Zero Day

by Mark Russinovich

  The sex was better than she’d expected. Daryl could see why a woman might get excited over it, but afterward Four had been distant, as if wrapped in his own world. He called repeatedly after that night, but she’d never gone out with him again. She understood what was going on and was not flattered.

  Throughout their weeks of dating, Four had repeatedly spoken of her beauty. Then he had worshipped at its altar. She had no desire to be any man’s idol. From that night forward she committed herself to her work. No more dating, no more pawing. She wore baggy clothes, no makeup, and buried herself in her studies.

  She counted herself the better for the experience. Four, she realized, had been full of himself, certain he was God’s gift to women, to her, to the world, when in fact he was a self-satisfied, egocentric snob. She considered herself well rid of him, and from this had come her utter contempt for egocentrics.

  Four had not taken rejection well. He spread stories that Daryl was a slut, that he’d dropped her because she’d cheated on him. His stories only seemed to increase the attention of the other male students, and no hiding beneath oversize clothes could conceal her obvious beauty and latent sexuality.

  As a release, and because she’d discovered her aptitude for sport, Daryl played intramural soccer after moving to Stanford for graduate work. She threw herself into the game and, if not the star of the team, was taken seriously as a player. On weekends she backpacked and hiked throughout northern California and parts of Nevada. She skied at every opportunity.

  When Daryl first met Jeff, she was working in cyber-security, performing virus analysis, at that time a new field. A rising star in the NSA, she’d played a major role in identifying the hackers of two high-profile viruses. Overall, though, she was bored and generally annoyed by the obvious attention of men to her physical appearance. She’d learned, however, that it could work to her advantage. As for marriage and family, she had her work and found it endlessly fascinating.

  After that first meeting, she’d seen Jeff at two others. Following the third a small group had gone for coffee together. It devolved into just the two of them. Their conversation had been on the merits of the Windows operating system versus that of the Macintosh, and in such detail they’d driven the others away. Not once, she realized, had he looked at her breasts, and for the first time since they’d developed, she was disappointed. What was the point of great tits if a man who interested you didn’t notice?

  Over the telephone she’d once complained about it to her mom, a woman of considerable beauty herself. “The ones you don’t want to notice, will; the once you’d like to notice usually won’t. Get used to it,” she’d told her daughter.

  Daryl and Jeff had reached that point where young couples talk about themselves. She’d gone first. When it was Jeff’s turn, he told her how he’d been raised by two elderly grandparents who had doted on him. “It sounds lonely,” she’d said.

  “They were awfully good people, and very loving. They passed before I was graduated from college. I’ve been mostly on my own since, until recently that is.” He’d brightened, then told her about his girlfriend, Cynthia. That had been the end of any thoughts she’d had about the two of them.

  After that they worked together from time to time. At one juncture he’d provided her with significant information unofficially. A few months later, she’d done the same. From then on they’d formed a fast and close working relationship, unfettered by his relationship with Cynthia.

  She’d learned through a mutual friend of Cynthia’s death and had, in her subsequent contacts with Jeff, noticed the change in him. Where once he’d frequently been lighthearted, now he was somber. She regretted that she’d never found the proper moment to express her condolences at his loss.

  She was looking forward to seeing him, especially as she was convinced he was the one person who could help her with this virus. As for the rest, well, time would tell.

  11

  RIO DE JANEIRO, BRAZIL

  RUA FRANCISCO OTAVIANO

  TUESDAY, AUGUST 15

  10:16 A.M.

  With a touch of distaste Maria Braga watched the scraggly-haired young man enter.

  The Euro Internet Café, just two blocks from Copacabana Beach in Rio, catered largely to the tourists who walked by and to certain Cariocas who didn’t have a computer of their own. She knew both types at a glance. The tourists were dressed in fresh beach attire, while the locals were primarily diligent, well-scrubbed students. With six computers and one booth for international telephone calls crammed into the long, narrow room, Maria made an adequate living for herself and her daughter. In the four years she’d run the café, she’d only been robbed once.

