True Faith and Allegiance

24

Jack Ryan, Jr., had arrived to work early this morning for the team run, and like the day before, he was quiet and reserved around the others. His mind was still on Indonesia and everything that had happened there, and what had happened because of everything that had happened there.

Midas ran along next to him for a while and tried to get a conversation started. The ex — Delta operator was several years older than Jack, but Jack had no problem seeing the man was obviously in peak physical condition, considering how he could run multiple eight-minute miles back-to-back and still keep up a conversation that made him sound like he was chatting over cocktails in a hotel lounge.

But Jack wasn’t in a chatty mood. His mind was on what he saw as his responsibility for the woman he’d never met who died alone and horribly in Minsk.

Jack barely paid attention to Midas, and finally Midas pushed ahead and ran on alone.

After morning PT, Jack showered and went into his office, where he started going through some e-mails while keeping an eye on the news out of Italy this morning. Of course he experienced all the anger and sadness most Americans felt when learning about this attack, but on top of this he couldn’t help thinking about what his father had said about the rash of leaks of unknown nature going on at the moment, and the possibility that one of these had led to the death of Jennifer Kincaid. Still, Jack had no inside information about the events at Sigonella; and though the attack on the U.S. Navy personnel was being reported as a terrorist incident, CNN had not reported that anyone had been specifically targeted. Instead, the reports so far had all framed it as if anti-American terrorists had shot up and blown up some rental property near the base, making the reasonable assumption they might kill some Americans in the process.

At eight-thirty a.m. Jack was called into Gerry Hendley’s office, where he found Gerry waiting with a small tray of coffee, pastries, and fresh fruit. Also present and sitting at the table across from Hendley’s desk was the IT director for The Campus, Gavin Biery. Gavin was a portly and rumpled man approaching sixty, and he was known around the office for never passing a box of donuts without picking one out, so Jack was surprised to see him with a bottle of water and a half-eaten orange in front of him for today’s breakfast-time meeting.

Jack said nothing, he just raised an eyebrow as he poured himself a cup of black coffee.

Gavin, however, was a perceptive guy. “It’s a diet, Ryan. Not all of us have four hours a day to work out.”

It was true Ryan was in great shape, and he worked out regularly, but he’d never worked out four hours in a single day in his life, and he didn’t bother to point out to Gavin that he hadn’t had time to go to the gym all week. Instead, he replied, “Good for you, Gav. I want you to live forever.”

“Only because I’m the guy who solves all your technological problems, of which you have many.”

Jack sat down. “Actually, it’s your great interpersonal skills that I’d miss most.”

Gerry Hendley had the TV on his wall tuned to CNN, and the daytime live feed out of Sigonella showed a smoldering house with a dozen emergency vehicles parked down the street in front of it. The sound was muted, but the chyron at the bottom of the screen read: TWELVE DEAD, FIVE INJURED IN U.S. NAVY ATTACK. Gerry and Gavin had been looking at it while they waited for Jack, but now Gerry turned away, picked up his coffee, and moved over to the table, where he sat down with the two men.

“Gavin, Jack asked me yesterday to reach out to the DNI and offer our help in locating some sort of security breach in the U.S. government. I spoke with Mary Pat Foley last night and offered any assistance with the analytics in the search for whatever leak was responsible for the horrible exposure and murder of Jennifer Kincaid.”

Gavin had been told of the events in Indonesia and the tragic fallout of those events.

“What did Foley say?” Gavin asked, picking at his orange.

“She’s agreed to bring us into this informally.”

Jack squeezed his fists in satisfaction. “That’s great, Gerry. Thank you.”

Gavin Biery added, “It sounds like an interesting puzzle. But what do you mean, informally?”

“There are those at NSA and other places who know what our analysts have pulled off in the past.” When Gavin raised an eyebrow, Gerry clarified quickly, “Not just our analysts, our tech side as well. That thing that happened with China a few years back, specifically.”

Gavin nodded. “Yes, I sort of saved the world on that one, didn’t I?”

“You did,” Jack said quickly. “You saved us all. Gerry, you were saying?”

“Dan Murray is having a package of details sent over regarding the widespread intelligence leak that has come to light in the past couple of weeks. It should be on our server by now. You guys can see all the data they have on it. If you happen to find something, we’ll let Murray or Foley know.”

Gavin Biery said, “You told me about the thing involving the poor CIA officer in Minsk. But what’s the scope of the breach?”

“From what I heard from Mary Pat, at this point, nobody knows how deep and wide this goes. They are getting burned by new compromises every couple of days.”

Gavin asked, “Could this, in some way, be related to that thing the Chinese did a couple of years ago? Remember, they got onto JWICS.” Early in President Ryan’s latest term, Chinese computer hackers accessed intel from the U.S. intelligence community’s Joint Worldwide Intelligence Communications System. It had compromised communications between America’s spies and created a brief moment of panic around the IC. Fortunately for all, The Campus, led by MIT-trained genius Gavin Biery, had located the culprit of the hack and ended the crisis.

