Postmortem(32)

The data base violation had to have occurred over the weekend or at some point earlier today.

Someone, an outsider, got in.

This person had to be familiar with the relational data base we used. A popular one, I reminded myself, and not impossible to learn. The dial-up number was Margaret’s extension, which was listed in the HHSD’s in-house directory. If you had a computer loaded with a communications software package, if you had a compatible modem, and if you knew Margaret was the computer analyst and tried her number, you could dial in. But that’s as far as you would get. You couldn’t access any office applications or data. You couldn’t even get into the electronic mailboxes without knowing the user names and passwords.

Margaret was staring at the screen through her tinted glasses. Her brow was slightly furrowed and she was nipping at a thumbnail.

I pulled up a chair and sat down. “How? The user name and password. How did anyone have access to these?”

“That’s what I’m puzzling over. Only a few of us know them, Dr. Scarpetta. You, me, the other doctors, and the people who enter the data. And our user names and passwords are different from the ones I assigned to the districts.”

Though each of my other districts was computerized with a network exactly like ours, they kept their own data and did not have on-line access to the Central Office data. It wasn’t likely—in fact, I did not think it was possible—that one of my deputy chiefs from one of the other offices was responsible.

I made a lame suggestion.

“Maybe someone guessed and got lucky.”

She shook her head. “Next to impossible. I know. I’ve tried before when I’ve changed someone’s electronic mail password and can’t remember what it is. After about three tries, the computer isn’t forgiving, the phone line’s disconnected. In addition, this version of the data base doesn’t like illegal log-ons. If you type in enough of them when you’re trying to get into SQL or into a table, you get a context error, whack the pointers out of alignment and crash the data base.”

“There’s no other place the passwords might be?” I asked. “No other place in the computer, for example, where someone might be able to find out what they are? What if the person were another programmer . . . ?”

“Wouldn’t work.” She was sure. “I’ve been careful about it. There is a system table where the user names and passwords are listed, but you could get into that only if you know what you’re doing. And it doesn’t matter anyway because I dropped that table a long time ago to prevent this very sort of problem.”

I didn’t say anything.

She was tentatively searching my face, looking for a sign of displeasure, for a glint in my eyes telling her I was angry or blaming her.

“It’s awful,” she blurted out. “Really. I don’t have a clue, don’t know what all the person did. The DBA isn’t working, for example.”

“Isn’t working?” The DBA, or data base administrator, was a grant giving select persons, such as Margaret or me, authority to access all tables and do anything we wished with them. For the DBA not to be working was the equivalent of being told the key to my front door no longer fit. “What do you mean it isn’t working?” It was getting very difficult to sound calm.

“Exactly that. I couldn’t get into any of the tables with it. The password was invalid for some reason. I had to reconnect the grant.”

“How could that have happened?”

“I don’t know.” She was getting more upset. “Maybe I should change all of the grants, for security reasons, and assign new passwords?”

“Not now,” I automatically replied. “We’ll simply keep Lori Petersen’s case out of the computer. Whoever the person is, at least he didn’t find what he was looking for.” I got out of the chair.

“This time he didn’t.”

I froze, staring down at her.

Two spots of color were forming on her cheeks. “I don’t know. If it’s happened before, I have no way of knowing, because the echo was off. These commands here”—she pointed to the printout—”are the echo of the commands typed on the computer that dialed up this one. I always leave the echo off so if you’re dialing in from home, whatever you’re doing isn’t echoed on this screen. Friday I was in a hurry. Maybe I inadvertently left the echo on or set it on. I don’t remember, but it was on.” Ruefully she added, “I guess it’s a good thing—”

We both turned around at the same time.

Rose was standing in the doorway.