The Devil's Code

CHAPTER 11

In the course of my life, I'd spent maybe six months in Washington. Though it might not be fashionable to admit it, I like the place. Usually portrayed as a mass of greed-heads packed liked oiled sardines inside the Beltway, Washington has nice places to walk and good art to look at. People who like central Italy, the campagna, would like the rural landscape out in Virginia.

We got into National late, and picked up the car and a map. We wouldn't be right in Washington. According to Rufus, the server we were looking for was in Laurel, which is actually closer to Baltimorenot far, I noticed on the map, from Fort Meade, headquarters of the National Security Agency.

I'd had some dealings with the NSA when I was in the military and I'd always been impressed by two things: their employees' technical expertise and their arrogance. I hadn't had anything to do with the agency for a couple of decades, but because it was so heavily involved in computers, there was always a lot of back-and-forth between NSA computer geeks and the outside computer world.

Word got around, and the word was that the NSA was rapidly becoming obsolete. Once upon a time, agency operatives could tap any phone call or radio transmission in the world; they could put Mao Tse-tung's private words on the president's desk an hour after the Maximum Leader spoke them into his office phone; they could provide real-time intercepts to the special ops people in the military.

No more. The world was rife with unbreakable codesany good university math department could whip one up in a matter of days. Just as bad, the most critical diplomatic and military traffic had come out of the air and gone underground, into fiber-optic cable. Even if a special forces team managed to get at a cable, messages were routinely encoded with ultrastrong encryption routines.

The NSA was going deaf. And the word was, they didn't know what to do about it. They'd become a bin full of aging bureaucrats worried about their jobs, and spinning further and further out of the Washington intelligence center.

LuEllen and I checked into a Ramada Inn off I-95 near Laurel, Maryland. Separate rooms, under separate IDs, gave us some easy options if there were trouble. In the burglary business, you never know when you might need a bolt-hole.

The next morning, after pancakes and coffee and The New York Times for me and The Wall Street Journal for LuEllen, we went looking for the server. The T-l line it used was located in a suburban office complex called the Carter-Byrd Center, building 2233. We found it fifteen minutes from the motel, two rows of four, two-story yellow-brick buildings, facing each other, behind small parking lots, on a dead-end street.

The tenants were professional services companies: accountants, financial advisors, a legal publishing firm, a title company, and several law firms. Most of them occupied an entire floor or building wing. The company we were looking for, Bloch Technology, was one of the small companies, grouped with other smaller companies, in a suite of offices in the end building on the right.

LuEllen, dressed in a dark blue business suit and navy low heels, clipped her miniature Panasonic movie camera into her briefcase, gave me a hot little kiss on the lips-going into a job always turned her on-and headed for 2233 to do the first reconnaissance. I waited in the car.

The idea was, she was looking for one of the other companies in Carter-Byrd, but got the building wrong. She'd be inside, we thought, for two or three minutes.

Fifteen minutes after she'd disappeared through the double glass doors, I was about ready to go in after her. Then she walked back outside, with a guy in a short-sleeved white shirt, who pointed up the hill toward the first building. She nodded, and they talked for a few more seconds, she laughed, patted his arm, and started for the car. I slumped a little lower in the passenger seat. The guy watched her go; he wasn't watching her shoulders.

As she came up to the car, I slumped another six inches. She climbed into the driver's seat, fired it up, backed out of the parking space, and we headed up the hill. "He's back inside," she said, as we pulled away.

I pushed myself up. "That took a while."

"I knocked on the doorit's got a Vermond combination pad, not alarmedand asked where Clayton Accounting was, and we got to chatting," she said. "Those computer people are amazing. They've got all these interesting machines."

"Really."

"Really. He's got five of them. They look like air conditioners, all lined up in the back room."

"Two rooms?"

"Three. One is a standard office, one has the computers, one has a futon on the floor and a miniature refrigerator where he keeps his Cokes."

"Is he in there alone?"

"There're two desks, but one of them looks pretty unusedlike maybe a part-timer. I got the phone number."

She'd pissed me off a little by casually talking to the guy. "We're gonna have to do a really light break. If we screw anything up, he'll remember talking to you. He'll remember your face."

