by Reece Hirsch
Highlighted books: Purchased The Best of 2600: A Hacker Odyssey by Emmanuel Goldstein; purchased How to Disappear: Erase Your Digital Footprint, Leave False Trails, and Vanish Without a Trace by Frank M. Ahearn.
Highlighted media: Numerous; viewed Citizenfour documentary on Netflix.
Highlighted Internet searches: 15 Google searches using search term “Centinela Bank hack”; 13 Google searches using search term “Damian Hull”; 7 Google searches using search term “Federal Reserve hack”; 3 Google searches using search term “statute of limitations cybercrime”; [link to additional results].
Highlighted sigint intercept: “Sure, I was involved with the Centinela Bank hack, but that was a long time ago. I’m a different person now. And the statute of limitations has run, right? Right?”
Highlighted telephone calls: Numerous phone calls from individuals on Cybersecurity Watch List, including potential cyberthreats Enigma, 4T8CRS, PWNSAUCE, Seneca, KatieH8, AgentUrnj, Damian Hull. See appendix for continuation.
Notes: Suspected to have been involved in Centinela Bank hack and hacktivist protests/cybervandalism involving private cybersecurity firms Stryker Security, Nomad Labs, and Blount Object Consulting.
THREAT LEVEL 1 ALERT: Telephone call 7-10-15 from PRIORITY Watch List Target Ian Ayres to subject’s workplace number (415) 555-8814 (new business listing Bruen & Associates).
REFERRED TO WORKING GROUP FOR IMMEDIATE PROCESSING AND THREAT REMEDIATION.
PROCESSING OUTCOME: CLASSIFIED. LEVEL 2 CLEARANCE OR HIGHER REQUIRED.
6
Zoey got the call from Chris as she was walking along Mission Street back to the office. The cool, clear, bright San Francisco morning was as bracing as a shot of espresso, but she was still actually looking forward to returning to her new job. As soon as she heard the hoarse, desperate tone in Chris’s voice, she knew that her day was taking a hairpin turn.
When he told her that Becky Martinez and Ira Rogers were dead, she dropped her cardboard cup on the sidewalk and barely noticed as the scalding coffee seeped through her sneakers.
Panic, grief, and confusion owned her. She wanted to go fetal. She wanted to sit on a nearby bus bench until her world reassembled itself.
But she knew that standing still would be a mistake, and possibly a fatal one.
Whoever had killed Becky and Ira and tried to kill Chris and his new client was probably looking for her too. They’d assumed that she would be in the office. But here she stood, only two blocks away and in plain sight of passing cars.
Zoey needed to hide herself away somewhere. She scanned her surroundings, trying to determine if she’d already been spotted.
Now everything looked like a threat:
The cars speeding past on Mission Street.
The pedestrians staring at the dumbstruck girl standing in front of a pool of coffee.
The owner of the 7-Eleven behind his counter, trying to decide whether to clean up the sidewalk.
She didn’t know whom she was supposed to be afraid of, but it could be almost anyone.
Chris had said that she needed to disable her phone. It was a smartphone and she couldn’t remove the battery, so she went into the 7-Eleven and bought a Big Gulp. Then she dropped her phone into the Big Gulp and tossed the cup into a trash can. While she was at it, she darted back in and bought a burner with Internet access with cash.
When she was back on the street, she walked quickly, taking care not to run. She cut over on Second Street toward the Financial District and its morning crowds in their suits and skirts.
She wanted to rent a car and drive until she reached the wildest, northernmost reaches of California, someplace with a name like Eureka or Alturas. But she couldn’t rent a car without providing a credit card. She didn’t have enough cash for a hotel room, and she couldn’t use a credit card. She stopped at the first ATM she spotted and withdrew the maximum amount of three hundred dollars. As she waited for the machine to dispense the bills, she stared into the machine’s CCTV camera, remembering what Chris had said.
For the benefit of her pursuers, in case they were able to access the video feed, she mouthed a “fuck you” into the lens.
