The St Andrews Exception

Hamish MacNair first noticed the problem because somebody was washing their clothes too regularly.

This was not, in itself, suspicious.

Hamish understood that most people regarded regular laundering as evidence of good character. His mother certainly did. Elspeth MacNair regarded clean socks, vegetables and properly filed receipts as the three pillars upon which civilisation rested.

But people were not regular.

Machines were regular.

People intended to do their washing every Thursday at quarter past two and then forgot because somebody suggested lunch, or it was raining, or they had run out of detergent, or they simply discovered something better to do with their afternoon.

This particular student had used washing machine number seven in the basement of St Salvator's Hall at almost exactly 2.15 p.m. on six consecutive Thursdays.

That made Hamish look twice.

At 10.14 on the seventh Thursday, he was sitting in a corner of North Point Cafe on North Street with three terminal windows open on his laptop and a mug of tea going cold beside him.

Hamish was twenty-three, six-foot-two and possessed of the irritating sort of appearance that other people assumed must have required effort.

It had not.

His dark hair looked deliberately untidy because he forgot to comb it. His spectacles were repaired at one hinge with black electrical tape because the repair worked and replacing them would therefore be wasteful. He had a long face, good cheekbones and absolutely no idea that any of this mattered.

A woman stopped beside his table.

Hamish continued typing.

She remained there.

Eventually he noticed the shadow across his keyboard.

He looked up.

"Hello, Fiona."

Fiona Bell was studying medieval history and had known Hamish for almost a year. She had also been attempting, with diminishing subtlety, to persuade him to go on a date for approximately six months.

"Can I sit down?"

Hamish looked at the empty chair.

"Yes."

"Thank you."

She sat.

Hamish returned to the screen.

Fiona waited.

"You look busy."

"I am."

"Anything interesting?"

"Washing machines."

Fiona nodded.

She had learned that asking Hamish a question required accepting the consequences.

"What about them?"

"One of them is being interrogated."

Fiona looked at the laptop.

"By you?"

"No. Latvia."

That got her attention.

"Latvia is interrogating a washing machine?"

"A server in Latvia. Latvia as a nation is probably unaware."

"Good. I wouldn't want this becoming diplomatic."

Hamish looked at her.

For a fraction of a second Fiona thought she had got him.

Then he returned to the terminal.

She sighed.

"I'm going to the cinema tonight."

"That sounds sensible."

"You could come."

"I don't particularly like films."

"You liked Alien."

"The quarantine procedure was appalling."

"Hamish."

He looked up again.

"I am asking whether you would like to come to the cinema with me."

"Yes."

Fiona blinked.

"Yes?"

"Yes. You have asked."

"No. I mean, would you like to?"

Hamish considered this.

"I don't know what you're seeing."

Fiona closed her eyes.

"Seven o'clock. Outside the Picture House."

"I may be late."

"You won't."

"I might."

"You'll set three alarms."

"That is unrelated."

Fiona smiled despite herself.

"Seven."

She stood.

Hamish nodded and returned to the washing machine.

Fiona had reached the door when he called after her.

"Do you use Wash-O-Matic?"

She turned.

"That is quite possibly the worst question anyone has ever asked me after agreeing to a date."

"The laundry application."

"Yes."

"Don't."

"Why?"

"I don't know yet."

That answer changed her expression.

Hamish rarely admitted that.

"All right."

She left.

Hamish enlarged the traffic log.

The University of St Andrews had recently outsourced payment for several residence laundry rooms to a company whose application allowed students to see which machines were available, pay for a cycle and receive a notification when their washing was finished.

It was convenient.

It was also badly designed.

The application exposed considerably more information than was necessary. A sufficiently persistent observer could determine which residence contained a particular user, which machine they preferred and when they normally used it.

Hamish had reported that three months earlier.

He had received an automated response thanking him for helping Wash-O-Matic improve the customer experience.

Nothing had changed.

Now someone else had noticed.

The Latvian server was querying hundreds of machine records but retaining the results for only one user.

Hamish followed the requests backwards.

The user ID had been salted, but badly.

He found the residence.

St Salvator's Hall.

Hamish stopped typing.

There was a student at St Salvator's Hall whose presence at the university was officially treated as unremarkable.

Four protection officers accompanied this unremarkable student between lectures.

University staff never mentioned the student's family.

Students mentioned almost nothing else for the first fortnight and then, because this was St Andrews, largely got bored.

The student's name was not secret.

Hamish nevertheless had no intention of using it.

He referred to the individual privately as Subject B.

St Andrews had a way of making the present look temporary.

