I have just moved home, out of London for the first time in years. I am on my first journey back – an hour and forty on what is, technically, the fastest train in the UK. Wait, that is actually the Eurostar but it’s not able to go at full speed on our rail infrastructure and so has to wait until it reaches the other side of the tunnel to reach full speed; maybe that’s why we think we should leave – the politics of envy.
A train journey on your own is a time to reflect and I have reconciled myself to the length of my new commute with nearly two hours of uninterrupted work (or reading). Today, on my first journey and on an empty train, I have been joined rather annoyingly by a young man I shall call Alex. I was annoyed at first by Alex’s presumption and short-sightedness; there are at least a dozen unoccupied tables and seats he could have chosen instead. But within minutes of him sitting down next to me, I have forgiven him. He is a walking (and talking) risk to himself, his data, his company and probably more. I am writing live, and he is providing all my material.
His name isn’t actually Alex but within three minutes I have learned his real name; his laptop greets him personally. I have watched him open the laptop and type in his main password; which is, and the security pedants amongst you won’t mind me sharing it, Football with a capital F. As an aside, I do wonder what sort of failures we in the information security business really are when over 50% of people still don’t understand the need for a proper password; I shall write about that again, but the answer to the question might be, almost total failures. We are not born knowing that a strong password is only to protect ourselves (admittedly I am not a millennial); we need to be taught it. Why isn’t that message getting through? Back to Alex, and he does at least tether to his phone. The cruel part of me thinks this is probably because the train Wi-Fi is unreliable rather than anything more sensible, but I may be wrong. Perhaps he’s done some e-learning.
Alex reads the Times, on subscription. I miss his password to the website (but I can probably guess). He is an Aston Villa fan (he has a sticker on the back of his laptop), doesn’t rate our new unelected Prime Minister very much, and I judge watches a lot of television (he makes a note in his phone whilst reading the Reviews page). He skips quickly through what I think would be the Times 2 section (I don’t read the Times and may be wrong on the nomenclature, but the bit with houses and comment and what I guess we must call Lifestyle). He reads a match report of the European games last night, but I can’t decide for sure if his second team is Celtic or Rangers – potentially a dangerous doubt to have.
Unexpectedly he then closes the browser and clicks instead on Excel, and up comes a document he has clearly been working on for a while. He is, I decide, a quantity surveyor. I now believe I know for whom he works, and his job title (which frankly doesn’t help me decide firmly on his actual job – if he were American he would undoubtedly be a Vice President of something or other generic and sound much more important than is the reality). Later in the journey – this bit isn’t strictly live, but Alex, if you’re reading, you should think of it as post-match analysis and me as the Gary Neville of shoulder surfing – he will get out his work pass, branded lanyard and all, and drape it around his neck and confirm beyond doubt his employer and confirm to me his surname. Back to the live Main Event and the journey isn’t yet an hour old but already I have this guy exactly where I want him – were I what his newspaper of choice would call a hacker. I am not, and he is lucky.
He works on a spreadsheet he began a few days ago. In fact, he “picks up where he left off”. He is good with numbers – well maybe he’s only average but I am number blind and what he does loses me somewhat. Whatever, he successfully manipulates some reasonably complex formulae and seemingly gets the answers he was expecting. His company uses O365 and his document won’t save; rather annoyed he logs in and I note this password too and that he has no 2FA. It is also football related and in fact Aston Villa related; think of perhaps their most famous player and his shirt number. Oh Cyrille, gone but not forgotten.
His attention span is limited, or maybe I am being unkind because it is not yet 7AM; every now and again he switches back to his browser and flicks aimlessly about. I learn that he is a regular commuter – who else checks Trainline at this time of the morning and who else has an account on Loco2 – and I gather two more football related passwords. Well, in truth one more which is new to me but used for two accounts and, again, it is a Villa player and their shirt number. Jack of the terrible hair, we thank you. He checks trains into Kings Cross – not really news because that is where we are heading now – and then from our start point to Birmingham. I can guess he goes to Villa home games, but perhaps not regularly enough to have a season ticket or the train times would be familiar. Maybe I am reaching here, but it’s not a desperate extrapolation.
Back to Excel, and then he is on his feet and for a moment I think he will leave his screen open but no, he reaches down and locks it. He returns a few minutes later with a coffee – latte or possibly a poor, train cappuccino – and a Danish. What did the Danes ever do to find themselves attached to such a sweet and (in my view, Alex himself doesn’t comment here) tasteless confection? I do though know he isn’t coeliac, at least. As one purveyor of such comestibles might put it, every little helps.