Five minutes later she’d checked into the Hotel Vitale on the Embarcadero. The desk clerk raised an eyebrow when she paid in cash, insisting on an additional cash deposit for incidentals. She wondered how anyone managed to live a life off the grid without credit cards.
Once she was in the room, she paced about, trying to access the secure site through her burner smartphone. The phone’s Internet connection was spotty, so she went downstairs to use a computer in the hotel’s business center.
After she’d sat around for an hour, waiting for a message, Chris began communicating by live chat through the secure website.
CHRIS: You there?
ZOEY: I’m here. Are you okay?
CHRIS: Yes, but we’re not safe.
ZOEY: Where are you?
CHRIS: We’re in SF, still on the run.
ZOEY: Just tell me where you are and I’ll come to you.
CHRIS: That’s not a good idea. We think that this agency is coming for Ayres because of what he’s found. They’re coming for me because he told me about it. We’re the target. You’re not.
ZOEY: I could help. You know I have skills.
CHRIS: I know, but what you need to do now is go as deep underground as possible. You once told me that you knew someone who knew how to do that.
ZOEY: Damian Hull.
Damian Hull was a cybercriminal who had evaded a prison sentence for violations of the Electronic Communications Privacy Act by seemingly disappearing from the face of the earth. When Chris was a prosecutor with the DOJ cybercrimes section, he had convicted Hull of enough counts under the ECPA to put him away for twenty years. Damian had never shown up for his sentencing hearing, and despite the best efforts of every federal law enforcement agency, his whereabouts remained an utter mystery. During Zoey’s days as a hacktivist, she had crossed paths with Damian and knew that he could be located—if you were among the select few that he trusted.
CHRIS: Do you still know how to contact him?
ZOEY: Yeah.
CHRIS: And will you do it?
ZOEY: You really think it’s necessary? This guy is the nuclear option. You don’t just play that card unless you’re prepared to go away for a while.
CHRIS: If you think it will make you safe, then you should do it.
ZOEY: You really think it’s that bad?
CHRIS: Yes.
A pause before Zoey’s response.
ZOEY: Okay, I’ll see what I can do. I’m not sure how often I’ll be able to contact you once I pull the trigger on this.
CHRIS: I understand. Just do whatever you need to do to go off the grid, and I’ll see you on the other side.
ZOEY: How about if you and Ayres come with me?
CHRIS: You know that could never work. I’m the last person in the world that he’d want to protect.
ZOEY: Yeah, true.
CHRIS: If you need to reach me, I’ll keep checking the secure site. I know you may not be able to access it again for a while, though.
ZOEY: I hope you know that you’re never going to get revenge for Becky and Ira. Don’t try to beat them. Just keep running.
CHRIS: I’d give you the same advice.
ZOEY: Remember, you’re not Edward Snowden. All those documents gave him leverage. What do you think they would have done to him if he was just a guy making unsubstantiated claims?
CHRIS: We should probably sign off. Stay safe. I’ll see you when I see you.
ZOEY: You too. I guess this was the worst opening day in history, huh?
Zoey had worked hard to conceal her panic and desperation while typing with Chris. After all, his situation was even worse than hers. Nevertheless, after she signed off from the secure site, the rueful smile disappeared from her face, and she began agonizing over the choice that she faced. She wasn’t sure whether reaching out to Damian Hull was a
good idea, or even safe. There was no telling if he would take her in or suspect a trap and burn her.
Even viewed in the most sympathetic light, Damian was a questionable character, a sort of cyber arms dealer. Before he’d fallen off the map, Damian had sold “vulns,” or vulnerabilities, to the highest bidder. Vulns were errors in the coding of major software programs that provided access to corporate assets or customer information. The trick was finding vulns that were previously undiscovered, so-called zero-day events, which provided cybercriminals with a narrow but crucial window in which they could exploit their access before data-security experts diagnosed and patched the flaw.
