The Shadow Broker (Mr. Finn Book 1)

by Trace Conger

  I had to fight off sleep around page twenty-six. I’d finished the pot and was eager to cross page twenty-seven off my list before turning in for the night. That’s when I saw a post on an IT forum dated April 28, 2007, from someone using the handle “Silvio1053.” Something about “operating system development” and “business desktop deployment,” whatever that meant. The handle hyperlinked to a login page. I registered for my own forum account using a bogus name and once logged in, I clicked on Silvio’s handle again, though this time the hyperlink took me to a user profile page registered to “JBanks.” It was no slam-dunk, but the IT topics fit my preliminary profile. If Silvio hacked into Bishop’s system, he probably had IT experience. Maybe I’d inched a step closer. The find jump-started my central nervous system faster than the caffeine. I printed out JBanks’ forum post and drew a large question mark in the corner.

  “Nice to meet you, JBanks,” I said. “Let’s see if we can find the rest of you.”

  There’s a method to why people select their handles. The selection isn’t arbitrary. They mean something—something to them anyway. The IT forum was the only other site where I saw a possible connection to the Silvio1053 handle, and it’s possible that whoever used this handle to post to the forum in 2007 was the same person using it today. It could also be a colossal coincidence, but it’s all I had.

  I Googled “JBanks” and almost fell out of my deck chair. I thought the results for Silvio1053 had been mind numbing, but at 627,000, the results for JBanks threatened my eyeballs and my weekend. I clenched my teeth and considered chucking my laptop into the Ohio River. Instead, I climbed down to the boat’s main level, fell onto my mattress and went to sleep.

  THE NEXT MORNING, THE GOOGLE search results page greeted me like an ugly, drunken hookup from the night before. I brewed the first pot of the day, carried my laptop back to the sun deck and went to work. The morning sun glimmered across the river as the calm water lapped off the side of my boat.

  The results for JBanks were too general to focus on. Banks is a common name, and I had Web pages from every corner of the country on everything from fly fishing to metalworking to sports marketing to advertising to movie reviews. I could spend Bishop’s thirty days just meandering through these results. Time to narrow.

  I ran the search again, this time focusing on the terms “JBanks” and “IT” and got the results down to 81,000. Still not feasible. A morning breeze kicked the smell of someone’s breakfast onto the sun deck. Bacon and maybe toast. The same breeze grabbed my IT forum printout from yesterday and threatened to send it into the river, but I snatched it out of the air before it had a chance to escape. Studying the printout again, I decided to focus on the unique terms in the post. Running the JBanks search with “operating system development” returned 996 results and running it with “business desktop deployment” returned less than ten, including the original IT forum post. I weeded through those results, but there was nothing to go on.

  My coffee pot gurgled through the open galley window, and I headed down and poured my first cup. Back at the laptop, I went through the “JBanks” and “operating system development” results. Most of the results on the first page originated from sites in the UK, so I ruled those out. It’s possible Bishop’s blackmailer was outside of the country, but since Bishop mentioned most of his business was inside the States, I wanted to focus on in-country first. The second page offered results for term-paper writers, college professors, nursing information and a few sites from Germany and Istanbul. Most of the other results pages blended together in a sea of miscellaneous scrap.

  I polished off my second cup of coffee when I clicked on page eight. The third result was an article published two months ago in PenTesting magazine, titled “Top Five Password Coding Vulnerabilities and How to Avoid Them.” The article’s author ... Justin Banks. I clicked on the About Us section of the site. PenTesting magazine was a publication for white-hat hackers, individuals who made their living testing website vulnerabilities. I assumed Justin Banks was a staff writer for the magazine, but he wasn’t. The short bio at the end of the article listed him as an IT security consultant from WhiteHat Security Solutions in Columbus, Ohio, a consultancy company about one hundred miles north from where I sat. Now we’re getting somewhere.

