The dark all-terrain sport bike screeched to a stop on the curb and honked, shatter-resistant glass visor protruding up from above the flickering headlamp. Blue light crept over the rooftops. The orange street lamps reflected off the highly polished visor, sparkling crisply.
Viktor threw back the tinted part of his visor and gestured at the lit window above him. Erika waved down at him and he held up his hand, gunning the bike by twisting the right handlebar and maneuvering off the curb before opening up the throttle, slapping down his visor, tilting back into a wheelie and sending the bike in a crazy dash down the empty street.
From the room above, they heard the bike bellow into the distance before puttering back from the way it had gone and growling off. John had on his leather jacket and the same cargo khakis as before. The black sunglasses were tucked in his pocket and he’d transferred his cold weather items to his backpack. Apparently, they were going someplace chilly. He checked his digital wrist-watch. Behind him, his duffel bag lay on the floor as his backpack lay against it.
Katie was inventorying everything with a clipboard, recording in what bag everything was. Every once in a while, she scratched away what she had written with the detachable eraser and then flipped the pencil around again to continue her bookkeeping. In one bag there were maps. Lots and lots of maps. Electronic foreign language translators were in there too. In another compartment of the same bag were walkie-talkies, Garmins with color LCD screens and built in GPS antennas. John looked the bags over in more detail. There were several pouches containing who knew what. Out of one looped a black audio cord. There were Ricoh digital all-weather cameras with GPS capability, black, with yellow trigger buttons. CoreGear jackets that transformed into backpacks, a ruggedized handheld computer, with a nice, wide, color LCD display. And several yellow GPS hand units. All in designated locations. A Panasonic Toughbook sat folded in an open carrying case on the bed. He mouthed a swear when he saw it all. This was hardcore turtle gear.
Katie handed John a Marmot hiking pack which he opened slightly, only to mouth another swear. The bag was filled with bills. All varieties of colors, they appeared to be from multiple countries. The opening in the bag wasn’t large so he couldn’t see well, but the top ones looked French. He looked at Katie and then closed the bag and swung it over a shoulder. Bending down, he picked up his own bag and slung it over his other shoulder.
In another Marmot bag, there were several plastic bags with numerous first aid and safety items, such as magnesium flares. And the contents of the final two duffels appeared to be hiking and climbing gear. John couldn’t really see because someone turned off the light and they were walking down the hall, to the street. They walked behind the hostel a few blocks, Viktor looking on from his bike. They came to a stop at a grass embankment.
A few moments earlier, John had pointed out to Katie that she could never fly with such large sums of cash, to which she responded “that’s why we don’t.” Now, her insanity seemed complete. Because there, parked at a fifteen degree angle on the grass, covered in dew, were three vehicles. A black 2001 Peugeot 700, a white 1997 Volkswagen Jetta with wide, round rally lights on top, a silver and yellow 2003 Subaru Baja, and a 2008 Citroën C5. One of the cars went bweep! and its lights flashed.
“John, why don’t you ride with me,” Josh said. He headed for the Peugeot. They got into the car and John pulled his door shut, fighting gravity. Some rumblings came from behind them as luggage was loaded into the other cars.
When the Subaru, the last vehicle, was packed, Josh switched on his car and turned the wheel quickly, rolling off the embankment and onto the road. The other cars followed suit. And they were off. In a past life, the Peugeot was a luxury car and it still felt so, irregardless of Josh’s suspected manhandling. The four cars u-turned in the predawn light beside a length of trees and went up the road down which they had just walked, coming to a stop and turning right, bringing them behind Viktor, who turned in the glow of their headlamps. Adjusting himself on his seat, he throttled his engine up and took off, Josh accelerating hard to keep up.
The bike accelerated fast but eventually hit a steady speed and a moment later, the vibration of the Peugeot dissipated, leaving John in peace to soak in the quickly changing scenery.
“Where are we going exactly?” he asked Josh.
“We’re going towards the mountains. We need to drop off some information on the way and get a new tip.”
“Is it always like this?”
