Patricia Cornwell - Postmortem

"I believe you. But someone did it, Lucy. Maybe you can help me figure it out?"

I didn't think she could but had felt an impulse to give her a chance.

Energized and excited again, she said confidently, "Anybody could do it because it's easy."

"Easy?"

I had to smile.

"Because of System/Manager."

I stared at her in open astonishment. "How do you know about System/Manager?"

"It's in the book. He's God."

At times like these I was reminded, if not unnerved. Lucy's IQ. The first time she was given an IQ test she scored so high the counselor insisted on testing her again because there had to be "some mistake."

There was. The second time Lucy scored ten points higher.

"That's how you get into, SQL to begin with," she was rattling on. "See, you can't create any grants unless you got one to start with. That's why you've got System/Manager. God. You get into SQL with Him, and then you can create anything you want."

Anything you want, it dawned on me. Such as all of the user names and passwords assigned to my offices. This was a terrible revelation, so simplistic it had never occurred to me. I supposed it never occurred to Margaret either.

"All someone's got to do is get in," Lucy matter-of-factly went on. "And if he knows about God, he can create any grant he wants, make it the DBA, and then he can get into your data base."

In my office, the data base administrator, or DBA, was "DEEP/THROAT."

Margaret did have a sense of humor now and then.

"So you get into SQL by connecting System/Manager, then you type in: GRANT CONNECT, RESOURCE, DBA TO AUNTIE IDENTIFIED BY KAY."

"Maybe that's what happened," I thought out loud. "And with the DBA, someone not only could view but actually alter the data."

"Sure! He could do anything because God's told him he can. The DBA is Jesus."

Her theological allusions were so outrageous I laughed in spite of myself.

"That's how I got into SQL to begin with," she confessed. "Since you didn't tell me any passwords or anything. I wanted to get into SQL so I could try out some of the commands in the book. I just gave your DBA user name a password I made up so I could get in."

"Wait a minute," I slowed her down. "Wait a minute! What do you mean you assigned a password you made up to my DBA user name? How did you know what my user name is? I didn't tell you."

She explained, "It's in your grants file. I found it in the Home directory where you have all the INP's for the tables you created. You have a file called 'Grants. SQL' where you created all the public synonyms for your tables."

Actually, I hadn't created those tables. Margaret did last year and I loaded my home computer with the boxes of backup diskettes she gave me. Was it possible there was a similar "Grants" file in the OCME computer? I took hold of Lucy's hand and we got up from the couch. Eagerly, she followed me into my office. I sat her down in front of the computer and pulled up the ottoman.

We got into the communications software package and typed in the number for Margaret's office downtown. We watched the countdown at the bottom of the screen as the computer dialed. Almost immediately it announced we were connected, and several commands later the screen was dark and flashing with a green C prompt. My computer suddenly was a looking glass. On the other side were the secrets of my office ten miles from here.

It made me slightly uneasy to know that even as we worked the call was being traced. I'd have to remember to tell Wesley so he didn't waste his time figuring out that the perpetrator, in this instance, was me.

"Do a find file," I said, "for anything that might be called 'Grants.'

Lucy did. The C prompt came back with the message "No files found."

We tried again. We tried looking for a file called "Synonyms" and still had no luck. Then she got the idea of trying to find any file with the extension "SQL" because ordinarily that was the extension for any file containing SQL commands, commands such as the ones used to create public synonyms on the office data tables. Scores of file names rolled up the screen. One caught our attention. It was called "Public. SQL."

Lucy opened the file and we watched it roll past. My excitement was equaled by my dismay. It contained the commands Margaret wrote and executed long ago when she created public synonyms for all of the tables she created in the office data base commands like CREATE PUBLIC SYNONYM CASE FOR DEEP.CASE.

I was not a computer programmer. I'd heard of public synonyms but was not entirely sure what they were.

Lucy was flipping through a manual. She got to the section on public synonyms and confidently volunteered, "See, it's neat. When you create a table, you have to create it under a user name and password."

She looked up at me, her eyes bright behind her thick glasses.

"Okay," I said. "That makes sense."

"So if your user name is 'Auntie' and your password is 'Kay,' then when you create a table called 'Games' or something, the name the computer gives it is really 'Auntie.Games.'

It attaches the table name to the user name it was created under. If you don't want to bother typing in 'Auntie.Games' every time you want to get into the table, you create a public synonym. You type the command CREATE PUBLIC SYNONYM GAMES FOR AUNTIE.GAMES. It sort of renames the table so it's just called 'Games.'"

I stared at the long list of commands on the screen, a list revealing every table in the OCME computer, a list revealing the DBA user name each table was created under.

I puzzled, "But even if someone saw this file, Lucy, he wouldn't know the password. Only the DBA user name is listed, and you can't get into a table, such as our case table, without knowing the password."

"Wanna bet?"

Her fingers were poised over the keys. "If you know the DBA user name, you can change the password, make it anything you want and then you can get in. The computer doesn't care. It lets you change passwords anytime you want without messing up your programs or anything. People like to change their passwords for security reasons."

"So you could take the user name 'Deep' and assign it a new password and get into our data?"

She nodded.

"Show me."

She looked at me with uncertainty. "But you told me not to ever go into your office data base."

"I'm making an exception this one time."

"And if I give 'Deep' a new password, Auntie Kay, it will get rid of the old one. The old one won't be there anymore. It won't work."

I was jolted by the memory of what Margaret mentioned when we first discovered someone tried to pull up Lori Petersen's case: something about the DBA password not working, causing her to have to connect the DBA grant again.

"The old password won't work anymore because it's been replaced by the new one I made up. So you can't log on with the old one."

Lucy glanced furtively at me. "But I was going to fix it."

"Fix it?" I was barely listening.

"Your computer here. Your old password won't work anymore because I changed it to get into SQL. But I was going to fix it, you know. I promise."

"Later," I quickly said. "You can fix it later. I want you to show me exactly how someone could get in."

I was trying to make sense of it. It seemed likely, I decided, that the person who got into the OCME data base knew enough about it to realize he could create a new password for the user name found in the Public. SQL file. But he didn't realize that in doing so he would invalidate the old password, preventing us from getting in the next time we tried. Of course we would notice that. Of course we would wonder about it, and the idea the echo might be on and echoing his commands on the screen apparently didn't occur to him either. The break-in had to have been a onetime event! If the person had broken in before, even if the echo was off, we would have known because Margaret would have discovered the password "Throat" no longer worked. Why? Why did this person break in and try to pull up Lori Petersen's case? Lucy's fingers were clicking away on the keyboard.