by Sam Bourne
‘It would,’ Ellis replied. ‘But if we’re right that they have the Alexandria Group in their sights, then it won’t just be western locations. Western sensibilities might well be the ultimate target. If you think back to Palmyra: trashing it was partly about erasing Syria’s pre-Islamic past, and partly about outraging western opinion. Same with the Taliban blowing up the Bamiyan Buddhas.’
‘But we shouldn’t forget the killings. That’s not their usual MO, is it?’
‘Excuse me?’ It was Lofgren’s mini-me. ‘What killings?’
Governor Morrison looked over at the Director. This is what I was telling you about. Now she gestured for Maggie to explain.
‘OK. Even before the destruction of the library at Charlottesville, there was a murder. Of a historian at that university. That’s what the governor first asked me to look at. A Professor Russell Aikman. But it turns out he was not the only one. We found several historians killed—’
‘Who’s we?’ Mini-Lofgren again.
‘Er, sorry. Me. Just me. Force of habit.’ Maggie smiled broadly, as Uri walked into her head and then out again. ‘In the past few days, several historians were killed in very rapid succession and in very suspicious circumstances. I can give you the details. And not only in this country. And not only historians. We’ve also seen the murder of crucial eyewitnesses to historic events. Holocaust survivors initially, but there are also now reports of the killings of survivors of the massacres in Rwanda and in the Balkans.’ She thought of Uri and his ingenious system of Google alerts; a string of text messages had arrived from him as she rode in the cab. A peace offering perhaps.
‘To say nothing of the destruction of Yad Vashem, and denial of service attacks on a range of websites whose sole purpose is documenting these events. This looked like a wide-ranging, international effort aimed at destroying the record of history’s greatest crimes. And now, after what happened last night, the target seems to be even bigger. History itself.’
She took a breath. She suddenly felt self-conscious. This, she realized, looked like grandstanding: a Washington offence, even if everybody did it all the time.
‘All I’m saying is that this might be jihadism or it might not. We don’t know.’ Maggie looked around the circle. ‘We need to keep an open mind.’ She saw two of the Deputy Assistants, or Assistant Deputies, look at each other. She was being difficult.
As she spoke, the secretary who’d brought Maggie to this room came in noiselessly, approached the Director and handed him a small square of paper. He took it and carried on nodding, allowing Maggie to finish her point. Then he cleared his throat.
‘It’s from the analytics team. Confirmation that our work here is now much more urgent. First, this document fits our initial assumption: it makes clear that the Alexandria Group of libraries and archives is indeed the central target of a worldwide operation, apparently aimed at destroying the historical record.
‘Second and more alarming, the manifesto includes a deadline.’
‘A deadline?’ said the governor, now looking petrified. ‘What kind of deadline?’
‘Whoever is behind this effort wants it completed by Friday of this week.’
‘Friday? Why Friday?’ It was Lofgren’s echo.
Andrea Ellis was checking the calendar on her phone. ‘Does that date have any particular significance?’
Donna Morrison sighed. ‘I can think of one. That’s the day we’re expecting a verdict in the Keane case. You know, “history on trial”.’
There was a silence as each person in the room tried to process the implications and to calculate the relative probabilities of coincidence or intent.
‘Either way,’ said Lofgren, ‘we have only two days.’
Chapter Twenty-Three
Mountain View, California, one month earlier
Jen Goodwin checked her watch. Her contact here, Katy, would be down in a minute or so. Jen would have to pretend not to recognize her immediately – even though she had spent a good part of the last week scouring her every social media post, learning so much about her, she’d almost become a friend. Almost.
She felt that familiar frisson – part guilt, part thrill, each related to the other – that this job still supplied, even after several years. If asked at dinner parties, she would usually say she was in ‘IT’, a response which elicited either a turned back, a look of strained pity or undisguised panic: Oh my God, how dull, what on earth are we going to talk about?
