by Kate Fazzini
They spread the news via a network of compromised journalists, who filed fake or exaggerated news stories to battle isolationist or neutral sentiments. In one case, they discovered that one of the political parties was taking donations from the Nazis. It’s unclear how effective their efforts were, but it’s likely the British had some influence on U.S. elections.
The truth is, every election, presidential or otherwise, is “interfered with” by some outside force. Every candidate has a series of nations behind him or her, loudly or quietly pushing for a win so that they can enjoy a relationship with the United States that furthers their goals.
There has been a series of changes in the past 20 years that has helped the Russians to be infinitely more capable than they were before. The first is a technically superior workforce of math wizards and computer hackers. What’s more, now the government is willing to let those people—criminals, intelligence officers, or a combination of the two—work off the books with other nations in an effort to weaken U.S. infrastructure. Nations like Iran and North Korea.
And now they have ample testing grounds. The United States has sold or deployed its technology to many places across the globe. The United States is far less concerned about cyberattacks against infrastructure in Brazil or Ukraine or Mexico. But it’s the same infrastructure.
The only way cybersecurity people get to be any good in this field is by doing the work. And for decades Russia has used the world as its lab.
Then there is the matter of shaky alliances. The ease of digital recruitment. Convincing government malcontents to give up their credentials is an art form that grows easier with the vast global exposure of the internet. But there’s one thing that will never change and that, paradoxically, is the very human proclivity to change one’s mind.
In Russia and other hotbeds of cybercrime, there is a long-established precedent that each individual employee, every government agent, each operative could wake up one morning with a sudden, irrevocable desire to pivot, to change directions, to switch sides.
* * *
René lies in bed, sick, feverish all over. She’s pregnant. She’s panicked, because she didn’t think she could get pregnant. She worries Sig won’t believe her. She checked the box of condoms he’d bought, which he says he has been using. But there is the box, unopened, shoved in a drawer in the bathroom, still in the bag from the drugstore.
Had he not been using them? She knows what he will say if she asks this question. He’ll say she was delusional. Crazy. There was no way to bring it up without being accused of always accusing him of things.
“I treat you like a queen and this is what I get in return.” His face will go from that pleasant mildness, that big, white smile, to teeth-baring rage in nothing flat. He will say she was seeing things, hearing things. “Maybe we need to get you to a psychologist?” he’ll spit at her.
By June, she’s figured out she is three months pregnant. She has been so busy, so distracted, that she hasn’t noticed the missed periods. It is Sig who notices she is looking bigger around month two. He rids the house of carbohydrates. Insists she eat a diet of lentils and small portions of skinless chicken. She’s hungry all the time, and now she knows why.
So she waits for him to come home. He said he was going to Bucharest to meet a business contact. Or was it an old friend? A cousin? She can’t remember. It is all so mysterious; he is always so mysterious about where he is going and what he is doing.
He will be home late, past midnight. She hopes he isn’t in the mood for sex when he gets home. She can’t sleep because now that she knows she is pregnant, she can think of nothing else.
She fantasizes about going somewhere nicer than Romania, someplace really far away. In her wilder fantasies she escapes to England, America, the Caribbean. She imagines cashing it all in, her and Sig on a nice, warm island somewhere. Then maybe the old Sig would come back.
She is the girl who made those saucy phone calls to technology executives. Who shut down their advances with a crisp, cutting word or two. Tastes like chicken, ha, ha, ha. Now she is reduced to slicing and dicing her own internal monologue, for an audience of one. Well, technically, now two people. A baby. She can hardly believe it’s real.
She stares at the ceiling, rubs her jaw. She has been reading a medical website’s recommendations for jaw pain. She has ruled out many of the reasons for it—no tooth problems, no loose fillings or flu. The medical site has suggested a strange reason for it, one she hadn’t expected: anger. Unresolved anger.
She ruminates on that point for a little bit. Anger, yes, anger. A strange feeling.
14.
