`We have long had a problem with alcohol and drug abuse due to the stressful nature of the company environment. No further investigation is necessary.' At his computer terminal, Anthrax smiled. How embarrassing was that going to be? Try scraping that mud off. He felt very pleased with himself. Anthrax then tidied up his things in the company's computer, deleted the sniffer and moved out. Things began to move quickly after that. He logged into System X later to check the sniffer records, only to find that someone had used his login patch password on that system as well. He became very nervous. It was one thing goofing around with a commercial site, and quite another being tracked from a military computer. A new process had been added to System X, which Anthrax recognised. It was called `-u'. He didn't know what it did, but he had seen it before on military systems. About 24 hours after it appeared, he found himself locked out of the system. He had tried killing off the -u process before. It disappeared for a split-second and reappeared. Once it was in place, there was no way to destroy it. Anthrax also unearthed some alarming email. The admin at a site upstream from both System X and the company's system had been sent a warning letter: `We think there has been a security incident at your site'. The circle was closing in on him. It was definitely time to get the hell out. He packed up his things in a hurry. Killed off the remaining sniffer. Moved his files. Removed the login patch. And departed with considerable alacrity. After he cut his connection, Anthrax sat wondering about the admins. If they knew he was into their systems, why did they leave the sniffers up and running? He could understand leaving the login patch. Maybe they wanted to track his movements, determine his motives, or trace his connection. Killing the patch would have simply locked him out of the only door the admins could watch. They wouldn't know if he had other backdoors into their system. But the sniffer? It didn't make any sense. It was possible that they simply hadn't seen the sniffer. Leaving it there had been an oversight. But it was almost too glaring an error to be a real possibility. If it was an error, it implied the admins weren't actually monitoring the connections in and out of their systems. If they had been watching the connections, they would probably have seen the sniffer. But if they weren't monitoring the connections, how on earth did they find out his special password for the login patch? Like all passwords on the system, that one was encrypted. There were only two ways to get that password. Monitor the connection and sniff it, or break the encryption with a brute-force attack.