  The young man’s name was Nicolau. Maria thought he was weird. She didn’t like the way he looked at her, staring at her modestly covered breasts as if she were naked. She was certain he was some kind of pervert.

  And he was a nerd. She could tell this guy knew all about computers. He’d probably built his own at home or, at least, bought the very latest models. From the looks of his expensive watch, he could afford it. He didn’t have to use hers, so why did he?

  Nicolau rarely stayed at the station more than three or four minutes. That alone was strange. He was up to something, but she had no idea what. She’d thought about charging him more—maybe he’d go somewhere else—but her fees were posted.

  Nineteen-year-old Nicolau da Costa was a hacker. His father was a senior vice president with Banco Central do Brasil, while his mother ran a modest flower shop on Avenida Nossa Senhora de Cobacabana. Nicolau spent his nights at his computer playing video games or online in various chat rooms, exchanging virus code, talking endlessly about creating a virus that everyone in the world would know, but wouldn’t cause enough damage to get him arrested.

  He’d found it wasn’t that easy. More than once he’d been on the verge of launching a virus, but had always held back. Brazilian prisons were notorious. He had nightmares about ending up in one. You never knew when the authorities might decide to make an example of someone. Even his father wouldn’t be able to help.

  Every once in a while, though, a job came along. This was the fifth in less than a month. He dropped onto the chair and checked to confirm that the computer was connected to the Internet. He looked back at Maria up front, then slipped his floppy into the computer and launched the code. The e-mail had told him to leave the floppy in place for three minutes. As he waited, he browsed two Web sites, then, satisfied, extracted the floppy.

  Now he entered his Yahoo e-mail account and sent the following message.

  Date: Tues, 15 August 10:21 —0700

  He typed in the address, careful that no one was looking.

  From: Riostd

  Subject: sent

  rlsd code. rdy for another when u r. send $.

  RioStud

  At the counter Nicolau smiled as he counted out the coins for his time. Nicolau thought Maria was hot, but wondered if she had been raised in a convent. He and his friends talked about traditional girls like that, though none of them had ever met one who had been. She sure dressed like a nun.

  12

  MANHATTAN, NYC

  IT CENTER

  FISCHERMAN, PLATT & COHEN

  TUESDAY, AUGUST 15

  10:25 A.M.

  Stepping outside the building, Jeff was surprised to see it was midmorning. A slight breeze was coming in off the Atlantic and the air was clear, invigorating after the sterility of the IT Center. He walked around the corner to a deli he’d spotted earlier, where Daryl had agreed to meet him. He was looking forward to seeing her again. Quite apart from her ability to help him in his work, he’d always enjoyed her company.

  For the last day the world outside had not existed for him. Nothing mattered but the pixels on the screen, accessing the operating system, the story he discovered as he inched his way toward solving the problem, the bits of information that formed together in time to crack the mystery, and the final recovery of the
blocked, stolen, or destroyed data. Though this one was not solved—not yet.

  Daryl was due any minute. As he entered, he realized that the deli might have been out of Seinfeld, with a dozen people ensconced in booths or sitting on stools. He took an end booth, placed an order for coffee, then sat drinking as he waited.

  He felt bad about leaving Sue with such a mess, but he had to take a break and rest to think clearly. He glanced over at two men and one woman working on laptops with Wi-Fi and wondered how many viruses each had without knowing it. Two other men in business suits were sitting at a small table having an animated conversation. From the few words he picked up they were talking baseball. Apparently the Yankees were losing.

  As a barista cleared a table beside him, Daryl Haugen entered, glancing first left, then right. She was wearing her usual garb of jeans, with a tight white blouse. He waved a hand; she spotted him, smiled warmly, and came over. Sitting across from him, she placed a half-empty bottle of water on the table, then flopped her laptop bag onto the floor. She looked stressed, very, very tired—and lovely.

