Strange Flesh

by Michael Olson

  “Yeah, our guys thought of that. But looks like Billy has alternates in quite a few uncooperative lo-calities. And he’s crammed Google’s results with pages that link to mirrors. So attacks won’t buy us much time before they get impractical.”

  Billy came prepared. Even if Blake authorizes an internet-scale reprise of his Whack-A-Mole game, I doubt it’s one he can win.

  McClaren asks, “Anything else?”

  I say, “He’s probably got a kill switch. If we could find him—”

  “Yeah. I’ll bet we could talk some sense into the boy. You can imagine the boss is getting a little—”

  “I know. I’m doing everything I can.”

  But I feel a ramping sense of futility. A person with the brains, devious nature, and unlimited resources of Billy Randall can stay hidden from his pursuers too easily. Our only recourse is to track him down, despite that for the past month, the entire Randall security apparatus has failed to do so. They can’t expect that I, working more or less alone, will be able to locate him before this stuff storms across the internet.

  And yet . . . My mind won’t quite let go of the problem. The hallmark of a good hacker is machine-like persistence. The numb commitment to the belief that there is always a way in. You just have to keep swinging your pick.

  63

  When confronted with what seems like an impenetrable wall, one studies it carefully for even hairline fissures. I bet the faults in Billy’s fortifications will radiate from the impact of Gina’s suicide. Her death demands this twisted tribute from him. Her memory makes him emotional and precipitate, maybe less careful. Indeed, I first found him through her.

  And what do we know about his most recent actions?

  Watching that video must have really multiplied his anger at Blake over her death.

  But why?

  I force myself to endure it several more times. For the life of me, I can’t find anything new in that tight head shot. Billy said, “I know everything now.” As though watching the video provided some last, essential piece of information. So is there something in the video—a dog-whistle code that only he can hear—that makes him want to train his guns on his brother?

  Maybe a dog whistle is a bad metaphor. Maybe it’s something that I could hear if I just knew what to listen for.

  So how do I find out what I’m missing?

  Of the two people who could answer that question, one is in hiding and the other is dead. But then I recall something I’ve learned about Billy’s research: the curious way he described his visit to Gina’s apartment to her landlord.

  Maybe it’s time to conduct a séance.

  Virtual world builders are usually very mindful of security since they often have convertible currencies on which their users rely. So they face an economic holocaust if some enterprising cracker finagles himself keys to the mint. NOD keeps their boxes’ software locked correspondingly tight.

  Breaking in will take a bit of setup. I start by hunting through a bunch of NOD forums for email addresses of company employees. For all but the most senior, they have an enforced “first name underscore last name” convention. I spend a few minutes with Spemtex, a delightful spammer’s tool that sends a test email to thousands of combinations of common first and last names at a given organization. This gets me a list of seven people responding with out-of-office emails.

  One of these, a database administrator named Zach Levin, is kind enough to provide in his auto-reply the information that he’s part of the team at the Massively Metaversal Media conference currently under way in San Jose. Running the names of the subset of other employees whose spam didn’t bounce through Dice, the Ladders, Monster, and Career-Builder yields five résumés from active NOD employees. Two of these are low-paid off-hour IT support drudges who are likely to be on duty Saturdays. One of them, Matt Jones, is a recent hire at NOD’s satellite office in Austin and simply hasn’t yet taken his résumé down. New employees make good targets because they’re not as familiar with the company’s security policies, they aren’t likely to know a lot of their coworkers by voice, and they’re generally insecure in their position and eager to comply with well-framed requests. As a final bit of icing, he’s included his cell number.

  The plan is simple: I pay eight hundred bucks to rent a well-distributed botnet to intermittently DOS the NOD world domains as well as the corporate servers at their main Menlo Park office. One of these boxes is an internet telephony system. Attacking it will cause havoc in their comms. Then I send an email to poor Mr. Jones spoofed to look like it’s coming from Zach Levin:

  Hey,

  Sorry to hit you with this out of the blue, but I’m sure you’ve heard we’ve got some problems with the Menlo servers. I’m here at M3 with some guys from Second Life who say they got nailed last week. They tell me it’s just Chinese script kiddies screwing around. There’ll be a CERT coming out on it soon.

