Virus

by Bill Buchanan

  Clint Bridges looked into Craig’s sleepy eyes and explained. “We need your help tracking down any e-mail traffic Shripod Addams may have launched since this past Sunday. We need any records you have showing what he’s been up to.”

  “Addams?” Craig’s ears perked up. “That fella just died in a car accident, didn’t he?”

  Clint nodded agreement and exhaled a deep sigh. He needed to watch what he said concerning this case, and if he wasn’t careful, this need to know issue of security could trip up their investigation. Through one glance, without an exchange of words, he communicated with the captain of security. The expression on the captain’s face read: Go ahead, tell him, he needs to know.

  “I can’t overemphasize the importance of what you may find, Craig, so let me just say this. Addams may, and I repeat may, have been connected with this Star Wars disaster. There’s a remote chance his e-mail traffic could lead us to the bottom of it.”

  Immediately Craig’s hollow, sleepy eyes widened to the size of quarters. He was sold. He’d do whatever he could to help, anything. “Over fifty thousand innocent people— dead, and for what?” Craig’s jaw muscles tightened as he shook his head. Up until now, Craig hadn’t known what to make of this situation. Yanked out of the bed in the middle of the night by some tight-lipped Air Force captain and G-man. Now it all made sense. He’d thought it must be pretty important to bring in the Comp Center director, and he’d been right.

  “What was his login?” Craig asked. “And which of our computers was he on?”

  “I can save you some time, Craig,” said the Comp Center director as he began shuffling through some paper records. “He was a government civilian employee and had an account on only one computer inside the mountain. His computer machine name was allies; login was addams.”

  “Excellent! That narrows the field considerably,” Craig said with a smile. Only a single computer to search. He might get some sleep after all. “I’ll search the networking files on allies looking for any outbound e-mail traffic under addams. Should be no problem. Our networking traffic log covers the last six months.”

  “Good,” Clint responded with a smile. “One final keyword for you, Craig. Highlight any e-mail traffic to Livermore.”

  ‘The Lawrence Livermore Lab?” Craig grimaced.

  “One and the same. Why?” asked Clint, looking a bit perplexed. “Some problem?”

  “Yeah, a volume problem. We get more e-mail traffic in and out of Livermore than any other Comp Center. We transfer hundreds, maybe thousands of messages back and forth every day. They’re our SDI software house. We just got a new load from them Tuesday, I think.”

  “Search for outbound Livermore e-mail traffic with ad-dams as the sender. He was a Russian interpreter, and normally he’d have no business sending e-mail of any sort to Livermore.”

  “All right, let’s go for it,” Craig said, feeling reassured. He sat down at his workstation and began clattering away at the keyboard with amazing speed. Almost immediately, he was logged into the allies computer looking over the networking records. He bit his lip. Thousands of files had been transferred between the allies and Livermore computers. He held his breath, then entered a single line that extracted the information he was seeking. In computerese he asked allies if Shripod Addams sent any e-mail to the Livermore computers. Impatiently, Craig drummed his bony fingers across the computer console waiting for a response.

  He didn’t have to wait long. The answer was as simple as it was surprising. Yes, Shripod Addams sent e-mail to Livermore. At 11:56 p.m., Sunday, December 7, Addams sent e-mail addressed to mal on a Livermore computer named security.

  Following a brief discussion, the group placed three phone calls simultaneously. Both the Comp Center director and the captain of security called their Livermore counterparts while the G-man called Washington. Within five minutes, the group learned from Livermore’s director of security that mal, Merchant A. Lucky, was dead.

  Super-User Violation, 12/11/2014, 1310 Zulu, 5:10 A.M. Local

  SDI Software Computer Center,

  Lawrence Livermore National Laboratory,

  Livermore, California

  Rushing ahead of his entourage of top-level executives, Dr. Tristan Roberts, President of Information Sciences at Livermore, was first to bolt into the SDI Software Lab. Winded, he betrayed his exhaustion. This was an extraordinarily early hour to call an executive meeting, but these were extraordinary times.