"I thought it was worth the effort. And you know what? There is no security. The rest rooms are on the second floor. I went into the ladies' room, and there's a drop ceiling, but it's a mess above it. If we went up, and anybody came in to clean up. they'd know."

"So what do we do?"

"I'm thinking about it."

"All right." I looked at my watch. "Let's go get some deodorant, and then we can hang out for the day. You can think."

We found a drugstore, and I bought a travel-sized can of a woman's deodorant, the kind that advertises actual freshening powder in its spray, and a couple of Cokes. We drank the Cokes on the way back to Carter-Byrd. This time, LuEllen slumped in the seat while I went inside, carrying her briefcase so I looked like I had a reason to be there.

The building was essentially a long string of business offices opening off central hallways that ran the length of the building.

There was nobody in the hall when I walked inside, and I made a left, slipped the deodorant can out of my pocket, and gave it a couple of shakes. Bloch Technology was the third door on the left. I spotted the keypad as I came up, looked both ways, and then gave it a thorough spraying with the deodorant. I waved my hand in the air a couple of times to disperse the smell as best I could, then headed back out. Total time in the building, less than one minute. Total people encountered, none.

"So let's go hang out," I said.

We hung out, more or less; I took her to a driving range, where she hit golf balls, and very well, with a five-iron older than she was, and with a three-wood that was not only wood, but was no bigger than her fist. I did some quick sketches of her swing. Later, we caught a movie, and in between, I got back to Bobby, who had what he called a curiosity: a sudden spate of rumors on the Net that Firewall was planning a major attack. Bobby knew about Rufus and the Monger; I suggested that he call Rufus and have him trace the latest round of rumors. And I had a new question of my own, that popped into my head just as we were signing off. Bobby said:

will trace rumors soonest.

ok.

call tonight.

yes. new thought. look at airlines. see if jm flew in days before he was killed.

yes. will also check gas card. also, jpeg in your box.

thanks.

I downloaded the JPEG, which is a picture format, and saved it to examine later. After the movie, which sucked, LuEllen pointed me at a sporting goods store, where she bought a spool of black monofilament fishing line called Spider Wire. We went back to the motel, looked at the movies she'd made that morning at Blochfive Dell servers sitting on heavy plastic benches with a monitor and keyboard off to the sidethen had a slow dinner at a fast diner. The nerves were getting on top of me, like they always do. After dinner, we went back to the motel, picked up her bag, and at seven o'clock, when it was good and dark, we were back at Carter-Byrd.

There were maybe forty offices in 2233. Seven or eight still showed lightsAmericans work all the time, no getting around it. Bloch Technology was not one of the lighted offices; Bloch's futon was only a tiny cloud on the horizon.

We took the end space in the parking lot, and LuEllen tied one end of the Spider Wire around the steering wheel, led the line out through the window, across the lawn to the door. She checked to make sure that nobody was coming from inside; she did a quick knot on the outside door handle, cut the line at the spool, and strolled back to the car. When she was back, and inside, she pulled the line tight, until it stretched, absolutely invisible, directly across the sidewalk to the door.

"Now, if somebody wants to use the sidewalk, they'll simply have to go around," I said. "Either that, or garrote themselves."

"If somebody comes, we cut the string. It flies halfway back across the yard, and nobody sees it."

"Did you ever do this before?"

"No, but I read about it."

We sat in the lot for twenty minutes before the door opened: and the rest worked just like LuEllen thought it would. The guy pushed through the door and walked away, headed toward his car in the parking lot. She put pressure on the door as it slid closed.

"Gotta hurry," she grunted. "I don't know if the line'll hold. The door's heavier than I thought."

"Hang on, hang on." I didn't want the guy who was leaving to see me get out of the car. When he was up the hill, I hurried across the lawn. She'd stopped the door just as it touched the doorpost. I pulled it open, and snapped the line off the handle. We were in.

LuEllen had programmed Bloch's phone number into her cell phone earlier in the evening, and dialed the number as she got out of the car. The hallway leading past Bloch Tech was empty. I walked to the door, LuEllen close behind, and mimed a knock: we could hear the phone ringing inside. No answer.