The Mother
The data isn’t gone. It’s just locked. Bo Chou is slightly panicked. He is the victim of ransomware, and his files are locked. Held captive. His beautiful data. He has half an hour to respond to the criminals who have attacked him. First the spy from Senegal, and now this. Lie down with dogs, get fleas, he thinks. It’s too much.
The ransomware in question is called CryptoLocker, and he’s done all the quick research he can on what it is, how to remediate it.
This isn’t the same type of ransomware TechSolu uses, but an older, more rudimentary version. A more brutal type. Bo won’t encounter any soft-spoken customer service representatives here. It’s the automated call center version of TechSolu’s full-service business.
Bo has gigabytes of research at stake. The criminals pitching him are Russian, it seems, or maybe even North Korean? It’s difficult to tell through all the automation. They want $500, or the equivalent of that in Bitcoin. Bo is grateful that he has a little bit of cryptocurrency, enough to make the payment. He is ready to wire the money by smartphone, but pauses for a minute to contemplate what he’s doing.
It’s Halloween in Shanghai, 2015. The city has adopted the American holiday with a little too much enthusiasm, and people are screaming their heads off outside Bo’s apartment window.
What Bo is experiencing is something on the brink of taking off, of turning into a global phenomenon. More sophisticated, smaller organizations like TechSolu have already pivoted to cyber-extortion: demanding bribes to bury damaging information, often for much higher figures. Automated ransomware is the latest trend because it can be spread virally and across many machines at once before being discovered. It’s the Walmart of cyberattacks.
There’s tons of ambiguity involved. It’s rarely clear if the ransomers have access to the files they steal. Even some of the criminals don’t always know what they have, but it’s likely they are dealing with too many compromised files and machines to find out.
Bo is worried they have not only locked up his files but have downloaded them, as well. Losing the data would be devastating for his business. He kicks himself for not updating his damn laptop. He didn’t want to take five minutes out of his day to do it, as if he didn’t know better. It’s unlikely that they have his data files, but he’s not quite sure how CryptoLocker works, and even the information he can find about it on private forums is unclear.
Bo, stuck in his technological ways, never migrated his database to a cloud server—meaning all of the data exists on his laptop, stored locally. Years ago he had made a habit of backing up his data on a separate hard drive, but he grew lazy and stopped. This means all of his files are inaccessible unless he pays the ransom, gets the decryption key, and is able to open them back up.
Perhaps it is fortuitous, he thinks. He’s been wanting to start fresh again. Maybe he shouldn’t pay the ransom. Maybe he should leave those files locked up. Maybe he should stick to his hotel job. Maybe he should live a nice, clean life, find a nice girl or guy to settle down with.
Or he can pay the ransom, keep the data, and go completely in the opposite direction. There is an underground group he frequents on the dark web that’s been discussing a lucrative scam involving just the kind of data he has been able to collect from his USB stick malware.
It works like this: Bo collects proprietary information strategically f
rom selected, specific law firms, banks, or consulting firms. The information is about publicly traded companies and is nonpublic. In other words, information that could influence the company’s stock price.
That information could include poor test results for a cancer drug if it’s a pharmaceutical company or news that a big account had fallen through if it’s a consulting firm. Other criminals in the group then put spyware designed to read keystrokes or observe the target through computer webcams to determine when the news is going to be released.
Then the group buys and sells stocks in anticipation of the news. And they almost always win. They are raking in millions in the stock market, way more than the pocket change Bo was making on Fiverr.
Then there’s the craziest option of them all: Bo leaves the life of crime and gets a legitimate job. He has received some interest from an American company with offices in Singapore. The role would be in big data and analytics. The offer had come from one of his Fiverr clients, a frequent flier. The guy is an executive who runs a small business unit covering southern Asia. He is impressed with Bo’s ability to gather such intricate knowledge about certain companies. The executive has no reason to disbelieve Bo’s story, that the information is all gleaned legitimately.
