Tales From The Field

And now, the first installment of a feature I’m calling Tales From The Field, about INFOSEC practitioners on the job. This one from friend and colleague Matt Snoddy (https://www.linkedin.com/in/mattsnoddy/).

“The Bourbon Story

A few years back, my partner in our computer forensics company got a call from an attorney. It was a new case involving the Kentucky Distiller’s Association (KDA), which is the big governing body over the whisky distilleries that dot Kentucky’s landscape. The KDA has been around for a very long time, long before the current renaissance of bourbon, before computers, and even before Prohibition. Their offices reek of history, tobacco, leather and oak.

KDA needed some computer hard drives forensically imaged for the case, which is right up our alley. The imaging had to happen on-site at their office in Frankfort, so we packed up our gear in Lexington, made the half-hour drive up I-64, and arrived early for what was going to be a long day.

We arrived, took over their conference room, and settled in with extension cords running everywhere, notes taped to drives, and laptops whirring.

The KDA has a pretty straightforward office décor: If there’s a wall, put a picture of bourbon on it, and if there’s a flat surface, put a bottle of bourbon on it. A simple stroll from the front door to the conference room introduces the eyes to a feast of hundreds of bottles of bourbon, old and new, rare and common, all glorious. Surprisingly (or perhaps not), many bottles had been opened and sampled.

As we went through our day, things were running on target to be wrapped up about when they closed. About 3 PM, several of the staffers filtered into the conference room and heartily announced, “Happy hour!” and asked what I was drinking.

As a businessman and a polite Kentuckian of average breeding, of course, I accepted the three fingers of Woodford Reserve Rye neat that they poured me. It would be a social faux-pas to decline such hospitality.

After drinks all around and as hard drive imaging wrapped up, one of the staffers told me to make sure I took something from the goodie-closet before I left.

I asked what the goodie-closet was.

I was walked up a short hallway off the conference room to a full size kitchen pantry. She opened the door for me and inside, floor to ceiling, across shelves and shelves as far as the eye could see, was all manner of bourbon, probably a thousand bottles, some sealed in shipping boxes, some just freestanding like you’d find in a high end liquor store, waiting to be gifted to visitors. “All the distilleries send us several cases each year,” she explained. “We keep some of it and give the rest away.”

Well, with that kind of invitation, I carefully looked at all the shelves, looking for the wild unicorn of bourbon, Pappy Van Winkle.

“I don’t see any Pappy in here,” I joked.

“Oh, no, we’ll never have Pappy. This is the Distiller’s Association. Pappy is just a label. They put Buffalo Trace that comes from a certain corner of a warehouse in a certain bottle and call it Pappy. If you want some Buffalo, we have a couple of cases over there,” she helpfully pointed out. “But we’ll never have Pappy, unless they start distilling their own stuff again,” she gleefully explained, effectively thumbing her nose at all the new-money bourbon crazies.

“Ah! Well that explains that,” I said, as I reached for a bottle of Elijah Craig 23-year. “Thanks for the bourbon!”

I packed up my things and headed back to Lexington, new bottle of bourbon in tow, and hoping for another crack at their goodie-closet when and if they call again.

The Elijah Craig didn’t make it past the weekend, if my memory serves...”

--Matthew

Matthew Snoddy