How to find the man who isn't there?

Question

"As I was going up the stair
I met a man who wasn't there!
He wasn't there again today,
Oh how I wish he'd go away"

Antigonish by William Hughes Meams

Paul Billson makes his living in industrial espionage. He's good at it.

He's the kind of person that you never recall talking to, you don't remember seeing. Even directly after speaking to him, you wouldn't be able to describe him or remember what he looks like. It's not magic, it's just his personality.

He's adept at disguise, and social engineering. He uses the core skills to get him into places that no one should really be able to enter. He obtains his intelligence, and he leaves as ghostly as he arrived. Security teams watching CCTV somehow view him as being unimportant and fail to really notice. He takes his time, picks his moment. He can tell when he's safe to tailgate into secure areas and when to wait for his opportunity....

Paul doesn't have super-powers, he's just unnaturally good at reading people and situations and taking advantage of weaknesses (both in people and systems).

The owners of the companies that he is targeting knows that something is going on - competitor companies are getting the commercial edge far too often.

How can they go about detecting and trapping the man who both isn't there but somehow is?

Answer 1

First, you can wait. You only need to catch him once. He needs to not be caught each payday. What you know is that your odds of catching him only need to be reasonable, not perfect.

This problem is usually seen with resistance movements and sabotage problems. There are a few techniques:

• The Snap Line: occasionally, randomly snap off a section of your facility. Equivalent to putting guards at the elevators and fire doors. Do a careful vetting of everyone in the space, including a search of crawlspaces and bathrooms. If you happen to snap around the correct person, you win. See Wasp or Nazi Germany.

• The Reward: have security guards work on trying to tailgate at the right time. Anytime someone stops them and asks to see a badge, they show their security badge and pay out a hundred dollar cash bonus. You now have an active anti-tailgating system. Used in numerous Silicon Valley companies.

• The Whistle: when the whistle blows, stop and vet the person nearest to you. Vetting needs be good, or maybe random. Snapping a picture of the person and badge might work.

• The Canary Trap, aka Selective Information: in those cases where you get to see the leaked information, automatically adjust wording so that different people get different wording Classically, add a few very small offsets to Excel files under the formatting threshhold, e.g., "323.00000+employeeIdNumber*10E-8". Mentioned in Patriot Games and Oath of Fealty.

There is nothing special here. This is straight security operations, not science fiction. For that, we use telepaths and FMRI machines.

Answer 2

Here is one possible way to do this. It will take a lot of patience and good planning, but it is definitely possible.

The Premise

You need to set up a trap. A setup which allows quick identification of what is real and what is not which goes one level deeper than the regular security screening. The idea is that you are not safeguarding against the intruder, you are expecting him to infiltrate and you are ready to identity and capture him.

Setting Up The Trap

A setting which appears perfectly natural and normal for offices and workplaces, but with just one small difference: the employees carry an ID card, which apparently is just a security swipe card, but it also carries a microchip allowing digital tagging. A type of short distance tracking device, if you will. None of the employees is aware of the tracking part and they only know the card is a regular security swipe card. In a separate security room (other than the standard one), there are half a dozen tech guys monitoring the activity in the building. One computer screen displays the number of people in all rooms through visual recognition of human shapes (the computer gets feedback through security cameras and processes it with software to determine how many people are there in the place) while another monitor simply tracks every card holder in the building.

Identifying And Catching The Intruder

Considering that the employees use the card only for security access, and that critical data is accessible only from certain computers/lockers, the intruder seeking access to classified information would either register a fake employee account in the company's database and prepare a fake security card (the most expected approach) or use the real high access card of a genuine employee (possible but much lesser likely). This means that in case of an information breach, there are either of two possibilities: a- somebody with a fake security card accessed the place OR b- somebody else used the genuine card of a high level employee.

In both cases, it would be possible to quickly determine which scenario it is and who is the intruder. If the person faked an employer's ID and used a fake security card, you can easily determine it by comparing the visual security cam records and compare them with digital tracking records of the genuine cards. You would find instances where the visual records show a person using a swipe card and entering the room but the tracking record of genuine cards showing no entry of a tracked person into that room.

If this is not the case and the visual access record matches the track record, it means that either someone has stolen the real card of a top access individual (in which case you would easily identify them through visual record) or there's a black sheep in your company.

Answer 3

The best way to capture such a person is to convince him that he wants to be seen. You talk of industrial espionage, so making it well known that you'll outbid the competitors would be very effective at encouraging him to choose to be seen.

Answer 4

So its not true that the man is not there. He is there. He is just undetected. Like the Higgs Boson up until recently. We concluded it should be there, but we just didn't ever catch it in the act, so to speak.

But the fact we could postulate its existence at all means it has to leave a trail, or footprint behind. But, in the case of espionage, is there a way to use that information to 'detect' the culprit? Haven't we already 'detected' the culprit, by being made aware that the culprit might in fact exist?

In regard to 'trapping' the culprit, in the case of the Higgs Boson, it was merely observed, in some sense. Would 'observing' the culprit or 'identifying' him be a good surrogate for 'trapping' him? Because, after all, what good would trapping him do, if he is as wily as we know him to be? He would surely escape, perhaps before we could identify him. If we could just see him, would that be enough? Or would we have to also identify him; and could we identify him? Wouldn't he have seen this coming and expunged all his records?

Let's just try to 'see' or 'observe' him, and let that be enough to satisfy our curiosities for the time being.

