The Staff: An Origin Story, Back When Our Only Threat Model Was the Printer

The first in a series about an IT department that did not ask for any of this.
We were the Staff before anyone capitalized it. Just the people you called when something stopped working, which in practice meant we were also the people you called when something had never worked, and the people you called when you'd quietly changed your own password and weren't going to admit it, and the people you called about things that were not, strictly, computers — the thermostat, the fax line nobody remembers ordering, the standing desks, a chair.

This was fine. We want to be clear about that up front, because everything that happens to us later gets framed as a rescue, and we resent that framing. We were fine. We had a rhythm. Someone's laptop died on a Tuesday, we imaged a new one off the golden image that was two OS versions behind, and by Thursday it was like nothing happened. Our biggest recurring incident was the third floor printer, which jammed on a schedule so reliable you could set your calendar invites around it, and which we had long since stopped attempting to fix and instead maintained, the way you maintain a relationship.

We had a firewall. We are not going to pretend we didn't. It did what firewalls do, which is sit there being a firewall, occasionally logging something none of us looked at because looking at it was not anybody's job. Somewhere in the promotion paperwork, one line item assigned "IT security" to whoever was idiotic enough to list it as a strength on their own review, and for years that meant it belonged to Gary, who took it to mean: don't write your password on a sticky note where the cleaning crew can see it, and change the Wi-Fi password when it felt necessary, which was never.

We had an on-prem Exchange server. It lived in a closet that also held the janitorial supplies and a space heater from 1976, and it was held together by a patch cadence best described as "when it complains loudly enough." Nobody touched it except Kevin, and Kevin did not document what he did to it, on the theory — which we all secretly shared — that documentation was how servers found out they were replaceable. The truth is that's how we figured we'd be replaced too — by writing down too much about how we actually did our jobs. Circle the wagons. Loose lips sink ships.

This is the part where, if this were a different kind of story, we'd tell you we were reckless, and that something was coming for us, and in hindsight the signs were everywhere. They were not. We patched what broke. We backed up what mattered, mostly. Our incident response plan, such as it was, consisted of Kevin's cell number written on the inside of the server closet door in Sharpie, which — and we want this on the record — worked. Every time. For years. The incident response success rate did slow down after Kevin missed a step raise — a fact he pieced together over lunch, listening to the rest of us compare numbers, and realizing he was the only one at the table who hadn't gotten one.

We handled help desk tickets in a shared inbox that four of us watched and none of us owned, which meant tickets got answered fast and by whoever got there first. It also had a quieter benefit nobody talked about out loud: nobody could close out somebody else's ticket, inadvertently or otherwise, and quietly take the credit, because none of us could say with any authority whose ticket it had been to begin with. The whole system had exactly one flaw: nobody could tell you, in aggregate, what we actually did all day. If you'd asked us to produce a report of "risks to the environment," we would have handed you the printer's jam log and asked if that counted.

Noisy users — the ones who filed a ticket for everything, the ones we came to know on a first-name basis in ways that were not a compliment — we handled through one of a small number of time-tested methods. Sometimes we let the email sit, on the theory that most problems, given enough time, resolve themselves out of sheer embarrassment. For a very select group of users, one earned through years of dedicated effort, their network cable would occasionally, mysteriously, work its way loose sometime during the day — cables do that, it's well documented — and when they called about it we always, without fail, helped them out by asking them to reboot. Which, on the Windows systems we were running at the time, took what felt like a small geological era, which — as a matter of coincidence — was just about enough time for somebody to stroll over and push the cable back in. (We probably shouldn't have said that part out loud. Strike it from the record.)

It did not occur to us that we needed a security posture, because we did not think of ourselves as having one. Systems worked, work got done, we went home on time. We thought of ourselves as the people who kept the lights on, in the literal sense at least twice, when the building's electrical contractor turned out to also not really know what he was doing. Security was the badge reader by the front door, and even that we thought of less as a control and more as a doorbell with opinions.
We tell you all this not for sympathy but for calibration, because we are aware of how this reads from where you're sitting now — you, who already knows there's a contract renewal coming, and a clause in it neither we nor anyone who signed it actually read, and a Tuesday not too far from this one where somebody in Contracts forwards an email with the subject line "quick question" that is not going to be quick and is not, in any sense, a question.

But that Tuesday hadn't happened yet. This Tuesday, the printer jammed on schedule, Kevin's number was still legible on the door, and as far as the Staff was concerned, we had this handled — because as far as we could tell, "this" had never been defined as anything more than it currently was.

We'd love to tell you we saw it coming. We did not. We were fine. We want that on the record too, before the record starts working against us.