morning I arrived to find a fat pink envelope on my desk decorated with hearts and cupids. Inside was tucked another plump envelope with a calligraphic message on it: “Shelly, Julie, DiDi, and Roxy invite you for the weekend. Necessities enclosed.” Heads craned my way as I slipped my thumbnail through the seal.

Out fell a dozen of the tiniest condoms. They’d filled the envelope with the thin latex fingertips clerks slip on when flipping through sheaves of checks and currency. Their cleverness cracked me up. When I stopped laughing, I took out a ruler and carefully measured one of the latex rings. Nodding judiciously, I placed one in my wallet. The lasses laughed, hooted, and jeered and cheered.

We Leave Our Light Off For You

At night, I pretty much lived at the data center, starting on the computers as soon as one was freed up from the work day. To snatch a few hours’ sleep, I holed up in a small motel near the bank’s Data Corp office.

During my extended stays, hotels generally grew used to me, A low-key and seldom demanding demeanor made the maids happy and sometimes pampering. Managers were pleased to X-out a room from their unrented list for a month or six, sometimes more. Across many states and a few countries, hotel life worked efficiently for me.

But deep in the Shenandoah Valley…

This local motel operator wasn’t used to a nomad like me, out all night, sleeping during the day. He glowered at my arrival each morning, frowned as I departed in the evening. Chambermaids reported reams of secret code documents in my room. Learning I skulked down to the bank building each night convinced him I was up to no good. He grew suspicious nefarious activities were afoot.

He telephoned the bank. They routed him to the Data Corp center and wound up with an operator who told him, “Oh, that’s the guy involved in the computer fraud.”

He’d heard enough.

Next morning, exhausted from a long and grueling bout of decoding and debugging, I arrived to find the motel manager in the lobby, arms folded, glaring at me. My haphazardly packed suitcases stood by the door.

Stiff-lipped and obviously fearful of a disheveled guy my size, he said, “Pay your bill and leave. I’ve called the police.” Activity in the motel stopped as a gallery of employees gathered at the balcony rails to witness their innkeeper deal with his dastardly guest. I disappointed them by producing my American Express.

With no internet at the inn, he refused to lend me a phone book to look up alternative hotels. The manager got his final satisfaction by ordering his bellboy to toss my bags outside.

Theirs was an independently owned franchise of something like Motel 7. An hour later, cheek buried in a Howard Johnson’s pillow, I sleepily fantasized complaining to Motel 7’s corporate office… and drifted off to sleep. Just another hazard of the road.

Reanimation

Here I delve into technical details of Sandman’s cryptography and computing. Feel free to skip ahead to The Flash Gorden Super Decoder Ring.

The first hurdle required overcoming a lack of tools, even a lack of tools to build tools. I needed to develop solutions on the bank’s computers, and they weren’t geared for deep-level development. The answer was to invent parsers in assembly language, the language of the machine itself, not meant for the type of character analysis and manipulation I needed. That filled the early days and then came the heavy lifting.

David Edgerley Gates previously brought to our attention substitution cyphers called cryptogramsfound in Sunday newspaper puzzles. Each encrypted letter translates or maps to a plain text letter. For example,

CryptoQuote Encryption Table
↪︎ ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 ↪︎
JXOHY28RGUPB1WA736SLZQF5MD40CN9VTKIE

In the ‘Adventure of the Dancing Men’, Sherlock Holmes took on a secret society’s messages that differed from cryptograms only in the ‘letters’ represented as pictographs. The Dancing Men glyphs corresponded one-to-one with letters of the alphabet.

Sherlock Holmes Dancing Men translation table

Sandman didn’t resort to half measures. I realized he’d built multiple tables that made decoding a multiple more complex. I had to figure out the mirror image of what he’d devised. The American Civil War saw the use of hair-yanking two-dimensional cyphers. Sandman hadn’t made decryption impossible, merely difficult.

Toward that end, I built a translator to fill holes in the reconstituted tables, gaps where uncertainty failed to reveal which letter represented what. The translator checked for errors, refined and reran the process repeatedly until the blanks filled in.

The process was a variation of stepwise refinement: shampoo, rinse, repeat. I’d decrypted so much, I no longer doubted the plan’s viability. The more I decoded, the smaller shrank the unknowns list.

As Sir Conan Doyle pointed out, the frequency of letters we use in writing varies considerably, useful to know when solving puzzles and Wheel of Fortune. In many examples, ETAOIN occur most frequently in ordinary writing and KXQJZ appear least often. In my code tables, I’d cracked the ‘E’s, the ‘S’s, the ‘T’s and most of the other letters. Here and there I might not know the occasional Q or J, but that decreasingly mattered. Over time, I could plug holes as the solution became clear. I was going to whip this thing.

Ironically, if Sandman had simply treated labels as serial numbers, e.g, No52000, No52010, No52020, etc, he would have robbed them entirely of meaning, making decoding moot. He probably avoided that path, thinking it went too far and might set off alarms within Data Corp’s programming staff.

In the days before I’d realized the labels were encrypted, I wrote a program to extract a sampling from 25,000 lines of code, sort them, hoping they’d point a way to patterns. The harvest yielded 3600 unique names, not one of them a recognizable word or abbreviation. That clue alone suggested something bogus. Programmers might omit vowels, might use peculiar abbreviations, or sometimes use slang drawn from popular fiction like grok and borg, foo and plugh. In 3600 labels, I found not one meaningful word. Patterns, yes, but nothing recognizable surfaced.

I built frequency counters, applets to show how often characters appeared. I had to be wary of vowels since labels were limited in length and the first thing people jettison when abbreviating are vowels. The tables from the frequency counters not only revealed which letters were the most crucial, but also helped zero in on likely character replacements.

The first pass turned out better than expected. A thousand labels suddenly appeared readable. A few unknowns became obvious, but in one table I inadvertently mixed M with N. Correct and rerun. Rinse and repeat. Letter by letter, the coded alphabets unmasked.

Discovering how Sandman selected which table to use helped narrow the focus. The first character of a label served as a table selector. If that letter fell within the first third of our thirty-six alphanumeric characters, he used table 1, or within the second third, table 2, and so on. That mapping didn’t immediately jump out from the encryption, but it could be deduced as labels revealed themselves.

Sandman’s Encryption Table
  ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
selector

↪︎ JXOHY28RGUPB1WA736SLZQF5MD40CN9VTKIE
↪︎ 5FXABTS2V71K9Y6G048HUOLEIPQJNZCDMWR3
V52KGBXSLOM7TIWH6P18Q03NYDJZCEUFR94A

7-of-9 and Other Figures

An important issue I had to deal with was context. If you’ve ever glanced at raw HTML, you saw that formatting tags were mixed in with common text. You might see something like:

<html><head><title>Student Body</title></head><body>

This page discusses who shall head the student body.