As I mimed another knock, LuEllen turned off her phone and pointed a little battery-operated black light, the kind teenagers used to buy in head shops, at the keypad. The powdery crystals in the deodorant fluoresced in the lightexcept for the three that had no powdery crystals.

"Four-six-seven," she said. "But there are four digits in a Vermond lock. In this model. So they repeated one of them."

Nobody in the hall: I took a dime notebook out of my pocket and began scrawling number combinations as quickly as I could write, calling them out as I jotted them down. The thing about number pads is, with ten digits, there are 10,000 possible combinations. Getting inside with a brute-force attack is tough. And a few locks, but not this one, were alarmed, or would lock up, after a certain number of incorrect combinations. Then they could only be opened with a key.

But if you know the four digits involved in the combination. ah, then there were only twenty-four possible combinations. If one of the digits is repeated, like it was here, and you don't know which, the number goes up to thirty-six. But most people start their combination with the lowest number, in this case, a four. We started with four-four-six-seven, and went to four-four-seven-six, and to four-six-four-seven, and so on. We were lucky, hit it on the eighth combination, and pushed into the darkened office.

"Gloves," LuEllen said.

We pulled on vinyl gloves, and followed the hair-thin beams of the flashlights into the server room. The Dell servers looked like five little dwarfs, lined up for breakfast; the room was windowless, and windowless was good. The futon was rolled into a corner of the third room, with a fuzzy blue blanket tossed carelessly on top of it. LuEllen, using her flash, found a roll of tape in the outer office, and brought the blanket into the server room. We taped the blanket to the wall so it covered the door, and then LuEllen slipped under the blanket into the outer office, and closed the door behind her. I pulled the blanket so it covered the door completely, and turned on the light.

"Light's on," I said. Then I turned if off, and LuEllen pushed back inside.

"Almost perfect," she said. "There was a little tiny dot of light near the right corner."

We rearranged the blanket and I went to work on the machines. Servers are nothing but specialized computers, optimized for communications and storage. If you've got a relatively modern home computer, you could use that as a small server, with the right software. In this raid, we wouldn't be going after the content inside the servers. We wanted access, rather than content. I spent twenty minutes pawing through Bloch's software and service-maintenance manuals, and then got into the servers themselves. They were running on a standard off-the-shelf UNIX server package. I had root in five minutes, with an outside maintenance account. Then I dumped in a little access program of my own; I've done this before. After checking it, I shut down local access, turned the light off again, pulled down the blanket, and cleaned up the tape.

While I was working on the machine, LuEllen had been going through paper files in the outer office, using her flash. "All bullshit," she said. "Tax forms, bank statements, advertisements."

One of the forms listed Toby Bloch as owner of 100 percent of Bloch Technology stock. "Is that the guy you talked to?" I asked. I crumpled up the blanket and tossed it back on the futon, more or less as it had been.

"That's the guy. Toby."

"All right. Nice little business he has here."

With everything back in place, we listened at the door, heard nothing, and walked out; out to the car, and we were gone. Nothing to it.

But there was trouble back at the ranch. I wouldn't go online with the server until after midnight, when there was less chance that the real system operator was online. Instead, I checked with Bobby, to see if he had anything more on Jack Morrison or Firewall. He did.

look at news programs. firewall attacks irs with dos. big trouble now. attack maybe starts in switzerland. style feels german.

will look. anything on jm?

jm flies to baltimore-washington international on monday before shooting, returns same night. rented hertz, 64 miles. no more detail. also flies to bwi on thursday afternoon back friday morning. no car, no hotel on card.

thanks. will look at news.

this is *very* dangerous.

later.

I thought about that until LuEllen said, "What?"

"Jack Morrison was in town the night Lighter was killed," I said.

"That's not good."

"No. But Lane's lecture about Jack and guns. that's still pretty straight. I still can't see Jack shooting anyone." "What's this about the IRS?"

"I don't know," I said.

"Bobby seems more worried about that than about Jack."

"Jack's dead," I said.

I checked the Times and Washington Post online editions, but they had nothing on the attack on the IRS. CNN had a story, but like a lot of CNN stuff, most of it seemed to have been garbled by a mentally challenged paranoiac; I clicked over to The Wall Street Journal, which had a short item.