The town had been built in layers of argument: medieval stone, Georgian fronts, Victorian additions, university noticeboards, fibre-optic cable. On North Street, students moved between buildings older than several countries while checking messages on phones that would be obsolete before they graduated. The sea was never far away. Even when it could not be seen, it announced itself in the salt on windows and the gulls that treated the town as an occupied territory.

Hamish liked the contradiction. Ancient things did not bother him. Ancient things generally had documentation. It was new systems pretending to be simple that caused trouble.

His room in a narrow flat off South Street reflected this belief. The furniture belonged to three different decades. The desk had been reinforced by Euan with a length of timber he insisted was 'perfectly serviceable'. Two monitors stood on it beside a soldering iron, a mug containing six screwdrivers and a photograph of Patrick MacNair beside an enormous radio set. Fiona had once described the room as what would happen if a computer laboratory developed mould and applied for listed-building status.

Hamish had taken that as a compliment.

The photograph of Patrick had been taken in Kirriemuir when Hamish was nine. Patrick was seated at the radio, headphones around his neck, one hand resting on a tuning dial. Hamish stood beside him with the solemn expression of a child who had just been entrusted with classified information. In reality, Patrick had been teaching him to distinguish atmospheric noise from a distant amateur operator in Norway.

'Listen before you name it,' Patrick had said.

Hamish had remembered that sentence long after he forgot the Norwegian's call sign.

The university network gave him the same pleasure as the radio had. Thousands of devices talked constantly. Printers announced themselves. Door controllers checked in. Lecture theatres requested updates. Students streamed music, lost passwords, connected kettles to wireless networks and named their laptops things they believed were amusing. Most of it was noise.

Patterns lived inside the noise.

That was why the Wash-O-Matic traffic bothered him before he knew what it meant.

Earlier that week he had shown it to Dr Aileen Mercer, his dissertation supervisor, in her office overlooking a courtyard wet with November rain.

Mercer was in her forties, permanently short of time and one of the few academics Hamish had met who could interrupt him without making him feel interrupted.

'Why are you looking at washing machines?' she asked.

'I wasn't.'

'Of course not.'

'I was measuring persistent identifiers across poorly segmented campus services.'

'And the washing machines volunteered?'

'Essentially.'

She leaned towards his screen.

Hamish showed her the repeating queries.

'Could be maintenance.'

'Could be.'

'Could be analytics.'

'Yes.'

'Could be somebody with too much time.'

Hamish looked at her.

Mercer smiled. 'I include you in that category.'

He ignored this.

'What makes it interesting?' she asked.

'It selects one identifier and discards the rest.'

'Whose?'

'I haven't resolved it.'

Mercer sat back. 'Then don't.'

Hamish frowned.

'You are allowed to notice a security problem without proving you can exploit it.'

'But if I don't establish impact, they'll classify it as low severity.'

'And if establishing impact means identifying a student from supposedly anonymous telemetry?'

Hamish looked at the traffic again.

This was the part of computing he disliked. A machine would accept a command if permissions allowed it. People expected him to understand whether a command ought to be given.

Mercer watched him think.

'Your grandfather's rule,' she said.

Hamish looked up. He had told her about Patrick once, months earlier.

'What do you know, and what do you think it means?'

Hamish closed the lookup window he had been about to run.

'Annoying,' he said.

'Good supervision often is.'

He left the office without resolving the identifier.

By Thursday morning, the external server had done it for him.

And by Thursday afternoon, the distinction between a privacy flaw and a physical threat would no longer feel academic.

There had once been a Subject A.

Subject A was the reason Hamish was no longer welcome at Balmoral.

That incident had involved a router, a badly configured guest network and several dogs.

Hamish maintained that the dogs had escalated matters unnecessarily.

His father maintained that one could not blame a corgi for defending the Crown.

His mother maintained that Hamish had been specifically instructed not to touch anything.

The Palace had eventually sent a handwritten letter.

Hamish kept it in a shoebox.

It was the most formal request to stop interfering with wireless infrastructure he had ever received.

He had labelled the entire episode THE BALMORAL MISUNDERSTANDING and refused further questions.

Now Subject B's laundry account was being watched.

Hamish opened six weeks of records.

Thursday.

14:17.

Thursday.

14:11.

Thursday.

14:19.

The times varied slightly.

The pattern did not.

He checked the residence layout.

Basement laundry.

One public stairwell.

A service corridor at the rear.

Hamish sat back.

Something his grandfather had taught him surfaced from memory.

Write down what you know before you decide what it means.

Patrick MacNair had been dead for three years.

He had spent much of his life repairing radios and distrusting conclusions reached before tea.

Hamish opened a blank document.