</body></html>

Imagine searching and replacing the keywords ‘head’ and ‘body’ without affecting the HTML tags in a hundred-thousand lines and upwards of a million words without making a mistake. The solution is to comprehend meaning, to grasp when head is part of a formatting tag and when it isn’t.

Much like a human reader, the translation program needed to comprehend context. It parsed the text, distinguished actual programming statements, formatting commands, comments, and assorted runes in what technical people call a non-trivial exercise.

The smart enough parser had to recognize if “7,9” referred to two registers, two memory locations, a mix of the two, coordinates, formatting, a decimal number, part of a comment, or an actress in a television show.

To minimize errors as I restored the code, I borrowed a programmer to help check expansions. Late into the night, our flat conversations sounded like alien air traffic controllers:

“… Hex two-five-five, nought, bang paren dog-easy minus splat…”

“… Xor var fox fox, double word, two-seven baker niner able, no deltas.”

A splat meant an asterisk, bang an exclamation point, a delta implied a difference, and much of the rest was hexadecimal. You’re following this, right?

Deltas had to be identified and dealt with. A final pass matched the assembled output of the original and my newly created decrypted version.


The Flash Gordon Super Decoder Ring

It took a shade over two months, but finally I could inform the vice president he had viable source code, better documented than the original. Since most people couldn’t tell assembler code from alphabet soup, he awarded me congratulations with a vague smile. After all, he had to trust what I said it was.

More satisfying was a phone call I made, one to Sandman.

He said, “I don’t believe it. Impossible. You could not have done it. I couldn’t have done it.”

“It’s true. Got a fax number? I’ll send you a couple of pages plus a cross-reference list of labels.”

“Wow, that’s stupendous. Awesome. I didn’t think it could be done. I respect you, you know. This has been extremely satisfying in a way, a battle of brains. Thrust and parry. Check and mate. You’re as good as they say.”

“You could be a contender, Dan. Do the right thing, join the universe on the side of the angels.”

I thought it was end game, but it wasn’t over yet. When no one was looking, perhaps influenced by his corrupt skating Queen, Sandman slipped another rook onto the board.

Computer Associates

I continued development, expanding the product’s capabilities. Some time earlier I had invented Fx, a technique to carve out an independent partition tailor made for such a product to run in. I refined it for Data Corp, which pleased the customers.

On the sales side, matters were not going well. Sandman was right about one aspect. The business model Chase maintained in his head did not match the reality of the market. Australian Boyd Munro had managed to support a high-flying international sales organization– literally high flying– Boyd and the top officers flew their own private planes. Their salesmen personally visited companies to sell a product that leased for a thousand dollars and upwards a month.

Chase owned a Cessna, but with a product that sold for a fraction of Munro’s in an increasingly competitive and changing market, flying half way across the country to make a sales pitch wasn’t feasible. Although we’d solved the technical and legal catastrophes, the board eyed the bottom line, and S&M– sales and marketing– loomed in their gunsights.

During my break in Boston, the vice president phoned. Another situation. Couldn’t he time dramas to occur when I was in Virginia?

“Leigh, what is your opinion of Computer Associates?”

“My opinion? They have staying power, can’t argue that. They change with the times. The company has a chequered reputation, though, considered shady. Rumors persist about a clash with Tower Systems out in California and that the D-fast and T-fast products were cloned. Supposedly the president’s brother is the corporate attorney, so one story says they bully smaller companies in court, grind them down with legal fees, Software Darwinism, the beast with the biggest claws.”

“Computer Associates expresses an interest in buying the rights to our product. They want to send a software specialist to look over the programs. Can you fly here to show it to him?”

“You want to show a competitor our source code? In light of what I just explained, if only a small part is true, does this make sense?”

“Did I mention they are talking a five with a lot of zeros after it?”

“Five hundred thousand dollars? You are joking.”

“I do not joke.”

“Have them sign a non-disclosure agreement, maybe an MOU. Protect yourself.” I could tell from his reaction he wasn’t listening to anything but a five followed by five zeroes.

Bankers, hard-nosed but so naïve.

CA’s software guru turned out to be a Jersey guy with an enviable excess of kinetic energy. The bank’s coffee klatch girls studied Matt, sizing him up.

“He looks like the Leverage TV actor, you know, Christian Kane without the smile, don’cha think?”

“I picture that bad boy flying down the road on a motorcycle, long hair flattened back by the wind.”

“You hear how he talked to the receptionist? He gives me the creeps. You ever see Andrew Dice Clay?”

“Girlie, we got a male who fogs a mirror. What more do we need in a testosterone drought?”

Matt communicated mostly in monosyllabic grunts and nods, then dove head-first into the programs. The vice president hung about, all but wringing his hands before deciding his presence wasn’t contributing. Chase on the other hand, sat down prepared to answer questions. When Matt opened his notebook and began to make copious notes, I shot a questioning look at Chase. He merely shrugged and motioned me outside the room.

“The VP said anything goes. They want to sell it and don’t want us to throw up barriers.”

“What about the non-disclosure? Your bank had me sign one.”

“You are a consultant. This is an established company.”

“I don’t believe it. You wouldn’t give me a hint about the program until I signed sixteen documents. This guy waltzes in, they open the vault?”

“Pretty much. Look, they know your feelings; they just don’t see it your way.”

The VP returned and offered lunch, a largess almost unheard of. Barbecue, Southern buffet, Chinese… Matt waved them all away. “Cold pizza will do.”

Folks in the Shenandoah Valley like to get to know people they do business with. Matt did his best to keep a distance. Chase was clearly uncomfortable with this, but the vice president took it to mean Matt was all business and above frivolity while the rest of us worried about job security. The fact Matt saved the vice president forty bucks for lunch didn’t hurt either.

The afternoon turned into more of the same. Matt pored over the programs, taking extensive notes, filling page after page. He asked to use the phone in private a couple of times. About 5:30, we shut down for the evening, unusual for us. We invited Matt out to dinner. Chase suggested bluegrass, but Matt declined both.

We met again at nine the next day. Mid-morning Matt turned his attention to my Fx routine and his interest picked up, so much so that he was copying actual bits of code. How did this advance negotiations, I wondered. I closed the binder cover and excused myself, taking it with me.

I stopped in the VP’s office, and reported I didn’t like the way this was going. I’d developed this routine on my own, already had it purloined once, and I didn’t want it stolen again. Because I benefited from royalties, I allowed the bank to use it but they didn’t own it– I did. My holding out for a signed agreement did not make the vice president happy.