  Anyway, Jack Fisher [VP marketing] is meeting with IMP about some biz dev stuff, and he needs this report from the main server for background. Traffic stats, etc. . . . I tried to log in when the thing was going down and managed to lock myself out. I can’t get ahold of the Menlo techs, so can you reset my password and leave the new one on my voicemail? You’d really be saving our ass up here. Thanks.

  —Zach

  A key strategy in establishing credibility with a mark is to make predictions that are then confirmed by “independent” sources. So twenty minutes later, I send him a fake report from Carnegie Mellon’s Computer Emergency Response Team confirming my story. CERT maintains an email list to which most webmasters subscribe to tell them when giant worm infestations are eating the internet.

  I let that marinate for an hour and then lob in a call. I’m counting on the fact that these two people don’t know each other well enough for instant voice identification over the phone. I throw on a little cell static just in case. “Jones,” he answers.

  “Hey, man. Zach Levin. You get my email about the password reset?”

  “Yeah. I just put it through.”

  “Great. Hey, I’m on my cell here. I think there’s something wrong with the exchange in Menlo. Can you put me on hold and try one of those lines?”

  He clicks off and comes back a minute later.

  “Yeah. Seems like it’s down. It’s not ringing through.”

  “Right, so I can’t get into my voicemail to get my new password. So can you reset it again and tell me what it is?”

  “Well . . .” You never give passwords out over the phone.

  “I know you’re not supposed to. But we’re in kind of a bind here. Tell you what, can you put your manager on?”

  “He’s not here.”

  “Hmmm . . . Well, I don’t know what we should do. It’s really starting to hit the fan. Jack is on the warpath, and I’d hate to be one of the Menlo IT guys tomorrow. You could be a real hero by helping us out. I’ll write you an email right now authorizing this. Hold on.”

  I send him another email copying a couple people high in the tech hierarchy. All of whom work in Menlo and don’t have access to their server right now.

  Finally, he says, “Okay, it’s one five bravo tango seven kilo kilo zero four six.”

  “Thanks, bud. I owe you one.”

  Five minutes later, I’m deep in their network. I’ve got some bent Linux libraries on their database server, and I’m silently sucking a copy of the two-terabyte hard disk across their hosting facility’s rocking fiber-optic line.

  While her physical remains are well beyond my necromantic abilities, perhaps one of Gina’s digital selves can be resurrected. I’m hoping this undead Gina will retain some spectral connection to Billy.

  Of course no avatar ever really dies to begin with, they just enter a limbo of inaccessibility. Now we can be so carefree with memory that you almost never destroy data, you just redescribe it as “deleted.” So I’m betting that Gina’s primary av can be exhumed from her plot in the database I’ve just stolen.

  64


  Like people, avatars tend to bloat as they age. Rezzed on 9/07/2003, during NOD’s beta-testing period, Joanne_Dark had grown gargantuan. Her bulk appears not in the Audrey Hepburn contours of her av, but rather in her possessions. She stores huge amounts of gear for role-playing sims based on Star Wars, Star Trek, StarCraft, and Battlestar Galactica. J. R. R. Tolkien and George R. R. Martin each get folders. As do C. S. Lewis and Lewis Carroll. But I want to find the places where her NOD life intersected with her real one, and I suspect these fantasy games will only lead me farther afield.

  I scroll through her in-world buddy list looking for Billy, feeling my way through her data like a newly blind man trying to recognize a familiar face by touch. If I can find the av Billy uses outside of Savant, I may be able to catch him in NOD using a connection I can trace.

  Gina has 552 names in her buddy list. A thorough search through all their profile data might take days, but Billy is a kind of artist, and most artists regard anonymity as a deadly poison. He wouldn’t neglect to brand his personal avatar. By now, I should be able to spot him from a mile away.