“Yeah. Never in the same place. But the same procedure.”
“I see,” John said. He thought for a moment. “Tell me, why do you guys bother with dead drops at all? I know you use Tor. Why expose yourselves physically?”
“Good question,” Josh said. “We only use the network to exchange tiny bits of information, usually just locations. Have you heard of steganography?”
“Encoding messages in other messages?”
“Exactly. That’s one way. Or, in our case, messages in files. Basically, we and our contacts encode text in an innocuous-seeming picture and then post that picture on a message board on the Darknet that gets dozens of pictures posted to it every day. And, because we’re paranoid, we only encode a tiny bit of information, so it’s very hard to detect.”
“Interesting,” John said. “How tiny are these messages you imprint?”
“One hundred twenty-four characters, each character’s ASCII value mapped onto the RGB color space in random pixels.”
John nodded, impressed. “That’s legit. It’s got to be a pain to download all those pictures though. And check each one to see if it has a message.”
“Nope,” Josh replied. “We actually have an extension that lets us download images en masse. Once we have them, we run them through a custom program that checks them all.”
“That’s awesome,” John exclaimed.
“Indeed,” Josh said. “André wrote the checker. Guy’s a legit genius. You’ll see soon enough.”
“Is all this really necessary though? All this tradecraft?”
Josh looked at him. “This way we’ll never find out.”
John nodded, looking at this strange person who was addressing him. Wondering who he really was. What maelstrom he was sweeping him into. He leaned back in his seat. “No surprises,” Josh exclaimed after a pause.
John echoed, noticing how different their accents sounded, “no surprises.”
Four hours later and roughly four thousand miles away, at Fort George G. Meade, Maryland, NTOC shift commander Joe Hansen was just about to take a sip from his coffee when his watch started beeping. He looked at the occasion alarm and looked at his coffee. Putting a lid on it, he slid an insulating ring around it, nodded at the aproned man behind the counter in the NSA coffee shop and jogged to the elevator.
Joe had a high IQ, about one forty-two, which put him squarely in the genius range. But he’d still managed to get a few beads of white liquid on his jacket and that distressed him as he waited for the elevator to arrive. When the doors opened, they did so with a pressurized whoosh that cooled his face. He stepped inside and paused from rubbing the stain with a napkin long enough to swipe his access card on the reader and select a floor. As the numbers on the wall chimed by, he quickly made the stain worse, then tried dabbing a little saliva on it to see if that would help, to no avail. He sighed, casting his eyes around the empty dark box. Same elevator as always, for better or worse. He felt deceleration. A final chime and the doors opened.
He walked down a long corridor. Brushed past a woman in a gray suit who was chatting with a female marine in uniform. The passageway was fairly minimalist. Another turn. Another long corridor. And then he came to the entrance to the NSA/CSS Threat Operations Center, NTOC. The entrance was dimly lit, two rows of round bulbs on the ceiling and two flags at the far end, one the flag of the United States, the other the flag of the NSA, the agency’s seal centered on a sky blue background. Beyond the entrance was a large room, superficially not unlike one of NASA’s Mission Control Centers. On the far wall was an array of large video screens. To the left of the screens was a cluster of bright red LED clocks, each showing the time at different locations: Zulu, Germany, etc. In the foreground were rows of computer stations, some manned by individuals in business attire, others by men and woman in military uniforms. The screens cast an eerie blue glow on the consoles and walls, but otherwise, the room, like the entrance, was quite dark. Joe imagined this wasn’t the job for seasonal affective disorder sufferers.
Reaching into his jacket, he took out his ID card and opened the door to one of the operations rooms overlooking the operations center. The ops room’s smart windows were set to opaque, making the room outside appear as if cloaked in dense fog. A conference table ran down the length of the room and there was a whiteboard on one of the walls. This room was brighter than the main room. Joe nodded to the only other person inside.
David Patel, his creative lieutenant, who was only twenty-six years old, was weary eyed and Joe knew it was too early for him. Feeling momentarily compassionate, he handed him his coffee.
