The Director

25

James Morris worked like a man who knew he was running out of time. Grantchester was too hot now: He relocated his command post to Bristol, in the West Country. It was easy to disappear, if you knew how to vacuum your electronic exhaust. From Bristol he directed the network that he had assembled. He provided each member the same template of operations: Penetrate your target with malware that finds a hole in the code; exploit through “social engineering” the human weaknesses that allow you to gain control of a systems administrator or database administrator. He stopped communicating even with the covert clearinghouse in Denver, lest they understand what he was really doing.

Morris chose Bristol for the same reason he had chosen Cambridge: It had a university that excelled in mathematics and computer science. So many amateur hackers were online that Morris could mask his own digital tracks. He took an apartment along the Queens Road, near the university, and filled it with servers and screens. He lived on caffeine in various forms and a new favorite food, Ramen noodles, which he consumed day and night.

Morris had five principal operatives: Edward Junot in East London, his gofer and enforcer; Emmanuel Li, the Chinese director of his “institute,” who had left Grantchester for a new hideaway; Misha Popov, the Russian tough guy in Berlin, known by his handle “Malchik,” who ran a string of unwitting German hackers; Yoav Shimansky, the Israeli who had served with the IDF’s Unit 8200; and the Chinese graduate student Bo Guafeng, who tapped into his hacker connections back home. Morris had other people in other networks: hackers picked up from the semi-anarchist libertarian groups that flourished at the margins of the cyberworld. But he used them now mostly for chaff, to distract and deceive.

Morris gave each member of his core group a basic toolkit. They had an updated version of the attack suite known as Metasploit, beloved by “white hat” penetration testers and “black hat” hackers who wanted to take systems down. When Morris’s team members had gained access to a system, they could steal its files by typing download; insert files by typing upload; or create a keylogger that recorded every touch of the target’s finger, simply by typing keyscsan_start. The tools were all preconfigured: hashdump stole the Windows hashes that were supposedly protecting passwords and data; timestop changed the recorded times when files had been created or altered. Morris’s team could disable security systems, add backdoors and encode malware into.exe files that were nearly undetectable.

“It’s too easy,” Morris liked to say. And it was.

But Metasploit was only the start. Morris provided his operatives with newer, fancier tools that could surmount controls that had been created to deal with Metasploit. At times they’d use older tools like Back Orifice, a pun on Microsoft’s BackOffice software for servers, which could control computers running the Windows operating system. They had ProRat, another Windows tool that allowed insertion of backdoor Trojan horses, aka RATs, or remote access tools, which could infect all the computers on the same local area network. They had Sub7, yet another remote access tool. It was like a medicine cabinet stocked with poison pills.

Morris liked to hack his own team members, to keep them nimble (and convince himself that the Pownzor hadn’t lost his touch). But it was also a way of sharing the ideology that Morris had believed since his youth, even as he had gone to work for the U.S. government. He was an advocate for freedom. Like so many other hackers and whistleblowers, he imagined that the United States had been hijacked by evil bureaucrats; his experience at the CIA had only deepened that suspicion. The United States had inherited the imperial mission of Great Britain, without realizing it. The British had created the CIA as the operational arm of this post-imperial regime, with Americans toddling along behind. Morris was determined to break that chain. He had imagined two months ago that the new CIA director, Graham Weber, might be an ally. But that was folly. Weber was caught in the ooze and muck.

Ground zero for Morris was the Bank for International Settlements in Basel. Over the past weeks, he had been studying this financial epicenter. He gathered books from online sellers, using several dummy accounts. The BIS in Morris’s mind had become the hub to which all the spokes of command were connected. It provided the world’s central banks with liquidity, it bought and sold their gold and other instruments that were part of the international repository of financial reserves. It set the capital standards that were the global financial system’s measure of international health. It was the umpire and scorekeeper: It maintained the records attesting which institutions were healthy with adequate reserves and which were dangerously undercapitalized. If it was hacked, he could be a digital Robin Hood, taking money from rich countries and giving it to poor ones.

Morris believed that by disrupting the BIS he was restoring the state of nature: Malchik, Yoav, Bo and the rest regularly found their screens going dark and then coming alight again with the messages about One World, and the reign of Internet freedom that would follow the end of the old order of 1945. He sent the fastidious Dr. Emmanuel Li pictures of kitty cats and sunsets and people holding hands, with the message: Keep them Free: One World. He thought Li would be reassured by these images of life as a Coca-Cola commercial.

