True Faith and Allegiance

27

Jack walked into the office at ten after eight in an especially foul mood because he’d missed the team run, scheduled today at five-fifteen. It always was a chore for him to get out of bed in the morning, especially when working late the night before. But he did it almost every day because he knew he always felt better after getting some exercise.

This morning, however, his willpower had completely faltered. He’d stayed up working from home till after midnight, then he’d slept through three alarms, and woke with a start at seven forty-five, with barely time enough to take a quick shower. Then he dressed and walked to work, mad at himself all the way for his show of weakness.

The rest of his morning run group had already exercised, showered, eaten, and begun their workday when Jack passed them on the third floor, gave some tired and gruff greetings, then poured coffee for himself, grabbed a Danish from a box by the pot, and shuffled directly into the conference room.

Clark and his two trainees were on their way out of the building to do some shoot-house work at a private range complex in Leesburg, and Dom and Ding were still writing up after-action reports on Jakarta, putting together as much information for Mary Pat Foley as possible that might help her team identify just who in North Korea had been behind the operation against America.

As soon as Jack passed through the door into the conference room he was sharing with Gavin, he saw that the older man had beat him to work. This was one last kick in the rear that told him tomorrow he would not sleep through his alarms.

Jack pulled up a chair in front of his work laptop. “Morning, Gavin.”

Gavin looked at the Danish in Jack’s hand. “You know… you should start watching what you eat. You won’t be nineteen forever.”

“Not today, Gav. Woke up on the wrong side of the bed.”

“Well… I hope that’s because a new girl was taking up the right side.”

Jack did not answer for a moment, but finally he just repeated himself. “Not today, Gav.”

“Okay. Well… am I, at least, free to discuss work matters pertaining to this intel leak?”

Jack sipped his coffee, willing the caffeine to take the express route to his bloodstream today. “Of course you are. Anything new from NSA overnight?”

“Nope, nothing. And that just means they are going to be more sure of themselves that there has been no breach of their data.”

Jack sipped scalding-hot coffee as he looked over his laptop at Gavin Biery. “But you are not dissuaded by the fact they haven’t found anything.”

“Nope.”

“Okay. So… how do we find out if the government missed something? How do we know if there was a data breach on the OPM?”

Gavin shrugged. “We don’t. We take it as fact that I’m right, they are wrong, and we go from there.”

Jack almost spit out his coffee. “What?”

“It’s the old Sherlock Holmes philosophy. Once you eliminate the impossible, whatever remains, no matter how improbable, must be the truth. If the government hasn’t found evidence of the intrusion, I won’t be able to, either, not from here. Send me over to OPM with carte blanche to tear apart their network, dig through code line by line, and look through every record of every remote access of every transaction that has taken place for the last couple of years. Then, eventually, I’ll find you something. But that isn’t going to happen, and even if it did, a lot more good people are going to be compromised in the interim. I have no doubt that two weeks from now, two months from now, or two years from now, the federal government will realize they’ve been breached. But we don’t have that kind of time. You have to trust me, and we have to move ahead, fully on board with the theory that some bad actor has access to the full SF-86 data on everyone in the U.S. who has ever applied for classified access.”

“That’s nuts, Gavin. Everyone? Even if I were to take this giant leap with you that someone got into the OPM without anyone in the government knowing about it, why the leap that everything was copied and exfiltrated?”

Gavin replied calmly. “Because once you are onto the network, once you have admin access and have built yourself a back door, taking all the files is no more complicated than taking a single file. In fact, it’s easier to take it all and then sort through it later on. You can’t just presume they went to all this trouble and just exfiltrated a small percentage of the data.”

Jack leaned back in his chair. “How many files are we talking about?”

“The system went online in the early two thousands, but the OPM went back and put a range of old files online as well. Going back to 1984.” He paused for effect. “We’re talking about well over twenty-five million files.”

“Jesus, Gavin.” Jack put his head in his hands. “Let’s hope you’re wrong.”

Gavin said, “Hope all you want. But I’m right.”

Ryan said, “I’ve been giving this a lot of thought. Having your old application in the OPM database wouldn’t be enough to compromise you, not in the way these events have taken place. Whoever is exploiting this data to make real-time targeting packages has to do a lot more work to connect the dots than just pull names off an application. Just because Joe Blow’s name is in e-QIP doesn’t mean he works for CIA or FBI. Somebody had to take the raw data from the SF-86 and fill in a thousand blanks.”

Jack pulled up the Commander Scott Hagen incident. “Take this first guy — Hagen. He’s in his mid-forties. His SF-86 has to be twenty years old. You can’t tell me there is something in that application that is going to tip off a gunman that Hagen will be eating a burrito at a Mexican restaurant in Princeton on a particular night twenty years later.”

