Sutcliffe saw me studying Wilhelm’s face.
“Mr. von Wilhelm has personally donated several million dollars to our Access Solutions fund.”
“Seems like a charitable guy,” I said.
“Well, our job is to help families like yours get the medication you need. We know these are tough times. Millions are uninsured, and millions more are underinsured. My office is tasked with helping families get through the financial aid process as quickly and painlessly as possible.”
“To be honest, I was surprised you agreed to meet with me in person,” I said. “From what I read about these programs, a lot of it is done online.”
Sutcliffe seemed to take personal satisfaction from my observation. “Our office is unique in that regard. We believe, with Mr. von Wilhelm’s full support, that a personal touch during what is obviously a difficult time not only builds goodwill with our customers, but sets an example for the rest of the industry to follow.”
“Well, I think this industry is pretty messed up,” I said. “I’m paying a lot of premiums without getting much for my money.”
“Do you mind if I ask who you’re insured with?”
“Atrium,” I said.
Sutcliffe groaned. “Goodness, they’re difficult to deal with.”
I nodded my head vigorously and recounted my experience with Leonard Tate.
“So they wouldn’t make a generic shortage exception?” Sutcliffe said in a voice wavering with disgust.
“What’s that?” I asked.
“Some insurance companies will cover the full cost of a brand-name drug if the generic isn’t available. I guess Atrium isn’t one of them.”
“Well, how much do you think Ruby and I will be able to get toward the cost?”
Sutcliffe already had my application. I’d sent it to her the day after I hung up on Tate. She knew how much money we made. She smiled, and I felt lighter already.
“It looks like you’ll be able to get the maximum coverage.”
I smiled back. My body tingled like it was full of helium.
“That’s great news,” I said, letting go a deep sigh. “That’s incredibly generous.”
“Twelve thousand dollars is the largest per patient donation of any major pharmaceutical company.”
I swallowed air.
“Twelve thousand?” I said. “Ruby’s course of treatment is well over three hundred thousand dollars.”
Sutcliffe appeared genuinely surprised. “I’m sorry,” she said. “But you don’t qualify for our full access program.”
“What? Why not?”
“Because you have some form of insurance. The full access program is only for the uninsured. It’s also given out by lottery. We couldn’t afford to give our medications out for free. I guess I should have been more clear on the phone.”
I was speechless. For a while, I just stared blankly at the floor. Thinking.
This wasn’t a question of going into debt. This was about not being able to get the drug at all. Twelve thousand dollars represented two weeks of treatment at most.
I buried my indignation. At least we had something—a start.
“My wife and I are truly grateful for your generosity,” I said.
Vivian Sutcliffe smiled, evidently pleased. “We’re glad we can help.”
“One thing,” I asked, my mind already racing. “If Atrium is so bad and inflexible, what are some insurance companies that would have covered us for the full course of treatment?”
“Oh, that’s an easy one,” Sutcliffe said. “UniSol Health is the biggest and the best. They’d cover the full cost, even if the generic were available. I should know, because that’s who insures Wilhelm Genetics employees.”
“Thanks,” I said. I meant it, too. Because now I knew how I was going to fix our problem.
CHAPTER 5
I felt heartsick watching Ruby sleep. Was she thinner already? Had she become anemic? Her skin coloring matched the white of our bedsheets, and this was after taking Verbilifide for only two weeks. With credit cards we had enough money for another course of treatment, even though Ruby already didn’t want to take it.
It was hard for me to believe the drugs were better than the cancer. Ruby would sweat off pounds she didn’t have to spare while she slept. Pain would sometimes overtake her, leaving her breathless and doubled over, as though she’d been punched. Walking to the living room became a test of endurance. The drugs battling her disease kept calling up reinforcements from every vein in her body, marshaling the troops at the expense of her life spirit.
