She sighed. “Goes with the security territory.”
“Yeah? I’d love to learn more about that at some point.” He overtook a weaving SUV.
“It’s really not all that riveting, Ben. My job is basically to study what can go wrong. The engineers get to spend all day thinking up ways to makes things work; my focus is on understanding how things can be made to fail.”
“Like worms, viruses? That sorta thing?”
“Not really. I mean yes, there were people on my team who looked at those things. But security can only really be understood as a system. Sure, attacks and specific defences matter, but they’re usually part of some system, which is invariably more complex than the individual pieces.”
“Huh.”
“And ultimately, systems come down to people. D’you see? If you can understand which people are trying to do what, to whom – and why, then you may have a promising future in the security profession.”
“I dunnow. Sounds pretty interesting to me. Your phone’s bleeping by the way.”
Nguyen had sent her an SMS text: ‘Cool, sounds like a plan’.
“So you’ve always had this interest? – In security, I mean?” he continued.
“I just sort of fell into it, really. Sorry I don’t have a better answer for you.”
Silverman: “You know, I have this theory, about women and security.”
“Oh really,” Natalie rolled her eyes good-naturedly. “This could be interesting.”
He laughed awkwardly. “Well, dating in San Fran: a lot of women there are looking for the salary, the car, all that stuff. We’ve chatted it through – my buddies and I, and decided it’s this sorta age-old search, for resource sufficiency. That’s what we reckon women are on about when they talk about security.”
“I see.”
“And yet, I don’t think that’s what a lot of women are really looking for at all. I mean sure, it’s kind of this precondition, like not going hungry.”
“Really.”
“OK, at the risk of making a complete fool of myself here: it almost feels like the exact opposite, when you see how they react in different situations, in unguarded moments.”
“How so?”
“In that they want an adventure! Into some glamorous, foreign land! They want to be swept away! Or perhaps more accurately, they want to be brought fully alive… But like I said, what do I know?”
Perhaps he hoped she’d enlighten him. She felt a slight tingle inside. Not because of Ben per se, but because of this sudden distinction forming in her mind: between meaningless and meaningful adventure...
Ben filled the silence that ensued: “Back in Sunnyvale already. I have a one-on-one with Dwayne Wisnold about the financial forecasts. Should I drop you back at your car?”
“I’ll come to the Clamor office with you. I want to start looking at those databases.
“Let me ask you a question, Ben. It’s unusual I know, but it would help a lot to get a straight answer. The Asian community here: it remains a minority group in America, yet Asian women seem to feature big in male fantasies – pornography, sex trafficking too. Why do so many men have a thing about Asian women?”
He laughed uneasily. “Honestly Natalie, guys have a thing about almost all women. I mean not all, but –” He paused, thinking. “Truthfully... I don’t know. But I think it’s always been that way. Here in the Bay Area, many Chinese came over for the original gold rush. I remember reading about this in college: that by 1870, I think it was, there were several thousand Chinese women here. And the majority were prostitutes – officially that is, as recorded in the censuses. And very often they worked that way to pay off their debts, their transport costs, to their pimps, or whatever they were called back then. Certain patterns have a nasty habit of repeating themselves. I guess you’re right though: it wouldn’t be this way if there wasn’t a lot of demand for it. Sorry I don’t have a better answer for you.”
As they entered the Clamor parking lot, a livid sunset burned filament red through the tawny-grey smog.
It was time to get to work.
CHAPTER 12
Natalie and Ben went their separate ways in the lobby, Ben heading into the same meeting room Natalie had spent that Sunday strategy session in. At the far end, she saw Wisnold – accompanied by a man in a suit whom she didn’t recognize, and Nancy Wu. For a second their gazes locked, Wu looking back a little too neutrally for Natalie’s liking. She hurried on to Yuri Malovich’s office. Old office. It chilled her to think of working at the machine of a person so recently deceased, a person whom she’d only properly met thirty some hours previously – yet there was nothing comfortable or natural about any of this, and using his machine might just reveal something: a file directory structure, an access terminal configuration … who knew. The rationale turned out to be academic anyway. In Yuri’s old office stood Tom Nguyen with a man and a woman in smart casual dress.
