Into a Raging Blaze

by Andreas Norman

  Jamal went to an airline website. She sat next to him and saw him completing the various booking fields: fly in to Cairo, out of Sharm el-Sheikh. First, a few days in the capital, then a week by the coast in his uncle’s house. Ms. Dymek. Mr. Badawi. The last week in October: out on Friday evening and then back ten days later. Flexible tickets, because you never know, said Jamal with a tone of voice that made her wonder if, despite everything, he had changed his mind. The tickets cost 8,500 kroner, but at least some of their accommodation would be free, she thought, and pushed her money worries to one side. She stroked Jamal’s hair. Cairo.

  18

  Stockholm, Saturday, October 1

  Bente stepped into the Security Service guest apartment and took off her coat. The air inside the late-nineteenth-century two-room apartment was still. Staff from the Protection branch would regularly enter to sweep rooms for bugs—it was standard procedure—but no one had been into the apartment since she arrived in Stockholm.

  She had woken up early and hadn’t been able to fall back to sleep, so she had taken a brisk walk around the block and bought a few apples from a corner shop before returning to the apartment. She shut the door and locked it behind her, took an apple out of the bag and bit into it before calling the Section.

  Mikael answered right away. Yes, he had received her text message. He had that slightly thick voice he always got when he was excited. “I think we’ve found something.”

  “Okay?”

  “You have to see for yourself. It’s from a site for computer-game programmers, but they’re discussing completely different things. I’ll send you the link now. It’s a discussion thread, almost at the bottom of the page. Number twenty three.”

  She went to the page. It was indeed a site for programmers, with various forums for different technical discussions about things she didn’t understand. Computer nerds. There was a link to an Internet Relay Chat channel. It was encrypted, but the Section had managed to force the algorithm with the help of the FRA’s processors. She only needed to read a few lines to know that it was a hit.

  She called Hamrén, who was in a meeting. No, she couldn’t call him back; she needed to talk to him. Now.

  When she told him what SSI had found, he fell silent and listened to her. Then he began to speak quickly, almost in a staccato. Wonderful. Very, very good. Send it to the Directed Surveillance unit and the analysts. He would be back in the office within half an hour.

  She sent an e-mail to Hamrén’s chief analyst with a link to the channel, copying in the technical unit head, and leaned back. Perhaps the Brits were right, in spite of everything.

  Two hours later, they were gathered in a semicircle—Hamrén and the Head of Directed Surveillance, together with four analysts and technicians from Counterterrorism. Wilson was also there with his adjutants, Sarah and George, and four new faces—anonymous young analysts who must have flown in from London during the last twenty-four hours. Wilson was leaning back in his chair and raised a limp hand in greeting when Bente came through the door. The blinds were closed; the pearl-white light of the projector screen cast an artificial glow over the walls and the faces of all present.

  Hamrén waited until it was exactly half past eight before getting up. He momentarily found himself bathed in the white quadrant of light—squinted, was blinded—and took a step to the side.

  “Good morning, everyone,” he began. “You have all been sent the link. Magnus will go through the channel for us now. Okay, Magnus. Take it away.”

  The Salafist analyst began his presentation by cautiously opening a window on the screen. A functional, somewhat ugly, yet striking website appeared. The majority of the page was filled with a list of discussion threads. What they were looking at was a website for developers, he explained. Programmers, hackers.

  “It is a meeting place for a community of roughly five to six thousand people. The common denominator is that they develop various programs together in open source code. Completely normal, legal activities.” He clicked. “Here, for example: questions about graphical rendering in computer games, animation.”

  He opened a tab for a new subpage. Around twenty thematic discussion threads appeared in a list. He opened a new thread and scrolled down a seemingly unending string of posts. “For our purposes, this is an uninteresting discussion about programming online games,” said the analyst, ending his guided tour. He clicked back to the homepage. “As you can see, nothing of interest to us. Except this.”

  The projector fan whirred. He brought up the IRC channel. A concentrated silence lay across the room while everyone stared at the projector screen.