He continued. “An application for security clearance is a snapshot of that person’s life at one point in time. It isn’t going to have a tenth of the data on it that the terrorists would need to target these guys. Especially when you are talking about the military and intelligence community. Their application says they want a security clearance, so here is all their info as of the date of the app. It doesn’t say they are now a CIA NOC in Minsk undercover with the Russian mob, and they live at a particular address.”

Gavin Biery was already nodding his head. “Ryan, you are exactly right, but that only helps us narrow down the culprit. The question we should be asking isn’t ‘Who could steal all this data?’ It’s ‘Who could steal all this data and also possesses the ability to exploit it?’” He pointed to the monitor on the wall. CNN was playing a story about the attack in Italy the day before. “This is tier-one targeting information.” Now he pointed to his laptop, with all the cases of intelligence leaks of the past few weeks. “These, as well. It isn’t that somebody knew Scott Hagen and Jennifer Kincaid and Stuart Collier and all the others. It’s that they knew Hagen was going to be in New Jersey on this date with his sister at his nephew’s soccer tournament, and Kincaid was in Minsk on a CIA op, and a compromise to her husband at State at the embassy in Jakarta. Somebody managed to get fingerprint data to the Iranians and the Indonesians, for Christ sakes! This is high-level shit, Ryan, and it was done through a high-level cyberattack and high-level research and high-level social engineering.”

Jack said, “Look… I’m an analyst. I have to take in all the possibilities. I can’t put all my eggs in one basket and work under this unproven assumption of yours that we’re dealing with a breach of OPM data. All the OPM data.”

Gavin said, “You can do what you want. But you keep saying that there are a lot of people trying to find who is responsible for all these compromises going on. They are all chasing down leads, testing suppositions, and dissecting each event. I am sure of what I’m doing, and you can work with me. We’ll be doing something no one else is doing. If we’re wrong… well, then, somebody at DoJ or NSA is going to solve this issue. But if we’re right, we’ll be the only ones with a chance to uncover what is going on, and we can end this disaster before it gets any worse.”

Just then, Jack glanced down at his computer when an instant message from Gerry popped up with an audible ding. He read the message twice, a pain growing in the pit of his stomach.

“It just got worse. Did you hear about that mail bomb yesterday in Falls Church?”

“Yeah. Killed a lady.”

Jack said, “Gerry says he doesn’t know if there is any connection, but the victim was a civilian at the DIA in the Directorate for Analysis. She was working on a task force dealing with Islamic State movements in Iraq.”

“Wait,” Gavin said. “Nobody thinks ISIS really whacked some DIA working stiff in the burbs of D.C., do they?”

Jack looked up at Gavin. “Who knows? Look at Sigonella. Who saw that coming? If this lady’s death is related to that leak we’re working, this is probably just the tip of the iceberg.” He clicked on a link to a news article that Gerry included in his message. After he read the name of the street where the attack took place, he said, “I’m going to go over and take a look.”

The drive to the crime scene was less than twenty minutes from Alexandria, so Jack walked home, climbed in his black BMW 5-Series, and headed off. He pulled up on the scene at ten a.m., meaning he arrived some sixteen hours after the event itself.

While he didn’t have the exact address of the bombing, he didn’t need it. When he turned onto the street he saw the crime scene tape and a squad car out in front of the house halfway up the block. The mailbox was gone, and the bricks of the post were blackened and chipped. There was some dark charring on the street itself, but the loose debris and blood that he assumed had been there immediately after the incident had been cleaned up.

Jack remained in his BMW. He didn’t want the Falls Church police officers recognizing him. With his beard it was a rare occurrence, but it did happen from time to time, and it wasn’t worth the risk.

Instead, he pulled to a stop at the end of the block, a hundred yards from the blast site, and he looked on at the two-story home. Using a small pair of binoculars to inspect the area from front to back, he then scanned up and down the now quiet street.

He had just been sent a preliminary FBI report that explained the explosive had been rigged with a detonator wired to a mobile phone. This meant someone had to call and set it off the moment Ms. Pineda went to the mailbox. This, of course, indicated that the killer or killers were nearby when it happened.

He wondered if they had parked right here. This was as far back on the street as you could sit on the south side and still have line of sight on the mailbox, so he thought it a safe bet they were either right in this same spot or else parked to the north of where the bomb went off.

Jack had also read in the report that this was not the residence of the woman killed. A friend lived here, and Pineda had simply stopped by to pick up the mail. For this reason the FBI had doubts Pineda was the intended target, but Jack realized anyone going to the trouble to command-detonate a reasonably sophisticated bomb would have some knowledge of what their target looked like, and they would have been looking right at her when making the decision of whether or not to set off the device.

