The Pool She Borrowed: What the Cameras Caught That Weekend

Chapter 4: The Emergency Code

The water main broke on a Tuesday in October, two years ago, in the part of the year when the light goes amber and every problem feels biblical. I was at a client's site in Raleigh when it happened, watching a geyser audition in the middle of Sycamore Court through the medium of three neighbors texting me photographs. The main fed the whole eastern half of the Ridge, and the shutoff valve for our section — this being the kind of detail my profession has trained me to appreciate — was in my backyard. Six feet inside my side gate.

Grace Liu called first. Grace is forty-five, lives two doors down, teaches third grade, and is the only person on the street I trust with a key. She was standing in water up to her ankles in sensible shoes. "Nate, the utility crew needs your yard. The HOA office is coordinating. Can you — "

"I'll call them," I said. "Tell the crew twenty minutes."

I called the HOA office from a conference room in Raleigh, with a hospital CIO watching me through the glass, and I gave the office manager my side-gate keypad code so the utility crew could get to the shutoff. Four digits. I remember choosing them years earlier for the reason everyone chooses codes: they were a date I would never forget and a stranger would never guess, which is to say they were a bad password with a lock attached.

The repair itself took two days, and from the photographs Grace sent I could watch it like a time-lapse of a flood learning manners. The utility crew were professionals, in and out of my yard, careful with the fence line, apologetic about the mud. Someone from the HOA office stood at my gate with a clipboard — I could see the clipboard in Grace's photo before I could see the person holding it — logging everything. It was all, I want to emphasize, reasonable. The street needed water. The valve was in my yard. The code was the fastest key anyone had. Nothing about that Tuesday was a villainy. That is what makes it worth writing down: the most consequential security failures of my life have never arrived wearing a ski mask. They arrive wearing a lanyard, carrying a clipboard, solving a genuine problem.

The crew got in. The main got fixed. By Friday the street had water and I had a letter from the association, on letterhead, thanking the residents whose cooperation had made the repair possible. The letter contained a paragraph I read twice. In light of the emergency, it said, the association would retain gate and access codes in a secure registry, so that future emergencies could be handled swiftly, without troubling residents who might be away. Residents who objected could contact the office. I remember standing in my kitchen with that letter and thinking two things, in order: that "secure registry" was doing a great deal of work in that sentence, and that I should change my code.

I meant to change my code. I want the record to show intent, because in my line of work the difference between a breach and an embarrassment is a good intention filed in the wrong drawer. I meant to change it the weekend after the letter arrived, but Wren came home with a friend and a car full of laundry and opinions about marine biology funding. I meant to change it at Thanksgiving, and wrote it on the list where Thanksgiving errands go to be admired rather than done. I meant to change it the following spring, standing at the gate with the keypad cover open, and got a client call about a ransomware incident that ate the next eleven days of my life, including, apparently, the part containing the code. And I meant to change it once more that fall, for no occasion at all, which is the most honest kind of meaning-to — and I stood there in the light with my hand on the keypad and thought, It is four digits. The street is quiet. The registry is a binder in an office. What is the actual risk?

I have written that sentence, in more formal language, in the findings section of at least a dozen audit reports. The actual risk is never the burglar. The actual risk is a credential, legitimately issued, never revoked, sitting in a list maintained by people who regard access as a form of helpfulness. I knew this the way a smoker knows about lungs. Knowing is a wonderful thing. It is just not the same as doing.

So the code stayed. Four digits, unchanged, in a registry at the HOA office, indexed — I would learn — with my name, my address, and a note about the pool. I told myself the gate was a small thing. The gate, as it happened, agreed to be exactly as large a thing as I had made it.