  The proximity fit. If Banks lived in Mexico or overseas, he’d have no reason to have met Bishop or Fat Sam, but someone in Columbus, Ohio, seemed like a good possibility. He’s less than two hours away, so it’s not out of the question that he’d crossed paths with Fat Sam before. This was the best lead I had, but I didn’t want to discount the remaining results, so I printed out the magazine article, along with Banks’ bio, and kept crawling through the online search results. After another three hours, I hadn’t found anything else to lead me in another direction, so I decided to focus on the consultant in Columbus.

  I called Bishop to probe deeper.

  “Put your thinking cap on,” I said. “Does the name Justin Banks ring any bells?”

  “Justin Banks ...” repeated Bishop. “Not that I recall. You think he might be Silvio?”

  “Maybe. I’ve been looking into him. He lives in Columbus. Works in the IT security industry.”

  “You got a company name?” said Bishop.

  I grabbed the printout. “WhiteHat Security Solutions. That sound familiar?”

  Bishop was silent for a moment. “I met with someone from Columbus years ago, but that company doesn’t sound familiar.” He was silent again. “No, it’s another company, a Blue Horizon or something. Something with the name ‘Horizon’ in it.”

  “How long ago we talking?”

  “About three years ago. I talked to a consultant about encryption software. I met with him twice. Here in Cincinnati.”

  “Would Sam have been with you?” I said.

  “Not sure. Might have been. It was a while ago. What makes you think this is our guy?”

  “A few things point to him. No need to go into details yet.” I resisted the urge to tell Bishop it was the only solid lead I had.

  “Okay, so what’s next?” he said.

  “I’m going to dig a little deeper. I’ll call you with any updates.”

  I hung up the phone and read Banks’ bio again. He was a strong possibility. Definitely had the skill set, and the idea of an ethical hacker going rogue and hacking for extra cash made a believable scenario, especially when it paid fifty grand a month.

  Bishop mentioned working with a company named Blue Horizon before setting up shop online. An online search revealed a Blue Horizon Consulting in Westerville, a suburb of Columbus. The company’s Web page indicated it specialized in information technology security and testing. Getting closer.

  I ran another search, looking for any connection between Justin Banks and Blue Horizon, but didn’t turn up anything. That didn’t mean there wasn’t a connection, only there wasn’t any evidence of one online. If I could confirm that Justin Banks worked for Blue Horizon during the time frame Bishop indicated, I’d have enough evidence to warrant a trip to Columbus for some serious digging. No reason to waste time and gas otherwise.

  I pulled up another list of similar companies in the area and found SBC Partners, a company that also specialized in e-business consulting. I started on another cup of coffee, dialed the main number for Blue Horizon and asked to be connected to their human resources department.

  “This is Kyle Murphy. How can I help you?”

  “Hello, Kyle,” I said. “This is John Wyatt with SBC Partners. We recently interviewed Justin Banks for a position, and his resume indicates he worked for Blue Horizon. I just wanted to confirm that was accurate.”

  “Hang on a second and let me pull up that name in the system,” he said. “The name again?”

  “Justin Banks.” I could hear the plastic clicks on Kyle’s keyboard.

  “Looks like he worked here as a senior e-commerce security adviser for three and a half years. Before my time.”

  “Wonderful,” I said.
“Can you confirm his employment dates?”

  “Sure,” more clicks. “He was here from August of ‘08 to January 2012.”

  “Perfect, that’s all I need,” I said. “Thanks, Kyle. Have a great afternoon.”

  “You too.”

  Justin Banks had the technical expertise as a penetration tester to crack Bishop’s site. He lived close enough to have met with Bishop and potentially Fat Sam in person, and he worked for the same company that Bishop worked with when he architected the Dark Brokerage. My gut told me that Banks figured out Bishop was into something illegal and kept tabs on him. When he found out what Bishop created, he saw an opportunity to fleece him out of some cash.

  Most people don’t realize they’re immortal online. All those photos and website posts never go away. They just get buried deeper and deeper in cyberspace until someone like me comes along and stirs up the layers.