He logs in again and confirms the Football password; it’s always good to be sure. I am disappointed that he continues with Excel for a bit but then, somewhere outside Grantham (of all places) he surprises me by opening the Guardian and – wait for it – goes straight to the Soulmates section and logs in. Reader, he’s single and online dating. I didn’t marry him, but someone could.
He is straight (or at least mostly so); he is looking for women looking for men; girls who like boys who like…. He seems to prefer brunettes, as gentlemen don’t, and although I don’t know his age (he looks early thirties) he seems to be looking for someone a little older. Jane (not your real name but I apologise anyway) you may expect a message. Actually, some sort of wink. Be assured, he lingered on your profile, enlarged your picture, and nodded in what I want to call a wise way; perhaps, if so, the wisest thing he has done today (but it is only 8AM). He’s not completely smitten though Jane (don’t be disheartened as love grows slowly like the climbing rose) as he continues to browse. No-one takes his interest as do you, so all is not lost.
We are joined at our table in Grantham by a serious chap in a suit and a tie fastened so tightly I fear for his ability to breathe. Not really relevant except unhelpfully he sits opposite Alex, and Alex is forced to adjust his laptop. I miss some more browsing and some of what I assume, based on the increase in typing, is more Excel. Then, beautifully, he takes out his phone and makes a call. I can’t learn his pin but I learn some other useful things. He will be getting the 1801 back, and he will then change and head straight to Leeds for a night out; he will be in Briggate by 9PM and he names two bars, of which the merits are discussed, and they settle on one for 9 and one for later. He is staying over with a male friend and they are going to the football the next day; I don’t know Villa’s fixture list or where they are this weekend and I can’t decide if that is who they will see. Regardless, he will be out on Friday night and Saturday. I don’t know if he lives alone (yet) nor his address; we haven’t reached Peterborough yet though, so there’s time.
He hangs up on Rob (sorry Rob, but that’s not your real name either and yes, I have learned it). Peterborough comes and goes and the man in the suit leans back and Alex stretches a bit and pushes his laptop back and I can see his screen once again. Yes, it’s still Excel. He is struggling with one formula but, kudos, he perseveres and is satisfied when it works. He saves and closes the document and goes back to the internet. He loads a page, but we are out of 4G range and he stares for a while at a blank screen. When it loads, he is looking at LinkedIn. He has 1,200 and some connections (I miss the exact number), and he gets pretty numerous (I only have my account to compare him with) requests for more. Later, in more post-match punditry, I will send him an invitation to connect but, sadly, he won’t have accepted it before we go to press. He will accept though, as he does all those he has received, without reading them of course. On to Instagram (password and username, which is also I assume his Gmail account) and he flicks too fast for me to see what he likes and what he doesn’t; cars and girls, as someone once sung. Facebook gets a cursory glance (the password was saved to the keychain) and then another social media site I don’t recognise. Back to the Times, and then another phone call, incoming this time. His mother, I assume, who is wondering if he will be visiting over the weekend. He won’t – as I had already learned he will be at the football and staying in Leeds for the weekend. I do, though, become almost sure that he lives alone; his mother (if that is indeed who it is) seems to ask if he needs her to go around to the flat – he thinks about it and sounds tempted, but in the end decides not, thank you. He will try and go and see whoever this is in the week, but he will be in London for some of it and he isn’t sure what time he will have. Where is he staying? A hotel near London bridge (he names it, I know it) on at least Tuesday and probably Wednesday. He asks after Jo – his sister and also not her real name – and she seems well. Happy with her new boyfriend, what’s his name? They start to say their goodbyes and just as they do we enter the tunnels coming into London and they are cut off. At the other side, he texts (I assume) to say goodbye properly.
As we slow down for Kings Cross he does the lanyard thing I have already mentioned; he works for a big, well-known company and he may well indeed be a surveyor. He is in property, for sure. I am surprised they let him get away with the practices I have witnessed, but clearly by accident, failure or (lack of) design they do. I have a username for him at work and a password. I know his habits. His hobbies. His love life. His home town. We will soon be LinkedIn buddies. I have his social media usernames and some passwords (I can guess the rest). His email address at work and at home. I feel I know Alex in reality – and if I wanted to, I could physically find him over the weekend, worse for wear in Leeds, and lonely and bored in a London hotel next week. A Villa scarf or badge, the price of a drink or two purchased in a rooftop hotel bar, and me and Alex could become actual, real life friends. Well, real life maybe but not real friends. Now, I am off to worry about my firewalls.