Occasionally, she would say infosec or information security or, if speaking to someone over forty, cybersecurity, which might trigger a raised eyebrow or, more often, an inquiry about passwords. What Jen Goodwin never said was that she was a pentester: a penetration tester, hired either alone or as part of a ‘red team’ to test the defences of companies’ computer systems against intrusion.
Her task was to break through by whatever means necessary. That might mean sitting at the keyboard of a machine hundreds, if not thousands, of miles away, prodding and poking at a company’s digital plumbing until she found a weak join. Or it might mean deploying what she and her colleagues called ‘social engineering’: exploiting the single weakest part of any company’s digital infrastructure, namely the human beings who supported it.
When Jen Goodwin had received this commission four days ago, she’d known instantly it would be the hardest of her career to date. The target company was just too important, too central to the internet, to take chances with its security. And, of course, it was stupendously, unimaginably rich, with a bottomless well of resources. To attempt a virtual break-in would be ridiculous. Whatever trick of hackery might work with a regular company was doomed to fail against this one. Which left only one option: physical penetration.
But a quick look at the available OSINT – open-source intelligence, your regular publicly available information – was, if anything, even more discouraging. It took Jen barely a glance at Google Maps – and yes, she was aware of the irony – along with various satellite images, to see that the Network Operations Center, or NOC, which was her target, was all but impregnable. It was built like a maximum-security prison: no windows, heavy iron gates, electronic card scanners, biometric security controls – doubtless including iris-recognition – as well as swipecard-controlled turnstiles at every entrance. Sometimes, you’d be surprised; Jen could waltz into company offices by simply tailgating, attaching herself to a group of visitors and slipping in without anyone noticing. That was not going to be an option with this one.
But, and this was one of the things Jen loved about her job, that very fact prompted a thought. What must it be like to work inside such a place? All that security: pretty soon, you’d feel like a prisoner yourself. Maybe she could use that to her advantage . . .
Her next move was her LinkedIn account. Or rather one of her half dozen fake LinkedIn accounts. It took a while, but before long Jen’s screen displayed several profiles of people who worked both in the NOC and in the ‘data integrity’ centre nearby. She then simply cross-checked those with accounts held by those same people on social media: Facebook, as always, was the most generous source of personal information. Which was what had led her to Katy.
Katy was just darling, you could see that. Such a sweet person. Newly hired at the data centre, fairly low level and so eager to share the details of her life. Scrolling through her (public) Facebook page, Jen learned it all: mother’s maiden name, high school, childhood pets. That stuff they ask in those ‘security questions’ when you need to change your password? It was all there. Oh, and so was the location of her children’s school. Just in case that became relevant.
Anyway, that wasn’t what leapt out. No, the detail which jumped off Katy’s Facebook page was her involvement with, and commitment to, a local maternity support centre. She was a volunteer there, and a passionate one. Once Jen saw how much Katy cared for new or expectant mothers, she knew what she had to do.
The first move, as always, was a phone call. Not from her phone, but from her l
aptop, via spoofcard.com. The webpage greeted her with its familiar message: Easily disguise your Caller ID. Display a different number to protect yourself or pull a prank.
What she was doing was somewhere between the two, she decided. She selected the ‘free demo’ option and then followed the steps: entering the number she wanted to call, then the number she wanted to display and finally, as she put her earphones in, clicking ‘Place Call’. It really was that simple.
Now, as she called the data centre’s switchboard, the incoming call would appear to be from the target company’s headquarters. She asked to be put through to Katy. She cleared her throat and got into character, the first of three roles she would be playing for this job.
‘Hi Katy, my name is Helen. I’m a project co-ordinator with facilities management? We’re upgrading a few of our facilities. The good news is, we’re sending out an interior designer to you tomorrow so she can take a look around, then put together a scheme for renovating your workspace?’
‘That’s great,’ Katy said, just as sweetly as Jen had hoped. ‘We really could use the help!’ A little laugh and then, ‘But isn’t this a little short notice?’