KNOWN

A remote server repeatedly queries one student ID.

The student is Subject B.

Queries increase on Thursdays.

Subject B regularly uses basement laundry Thursday afternoons.

Hamish hesitated.

Then typed:

NOT KNOWN

Why.

Who operates server.

Whether surveillance is hostile.

Whether laundry pattern is the actual target.

That last one bothered him.

He went back to the traffic.

There was something else.

The same server wasn't merely requesting laundry information.

It was checking when the machines became available.

Then querying a completely different university service.

Hamish followed it.

Facilities management.

Door status.

Not control.

Status.

Someone wanted to know whether the rear service entrance was open.

Hamish checked his watch.

1.43 p.m.

He looked at Subject B's previous Thursdays.

The laundry normally began between 2.11 and 2.19.

By Thursday evening, he would.

At the time he had not recognised the value of that.

Years later Hamish would remember the walk not because anything happened, but because nothing did. No threat. No anomaly. No hidden system demanding to be understood. Just Fiona, the wind and a beach broad enough to make the university's ancient certainties look temporary.

They continued towards the Eden estuary.

'Absolutely nothing, apparently.'

'What does that have to do with anything?'

Hamish frowned.

'You're lucky you're pretty.'

She studied him for a moment, then laughed.

He came back.

'Much.'

'Was that worse?'

Hamish took three more steps before noticing.

Fiona stopped walking.

'They are systems with undocumented behaviour.'

'I'm genuinely relieved.'

'People are not problems.'

Hamish glanced at her.

'And people?'

'I didn't say it was bad. A problem can just be something not yet understood.'

'That is a terrible philosophy.'

'There is always a problem.'

'What do you do when there isn't a problem?' she asked.

Wind pressed Fiona's coat against her and lifted Hamish's hair until it looked even more deliberately arranged than usual.

They walked on.

'Needing to.'

'Not knowing?'

Fiona smiled. 'There. That's your problem.'

'I don't know.'

'And this matters because?'

Hamish pointed towards a building above the dunes. 'It has been replaced.'

'You have been looking at that aerial for five minutes.'

'I am looking at the sea.'

'You know,' she said, 'most people come here and look at the sea.'

Fiona carried her shoes. Hamish kept his on because sand was, in his view, an argument for footwear.

The beach stretched north in a pale curve beneath a huge November sky. St Andrews sat behind them in towers and roofs, suddenly small against sea and sand. Runners passed in bright jackets. Dogs pursued gulls with the optimism of animals unfamiliar with aerodynamics.

The previous Sunday, Fiona had persuaded Hamish to walk along West Sands.

Hamish shut the laptop.

Then opened it again because shutting it before putting it in the bag was pointless.

He stood too quickly, caught his foot in the charger and nearly pulled the table over.

A waitress caught his tea.

"Sorry."

"You're going to kill yourself with that thing one day."

"Statistically unlikely."

Hamish ran.

The two protection officers outside St Salvator's Hall saw him coming.

This did not improve matters.

Hamish's coat was open, his laptop bag was bouncing against his hip and he had the expression of a man who had just discovered that mathematics was personally offended.

The larger officer stepped into his path.

"Afternoon."

"I need to speak to whoever is responsible for Subject B."

"No."

"It's about the laundry."

The officer stared at him.

Hamish realised this had not been an ideal opening.

"The electronic laundry system."

"No."

"Someone is using it to monitor your protectee."

The second officer looked over.

The first remained impassive.

"Sir, move along."

Hamish opened his laptop.

The officer put a hand over the lid.

"Don't."

Hamish stopped.

Patrick again.

What do you know?

"Fine. At 2.15 your protectee normally uses machine seven in the basement. Somebody outside the university knows that. They've checked the rear service-door status eleven times today."

The officer's hand moved away from the laptop.

Hamish continued.

"The last check was four minutes ago."

He decided there was insufficient data.

Now, running down North Street towards St Salvator's Hall, Hamish briefly wondered whether a second royal security incident might indicate a pattern.

He also kept it because Patrick would have found the whole thing hilarious.

Hamish kept the letter because the wording was excellent.

'Official correspondence from the Royal Household asking him not to help.'

Euan looked up. 'What's that?'

It arrived in Kirriemuir four days later on heavy cream paper. Elspeth read it twice, placed it beside Hamish's cereal and said, 'You have achieved something your father never managed.'

This did not prevent the letter.

The network worked afterwards.

'Apparently, sir.'

'Is that bad?'

The senior figure looked at the security officer.

One of the dogs barked.

There had been a silence.

'The guest network is double-NATed,' Hamish had explained from the bench.