  The posts shone before them. What they said was markedly different from the technical subjects of the other threads. The most recent post was just two hours old, written by the user, Sala82. It contained a YouTube clip: a shaky video of the arrest of a black man. The police were British, judging by their uniforms. Bente glanced at Wilson, but he merely looked sullen; barely a flicker crossed his face. Several further YouTube clips were from the riots in London in August. Beneath them was a long string of heated posts about the British police state, about Big Brother society.

  Magnus broke the silence: “As you can see, this is a far more political discussion. Unusual for a site like this, but not in itself worrying. However, if we go to the beginning of the discussion, we find things that are far more interesting.”

  He worked his way down the thread to an earlier post. The user, Redstripe, had posted it two days ago. It contained a photograph showing a man in a suit together with two younger colleagues. When Bente had first looked at the discussion thread, earlier that morning, it had taken her a second to recognize him: Stefano Manservisi, the Head of the EU Commission’s Directorate General for Home Affairs—GD Home. The picture had been taken at some sort of conference venue with beige walls and gray stone floors—perhaps one of the rooms at the EU Commission in Brussels, with which she was vaguely familiar. Manservisi and his colleagues were smiling. Around them there were people standing and talking. The photo was poorly executed and amateurish, probably copied from the Internet because the resolution was poor; she could see the pixels on the edge of Manservisi’s suit.

  Under the picture it said, in English, Need to ID the people in the picture. Anyone?

  Shortly afterward, on Thursday, September 29th, at 22:35, an answer had been logged from the user, Frontline: Hi Red. What’s up?

  Several other users promptly appeared in the thread. A dialogue developed. Bente could count almost twenty participants. The analyst scrolled slowly down the page so that everyone had time to read.

  Wilson was leaning back in his chair with his arms crossed—immobile, inscrutable. It was Bente’s signals intelligence at SSI that had discovered the IRC channel, not the Brits, and it didn’t surprise her. She had good people at the Section, but the British outfit at Government Communications Headquarters had incomparably greater resources. They should have seen the threat long before SSI. She looked at Wilson through the gloom. His bushy eyebrows were drawn together over his blue eyes. Around him were his British colleagues, their faces attentive, reading the text on the screen. Wilson wasn’t reading. He was looking straight ahead, lost in his own thoughts. Then he felt her gaze. He turned his head quickly and looked straight at her, expressionlessly. For a moment she felt like Wilson could read her thoughts, that he was judging them, trying to make out whether she posed a threat or not. Then there was a lightning-quick change in his facial expression. He blinked at her. A cold smile flashed across his face. A loyal glance between colleagues. She smiled back and turned to the front again. Of course the Brits had seen the IRC channel; she knew it the moment Wilson had met her gaze. His reaction had given it away: the stony stare, the exaggerated smile. He hadn’t been reading what it said on the screen because he already knew what it said. Naturally, British signals intelligence had picked up on the ongoing discussion: it was on the Internet, with nothing more than some light encryption to prevent curious amate
urs from finding it. The technicians at the Section had only needed a few hours to force their way past the encryption. The question wasn’t whether the British knew, but why they hadn’t chosen to share it before.

  Redstripe: Need to find them. All I know is they’re EU. GD Home

  Frontline: Ok

  Redstripe: They’re sick in the head

  Frontline: lol

  [Sala82 logs in]

  Sala82: hello

  Frontline: hi

  Sala82: whatareyoudoing

  Redstripe: its no joke Seriously need to check them out. ID preferably asap. They’re fucking with a friend

  Redstripe: and with all of us

  Sala82: seriously

  Redstripe: If you don’t believe me look for KOM(2011)790

  [Darknite logs in]

  [Bando logs in]

  [Steph911 logs in]

  Frontline: ???

  Darknite: agree. No hit

  Bando: seems pretty classified

  Frontline: not for too long I hope :D

  Redstripe: My friend has it but don’t talk about that. Spook stuff. CIA stuff. The people on the picture wrote it. names, addresses, etc. is what we need. then we can respond

  Sala82: sink some ships :)

  Darknite: agree

  Steph911: readin u loud n clear

  In the course of minutes, yet another ten users had logged in. And, throughout, it was right there: the mentioning of the EIS report. The reference number to the report was correct. It was odd to see it there, on a site like that. Everyone in the room read quietly. The atmosphere was close, concentrated. What was scrolling up before them was a threat. The kind of threat they had spent their entire professional lives trying to eliminate. Magnus scrolled onward:

  Redstripe: Focus on the guy in the corner. See pic here

  Adam: What?