Lunch saw subs delivered. By mid-afternoon Matt said he was ready for a meeting. Even I wasn’t prepared for the audacity of his announcement.

“You know a guy named Daniel Sandman? We bought rights and title to the package from him. After minor changes, we shall bring it to market. We’re willing to pay you $10,000 for whatever rights you think you have and you turn your source code over to us.”

The blatant gall stunned us. Finally, Chase said, “The offer of a half million plus was just bullshit?”

The vice president, never one to forget proprieties, frowned at Chase but said to Matt. “You viewed our source under false pretenses?”

Matt shrugged. “You were under no obligation to show me a fucking thing. I suggest you consider this proposal quickly and unemotionally. I have no idea how long my bosses will keep the offer open. With or without you, we’ll bring the product to market within months.”

“What offer?” said Chase. “This is blackmail.”

“It’s actually extortion,” said the vice president. “It won’t fly here. We own the product. We have taken steps more than once to defend it. I cannot imagine what Sandman led you to believe, but the product is not yours. Now I’d appreciate it if you return the notes.”

“Forget about it. The notes are mine, freely allowed by you. You know Charlie Wong, the guy I work for? And his brother, their lawyer? Believe me, before this is over, we’ll own it, Fx and all, and you’ll be wishing you had the $10,000 to cover your first week of legal fees.”

“Fx is not for sale,” I said flatly.

“You think you can stop us?”

The vice president leaned in. “Our customer base monthly revenue is worth more than you’re offering. I suggest you leave, before Southern hospitality comes to an end.”

Matt tapped his fingers a moment and said, “You’ll regret it. Call me a fucking cab.”


The after-conference turned dismal. We had been humbled, deceived, threatened, misled and misused. Only our refusal to be bullied gave us the least comfort.

Matt’s feint and his company’s bluff corroded the bank’s confidence. Computer Associates’ audacity must surely have some credence, mustn’t it? The vice president sent out a tendril of query, tried a civilized probe into Computer Associates, which was met with stony implacability. Gradually, the cold acidic silence ate through the bank’s certainty and sense of justice. They decided to invest no more in the product.

I was retained for the time being because Data Corp still had customers who depended on the software and they would not abandon them. As manufacturers introduced new devices and operating system changes, our package continued to adjust and adapt.

Loose Ends

Chase departed, moving on to sell elsewhere. He reported an industry insider rumor that Computer Associates concluded Sandman either screwed them or they found him too volatile to work with. Either way, they killed off their project. But sadly, they’d also killed ours.

CA’s retreat came too late for us. With sales and marketing shut down, the die had been cast. Within a year or two, requests for updates to the software slowed and then tapered off altogether. The bank ceased billing the last few customers, letting them continue to use the product if they chose or migrate to a competitor’s offering.

Sand Castles

Sandman induced mixed feelings. He possessed a brilliant, if sadly injudicious mind. Like a Greek drama or a Russian novel, the characters and the outcome were doomed from the start. I thought of Sandman less a bad guy and more a pathetic protagonist hemmed in by a distorted perception of the world.

As a result, he acted vengefully and criminally. He’d defrauded a bank and its most important business clients. goaded by his lover, he blew every chance, every opportunity to get it right. When the blunders of a cigar-chompin’ deputy gave him a get-out-of-jail card, he attempted one more dishonest end-run, reselling a product he no longer owned. It shouldn’t have turned out a tragedy, but characters seldom get to decide the plot.

I confess I relished the contest. Like a novel’s protagonist, I had to see it through until its end. A friend noted I would have fought the battle even if I hadn’t been paid.

As a freelancer, jokes surrounded me about riding into town, smiting a problem, and riding out again as winsome daughters clasped their hands to heaving bosoms and cried out, “Who was that masked man?” Even the industry slang of a hired ‘code-slinger’ evoked the image of a geekish gunfighter. We each enjoy our illusions, but the challenge felt exciting.

Although a resoundingly happy ending didn’t materialize, the case looms in my past with a sense of satisfaction, of skirmishes won and a job completed. One could argue otherwise, but I like to think it a shadowy victory for the good guys.

As much as I enjoyed the battle of wits, the world would have been a happier place if Sandman had executed an ethical U-turn into the righteous lane. But if the ungodly, as The Saint was wont to say, always did the right thing, we’d have no story.

20 December 2020

The Skating Mistress Affair, Part III


bank vault

Part I and Part II provide the background of a unique bank fraud investigation. Last time, Sandman, influenced by his interfering inamorata, could not grasp that having cheated a bank once, he was no longer in a position to negotiate tough deals to make matters right.

No one had any notion of the unreal turn the case would take.


Off-Court Serve

A sizable entourage gathered in North Carolina: the vice president, a local consultant, a legal assistant, two attorneys, a company officer, Chase, and a brace of company people who stayed in the background.

I hadn’t previously met the bank’s attorney, a pretty, dark-haired girl with beauty, brains, and a beguiling sense of humor. Diane and I hit it off immediately.

The vice president introduced the other attorney, a local Greensboro man who’d made good. He’d graduated Harvard summa cum laude, then returned home to practice. His Clark Kent glasses lent a vague, intellectual uncertainty that would fool most people. Women zeroed in on tall, dark, and handsome, although he’d probably suffer an academic stoop in later life. Chase used the term ‘Esquire’, which became the man’s sobriquet for the rest of the trip.

The attorneys laid out a simple plan. They intended to search Sandman’s residence and, if necessary, his workplace for the source code. Since Sandman worked nights and slept days, they hoped to catch him napping– literally.

Esquire’s clerk had filed a brief and affidavits, including a couple from me, in support of search warrants for Sandman’s residence and place of work. They drafted carefully the motion to search the workplace, Carolina Steel. They weren’t Sandman’s employer, they merely let Sandman use their computers for development in exchange for his software and services. Two of their employees, Harry Church and Charley Barley, collaborated with Sandman.

Guilford County courthouse
Guilford County courthouse

An out-of-state entity requesting to search a local company might give a judge pause, but banks enjoyed certain federal privileges and protections. Trailing after the attorneys, we convened at the Guilford County courthouse to obtain a judge’s signatures on the court orders and warrant.

And then we waited. And waited. The courthouse’s architecture would have given Howard Roark apoplexy, a dull cell block unrelieved by a Greco-Roman temple façade. Its uncommonly hard benches had been cunningly copied from a Spanish Inquisition design. After painful hours of aching back and backside, I’d have confessed to assassinating Warren G Harding.

