27 My Colonel Cut My Badge In Half And Called Me A Security Breach — He Didn't Know The Audit Showed His Own Office Cloned It

Lauren took Priya back to the checkpoint after the shift change was over, and she pulled the audit up on the console and walked her through it.

The audit was, as Priya had known, a system that she had built. It pulled data from three sources — the badge office, the access control system, and the checkpoint consoles — and it cross-referenced them every Tuesday morning. It was not a complicated audit. It was a routine. It was the kind of routine that everyone who built access systems was supposed to write and that almost nobody actually did.

"I wrote this," Priya said.

"I know," Lauren said. "I read your name in the header."

"Did you know I wrote it?"

"No. I just thought it was a good audit."

Priya looked at the screen.

The audit was a table. Each row was one access event. Each column was one attribute: time, door, badge, credential, issuer code, and console. On a normal Tuesday morning, the table was about two hundred rows long, and every row was boring.

On this Tuesday morning, the table had a row on it that was not boring.

15:47:11 — Vault 4 — badge ending in 4471 — credential 4471-A — issuer code SEC-03 — console CP-1.

15:47:13 — West loading dock — badge ending in 4471 — credential 4471-A — issuer code SEC-03 — console CP-3.

"Two entries," Lauren said. "Same badge. Same credential. Same issuer code. Two doors. Four hundred meters apart. Two seconds apart."

"Two seconds apart is the part that tells you something is wrong," Priya said.

"I know. Nobody can walk four hundred meters in two seconds. Even if they ran. Even if they were driving a golf cart. It is not physically possible."

"So the same credential was used at two doors that are four hundred meters apart, two seconds apart. Which means the credential was not a physical badge. It was a digital signature. It was a copy. And the copy was used at one of the doors by someone who was not me, while the original was used at the other door by someone who was not me either, or by someone who had my original badge."

"Or by someone who had a reader that could transmit the credential over a distance to a relay at the other door."

Priya looked at her.

"You know how a relay works."

"I know how a relay works. I am not just a checkpoint technician. I took the same advanced access control course you did."

"You did?"

"Two years ago. I took it because I was tired of being told that checkpoint technicians were not allowed to know how the system worked." Lauren's mouth twitched. "It turns out I was right to be tired."

Priya turned back to the screen.

"Okay," she said. "So someone used a programmer in Keene's office to create a cloned credential with my name on it. Then they used the credential to open Vault 4 at 15:47 on Monday. They also used the original badge — or a second copy — to open the west loading dock at 15:47. And they did it in a way that showed up in my audit and that would have shown up in Keene's audit too, if he had run one."

"Which he did not."

"Which he did not." Priya paused. "Airman Price, why did he not run one?"

Lauren was quiet for a moment.

"Because the audit would have shown him the issuer code," she said. "And the issuer code would have shown him his own office. And a colonel who runs an audit and finds out that his own office cloned a credential has two choices. He can report it. Or he can make it go away."

"And he chose to make it go away."

"He chose to blame you. Which is not the same thing as making it go away. It is making it go away in the way that requires the least amount of work and the most amount of courage from the person who is doing it." Lauren turned the screen toward Priya. "Look at the fourth row."

Priya looked.

16:02:47 — Vault 4 — badge ending in 2210 — credential 2210-B — issuer code SEC-03 — console CP-1.

"Somebody used a second cloned credential at 16:02," Priya said.

"Somebody used a second cloned credential at 16:02. And I checked the badge number. The badge ending in 2210 belongs to a master sergeant named Dominic Reyes. He is the noncommissioned officer in charge of the network operations cell. He was in the same meeting as you when your badge was supposedly opening Vault 4."

Priya's breath caught.

"He was on the video call. He was on the call at 15:47 and he was on the call at 16:02. I remember him taking notes."

"Then somebody was watching that meeting. Somebody knew who was on the call and when, and they cloned the credentials of the two people on the call who had access to Vault 4, and they used those cloned credentials to open Vault 4 while both of those people had an alibi."

Priya stood very still.

"Airman Price," she said, "do you know what is in Vault 4?"

"I know what is in Vault 4. It is a communication node. It is a backup routing center for the base's classified network. If you have physical access to that node, you can install a device. And if you can install a device, you can monitor traffic. And if you can monitor traffic, you can see everything that the base's classified network sends and receives."

"Then we have a much bigger problem than a cloned badge."

"We have a much bigger problem than a cloned badge." Lauren turned the console off. "Specialist Shah, I am a twenty-seven-year-old senior airman who runs a checkpoint. I am not the person who investigates this. I am the person who reports it. And I have reported it. The question now is whether the people I reported it to are going to do anything about it."