Jenn threw up her arms and shrugged. It was up to him.
McKenzie detested May’s corn-pone Maryland accent. How many real people still talked like that, anyway? Except, of course, on yahoo radio. Tim May was a former sheriff, a respected arson inspector, and sometime pastor of a local countryside church. His co-host, Frank Mitchell, masqueraded as a lieder-hosen, garlic-raising, leftover hippy vegetarian and city-dweller, but McKenzie was sure that was just a pose. They were the local version of Hannity and Colmes, with Hannity ever dominant and his left-wing man an apparent pushover.
“You’re on Mid-Maryland Live from the Great Frederick Fair, with Congressman Hugh McKenzie. Boy, have I got some questions for you, Congressman.”
“I’m sure you do, Tim. But maybe we should just take calls from your listeners. What do you say?”
May was surprisingly polite to him for the first ten minutes and apologized several times for not having him on sooner. He allowed him to talk uninterrupted about Medicare-For-All and the rest of his legislative agenda.
“I gotta ask you, Congressman, what you think of our president, Donald Trump. Now I don’t gotta remin’ you, we’re on live radio, so keep it clean!”
McKenzie harrumphed, his version of a laugh. “Well, you know, Tim, I’m no fan of the president. But I’ve got to give our listeners some hope. I am convinced he’s going down on November 3rd.”
“Whoa now, pardner. What makes you think that? All the polls have been tightening, and if 2016 is any measure, he’s gonna come back and win big time, uh-huh, uh-huh. Whaddya say to that, Frank?”
“Let’s listen to the Congressman, Tim. He’s our guest, not me.”
“Oh yea, that’s right. Well, Congressman. Take it away!”
“I think history teaches us to be very wary of the polls, Tim. Take my own district. My opponent would appear to be leading in the polls, but my internal polling suggests that is not the case.”
Tim May actually winked. “So give us the scoop, Congressman. What do your polls show?”
“They show us winning by a healthy margin. In fact, I’d say they show us winning pretty close to what the historical averages of this district show.”
“Folks, you just heard it from the horse’s rear—sorry, the horse’s mouth,” May said, stifling a guffaw. “Sorry about that, Congressman. Old habits die hard. I was just thinkin’a my ole’ buddy ‘ere, Frank. No offense intended.”
“And none taken, Tim.”
When they got back into the Suburban, McKenzie kicked the front seat. “Damn, why did I have to say that?” he said.
“He was goading you,” Jenn said. “Nobody is going to take that seriously. Besides, nobody really listens to WFMD anyway. It’s just barely covers Frederick, Carroll and Washington Counties. And the northern tip of Montgomery, mostly Republicans anyway.”
After Frederick, Takoma Park was a relief. This was the beating blue heart of his blue district, where Democrats out-registered Republicans ten to one. Takoma Park was known as the first American community to declare itself a nuclear-free zone. To reduce their carbon footprint, they had banned cars from downtown and sponsored communal truck gardens for residents who didn’t have their own yards. Since almost everyone owned lavishly restored Victorian houses or upgraded post-war bungalows, the truck gardens became the communal weed patch.
The street fair was preceded by the LGBTQ pride parade. McKenzie had his volunteers marched in front of the 1968 yellow Mustang convertible loaned by a supporter, carrying campaign banners and tossing out rainbow-colored candies. He waved from the back seat and got sunburned.
Later, at the Democratic Party booth, he spied Aguilar walking through the crowd. Pretty gutsy for him to wander around here where there’s not a Republican in sight, he thought.
“Say, isn’t that what’s-his-name, the liberal commentator on Fox News?” he asked Jenn.
“José Gonzales.”
“Yeah, him. Look.”
Gonzales was talking with Aguilar, arm wrapped around his shoulder, as if they were best buddies.
“We need a fly on the wall for that conversation,” McKenzie smirked.
Jenn instructed one of their paid volunteers to doff his campaign t-shirt, join the crowd that had formed around the pair, and bring back cell phone video.
“So what were they saying?” she asked, when he came back a few minutes later.
