My First Professional Social Engineering Job

Can you remember the first time you manipulated someone to give you information? The first time I used social engineering professionally to obtain information resulted in loads of pics of cool fighter aircraft.

This week my digital photo album made me aware of some pictures from a deployment in Afghanistan exactly 15 years ago and reminded me of one adventure I had while trying to obtain information on a specific air traffic control radar.

Why is this adventure still relevant to me so many years later? Well, back then I was in a Signals Intelligence (SIGINT) unit, but this task required some Human Intelligence (HUMINT) skills. Or, speaking in civilian terms: Social Engineering. It was actually the first time I had directly gathered information from a conversation with my intelligence target, rather than relying on communications being intercepted. While I had quite the experience stepping into other characters in my free time (these are stories more suitable for a night out), I had never before tried this in my professional career.

A lot has been said and written about successfully manipulating people to make them give you information or allow access to restricted areas. For me, the most important aspect is the ability to read other people’s emotions and sentiment towards oneself and to anticipate their reactions. I think it is much like a game of chess and whoever plans several steps ahead, will be in control. To achieve this, I have learned that it is important to have your counterpart feel comfortable and give him or her the feeling that they are in control of the situation at all times. Last but not least, you should always have a good cover story, or pretext. Instead of going on about the methodology of social engineering in theory, I would just like to share my adventure with you.

In January 2015, I was stationed in Kabul (Afghanistan) with an electronic warfare detachment. Our parent unit back in Germany was in charge of monitoring radar systems worldwide, as part of their Electronic Intelligence (ELINT) mission. They had a large database in which they gathered information on all types of radars. Not only those used by potential adversaries, but also from allied nations. One day our detachment was asked to travel to a nearby US airbase, because a new air traffic control radar was apparently installed there. If possible, we were to take a picture of this new system, which would then be uploaded to the database. This should be a simple task. Fluent in English, I was asked to join this “mission”. After driving for about an hour, we arrived at the airbase and soon noticed that there was no way to get a clean shot of the radar system. Of course, it was located on the flight line. I knew we couldn’t just ask to see that radar system, as itwould seem a little bit too suspicious, and I also knew that “sightseeing” tours of the aircraft were fairly common. There actually is a German word to describe this: Gefechtsfeldtourismus.

One of the guys with us was an old German air force sergeant major and I came up with a pretext that might enable access to the flight line. We walked up to the nearest security office at one of the gates and I stepped into character. I introduced ourselves as a German patrol, which just happened to visit this air base in order to go to the PX and that my sergeant major was command sergeant major of a German fighter squadron back home. Obviously, I couldn’t state we were part of an electronic warfare detachment. And as it was the sergeant major’s final deployment before retirement, we kindly requested to get him one last look some of some the aircraft. A plausible (and made up) pretext, a direct and firm request and most important: leading this conversation with a friendly and calm demeanor. After all, a smile can open doors.

Soon afterwards, a young A-10 pilot showed up and gave us a full flight line tour. We had achieved step one and gained access to the flight line. We spent the next half hour of so walking around, taking pictures and acting like tourists. Now step two: get some pictures of the radar and possibly some additional information on it. In order to achieve this goal, I switched characters. While I was very serious, yet calm and friendly, to get inside, I was now the kid in the candy store.

What’s that? Can I look at that? Gosh, that’s cool.

I wanted it to appear as if I had no idea what everything around me was, so that when I asked questions it would seem like I was asking more out of personal interest than having a professional agenda.

Is that the control tower? I bet you have a great view from up there!

This got us into the control tower. It was manned by two civilian contractors who never really received any visitors. After all, most people would go have a look at the aircraft. Again, I was the kid in the candy store, asking many questions. The guys felt flattered that someone was interested in their work, they felt like they had the upper hand and ultimately shared a lot of information. I pointed to the radar.

What’s that green thing with the revolving dish?

From there on, I got a full briefing on my actual target. Frequencies, ranges, current issues and some more technical gibberish. Lastly, a couple of close-up pics as well. While many of you may think this was just a fun adventure, it was actually hard work. I had to memorize what I had heard and thus stay concentrated while remaining in character. I couldn’t take notes and I couldn’t record anything. I think this is one of the most challenging aspects of any social engineering attempt. Memorizing new information, while trying keep your pretext in mind.

After one and half hours the tour was finished. Personally, I got some awesome pictures of the aircraft, Professionally, I accomplished the mission. The information I had collected and the close-up pictures of the radar system were reported to our parent unit and they were quite surprised.

How did you get all this?

I just asked friendly 😊


Matthias Wilson / 14.01.2020