Once we discovered judges had adjourned for lunch, we followed suit. Esquire stayed behind in case a magistrate returned early. We need not have worried. The clock read well after lunch hour when Esquire came dashing back.

Why Southern Deputies Have Stereotypes

   
Sheriff J.W. Pepper   Sheriff B.T. Justus   our Deputy I.B. Dimbulb

The next step entailed the sheriff’s office executing the search warrant. While we waited, the Sheriff’s Department assigned a deputy to us. Jaws dropped. I wasn’t sure about the others, but I gulped in dismay.

Sheriffs J.W. Pepper and Buford T. Justice– movie fans might recognize them as the fat, stogie-chomping clichés portrayed by actors George Clifton and Jackie Gleason, respectively. Our guy looked like their bigger, nastier, meaner brother, the Southern deputy the South has done its best to stamp out.

Mean little eyes peeked out from the fat pads of his cheeks. His hair was losing the follicle war fought on an oily battlefield. He chewed a fat cigar mashed out so often, its end looked exploded. This good ol’ boy had worked hard developing a beer gut, the kegger kind that gave meaning to barrel-chested.

Chase and I’d been chatting up the pretty attorney between us, idly flirting to keep in practice. The deputy looked around at the gathered crew, hitched up his gunbelt and seized upon her to impress.

“Lil lady, whuz this here all about?”

Diane explained we were waiting for a warrant.

“Whut, you’re a legal lady? Purty lil theng lack you? Listen here, I’ll check on it, pull a few strings.”

He wandered off, came back, and glowered at Chase and me still sitting on either side of her. He plumped down next to the law clerk, facing us, legs apart to accommodate the sag of his kilderkin belly. Guilford County law enforcement shirts were made out of sturdy twill, not flimsy civilian fabric that might rupture at the next Big Mac.

“We wait a bit. At least this here’s simpler than last week. Yes sir. We wuz down in n-town, middle of the night, had my nightstick out whaling away, an’ you wun’t believe how shy them dark ones gets facing real lawnforcement.”

A man with a gun, a prejudice, and a loose screw had been turned loose on the streets of Greensboro.

The rest of us sat aghast. The local paralegal looked as if he wanted to shrink out of sight. Our VP, lounging against the wall, grimaced in disgust and departed the scene of the crime.

Next to me, attorney Diane tried to reassure me, the Yankee in the group. She whispered, “Believe me, this is not what Southerners are all about. This moron is… is…”

“An abomination,” muttered Chase. “Pardon the expression, but an utter asshole.”

His eye-watering cigar breath wilted most of us. I couldn’t decide if the deputy was oblivious to our reactions or encouraged by them. Had some of us managed to conjure obsequious interest, the course of events might have changed.

He continued. “Yep, now you takes a good oak nightstick, it makes a real good impression. It’s a grand persuader and if someones gets a bit messed up, you don’ gotta file no reports lack if you draw down. Nows this one darkie…” He didn’t use the word darkie.

I worked and traveled throughout the South, but I never encountered anything like this. More than sickening, this guy frightened us.

Once upon a time, the don’t-tread-on-me temper I inherited from my mother would override the quiet reason of my dad’s DNA contribution. Chase glanced at me in alarm. He’d seen me erupt once before. He leaned over and rested a calming hand on my wrist.

“Leigh, don’t, man. Don’t let anger cloud your vision. We need this guy on our side; it’s too important.”

Chase was right. We didn’t need to antagonize the repellant lawman assigned to us. I stalked toward the restrooms.

Hands on the marble counter, I leaned forward gathering myself. The vice president stepped out of a stall. He washed his hands and said, “Piece of work, isn’t he.”

“That bastard gets his jollies clubbing kids. Makes me sick.”

“That’s why I left before I told him off. We can’t change him now.” He clapped a hand on my shoulder. “C’mon, we endure.”

And we did for two more hours. None of us knew how much more of the deputy we could take before one of us turned homicidal.

Chase and the VP grew increasingly agitated the warrant was taking so much time. As shadows grew long, legal delays put at risk the plan to surprise Sandman asleep. Now past mid-afternoon, the time neared for his inner vampire to stir.

Esquire appeared and waved the vice president over. Minutes later they handed the deputy the court order.

The deputy squinted at the documents.

“Whut’s this here software?”

Chase said, “Computer programs, apps. Software runs the computer.”

“Whut’s it look like?”

“It could be listings, discs, hard drives, or even tape.”

“Yuh, but which?”

“It could be any of the above: print-outs, discs, cartridges, or tape.”

“Yuh, I said which?”

Chase turned helplessly to me.

I said, “We don’t know, sir. If this order was for music, it could be on a cassette, a CD, a vinyl record, or even sheet music, see? Same idea; we don’t know if it’s on a hard drive, CD, or printed sheets. It could be any or all.”

“Listen up. If you don’ know whut you’re lookin’ fur, we jez ain’t goin’.”

Attorney Diane stepped forward. Beguilingly, she said, “This is a court order signed by a judge; you have the warrant. Leigh here can recognize the software.” She rested her hand on his forearm. “We need an experienced officer like you to execute the warrant.”

“Thet judge pulls bogus orders outta his ass all the time. It don’t spell out what it is, I don’t execute it.”

Esquire hadn’t been regaled with the deputy’s adventures like we had, but the antipathy between the two men had blossomed, instant and intense. He said, “Come, Deputy, explain that to the judge.”

“Folks say you got fancy-ass Harvard law school, but that don’t cut no ice. I don’t tote for you. I works for the Sheriff.”

“The judge hears this, you might not work for anyone.”

The deputy stared at Esquire. He unhurriedly took the cigar out of his mouth, pulled out a paper pouch of tobacco, tucked in a chaw, and reinserted the cigar. He gave the distinct impression he’d like to address Esquire with the nightstick. Finally, he said, “Let’s git.” He turned and stomped away.

The Raid

The deputy’s heavily muscled Dodge led our convoy of four cars. The paralegals and staff came along as witnesses. We pulled in front of a modest house in a suburban neighborhood.

Chase stayed back to avoid antagonizing Sandman. I was kept waiting in the last car, I was told, for the premises to be secured.

Four got out. Both lawyers and the vice president followed the deputy up the walkway. The deputy banged on the door.

A spikey-haired, sleepy-eyed Sandman came to the entry, tying the belt of his bathrobe.

“We lookin’ for a Daniel Sandman. You happen to be him?”

“Yes.”

“We got a warrant for software. You got any this here software?”

“No, no sir, I don’t.”

“None at all?”

“No sir.”

“Well, then, a good day to you.”

“But… but…” said Esquire. “We came to search.”

“No, we ain’t gonna do no search.”

