That Time I Worked With a Laptop Thief
That Time I Worked With a Laptop Thief
我曾与一名笔记本电脑窃贼共事的经历
Preamble I used to work at a place where they had an IT contractor that was stealing laptops and reselling them for over a year. This post is the story of how he got caught. Real names of people and companies will not be used, but the tale and screenshots (with redactions) are all true.
序言 我曾经在一家公司工作，那里有一名 IT 外包人员在长达一年多的时间里一直在偷窃并转卖公司的笔记本电脑。这篇文章讲述了他如何被抓获的故事。文中不会使用相关人员和公司的真实姓名，但故事内容和截图（已做脱敏处理）均属实。
When I Went Back to IT I was burning out on my position as a DevOps Engineer. Instead of looking for yet another job doing the same thing, I asked my boss if I could fill a different role temporarily so I could reset while still being useful to the company. He agreed and asked what I had in mind. The company’s IT manager was leaving and the whole department’s staff, tools, and processes really needed some attention. I volunteered to be the interim IT manager that handled banging the department back into shape. He liked the idea so I got started.
当我重回 IT 部门时 当时我作为一名 DevOps 工程师感到精疲力竭。与其去寻找另一份同样性质的工作，我询问老板是否可以暂时担任其他职务，以便在保持对公司贡献的同时调整状态。他同意了，并问我有什么想法。当时公司的 IT 经理即将离职，整个部门的人员、工具和流程确实需要整顿。我主动请缨担任临时 IT 经理，负责让部门重回正轨。他很赞同这个想法，于是我便开始了工作。
The Contractor The only one left in the IT department was a single IT contractor that we will call Jim. Jim had been with the company for a little over a year. As I got to know Jim, I discovered that everything under his watch was falling apart. The IT closet was a gigantic mess. He was rarely available during working hours, he worked on who knows what at the office during the evening, and wasn’t helpful when he was assisting with IT related issues. I gave him the benefit of the doubt and figured that his department was understaffed and overworked for too long so the first order of business was to assemble a new team.
外包人员 IT 部门里只剩下一名外包人员，我们暂且称他为 Jim。Jim 在公司工作了一年多。随着我对 Jim 的了解加深，我发现他负责的一切都在分崩离析。IT 机房乱成一团。他在工作时间内几乎从不露面，晚上却在办公室里不知道忙些什么，而且在处理 IT 相关问题时也帮不上忙。我当时选择相信他，认为可能是因为部门长期人手不足、工作负荷过重，所以当务之急是组建一个新的团队。
The New Team Assembles After a month of helping with IT tickets basically on my own (Jim was often MIA), and after cleaning out the IT closet, I hired a new IT manager and support specialist. During their first week, I gave them a tour of the office including the newly reorganized IT closet. That was when I first noticed something was amiss. We had just placed an order for 15 new MacBooks. While some of them had already gone out, the number that remained in the closet still looked smaller than it should have. I consulted the inventory and saw that six machines were unaccounted for.
新团队组建 在独自处理了一个月的 IT 工单（Jim 经常失踪）并清理了 IT 机房后，我聘请了一位新的 IT 经理和一名支持专员。在他们入职的第一周，我带他们参观了办公室，包括刚整理好的 IT 机房。就在那时，我第一次察觉到有些不对劲。我们刚订购了 15 台新 MacBook。虽然其中一些已经发放出去了，但机房里剩下的数量看起来比预期的要少。我查阅了库存，发现有 6 台机器下落不明。
The Lies Begin To keep everything transparent and out in the open, I started a thread in the IT discussion Slack channel asking about the missing laptops and requested everyone on the team to speak up in the thread if they knew anything about it. My boss knew nothing. He could not since he works remotely. The new hires didn’t know anything either since this was the first day they were seeing the IT closet. Then Jim messages me, not in the thread but via DM. He’s telling me five of the laptops had dead batteries on arrival while the sixth went out to an employee. That was the first thing that didn’t add up. Five out of fifteen brand new, sealed in box Apple laptops were dead on arrival? I know Apple’s hardware isn’t the most resilient, but that failure rate is unheard of for them. In the message he sent me five Apple repair case IDs. Upon looking them up, I see that they were suspiciously created right after I sent out the message about the missing devices. Even more suspicious, I find out that he created the repair requests under his personal Apple account rather than the company account, preventing me from gathering more information about the requests.