“For me? Thank you!”
Joe nodded. “Don’t mention it. So what’ve you got for me this morning?”
“I have the data for the fifteen Quechua intrusions FBI sent us. Cross-correlations turned up nothing significant.” Rising from his chair, David directed Joe to a fat stack of papers clipped together on the table. Opening the stack to a page marked with a Post-it, near the end, David stood across the long conference table and gestured at a significant section of the spreadsheet with his pen -standard issue; someone had tried smuggling out info on a camera pen recently. Each cluster of lines described the time, target IP, target name, duration, and IP address of origin of a suspected computer intrusion attempt on various sites in the U.S. The spreadsheet entries then further elaborated with data on the operating system used, whether a proxy was believed to be employed, the Internet service provider of the attacker, the relevant domain, the institution or corporation to which the IP address was assigned, their physical address, the type of connection they had, their bandwidth usage for the last three months, the username and password they signed into their ISP with, and other relevant data. Joe slid his finger down the rest of the stack. So many pages.
It was hard to believe the ridiculous number of cyber attacks that were inflicted upon government and private assets in the United States, from at home and abroad, the majority of the latter originating from China. The conduit was the World Wide Web. The big danger was infrastructure. Powerplants, power grids, waste water treatment plants. Those things were incredibly vulnerable. There was really almost no expression for it that could have been accurately labeled as hyperbole. The honest-to-God truth was America was completely unprepared for an infrastructural cyber attack.
Combating this and other cyber threats were the FBI and NSA. FBI only had the jurisdiction to directly obtain Internet data from sources inside the United States, either in real-time or by accessing Internet service provider records. Those were the rules. That was why they coordinated with the NSA who could correlate records obtained by the FBI with NSA’s formidable cache of data, since it was now tasked with monitoring all government networks as well as the vast majority of internet communications that either originated from or terminated with a party internationally along with their related metadata, in coordination with Britain’s GCHQ, Australia’s ASD, New Zealand’s GCSB, Germany’s BND, and Canada’s CSE, among others.
Cooperation with the FBI hadn’t always been easy. He wasn’t a big fan of Bush Two, but he was pleased that starting under his administration, the agencies had begun cooperating more. Shortly after, under the auspices of the Obama administration, the job of ensuring the dissemination of cyber data among intelligence agencies was assigned to an organization managed by Homeland Security called the National Cybersecurity and Communications Integration Center. It had made organizing an arrangement with FBI to have them automatically forward raw intel to his agency much easier. There was less lag time so they were doing a better job of tracking offenders. At the same time, cyber attackers were getting craftier. After all, they weren’t stupid. For example, there had recently been a marked increase in the use of zombie computers, computers that were infected with a remotely controlled bot that directed them to carry out malicious activities, unbeknownst to their owners.
But aside from the usual traffic, the hits he and David were interested in, the peculiar ones FBI had begun sending them a few months ago, were unique in three main respects. Firstly, each utilized the same highly versatile malware to gain remote access to the target computer network, Trojan.Quechua, which had first been observed a year earlier infecting servers hosting databases for the Tibetan Government-in-exile. This and its limited use elsewhere potentially implied a Chinese origin to the intrusions. However, there was another wrinkle. These attacks weren’t coming from China. They were coming primarily from university campuses in Europe... The third characteristic of the attacks was that the vast majority were focused upon private infrastructure and municipal law enforcement and fire department computer networks. So who was launching them? Were they students? Professional programmers? And who were they answering to?
Joe read the printouts over for a few minutes. David handed him a map of Europe and Asia with dots denoting attack sources, orange for May first through fifteenth, purple for May sixteenth through June fourth. Joe noticed that David had avoided primary colors. He’d been trained to avoid biasing data. The number of infrastructure intrusions using Quechua between mid-May and early June was double the number from the first half of May. And most of the most recent intrusions were from the Czech Republic and Germany. Now why those two countries? He chewed his lip.