“Natalie,” Nguyen said gravely. “This is Cindy Bayley, and, erm – sorry, what did you say your name was?”
“Adam Lau.”
“Hi,” the woman took over: “I’m Special Agent Cindy Bayley of the San Jose office of the Federal Bureau of Investigation.” Cindy had blond hair that gathered in thick ringlets round the base of her neck. She had an easy confidence, speaking in the distinctive accent of a southern state – Georgia, Natalie was pretty sure.
“I’m Natalie Chevalier. I’m doing some security consulting work here. Great to meet you both,” and they exchanged pleasantries. “I’ll be looking into some problems that the company’s been having with indecent content. Here’s my card, if at any point you all need to talk to me.” She realized she was handing out her yoga credentials yet again. If she was in consultancy for real, she needed a new identity.
But there was an instant rapport between the two women, like they already knew one another. “I may just take you up on that, Natalie.” Nguyen led her down the corridor and the two agents resumed their conversation. “So much for the paperless office,” Agent Lau could be heard saying, presumably about the piles of papers behind Malovich’s desk.
Nguyen showed her to an open workspace off the corridor, bare but for a chair, desk, computer terminal, phone and eight-foot high inflatable Godzilla with Colgate-white smile. “This machine is clean, never used before,” he said.
Natalie and Nguyen stood there for a moment. She placed a hand gently on his shoulder:
“You OK Tom?”
The shoulder paused, then withdrew. “Yeah. Fine, thanks.” He smiled.
He logged her onto the system, then opened up a window saying KISS at the top. “I wrote some middleware that should help you query the user database easily enough, but holler if you need anything.”
“KISS?”
“Keep it simple, stupid.” And he strode back to the federal agents.
Natalie pulled out her trusty red memory stick, where she kept her Security Toolkit. Loading up the relevant tools, she promptly found the system directory, collapsed Tom’s application and located the interface that allowed her to query the database direct, running her own scripts.
First things first: the purging of all records pertaining to ‘Natalie Chevalier’. Now, she had to be careful here, not to affect the forensic evidence, the authenticity of the audit trails – especially with the FBI involved. But this pertained to something different and the logs would be available for anyone to see: her fake profile simply couldn’t stay up there.
Delete.
That done, she opened a separate browser window and typed in the address: http://www.clamor.us/TriumphantGardensHotelandGiftShop.
There was ‘Jasmine’ – alongside several other girls, advertised on the mini-site. Toggling between their different profile pages, Natalie quickly inferred the common attributes: Chinese by stated origin, aged 13–17, all shown in full-length photos, displaying a price range between $6,000 and $26,000.
The higher values correlated with another attribute: ‘Unopened’. Virgins.
She then ran a query to see how many profiles across the Clamor user base conformed to these attributes: 427.
She narrowed her eyes. One immediate question was the integrity of the data – not unlike integrity among people, was it what it purported to be? The definition of data integrity Natalie abided by was ‘every piece of data being as the last authorized modifier left it’. The photos seemed to be real enough, but could someone have entered the system and tampered with other attributes, seeking to damage the company’s reputation?
Corporate computer security could be likened to the layers of an onion, Natalie learned early in her career. The onion represented the system’s Trusted Computing Base: all the hardware, operating systems and software requiring protection. The inner core was the Security Kernel, whose Reference Monitor governed access across all layers. It decided, for example, whether a user such as Natalie could access secured data without her own login credentials. Could someone else have done so before her, planting these profiles? Someone acting a little like those ‘fakesters’ and ‘fraudsters’ on Friendster, only on a larger scale – and possibly from within the company?
