The Man Who Fixes Things

In the older quarters of most Moroccan cities there is a figure who has no formal title and no contract with anyone. He works at the local ISP during the week, or for an electronics repair shop near the new town, or sometimes just for himself. On Saturday afternoons he comes to fix things. The router that has been disconnecting. The DVR that needs a new password because the one written on the back has been forgotten. The wifi extender on the roof that the storm has unplugged.

He is the cousin of someone, the neighbour of someone else, the man whose father grew up on the next street. The relationship is older than the riad's business. He is paid in mint tea and an envelope at Eid.

He knows the admin password for the router. He set it. He knows the credentials for the four cameras. He installed them. He knows the wifi password every guest receives, because he wrote it on a card three years ago and it has not changed. He has a Google account on his phone that holds, in saved passwords, the operational credentials for thirty or forty properties in a square kilometre.

He is not an attacker. He is a node of communal trust performing a function the formal infrastructure does not provide. The arrangement is rational, and it is also a concentration of access that no external assessment will find, because it exists on no contract, no invoice, no vendor list, no document that diligence reviews; it exists only in the texture of relationships that predate the business.

Risk assessments built around organisational charts assume that infrastructure is owned by the entity that operates it and administered by the vendor that bills for it. In environments where the formal economy is not the operating economy, that assumption produces the same blind spot.

The credentials to a building can sit on a phone in a pocket walking through a souk.