At 10:14 on the morning of my nephew Eli's reception, I called the caterer and said my sister wanted dessert held until after the family photographs. At 10:27 I told the venue manager that the speeches had been moved to the smaller room. At 10:41 I asked the DJ to take Eli's chosen song out of the opening set, since the family would be arriving late. None of these instructions came from my sister. I also unplugged the DJ's audio cable, turned the welcome sign toward the coatroom, and took the pens from the guestbook table. By lunch, the cake was in storage, half the relatives were looking for the speeches, and Eli was asking when he could hear the song he had picked. A series of small changes had altered more of the afternoon than anyone's six months of planning, which is the kind of finding an adversarial exercise is meant to produce.
I have been a cybersecurity researcher for fifteen years. Red teaming means taking the role of an adversary and trying to make a system fail before a real adversary does. I am constantly wary of the potential for various rogues, blackguards, ne’er-do-wells, no-goodniks and other bad actors to derail the event. Nobody has established that an event becomes safe merely because it has a children's menu and takes place in a rented banquet room. My sister had listed me as the reception's backup contact in case a delivery driver got lost. I asked to run an exercise against that arrangement; she told me to come as an uncle and leave the clipboard at home. Her refusal left me with only the live event in which to observe the system under adversarial conditions.
I began on Saturday by moving the printed service programs from the entrance to a shelf near the coats. Two guests entered without one, and the usher found the stack only after the reading had begun. Eli read beautifully, which did not account for the unchecked transfer of printed materials. On Sunday I set up a Wi-Fi Pineapple near the guestbook and a cell-site simulator, a Stingray, in the foyer. I also put malicious QR codes beside the seating chart. They led to a previous draft in which Table 8 still existed. The venue manager asked me to move the Stingray case because it was taking up half the gift table; I noted that nobody had asked why I had brought it.
The florist was told to hold the extra table flowers; the photographer was told the grandparents would be available twenty minutes later; the venue was asked to shift four chairs from Eli's friends' table to the adult tables. When the caterer asked about the cake, I said the photographer needed it intact. When the photographer asked why nobody was at the photo spot, I said the speeches had run long. This was the social engineering phase: I used my status as the backup contact to make several people accept instructions my sister had never given. My log tracks each request against the official schedule, although my sister has declined to give me the final copy of that schedule. She also declined to read the equipment inventory I sent her, so I had no family-approved baseline for the foyer.
The chairs were the first seating failure. Eli had made a list to keep his friends together, and four of them spent lunch at an adult table while my sister carried chairs back from the smaller room. Three guests scanned the QR code and asked the caterer where Table 8 had gone. Two others followed the welcome sign into the coatroom; the guestbook stayed blank until my aunt borrowed a pen from the bar. I recorded seven minutes of guestbook unavailability, though my aunt disputes when the outage began. The DJ traced the silence to his disconnected cable after several minutes. My father then began his speech in the main room with thirty people listening, while the rest waited by the microphone in the smaller room. He asked why I had not simply told him where everybody was. I was measuring the time it took for someone responsible for the program to notice that the audience had split.
The DJ was the first vendor to check with my sister directly. She restored Eli's song, but by then he had gone outside with his friends and the room was being reset for dessert. The caterer brought the cake out during the photographs, having received a correction to my earlier instruction. My sister says the common cause of these failures is me. That is why I documented each one separately: a security plan that works only when the person with access is well behaved has an obvious dependency on that person's behavior. She says she knew I would come. I had warned her that access control was the main issue.
That evening my sister asked me to stop calling the vendors and touching the equipment. I said I had stopped after the cake and offered to send her the timeline. She asked whether I had told Eli what I had done. I had not, because telling a thirteen-year-old that his afternoon was being stress-tested would have altered his behavior, and he was already disappointed about the song. When I told him later, he asked if I could ask the DJ to play it now. I explained that the DJ had packed up. He said he knew; he wanted to see if I would make a call when he was the one asking.
I sent my sister a timeline with six social engineering findings, three observations about the room, and a note that she had not reviewed the network equipment. She replied that I was supposed to pick up our mother at eleven. Our mother had arrived by taxi after the family photographs. I had called the venue at eleven about moving her chair, which was done within four minutes; I recorded that response as a pass. My sister called and asked, "Why are you ruining Eli's bar mitzvah?" I explained that an actual adversary would not have sent her a timeline. She said I had taken away Eli's song and forgotten our mother. I cannot make them understand the seriousness of what I found. I am telling you: my family are sheep, and they aren't going to make it.