How do we see that which is always unseen? We see everything, and eliminate the possibility of anything being unseen. We need lots of high definition cameras and a supercomputer. Everywhere that could have any relevance to a spy, install enough security cameras to cover every square inch of the area in question. Stream the data from all these places, in realtime, to the supercomputer. It will parse the live feeds in realtime, identifying and logging any instance of movement, any humanoid forms, any faces, any heat (theyre thermal cameras' too BTW). If there is movement with no heat, its logged. If there is movement, it is logged. If there is a humanoid in the picture, it is logged. If there is not any humanoid in the picture, it is logged. Everything is logged according to observed reality, all the time, with no bias, no system downtime, no CCTV watchers pausing to take a sip of coffee, or taking their eyes off the screen to see who's calling them.

What's the culprit going to do now? Dress up in a thermally insulated tree costume and go floating down the hall to the secret file room to do some espionage?

If the choices are, be caught in the act, or do not perform the act, I'd say this: We may never observe the culprit, but if not, we have certainly eliminated the problem.

Answer 5

His abilities aren't over his actual existence, only people's perception - so don't use people

One of the common themes in answers so far seems to be using other people: Security teams or other employees. Mr Billson, however, must use the fallibility of these people's powers of reasoning and observation all the time in his work. He can bribe, trick and blackmail his way past people so your measures need to involve as few humans as possible. All technology installed will need to be done secretly.

Track phones

Mobile phones are constantly searching for the best signal provider, if you create a fake signal provider you can intercept this search and get the phone to send you some information about itself (unique to but not actually showing up as their phone number). You can then use a network of these devices throughout your building to triangulate where a particular person (identified by their phone ID) is within your building.

But what if he turns off his phone or simply doesn't have one?

Even better! In an age where everyone has one this would make him stand out even more. Use a secondary method of tracking like a trip on all doors (just sends a signal when a door is opened) and if a series of doors open but we cannot reconstruct a phone path then we know this person has ditched their phone and we can have them contained by security or automatically locking doors.

When tracking people we want to be looking for key areas (I'm going to assume that not all computers within this company have access to the vital information - else that would be one of the first restrictions to be made). If a person enters these key areas - especially after not taking the most direct route or stopping often - you pair this up with cameras covering the computers and compare the face of the user with your database of employees. If there is no match you lock the doors and send in a security team.

Ah but he is a super sneaky trained spy who gets through all these things, pinching someone's phone who he looks very similar to. So he escapes.

Track your internet traffic, making sure information isn't leaving the company at too high a rate. You could also take an extreme and run your machines on a unique operating system - anything coded in such a way to make sense to your computers wouldn't make sense to another computer - though this limits your ability to work with other companies.

However, the most common loss of vital information isn't usually through this physical infiltration - more often it is by waiting for one of the employees to slip up, to email themselves some work home or have a SSH set up on their home computer that can be stolen or hacked. Cyber security is probably the most efficient method to steal company secrets, our Mr Billson is taking the less effective physical method.

Answer 6

Your best option is probably electronics. They don't care if you're memorable or important, they just react.

For night time security Locked doors obviously help although I assume Paul Billson can get past locks. To catch him you'll need to have some kind of motion sensors/ infra-red sensor that covers the entire building as soon as the working day ends. If this detects any moving heat it can trigger a silent alarm and lock down the building from within trapping Billson inside and alerting the police/ private security. I assume even Billson would struggle to get out of that unnoticed. As long as this system is always on at night, and can't be turned of or accessed from outside the system, it should catch any intruder. Obviously an internal generator and locks that slam down if the generator power is cut are essential as is a system that can't be altered from the outside to allow Billson in.

This leaves the daytime During the day is now Billson's best opportunity. Someone with his skills should be able to just waltz in without being noticed and quickly get an unused computer and access the files he needs. To stop him doing this you need to stop him getting in. Once he's in everyone will just assume he should be there. The best bet would be to have a reception, an unlocked door into a small atrium, then a second, locked door. This will let Billson into the atrium but he won't be able to leave through the second door. The system would have to be that the first door locks when someone is in the atrium, trapping him in. This may occasionally trap your workers and visitors but that's their fault for not bringing their key (or more likely, electronic card). Anyone who is caught should be arrested and questioned, until the right guy has been caught.

Of course Billson could fake, or steal a card so you need a second line of access. Maybe a fingerprint or retinal scanner along with the cards. Sure, Billson could hack into and add himself to the database but if he is capable of that, he could probably just get the data he wants by hacking the system.

Answer 7

Have cameras in the corridors and use photo recognition software to match faces with your internal employee database photos. In case that database has been previously compromised, check the photos against where the employees are sup[pose to be and look for patterns.

Answer 8

Protocol. Strict reliance on protocol is how the military has kept social engineering attacks to a minimum for hundreds of years.

Guy at the gate is wearing a general's uniform? Too bad. He doesn't have a pass. He isn't getting past the gate. He'll have to wait until you can confirm his identity with someone on the inside.

Person with a janitor's uniform has been in this one hallway longer than allowed? Send someone to intercept him.

It's grueling at times and slows down your operation quite a bit, but it works.

If he's successful at finding a blind spot in the protocols, random spot checks and technological barriers like Tail-Gating cameras, checking logs of redundant security systems against each other for parity, and employee location check-ins take care of most of the rest.