Each entry in the spreadsheet was the culmination of a long circuitous pipeline between the victims’ computers and this table. Constantly being modified to elude anti-malware heuristics, the malware was typically installed days before intrusion took place, and it wasn’t until a cyber security firm happened upon its signature, whenever that was, and updated customer anti-malware software, that the infection became detectable by the network administrator. When it was found, a copy of the malicious program was forwarded to the security firm who passed it on to Homeland Security’s Industrial Control Systems Cyber Emergency Response Team. They then carried out forensic analysis of the malware.
The malware’s timestamp told them when it was accessed by an attacker -assuming it hadn’t been deliberately altered- and this information was then given to the FBI. In the past, at this point, a subpoena was issued to the Internet service provider for the facility in question and the IP addresses with which the malware had exchanged data during the times of intrusion were determined. Finally, that information was passed on to NSA.
Today, things proceeded differently. These being intrusions with ramifications for national security, following analysis by the FBI, all information relating to the infection was passed directly onto the NSA. The agency then extracted the IP records from its vast archive of global Internet data housed in the Intelligence Community Comprehensive National Cybersecurity Initiative Data Center in Bluffdale, Utah. If the information wasn’t there, they made a request to the FBI Data Intercept Technology Unit that it instruct the relevant Internet service provider to provide the data from its own records, no warrant required, pursuant to Section 702 FAA of the FISA Amendments Act of 2008, the same act that authorized broad internet content and metadata collection so long as one of the parties communicating was international. Optimistically, this entire process took several days though that didn’t include the weeks that might have elapsed since the actual intrusion had occurred.
The next step was to contact law enforcement or intelligence agencies in the countries of interest and arrange for them to subpoena the Internet records from the campus in question. And it was here that the trail always dead-ended. This was because the attack sources invariably turned out to be guest Wi-Fi networks in dorms or libraries. It was the perfect no-win situation. More promising opportunities did arise, on occasion; for instance, someone might log into a McDonald’s Wi-Fi at a highway rest stop, where the ratio of cameras to hiding spots was higher. But these were comparatively rare.
He made a face which let David know he was frustrated for not being able to see the forest for the trees. Something was happening. He didn’t know what. He didn’t know who. But he was becoming increasingly worried. He reached over to the phone on the desk and called up the director of NTOC. They needed to bring Homeland Security and CIA into the loop.
The luxury car rolled to a stop at the edge of a field, a thin dusting of snow melting under its tires. It was mid afternoon and cloudy. In the distance, sublime white mountains stretched into the sky before becoming decapitated by clouds, byproducts of long duration orogeny. They were really something. Above them, snowflakes drifted very slowly, shearing against the windows. It was silent. A car door thumped from behind and Katie walked past them, her head hunched over. Joshua turned to John.
“Sit tight. I’ll be right back.” He opened the door, flooding the cabin with cold air, and slammed it shut. Total silence. The snow continued to fall steadily. The two young adults walked off towards the field. Painfully slowly, they dwindled from view. This didn’t seem very safe. John looked to the side at the trees. His hat rubbed noisily against the back of his seat and obscured his ability to hear. He peeled it off. Okay, he could hear a little better now.
The snow picked up. This seemed to be taking a long time. John looked behind him at the Citroën. The bike, Volkswagen, and Subaru weren’t here. Lucky blokes weren’t suicidal. A thought suddenly entered John’s mind. A question. He would have to ask Josh when he got back. He looked at Erika, alone in the Citroën. She was talking out loud. Communicating with someone. He watched her and she looked up at him. And continued talking. Checking his watch as a comfort reaction, he faced forward. The snow, meanwhile, continued to flurry. Two dark forms appeared. Josh and Katie were back.
Josh got back in the car, tossed a plastic bag in John’s lap and threw the car into reverse, executing a Y-turn and heading back in the direction from which they’d come. Looking over his headrest, the field bobbed in John’s view and receded. He looked down at the Ziploc bag. Inside it was another bag, and inside that was about thirty pages of typed material. John asked Joshua if he could open it and he said of course, he was part of the team now. John looked the stapled papers over. It looked like a dossier at first glance but was actually more than that. For a German man named Daniel Kiel.