From his apartment on Queen’s Road, Morris would look down onto the Bristol docks to the Avon River that flowed west into the Bristol Channel. By day, it was an ugly industrial vista. But by night, under the lights, the old bridges and wharves took on a soft lemony glow. Morris would sit on his deck after a day of coding, and watch the lights refract and dilate with the beat of his heart. He took the edge off with a shot of brandy and then retreated to bed, where he read himself to sleep with his monographs about the BIS.

The more Morris read about the “Tower of Basel,” as one book called it, the more he saw the BIS as a compendium of all the mistakes and conspiracies of the twentieth century. The bank had been created in 1930 to manage the flow of German reparations payments, and its profits were supposed to go to Germany. In the 1930s, it came to be seen as a financial backstop for the Nazis. The Allies seemed united in wanting to liquidate the BIS after World War II, but bizarrely the British had insisted on rescuing it during the 1944 Bretton Woods negotiations — to the point that John Maynard Keynes threatened to walk out of the conference if an American plan for defunding should be approved. Keynes was so agitated about the BIS issues that observers feared he’d suffered a heart attack. The Allies finally agreed that the BIS should be “liquidated at the earliest possible moment,” which Keynes interpreted as, “Not very early!”

And on it rolled, for seven decades: Until James Morris was instructed to shatter this symbol of Anglo-American tutelage.

Morris used the BIS routing codes and account numbers he had received from Roger to tailor his attack. These codes and passwords made it easier to program the Robin Hood part of his scheme, moving funds from account to account. He had his team develop a string of backups, in case the BIS plan wasn’t enough. This second tier included commercial banks in London and Manchester whose software supported the Bank of England’s reserve management; the London stock exchange; a hedge fund in London and a private-equity fund in Edinburgh. But these were fallbacks.

To prepare his attack, Morris and his researchers had gathered a basket of exploits that could penetrate all the major systems used by financial institutions: They targeted the “Corebank” and “Alltel” software of Fidelity Information Systems; Oracle’s “Banking Platform” and “Flexcube” software; the Swiss-based Temenos “T24” system; the Indian-owned Infosys “Finacle” suite; the London-based Misys “Bank-Fusion Universal” system; and the German “SAP for Banking.” These software platforms shared a common unintended feature: They all were targets for a determined assault.

Morris admonished the members of his network to pay special attention to backup systems: Where were they? How could they be accessed? How was the mirrored data from the main institution transferred to the backup center? How frequently was it backed up? Morris had prepared for this as well, studying the leading software vendors that provided data protection and backup services for the financial industry.

Morris had cunningly dissected the world of global finance. His target in Basel touched, at one or two degrees of separation, nearly every institution around the world. A shock wave transmitted through these institutions would create not just a disruption, but something more. The financial system was like a snowflake: so intricate in its fractal patterns, but so fragile.

Morris was shopping for milk and cereal and fruit juice at the Tesco near his apartment when he noticed someone was following him. It wasn’t fancy clandestine surveillance, with teams of people in relay and layers of coverage, but just one person. He was compact and well dressed, with the muscular build of a soldier. He was wearing a blue peacoat and sucking on a piece of hard candy.

It was only when Morris caught his intense eyes that he realized it was the same man who had approached him in the pub before he had quit Grantchester, the man Ramona Kyle had introduced as Roger. He had given Morris an index card with the time and place for a meeting in London, but Morris had let it pass two days before. Now, somehow, Roger had found his new command post.

The man followed Morris through the checkout at the market and then down the street to a café, where Morris had planned to get an almond-flavored latte before he went back to work in his lodgings over Queens Road. When Morris sat down, the man took the table next to him. When he got up to move, the man simply walked over to Morris’s table and took the closest chair.

Morris’s face was impassive, but he was frightened. This was the first sign of surveillance he’d seen; the first indication that anyone knew where he was since he left Cambridge. He played dumb.

“Do I know you?” asked Morris, peering through his spectacles at the young man in the peacoat.

“I’m Roger,” said the young man, extending his hand. “You missed our meeting.”