  Dr. Roberts had the dubious distinction of presiding over the worst software debacle in the history of computing and aviation. In the final analysis, a situation such as this SDI disaster demanded a bloodletting—political, military, and technical heads were rolling. It was only a matter of time for Roberts, but even though his career was finished, he wasn’t going out without a fight. Both Washington and Cheyenne Mountain had him in a stranglehold and weren’t about to let go. They wanted answers—now.

  Who did it? How’d it happen? How would this virus behave in the future? So far, even with Livermore’s management and technical staff working around the clock on this problem, he had no answers. He’d been paralyzed by the inertia and politics that came with every mammoth-sized software project, paralyzed by inaction, corporate infighting, and lack of teamwork. But what could he do? Cornered with his back pinned to the wall, Roberts understood one fundamental cultural law of large corporations that Washington and Cheyenne Mountain refused to acknowledge. Like any large organization, Livermore could not produce anything fast that was good.

  So why not?

  Better than anyone else at Livermore, Dr. Roberts understood their corporate system of career advancement by crisis—the Look Good Game. Ironically, he found himself a prisoner of the corporate game he’d played so well throughout his career. Like taxes, the rules of the game were an integral part of Livermore’s corporate culture; he couldn’t change them overnight and he knew it.

  But for those anxious and willing to play the game, this corporate crisis offered unlimited opportunity for promotion. After all, the writing was on the wall, the guys at the top were on their way out. The objective of the game was to look good as you got yourself out of the mess that you got yourself into. Creating the corporate illusion that no progress was really something of consequence was tremendously competitive work requiring enormous effort when you were not part of the solution. Sure, Livermore’s emergency SWAT teams had done some work on the virus, but most of their corporate time and effort had been devoted to looking good, to telling a good story, one with a positive spin on a bad situation, showing progress where there was none; presenting pretty, nicely formatted colored view-graphs that looked good, sounded good, and said nothing. To Roberts’ dismay, he’d seen more positive spin than he could stomach and concluded his organization was constipated, bottled up tight as a drum. After their forty-eight-hour-long frenzy, Livermore had not answered a single relevant question for Cheyenne Mountain, but their view-graph story would lead one to conclude there was really no problem—99.9% of Livermore’s software was perfect. Ultimately, Roberts was responsible for isolating the virus and he wanted results. Roberts wanted to break up this logjam and get on with the solution.

  In spite of a corporate culture which suppressed the truth, Roberts felt optimistic. He believed their situation was about to change. Finally, they’d gotten a lead in the SDI case—a dead Livermore security guard linked by electronic e-mail to a dead Cheyenne Mountain man.

  After receiving an early morning phone call from his Computer Center director, Roberts immediately rushed to the lab. His face looked gaunt and haggard, like the face of a man suffering from lack of sleep. He hadn’t slept for two full days, but now he had a plan to bypass Livermore’s six layers of middle management and work directly with the troops. He’d collected a small group of the software technical staff he felt he could trust; those who were technically excellent, but politically had no ambition, those who did their programming work because they enjoyed it.

  Art Brooks, the S
DI software team leader, was such a gentleman, and a gentleman in every sense of the word. Highly regarded by his colleagues, a man with a family and friends who loved him, a man who would never be president of the Livermore Information Sciences Division, but didn’t care. He had the job he wanted and considered himself a very lucky and successful man. As long as he was alive, his family would have a roof over their heads, food to eat, clothes to wear, but most important of all, they were happy. A squat-framed introvert with all the charm of a single bookend, Art didn’t care for business issues, but he loved technical problems and this computer virus was a pip.