Hamish retreated onto a bench. The dogs surrounded it. A security officer arrived. Then another. Finally, to Hamish's lasting mortification, a senior member of the household appeared and asked what on earth was happening.

The corgis entered the story because somebody opened a second door while Hamish was crouched beside a network cabinet. Four dogs interpreted a tall stranger holding a cable as a constitutional threat.

According to Elspeth, both descriptions omitted the important fact that he had been told not to.

According to Euan, Hamish disappeared behind a door marked PRIVATE.

According to Hamish, he corrected a configuration error.

What followed depended on who told it.

Hamish had mentioned this to a member of staff, who had thanked him. He had then mentioned the likely cause. The member of staff had thanked him again, more firmly. Twenty minutes later Hamish found an access point broadcasting with factory credentials from an outbuilding.

The guest network at Balmoral had failed before lunch.

Euan had supplied ironmongery to an estate contractor. Elspeth had decided this constituted a cultural opportunity. Hamish had brought a laptop because cultural opportunities rarely provided reliable wireless access.

The Balmoral story had begun two summers earlier, during a family visit Hamish had not wanted to attend.

The officer touched his earpiece.

"Alpha Two, confirm rear service."

Silence.

He repeated it.

Nothing.

The second officer was already moving.

The first looked at Hamish.

"How do you know this?"

"Bad software."

A burst of speech came through the earpiece.

The officer's expression changed.

"Stay here."

He ran.

Hamish stood alone in the quadrangle.

He lasted approximately four seconds.

Then he followed.

The basement fire door was locked.

One officer was already trying the access panel.

"Service override isn't responding."

Hamish looked at it.

"What system?"

The officer ignored him.

Hamish looked at the manufacturer instead.

"I know that controller."

"You were told to stay outside."

"Yes."

"Go outside."

"The controller releases on a fire alarm."

"We know."

"So trigger the local alarm."

"We cannot deliberately evacuate a protected building without knowing what's beyond that door."

Hamish looked at the floor plan on his screen.

The laundry room had a water sensor.

He looked at Wash-O-Matic.

Then back at the officer.

"I can probably make it believe there's a flood."

The officer stared at him.

"Probably?"

"The distinction between probably and definitely is important."

A crash came from behind the door.

That settled the philosophical question.

"Do it."

Hamish dropped to the floor.

He did not hack twelve washing machines into destroying themselves.

That would have been ridiculous.

He did something much less impressive.

Wash-O-Matic's maintenance interface allowed engineers to run a drain test.

The leak detector beneath machine seven was connected to the university building-management system.

Hamish started the test.

Stopped the pump.

Waited.

Water reached the sensor.

An alarm sounded.

The basement controller released the fire doors.

The protection officer pulled.

The door opened.

Three men were inside.

One was near the service entrance.

Another had Subject B by the arm.

The third turned towards the door.

Everything after that happened too quickly for Hamish to understand properly.

The protection officers entered.

Someone shouted.

Subject B dropped flat.

One attacker slipped on water from machine seven.

That part, Hamish felt, was at least partly his contribution.

Twenty seconds later it was over.

Hamish remained in the doorway.

Subject B was sitting against a dryer, breathing very quickly.

Not calm.

Not reading a magazine.

Frightened.

But watching.

The young royal looked at the water spreading across the floor.

Then at Hamish.

"You did that?"

Hamish adjusted his spectacles.

"The application exposes persistent user identifiers."

Subject B stared.

"The washing machine?"

"Yes."

A pause.

"That's incredibly stupid."

Hamish looked at the flooded floor.

"Yes."

Subject B began to laugh.

It wasn't dignified laughter.

It was the slightly uncontrolled laughter of someone who had just realised they were not going to be kidnapped.

One of the protection officers looked at Hamish.

"Mr MacNair?"

"Yes?"

"You and I are going to have a fairly long conversation."

Hamish nodded.

"Could we do it before seven?"

"Why?"

"I have a date."

The officer looked at the flooded laundry, the restrained kidnappers and the future constitutional problem sitting against a tumble dryer.

"Of course you do."

At 9.26 that evening, Hamish stood outside the Picture House.

Fiona had gone.

There was a note taped to the door.

It was not for him.

He read it anyway.

Then he checked his phone.

Four missed calls.

Seven messages.

The last was from Fiona.

I assume either the royal family or a washing machine has killed you. Call me when you aren't dead.

Hamish typed:

Both involved. Neither successful. Sorry.

He considered adding something.

After forty-three seconds, he wrote:

Would tomorrow work?

Three dots appeared almost immediately.

YES, HAMISH. TOMORROW WOULD WORK.

Hamish frowned at the capital letters.

Then walked home.