The volunteer had only caught the end of the conversation but remarked that the two were pretty friendly.
“Yeah, we saw that,” McKenzie said.
“So, Gonzales was saying, ‘Nobody’s ever asked me that before.’”
“Asked him what?”
“Aguilar asked for his vote,” the volunteer said.
McKenzie felt the heat rise to his checks. Then he shook it off.
“We’re all forgetting something,” he said. “Those two have been pals for years. Remember all those faux debates on Fox? Gonzales is a closet Republican. Everybody knows that.”
The Wednesday before Election Day, McKenzie made a tour of the early voting sites. The plan was to mingle with voters as they waited in line, Jenn by his side, with campaign volunteers handing out palm cards before the voters reached him. Jenn had him ignore the voters who dumped the cards. He spotted many faces he recognized from campaign rallies, union members, CASA de Maryland volunteers, and an imam from the Georgia Avenue mosque.
“I’m Congressman Hugh McKenzie, and I’m asking for your vote,” he said, going up to strangers Jenn pointed out. “I’m here to represent you, not the millionaires and the billionaires.”
They were at the Silver Spring Civic Building downtown, and the lines—even at mid-day—wound back several hundred feet across Veterans Place. He was astonished not just at the crowds, but their composition. There was hardly an Anglo face anywhere. These voters were Hispanic, Black African, Caribbean, Asian, Middle-Eastern, and who knows what strange mixes of peoples. This is not the Maryland I grew up in, he thought. But these are my people now. My opponent and his president want to send them back to where they came from—as if they had someplace to go. Most of them shook his hand politely. Some did a double-take, looking at his face, then at his palm card, then back at him, and bursting out, “Oh my gosh, it’s you!”
“Some people say it’s JFK, Jr. You know, John-John?”
“No, no. It’s you!”
“Yeah, I guess we look alike,” he joked. “I’m Congressman Hugh McKenzie, and I’m hoping you will remember to vote for me when you get inside.”
And then, in the distance, he heard the rattling of marimbas and the trill of Mexican trumpets, and he groaned.
“Here he comes,” he said to Jenn.
They tried to back away from the line of voters, but a crowd pressed into them from behind, swaying and stomping and cat-calling to the mariachi band of Nelson Aguilar pouring in from a nearby street. McKenzie and Jenn were at the bottom of the square and could clearly make out his nemesis over the heads of the crowd, shaking hands, blowing kisses, dancing arm in arm with teenagers, followed by a half-dozen television crews. He was a rock star and everyone seemed to know him, and if they didn’t, they wanted to. Someone thrust a campaign poster toward him, and he autographed it with a big black marker. A middle-aged woman extended her bare forearm, and he autographed that, too. The crowd began chanting, “Aguilar! Aguilar!”
“Time to make ourselves small,” Jenn said.
We already are, McKenzie thought.
20
At midnight, the security shift changed at the Civic Building. A half hour after the new man came on duty, he left the control room with its banks of closed circuit TV monitors and went to the break room to brew a pot of coffee. He did this every night, and after sipping an initial cup, put the coffee in a thermos and brought it back with him for the late-night vigil. It normally took him ten minutes—fifteen,
at the most, if he took his time in the rest room or stopped to read the latest Department of Labor or OSHA poster informing him of his rights.
Tonight was no different. The longest hours were those between two and five AM, after the revelers went home and there wasn’t a sound in the neighborhood except for the occasional police siren whomping up Georgia Avenue after some speeder. He needed enough coffee to make it through the dead hours, so habitually he brewed a large pot.
At exactly 12:32 AM, a man wearing what appeared to be an official Montgomery County Board of Elections badge emerged from a storeroom, went into the control room, opened a metal panel, and fiddled with some wires from a small device he withdrew from his jacket pocket. At 12:34, he unlocked the door to the media center and walked halfway down the row of voting machines. Each machine was a squat box—a desktop computer, in fact—elevated from the floor on four metal legs. The touch screen voting module was secured person-high on top of the computer, with a curtain that could be pulled around it to give the voter privacy. Standing at the rear of the machine, obscured by the curtain, the man fished a squat metal key from a pocket and inserted it into the rear door of the computer. He gave a quarter turn to the left and the simple swivel lock released, allowing him to fold down the door.