  Art surveyed the executive dress of the people in the room. Feeling intimidated, his stomach began to churn. He’d definitely under-dressed, but how was he to know? Everyone but Dr. Roberts looked good in their pin-striped suits. Dr. Roberts looked exhausted, while Art looked like he always looked at five o’clock in the morning—unshaven, sleepy-eyed, wearing Nike Air sneakers and Docker jeans. Art chuckled to himself, thinking this red-eye meeting seemed top-heavy with management. He counted twelve top-level Livermore executives plus the director of Livermore’s security, the director of Livermore’s Comp Center, and one worker bee, himself. This could have been a meeting of the senior executive staff with Dr. Roberts presiding as chairman of the board. The businessmen looked totally out of place in the software laboratory, but didn’t seem to mind; they strutted around the room with an air of confidence. Art had never been in the same room with Livermore’s top management, and didn’t know any of them personally. He’d seen their pictures enshrined on corporate organizational charts, but had never seen their faces up close. Remembering their pictures, he smiled—it must have been the lighting. Nearly everyone looked older in person, everyone but the one most likely to replace Roberts, the one nicknamed Superman. Superman reminded Art of mild-mannered reporter Clark Kent.

  Pushing Art aside, Superman cornered Dr. Roberts and began intently discussing his plan. Superman looked Roberts directly in the eyes, ignoring Art altogether. Art tolerated Superman’s rudeness to a point, but after a few minutes, he decided he’d had enough. After all, Dr. Roberts had called Art in the middle of the night and insisted that he meet them in the software lab. Art gathered his courage and interrupted their huddle. “Excuse me, gentlemen,” Art said, tapping Dr. Roberts on the shoulder. “How about letting me in on the game plan? What can I do for you?”

  Looking exasperated by his conversation with Superman, Roberts picked up his small notepad and turned toward Art. Roberts had been awake for over forty-eight hours. Lack of sleep combined with unremitting pressure made him a bundle of fatigued nerves. He was weak from hunger too, but couldn’t eat without suffering stomach distress, so his diet consisted of uncut, black coffee. “Desperation breeds unconventional approaches, Art, and you’re my ace in the hole. We’ve got a logjam to break up.”

  Puzzled, Art quipped, “Whataya mean?” Art thought he liked the ace in the hole part, but he wasn’t sure what to make of it.

  Dr. Roberts was a master at putting people at ease. Pouring them both some coffee, he asked Art to make himself comfortable behind the computer terminal. After signaling for Livermore’s director of security to join them, he continued. “We’ve gotten our first real lead in this virus case and I need your help. Time is critically important so I thought it best for me to come to you directly.”

  “Well, it depends on what you’re looking for, Doc, but I expect you’re right.”

  “I think we understand each other, Art,” Roberts said somberly as he thumbed through a few dog-eared pages in his notepad. “I’m not looking for a song and dance, I need results.”

  The director of security, a large man built like a defensive tackle, made his way through the wall of top-level executives and joined them at the terminal, caressing his foam coffee cup.

  Looking at the director of security, Roberts instructed, “Fill Art in on the details. Tell him everything we know.”

  He quickly outlined their impossible predicament. They desperately needed to find those people at Livermore responsible for planting the software virus and they needed the source code, a listing of the virus program.

  After the director summarized the electronic mail link between Livermore and Cheyenne Mountain, Art asked, “You say Merchant Lucky was involved with both computer and plant security?”

  Sipping his coffee, the security director slowly nodded an acknowledgment.

  “How many computers do we have here at Livermore anyway?” Art asked, holding his breath, not really wanting to hear the answer. “And which computers did Lucky have access to?”

  “Nobody knows exactly how many computers we have,” the security director said bluntly. “Our records show approximately how many computers we average per acre. All total, we maintain approximately five thousand computers on our local lab network and Lucky had access to every one. Using his workstation, he ran security checks on every computer on the network and had accounts on each.”

  “So much for computer security.” Art frowned.

  The security director winced, but agreed. “It looks like our man guarding the store may have robbed it.”

  “Following Lucky’s tracks could take some time,” Art lamented.

  “If he left any tracks at all,” the director observed quietly. “He was a clever, very talented fellow, but I don’t think he planned to die.”

