“I imagine you have a few questions for me while the steaks are seasoning, Bradford said.
“I do. For starters, why did you reach out to my father-in-law, Senator Hazelton? Surely you have your own people who can handle things.”
Bradford set his glass on the table and studied Drake for a moment. “My industry is highly competitive. Its young princes, the tech stars, are loyal as long as you pay them more than your competitors are willing to pay them. If word got out that I was having more than the average security problem, not only would my shareholders panic, but, well, my rivals would start picking off my best people.
“Any idea why you’re having more trouble than normal?” Drake asked.
“I think a lot of companies in America are experiencing the same thing. The number of security holes in software used to control refineries, factories, and utilities critical to our infrastructure are being probed every hour of every day by our enemies. The more holes they find that haven’t been patched, the bolder and broader the attacks get. That’s why my company was awarded the contract to develop security software for electric utilities. A power-grid cyber attack has the capability of keeping millions of people in the dark for months.”
Drake nodded. “But you’re not part of the infrastructure. Why is your company being attacked?”
Bradford got up and motioned for Drake to follow him back to the kitchen. “That’s what I hope you can help me find out, Adam. My hunch is that someone would like to take us out of the picture. Maybe a competitor. Or someone doesn’t want our power grid to be protected and as safe as it can be. I don’t really know. That’s what I’d like you to find out.”
Drake sat on a stool at the black granite-topped kitchen island while Bradford open a bottle of cabernet to breathe for dinner. “Could someone infect your new software with one of these cyber attacks?” he asked. “Is that what someone’s hoping to do?”
Bradford put the two steaks on a plate. “Possibly. But they have to get through our security measures first. We have as good a system as there is, but no system is impenetrable. It’s easier to get someone within our system to infect the software,” he explained. “Plant a worm in a thumb drive or a laptop that has access to our system, and when that device accesses our system, the damage is done. Okay, bring the wine and a couple glasses and let’s go out on the deck and grill these.”
Drake did as he was told and followed his host out to the covered deck, where Bradford had a built-in gas grill. The sun had gone down and the City on the Bay glimmered across the water.
Drake gave the view an appreciative look, then turned back to Bradford. “How do you prevent someone with access to your system planting a worm?”
“I’ll introduce you to my cyber security expert tomorrow if you like. Basically, you make sure devices that have access to your system never leave the building. Smart phones that can check email from the office aren’t allowed. Telecommuting isn’t allowed. Our employees can’t work from home. You monitor login logs, things like that.” Bradford turned the steaks over. “Rare or medium rare on your steak?”
When both steaks were medium rare, the two men returned to the kitchen, where Bradford fixed a quick salad and steamed some asparagus as the steaks rested.
Before they sat to eat at the dining table near the windows, Drake asked if he thought any of his employees were behind the cyber attacks.
“I know my people,” Bradford said. “They’re not doing this. Someone’s targeting us, and we don’t have a clue who it is. I need to stop these attacks, Adam. Or find a way around telling the government about them and risk losing my research grant.”
When Drake left that night, driving Bradford’s Audi TTS back to the Marriott Marquis, he realized he might need more than his legal skills to solve this client’s problem.
Chapter 12
It was nine o’clock Monday morning when Drake pulled into a guest parking space in front of the EIS building in Hunter’s Point. Once a naval shipyard just north of Candlestick Park, the area had been redeveloped to create an urban campus for offices and research companies.
EIS occupied the entire third floor of the new building. When Drake told the receptionist Mr. Bradford was expecting him, he was escorted to a corner office with a view of the bay. Two walls were tastefully decorated with framed photographs of racing yachts. The other two walls were lightly tinted windows, one of which looked out to the bay, and the other overlooked the open-design workspace where employees were clustered in four main groups.
As Drake walked in, Bradford was sitting behind a large glass-topped desk talking on the phone. “Come on in,” he said, covering the phone with his hand. “I’ll be finished in a minute.”
Drake studied the photographs of the yachts and saw that several of them featured Bradford standing at the helm of his yacht as it sliced through heavy seas, throwing white spray over the front half of the boat.
Bradford ended the call and stood up to greet Drake. “That was the detective again,” he said. “He’s waiting for the autopsy report, which, around here, could take a week before he gets it. Unless there’s evidence of foul play, he’s going to write this off as a heart attack and close his file.”
“Has he found out what your manager was doing before he died?”
“Our surveillance cameras show him leaving here at eight-thirty Saturday night,” Bradford replied. “Nick liked to work late when it was quiet. With our flex-hour system, he could choose the hours he worked. They don’t know where he went after he left here. He was found in his car in a parking garage down in the wharf district.”
Something seemed to be bothering Bradford. He suddenly turned and looked out at his employees working in their cubicles.
“Something wrong?” Drake asked.
“I had a call this morning from a neighbor. Asking if I had anyone in mind to replace Nick. He has someone he thought I should interview.”
“Is that helpful?”
