20. The Voice in the Corridor
Domain: Common Attacks — Social Engineering, Malware POV: Kip Reading time: ~15 minutes
The voice in the corridor sounded exactly like Magistrate Penric.
Kip was walking through the lower levels of the Inner Ward — a shortcut he had learned from Thread, a route that avoided the main passages where the magistrates and the archivists and the petitioners crowded the corridors — when he heard it. Penric’s voice, unmistakable: that particular combination of authority and weariness that Kip had come to know well over the past weeks. The voice was coming from a side passage, a narrow corridor that led to one of the auxiliary chambers where the magistrates sometimes held private meetings.
“Kip,” the voice said. “In here. I need to speak with you. It is urgent.”
Kip stopped. Something was wrong — he could feel it, a subtle wrongness that his conscious mind had not yet identified but that his instincts were already screaming about. Penric had never called him into a side corridor before. Penric had never used that particular tone — the tone of someone who was trying to sound calm but was not calm at all. And Penric would never, under any circumstances, have addressed him by name in an unsecured passage where anyone might overhear.
“Penric?” Kip said, and he did not move toward the corridor.
“Quickly, Kip. There is no time. Vale’s agents are in the building. I need you to—”
Kip turned and ran.
He found the real Penric in his chambers, reviewing a stack of supply reports with the slightly glazed expression of someone who had been reading supply reports for too long. Penric looked up at Kip’s entrance — at the expression on Kip’s face, at the way he was breathing, at the fact that he had clearly run here from somewhere — and set down his papers immediately.
“What happened?”
“Someone is in the lower corridors,” Kip said, still catching his breath. “Someone who sounds exactly like you. They called my name. They tried to get me to come into a side passage.”
Penric’s face went through several expressions in rapid succession — confusion, then alarm, then a cold, hard focus that Kip had learned to recognize as the precursor to action. “Show me. But do not approach the corridor. We will bring Thread.”
Thread’s examination of the side passage revealed something that was simultaneously fascinating and deeply disturbing. The voice — the voice that had sounded exactly like Penric — had not come from a person. It had come from a device. A small brass mechanism, similar in design to the repeater that had been installed in the Great Clock, but configured for a different purpose: recording and replaying sounds. Specifically, recording and replaying voices.
The device contained a small library of recordings — fragments of conversation, snippets of speech, isolated words and phrases — that had been assembled, Thread determined, from weeks of surreptitious monitoring of the Inner Ward’s corridors. Someone had been listening. Someone had been recording. And someone had used those recordings to construct a voice that could say anything — could call Kip’s name, could mimic Penric’s tone, could create a message that was entirely fabricated but sounded utterly authentic.
“Social engineering,” Quill said, when the device was brought to the council. “The manipulation of people through deception. It does not attack the walls or the barriers or the cryptographic systems. It attacks the people — their trust, their judgment, their instinct to respond when someone they recognize calls their name. It is one of the oldest forms of attack, and one of the most effective, because the strongest walls in the world cannot protect a person who has been tricked into opening the door.”
“It almost worked,” Kip said quietly. “If I had not noticed the wrongness — the tone, the location, the fact that Penric would never call me into a side passage — I would have walked into that corridor. And whatever was waiting for me there…”
He did not finish the sentence. He did not need to.
The voice-device was not the only weapon of its kind. Over the following days, Thread’s investigation uncovered a network of similar devices scattered across the city — some of them recording, some of them replaying, some of them configured to do both. A device in the Library’s public galleries had been recording the conversations of archivists and scholars for months, harvesting the raw material for fabricated messages. A device near the Commons had been replaying fragments of official proclamations, subtly altered, spreading misinformation about the council’s decisions and the Shroud’s advance. A device in the gear-works — this one the most sophisticated of all — had been configured to inject false commands into the automaton control network, causing the brass workers to perform actions that their human supervisors had never authorized.