If Damian hadn’t violated his own rules, he might still be in business, auctioning off vulns in the darker corners of the Internet. Selling vulns was a business that operated in a legal gray zone, because there was nothing inherently wrong or illegal with identifying flaws in a software program. In fact, many major tech companies paid vuln brokers large fees to turn over flaws that they had uncovered before cybercriminals could exploit them.
Damian’s downfall came when he got his hands on a vuln that was so sweet, so choice, that he had felt compelled to exploit it himself, siphoning off three hundred million dollars from the Federal Reserve System. And that was how Damian came to be introduced to Chris and his colleagues at the Department of Justice, and how he had been driven into some rabbit hole where even the most highly motivated and capable agents of the clandestine services couldn’t unearth him.
Zoey’s own cybercrimes were far less serious than Damian’s. She’d garnered a reputation in certain circles through several high-profile hacktivist pranks that involved defacing the corporate websites of banks and government agencies, particularly during the financial services meltdown of 2007. Her specialty was mimicking the look and feel of corporate websites so perfectly that her pranks took on overtones of performance art. For example, she had sent an unnervingly accurate replica of an email from Centinela Bank bearing the slogan “Lending Money to Those Who Need It Least Since 1904.”
Damian had recognized that the same talents that Zoey turned to satirical ends would be invaluable for a cybercriminal engaged in “spear phishing,” mimicking emails from a company in an attempt to get customers to provide their credit card and account information. He had reached out to Zoey, just as other fraudsters had, and tried to recruit her in exchange for a percentage of the take.
Zoey had politely declined the offer, explaining that she didn’t do theft. She’d been as nice as possible, knowing it didn’t pay to antagonize cybercriminals like Damian, because you never knew when you might be dealing with someone connected with organized crime. Despite her refusal, Damian had given her a method of signaling him if she ever changed her mind about his offer.
At that time she’d never heard of Damian committing any crime worse than theft. But then again she hadn’t communicated with him directly in four years, and who knew what illicit activities he was into now?
After an hour in the hotel business center agonizing over the decision, Zoey accessed an Internet Relay Chat (IRC) message board that Damian had once frequented. She took a deep breath and cracked her knuckles, knowing that once she summoned Damian there would be no turning back.
She signed on to the IRC board under her old hacker handle, Cynecitta, and typed in the signal:
“Testing one-two-three. Is this thing working? I didn’t think so.”
Of course, there was no immediate reply, just a couple of “WTF” responses from a smattering of hackers who happened to be on the board swapping exaggerated tales of their exploits.
After stressing about taking the step, Zoey felt a little let down by the nonresponse, like a witch who had botched an incantation. She wondered if she had misremembered the signal. She wondered if Damian was so deep underground now that he could no longer access the message board.
In accordance with Damian’s protocol, she would check back on the board every day at the same time that she had posted her original message.
Perhaps it was all for the best. If Damian Hull never contacted her again, she should probably consider herself lucky.
7
After eighteen years of service, and with no warning, Sam Reston received a one-page interoffice memo informing him that he no longer worked for the National Security Agency. He spread the memo out on his desk and analyzed it as if it were one of the intercepted emails or telephone calls that were his stock-in-trade.
Although it was scrupulously impersonal, the memo was clearly intended to reassure him that for practical purposes his status had not really changed. He would still have the same benefits and compensation, but he had been assigned to a new working group within the federal government that was not affiliated with any specific agency.
After spending most of his adult life working for the NSA, he would have hoped for some sort of acknowledgment of his service, but it was not that sort of workplace. The lifers still referred to it as No Such Agency or Never Say Anything, and being closed mouthed was ingrained in the agency’s culture.
And that was generally fine with Sam, who was not one for touchy-feely displays. At least that’s what his ex-wife told him. Sam sometimes thought that his colleagues tended toward the taciturn because they knew better than anyone else that the only place where true privacy was still possible was inside your own head. Given time the NSA would probably breach that last bastion as well. He’d read the research and knew that there was some interesting work being done with brain waves . . .