“It might be. It just seems wrong to be thinking about hiring someone to take Nick’s place the day after he dies.” Bradford walked to the door of his office and waved at Drake to follow. “Let me show you around. Then I’ll introduce you to our security analyst. He’ll tell you about the problem we’re having.”
Drake walked beside Bradford down a perimeter hallway to the office of the company’s IT security analyst.
With two raps on the door, Bradford walked in. “John,” he said, “I want you to meet Adam Drake. He’s the attorney I hired to look at our SEC reporting requirement about these cyber attacks. Brief him on what you do and what we’ve learned. I’ve scheduled a meeting with Richard—Adam, that’s our corporate counsel—at ten thirty, so you have an hour.”
Drake sat in the only chair in front of the desk and looked between two flat-screen monitors at the IT Security Analyst on the other side. John Lewiston looked to be in his late thirties. His hair was short and his pewter Oakley eyeglasses sat on top of his head. Drake looked around for a minute and noticed that Lewiston was a cyclist who kept his Trek mountain bike in his office.
“How much has Bill told you?” the IT manager asked.
“Just a general description of the cyber attacks,” Drake said, looking between the monitors again. “Why don’t you tell me when they started and what, if any, damage they’ve caused.”
“Our managers began noticing spear-phishing about three months ago. Do you know what spear phishing is?”
“It’s where hackers send emails to targeted individuals with attachments or links that release malware or a worm into your computer system,” Drake answered. “I thought that was fairly common.”
“It is. Our employees are trained to be careful. We don’t allow employees to sync mobile devices to both home and our computers. Mobile devices, like company laptops, PDA’s, and smart phones, can’t be used for personal use. We have a very complete IT security plan, I can
assure you, Mr. Drake.”
Drake wasn’t surprised that Lewiston thought so highly of the company’s security plan, which he had developed and supervised, but he was surprised that such a common hacking problem was so troubling to the company. “If these cyber attacks are common and you have them under control,” he said, “then what’s the problem?”
Lewiston smiled. “We’re fairly small for a software company. Only seventy- five employees. Every one of them has reported receiving tainted emails on a regular basis that use personal information no one should have access to. But our security plan has protected us so far. The problem is that none of this makes any sense.”
“I don’t understand,” Drake said.
“Look, we develop software to protect companies. We’re good at what we do, so you wouldn’t expect us to be a target, right? That’s why Bill thinks one of our competitors is behind this. By forcing us to report the spear phishing as a serious risk to the company on the SEC Form 10-K, we invite DHS and the FBI to come trooping in. This gives the competitor an argument that if we can’t protect our own company, our software can’t protect anyone else.”
This made sense. Drake nodded. “Any idea which competitor might be doing this?”
Lewiston stood up and took a file from the back bar behind his desk. Then he reached across his desk and handed it to Drake. “There were twenty two companies that applied to the Defense Advanced Research Projects Agency (DARPA). We got the award, so there are twenty-one possible competitors.” He sat down again and typed something on a keyboard.
Drake opened the file and looked at the summary page. The twenty-one companies with names he didn’t recognize were located all over the country. With each company listed on the summary page was a brief profile and a list of company officers.
“Did you identify a suspect?” Drake asked.
“I checked financials to see if any of them were in trouble,” Lewiston said. “And I looked online for comments that might explain a motive. I even checked Twitter and Facebook and LinkedIn. I didn’t find anything that raised a red flag.”
“Have you hired anyone recently who might have a connection to any of these companies?”
Lewiston shrugged. “Human Resources should have run background checks, so I didn’t. You could ask them.”
“I will,” Drake said as he got up to leave. “Which way to HR?”
“It’s the office to the left of the elevator. But you’ll need to get clearance from Richard Bryce, our attorney, before they let you see anything. He’s big on employee privacy rights. A real ACLU fan.”
Drake left the office. He was looking forward to meeting Bryce. His years as a prosecutor in the district attorney’s office in Portland had instilled in him a perverse fondness for irritating defense attorneys and ACLU fanatics.
Chapter 13
Ryan Walker was waiting for Saleem Canaan in the study of his Pacific Avenue mansion. His plan was working out nicely, and now it was time to show his Hezbollah soldier a little appreciation. While he didn’t know how the EIS manager had been killed, his source in the police department had reported that the death was being treated as a heart attack. Walker didn’t involve himself in the violent end of his business enterprise, but he was interested in knowing how the heart attack had been caused. If new techniques had been developed, he needed to know about them.
One of his six bodyguards knocked on the door and informed him that his guest had arrived. Walker followed the bodyguard down the curving staircase to the dining area on the second floor and stopped next to the table.
“Saleem,” he said when the young man entered, “please join me for lunch. I ordered some of my favorite San Francisco foods for us.”
The table was already set with the mansion’s china and silverware and loaded with a large silver bowl of Crab Louie salad, a heaping platter of crab cakes, a tureen of clam chowder, and bread board with sourdough bread.
“I try to eat as much of the wonderful seafood here as I can when I visit,” Walker said. “How have you been?” he asked.
“I’ve been shopping for a wardrobe to go along with the condo and car you provided me,” Canaan said as he pulled out a chair and joined his host. “So I’ve been busy.”