At 12:35, he inserted a USB stick into a slot and turned on the computer. Forty-five seconds later, he shut down the computer, put the USB stick back in his pocket, and relocked the computer door. At 12:36, he closed the door of the media room behind him and started walking toward the service entrance at the rear of the building by the garbage cans. At 12:37, he emerged onto the dark street, looked around him, and gently pulled the door closed behind him. In less than a minute, he made it around the corner to where he had parked his car in a legal parking spot hours earlier.
When the night watchman returned to his post four minutes later, he set his thermos and coffee mug on the desk and noticed the four blank screens in the bank of closed circuit TV monitors. He banged on the metal housing, but they didn’t flicker. He tried turning them on and off, but that had no effect, either. Finally, he went to the breaker panel by the door and noticed that two of the breakers had tripped. He flipped them off and then on and the screens behind him lit up. Musta been a power surge, he muttered. And not even a storm!
21
At fourteen years old, Brady Aguilar had transformed his bedroom into a video arcade. Atop a spare curved desk, he had positioned two 25” G-sync gaming monitors powered by a Ryzen 5 3600 CPU on a Prime B450M-A motherboard, installed by his own anxious hands in a P400S box. The Ryzen chip set had six cores, clocked in at 4.2 gigahertz, and could accommodate up to 64 Gigs of DDR4 memory. It was one of the most powerful gaming systems you could buy—at least, with his limited budget. With the monitors, 500 gigs of SSD flash storage, a GeForce RTX 2060 video card, and a 1 Terabyte hard drive, it had cost him just over $1,050, money squirreled away from lawn chores and snow shoveling.
When he finished his homework early, or during late summer afternoons, he would close the blackout curtains over the windows behind the monitors. But with the days shortening now at the end of October, he could turn from his virtual universe and gaze at the squirrels jumping branches in the giant walnut tree in the backyard to come down to earth. His favorites these days were Grand Auto Theft V for the action and Elder Scrolls V to enchant his mind.
But Brady wasn’t just a gamer. He used the second monitor for more serious pursuits, and that’s what he was doing tonight. He was the main IT guy for his dad’s congressional campaign, responsible for the campaign website, their social media, and their email accounts. His screen name was abuelo. Only AB, his dad, and the Crocodile knew his true identity. He wanted the volunteers to think he was an adult—maybe even a much older adult they could spoof, if such was their intention. He had played enough Dark Souls 3 to be wary of people pretending to be someone they were not. Infiltrators could be anywhere or everywhere.
He was checking the logs when he noticed that someone had been sending identical emails to a dozen different volunteers. When he opened the source code, he saw that the sender had spoofed a seemingly ordinary dot com address in the U.S., but that the underlying IP address was someplace in Russia. The email had the subject line, “Campaign tracker” and purported to offer a free of charge service that allowed users to track how their campaign was rated on various social media sites. Two campaign volunteers had apparently clicked on the link.
“Dad!” he said later that night when his father returned home to make dinner. “We’ve been hacked!”
“What do you mean hacked? Who? How?”
“Someone has been sending spear-phishing emails to campaign volunteers to get them to click on a malicious link. That someone stole their credentials to log onto our system and install a Gh0st RAT. That’s a form of malware, a Trojan horse that piggy-backs onto normal system processes so you can’t detect it. Then it steals your connection and communicates remotely with whoever injected it, all the while you’re surfing the internet or whatever.”
Aguilar raised his eyebrows. “You got me, chico,” he said. “What does that mean in normal speak?”
“It means we have a serious security breach of the campaign’s computers. Theoretically, the intruder could do any number of things—deface the campaign website, publish fake tweets or Facebook posts in your name. Or even get access to the campaign bank accounts. They basically have access to everything.”