  Justin Banks was a strong lead. Whoever our guy was, he’d gone to a lot of trouble to be invisible. And now a simple goddamn Google search might do him in. Had it not been for that PenTesting magazine article, I’d still be beating my head against the keyboard, but now I’ve got a solid lead. It’s like a tiny piece of bone sticking out of the dirt. You grab a brush and start removing bits and pieces of dirt, and sooner or later you’ve uncovered an intact T-rex skeleton in the Arizona desert. Or in this case, Westerville, Ohio.

  Finding the connection gave me a PI hard-on, but Bishop planned to shove a handgun down Silvio1053’s throat when he found him, and while I was okay with sending a criminal low-life off to slaughter, I wasn’t okay turning over an innocent man. I had to be right about Banks. That meant a trip up I-71 to Columbus.

  I RAN BANKS’ NAME THROUGH the IRB database and found his current address at 128 Buffalo Run Road in Westerville, on the northeast side of Columbus. I grabbed my bag, keyed the address into my SUV’s GPS and hit the road. Two hours later I turned onto Little Turtle Way, past the Little Turtle Golf Club, took a left on Blue Jacket, another left on Buffalo Run and pulled to a stop in front of a two-story townhouse. Banks’ unit was on the end, adjacent to the golf course.

  The neighborhood was quiet. Less than twenty vehicles sat in the shared parking section, and Banks’ driveway was empty. Banks’ front door was on the side of the building. The other units had doors on the front. I followed the walkway to his front entrance and looked through the two long windows that flanked the door. The lower level was dark. No lights, a good indication that Banks wasn’t home.

  There was no alarm-monitoring company decal on the glass or in the yard, so I tried the door. It was locked, so I walked around to the back, where a concrete slab patio, maybe ten feet square, abutted a sliding-glass door. A wooden slatted fence about eight feet high separated his patio from his neighbor’s unit. The sliding-glass door, half covered on the inside by a curtain, allowed me to see throughout the lower level. No sign of Banks or anyone else. I gave the door a tug, but it was locked. I noticed a wooden dowel in the sliding door’s track, but the dowel was about six inches shorter than the length of the track. Not too modern in his approach to home security, but it gave me an excuse to check out the golf course pro shop.

  THE SIGN AT THE ENTRANCE of the Little Turtle Golf Club said it was a private course, but the faded bricks and ripped doormat said it was the type of club I could afford. I scanned the parking lot. American-made vehicles. As country clubs go, it appeared Little Turtle catered to the upper-middle class, not the hyper-rich. I walked into the pro shop and found the head golf pro behind the counter. The plastic tag on his shirt introduced him as Ryan.

  “Hi there. Can I help you?” he said.

  “I played the other day and I think I left a wedge on the course. Did anyone turn one in?” I wasn’t a pro by any means, but I did have a ten handicap. I’ve also lost a half-dozen clubs during my lifetime, always wedges. Players tend to leave them just off the greens.

  “Hang on a sec. Let me look.”

  Ryan walked into the back room and returned a minute later with two clubs in his hand.

  “I’ve got a Calloway and a Nike,” he said.

  “Great! It’s the Calloway.” He handed me the club. “Thanks so much. I was afraid I’d have to replace it.”

  “No problem. You getting out today?” he said.

  “I wish I could, but I’m still on the clock. Just swung by home for lunch and thought I’d stop in and see if anyone turned it in. If the weather holds up, I might try to get out next week.”

  Ryan stepped to the computer on the counter. “You want to go ahead and schedule a tee time?”

  “Nah. Gotta check with my buddies first. I’ll give you a call to set it up.”

  “Okay, enjoy the rest of your day.”

  “You too,” I said. “Thanks, Ryan.”

  FIVE MINUTES LATER I STOOD at Banks’ back door with the wedge in hand. Sliding-glass doors aren’t the most secure, but they keep most people out. I’m not most people. If Banks lived in a pricey house, then he’d likely have a more secure lock, but this townhouse looked like a rental, so I figured the locking mechanism was on the cheaper side.

