Investigating Offices

Inspired (once again) by Shannon, I had a mental look around my offices past and present, to see what clues people might find. Some are more clue-like than others.

Contact lists:

My current office actually has a massive directory of people by department and by name, with phone numbers and emails. There’s also a cribsheet inside the stationery cupboard door (because it’s a convenient unused surface) with numbers for the cleaning company, the security team, the emergency maintenance team, a few very senior staff, and personal numbers for all the staff in our office (to check up on them if they don't come in). That’s pretty hefty stuff. With someone's home number, you can get their address fairly easily, even if that's not written down somewhere in the office too.

Timetables:

As we run shifts, we have two weeks of shifts pinned to the cupboard, plus an actual calendar featuring bigger events. Between these you can work out (with a bit of deduction and ability to match initials with names) who’s doing what shifts, (and therefore when they won’t be at home). You can also find out a lot of appointments, especially meetings, but also things like dental and medical appointments. If you spend time to look at paperwork or read a few emails, you can also work out what the meetings actually are, since most are known by acronyms. This information will tell you who else is likely to go from other parts of the company, which tells you when their offices will be empty. Plus, you can work out which meeting rooms to bug.

Procedures:

Bosses love protocols and procedures, and in our case also love physical paper. This means we have two huge ringbinders of protocols, listing exactly how we’re supposed to handle particular issues, as well as (in some cases) the passwords for computers or bits of software.

Keys:

Bosses like things to be locked, but in a shared office it’s usually not practical for everyone to have the keys, nor for a keyholder to always be around when needed. This means keys are often tucked away somewhere out of sight, but if you have the time to check cupboards and boxes, and try any keys you find, you can probably get into most things.

Personal lockers:

Plenty of offices have personal drawers, lockers or cupboards where staff members can stash their bags, shopping, lunchtime reading, favourite herbal tea, etc. These often also contain bits of miscellaneous paperwork (particularly in offices with hotdesking), and especially paperwork that’s private: job application forms, say, or notes for a meeting where they plan to disagree with their boss. As well as offering some insight into company politics, these can tell you something about individual staff members. On the downside, people tend to take the keys with them; on the plus side, in a lot of offices nobody bothers to lock them in the first place.

Food and drink:

A lot of people have favourite mugs, personal coffee and tea supplies, as well as maybe biscuits, protein shakes, fruit, peanuts or whatever other snacks they like. If you’re burgling the place and planning to come back later, you could quite easily spike some of the supplies with something that’ll send people home sick. This might be a good prelude to turning up imitating health inspectors (or paramedics), or simply taking advantange of the boss being ill to browbeat the junior staff into letting you in. More harmlessly, you could find out what people like, and use that to help befriend them.

Stationery:

Most offices have all kinds of stationery lying around, which might provide some clues. Pre-printed envelopes or labels are pretty common, and give you some idea where things are being sent. Invoices, credit slips and other order details are often not locked away, but just stashed in a tray until they’re dealt with; these can tell you a lot about the flow of money in a company, especially if they’ve been processed and now contain things like budget codes and authorisation signatures. In some cases you might spot dubious uses of company money – I’ve seen a few of those myself – and thse might be handy for blackmail, or for understanding how someone ticks. What do they like? Are they likely to accept a ‘gift’? Can you sweeten them up over time and get some favours? Again, if you know what companies the office has dealt with, and have order numbers and so on, you’re in a strong position to impersonate someone from that company to “fix the photocopier” or “show off some new products”.

Of course, stationery is also handy if you want to forge paperwork from the company. Letterhead stationery, official stamps and other goodies are often just left lying around, because people use them a lot. You can likely also get a look at senior staff’s signatures to fake those.

Printers and copiers:

It’s not that unusual for people to send a load of print jobs, but not pick them up for a long time, especially if they get distracted. You might find both official and personal printouts sitting around in the open, because often a shared printer is still the only place to send private information. In older settings, a typing pool or longhand secretary might produce and deliver a whole load of documents that the boss hasn’t had time to read, and they’re just lying in a tray.

Devices:

Things like phones, laptops and tablets are pretty common, though in shared offices (and especially on junior staff) they’re often frowned on. On the other hand, in a tech company or in a boss’ office you’re likely to see them lying around. As many people don’t bother locking them when not in use, this gives a good opportunity to check contact lists and call histories, read email (it’s likely that Gmail, Facebook and so on will still be logged in even if they’re not open, because they’re tenacious like that), copy whole chunks of data, or even install software for later hacking. This is quite likely a more reliable way to get at email than a desktop would be, as people tend to lock them or shut them down. Emails can get you all kinds of information on appointments, contacts, upcoming events (fire drills are a great chance to spend ten minutes looting the place) and personal lives.

Applications and personnel forms:

There's a fair chance any sizeable office will have some job applications lying around; in most cases it's strictly against policy to leave them lying around in public, but happens nevertheless. As well as anything you can learn about goings-on at the company, the comments they leave on application forms can tell you a lot about people.

Possibly more useful are things like annual review forms and performance reviews. These will tell you a lot about what individuals do, how well they're seen to be performing, and their aspirations. Depending on what the department does, you may be able to use these to find out who was involved with a particular project.

Photo boards:

In sizeable organisations, it's pretty common to have some kind of photo board. It might be official company photos with names under each one, showing the company hierarchy. On the other hand, it could be a collection of staff trip photos, newspaper clippings showing them doing charity work, and "morale-boosting" images of senior staff opening new buildings or talking to lowly underlings.