Walker smiled and handed him a plate with a healthy serving of Crab Louie salad piled on it. “Was that before or after you took care of the man you’re to replace?”
Canaan tore off a chunk of sourdough bread and buttered it. When he finished chewing his first bite, he said matter-of-factly, “I shopped first so I could savor my evening.”
“Try the crab cakes,” Walker suggested. “My chef makes them with sour cream and horseradish. Tell me how you killed the man.”
“I executed him in the state-prescribed manner,” Canaan replied calmly. “He suffered a heart attack caused by the sodium chloride I gave him, without the rest of the usual cocktail.”
“Very painful way to die, I would assume. Does the sodium chloride remain in his system?” Walker ladled some clam chowder into his bowl.
“It’s something I’ve used before in Mexico,” Canaan replied, digging into the crab salad, “so when it’s discovered, they’ll think it’s cartel and drug related. Don’t worry. It can’t be traced to me.”
“Make sure it isn’t,” Walker said after he’d swallowed a spoonful of chowder. “I don’t want the police questioning you and screwing up your chances for a job with EIS. Your new identity and background have been prepared by my people, and the CEO’s neighbor has made the referral he was told to make. You shouldn’t have any trouble getting the job. Study the file I have for you and call them tomorrow. Ask to see Mr. Bradford. He’s expecting you.”
Continuing to eat while a servant poured coffee for both of them, Canaan asked when they would have the malware they were going to use.
“One of the businesses the Alliance operates is an online gambling site,” Walker replied. “Very lucrative. And very useful when someone needs to be persuaded to do something for us. We’ve been keeping an eye on a man who works for the Pentagon’s Cyber Command. He worked on the cyber weapon America used on Iran. He’s providing us a copy of the worm in exchange for writing off a rather large gambling debt. We’ll modify it here to suit our needs, so I should have it on a thumb drive for you later this week. After the blackout, the subsequent investigation will discover a large deposit in his bank account.” He smiled. “We’ll make sure that it will be traced to one of the men who will be blamed for all of this. The government likes to label acts of terrorism ‘homegrown,’ so we’ll perpetuate the myth.”
Canaan nodded his approval. “What if I’m not on the team working on the software for the utilities? I won’t have the password I’ll need to access that program.”
“The man you killed worked on that team, so you should be the one to replace him. If you aren’t, we’ll figure something out. Perhaps someone else will have to suffer an unfortunate and untimely death.”
At this point, Walker checked his watch and rose to excuse himself. “I have a call coming in from South America I need to take in my study. Finish your meal and pick up the file I mentioned from my assistant when you leave. Good luck, Mr. Canaan. Call me when you are successfully employed at EIS.”
Chapter 14
Drake returned to the CEO’s office after his meeting with the security analyst. Bradford hadn’t mentioned that he thought one of his competitors might be behind the cyber attacks. If there was evidence of that, investigating EIS employees wasn’t necessary.
Bradford was working at his desk when Drake knocked on his door. “Bill,” he said as he walked in, “your security analyst said you thought one of your competitors might be behind the cyber attacks. Why didn’t you mention that to me?”
“Close the door and have a seat,” Bradford directed. He picked up a file from a stack on his desk. “This is the investigation Lewiston did after I menti
oned, in an off-hand way, that maybe it’s a competitor trying to make us look bad. He wasted a lot of time on this and didn’t find anything. I know most of these guys. This isn’t the game they play. You’re welcome to review it if you think it’s important.”
Drake took the file. It was a duplicate of the file Lewiston had shown him. “Bill,” he said, “why am I here? As far as I can tell, none of this spear phishing has been successful. You don’t suspect a competitor is engaged in corporate espionage or sabotage. Why not just report on the 10-K that you have determined there’s no material impact on your company or its financial results? That’s what most companies are doing.”
Bradford stood up and walked to the window, where he stood looking out at a sailboat coming into the marina nearby. After a minute, he turned to Drake.
“Your father-in-law, Senator Hazelton, and I are friends. Our two senators here in California have a different take on security issues. When I’ve needed help in Washington, he’s helped me. He told me that if there was something involving the work I was doing that didn’t feel right to give him a call. This doesn’t feel right, so I gave him a call.”
He walked back to his desk, but did not sit down. “I can’t put my finger on it exactly,” he continued, “but these attempts are clumsy. The skill we usually see from hackers, whether it’s the Chinese or criminal hackers trying to steal intellectual property, is missing. They aren’t probing my key people who have access to the things they might be after. They’re probing everyone. It’s like someone hired a novice hacker who didn’t know what he was looking for.
“My company attorney, Richard Bryce, deals with compliance matters,” Bradford glanced at the window, then faced Drake again. “He thinks we should report the phishing just to be safe. Google has stepped forward and reported Chinese raids on its system, and so have several others, like Intel and Adobe. But those attacks breached their systems. This is something else. I’d like to know what it is.”
Dark Trojan (The Adam Drake series Book 3) Page 4