The onion analogy had become outmoded as corporate networks increasingly merged into the wider web, but Natalie still used it, because it transposed equally to people, with the company’s leadership team serving as the kernel, setting the rules and norms governing shops such as Clamor. No question about it, procedures had been lax under Malovich – often the way with start-ups undergoing a growth spurt. Now Nguyen was the most senior technical person there, which was a big security plus. But Nguyen reported into the Chief Executive Officer. From experience, visionary founder-CEOs could be among the highest integrity executives of all: missionaries, as opposed to mercenaries. Only, Dwayne Wisnold was an outlier – due to his youth, and due to other attributes Natalie couldn’t yet put her finger on. Getting a firmer read on Dwayne Wisnold was fast turning into a top priority.
As those thoughts rattled round her head, her fingertips found the keyboard and she set about querying how clustered together this group data really was. The 427 profiles belonged to just ten mini-sites, or Group Spaces™ as Clamor called them. She started to relax the constraints. She tried changing ‘Origin’ to ‘Chinese, Thai’ and 873 profiles came up.
Natalie could feel the blood thumping in her temples. She rubbed them as though an angry hornet was trying to escape. If these profile pages were real, the trafficking ring was much larger than expected – and absolutely fearless. She’d included a series of other Asian countries: Vietnam, Cambodia, Korea, Philippines: 3,898 profiles. Korea alone added 1,028. She shuddered again as she realized these girls were collectively ‘worth’ more than $40 million.
Big money.
Surely organized crime.
Again, the data was tightly clustered. In a separate browser window, she brought up a sample of mini-sites. Each girl’s profile had the exact same link below the photo:
CLICK ME
Drawing in a sharp breath, Natalie clicked on the link.
A new browser window opened. It launched a separate website, a black page with greyed-out login and password boxes. The string in the address bar seemed to identify the site as ‘SurefarEnjoy’. It sounded like an Asian trading concern – yet, the web address featured a dot r u suffix: Russia.
Natalie’s fingers hovered over the keyboard.
From here, were she to take her investigation further, she would be entering the password-breaking world of cryptography. With time and the right crypto-analytical resources, the password could be deciphered – of that she had no doubt. But this would only bring about a new set of tactical considerations. It was one thing for the Allied code crackers to break the Nazi Enigma Code, quite another to act on the information gathered without revealing the breach and causing the enemy to change its codes. How might the site owners respond to any unauthorized entry here?
She identified a choice of next steps.
She could report back to Nguyen with what she had found, and let him make the call. She could turn it all over to the FBI and have them take the decision out of both their hands.
Or she could call up her old mentor, Ray Ott, and get his take on the matter.
* * *
Ben Silverman stared down at his laptop. There was a pristine quality about the empty Excel worksheet, not unlike like fresh powder in Tahoe at first light. The liquid crystal display even sparkled like the snow did in the dazzle of a new dawn.
He looked back up at the others. Nancy Wu, perfect and impassive, like an avatar of herself. Mike Marantz, the CFO – absent. Had Wu got him removed? In his place was a courteous Texan lawyer, Bob Swaine, considerably older and impeccably dressed, his disdain betrayed only by a pursed lower lip. Then there was Wisnold, who plainly didn’t want to be there at all.
Ben had just learned that, despite generating half-a-billion dollars in annual revenue, Clamor.us, Inc. apparently had no business model to speak of.
“I will repeat myself,” Bob Swaine was saying. “Our role is to present investors with historical financial information, not some cockamamie set of made-up numbers. Investors can make up their own minds, like the grown up boys and girls they all are.” The lower lip pursed a little more. “Common stock in Clamor.us may not be for everyone.”
The company’s historical financials were of course a matter of record, as audited by external accountants. Beginning with a mere eight hundred thousand dollars, Clamor had quintupled its sales in each of the previous four years. But two-thirds of the current-year revenue came from a single search advertising deal.