“But we have a warrant, a search warrant, as directed by a judge.”

“You heard the boy: He ain’t got none of this software. His word’s good enough for me.”

The vice president spoke up. “He has the software and we have a court order.”

The deputy spoke in mean, measured words. “You heard the boy. He said he ain’t got software. Now, you wantin’ to mess with me?”

Thwarted, the lawyers trudged back to the cars. Revving the Dodge’s big engine, the deputy whipped the powerful car down the street and out of sight.

“We still have the court order for his workplace,” said the vice president.

“A lot of good that will do us now,” said Esquire. “But let’s try.”

Nervy Steel

He directed us to Carolina Steel’s headquarters. As if anticipated, we were swept straight to the top floor where two company officers and their lawyers met us. Clearly, they knew we were coming.

The company attorneys blathered and blathered, made phone calls and blathered more. They claimed they were waiting for senior counsel. Outside the conference room, security gathered.

One of the executives said, “Our boys downstairs assure us they don’t have any of this software mentioned in the court order.”

Chase muttered in my ear. “Least not anymore.”

“That’s why we brought an expert and a court order to search,” said our vice president.

“Now, now. Normally in Carolina, police or deputies conduct searches. You don’t do it differently in Old Vir-gin-I-A, do you? All y’all can’t expect us just to let you poke around, can you, especially since our boys assure everyone nothing’s to be found? Certainly you don’t mean to question our veracity or abuse our hospitality?”

A legal argument ensued, but it grew clear that without police presence, we wouldn’t be allowed beyond the boardroom.

Security personnel moved in to escort us to the parking lot. The burly males looked menacing enough, but the much scarier short female guard appeared itching to shoot one of us in the kneecap.

Thwarted yet again, we adjourned for a post-mortem. It felt like our own. What should have been a simple mission, abjectly nosedived.


Days later, talking to Sandman, he told me what happened behind the scenes.

“Man, the deputy gave me a scare. As soon as I closed the door, I lit the fireplace. Middle of summer and I get a blaze roaring. I’d stacked listings all over the house, one of them on an end table next to the door, not more than two, three feet from where the deputy stood.

“I gathered them up, feeding them piece by piece to the fire, burning the evidence. I also had a couple of mag tapes around. You wouldn’t believe how Mylar stinks when it burns. Gives off this black ash. The stench still reeks in my nostrils. That left a disc cartridge. I figured if worse came to worst, it might anciently sorta get dropped.

“Simultaneously, I called the computer room, and told Charley and Harry the situation. The entire time you were upstairs with the lawyers stalling you, they were downstairs erasing everything they could off of disc and tape, shredding so many listings they fried the shredder and had to roll in another.

“Every ten minutes the CIO would call in. ‘What’s left? What’s left?’ By the time our lawyers let you go, we’d hidden the key pieces and destroyed the rest.

“Harry, Charley, and me… we worried one or all of would be let go, but Carolina Steel’s attorneys nixed that, saying terminations could be used as prima facie evidence we’d done something wrong like destroying the programs specified in the warrant.

“Man, I shouldn’t gloat, but our insane clown deputy beat your Harvard summa cum laude lawyer. Lot of good he did y’all.”

Post Mortem

I accompanied the bank people back to Virginia. It wasn’t a happy trip. The vice president needed to prepare an explanation for the stockholders. The rest of us and Data Corp’s general manager met at the Arbor, a favorite restaurant for dinner, overeating, and imbibing. Comfort food and drink.

We agreed not to talk about the debacle while we ate, but we couldn’t bear the tension. We cursed the deputy, Sandman, Carolina Steel, and software in general. Finally we pushed fried chicken aside and sat back.

“Well,” said the bank’s attorney, dabbing lipstick where it had worn thin. “That was a right fiasco.”

“And other words that begin with ƒ,” Chase said.

Diane put her lipstick away. “What I don’t see is an option anymore.”

“That was it, the end of the line.”

“We’ve got to consider our exposure, to customers, to shareholders, to ourselves. We face serious liability if customers discover we don’t possess the source code.”

“Hmm,” I said.

“Damn,” said Chase, far down in his beer. “I have clients who want to buy it if we can add features and support for new hardware.”

“There is one option,” I said, but no one was listening.

“Oh Lord,” said the attorney. “I wonder if we’ve stepped on any state or federal banking regulations. We could be accused of fraud here.”

“Not necessarily,” I said.

“Even worse exposure,” she groaned, “most of our sales have been out of state.”

I said. “Folks, listen a moment. I can decrypt the code.”

Chase peered at me speculatively, the lawyer skeptically, and Data Corp’s general manager like I was crazy.

Chase said, “Danny told us over the phone it’s too complex even for him. It can’t be done.”

“When do you stop believing the guy who screwed you and start listening to the guy hired to save your butts?”

For the first time in weeks, Chase looked more relieved than morose. He gulped like a man given a Heimlich maneuver.

The general manager reached across for the last piece of chicken. “I’m pretty certain we can’t afford for Leigh to write us an entirely new program.”

Diane’s paralegal had followed both the legal and technical discussions. She had drafted the original purchase contract with Sandman.

“Leigh, what makes you think you can do this?” she asked. “Not only would you have to figure out the program in the ordinary course of events, but a brilliant and devious guy has done his best to see it can’t be done.”

“If anyone can do it, Leigh can,” Chase said with perhaps more conviction than he felt. “If you’d heard the two of them on the phone, you’d know he’s got Sandman on the run. I’ve seen his work, even more brilliant than Sandman.”

“Are we talking battle of the brains or war of the egos?” said the GM. “He may be quite the code-slinger, but experts say code-smashing can’t be done.”

I said, “The difficult part was figuring out it was encrypted. The second hardest has been deducing how. I’ve been working that out at home while I’ve been waiting.”

“You’re plugged into NSA or CIA or something?” said Diane’s paralegal.

“No, it’s merely a puzzle.” A famous quote came to mind. “A riddle wrapped in a mystery inside an enigma.” They stared at me. The Churchill reference fell flat. I couldn’t blame them; we’d undergone a bad day.

“What’s our guarantee?” the paralegal asked. “We already took the word of one guy. It’s not up to me, but I wouldn’t throw good money after bad.”

I said, “Sandman created programs to strip and encrypt the program. I have to design programs to decrypt and restore the code.”

Diane spoke up. “So why are you saying this isn’t the most difficult thing in the world?”

“Sandman didn’t want to trigger alarms, so no fancy NSA 128-bit encryption. Instead, he scaled up cypher obfuscation to support the legend of a hard-to-comprehend way of doing things. He believed he garbled the code too much to permit serious study. He’s wrong, but it’ll take detective work.”