A denial-of-service (DoS) computer attack aimed at the internal revenue service has caused a major disruption in the handling of end-of-quarter business tax filings, an IRS spokesman confirmed this afternoon.

The attack, which began this morning, is continuing. The attacking group has identified itself as "firewall."

A denial-of-service attack attempts to flood the target with huge numbers of legitimate-looking transactions, eventually overwhelming the target computer's ability to cope with the numbers.

While official department of justice sources said that the attack is limited, one high-level IRS official, who asked not to be identified, said that there has been a major disruption of end-of-business-quarter tax filings. He said that "tens of thousands" of business quarterly returns were involved and said that the attack seemed to be spreading.

An FBI spokesman said that many of the DOS calls appear to be coming from small-college computer labs.

"What apparently happened is that some individual or group planted small attack programs inside these open computers, and designed them to go off at the same time. We are getting in touch with these schools as we identify them, asking that they go off-line long enough to remove the programs from their computers. Most of them have no idea that their computers are participating in the attack," FBI spokesman Larry Conners said.

Conners said that the attack program is an unsophisticated one, but the IRS official said that it takes advantage of the fact that the IRS computers must be open to the outside to receive legitimate tax returns. The attack involves sending and resending hundreds of legitimate-looking, but slightly flawed returns, which the IRS computers then attempt to return to the sender. As the volume built, the computers were no longer capable of handling the flow of traffic.

"Individually, the attack filings wouldn't be a problem; the problem is that they just keep coming, over and over, from so many different sources," the IRS source said.

The FBI's Conners said that the attack may have started in Switzerland, with the attack programs planted as long as a month ago.

"If the attack isn't sophisticated."

"It's not sophisticated, but a fire ant isn't sophisticated either," I said. "But you get a few thousand of them swarming up your shorts, and you've got a problem. If the feds get really pissed, and start hammering on that list of names, who knows where it'll end?"

"There've been other attacks like this. I read about one in Newsweek."

"Yeah, but there's a huge difference," I said. "Before, they were messing with private businesses. The politicians' public attitude was, well, that's too bad, but the real feeling was, fuck a bunch of private businessesthose guys got too much money anyway. But now, these guys are messing with the politicians' money."

"Ah."

"Yeah. Big 'Ah.' "

The JPEG photo that Bobby sent me was still on my hard drive. I opened it, and took a look. A parking lot, apparently taken from a fairly high angle. Three men in suits were walking across a parking lot full of pickup trucks. All three of them were carrying briefcases, and one had his face turned up toward the camera. The resolution of the JPEG was not high enough to make out the faces. All of the photos, Bobby had said, were the same.

"So who are they?" LuEllen asked.

"I don't know."

"If the picture's important. it must be that the three shouldn't be together. You know, like a gangster and a cop."

"Or a Chinese and an American," I said. "Look at this guy. there's something about him that looks Oriental."

"Shape of his face. unless it's a woman."

"Huh. I don't know." And I didn't.

Late that night I went into Bloch Tech's server. There's so much stuff in a server, even a small one, that there's no real-time, hands-on way to sort through itit's not like flipping through a book. It's like flipping through a library, like trying to make sense of Jack's disks.

I did a search for references to Firewall, and found several hundred in saved e-mail and in postings on Web sites. Six accounts seemed to have a lot of traffic about Firewall. I went into the administrative files, pulled the accounts, and copied out names and addresses. As I finished, I noticed a peculiarity: they were all new accounts, they'd all signed up in the last two weeks, and they'd all paid the up-front minimum of three months by check, rather than opting for credit-card payments.

"Damn it, I'll bet the names are fakes," I told LuEllen. I saved the names. I could ship them to Bobby later, and have him look them up.

Since I had the administrative files up, I checked for Jack Morrison and came up empty; then, on the off-chance, I checked Terrence Lighter, and got a surprise. Lighter had an account on this server, and better yet, his e-mail had dozens of letters. A few were encrypted, so I skipped over those. Most of the rest were letters to and from collectors and dealers in antique scientific instruments, apparently a hobby of his.

And there was one letter that said, unencrypted and in the clear, the Sunday before last:

Mr. Morrison. I will see you tomorrow at my office at 8:30.

Please bring the files with you. Thank you. T.L. Lighter.