  “Let’s check the obvious first. Maybe we’ll get a break.” Art leaned back and thoughtfully gazed at the domed ceiling. The software lab was magnificent, something akin to an amphitheater, with Art, Roberts, and the security director located center stage.

  “I’ll focus on the project computer first, the one used to build the SDI software. That’s where the virus found entry. What progress has been made tracing the program changes back to the technical staff?”

  Bleary-eyed, on the fringe of exhaustion, Roberts read from his notepad. “Roughly halfway through the list of changes, but nothing suspicious so far.”

  “I’d like to take a look.” With a trembling hand, Roberts handed Art the pad. As he scanned the long list of changes made to the SDI software, his jaw dropped to the floor. His eyes remained transfixed on the pad for several minutes.

  When he spoke, his tone expressed despair. “God, what a mess.” He would always look back on this moment as the point when he decided to retire, to get out of the defense business altogether.

  “Absolutely unbelievable,” Roberts confirmed, wiping his face with his hand—a sign of fatigue and stress. “So much for quality control.”

  Art went pale. “I can’t believe we shipped this program untested. I had no idea.” Hundreds and hundreds of changes had been made to the software.

  “Art, it’s not as bad as it seems,” the director insisted. “These changes were fixes to known program bugs and they’d all been tested separately.”

  Unconvinced, Art spoke in a shakier voice. “Who’s shotgunning the effort to trace each change back to our technical staff?”

  “A couple of new hires,” the director replied. “The job’s trivial, pretty much a step and repeat process. There were so many changes, it’s taking some time to get through them all.”

  “The change list shows who made each change and when,” Art said as he clattered away on his terminal. “I want to sort through the list and find out if anyone made changes who is not on my team.”

  Dr. Roberts looked at the director of security and nodded. “Makes sense to me.” Roberts thought Art a most unusual man, but he needed his skills. Art had trouble communicating with people effectively; his directness made people uncomfortable and defensive, but he could communicate more effectively with a computer than anyone else Roberts had ever known. Due to the technical nature of Art’s work, he tended to be somewhat introspective, self-motivated, inquisitive, and unbelievably socially awkward.

  After a few more moments of key-clattering, the terminal spat out a short list of people. Art didn’t know any of them, but one.
/>
  What followed over the next few moments had an otherworldly, surrealistic quality about it for Art. Looking back, he would think it more like a dream, it happened so quickly, so easily. Looking over the list, Art did a double take, and stared at that name again. Suddenly, there it was. There was no mistake about it. The programmer who had made change number 1246 was named root, computerese for super-user. “This is it!” announced Art. “Take a look. It’s gotta be the one! A super-user violation!”

  Looking over Art’s shoulder, Dr. Roberts said, “I don’t understand. What does it mean?”

  “By convention, no super-user ever changes the SDI software. Super-users keep the computers running for the users, the programmers who write the SDI software.” Roberts couldn’t believe how quickly Art worked. He’d found this software change control violation in less than five minutes. Puzzled, Roberts asked, “Why wasn’t this discovered before now?”

  Art’s reply was both thoughtful and out of character— carefully crafted so the two new employees working on this job wouldn’t look bad. “The new hires lack experience and simply didn’t know what to look for. We’re talking about violating convention here; guidelines, not hard and fast rules. Our programming conventions aren’t written down. You pick ’em up along the way.”

  Art studied the list of names and times on his computer screen, then turned and spoke to the security director. ‘The super-user changed the software between one and two o’clock on Monday. Was Lucky working Monday afternoon?”

  The security director sat down at a terminal, logged on, then copied down the hours Lucky had worked over the past several days. Rubbing his balding head, the director replied, “Yeah, he was here all right, but he wasn’t a super-user. He didn’t have the password.”

  “So, what about it? You said yourself, this guy was clever. He could get it easily enough.”

  The tone of voice Art used caused the hair on the security director’s back to stand up, but why deny the allegation? Art was right. Reluctantly, the security director agreed with a grimace. “You’re right. Lucky could have made the change. Unfortunately, this wouldn’t be the first time our root password was compromised.”