Jen had assumed Katy, no matter how good a person she was, would be suspicious. And she had prepared for it.
She sighed and said, ‘You’re right. You should have heard from me sooner. I have just been completely buried in work. And I know I’m falling behind, but with the baby due in five weeks—’ She let her voice quaver. ‘If my boss finds out I screwed this up, he’s going to freak out.’
‘Oh, sweetheart, don’t worry. We’ll figure this out. Forget I even mentioned it. Tell me about the baby! Is it your first? Do you know if it’s a boy or girl?’
Jen dived in, talking about names and birth plans, the fact that she’d had to switch her ob-gyn a month ago – all of it coming easily, since she had, in fact, been pregnant with her first child two years earlier. All she had to do was maintain the slightly higher-pitched voice she had allocated to ‘Helen’.
‘Anyway,’ Jen said, as if reluctantly getting back to business. She gave Katy the name of ‘Greta’, the interior designer who’d be coming to the data centre at eleven am the next day.
Which was who Jen was to play right now. She looked up and there was Katy, her face a picture of warm welcome. Instantly Jen knew that the fake business cards and website she’d cooked up for Greta would scarcely be necessary. She was in.
Seconds later, now issued with an all-important pass, she was with Katy and her colleagues in the data integrity department, chatting away helpfully about what they wanted from their office environment, what was working well and what would be ‘even better if’.
‘I like to call those EBIs,’ Greta said enthusiastically, as she scribbled down each of their suggestions. Before long, they were all thumbing through swatches and talking ergonomic keyboards. There was a long discussion about the optimal location for the water cooler.
After an hour or so, Jen took a bathroom break, which gave her a chance to walk around the office and be seen. She didn’t rush, smiling instead as she brushed by Katy’s co-workers, so that as the morning passed and as lunchtime neared, she had all but become a familiar face around the office. The company’s official policy may have demanded that all visitors be escorted but that was for visitors. By now Jen had been seen walking around with, even getting coffee for and laughing alongside, trusted insiders. She no longer looked like a visitor, so no one questioned her. (Mega tech giant this might be, Jen thought: but human nature is human nature.)
Eventually, ‘Greta’ put away her tape measure and said, ‘Thanks so much, guys. I think I have all I need here. You’ve all been so great.’ She checked her watch. ‘Eek. I need to be over at the NOC for my next appointment. Can any of you wonderful people point me in that direction?’
Katy’s face became a picture of concern. ‘When do you need to get there? It’s quite a ways.’
‘Really? I’m meant to be there in, like, ten minutes.’
Instantly, Katy scooped up her bag and her keys and said, ‘You know what, I’ll give you a ride.’
‘No, that is completely un—’
‘I insist. It’ll take you far too long to walk over there from here. Come on. I might even get coffee for all these losers.’ A round of warm laughter and rushed goodbyes from Katy’s co-workers, as they thanked Greta once again for all she was about to do for them.
In the car, Katy chatted away about the long hours in this job and how she was adamant that that would not affect her volunteering. Greta nodded and murmured her agreement, careful to leave no doubt that she was hearing about it all for the first time.
As they spoke, Katy’s car twice pulled up at gates where a camera scanned her auto-pass and the boom lifted automatically – barriers that, had Jen attempted them alone, would have kept her out. The closer they got to the NOC, the more intense the security became.
‘All right, here we are,’ Katy said as she pulled into the parking lot directly in front of the building, which looked every bit as forbidding as it had online. ‘Do you want me to take you in?’
‘No, you’ve done more than enough. I’ll take it from here.’
Katy said her last goodbyes to Greta and, as it happens, Jen did the same. As she strode through the NOC entrance, careful to walk with the confident stride of an employee rather than a guest, she left ‘Greta’ behind.