The next morning, the Thursday before the election, Aguilar raised the issue with AB and the Crocodile.
“This is bad, boss,” the Crocodile said. “You should take it to the FBI. They could do a Hillary on us.”
“What do you mean?”
“Steal somebody’s emails. Publish them. Embarrass us.”
“Have you put embarrassing information in your emails?” Aguilar shook his finger at him. “Naughty, naughty!”
“It’s serious, boss. Look at how McKenzie exploited that idiot from the restaurant association and his campaign check. They could take anything and twist it to make it look nefarious. They could steal our media plan.”
Annie had a different idea.
“I know an IT guy I can take this to,” she said. “If he thinks it’s serious, he’ll know whom we should approach at the FBI.”
The Crocodile cocked an eyebrow at her. “How’s that?” he said.
“He works for the State Board of Elections. In fact, he manages the tech side for all of the state’s 19,000 electronic voting machines. He works with the manufacturer when they install software updates, and makes sure that all the counties properly train precinct workers. And he handles security.”
“Is this just a guy?” the Crocodile said.
Annie’s cheeks reddened slightly, but she said nothing.
“So, it’s more than just a guy.”
“Ken, leave her alone. It doesn’t matter who it is,” Aguilar said. “I think we should be happy for his help.”
22
After Annie’s phone call that morning, Gordon Utz decided to run a security check on the voter registration database. As he was going through the access logs, it leapt out at him: Someone was attempting a brute force attack. The same IP address was trying repeatedly to log onto the system, apparently without success. They were probably using Hashcat, Forge, RainbowCrack, or John the Ripper. These were popular brute forcing tools that allowed a would-be intruder to try millions of password combinations using rainbow tables, a kind of password dictionary of pre-computed hashes of plaintext words and character sets. This greatly reduced the access time needed to penetrate the system and could crack passwords up to fourteen characters in length in less than a minute.
Gordon smiled to himself: He was better than the hackers. He had added “salt” to his cryptographic hashing routine, random characters that were not visible to users but frustrated most rainbow table hackers. It was kind o
f like spelling your name and adding 71B9 (or any similar combination of letters and numbers) at the beginning or end of it in hidden text.
Whoever was attempting to penetrate the database was also spoofing their IP address. It looked like the attack originated from the Washington, DC, area, but as he traced it back, he saw that it resolved to a server located in the Russian Federation.
“Even the Russian address could be a spoof,” he told Lisa Rasmussen, the state supervisor of elections. She was an appointed official who had been in office for over twenty years. When she had started working in Annapolis they still used printed voter rolls and punch card voting machines, but she prided herself on keeping up with the technology—if not herself, at least by hiring brilliant geeks like Gordon Utz.
“I’ve never been a believer in Russian hacker paranoia,” she said. “Maybe it’s just a bunch of kids in some basement somewhere. Did they get in?”
“Not that I can see,” Gordon said.
“What else do we have on that server?”
“There’s an FTP folder with the training manuals for the voting machines. We need to make it accessible to all the precinct captains for training.”
“Can you give it another layer of protection?”
“You bet. But I still think we should go to the FBI.”
Gordon drove up Route 50 from Annapolis against the early rush hour traffic and made it to the FBI’s Washington Field Office across from the national architectural museum by 4:00 PM. He had requested to meet with Jim Clairborne, the deputy chief of Cyber Division tasked with election security.
Since the alleged Russian breach of the DNC in 2016, the FBI had beefed up its election security operation to where they now had dozens of agents whose main job was to hold the hands of election officials around the country. They set up public websites to announce cybersecurity training programs and best practices and made it look like they were taking the threat of election hacking seriously. They had a nationwide database called ERIC that allowed election officials to match voter rolls across states to identify voter fraud, but fewer than half the states had signed up. In truth, Election Security was not a happy place to work. Most of the agents assigned there felt they had been sidelined from the real work of the FBI. They should have been out cruising in unmarked Ford Fusions, meeting confidential informants in fancy hotels.
The Election Heist Page 9