There was a list of phone numbers, arranged alphabetically. Of different municipal agencies. There were newspaper clippings. Web printouts. And on one page, a man’s face. John supposed it was Kiel. He was regional manager of a company called Kation, headquartered in Berlin but with a factory in Dresden. Before long, John realized that what he was looking at was actually reporter’s notes. Fascinating. They were amazingly nonlinear but yet, seemed to be weaving towards something.
Okay, apparently, some people in rural areas neighboring Plzen, Czech Republic were complaining that air quality was falling precipitously and that people were getting cancer much more frequently than they had before. Kiel had a variety of connections with Czech officials and had gone on a number of business trips with members of the Czech government, though the contents of those meetings were not known. John guessed where this was going but read on.
The type of chemical processes Kation used were not publicized for proprietary reasons, nor was it known exactly what chemicals they used. The German analog of the Environmental Protection Agency, Umweltbundesamt, or Federal Environment Agency, had documents pertaining to those processes but they were protected.
John’s minimal background in environmental science had included an OSHA HAZWOPER course so he knew that if the German system was anything like the American one, companies would hire consultants from time to time to assess environmental compliance. Doing that of course would require a general knowledge of factory processes. He filed that little tidbit away and read on. Kation was located in several industrial parks around Germany and specialized in making finished metal products and manufacturing plastics. Set screws, screw drivers, bicycle wrenches. And it was a subsidiary of Siemens. Ok, so it was like a Pratt & Whitney to United Technologies or a Fluke to Danaher Corporation. Siemens was an uber umbrella corporation, he knew, but he wasn’t aware they worked with metals. He’d have to Wikipedia them later.
He flipped through more pages. Kation was acquired in 2008. And apparently, they were immediately a disappointment. Siemens seemed to be trying to get them up to snuff but their environmental record was bad and costing money. This data was obtained from an unnamed “source.” Sucky source, John thought, if he couldn’t even say what process they used… oh. Okay, yes he did; black oxide, which meant nothing to him. Grinding. And a list of chemicals they used. And boy was it a doozy. Many lubricants, acids, kerosene, raw metal, soap, water, strong bases... The list went on and on and on. And below that, a list of companies they purchased from: Bayer, Coelan, Gerolsteiner Brunnen, Karcher, Linde Group, to name a few.
Dresden was the company’s largest facility. The source claimed that they were transporting waste to The Czech Republic, without marking it properly, and had been doing so for about twenty months now, after a period of downsizing. The director seemed to know too. John wondered why they were doing it. Was it cheaper? He did know that mismarking chemical barrels was a major offense back home. In America, they had a system called cradle to the grave. You made it, you made sure there was a record of its travels for as long as it existed. Responsibility was therefore easy to assign. It was an innovation that had had its roots in the eco-disaster that was the 1970’s. Germany was a first world European country so John could only assume it operated along a similar paradigm.
So they were sending things someplace where it was cheaper to eliminate apparently, or where disposal rules were more lax. The people the reporter had interviewed claimed that incinerators at a waste disposal facility were putting out an odd smell, which had begun twenty-one months ago. And people were already starting to get things like leukemia, where there had been a low incidence before. Birth defects were going up too. He cringed at one of the descriptions. Babies born with severe mental retardation. Facial distortions.
Anyway, the reporter had connected the dots and concluded that someone in Kation was sending chemicals across the Czech border in trucks that were being emptied at a rural facility, where they were incinerated, which, if true, was extraordinarily immoral. And that was all the info. Everything else consisted of corroborating evidence. The reporter had everything except for concrete proof. That was where they would come in. The odd smell came on Saturdays. Today’s Wednesday. That gave them three days to prepare. It didn’t say who he was or what periodical he worked for. Creepy. John looked through the windscreen and glanced at the overhead thermometer. The temperature was going up.
There was a sparkle in his peripheral vision and he looked out the window at an approaching on-ramp. The other three vehicles were back.