The Doors Were Open
In the spring of 1998, executives at Chiquita Brands International were trying to work out how a reporter knew what he knew.
His questions were too precise. He was asking about matters that had been discussed behind closed doors and nowhere else. So the executives talked it over—how he could possibly have this, who might be feeding him, where the leak could be—and they did most of that talking on the company’s voicemail system.
He was listening to every word.
My partner and I worked that case as detectives with the Hamilton County Sheriff’s Office, and I was the one who broke it. It was one of many cases I worked in those years and afterward, and it taught the lesson they all taught, only louder. Every case I worked in both the public and private sector started with a human.
None of them started with a click.
Nobody in that building was fooled
The reporter, Michael Gallagher of the Cincinnati Enquirer, did not trick anyone into letting him in. An insider handed him the access codes. Everything after that was already open. The executives had never changed the default passwords on their mailboxes. Nobody erased messages. People who would never have put a sensitive sentence in an email left long, candid voicemails, because voicemail felt like talking, and talking felt private.
These were capable executives, good at their jobs, running a large international company with the competence that takes. Nothing about the breach says otherwise. It says something about the system they were working inside, and what nobody had ever asked of it.
Gallagher put questions to the executives. The executives, alarmed, discussed those questions in voicemail. Gallagher listened, and what he heard told him what to ask next. The leak they were hunting was the conversation they were having about it. They were not the victims of a source. They were the source.
The phone records broke the case. His first calls into the voicemail system came from a payphone in the newspaper’s lobby. Later he got comfortable and called from his desk. I went through tens of thousands of records to find those calls, and they led straight back to the newsroom. The evidence had existed the entire time. Nobody had looked, because nobody thought voicemail was worth looking at.
By the end of June 1998, the paper had fired Gallagher, retracted its series, and run a front-page apology three days running, and agreed to pay Chiquita more than $10 million. NPR covered the apology the day it ran. Gallagher pleaded guilty to two felony counts. The insider, a former Chiquita lawyer, pleaded no contest to reduced charges and was suspended from law practice in two jurisdictions.
Company reputations tarnished, consumer trust lost, careers ended, millions of dollars gone. That was nearly thirty years ago, but the patterns have not changed.
The same doors, a generation later
In January 2024, Microsoft disclosed that a nation-state group it calls Midnight Blizzard had been reading corporate email, including that of members of its senior leadership team and staff in cybersecurity and legal. The way in was a legacy, non-production test account with no multifactor authentication, opened by guessing passwords. From there the attackers used an old test application that still held elevated access to grant themselves the right to read corporate mailboxes. Executive communications again. The door did not require a click to open. An old test account still provided a way in.
The insiders look the same. In December 2021, a former Cash App Investing employee downloaded customer reports. Block’s own filing says the person “had regular access to these reports as part of their past job responsibilities.” The job had ended. The access, in practice, had not.
In 2025, criminals paid a small group of overseas Coinbase support agents to copy customer data out of the company’s own support tools—names, addresses, ID images, balances—and then used it to con customers. Nobody at Coinbase needed to be fooled. The agents were using access they already had.
The test counts the wrong thing
Now run any of those organizations through a modern security awareness program. A simulated phishing email, a tracked link, a dashboard of who clicked.
Every executive at Chiquita could have passed. So could every Microsoft leader whose mail was read. The breaches would still have happened. Nothing in them required anyone to be deceived into opening a door. The doors were open.
A phishing simulation measures one thing: whether a given person can be fooled on a given day. It reports the answer as a percentage, and a falling percentage reads as progress.
An attacker does not need a percentage. He needs one.
Researchers at UC San Diego tested this across nearly 20,000 employees over eight months, in a randomized trial of ten phishing campaigns. Across individual campaigns, the median click rate was about one in ten. Over the full eight months, 56 percent clicked at least once. Recent annual training had no significant relationship to whether someone fell for it, and the training shown immediately after a click reduced clicking by about two percent. The researchers concluded that these programs, as commonly deployed, are unlikely to offer significant practical value.
That gap—one in ten per campaign, more than half over time—vanishes when the program reports only the campaign rate. The dashboard shows the first number. The attacker is working the second. And even a perfect number answers only the question the test asks. A lower click rate cannot tell you what access remains available to whoever gets through, or what that person can reach once they do.
Every door had been opened in advance
The rest of my caseload had the same shape. Users installing software policy forbade, on machines that let them. Users routing around the proxy because nothing stopped them. Data arriving on a thumb drive from somewhere nobody could name. An aggrieved employee who handed his access to someone who then turned the company’s own systems against each other. A departing employee who copied the bulk of a server to an external drive and walked out the door with it.
Look at what those have in common, and what Coinbase and Cash App have in common with them. None of those people was fooled. Each one did something the environment permitted, and in most cases nothing was watching when they did it. The human was the entry point every time. The capability had been granted long before.
A phishing exercise would not have exposed any of those conditions. Another training module would not have revoked the access. The aggrieved employee was not confused about what he was doing. The man copying the server did not need a lesson in spotting a suspicious link. Both knew exactly what they were doing. The only question that mattered was whether the system permitted it, and it did.
The click lands on someone
So why does the click get the budget?
Part of the answer is that a click comes with an individual to hold responsible. When someone clicks a simulated link, the program has a name, a timestamp, and a remediation module to assign. The failure lands on the employee. The decision to measure it that way doesn’t come up for review.
A permission failure has a different address. A default password left unchanged across an executive floor. A test account with a path to executive mail. Reports a former employee could still download. A server any departing employee could copy. Those trace back to whoever designed the environment and whoever approved it. Audit them honestly and the finding is against the organization.
One exercise produces a trend line and someone to retrain. The other produces a list of decisions leadership made. The incentive runs in one direction. The exercise that ends with a person is easier to fund, easier to report, and easier to repeat than the one that ends with a decision.
What looks like a people problem is a design problem wearing a human face. The face is the point. It is who gets blamed.
A perfect score would have changed nothing
The executives at Chiquita could have posted perfect scores on every phishing simulation ever built. It would not have mattered. The breach never needed them to click anything. It needed them to leave a password someone else had set, keep everything, and talk freely inside a system they had never thought of as a system at all.
The simulation asks whether your people can be fooled. That was never the question I spent those years answering. The question was always what someone had been allowed to do, for how long, and whether anyone had ever looked.
Your simulation will tell you, month after month, how many of your people can be fooled.
It will never tell you how many didn’t need to be.
Discover more from At Ground Level
Subscribe to get the latest posts sent to your email.
