On a Tuesday afternoon, during a maintenance meeting, Samira left her work phone on the shared table in the housing cooperative. At the end of the meeting it was gone. She did not know whether a neighbour had picked it up by mistake, whether it was still in the building, or whether somebody could unlock it. The phone held the app for shared-space keys, email alerts about repairs, and conversations about an accessible-housing adaptation. No one wanted to turn the event into a suspicion aimed at the neighbourhood. That was exactly why the group chose to treat it as a drill: a chance to test whether they could protect people without rushing, blaming someone, or stopping ordinary life.
Losing a device is not merely losing an object. In a cooperative, a phone can connect care work, shift coordination, doors, invoices, suppliers, and information that belongs to other people. The instinctive response is usually to look for it and change passwords. Those are necessary steps, but they are not enough. The useful question is which decisions can be made in the first fifteen minutes, who may make them, and how to prevent a security measure from causing more harm than the initial risk. A good drill does not rehearse a dramatic theft scene. It rehearses the modest coordination required when the facts are still incomplete.
Making the context clear#
The cooperative began by defining the case. The phone had a passcode and biometric lock, but the email session remained open. The access app could not create new keys from the device, though it could open the bicycle-room door. An encrypted backup existed, but no one knew when the last one had run. This list was not meant to reassure people with technical language. It allowed proportional choices. It would not be reasonable to disable every digital key for forty households at once; it would be reasonable to suspend that particular permission, contact the person who administered access, and record the time of each action.
The cooperative began by defining the case. The phone had a passcode and biometric lock, but the email session remained open.
The first discovery in the exercise was that the word "responsible" was too vague. The digital committee could erase a device, but its office hours ended at six. The concierge had the number for a locksmith, but no access to the permissions panel. The person who lost the phone knew best which sensitive conversations were open, yet she should not have to investigate alone or prove that she had acted carefully. They agreed on a short chain: the person who detects a loss calls the duty number; the duty person revokes specific permissions; another person checks affected services; and a third records decisions, uncertainties, and times. No link in that chain should have to wait for a full meeting.
What changes in practice#
That chain also changed how they notified residents. A general message saying that "a phone with data has been lost" could create anxiety and invite unnecessary questions about Samira. A message that was too vague would leave others unsure whether they needed to act. The chosen version explained the operational fact without speculation: a preventive protocol had been activated, a few specific access permissions would be temporarily suspended, and any disruption could be reported to the duty phone. Separating operational information from personal detail protects both security and neighbourly life. Transparency does not mean exposing everything; it means that each person gets what they need in order to cooperate.
The drill exposed an uncomfortable dependency: the emergency contact list was in a folder accessible from the missing phone itself. When they looked for a paper version, they found an outdated sheet and the supplier contact no longer worked. They did not treat that gap as evidence of individual carelessness. They turned it into a concrete improvement: a printed card, checked each quarter, with contacts, suspension instructions, and physical-access alternatives. The card would stay with the concierge and in the community room, but it would not include passwords, master codes, or private data. Preparation does not mean copying secrets. It means reducing the need to improvise under pressure.
Deciding with information#
They also tested what happened to people who did not use a smartphone. During the trial, a resident returning from work could not enter the bicycle room because her access had been disabled through a configuration error. The team learned that a secure response must retain a human alternative. They placed a logged temporary key with the concierge, set a maximum time for resolving lockouts, and asked the duty person to confirm that no one was excluded from a necessary space. If a measure protects an account but leaves someone without medication, without a bicycle for work, or unable to enter their home, it is not a complete response.
The drill record was intentionally short. It included the time the loss was reported, permissions that were suspended, contacts made, decisions still pending, and the planned review time. It did not collect rumours, witness names, or judgments about Samira's behaviour. The distinction matters. A log supports learning and accountability; a pile of personal details can become a new risk. A week later, the group could see that it had taken nine minutes to reach the duty person and twenty-seven to confirm that physical access still worked. Those numbers led to clear changes, not to a ranking of blame.
Reviewing and adjusting#
The exercise included a question that is often missed: when does the emergency end? Recovering the phone does not automatically restore confidence in every open session. If it turns up in the common room, the group needs to check whether it was unlocked, whether it joined an unfamiliar network, and whether the changed credentials were actually connected to the device. If it does not turn up, they need to decide when to erase it remotely and what information should be restored. The cooperative agreed that the affected person would take part in that review with support, and that no permanent measure would be taken merely because someone felt pressure to close the incident quickly.
To keep that review from becoming a ceremony, they agreed on three checks for the following day. The first was technical: confirm that revoked permissions remained revoked and that a remote wipe, if ordered, left verifiable evidence. The second concerned service: ask concierge, cleaning, and maintenance staff whether a task had stalled because of the suspension. The third concerned care: give Samira space to say which part of the protocol helped and which part added work for her. Listening to that experience was not decorative. The person living through an incident sees frictions that do not appear in an administration panel.
The drill's main value was not the discovery of a new app. It was making visible the network of people, permissions, and alternatives that keeps a shared building working. The next time a phone disappears, the cooperative will not have to choose between minimizing it and shutting everything down. It can suspend what is necessary, support the affected person, keep care routes open, and review what happened afterwards. The practical action is simple: gather three people, invent a plausible loss, and walk through the protocol with a clock, a decision sheet, and someone assigned to ask who might be left out. That brief rehearsal turns security into a shared capacity rather than a silent burden.
