The Breach that Binds Us
October 2020 is the Cybersecurity month, every Thursday we are releasing one of the winners of our Political Fiction Story contest that was part of the ELF Cybersecurity, blockchain and big data online event in May 2020.
The email came through at 17:50 on a Friday.
“Great… just great” Adam thought.
He was supposed to meet up with his colleagues in the Government Legal Department for a drink after what had been a pretty bad week. He needed that drink. But no, Gavin Tomlinson decided that 17:50 on a Friday was a perfect time to send him an email, subject: “GDPR Query”. This made things even worse. His years as a data protection lawyer told him that “GDPR Queries” never had a quick answer.
But on the other hand, it was Gavin. He had met Gavin from the cyber-security team at the Home Department a few times in the office canteen. They had flirted a bit in line to get their sub-par lunch food, to the extent that Gavin left a napkin with his number on Adam’s lunch tray. But, Adam had yet built up the courage to send him a message.
“At least I get to talk to Gavin” Adam said to nobody in particular as he sat back down.
He grabbed his phone to send a quick WhatsApp to his colleagues to tell them he couldn’t make it but was greeted by a default message. It said, “UNABLE TO CONNECT”.
His desk phone rang. Adam’s heart started racing when he saw the name and managed to say “Umm, hi”.
“Hey, Adam, sorry to be abrupt but we really need you down on the 4th floor. We have a bit of a, uh, situation”. Gavin hung up. Adam put the phone down and stood up – he hadn’t even read Gavin’s email yet. As he entered the lift he heard his mobile ‘ping’, but he ignored it.
The lift opened on the 4th, and all he saw was chaos. People literally running across the office. “What the…” he whispered under his breath. He’d never seen anything like this.
Adam spotted Gavin across the office, who gave him a distracted smile and waved him over. As he approached the group, Adam cheerfully said “Hey!” No one heard. They were staring at a computer screen that had words scrolling across it like the end credits of a movie. He moved closer to the screen and saw what the it said. He saw “NANCY MARSH – 78 – LIVES IN COLDWATER – TREATED FOR LIVER CANCER IN 2016 ** PRIYA MUKHERJEE – 32…” It went on and on.
Confused, but not wanting to impose, Adam stepped back and quickly checked his notifications. A message read “GOVERNMENT ALERT – CYBER-SECURITY THREAT UNDERWAY – GOVERNMENT AWARE – PLEASE WAIT FOR FURTHER INSTRUCTION”. The WhatsApp default message suddenly made sense.
Gavin turned to Adam and said “We’re under attack. All internet, mobile included, is unusable. They, um, well… you see, they seem to have got a hold of all the medical records from the National Health Bureau” he paused. “That’s what is being broadcast on the screens. They’ve hijacked the internet, stolen all medical records and are broadcasting people’s medical data to every browser in the city.”
Adam interjected. “I’m sorry? All data from the NHB”?
“Yes. Every record ever created by the NHB has been stolen. So, my question to you, Adam, is: What now”?
Adam didn’t know. All he could think is “We’re screwed”. He regained some composure. “Well, obviously the data protection implications of this are huge.” He thought for a second then asked, “How many records?”
“Close to 40 million, probably.” Gavin said.
Adam’s summer flashed before his eyes. He had imagined a holiday to South America with his best friend Nadia. Now, it will be spent notifying 40 million people that their data, their most personal, intimate medical information is out there, somewhere, waiting for someone to use or abuse.
It was then they heard maniacal laughter coming from the computer speakers. A masked figure appeared on the screen who had their voice disguised in that strange computer-manipulated way. The office went quiet.
The figure said “Prime Minister Evans is a LIAR. She campaigned on law and order. But all she has done is create a “backdoor” for law enforcement bodies to access YOUR personal data. We know because we used it to access every record from the NHB. We will continue broadcasting this data until this access is closed.”
Adam thought back to last year’s fraught election campaign. He remembered Evans’ party touting this “backdoor” as a positive, saying that if you had nothing to hide, then you have nothing to worry about. He never agreed with this. Privacy was important to him. Being part of a minority community, he saw from other countries how data can be used against you. But, as much sympathy as he had with the hackers, he remembered Mrs. Marsh’s name. No one should have their medical records broadcast to the country.
A tense half hour passed with no one really sure what to do. A team was trying to track where the hackers were, but Gavin and Adam’s worry about data protection was slightly less urgent than that. They waited for further information.
A phone rang in the office behind the group and was answered by Gavin’s boss. She answered the phone on speaker. The whole office heard the Prime Minister’s voice frantically say: “Close the backdoor. There is nothing else we can do. We thought we could hide it from hackers, but now we have to change strategy. Close it. NOW. That is an ORDER.”
Gavin and Adam sat down beside each other and sighed. They looked at each other, laughed, as if to say, “thank god that’s under control”.
Gavin spoke first. “How about a drink, Adam Cunningham? We’ve had a stressful day, I think we deserve it.”
Adam smiled and nodded. He said “Yes. Yes, we do” as he went to call the lift. The 40 million privacy breach notifications could wait until Monday.
by Christopher Jefferies, LYMEC IMS