Ruby’s breathing, shallow and quick, matched the rhythm of my own beating heart, as though ours were two bodies entwined as one. I sat on the edge of the bed, stroking her hair, then brushed her skin with a cool, damp cloth to soak up the sweat. Her skin felt cool to the touch, slack where it should have been pliable. I wanted to suck up her sickness, like John Coffey from The Green Mile, and spit it out as a vile horde of black flies. Instead, I put on her latest favorite Pandora station—Adele and music that sounded just like Adele—and settled down at my desk to get to work.
The unfairness of it all didn’t matter. My wife ate organic, slept eight hours whenever she could, exercised, read up on all the supposedly dangerous products and chemicals to avoid. She embraced nature and natural living with enthusiasm, while nature kindly responded by spitting in her face. The why didn’t matter anymore: Ruby had cancer. Her life was now divided into two distinct epochs, Before Cancer (B.C.) and After Cancer (A.C.), and time would forever be measured against these markers. No, it wasn’t fair at all.
I held on to this thought while I configured my phone-spoofing application.
Before Ruby’s illness, I didn’t know much about phone-spoofing technology. I knew it worked through either PSTN or VoIP. Yeah, tech stuff and cancer share a common alphabet soup of indecipherable terminology. Voice over Internet Protocol—that’s longhand for VoIP—is a communication protocol for delivering voice and multimedia data over the Internet. Most of the phone-spoofing services I found relied on the VoIP protocol over PSTN because it was easier to use and a lot more flexible for breaking the law.
Web sites advertising this type of service tried to highlight legitimate reasons for their use. Say, for example, a business wanted to substitute the number they were calling from with a different call-back number. Well then, phone spoofing provided an excellent and reliable solution to that pretty nonexistent problem. Like I said, it was a stretch to find an application for this technology that even hinted at legitimacy. More often than not, phone spoofers were hackers, like I was about to become, and a hacker’s intention is anything but legit.
Over the years, IT experts have spent countless billions beefing up their computer security infrastructure. They’ve brought in meatier computers, state-of-the-art virus protection software, firewalls, and various tools of the trade to keep the hackers out. What they can’t upgrade are the people who work in their call centers. This weakness can’t be fixed with code or by upgrading to a smarter model. People will do what people will do. When a hacker gets a customer service representative on the telephone, that’s when the real magic happens; it’s the moment a dedicated employee becomes the unwitting accomplice of a crime.
The technique is called social engineering, the art of manipulating people into performing actions or divulging confidential information. If social engineering is the getaway car of cybercrime, then the telephone is the gun. To commit my crime, I needed to disguise my phone number. I was about to make a bunch of calls to the customer service department at UniSol Health. Eventually, I’d rouse at least one rep’s suspicion if he saw the same number popping up time and time again on his call screen. None of this could be easily done through the good old-fashioned phone network. Thankfully, the Internet makes most everything possible, especially crime.
At first I thought about using SpoofPhone. The company’s tagline eliminated all doubt as to what service they provided: “The Global Leader in Caller ID S
poofing.” Then I looked at the price: ten cents per minute. I figured with the number of calls I needed to make, the cost would be prohibitive. Instead, I settled on a technology called Asterisk.
Asterisk required a spare computer, which I had, and a VoIP service, which I got from VoicePulse. It didn’t take much Linux knowledge to get the program installed and working. Of course, there were a few configuration files to tweak, but that was rudimentary work. Then I had to route my business phone to run through the Asterisk program. It took me three hours. Good thing I work quickly when motivated.
Before all this took place, I scanned through my database of registered One World game players, searching for men with a similar demographic to my own. One of these guys, unwittingly, was going to help save my wife’s life.
As a matter of protocol, I don’t store much customer information in my database, but I do require a credit card for buying specialty items and energy boosts for a better game-playing experience. That means I’ve got names and billing addresses on file. Lots of them. I also asked a bunch of voluntary questions on my registration form: phone numbers, sex, date of birth, that sort of thing. Gamers like to support the independent guy, so about half of my registered players filled out the entire form. It was enough information to get me started.