Attached to her waistband was the pass which she had lifted from Katy’s desk nearly an hour ago. Except now it was modified, the face of Katy replaced with the face of Jen. It had been easy enough to do: some basic recon the day before yesterday to discover what the passes looked like, then some fiddling around on Photoshop before printing onto a vinyl sticker a partial mock-up of a pass, using a picture of her own face. The finishing touch had come when she’d taken that bathroom break: in the stall, she’d pulled the sticker out of the zipped compartment of her purse and slowly pasted it onto Katy’s pass. Now, with any luck, the pass would ID her as herself, but scan as Katy.
It worked. She was in.
Now for the part most fraught with risk. She went to reception and asked them to call up to Greg Turner.
Her searches through LinkedIn had proceeded along two tracks. First, the hunt for Katy, but second had been her quest to find a SysOp, a man – it was bound to be a man – in system operations, established in the NOC, inside the belly of the beast.
Thanks to LinkedIn, in combination with Tinder and two other dating sites, she had found Greg. Early thirties, uber-geek and, crucially, if predictably, single. Which hardly narrowed things down in this place. But the point about Greg was that he was looking. Seriously looking. What’s more, and admittedly Jen had much less to go on than she did with Katy and the maternity centre, Greg came across as a guy who still had a touching faith in romance. Perhaps even in fate.
‘Greg?’ she said into the phone handed to her by the guard at reception when the message she had asked him to convey became too complicated. Jen asked the question in a voice that was shyer, more tentative than either Greta, Helen or, in truth, Jen. The profile she’d constructed of Greg in her mind told her he was after a woman who didn’t scare him. Actually, ‘woman’ was probably not the right word. ‘Girl’ was closer to the mark.
‘Oh hi there, I’m Katy from over at data integrity? Apparently you’re the designated fire marshal guy in your area, so I’m really sorry but that’s how I got your name. So, here’s the thing. Facilities management just had an interior designer with us, looking to improve our workspace – you know, maybe get us new chairs and all that – and she wanted to be shown around the NOC. So obviously we said no, we couldn’t let an external contractor in. So instead, she’s given me some questions to ask you all, which I can then feed back to her. It will take, like, five minutes?’
There was a pause, a moment of silence into which Jen read any one of a hundred possibilities. He was suspicious. Or he was busy and didn’t need the hassle. Or, despit
e her best efforts, her voice didn’t appeal to him and he had decided she wasn’t his type. (Maybe she sounded too much like a mom. Was that it? The thought had crossed her mind before and, given her line of work, it was troubling.)
But then he said, ‘OK. Sure. I’ll be right down.’
He emerged from the elevators about two minutes later, in a pair of chinos and polo shirt in a shade that would be identified as Nerd Blue on a colour chart. Exactly as Jen had hoped.
Shyly, she offered her hand. He took it just as shyly. ‘Katy,’ she said. ‘Greg,’ he said.
Rein it in, she told herself. Don’t give him the full eyes or the wide smile. It’ll scare him off. Sidelights, not full beam.
In the elevator, she pulled out her notebook and began running through the kind of questions she’d been asked to ask. ‘And she gave me these books with, like, fabrics in them.’
‘OK,’ he said, before looking up at the display which showed which floor they were on.
Soon, though, they were at his desk and she was asking him to sit in his chair and lean back and lean forward. Slowly a couple of other guys drifted over, and she felt like the girl allowed into the boys’ school on the last day of term.
To her surprise, they had lots of questions of their own about the angle of incline on the lumbar bar and the adjustability of the tension in the mesh. But still she managed to get them interested enough in carpet colours that the swatches soon came out. And of course there were long discussions about keyboards, as she asked Greg to log in and show her how he typed. Only fleetingly did she touch his head and neck to demonstrate what the interior designer had showed them all that morning – but just long enough for her to see that the touch had registered.
She waited for the group to disperse and only after Greg had hesitantly asked if he could get her a coffee, did she wonder out loud whether she could perhaps sit for a few minutes at that empty desk just over there and email over to the designer the details she had asked for.