Bo could get a visa to Singapore, a luxurious and exciting nation, even more exciting, perhaps, than Shanghai. But he’d have to give up his data collection activities and change his lifestyle entirely. An American company wouldn’t tolerate his data harvesting, and he couldn’t risk getting on the wrong side of Singapore’s legal system. He’d probably have to live in fear of all the risky stuff he’d done.
He stares at the computer screen. It looks like this:
Outside, the crowd is getting louder. Drums and music have started up. He realizes 10 more minutes have gone by. He now has only a little over an hour to decide, before all his data is destroyed. He notices a voicemail on his phone. Doesn’t recognize the number.
He puts the phone on speaker and nearly falls out of his chair. It’s his mother. He doesn’t even know how she got this phone number. It’s been nearly a year since he’s heard her voice. She is firm, as always, but there’s a bit more emotion there. Dad has been sick with the flu, she says. They’re so grateful for the money that he sent them six months ago. She misses him.
* * *
Bo’s mother is from Kashgar in the far west of China, close to Nepal. She is a Buddhist. She clings to tradition. She tried to shape him into someone just like her—hardworking and satisfied with a dull but safe life—but she did not succeed.
Kashgar was once a critical trading post on the Silk Road. Bo enjoys reading about its history. It was one of the things that attracted him to the dark web, when an illicit marketplace by the same name rose to prominence there.
The Silk Road was an integral route for trading between China, Korea, Japan, India, Iran, Europe, the Arab world, and the African continent.
It wasn’t only silk that was traded. Islamic and Christian teachings made their way across various parts of the world through this route. Art, literature, and philosophy spread, as well, alongside cultural traditions, languages, and cuisine.
When Bo was young, his mother would tell him tall tales about the original Silk Road. It was a rare show of warmth on her part and one of his better childhood memories. One of his favorite tales was about the tradition of sand mandalas: elaborate, colorful sand sculptures made by Buddhist monks that, once completed, were destroyed in a religious ceremony.
She would tell him of the shocked looks on the faces of Arabs and Jews and Europeans after witnessing this sight on their travels through Kashgar. She acted as if she had been there. He would laugh at the foreigners’ surprise as the monks blew the sand away. All that work, all those beautiful designs—gone.
This is the high school textbook version, of course. Kashgar’s ancient trading post saw far darker exchanges than feel-good stories like the ones his mother used to tell him. Slaves were brought thousands of miles and traded along the route. Concubines captured by Vikings were sold in Dublin and young men captured by the Turks were sold to fight wars across the Ottoman Empire. The Silk Road was a prime route for carrying viruses and bacteria—including Yersinia pestis, the Black Death.
The dark web Silk Road was, by contrast, mostly remembered for its pestilence. Founded in 2011, it served as a vending point for drugs and firearms. It also was ground zero for a certain brand of libertarian idealism characteristic of its founder, an American computer programmer named Ross Ulbricht.
Ulbricht, who is currently serving two life sentences for drug trafficking and other crimes that were perpetrated on the digital Silk Road, created the space as a kind of freethinking exercise.
The Silk Road was accessed, like most dark websites, by using a virtual private network and downloading a specific browser. Designing the browser took computer programming skills that Bo admired but did not himself possess. Learning about the massive global marketplace for cybercrime and falling in love with it, however, was just as addicting as Facebook.
* * *
Sixty minutes have passed.
Sand mandalas. The impermanence of love and hate. The way the past reaches into the future. Bo’s imagination has roamed the space between here and there, good and bad, white and black.
Now he has 10 minutes before the ransomware eats his past five years of hard labor. He opens the email from the American company’s Singapore office and reads it again. It’s not a hard offer. It’s not a certainty. Three minutes. He reviews the chat history with the insider traders who want him to join.
One minute.
He closes his laptop. Throws it into a plastic bag. Ties it up. Smashes the bag with a hammer. He throws it in the garbage, presenting his data to the wind like a monk’s sacrifice.