I tested out the installation by calling my cell phone from my business line. I picked a random phone number from our business card booklet, a bug exterminator in Cambridge. Mice weren’t the only creatures lurking about our apartment that Ginger liked to chase.
My cell phone rang. I checked the display. Sure enough, it looked as though Ace Exterminator was calling to fix our cockroach problem once and for all.
My phone call, however, appeared to have awoken Ruby. Ginger perked up as well, first a wide yawn, paw stretch, back stretch, and shake, then a leap off the bed. I wrapped Ruby in my arms and gave her a tender kiss hello. Ginger meowed, perhaps out of jealousy, prompting me to give her head a quick scratch.
“Who called?” Ruby asked. The torpor in her voice proved contagious as I stifled a yawn of my own.
“Nobody,” I said. “Wrong number.”
I’m sure I looked guilty of something, but Ruby didn’t seem to notice. It felt terrible to keep a secret, but then again, I knew Ruby would squash my plan during its inception stage. I was less certain how she’d react when it came time for the execution phase.
“Oh,” Ruby said, a touch of disappointment in her voice. “I thought it might have been my mother calling.”
A call to Ruby’s mother earlier in the week had netted us a five-hundred-dollar wire transfer with a promise to visit soon.
Ruby was right not to hold her breath.
Winifred Dawes—Winnie, to her drinking buddies—hadn’t left St. John once in the ten years since moving to the Caribbean retreat. Ruby had wanted to send her mother an e-mail, an impersonal update on her cancer treatment, but I insisted that we chat via Skype. Winnie talked to us from below deck. It was ten o’clock in the morning, but I knew her mug of coffee was really filled with wine. Five times in the course of our conversation, Winnie remarked on how great Ruby looked. This wasn’t meant to be encouraging. It was Winnie’s way of saying, “You don’t really need to see me just yet.” Guess the five hundred bucks bought Winnie several guilt-free weeks of getting sauced in the sun.
My mother, Pauline, a petite woman with curly gray hair and a face weathered by the weather, had flown in from Denver shortly after we gave her the news. She took a week off work from her job as a payroll clerk for Boulder, Colorado, the same city where I grew up. My mom didn’t have much money to lend, but contributed what she could. I could see the heartbreak in my mother’s eyes when it came time to leave. She gave Ruby a long embrace at Logan Airport, brushing aside tears as we departed. Ruby got from my mother what she never got from her own.
“I love you both,” Mom had said.
She left us with a promise to return soon, which I knew would be well before Winnie ever came.
A case worker from Dr. Adams’s office had been given the impossible task of finding us grants and other programs to help cover the cost of Verbilifide. The best option, Prescription Assistance, a nonprofit that helped the low income and uninsured obtain unaffordable medications, did not count Verbilifide among the two thousand-some odd drugs in their program.
Strike one.
We maxed out our credit cards in procuring Ruby’s next course of treatment. Strike two. Thankfully (that’s sarcasm), the medication’s side effects—lethargy, nausea, moodiness—were far more present and available than our limited funds. Ruby’s school friends managed to raise a thousand dollars from a walkathon, while her former employer pitched in another grand. The red tape of the Wilhelm Genetics Access Solutions program didn’t make life any easier. There was a rather lengthy time lag between being approved for the twelve-thousand-dollar grant and actually having the cash deposited in our bank account.
Strike three.
I kept a running tally in my head. Accounting for all funds raised, we were short a mere $270,000. Good thing I knew how to ameliorate our financial situation. The hard part would be convincing Ruby to go along with my plan.
CHAPTER 6
The UniSol Health phone tree might have been the most annoying of them all. That was probably because it felt like I’d listened to the same computerized female voice a thousand times. She sounded less pleasant to me than Freddy Krueger’s nails traveling down an endless chalkboard.