The cowl of a foreign accent shrouded his voice. It could be Russian, Polish, Romanian; somewhere east of the Danube. He didn’t make any attempt to cover it this time.

“I don’t do meetings,” said Morris. He grabbed his package and rose from the table and began moving away. But Roger was quicker. He pushed one of the light café chairs so that it was blocking Morris’s preferred exit path, and with the other hand pulled Morris’s bag of groceries away from him and slung it over his shoulder.

“I’ll walk with you,” said Roger. “Don’t worry, I’m alone.”

“I don’t want to talk to anyone. Go away or I will call the police.”

Roger smiled. “Really? I don’t think you will call the police. No games, please. I will talk, and you listen, okay?”

Morris shook his head. He headed the opposite direction from his flat, down toward the quayside along the river.

“You have a chance to be a great man, Mr. Morris, do you know that?” Keeping up, pace for pace.

“Fuck off,” said Morris.

“Not so loud,” said Roger. “And I mean it. You can be the man who changes history: The one who stands up for liberty, who says no to the police state. People will tell stories about you and sing songs. Maybe you will not be appreciated back home in America, but in the world you will be a hero. Yes. But you need help.”

“From you? Forget it. And anyway, I don’t know what you’re talking about. I’m an American graduate student.”

“Okay, fine. Whatever you say. But think of Brother Snowden. He was all alone, just like you. He did not have a pot to piss in. Everyone abandoned him. But then he had friends. Yes, Russian friends. I am not embarrassed to say it. We are the home of the hacker, the true home. We are the friend of WikiLeaks and Anonymous. We are the new generation. It is like the 1930s. The gods are dead. There is a new world coming. We are the helpers, the facilitators.”

Morris stopped. The sun was glinting off the canal in the distance. They were alone, out of earshot of anyone on the streets.

“Who are you?” Morris demanded. “And don’t give me that ‘Roger’ shit. Where did you get that information about the BIS?”

“Specialists provided it. People who share your cause.”

“You don’t share my cause. You’re a Russian intelligence officer. What else could you be? What I don’t understand is why my friend Ramona wanted to introduce us.”

“Your friend Ramona is wise. She is a realist. She knows that you are part of a great movement, but it needs help. You are taking on a superpower. You need friends.”

“Not Russian friends! Are you kidding me? Russia is a police state.”

“Look, James, you do not have the luxury to make such fine distinctions. There is a great struggle going on in the world, between the arrogant power of the American and British services and the yearning of the world to escape. It is light and dark. You cannot debate who is pure enough to be your friend. I am sorry. That is selfish. You must win, and we are the only people who are strong enough to help you.”

The Russian talked with a cold passion, like a man who believed that he had history on his side. The NKVD agent handlers who recruited the Cambridge Five in the 1930s must have spoken with the same seductive, dominating voice. The world was at a crossroads; a principled person had to choose sides.

Morris was shaking his head.

“Peddle it somewhere else, my friend.”

But the Russian was undeterred. He was a good officer, or he had the true faith, or maybe a combination.

“I mean it! You should come in from the cold, like Snowden did. The raid you are planning on the BIS is fine, but it is nothing compared to what you could do with us. We can create a League of Internet Freedom. Putin, he will be gone. All those people in Moscow with their whores and diamond rings and Mercedes, they are finished. The trench coat boys from the special services will be gone, too. All gone! This is the time for us, people like you and me. What do you say?”

Morris shook his head. This Russian would destroy him. How was he going to get rid of him? He thought about his weapons. He had only one, really, which was to self-destruct.

“Look, Roger, or whatever your name is, I don’t know who you think I am, or what I’m planning to do. But I will tell you one thing. If I ever see you again, I will abort my mission. I won’t explain, but let me say that from your perspective, that would be very stupid.”

“Strike a blow for freedom,” said Roger.

Morris pushed his glasses back on his nose and stood up straight. He was half a head taller than the Russian.

“Yes,” said Morris. “I may just do that. But alone.”

“I have more information for you. More codes and addresses.”

“I don’t want it. Go away. I mean it.”

Morris walked quickly along the banks of the Avon, his shoes clattering on the cobblestones. He stopped when he reached the gates of a lock and looked back, but he couldn’t glimpse the Russian. They could see him, evidently, but Morris decided that it didn’t matter, so long as they didn’t get in the way.