“Malware,” Quill said, using a term from the old treatises that described malicious mechanisms designed to infiltrate and corrupt systems from within. “The repeater device in the Spire — that was malware. It inserted false beats into the master rhythm, corrupting the city’s foundation of truth. The voice-devices are malware too — a different kind, targeting communication rather than timekeeping, but operating on the same principle. They are mechanisms that have been introduced into the system with the intent of causing harm.”
“And the supply chain,” Thread added. “The voice-devices did not appear from nowhere. They were built using materials that were acquired through legitimate channels — precision gears from the gear-works, recording mechanisms from the Library’s audio archives, brass fittings from the same suppliers that the city has used for decades. The adversary did not need to smuggle weapons into the city. They built their weapons inside the city, using the city’s own resources.”
“So we cannot simply inspect incoming shipments,” Sable said. “The threat is already inside. The malware is already deployed. We need to find every instance of it — every device, every corrupted mechanism — and remove it, before it does more damage.”
The malware hunt consumed the next two weeks. Thread and Wren led the search, moving through the city district by district, checking every mechanism that could conceivably have been compromised. The voice-devices were the easiest to find — they emitted a faint hum when active, a telltale vibration that Thread could detect from several corridors away. The automaton-corrupting devices were harder — they were embedded deep inside the gear-trains, hidden among the legitimate mechanisms, indistinguishable from the surrounding machinery except for the subtle wrongness of their behavior.
And then there were the devices that were not devices at all — the corrupted personnel, the compromised insiders who had been turned not by mechanisms but by social engineering: the manipulation of trust, the exploitation of fear, the careful cultivation of dependence that Vale had been practicing for years. These were the hardest threats to detect and the hardest to neutralize, because they did not hum or vibrate or announce their presence with any physical signal. They simply looked like people — people who had been placed in impossible positions and had made choices that they could not undo.
“We cannot remove everyone who might be compromised,” Kip said, as the fellowship reviewed the latest findings. “There are too many of them, and some of them do not even know they are compromised. They think they are doing the right thing. They think they are protecting the city.”
“Then we do not remove them,” Thread said. “We educate them. We show them what the devices actually do — the recordings, the fabrications, the corruption. We show them that the voice they trusted was not Penric’s voice, that the orders they followed were not genuine orders, that the cause they thought they were serving was not the cause they were actually serving. And we give them the same choice we gave Lissa and Corbin and Mari: cooperate, and be protected.”
“It will take time,” Sable said.
“Yes. But the alternative — trying to remove every compromised person, or locking down the city so thoroughly that no one can move or speak or act — is worse. It would break the city faster than the Shroud could.”
Kip thought about the voice in the corridor — the wrongness he had felt, the instinct that had told him to run. He had been lucky. He had noticed the discrepancy, had trusted his instincts, had gotten away. But not everyone would be so lucky. Not everyone would notice that the voice was wrong. And the people who did not notice — the people who walked into the side corridor, who followed the false orders, who trusted the fabricated message — would become, through no fault of their own, part of the attack.
“The defense against social engineering is not technology,” Kip said slowly. “It is awareness. It is teaching people to recognize the signs — the wrongness in the voice, the discrepancy in the message, the instinct that says ‘this is not right’ even when you cannot articulate why. The strongest walls and the best cryptography and the most rigorous access controls mean nothing if a person can be tricked into opening the door.”
He looked at the voice-device on the workbench — the small brass mechanism, the library of recorded snippets, the ability to fabricate any message and make it sound like anyone’s voice — and he understood, with a clarity that was almost physical, that the most dangerous weapons in the adversary’s arsenal were not the ones that attacked walls or barriers or cryptographic keys. They were the ones that attacked people — their trust, their judgment, their willingness to believe that a familiar voice meant a familiar person, that a plausible message meant a genuine order, that the world was still the same world they had always known.
The world was not the same. The voices in the corridors could not be trusted. And the only defense — the only real defense, the one that technology could not replace — was the willingness to notice when something felt wrong, and to run, and to ask questions, and to keep asking until the truth came out.