“Even so,” said Chase, “you won’t get the documentation back, the comments.”

“True, but I’ve been living with this program for months. Once decoded, the label names give clues; that’s why Sandman encrypted them. As for the logic, in a circular way I can learn the code by having to document it and I can document the code by having to learn it. Does that makes sense? I’ll attain a deeper knowledge than if I hadn’t had to do the extra work.”

Chase raised his glass. “I bet on Leigh.”

The attorney– she of little confidence– shook her head. “He’s cute but…”

Chase picked up the check and said to me, “Let’s get sleep and start tomorrow.”


Sandman had blown his chance to negotiate a deal that would have benefited everybody. The bank boxed him in legally and I was closing in on breaking his unbreakable code. He still had one more wrong move to make as we wrap up in Part IV.

13 December 2020

The Skating Mistress Affair, Part II


bank vault

Part I provided the background of a unique bank fraud investigation.

No one had any notion of the unreal turn negotiations would take.


Monster energy drink slash logo

Centuries from now, post-civilization archeologists will discover deep, mystifying gouges in the concrete walls of a skating rink in Greensboro, North Carolina. Those ragged furrows came about this way…

The Queen Unseen

Previously I’d uncovered an unusual fraud perpetrated upon a Virginia bank. The bankshares officials sent me to Greensboro to negotiate with the unlikely scammer.

I was willing to bet the miserly VP had booked the motel. It smelled like cheap motels everywhere, a musty mix of stale food, sex, and disinfectant. It featured two beds, a TV remote control bolted to the nightstand, and lots of cardboard stand-ups advertising the dining room, deals for my next visit, Dillard’s Rent-a-Car, and dial 6 for room service. The cardboard junk I swept into a drawer so I could open up my suitcase. Tomorrow, the maid would redecorate the room with new cardboard stand-ups.

I hung shirts on stupid hangers that featured nubbins instead of hooks. Someone had left two wire coat hangers behind. Thanks to cable television, frequent travelers no longer needed to use one as a TV antenna, but having one to keep the toilet from running helped in the middle of the night.

I sat on the bed and dialed Sandman’s number. Another cardboard stand-up informed me local calls cost 75¢. That would bring a frown to the face of Data Corp’s very tight vice president.

“Yo, this is Dan Sandman. We’re ready. Be there in fifteen minutes. Oh, I forgot– I’m bringing my girlfriend, Justine.”

Before my speaking with Sandman, Chase had filled me in about Justine, and Sandman revealed more in our conversation not long ago. Some years older than Danny, his girlfriend was married to an oblivious husband.

She certainly annoyed the hell out of Chase and not because of morals. Chase intimated she involved herself as more than a mistress. She interfered with the business he and Sandman put together. She interjected herself in the middle of discussions. Chase also thought she was a little too flirtatious.

Another hypothesis was developing.

A knock rapped on the door.

Sandman stood nearly a foot shorter than me with an average build, neither athletic nor chubby, barely a slight pudginess around the edges from Moon Pies. His sandy hair was short, but he kept brushing an invisible lock away from his eyes. He bore a pale complexion not from sun screens, but computer screens.

His girlfriend constituted another matter altogether, a dishwater blonde with blonder streaks, slender, pneumatic push-up cleavage, and skirt by Saran-wrap. In heels, she stood a couple of inches taller than Sandman. A lupine awareness hovered about her, a feral aura of a Jerry Springer guest loose on the veldt. She looked pretty in a tough, Tonya Harding way.

I found it difficult to picture her with a didactic like Sandman, a guy who listened to Shostakovich and read whenever he wasn’t writing. Well, maybe not so difficult to figure out– she insistently molded bulging parts against him.

From under her lashes she locked her gaze on me. My hypothesis was becoming a theory. They’d brought a shopping bag heavy enough that Sandman carried it in his arms rather than by its handles.

He said, “We were supposed to go out to dinner, but maybe we could order in pizza. Eat it here and talk.”

“Sure. What do you like on yours?”

We ordered a large artery-clogger with extra cholesterol, bound to be tasty. Recalling Sandman’s preference, I added two litres of Pepsi.

I got down to business. “The bank authorized me to verify the source code– no more tricks– and pay you a final fee.”

“I brought a listing.” He patted the shopping bag like a baby’s tummy. “Let me show you the program.” From the bag, he reverently pulled a binder of old-school perforated green-bar, 14×11, six inches thick. Definitely large enough.

Sandman held it in his lap for a moment longer, a young mother not wanting to put her baby in someone else’s hands. He said, “Let me show you the code now, so we don’t pizza smear it later.”

Involved with his own self-centered agenda, Chase had come off insensitive to this guy’s inner needs, missing the essential clues.

Danny opened the listing on the motel coffee table and gently smoothed a page with evident pride. Few people could appreciate his accomplishment and he desperately needed a professional and, better yet, a cognoscente to validate his work.

I scanned it. Titles, section headings, comments, labels now made sense. It stopped short of my persnickety standard of documentation, but the code was excellent, even brilliant. I told him so.

He hovered over me, pointing out snippets he was particularly proud of. Perhaps a hundred people in the world could appreciate his creation and he was not wasting this opportunity. A willing audience, I effusively praised his masterpiece.

Justine hovered by his side, watchful. Like hearing foreigners speak, she followed the buzz if not the intricacies. Throughout, she kept some part of her body touching his, not so much affectionate as proprietary. When her eyes turned on me, they gave the feeling of being x-rayed.

Tap on the door. Pizza man. Sandman carefully closed the listing and, with unconscious veneration, placed it back in the shopping bag. I noticed external drives, mag tapes, and a second, thin listing. “My encryption program,” he said.

The pizza was a social convention, a bonding device for minds and ribs. When Sandman and Justine turned to their shared enthusiasm for roller skating, she grew animated. “I love skating,” she said. “It’s where we met. My, ah, husband doesn’t skate. Do you like skating?”

“I like the Dire Straits song.”

“Have you ever tried it?” Danny asked.

“Me? Never. I’m a klutz and a menace. Klutzes that value their skin and bones don’t skate.”

Oh hush! Anyway, it has 4 feet.
© Inside Edition

“You never learned?”

“I suffered a deprived childhood. It happens when you’re raised by wolves.”

She sniggered. “Competition we like best, skate dancing. You’d have fun chasing a girl in a very short skirt, wouldn’t you?”

“I’d need to master the art of standing up.”

Sandman finished his pizza. He dabbed his mouth with a paper serviette. His eyes flicked to the shopping bag with the goodies.

He said, “About the fee, you know we want serious money.”

We. He kept using plural pronouns.