Ben had reviewed the other large revenue items in turn: Do-Re-Mi, a Korean gaming company so infatuated with Clamor that it had paid $85 million for essentially a set of site banner advertisements… All these revenue sources suddenly seemed suspect to Ben, as ‘lumpy’, one-off pieces of business – contrasting with the recurring, high quality revenue streams investors sought out and rewarded with high stock market valuations. In a sense, Bob Swaine was right: this was for investors to form their own judgments around. But Carmichael Associates was lending its name to this IPO, and its prominence meant there would be no tiptoeing away.
“Then what about the group buying service and all those ‘Clamorized’ companies?” Ben asked. “The group-based matching attributes we sold the crowd at the Keaton on, five days ago?”
“Three of those ‘Clamorized’ companies were local convenience food concerns, and as for the fourth – well, never mind the fourth,” Swaine said.
What exactly did Clamor do, as a business?
Amazon made margin selling books; eBay clipped a percentage off each auctioned item sold. Google received an introduction fee every time someone clicked through to an advertiser’s site. What about Clamor? It was suddenly a total and utter mystery! Certainly Clamor’s users consumed its services. They drove costs every time they logged on to its servers and uploaded their storage-consuming freakin’ photos. Ben tried to imagine what would happen if Clamor announced a monthly registration fee, or some per-photo micro payments approach. It wouldn’t be pretty. Still, there was always advertising, the default model for any web-based business with a large enough audience:
“OK, let’s break this down into basic terms. You’ve got three hundred and fifty million total users. Now, we know that these users visit the site on average – what? Four times a week? And that they spend, on average, two hours there each time. So we can multiply all that through and get a total number of worldwide weekly impressions. Then we farm that out on a c.p.m. basis through an international network of ad agencies.”
“What’s c.p.m.?” Nancy asked.
“Cost per thousand impressions.” It was a holdover from the Web 1.0 world in which advertisers accepted that half their spend would be wasted, and probably the other half too. Search-based advertising had largely supplanted it, with Google’s advertisers paying only for qualified leads. And for that very reason, the search advertising deal with Clamor had turned
out to be a total disaster. No one using Clamor was searching for anything product or service-related, much less such lucratively esoteric terms as ‘asbestosis’. The search logs revealed that Clamor users searched for: friends, romantic prospects, contacts, distant family members, more romantic prospects and more friends.
None of which seemed to worry Wisnold. “OK, so each of your three premises is, like, so wrong.”
“Which? – three?” Ben said, startled.
“First, no one really cares about ‘total users’ –” and Wisnold made dramatic air quotes. “It’s the quality of the sub-networks that counts: how many of an individual user’s friends and contacts they can find through the site. Second, visitor frequency – and third, duration: those are contra-indicators of user convenience. Users shouldn’t have to hang out endlessly on the site to find out what they need to know. It’s my goal to, like, push everything out to them, to their iPhones or BlackBerrys or dumb terminals in their cars, heads, whatever. OK, once we’ve grokked who they really are. And if we can’t figure out who they are, then maybe we’re not their lemonade stand after all. Not for a decade or so, leastways. So all the metrics you mentioned should be pointing down real soon.”
Ben pictured a set of graphs looking like the ski slopes of Tahoe. Panic gripped him. “OK guys!” he stood up. He paced the room. “This process won’t work. The kind of presentation we staged last Friday won’t work in New York. Human trafficking sites appearing out of nowhere, security officers dying in suspicious circumstances! This all needs to be way more buttoned-down! Way more buttoned-down!”
The other three looked on, becalmed. Drugged almost.
“Are we not all on the same team here? Do we not all want a successful Initial Public Offering?”
Silence.
Swaine spoke up: “With regard to the trafficking incident you mentioned, as long as we take down the offending material upon notification – duly received – we should not be subject to any lawsuits over user content posted by third parties. Now, you talked about being buttoned down.” He coughed softly. “I know how you investment bankers like to see things all nice an’ purdy. But of how much use were buttons to investors, when their very shirts were being ripped off their backs during the last craze? Just how buttoned-down was VA Linux? Or Opti Shaft?”
The Woman Who Stopped Traffic Page 9