Jack felt near certain the killer or killers had taken out exactly the person they’d been after.

But that left one important question. Why not target her up at home? Once he got a good feel for this crime scene, Jack knew he had to drive to where she lived and compare the two locations.

He spent fifteen minutes sitting here, looking around, and in the back of his mind he started to connect this place, this bucolic suburban street, with the events in Jakarta several days earlier, and the event in Minsk, the shooting in Princeton, the arrest of the CIA officer in Iran, and the other horrible scenes he’d spent the last full day studying. It was hard to do. Other than the blackened asphalt and the missing mailbox, this Falls Church street didn’t look to be the front line of some sort of secret war being fought by an actor who had managed to pilfer information on the personal lives of America’s military and intelligence professionals.

He stepped on the brake pedal and pushed the automatic start on his 535i, firing the near-silent engine. He put his car in gear and rolled quietly out of the neighborhood without the police ever noticing he was there.

He arrived at the Vienna, Virginia, condo building of Barbara Pineda ten minutes later, and it didn’t take him long to come up with a theory as to why she wasn’t killed at this location. He followed an elderly man through the door to bypass the lock, then stepped into the lobby of the small building, and here he saw the mailboxes. They were small PO box — type affairs, with tiny slits in each to slip the mail in.

And there was his answer. Dead simple. The terrorists used a small package bomb, roughly half the size of a loaf of bread — and when they went to Pineda’s condo they realized they couldn’t get it into her mailbox. If they left a package for her at her front door, or at a table here by the mailboxes where packages were left for residents by postal workers, then there would be no way to see her retrieve it without standing here in the lobby.

Jack drove back to Alexandria knowing good and well that the key to discerning how Islamic State terrorists successfully targeted a DIA analyst was to figure out just how they found out about Barbara Pineda’s plans to pick up the mail at her friend’s house. When he learned how they came across this time-sensitive and particular piece of intel, then he would be a lot closer to understanding how the leak was connected to the attacks.

Thinking it over, he decided he himself would take the SF-86 that Gavin kept insisting was at the heart of the leak, and he would then try to use all the means at his disposal to turn that into targeting data that could have put a killer at the Falls Church mailbox yesterday before the bomb went off. As an analyst at The Campus, Jack had access to all sorts of classified databases that would help him track the path of this DIA worker. Hell, he could even get Gavin to find traffic camera footage of Pineda and her vehicle.

But no. Jack decided he wouldn’t use classified intel. He realized his mission here was to find out how the perpetrator targeted Pineda, and the perpetrator did not work at The Campus. He would use Barbara Pineda’s SF-86 form, and open-source intel, to see if he could build the picture that was used to send killers after her.

As he drove he thought this could be done. It occurred to him that there is so much out there these days about people in open source that a motivated and intelligent individual could take old SF-86 info and translate it into real-time targeting info. As he thought it over, it made more sense. If you knew a woman like Pineda was trying to get a security clearance ten years ago, then all you would need to do would be to thoroughly track her, her friends, family, and contacts through years of open-source hits, to get an idea of where she is now. From different factors you could figure out if she was in a clandestine position today, and perhaps you could make inferences from OSINT about her specific role in the intelligence or military structure. And then, once you’ve decided this woman was your enemy and hence your target, you could use other OSINT means to find out where she will be next Tuesday at noon. Jack thought the work would be slow and arduous, but if worked by a motivated person well trained in identity intelligence, even open-source data would give up the secrets that would make targeting possible.

He called Gavin Biery’s mobile phone while he drove.

“Biery.”

“Hey, it’s Jack. Quick question. Do we have a way to look at these SF-86 files you think are at the heart of this?”

“Sure. I am looking at the e-QIP data right now.”

“Really? You figured out how the attackers got in?”

“No. I have classified administrator access. I’m sure the hackers found a way to get the same thing, but I got it from NSA to do my own poking around.”

Jack said, “Can you send me the application on Barbara Pineda? I want to use it to see if I can do the same thing the bad guys did. To find my way to this mailbox in Falls Church.”

Gavin whistled softly. “Good idea, Ryan. Might give you an idea of the types of brains working on the other side of this fight. I knew there was a reason to keep you around.”

Jack wasn’t in the mood, but he joked anyway. “I thought I was just around to bring you your lunch.”

Gavin didn’t miss a beat. “Speaking of which, can you grab me a turkey on whole wheat on your way back?”

Jack smiled despite his dark disposition. “Your wish is my command.”