Press three if you’d like to cut down this phone tree with a chain saw!
I pressed five to speak with a customer service representative—same as I’d done the last twenty-three times. Odds were good I’d get a hit eventually. Going by the numbers on the UniSol Web site, the company insured one out of every four Americans.
Ruby was out with friends from school, enjoying a little get-together, which I helped to arrange. I needed privacy to make my calls, and Ruby rarely ventured farther than our front door. The desire to socialize was just one of many things Verbilifide had extinguished, along with her appetite, ability to sleep, and a host of other activities we used to take for granted.
Ruby still had her hair—this wasn’t chemo—but she looked noticeably thinner to the four girls and one guy who came over to take her out to lunch and a movie. Her friend Elisa, whose olive skin and dark hair made Ruby’s sickly pallor all the more pronounced, told my wife she looked great, while her eyes betrayed the lie.
Ruby paused briefly at our apartment’s threshold, giving me the same look Ginger uses whenever she wants to sleep in our bed. I gave Ruby a long hug, whispered in her ear, “You’ll be fine. It’s just for a little while.” I actually checked the time and made a mental note of the hour. My plan already had enough pitfalls, and I sure didn’t want Ruby coming home to the scene of the crime while the crime was taking place.
Social engineering exploits a weakness in one of humanity’s greatest strengths: our inherent desire and ability to trust. I don’t particularly enjoy lying to people, and what I was doing filled me with remorse. At least my intentions were noble, so I could justify my actions. That dollop of justification was all I needed to take those first awkward steps across the line of the law. I was a criminal as soon as I made my first call, and I did so thinking, I’m doing this for Ruby.
I pressed buttons so that my call would be routed to a living, breathing human being.
“Thank you for calling UniSol Health. How may I provide you with exceptional customer service?”
I wanted to say to the chipper-sounding UniSol rep, “Could you just give me the account number of a customer whose insurance will cover the full cost of Verbilifide?” But Social engineering requires a bit more subtlety, so instead I lied and said, “My name is Greg Johnson, and I’m calling to check on a prescription status.”
According to my game logs, Greg Johnson is an avid player of One World. If he realized that he’d spent well over two hundred hours chasing away virtual zombies while buil
ding a town out of make-believe bricks, he might opt for fewer CPU cycles and more time spent with real people. But I’m not here to judge Greg. I’m trying to use him. Greg represented the latest call I made pretending to be someone I’m not. He was next on my list of potential candidates who might have UniSol health insurance that would save my wife. According to the birth date Greg entered when he registered for my game, he’ll turn thirty-three this October. Assuming he didn’t enter bogus data, it’s close enough to my age. Good enough for my purposes.
My phone-spoofing program made the rep think Greg—aka me—was calling her from a Wisconsin area code. I had checked my log, confirming that I hadn’t made any phone calls from Wisconsin yet. Heck, I’d never even been to Wisconsin. Go, Badgers!
“I’d be happy to help you with your prescription status. I just need your account number to get us started.”
I groaned into the phone, feigning embarrassment at my own made-up forgetfulness.
“That’s the problem,” I said with another sigh. “I’m traveling on business, and I left that card at home. I’ve tried my wife—both the house phone and the cell. Even texted her. She’s not getting back to me. But that’s just like her. If she’s not one place, she’s another.”
I didn’t know what I meant by that last bit, “If she’s not one place, she’s another.” However, the point wasn’t to make a lot of sense. The point was to be chatty. Seem friendly. The guard comes down as soon as a rep thinks I’m on her side. I’m not calling to yell or harass. I’m just a regular guy with regular problems, thank you very much. I learned all this by Googling social engineering. The Internet is like a distance learning crime school.
“Well, that’s not a problem, Mr. Johnson,” the rep said. “I can look it up for you. What’s your home address?”
I gave her the address Greg gave me when he registered for my game.
Stolen Page 4
