Chronicle the Thirteenth · The Great Drill

Do Phishing Simulations Work? The Court Ran One

I decreed a test of the court's vigilance. My instruction to the appointed was simple: spare no subtlety. I have met my court. Some of them have met me, and still reply to princes.

The task fell to the Page. The far lands would call him an intern; the court calls him temporary, and has for nine years. His qualifications were reviewed, as they are every year, in a handshake behind the buttery door, for he is the Chancellor's nephew, and the buttery door is where the kingdom does its truest hiring.

He did not want the task. He does not want any task. But his uncle smiled at him across the council chamber, and the Page, who is loyal the way old dogs and younger brothers are loyal, unpacked the lunch his landlady still makes him and began.

Let the record show the Page has qualities. His calligraphy is exquisite. This will matter shortly, and it was the only warning he gave us.

"Don't make it too subtle, love," said Dame Maud, passing through with the keys to everything. "The Squire once replied to his own out-of-office. Aim lower."

The scrolls are loosed

Taking the King at his word, the Page wrote plainly. His first scroll came from The Definitely Real King, lodging at a free pigeon house, and announced that the royal account would expire in four minutes. The simulation's mark stood in the subject line itself, for administrative reasons. The court read the mark aloud, agreed it was probably a new tax form, and entered its passwords with the calm of subjects who believe punctuality is a virtue.

Several courtiers praised the borders. The Page's illumination is, as noted, exquisite, and the learned now believe this is why vigilance scored so poorly. He has been formally asked to write uglier. It is the first written feedback of his career, and he has framed it.

The Duke pays the treasury

The third scroll was a final tax invoice: forty-eight thousand one hundred and one gold coins, payable before sunset or face the dungeon. The learned observe that an exact number is a costume worn by a lie, and that the brigands know this better than the treasurers do.

The Duke, who has previous in the matter of paying things, read the words FINAL and DUNGEON and paid at once. From the treasury. To the treasury. The clerks, finding the sum simultaneously missing and arrived, checked every coin out and back in for two days to be certain. For two days the kingdom was, on parchment, both destitute and twice as rich. The auditors have ruled it performance art.

In the confusion the trumpets went unpaid, and for two days no fanfare sounded anywhere in the kingdom. The Chancellor remembers it the way other men remember wars. Councils began on time. Announcements went unannounced. Nothing broke. Productivity, measured by the one clerk still counting, doubled. The finding was suppressed at the Chancellor's request, and is recorded here only because His Majesty does not read this far.

The Apprentice, in the gallery, wrote quietly: Entry 240: for two days there were no ceremonies. Nothing broke. Investigate.

The court becomes vigilant

Training, the learned promised, would follow failure, and it did. The court now reports everything. The Page's timesheet has been reported as phishing. The Chancellor's birthday card has been reported as phishing, by the Chancellor, who signed it. Every report receives an acknowledgement; the acknowledgements are reported. Gateway, First Pigeon of the Realm, who must carry all of this, has filed a grievance. The grievance was reported.

Gerald the golem, shown the tax invoice, paid it twice: once for the urgency and once, he explains, for the politeness. The fridge, exiled from correspondence these many months, clicked nothing at all, and has asked that this be minuted. It has been the smuggest fortnight of its exile.

For his final scroll the Page abandoned craft entirely. The subject line read THIS IS A PHISHING TEST. DO NOT CLICK. The click rate rose. The Squire of Shadow IT clicked to confirm it was a test, and entered his password as evidence.

The prize-giving

In the middle week a letter arrived that the Page had not written. A real one, from a real brigand, asking after the treasury. The court, by now connoisseurs, judged it the finest work of the campaign and awarded it Most Convincing Simulation at a small ceremony. The trumpets being unpaid, the Fool hummed. The Page accepted the trophy on the letter's behalf, which is the closest he has come to promotion.

Staple alone voted against. Staple votes no on everything, and is therefore the only member of this court with a perfect record against phishing. As for the brigand, he had asked for the password to the treasury; but the treasury was busy being counted, its coins all checked out, and no soul in the kingdom could say what the password currently unlocked. The kingdom was saved by its own audit. The learned have asked that this sentence never be repeated.

Sire, the far lands ran these games before us. A merchant king promised his clerks a festive bonus of six hundred and fifty pieces; those who reached for it were told they had failed a test. In these very isles, the carriage-masters thanked their plague-weary drivers with a bonus that was also a test. The clerks and the drivers remain employed, sire. Their goodwill does not. If we must hunt our own people, might we at least stop charging them for the privilege of being caught?

The learned, asked whether the campaign had worked, consulted the foreign scrolls and reported that courts drilled too often learn mainly to ignore the drums, and that a subject who can report a suspicious letter quickly, easily and without shame is worth more than any number of hunted ones. Praise the report, they said, and retire the trophy. The recommendation was reported as phishing.

The campaign is concluded. The Page attempted to return to his ordinary duties, and then, quietly, to resign. The court, vigilant at last, reported his letter as phishing. And the one after it. He has stopped sending them.

He remains available, which his uncle notes is his chief qualification, and at the next handshake behind the buttery door his internship will be renewed for a tenth year. He has begun, in the evenings, to illuminate the margins of the Royal Threat Ledger. They are exquisite. Nobody has noticed.