The letter told him to report the following Monday for his new job with “the Working Group” in a new facility twelve miles away from the NSA’s primary data-processing facility in the piney woods along the North Georgia–South Carolina border. He’d asked Boyd Cleary, his section chief, about the new assignment, afraid that he was being put out to pasture. Boyd was a deceptively easygoing former navy intelligence officer who oversaw Sam’s team of data analysts and statisticians. His blond crew cut always seemed a little too on the nose to Sam, as if Boyd were an actor playing a role.
“Don’t worry. It only means that you’re valuable,” Cleary said. “You’re going to the front lines, where all of the interesting work’s gonna be done. Really, I envy you. We’re going to be stuck here going through the motions.”
“I’d never say we were just going through the motions.”
“I’m talking about the future. The post-Snowden, let’s-make-a-show-of-beating-up-on-the-NSA future. Now that Congress has limited the NSA’s bulk data collection.”
“What sort of work will we be doing?”
“You know better than to ask questions like that. You’ll see when you get there. But I think you’re going to find that it’s right up your alley.”
“I’m a little old to be starting over at a new agency.”
“Don’t think of it as a reboot,” Cleary said, slapping him on the back as Sam winced. “Think of it as a lateral move.”
On his first day with the Working Group, Sam drove his Ford Taurus through the speed-bump town of Carlton, past the Dixie Dew BBQ. The two-lane blacktop was long and straight and lined with pine trees. Sam had lived in South Carolina long enough to understand that pine trees were the white noise of the Southern landscape. As undifferentiated and monotonous as the desert sands, they took on the characteristics that your eye brought to them. On a long-ago Saturday afternoon at Lake Lanier with his ex-wife, the pine woods had seemed to rustle and tremble with the promise of a new life. On this day the pine trees looked like flat-green spikes, serrated and forbidding.
After overshooting on the first attempt, Sam realized that he should have turned onto an inconspicuous side road. It started out as a rutted dirt path but morphed into freshly paved asphalt about a hundred yards in. A row of scratched and dented mailboxes at the intersection suggested that at the end of this road he would find some backwoods clan, but those were just for show. The NSA was as adept at artifice as a CGI special effects team.
&nbs
p; A deer stood in the middle of the road, watching him approach, then bounded upward into the woods with a motion so smooth it was like video footage of a downward jump run in reverse.
Two slow miles from the main road, the claustrophobic tunnel of pine trees opened up into a clearing and he saw the facility, which consisted of a five-story black-glass cube surrounded by a tall, electrified fence with barbed wire and all of the other extreme security measures that Sam had grown accustomed to at the NSA.
He slowed as he approached the main gate and took note of the telltale signs of a highly classified government operation.
Massive boulders to impede access—check.
Hydraulic antitruck devices—check.
Cement barriers—check.
Commandos in black attire carrying submachine guns, the so-called Men in Black—check.
Attack dogs, motion detectors, and bright-yellow signs warning that taking so much as a note or sketch, much less a photo, was a prosecutable offense under the Internal Security Act—check, check, and check.
Sam presented his blue NSA security badge to the guard at the kiosk in front. The guard took the badge, dropped it into a receptacle, and Sam heard a shredder grind and mulch the plastic. The guard handed him back a new badge with his name and the same stunned-looking photo but no agency affiliation.
The facility looked familiar, a much smaller version of the NSA data center where he had previously worked. He recognized the coppery sheen that glinted off the black building when the sun struck it from a certain angle. It was the high-tech shielding, code-named Tempest, that blocked all electronic signals from entering the building. The structures that housed the NSA, and apparently the Working Group, were like gigantic roach motels of data—vast quantities of the world’s data were hoovered into the building, but none escaped.
A young woman in khakis and a blue button-down came down to greet him as he sat in the reception area. She looked like she should be working at Walmart.