I said, “Don’t get too ambitious. The company isn’t in a mood to be trifled with.”

“You know the software is worth at least a couple hundred thousand, probably two-fifty, maybe more. They could make millions off this.”

“What I know is that they feel hijacked, Dan. You put their investors and customers at risk. They’re upset. You have their attention, but don’t overplay your hand.”

“The obfuscation was just a joke on Chase,” he said petulantly. “Why else would I sell it so cheap?”

“Their contract doesn’t have the word ‘joke’ in it. They’re not laughing. Chase was acting for the bank. Sending me here is an expediency. They figure you owe them, but they’re willing to pay a ransom if they can put this mess behind them.”

I owe them?

“Dan, you miscalculated. Sure, Chase might lose his job, but involving bank investors, you lost hearts and minds. You viewed it as getting a bonus $5000 to screw Chase, but you put Data Corp at risk with bank  customers. At worst, they perceive Chase as naïve, trusting a deceiver, a fraudster who lies, cheats, and steals.”

He turned paler. “Jesus, I never looked at it that way.”

“They don’t like negotiating with a gun to their head, but they’ll ransom the package if they can.”

“How much?”

“How much are you asking?”

Sandman glanced at Justine. Some silent communication transpired.

“Listen,” he said, “let’s go our own way this evening. We’ll reconvene tomorrow. We want to invite you skating. Let’s get to know each other better and then we’ll talk. OK? It’ll be fun. OK?”

It wasn’t okay, but options were limited. I nodded. “Sure.”

Sandman put his hand on the shopping bag. “We’ll, ah…” He seemed strangely uncertain. “We’ll take the program with us for now.”

I looked at them– Sandman timid, she suddenly tense. I realized each person in that room thought the same thing. I was considerably taller, broader, with more muscle mass. I could physically seize the listings and tapes from them, heave their asses out the door and leave them nothing.

For a moment they feared they’d misjudged, but the instance passed. They got me right the first time. Not an enforcer, never a bully, that’s not my style. I wouldn’t thump someone over computer code no matter how justified it might be. Doing the wrong thing wouldn’t accomplish the right thing. He’d placed himself and others in a precarious legal and ethical situation, but he nevertheless deserved compensation for his product.

Relieved, clutching their package, they backed out of the room, waving and saying, “Tomorrow, lunch time, we’ll pick you up.”

Reporting 1

I phoned the vice president at home and filled him in. He was a man of rectitude. He didn’t approve of a Sunday spent in a roller rink negotiating a shady deal with, in his view, a whoring shyster, but he understood the necessity.

“What’s your take on the situation?” he asked.

“Not positive. This girlfriend of his, she’s the wild card, the real problem. What do you know about her?”

“Almost nothing. Just that she’s, ah, a married woman of doubtful moral character. Why?”

“I think she’s running him. Behind the scenes, she calls the shots.”

“Like he’s the mistress? How do you make that out?”

“My theory, she fancies he’s Bill Gates and she’s Melinda without that pesky desire to rescue starving people on the other side of the world. Maybe it’s the skating thing, but I keep thinking Tonya Harding. Together, they’re a salad of Bud and Lou.”

“So?”

“It wasn’t strictly Sandman’s idea to scam us. She figured they could wring out more money this way. If Sandman has ceded the decision-making to her, I doubt we can reach a deal.”

“Much as it goes against my grain, this one time we’re offering him a chance to do right.”

“She thinks everyone is unscrupulous like she is. Her idea of business conduct entails screwing the other guy first. Given a path of crooked or straight, her twisted instincts choose crooked. Then after driving the bus off a cliff, she blames others. Sandman realizes they screwed up. She doesn’t.”

“I’m not sure I follow.”

“They assume their goals are the same, but I don’t think she cares all that much about him, just the money he represents. Sandman lashed out at Chase, but he’d prefer to settle this with minimal fuss. The woman seeks to screw as much money as possible out of the bank, and that’s still her goal. Making more money playing it straight wouldn’t occur to her.”

“If they’d been truly smart, he would have negotiated an optimum price, not a token amount. Then charged us again for continued maintenance and development, which we probably would have agreed to do.”

I said, “Instead of giving value and getting rewarded for it, petty spite and greed guides them.”

“Hmmm. Ever skated before?”

“No. The thought of me skating represents a danger to society.”

He surprised me by chuckling.

“Good luck. The person most agile remains standing at the end of the day.”

The Great Roller Skating Caper

They dropped in at noon on the dot. Her skating skirt covered most of both cheeks. She twitched her bottom against him as we walked to their car. On the ride over, she tucked a hand high inside his thigh.

The front third of the skating complex sported a store and rental shop, plus a snack bar on the left. The rest of the building encompassed a low-walled oval– the rink. Rock music and kiddie shrieks and squeals echoed off the concrete walls.

Sandman helped me pick out skates. Justine knelt to lace them on me, her breasts nearly tumbling out of her top. She momentarily rested my socked foot against her bare thigh before giving my sole a covert caress and slipping it into the boot. Truly a woman of subtlety and international distinction.

One at each of my elbows, they led me like a doomed gladiator into the arena. If given roller skates, many more Romans would have fallen on their swords.

They left me standing and backed away, leaving me on my own. Standing was the key word, because I didn’t know how to move. I shuffled my feet. Zoop. Zoop. Nothing, nothing happened.

I moved one foot, then the other, only to find I was still standing in the same place. Wait. I’d studied physics, mechanics, the science of momentum. I should be able to figure this out. Balance on one wobbly leg and cautiously push away with the side of my other skate.

Oops.

Twelve-year-olds hoisted me off the floor. They knew naught about physics, but they’d cultivated a sense of their bodies on wheels that had escaped my edification.

Jurassic Park III logo

Clinging to the low wall, I tugged myself along by my fingernails. The waist-high barrier circled only half way around. The rest of the rink was enclosed by the building’s cinder block walls, walls I hugged with intimacy.

I clawed my way around the perimeter. I dared not venture more than two feet from the wall so I could pull myself up. My fingers left gouges in concrete blocks still embedded today. A thousand years hence, archeologists will conclude the scarred oval housed a circus of unmanicured Jurassic Park III raptors.

For some reason, girls helped me to my feet but not guys. Possibly it was a center of gravity thing, or maybe if guys stopped to help, they couldn’t get going again. Or perhaps I’d proved an embarrassment to the male population.

Meanwhile, Sandman and Justine whirled and twirled, skating away to the music. Legs outstretched, his fingertips lightly on her waist, hands clasped, they gazed blissfully toward the stars. On skates, he appeared a whole lot taller. Not taller than her, just taller than me struggling to rise from the floor.

