Chaudhary was nodding. "You're probably thinking of the Social Engineering Second-ly blog."
"Yes, we are."
"Well, the blogger used an early model and he intentionally didn't download and install the security patches. If he had, he never would have gotten the DataWise to malfunction. But he didn't say that in his blog, of course. It's much more sensational to suggest that any thirteen-year-old can run an exploit. Gets you a lot more hits on your blog when you raise the battle flag of privacy breaches and malfunctions. The DataWise has far fewer vulnerabilities than ninety percent of the systems out there."
Frost added, "We have a white-hat firm we work with--ethical hackers. You know the term?"
"We can figure it out," Sachs said.
"Which spends all day looking for ways to hack into the DataWise servers our clients use. Any hint of an exploit, we send out a patch. If that blogger had done that he never would have gotten inside. What does he have to say about it?"
Sachs said, "I'm afraid our suspect killed him after he learned how to hack into the system."
"No!" Chaudhary actually gasped.
"It's true."
"Well, I'm certainly very sorry about it. Terrible."
/> Rhyme continued, "The subject we're after has a list of products that use your controller and people and companies who bought those things. A very long list."
"It's been a good few years."
The lawyer turned to the CEO, saying nothing, but perhaps sending a signal to avoid hinting at the company's net worth, even though this wasn't about its potential liability.
Chaudhary said, an aside, "It's okay. I want to help."
Rhyme pressed on. "And we have reason to believe that he's going to do this again. Kill someone else."
The man frowned. "On purpose? Why on earth?"
Sachs said, "Domestic terrorist, you could say. He has a grudge against consumerism. Maybe capitalism in general. He's sent some email rants to various news organizations. You can find stories about them, I'm sure. He calls himself the People's Guardian."
Chaudhary said, "But... is he psychotic?"
"We don't know what he is," Rhyme said impatiently. "Now, why we're calling. I'd like to know a few things. First, is it possible to trace where he's physically located when he takes over control of a product? And it seems he'll be nearby, so he can see the incident and decide exactly when to activate the controller. And, another question, is it possible to trace his identity?"
Chaudhary answered: "Technically, tracing, yes. But again that's the province of each manufacturer--the webcam maker, the stove maker, the car companies. We couldn't do it from our facilities. We simply make the controller hardware and write the script--the software in the controllers. He'd be hacking into the system through our customers' cloud servers.
"Then, if you knew in advance which appliance or device--I mean, the actual unit itself--he was targeting, the manufacturing company could trace his location. And even if you could he'd be using proxies to log into the cloud. You'd have to identify those. Finally, you'd have only seconds to find out before he logged out and powered down after the hack. As for identity, undoubtedly he's too smart not to use burner phones, unregistered pads or computers and anonymous proxies or virtual private networks. That's Hacking One Oh One."
This was more discouraging than he'd hoped. Rhyme then said, "All right. One other thing: Is there some security measure you can take to stop him getting access?"
"Surely. What I was saying a moment ago: The manufacturers of the embedded products--the stoves, HVAC systems, medical equipment, escalators--just need to install the security patches we send them. I know from his blog how that fellow--what was his name?"
"Todd Williams."
"How he ran the exploit. Yes, there was a vulnerability. We patched it within a day of learning it and sent out the updates. That was a month ago. Maybe more."
"Why wouldn't Midwest Conveyance have installed them?"
"Sometimes companies don't update out of laziness, sometimes business factors. Updating requires a reboot and often some tinkering with the code. That takes the whole cloud offline for a while. Their customers aren't happy with any disruption of service. Once people get used to a convenience it's impossible to take it away from them. Turning lights off remotely if you forgot, when you left the house on vacation? Keeping an eye on the babysitter in real time? Ten years ago, when that wasn't an option, you never thought twice about not being able to. But now? Everyone who has a smart product expects it to keep performing. If it doesn't they'll go elsewhere."
"You said it wouldn't take long."
Chaudhary smiled. "The study of the psychology of consumers is a fascinating topic. Disappointments are remembered. Loyalties shift in milliseconds. Now, Mr. Rhyme and Detective..."
"Sachs."