  There was no denying her beauty. He’d once sat in a meeting, bored out of his mind, only to realize he’d been staring at her. Her returning look had not been pleasant, and he’d been careful ever since. Still, simply being with her was an appealing experience.

  For an instant he couldn’t help comparing her to Sue. Daryl had a freshness, a spontaneous way of behaving, about her that was quite engaging. Sue was more artifice and calculation. The two women could not have been more different, and his response to each was night and day. He felt relaxed and open around Daryl, but on guard with Sue, making sure that he kept within the bounds of professional interaction.

  “No coffee?” he asked.

  She shook her head. “No. I had plenty earlier. It gets me wired if I’m not careful. How have you been? How’s it going in the cold, cold world of private enterprise?”

  In the years since he’d left the CIA the two had run into each other at the occasional conference. But mostly they’d exchanged e-mails and talked over the phone about difficult problems they’d encountered. Jeff was by nature a puzzle solver, while Daryl was the most gifted computer expert he’d ever encountered. Together they made a great team, but their different lines of work didn’t offer many opportunities for collaboration.

  “I’m doing fine,” he said. “Business continues to boom. I do it all myself so I don’t have to waste time with employees. It keeps me busy. My main problem is reminding myself to keep increasing my fees. Computer security is a pretty hot topic for many companies. But who am I telling? How do you like CERT?”

  “It’s US-CERT, and I like it a lot.” She grinned and for a moment the tension in her face vanished.

  In the wake of 9/11 came recognition that cyberspace was vulnerable to attack and that something needed to be done. The new Department of Homeland Security lumped together a number of previously independent and disparate groups in various agencies. Related to that, but also independent of it, in early 2003, the president issued a directive creating the National Cyberspace Security Response System and within it the United States Computer Emergency Readiness Team, labeled in government jargon US-CERT. As the operational arm of the National Cyber Security Division, its primary objective was to create a strategic framework to prevent cyber-attacks against U.S. computer-oriented infrastructure.

  A different organization, known as CERT, had been created earlier, in response to the infamous Morris worm, which had brought 10 percent of Internet systems to a halt in 1988. Housed at and part of the development center at Carnegie Mellon University in Pittsburgh, Pennsylvania, it held a less audacious mandate. CERT was intended to coordinate communication among the various cyber experts to prevent future virus outbreaks, though with the advent of 9/11, the older CERT’s profile had significantly increased.

  But the total effect of so many organizations with overlapping jurisdictions hadn’t improved America’s defenses; instead, it created chaos. Turf wars intensified rather than easing, and obvious measures took months or years of discussion and debate to implement—if at all—because it wasn’t clear which organization was ultimately accountable. In Jeff’s view, it was all tragic and pointless. The threat was self-evident. Only those with the power to do something about it seemed unaware.

  How anyone could do nothing in the face of such an obvious threat was something he could never comprehend or accept. The anger he felt whenever he thought of it burned at him, but he could do nothing more than what he’d already done and continued to do, every workday. Sometimes he wanted to scream, but he knew no one would listen. He’d just be defined as a kook and in consequence lose any effectiveness he had. This was, he now realized, one more reason why he’d made a point to stay in contact with Daryl.

  “I didn’t know you were a field operative,” Jeff said.

  She gave him a quirky smile. “I have a very competent team. Between my laptop, e-mail, and cell phone, we’re in constant contact.” She paused. “And I needed to see this situation for myself.”

  “How do you like Homeland Security?” he asked with a knowing smile.

  Daryl grimaced. “The bureaucracy can be wearing, but my part’s pretty good and getting better. I’m surprised anyone’s got time to work.”

  “You’re with my old friend George?”

  “With? We consult one another. I don’t spend any more time with him than I need to.”

  “How’s that going?” he asked, though he had no doubt of the answer. She despised the man as much as he did.