Gerry said, “That was the first question I asked. Mary Pat said this situation couldn’t possibly be related to that intrusion. This breach has compromised people at DoJ, the State Department, the U.S. Navy, and the CIA. Most of them are men and women with identities that would have no reason to be transmitted in JWICS comms.”

Jack said, “How could it just be one breach, then? All those branches and services you mentioned. They don’t pass classified intel on the same network. On top of that, those different networks have to be viewed in SCIFs.” A SCIF was a Sensitive Compartmented Information Facility, a secure location designated for the storage and processing of classified information.

Gavin said nothing, which was a surprise to Jack, because he always seemed to be ready with some sort of an answer. The man was brilliant, he was arguably the most important person in the entire Campus, and he’d be the first to let others know.

Gerry noticed Gavin looking off into space. “Gavin, is something wrong?”

“Just processing Ryan’s question. I’d like to look at the specs of this leak, or at least what the DoJ has managed to discern from the compromises you mentioned. Jack and I will put our heads together and try to work out how the intel was obtained. How many cases are we going to be looking at?”

“DoJ isn’t even certain of that. There is the Kincaid incident, plus the FBI officers who first responded to Jakarta in response to it, a CIA officer detained in Iran, and a U.S. Navy commander targeted with what looks like specific information, but it might not have been anything classified.”

Jack said, “So either three or four.”

“That they know of. These are the incidents that have come to light in the past couple of weeks, but there could have been others, or there yet might be more to this.”

As he said this, Gerry’s secretary’s voice came over his phone’s speaker. “Director Hendley? AG Murray for you.”

The director of The Campus knew the attorney general was one of the busiest people in the world this morning, so he snatched the phone off the cradle quickly. “Hi, Dan.”

Jack and Gavin looked on while Gerry listened to his caller for a few moments.

He said, “Yes, I saw it.” Then, “How certain are you?”

When he hung up the phone a minute later, he looked to the two men in front of him. “Sigonella, Italy, this morning. The terrorists had access to specific intelligence regarding their targets. Dan says this might be part of the same ongoing and unknown intelligence leak.”

Gavin mumbled, “The hits just keep on coming.”

“I guess we’d better get started,” Jack said.

Gerry looked at Jack now. “I know this is very personal to you, because of what happened after Jakarta the other day.”

Jack nodded. “It is personal. And that will help me focus on it. It won’t be a distraction to my work.”

Gerry looked him over a few seconds. “That’s all I wanted to hear. Thank you both. Let me know if you need anything at all from me. One call to Dan or Mary Pat or Jay, and I might be able to get you more information or resources.”

Hours later, Jack and Gavin were deeply engrossed in the intel sent over from DoJ on their secure laptops. They were seated on opposite sides of a long table in a third-floor conference room, and did little more than read through what was known about each incident and what had been done to date to find out how the information on the victims might have been obtained by bad actors.

Early on they decided to split their evaluation and analysis. Gavin would focus on the work that had been done in the countercyber realm, digging into the investigation to date on possible hacks or unauthorized data access that might involve all the compromised parties.

Jack, on the other hand, focused his attention on all non-cyber-related investigation avenues. Human spies, insider threats, unauthorized sharing of intelligence through friendly liaison relationships the U.S. intel community had with other nations, anything that might have been either accidental or deliberate that could have put these targeted men and women’s names out into the open.

As he read through the incidents again, Jack tried to figure out just what had to be known about each person involved in order to make them a target. He found this the more interesting part of the problem. It seemed to him that someone had worked very hard to tailor the intelligence to the targeting of these specific individuals.

The Scott Hagen incident was the first, and then a CIA NOC officer who had been arrested in Iran after entering the country.

The Iranians had claimed on state-run TV that they had proof the man’s name was Collier and that he had been in the American spy service for eleven years. The CIA had discerned, through sources and methods not shared in the files sent to The Campus, that the Iranians had used a fingerprint reader to determine Stuart Collier worked for the CIA.

This was curious to Ryan. He couldn’t imagine any accidental scenario where a CIA officer’s fingerprint was exposed in a way Iran might get hold of it.

As he and Gavin toiled through the afternoon, Jack sent some queries to analysts in-house, and Gavin reached out to some other personnel in his information technology section.

On Gavin’s side of the equation, he learned the work the NSA had done evaluating the chance that some classified network had been breached was preliminary; they’d been looking into this as a potential intelligence breach for only a few days, but so far they’d found no evidence of new, successful cyberattacks on the U.S. government that could have led to this information getting out.

The two men took a lunch break in the midafternoon. Gavin picked at a salad he’d brought from home, while Jack ate a grilled chicken sandwich ordered in from a nearby deli.

While they ate Jack bounced what he’d learned off the older man. “The U.S. intel community, or at least those members looking into this compromise, seem to think the leak is one person who knew all the people burned by the leak.”

Gavin said, “Highly unlikely.”