  A few golfers walked the course. An elderly couple played the hole adjacent to Banks’ back patio. They both looked at me, probably wondering if I was playing their fairway. I slowly swung the wedge through the grass, trying to appear like I was looking for a lost ball. I glanced up and waved them through. Seconds later the older man swung and drilled his ball into the trees on the other side of the fairway. I heard the ball ricochet off a tree, sending a group of birds fleeing for their lives. The woman followed with a worm-burner that went in the same direction as his ball. The trees and rough kept them busy and allowed me to focus on the sliding door.

  Most spring-loaded locking mechanisms have a significant flaw. They can fail against upward force. I leaned the wedge against the wooden privacy fence, slipped on my blue nitrile gloves and grabbed the sliding-glass door’s handle with both hands. My teeth clenched as I jerked up as hard as I could, pulling the door off its track and popping the spring latch to the open position. I lowered the door back onto the track and eased the door open until the dowel caught the bottom doorframe. No alarm. After backing the door off a few inches, I slid the wedge through the open space and used the club’s head to lift the dowel out of the track and opened the door the rest of the way.

  The inside of Banks’ townhouse was small and tidy. The first floor consisted of a living room, kitchen, breakfast nook and a laundry room. A desk with pictures of who I assumed was Justin Banks with an older couple, probably his parents, was positioned against the living room wall. I was relieved to see no photos of a wife and kids, because if this was our guy, he wouldn’t be around much longer, and I didn’t like the idea of breaking up families.

  I picked up one of the photos. Banks was a middle-aged man with an average build, short, dark hair parted on one side. The photo showed palm trees and what looked like an old fort behind him. I set the photo back on the desk and went upstairs.

  The second floor included two bedrooms separated by a bathroom and double-door closet in the hall. Banks used the bedroom that overlooked the golf course as an office. There was a solid desk, not like the small writing desk in the living room, a lateral file cabinet and a bookshelf that bowed under the weight of thick computer programming textbooks. There was a computer on the desk. I clicked it on and rummaged through the file cabinets as I waited for it to boot up. I didn’t know what I expected to find in the files, but everything looked normal. Each file folder had a printed label. Typical files. Car loan, warranties, bills, health, finances. I opened the folder labeled “bills” and checked the address to make sure that Banks indeed lived here. The folder contained several months of electric and gas bills, all addressed to Justin Banks. I returned the file, closed the file cabinet and turned back to the computer. The home screen stared back at me. No password prompt, which was good. He probably didn’t expect anyone to break into his home and search his computer. I
clicked the hard-drive icon and poked around, looking for any folders or files that could link Banks to Bishop, but I didn’t find anything.

  Bishop’s website was difficult to find online. Search engines didn’t catalog this portion of the Internet. Users could find the site only by using a special browser to mask their IP address. Then they had to key in a specific URL, which looked like a series of random numbers, to access the site. It was like kicking virtual sand over digital footprints, a nice benefit when shopping for illegal information.

  I checked the dock at the bottom of his home screen and found “TorBrowser.” I clicked and it opened. It looked like any other Web browser. I checked the browser’s bookmarks and found a link to the Dark Brokerage. It wasn’t a surprise that Banks would bookmark a site on the deep Web, given the long URL strings, sometimes upwards of twenty characters. They aren’t easy to memorize. It’s not as simple as typing www.cnn.com.

  After clicking the link, Bishop’s website popped up on the screen. Bishop’s site prompted me for a username and password, which I didn’t have, so I closed out of the system.

  Banks looked like our guy. He had the technical expertise to hack Bishop’s site, had accessed the site before, and had met with Bishop and perhaps Fat Sam in person, but I still wanted a smoking gun.

  I found what I needed inside Banks’ closet. There was another smaller vertical two-drawer file cabinet. The top drawer was empty. The bottom drawer contained a purple velvet Crown Royal bag filled with coins. Next to it was an accordion file folder. I dumped them out onto the carpet. The gold coins each had an image on them, a symbol that looked like the letter “B” combined with a dollar sign. They looked like arcade-game tokens.