  “Did I mention bureaucracy?” She made a face. “Don’t get me going, though honestly, when it comes to that group and their maneuvering for power, he’s better than some I could name. It’s just that I feel like I’m talking into an empty oil drum most of the time. All I hear is my own echo back. Commercial attacks are up steeply, but both he and the department don’t really seem to care about that all that much. Lots of people and companies are losing information that costs them money. These high-tech crime groups in Russia are getting fat off of us, and nobody’s made them a priority.”

  “I hear the Company ran another simulated attack last summer.” Such information was common knowledge in the elite world of cyber-security Jeff occupied. He’d been waiting to ask someone in the know about it. “What was the outcome?”

  She laughed. “It was like all the ones before Silent Horizon in 2005 or Operation Cyber Storms I, II, in 2006 and then Cyber Storm III in 2009. CIA and DHS rigged the tests so completely there was no way they couldn’t defend. They established perimeters no real attacker would ever follow while everyone defending a system against penetration knew the attack was coming, and what the rules of the game were. It was ludicrous, but management took great comfort from the results. They’re back to worrying about terrorists blowing up a computer system. It’s like the old FBI chasing bank robbers while the Mafia was running rampant. DHS does what its component parts have always done. There’s an extraordinary lack of imagination there.” Daryl shook her head, still amazed at the stupidity of it all.

  “It’s got, what? More than two hundred thousand employees? That’s enough manpower to do the job right.”

  “That’s it,” Daryl confirmed. “Cyber-security is so far down the totem pole we hardly count. If it wasn’t for the work of the private-computer and Internet-security companies, we’d be getting nowhere.” She took a pull of water. “Did you read about the airplane?”

  Jeff shook his head. “I’ve been in a cocoon. What happened?”

  “As I understand it, a British Airways flight from London to New York had an incident over the Atlantic.”

  “Don’t tell me it was a Boeing 787?” Jeff had long anticipated such an event given its heavy dependence on computers.

  “Yes, indeed, a fly-by-wire, computer-designed-and-operated aircraft.”

  “What happened?”

  “Apparently the plane began to climb very slowly, and the airspeed dropped while on aut
opilot. The crew was not alerted and didn’t recognize their danger until it was nearly too late. As it was, the plane stalled at forty thousand feet.”

  “Jesus.” Jeff shook his head in disbelief. “Like the Spanair crash last year they think was caused by malware.”

  “Yes. They were lucky they were so high. They needed all but a couple thousand of those feet to recover.”

  “What happened?”

  “We don’t know, but I understand they were only able to save the airplane by rebooting the controlling computer in flight.”

  “That took nerve.” Jeff was impressed. Someone had known what to do when the chips were down and had acted on that knowledge.

  “More than you can imagine. They had no command while the computer was off-line. There is no mechanical backup to the controls. That plane fell like a rock.”

  Jeff gave a low whistle. “That’s a bright crew to manage something like that, under those conditions.”

  Daryl raised an eyebrow. “They deserve a medal. But you haven’t heard the best part. When they tried to reboot, the computer locked up. They had to power off. It’s a miracle they got enough control back in time.”

  My God, Jeff thought. He couldn’t imagine anyone having the presence of mind to pull off a stunt like that in such an emergency. Those men really did deserve a medal. Still, those systems should have been secure from infection, and fail-safes should have prevented the need for manual intervention. “What about the redundant systems?”

  “They didn’t work.” She paused. “There were eight deaths. They managed to pull out of the dive that followed the stall, but the plane shot up to over fifty thousand feet before nosing down again. The autopilot was handling the roller-coaster ride, but still … No one in back was prepared, and most were unbuckled. Passengers were knocked around like pieces of cordwood. Five of the deaths were small children. They were thrown around like missiles. The adult deaths were from broken necks and internal injuries. One passenger is paralyzed. Many others were seriously injured.”