  I spend a couple minutes writing code in NOD’s scripting language, which they call nVerse. It populates a large area on my server with the primary skins of all of Gina’s friends. The assembly looks like a parade formation of the guests from a Halloween party at the Playboy Mansion.

  I run through the ranks, first deleting all the Furries. Then the stereotypical fashionistas, stripperellas, goth girls, and superheroines are cashiered along with their male counterparts. Plain Jane animals and their mythical cousins are sent packing as well. I reject a couple avs for their too-obvious monikers, like Ben_Dover or Mike_Hunt.

  A couple hours later, I’m left with a company of uglied-up humans, some scary children, a couple clones of famous dictators and serial killers, and monsters of various persuasions, including five renditions of the devil himself. Overrepresented in the top ten of these are what I’d call “freaks of nature.” A six-legged Chernobyl horse fetus, an African albino covered with human bite marks, a repulsive sex troll, and a two-headed crow.

  I think Billy would rep as something more fearsome than a carrion bird, but there’s something about this one’s dual black heads and beady crimson eyes that imparts a feeling of menace. Not to mention that its creator has given it a gigantic schlong, which is surely nonstandard equipment for any creature dependent on aerodynamics. Still, I’m about to dispel it when I pause over its handle, A_Ross_Fowles.

  I’d initially dismissed “Fowles” as the dumbest possible self-referential name, but the key attribute isn’t that the little monster’s a bird, but rather that it has two heads. Of course, bicephalic birds have been common symbols throughout world history, used by everyone from the ancient Egyptians to the modern Masons. But I’ve encountered one of these more recently.

  Where was it?

  I mentally rehearse everywhere I’ve been over the past weeks. Finally it dawns on me that since I’m looking at something in NOD, it’s not where I’ve been, it’s where Jacques has been. And he’s spent time almost exclusively in one place: the Château de Silling. And a two-headed bird, really an eagle but rendered to look more like a crow, is the first thing you see upon entering. The Sade family crest carved in stone over the castle’s gate.

  That insight solves the name for me: A_Ross_Fowles reads as Eros Fouls, a natural choice for a man who in real life renamed himself “Coitus Defiles.”

  But in finding Billy’s digital embodiment, I’ve only uncovered another corpse. My crow’s account was closed two days before he disappeared. I suppose even the dumbest fugitive would abandon his usual online haunts. Or at least he’d use a new avatar.

  I can’t quite believe that Billy has dropped NOD cold turkey. Since he’s forced to keep a low profile while on the lam, what better place to express himself than a virtual world where he’s securely armored in a plastic identity?

  Beyond that, I’ve been berating myself that I didn’t think of this search strategy before now, but in fairness I’m not sure I could have. I didn’t understand until I really got into NOD how attached people become to their virtual world of choice. While players may try on identities like so many party dresses, they often think of the place as a sacred homeland. That’s why I’d bet my whole stack that Billy is still logging on.

  I spend a long time browsing the profiles of A_Ross_Fowles’s buddy list. I see that Billy, disagreeable enough in real life, when unburdened of basic social constraints in NOD, becomes intolerable. Almost devoid of “real” avs, his list is populated by corporate mascots and sex workers. More interesting is the series of “friends” that he’s made but who have then revoked friendly status within a couple weeks of meeting him. This wall of shame is complemented by an extraordinary number of venues that have banned him, including Fran’s Fecal Funhouse.

  What could one possibly do to get kicked out of there?

  Despite all this information, he’s been savvy enough to obliterate any direct trail between his old and new avs. So I face the daunting prospect of having to seek out his new identity in the sea of almost ten million active NODlings.

  At least his mutant crow has given me a police sketch to use in my manhunt.

  He probably came to life within a week before or after Billy went off the grid. This alone will filter out nearly all of the avs but still leaves me with something on the order of sixty thousand. A couple more filters include avs who have visited servers with Savant’s former IP address, NODlings with more than three location bans, and finally people who are registered in any of NOD’s developer programs. Sadly, these criteria still yield an army of 7,461 possibilities. Doable, but not on my time-frame. I drum my desk, mulling how to proceed.