  Steph911: Good morning N ;-)

  Redstripe: Everyone. Need names & addresses before we can respond Particularly the guy on the left

  Golem: DDoS or what?

  Redstripe: question for later

  Frontline: They listen They watch you They are not your friends

  Redstripe: word

  Storm: Do you mean this guy:

  Underneath Storm’s post was a grainy, enlarged picture of a face. The face belonged to a man who was visible in the background of the first picture. The picture was so well processed that the facial features were clearly visible. The analyst scrolled back quickly, hovered over the fuzzy face of the man in the background with the mouse, and zoomed in.

  The man was in his fifties. Dark hair with streaks of gray. Set figure, a slightly round face, beard, dark-gray suit. One of many office employees to whom you wouldn’t give a moment’s notice if you were next to them on the subway.

  After that message, the posts came closer together. The analyst scrolled slowly through the thread. A stream of comments. At first mostly exclamations, jokes, admiration for the user, Redstripe, for posting the link, rapid exchanges of this kind. They knew each other. A close-knit group. Further on in the thread the tone changed and became more serious. The discussion developed and became more objective. Magnus scrolled forward twelve hours in the thread and showed how the tone had become very much goal oriented. After twenty-four hours, he said, it was clearly visible that the group had started working as a structured and collaborative team. Led by Redstripe, users like Frontline, Darknite, and Steph911 had gotten organized. The posts were short and matter of fact, written with an almost military tone.

  The analyst scrolled onward through the thread to a post on the morning of October 1st. “This is where we are now: Saturday. What we can see is in real time. Six people are logged in. All understanding each other perfectly.”

  The posts looked different, more like operational communications.

  Check Belgian population register. URL anyone?

  Number 2 is at the EU Commission, French guy. Check all employees. Does anyone have a list btw?

  Dear friends and co-hunters, free face recog tool here: http://download.cnet.com/Face-Recognition-System/3000–2053_4–100000859.html.

  Shit hot sources at www.silobreaker.com Maybe picasa or flickr are ways in Good work. Any1 in Bxl who can check it out, how you get in, etc.?

  WEAREBRINGINGTHEHOUSEDOWN

  We know all info about their lan, all info welcome. Logins, etc., try to get access to everything!

  Remember: no unnecessary entries, ok? No chitchat.

  Here’s the report’s number KOM(2011)790. Search for that.

  Keywords for those of you searching far and wide: Foreign Affairs Council, Justice & Home Affairs, Manservisi, de Kerchove, CTC, JAI, DG XI, surveillance, European Counterterrorism, intelligence coordination, etc.

  Redstripe will be moving ftpn in 4hrs

  Have a login for the EU intranet btw, kids stuff.

  Sweet.

  The analyst said, “You see, intensive communication, focused on gathering information about the report and the EIS and certain persons in that photo. We have counted twenty-eight different users active during the first two days, of which four are particularly active and leading the way.”

  The posts between the four users continued for hours, a rapid exchange of information, increasingly technical details revolving around how to find more data about the people in the picture, different ways of penetrating EU servers, EU networks, records, databases. Hundreds of posts—during certain periods, up to five or ten per minute. For hours, there had been an intense flow of chat between the four individuals. The closer they got to today’s date, the more posts there were, the analyst noted. The reference number KOM(2011)790 was mentioned several times—the report that Dymek had leaked. The analyst pointed out a post that described, in detail, how to hack into the EU’s document databases. Another listed all civil servants in section A3, the part of the EU Commission that worked on counterterrorism matters. This was where the photos, names and private addresses began to show up.

  In silence, the analyst scrolled through the rows of posts. If they had missed this . . . Bente froze at the thought. But SSI had done its job, thank God. The system worked.