He composes a note to the executive in Singapore expressing his great interest in the opportunity. Next, he does something that he hadn’t even contemplated 72 minutes ago.
Bo Chou calls his mother.
15.
The Ghost
Victor Tanninberg is having lunch with his journalist friend. It is early November 2015, and he hasn’t been outside his house in what seems like a year.
She has hundreds of questions for him. Especially about the upcoming election. She’s been getting lots of weird chatter about hacker activity during the 2015 primaries. And she wants to hear about the cars he’s been working on, about hacking in general.
“I’m not a hacker,” he insists, over and over again. “Yes, I have a Russian background, but I don’t know what the Russians are up to—that’s ridiculous.”
They have burgers at a pub. They drink beer. He shows off pictures of his kid.
In the end, he admits, leaving his house wasn’t too terrible. He has had what most people call “fun.” He might even do it again sometime.
* * *
It’s a quiet day in Helsinki. Dieter Reichlin has finished reading The Girl with the Dragon Tattoo for the second time. The book, which is ostensibly about a slim, angry hacker named Lisbeth Salander, makes frequent references to the various types of sandwiches—tomato and mozzarella, egg salad—eaten in Scandinavia.
The first time he read it, he was left with an unstoppable hunger for egg salad sandwiches. In anticipation of his finishing the book a second time, Dieter’s wife has mixed up a big bowl of egg salad. He sits, now, in his underwear at the breakfast table, eating egg salad right out of the bowl and watching Sig Himelman try to pick up women on Craigslist 1,700 miles away.
It is not what he’d expected. TechSolu or whatever Sig calls that place was a tiny criminal speck, but one that appeared to have been operating efficiently.
Dieter is interested in seeing if Sig will try the ATM cash-out scheme. At first, Dieter was sure he would, but Sig’s crack operation seems to be fraying at the edges. After watching the litany of flattering, saccharine messages to girls across Romania, he wonders if Sig even has time to work at all.
One
event flagged his attention. Directly after their meeting in the Helsinki airport, Sig opened a new bank account at Arnica Valka’s branch of Banca Transilvania on his laptop.
He did it using the identity of a young woman. It appeared to be a stolen identity, someone named René Kreutz, with an address in a suburb of the city.
It was the only inkling that Sig would branch out into this new scam, and then it was gone. Otherwise, besides the Craigslist solicitations, Sig remains balls deep in cyber-extortion. It isn’t clear who the victims are, but the payments—usually in the five- to six-figure range—keep rolling in.
It caused Dieter to rethink how he viewed his former rival.
Dieter had long viewed their relationship as a meeting of equals and opposites. Black and white. Good, simple Dieter and bad, complicated Sig.
This was changing things. Reading Sig’s messages, the flowery language, the grasping at straws with women he doesn’t know, dispels the illusion of a cool and confident criminal mastermind.
He had imagined Sig as a powerful executive with an army of underlings, or “employees,” as Sig would call them. In this reckoning, Dieter had pictured someone who comes across as a legitimate boss, making his charges feel better about the bad things they are doing, the risks they are taking. Through the handful of exchanges he can see on Sig’s laptop, however, he detects someone who is not in complete control, a personality that is deteriorating.
Dieter had fantasized about the incredible white paper he could write about Sig. Tracking the criminal element, offering a detailed look at how a cybercriminal operates, getting inside his head.
Now he isn’t so sure. As with many types of spyware, Dieter’s visibility is myopic. He can see only one piece of the puzzle, and it’s getting him nowhere.
He has some view into Sig’s transactions and his keystrokes, but it is difficult to connect the dots. Dieter hates spyware. Even the type that can co-opt webcams offer limited visibility. You can only see a single subject—if it’s a camera on somebody’s computer—or a stationary space, watching people walk in and out of a building. Unlike Lisbeth Salander, who could in her fictional world seemingly monitor everything about everyone simultaneously from an old Nokia smartphone. He laughs to himself, then frowns.