  I’m resigning myself to just getting on with it when I remember an innovative data-mining package one of the Red Rook librarians was flogging a while back. I find the old email and download the test version of CogneTech’s Cut_0.87 data-slicing tool kit.

  Once I get it installed and eating from the NOD data trough, the software lets me put in all kinds of free-form search information, including all my previous filters. The algorithm offers to consult the internet to gather data helpful in forming “metaconnections,” whatever those might be.

  Cut ponders for twenty minutes while I shower. When the software’s window resumes focus, I’m presented with a ranked list of avatar handles that it thinks I’ll most enjoy meeting.

  The results are both amazing and depressing. While I’m nearly floored by the eerie intelligence of the software’s choices, I can see immediately that the first results aren’t going to be Billy. The top prospect, Tad_A_ LaPhille, lists his real name, and he’s a former PiMP classmate of Billy and Gina’s. The second is a minor player in the Jackanapes’ circle. The third is the av of their dead friend Trevor Rothstein.

  After a couple more misses, I find Lillie_Hitchcock, who is unique among Cut’s selections in that she’s so pedestrian: the off-the-shelf Barbie av of a complete noob with the default T-shirt-and-khaki-pants outfit that everyone ditches immediately upon rezzing in. Her player has only replaced the T-shirt’s texture with a set of wide red, white, and blue stripes.

  I’m disposed to disregard her, since Billy designs avatars with exacting craft. But what keeps me interested is that I can’t tell why Cut selected her in the first place. I flip to the dialogue that explains an item’s ranking, and it tells me that her placement was based on a high relevance score for the av’s textures to the search term “double eagle.” I inspect Lillie for tattoos or anything about her that refers to birds. There’s nothing, so I impatiently check the links for an explanation.

  Never before have I been so possessed of a desire to kiss a piece of software, my work with the Dancers notwithstanding. And what is the valuable nugget it sifted from a flood of worthless internet nonsense?

  The Russian flag. Not the pernicious crimson hammer and sickle. The broad white, blue, and red stripes of the new Russia, which first lived as a flag
of the Russian Empire. The other flag in use around that time was yellow, imprinted with a black double eagle from the Romanovs’ coat of arms. Nearly identical to the one on the Sade family crest.

  Knowing I have my man, I ask Google to unravel her name. Billy’s skipped the usual verbal trickery, opting instead for just an obscure reference. “Lillie” and “Hitchcock” are the first two names of the philanthropist who commissioned the famous landmark that looks over the city of San Francisco. Her last name: Coit.

  And this av is not only live, but I see she’s logged in recently.

  I wrap up by inserting a routine in NOD’s database scripts that will message me any time Lillie_Hitchcock logs in. So the next time Billy enters NOD, I’ll be waiting for him.

  I check in with my Red Rook colleagues regarding their suppression efforts. Billy’s database had recently propagated enough to stay live for over five hours before they were able to disable the servers, and I sense a growing pessimism among the team. Meanwhile, Eeyore forwards me an entry from the NOD forums describing the Silling firestorm and the poster’s subsequent exploration of the dungeon. He details in vehement terms his feeling of betrayal at seeing his hard drive mirrored online and expresses his desire to, appropriately enough, torture Billy to death.

  There are nearly a hundred responses, mostly in the same torches-and-pitchforks vein. Though one complains that he found out his daughter’s pediatrician had gone pretty far along in the Course of Fever, and he laments the downed server due to the loss of his ability to check his zip code for “shit-eating Sade-freak pedophiles.”

  The controversy has already been picked up by a couple of the nimbler tech blogs. Blue_Bella renders this verdict: “Such a breach of privacy, some have called it the Unmasking, is frightening to closeted exxxplorers, but it could be for the best if it exposes how much we all like this stuff but just refuse to talk about it.”