Jack was prepared for the pushback. Gavin was a computer guy, so Jack felt sure from the beginning Gavin would assume this was some sort of a computer leak. “Mary Pat says NSA has run a security review on all networks run by the agencies involved and they found nothing amiss. Also, the fact that many different groups seem to be benefiting from the breach leads the government to the belief this isn’t one nation stealing information. The few nations with the potential know-how to break into U.S. networks aren’t the type to share intel across so broad a spectrum. That makes it look, to them anyway, like there is a government mole who is selling off this intel to multiple parties.”

Gavin said, “NSA did a review and found no hints of a breach, so they have effectively eliminated the possibility this has been done via a hack. They’re digging deeper, but their preliminary findings are sending everyone except for a few eggheads at NSA off looking in other directions.” Gavin shook his head. “I still believe this was cyberespionage of some sort. The fact they haven’t detected a data compromise doesn’t mean there wasn’t a data compromise.”

Jack was worried Gavin was too dug in to his theory, but he didn’t press any further. The last thing he needed was to entrench the Campus IT director further to one side of this or another. Good analytical thinking required an open mind, and Jack wasn’t at the stage where he could draw any tight conclusions and close his mind off enough to argue.

Four hours of nonstop reading and working later, Jack rubbed his eyes and turned away from his laptop, ready to ask Gavin if he wanted to go out to grab dinner together and then come back and work into the evening. But when Jack looked across the table he found the big man looking right back at Ryan with a grin on his face.

“Umm… you okay, Gav?”

Gavin answered the question with little hesitation. “I have a theory.”

“Let’s hear it.”

“E-QIP.”

Jack had no idea what the hell that meant. “What’s e-QIP?”

Gavin’s excitement was obvious in his voice. “It’s the government database that houses all applications for security clearance. The SF-86. Doesn’t matter if you’re Army, DNI, NSA, Department of Commerce, FBI… a contractor designing a new dump truck for the Air Force. Anybody who has applied for a security clearance has filled out the SF-86, a super-long questionnaire, one hundred twenty some-odd pages. All that data is housed in one database. If you are telling me a bunch of different government types from across all agencies and military branches have been compromised, I’ll tell you to look right there.”

Jack thought it over. “You are saying to find the commonality, you have to go back to the first thing these compromised parties did to become part of the classified world? To their original application for classified access?”

Gavin nodded. “That’s it. After the initial application for classified access, their subsequent information would have been moved to the issuing authority. The Department of Defense, DoJ, Department of State, or wherever. But the first file created for anyone entering the classified-access realm is all kept at the same place.”

Jack asked, “Okay, who manages e-QIP?”

“The Office of Personnel Management.”

The younger Ryan thought it over for a few seconds. “I like your thought process, Gavin, but you can’t seriously think nobody at NSA or DIA or CIA has come up with and tested this theory yet.”

“Sure, they thought of it, then they checked to see if e-QIP got hacked. When they didn’t find evidence of it, the investigators moved on.”

“But you’re certain they missed something.”

“I’m certain of this. There is no other linkage between those involved, which means, yeah, I’m certain they missed something. It happens.”

“What about the theory that an individual in the government had all this intel on different people, a mole? Just because there are a lot of different agencies and branches represented in this, that doesn’t rule out a mole. Take Chavez, for example. He knows everybody. You could bring him in here right now and he could give the name of a CIA NOC, a SEAL Team assaulter, a Department of Commerce investigator, an Air Force fighter pilot, and twenty-five other men and women with classified access.”

Gavin shook his head. “This is a data breach, I’d bet my reputation on it. This isn’t one guy spilling the beans on his buddies working in government.”

Jack said, “I’m not saying I’m on board with your theory, but let’s say you’re right. What country has the skills to get into the OPM network?”

Gavin really thought this one over for a long time. “It’s not what we’ve seen from the Chinese. The Russian government, either. Those would be the ones who could most easily break into OPM unnoticed, but they aren’t the ones involved in this attack.”

Jack said, “I agree with that. Russia could be passing out tidbits of pilfered intel to Iran. China could be passing out tidbits of pilfered info to the North Koreans. But neither of them are going to be handing targeting intel of a U.S. base in Italy over to ISIS. You could almost think that China might do it to screw with us domestically, but the risk versus reward just isn’t there. They’d have to know the reaction we’d have if we found out this was going on.”

Gavin said, “I’m going to try to narrow down the hunt for the culprit by reverse-engineering the problem. Give me some time to try to understand what it would take to get into the OPM’s e-QIP database. When I figure out how someone got in, I’ll look for the hallmarks of the attack that will give me a better idea of who might be involved. It will give us a smaller subset of villains to look for.”

Jack said, “Okay… but that’s your wheelhouse, not mine. What can I do to help?”

Gavin looked back down to his laptop. “I’m gonna be here awhile. You could go find me something to eat. Nothing too heavy…”

Jack laughed a little. “Two questions: Who are you, and what have you done with Gavin?”

Gavin Biery just raised his eyes from his computer.

Jack said, “Never mind. One kale salad, coming up.”

“I’m not a vegan, Jack, I’m just trying to cut back a bit. Don’t kill me.”

Jack stood and headed for the door. “You just work. I’ll worry about dinner.”