Every time I face planted, this toddler on skates and sucking a knuckle stared eye-level at me. Why was a munchkin two Lego bricks tall judging me? I had a lot farther to fall than he.

A charming skater, the kind that prompts males to upshift mass from their abdomen to their chest, hovered over me. With gorgeous padding in all the right places, she offered advice. “Lean forward and stick your bottom out.” Easy for her to say, she was beautifully counterbalanced.

I made one and a half circuits to my hosts’ twenty-three thousand or so, when I realized I needed to visit the restroom. “Behind the food court,” the charming advice chick said.

roller skating rink
Typical roller rink after too many tumbles. Note slight incline of floor. © Huffington Post

I worked my way to the gate and pulled myself hand-over-hand along the rail toward the snack bar. There I encountered an insurmountable problem. The floor suffered a sight incline, imperceptible to anyone but a novice on skates. To me, it sloped 160° uphill, and I didn’t have ropes and pitons to master it. I churned skates, but stayed right where I was.

Spotting the problem, two teenage girls took pity on me. Still on skates themselves, they towed me upslope to the restroom door. O sweet rescuing girls; had they been older, I might have proposed out of sheer gratitude.

The men’s room was laid out with ‘the facilities’ on one side, sinks on the other. I clomped over to the porcelain and discovered another problem. Curse the contractor, the floor’s slope continued in the loo. I found myself rolling away from the urinals. Damn. For a meticulous guy, this wouldn’t do; no one was going to mop up after me.

I angled the skates and locked my heels together, but the muscle tension discouraged kidney participation. Finally, I did the obvious and grabbed the pipe like a carousel horse and held on. That allowed me to ‘complete my business’ as my grandmother might have said. Someone more sensible would have simply entered the toilet stall.

I turned my attention to the sinks. There I encountered the opposite problem where the floor sloped toward the basins. Angling toes trying as I might, I kept rolling into them. I’d soap my hands, push off, lather, push off, rinse, push off… at least in theory. The front of my pants looked like the accident I was trying to avoid.

For once those warm air hand dryers proved useful. I aimed their nozzles at the front of my jeans and held the buttons on. A couple of locals wandered in, eyed the disheveled madman, the blow dryers, and the saturated floor, shot each other looks and backed out again.

Outside, the two girls smiled at me, waving me over. “How did you make out?”

“Trust me, you don’t want to know. I looked like a poster child for poster children.”

That brought more giggles. They steered me toward a food court plastic chair where I collapsed.

Sandman and his woman had just finished their final pirouette et pad-á-deux of the entire Swan Lake ballet. They glided out of the enclosure and up to my table. Unlike me, they barely broke a sweat.

He affectionately brushed a strand of hair out of her eyes. She glanced sharply around. “Not here,” she hissed, but she covered her rebuke by surreptitiously squeezing his thigh.

Sandman pulled out a chair for her and she sank gracefully into it. I was envious of their ease on wheels, but if my awkwardness charmed teenage girls, maybe there was still hope for me.

Sandman laughed. “We’ll say one thing for you. You’ve got guts.”

We sipped coffee and Cokes for a few minutes.

“Tell me,” Sandman said, “what the numbers are.”

“Pardon?”

“The numbers… how much they’re offering. A quarter million?”

I had a horrible feeling the bank radically underestimated these two. Or overestimated, depending on how one looked at it. No number was going to satisfy them.

“They authorized much, much less. I’m talking what you can walk away with this weekend, no questions asked. Name high numbers like that, I have to call in and they debate whether or not to accept. Good chance you could get half your quarter mil, perhaps a little more if you’re willing to wait through the week, but odds drop if you try to wring out much more.”

Justine’s face clouded. Sandman flicked a glance at her but all he said was, “Let’s drive back and change. We’ll pick you up for dinner.”


I looked forward to famed North Carolina slaw and barbecue, but their palates weren’t adventurous. Instead, we visited a family restaurant. Sandman and I chatted technical trivia, operating system internals, stuff of interest only to computer geeks. Were the circumstances different, I might have hired him to work for me.

Justine crushed her breast against his arm while shooting me feral looks. Her leg brushed mine twice, hard to say if it signified more than accidental contact. My instinct suggested it did.

“One twenty?” said Sandman.

“Yes, can do.”

“One twenty-five?”

“Quite likely.”

“It’s worth more than that.”

“It was worth more than that, but they’re wounded, embarrassed, made fools of. Your shot across the bow at Chase injured them and damaged your credibility. You placed their bank and reputation at risk.”

Justine placed her lips against his ear and whispered something.

“So they should be willing to pay more, shouldn’t they?”

“They’re willing to pay less. Don’t get greedy, Dan. Pigs go to slaughter. I can’t impress upon you enough you’re not dealing from a position of strength. Mess around further and you’ll blow the deal. Be timely about it. I can’t advise you any more seriously.”

“You have his interests at heart?” Justine asked me, but the message was for him.

I said, “I have our interests at heart. The company has a limit how much they’re willing to deal, how much they’re willing to risk, and how much they’re willing to tolerate before cutting their losses.”

“That would leave the product up in the air.”

“No, that would leave the product dead and buried. You sold it to them; they own it.”

Wheels turned, though I couldn’t track where they headed. These two lived in a land of make-believe with no notion how the business world operated.

As I left the tip, they ambled out with their heads together. In the car, they pointed out features of Greensboro as he drove toward the motel. They stayed in the vehicle as I walked around to his window.

“Dan, what do I tell the executives in the morning?”

He waited an uncomfortable half minute before answering. “Tell them we’re in no hurry to accept.”

Did my not-to-tarry warning trigger a contrary response? Trying to keep exasperation out of my voice, I said, “What does that imply? How close or far apart are we?”

“It means… It means go home and think about it and we’ll go home and think about it. Then perhaps we’ll talk again. Perhaps not.”

“Don’t try their patience, Dan. They’re already put out.”

He shrugged, smiled, and offered his hand. I shook it. Pressed tightly against him, she reached out and shook mine too. I turned and strolled back to my room.

Report 2

Despite the late hour, back in Virginia folks waited to hear from me. The vice president asked if I thought I could resolve this impasse in the next day or so. I had to say no.

“Go home, man. We’ll be in touch. Thank for trying.”


Over the next two and a half weeks, I spoke with Chase every few days. He’d ask clarification of some detail; I enquired about the situation’s progress. Twice I casually reached out to Sandman. He enjoyed talking tech, but steered away from closing a deal.

The notice came unexpectedly, a call from the bankshares president himself. He instructed me to fly once again to Greensboro. No one expected we would witness an entirely different battle of wits in Part III.