谎言的开始 为了保持一切透明公开，我在 IT 讨论的 Slack 频道里发起了一个话题，询问丢失笔记本电脑的情况，并要求团队中知情的人在话题下发言。我的老板对此一无所知，因为他远程办公。新员工也不知情，因为那是他们第一天看到 IT 机房。随后 Jim 给我发了私信，而不是在频道里回复。他告诉我，其中 5 台笔记本电脑到货时电池就坏了，第 6 台已经发给了一名员工。这是第一个对不上的地方。15 台全新的、原封包装的苹果笔记本电脑，竟然有 5 台到货即坏？我知道苹果的硬件并非坚不可摧，但这种故障率简直闻所未闻。他在消息中发给我 5 个苹果维修案例 ID。查询后我发现，这些案例是在我发出关于丢失设备的消息后才创建的，非常可疑。更可疑的是，我发现他用个人苹果账户而不是公司账户创建了维修请求，这让我无法获取关于这些请求的更多信息。
The Lies Continue The next day, two FedEx boxes arrive containing two brand new MacBooks. The FedEx label said it was from Apple’s 5th Ave store in Manhattan (which was walking distance from the office). There were two things odd about these machines: Neither of them were enrolled in our company’s Apple Business Manager account. That means we could not autoenroll them into our MDM. The FedEx label looked like it was printed on an InkJet printer from the FedEx website. This is not how Apple does things. Later Jim claims that two of the laptops have been replaced. I thank him and ask that he not take laptops home while we get all this figured out. He gaslights me by saying he verbally told me about the dead machines and that I must have forgotten. He then states that he does not take laptops home “at all”.
谎言继续 第二天，两个联邦快递（FedEx）包裹送达，里面装着两台全新的 MacBook。快递单显示发货方是曼哈顿第五大道的苹果零售店（距离办公室仅步行距离）。这些机器有两点很奇怪：它们都没有注册到我们公司的 Apple Business Manager 账户中，这意味着我们无法将它们自动加入 MDM（移动设备管理）。快递单看起来像是用喷墨打印机从 FedEx 网站上打印出来的，这根本不是苹果的办事风格。后来 Jim 声称其中两台笔记本电脑已经更换了。我向他表示感谢，并要求他在我们查清此事期间不要把笔记本电脑带回家。他对我进行煤气灯操纵（gaslighting），声称他口头告诉过我机器损坏的事，肯定是我忘了。随后他又坚称他“根本”不会把笔记本电脑带回家。
Apple Get Involved. The Lies Get Discovered. At this point, I’m still under the impression that something is fishy, but Jim still gets the benefit of the doubt. My responsibility at this point was not to accuse or speculate, but collect data and see where it led. I decided to consult Apple. I took the two new laptops that arrived to the 5th Ave Apple store. I explained the situation I was in and asked if they could tell me anything about the origin of them. They were not purchased by the company. Instead, the name associated with both machines was Jim himself. Meanwhile, all 5 of the Apple repair requests that he created got as far as Apple sending empty boxes to retrieve the 5 “broken” machines. Were those boxes sent to the company? Nope! They were sent to Jim’s place of residence. Finally, I asked about the FedEx shipping labels from the “replacement” machines. I asked how and from where they are normally sent. They confirmed that they do NOT ship repairs from an Apple store and instead send them from Apple Repair Centers, which in this case, was in a neighboring state.
苹果介入，谎言被揭穿 此时，我依然觉得事情有蹊跷，但还是选择给 Jim 一个机会。我当时的职责不是指责或猜测，而是收集数据，看看真相指向何处。我决定咨询苹果公司。我带着那两台新到的笔记本电脑去了第五大道的苹果零售店。我解释了情况，并询问他们能否告知这些机器的来源。结果显示，这些机器并非公司购买，而是以 Jim 本人的名义注册的。与此同时，他创建的那 5 个苹果维修请求，进展仅仅是苹果寄出了空箱子来回收那 5 台“坏掉”的机器。这些箱子是寄到公司吗？不！它们被寄到了 Jim 的住处。最后，我询问了那些“更换”机器的 FedEx 快递单。我询问它们通常是如何以及从哪里寄出的。他们确认，苹果绝不会从零售店寄出维修件，而是从苹果维修中心寄出，而在这个案例中，维修中心位于邻州。
Jim has now been caught in multiple lies: “I believe 2 of the defective laptops have been replaced and should be at the office right now.” - Two laptops did arrive to the office, but they did not belong to the company. They belonged to him. “Once again, I do no take laptops home at all.” - Then why did he have the Apple repair boxes sent to his home address? The FedEx labels were clearly a cover. The from address was spoofed to look like Apple. The FedEx tracking for them never got past the label being created which means Jim hand delivered them to the office (no cost that way). The Apple repair cases never updated to indicate that the machines were received, so how could we have two replacements from them?
Jim 现在被揭穿了多个谎言： “我相信两台故障笔记本电脑已经更换，现在应该已经在办公室了。”——确实有两台笔记本电脑送到了办公室，但它们不属于公司，而是属于他自己。 “再说一次，我根本不会把笔记本电脑带回家。”——那为什么他要把苹果的维修空箱寄到他家地址？ 那些 FedEx 快递单显然是掩护。发货地址被伪造得看起来像苹果公司。快递单号的追踪信息一直停留在“已创建标签”阶段，这意味着是 Jim 自己亲手送到办公室的（这样不用花运费）。苹果的维修案例从未更新显示机器已收到，所以我们怎么可能收到他们寄来的两台更换机器呢？