  “We can also tell the participants have been in touch with each other through other platforms.” The analyst pointed out a post that said, I just talked to Steve, he might be on to something. Check this out. He then quickly scrolled five minutes forward in the thread. Here was a discussion about names to be recorded.

  “They’ve broken into the EU’s servers. London’s assessment is that this is in order to gain accreditation as journalists and, in that way, gain access to large parts of Justus Lipsius, the EU Council building where summits are held. That would give them great mobility and capacity to get close to the ministers and their delegations. The hypothesis we’re working on now is that they are trying to get inside the perimeter security in order to get close to certain chosen individuals—targets. We’re investigating how they’ve managed to access the accreditation system, and under which names.” There was a range of ways—Trojans, secret doors. Magnus made a gesture at one of the technicians sitting beside him, who now cleared his throat uncomfortably. No, they didn’t know precisely how they had gotten in. But they had gotten on to the EU Commission’s intranet—that had been confirmed by Brussels.

  “They’re good,” muttered Hamrén.

  The analyst scrolled onward through the thread. “Let’s look at their motive,” he said. “The report mentioned here is the proposal for the creation of the EIS, a proposal that will be discussed at the summit on October 10th—the same report that Carina Dymek came into contact with. What the relationship is between Dymek and the individuals communicating here is not clear, but we’re assuming there is a connection.” He waved his laser pointer across the screen. “The group is quickly politicized. The rhetoric is the same as that among those leading protests against the FRA laws and supporting the people behind the Pirate Bay. The individuals in this group are probably among the upper echelons of the fil
e-sharing world as well. We can also note certain anti-Western sentiment here, which tends to be common in autonomous groups.”

  He showed several posts talking about oppressor states. Here and there were video clips of police arrests, along with text about how the EU was increasingly becoming a military power, a violent machine.

  The analyst stopped and let them read. It was the usual anarchist rhetoric: anti-system; anti-establishment.

  Finally, Magnus turned to them and said, “To summarize, what we see is very probably some kind of attack being planned. The target is the Council of Ministers in Brussels on October 10th.”

  “What do you mean, ‘probably’?” said Wilson’s calm bass. “This is an attack being planned.”

  Everyone sat in silence.

  Magnus scrolled down and stopped at one of the first posts: the user, Redstripe.

  “We are dealing with a group with substantial technical expertise, who are infiltrating an EU summit and targeting individual EU officials in order to carry out some sort of action. By all indications, it is the people in the picture in particular that they are focusing on: Manservisi and the man here.”

  “I know who Manservisi is,” said Hamrén, “but who’s the other one?”

  The analyst clicked back to the photograph. Hamrén pointed at the man in the background.

  “He’s called Jean Bernier. Works for the EU Commission. We’ve checked him out, because we couldn’t see what the motive was for choosing him as a target, either. He’s a civil servant, a lawyer.”

  “So why him?”

  “We don’t know.”

  “Because he works for the EU,” said Wilson with a shrug of the shoulders. He pointed at the photograph. “This Ahwa group presumably wants to make an example of someone—kill an EU official—or use him to get into the summit.”

  Everyone sat quietly. Hamrén nodded. The analyst continued:

  “We have begun to develop a profile, a preliminary profile, of this ‘Redstripe’ and the other users. What we are looking at is typically a man in his twenties, above average intelligence, comfortable background. Very knowledgeable about programming, but primarily self-taught. Almost ever-present in circles developing open code, and also involved in illegal file-sharing networks to some degree. He has antisocial, in some cases sociopathic tendencies. Most of his social interaction is via the Internet and he has a more-or-less global spread of contacts. He feels little or no affiliation with the society that surrounds him; it is this group that represents his values. Politically, it’s harder to profile; the people in the group aren’t generally interested in traditional politics or in parties. They have a more anarchistic approach to things. We think that, at some stage, agents of the Ahwa group have recruited them. Perhaps they don’t even know that the group exists, they’re just in contact with a middleman who doesn’t reveal the organization behind it all. It’s likely the people behind these usernames aren’t familiar with the organization in Cairo; they’re being used as instruments of terrorism.”