by Jack Davis
“Thanks Myron.”
“Let me talk to Mr. Lopez and make sure he’s okay with this.”
“I’ll get you the paperwork and try to get before Nelson this afternoon. Will that work for you,” asked Carpenter.
“I would think so,” replied Dunn.
Dunn turned back to the interview room. Before entering, he spun around and said, “This deal is contingent upon the two of you being personally responsible for the case. If it is reassigned or handed over to another agency, we have the right to reevaluate.”
“Understood and agreed. I’ll have the paperwork written up with that stipulation.”
Dunn entered the interview room where his daughter and Kruzerski had been with the defendants. Through her, Dunn explained what had been proposed. Alvaro agreed immediately.
There was a knock on the door. Morley announced the group had been cleared through Customs under assumed names and that they needed to leave.
38 | The Hack-Back
Brooklyn, New York, 10/02/09, 1312 hours
Swann, Greere, Murray, and Morley arrived at the office in one car, while the others along with the Dunns came in a van. Morley had called Kensington to have personnel at the loading dock entrance ready to receive the “guests” He had also asked that she not inform Brown until he had a chance to get things squared away.
“Oh, don’t worry about Tommy,” said Kensington, “he’s still out to lunch with the battalion of brass that came up from headquarters to interview you.”
“I guess Tommy’s good for something,” replied Morley.
Back in the office, Kruzerski and Murray started processing Alvaro.
Maria was taken to another room, where she placed a phone call to her mother, who was watching the children. Posada and Pencala were careful to give Maria an excuse to make the call short, fearing if she talked too long, she might say something she shouldn’t. She was told to act natural and ask about the kids. Then she said she had to run but that Alvaro needed his computer turned on.
Swann and Greere went to the lab to get the equipment ready for the contact with MichaelTAA. The plan was for Swann to hack back through Alvaro’s machine in Mexico and use that machine to access the WoW site. In that way, to anyone monitoring the inbound connection everything would appear normal. It would be originating from Alvaro’s home ISP and from his MAC address. Swann and Greere were confident no one on the other end would be able to discern that anything was different. They never got the chance to test their theory.
Swann knew something was wrong the minute he tried to unlock the screen on Miguel’s machine. It was the machine he’d been using to monitor Alvaro’s computer, and he had left it on during the trip to the Bahamas. While the light on the machine and the monitor indicated that they were receiving power and on, he couldn’t get any response. He tried everything but was unable to get the monitor working. Next, he went and got a different monitor to see if that was the problem. When he connected it to the machine and powered it up, it started the sync-up process, then it died too. Swann now knew there was something very wrong, and it had nothing to do with the monitor.
After calling Greere the two started to attack the problem. Three and a half hours later the two were in Morley’s office along with Kruzerski, Murray, Pencala, and Posada.
Morley started as the last of the group walked through the door. “First of all, I want you to make time for the guys from Inspection. The sooner they interview all of you, the sooner they’ll leave.” Morley saw the pained looks and rolled eyes, so he added, “Make it happen,” before he got down to business. “What do you have for me to feed HQ today?”
Greere led off, “You want the good news or the bad news?”
“Good news outta you guys would be a first, why not start with that for a change?”
Greere looked at Kruzerski and nodded.
“Well, Lionel and I,” Kruzerski paused and gave a sideways glance at Greere. “Lionel and I ran the numbers Lopez gave Miguel. They’re from the pharmaceutical hack, but the specific number we’re looking for isn’t in the bunch.”
Morley asked, “Have you been monitoring all the numbers to see if any of the others are being used?”
“We’ve been working with the banks and the credit card companies on that,” said Greere. “We only have one other Service case that involves these numbers, and it’s out of San Jose. Lionel and I talked to the case agent, but he doesn’t have any firm idea on where the numbers are being distributed. He thinks it’s some local group of script kiddies working out of San Jose State. He has a line on one of them, and thinks he’ll know something within a few weeks.”
“Good, if he can get something back this week, that’d be helpful. Make sure he knows that.”
“Will do.”
“Okay, so in the good news pile you lead with the fact this case is connected with a case we know almost nothing about. What’s your highlight? Warrants for your arrest related to the bar fight aren’t in the Interpol system yet?”
Swann chimed in, “Wow, three federal arrests in a little over a week, all of us working nine straight days without a day off, we’ve probably identified the source of a major network intrusion, and we’re setting up a sting of that source, and this is the thanks we get? Whoa, hold off on all the accolades, it’ll go to our heads.” They all laughed.
Morley shot back. “Perspective is a funny thing. From where I’m sitting, you arrested one borderline juvenile, one illegal who got me shot, brought us to the brink of war with a tiny island paradise, and now has me mothering a gangbanger and his wife…who it doesn’t look like we’re gonna be able to prosecute. To top it off, I still don’t have the numbers or the person responsible for taking them. I guess I’m just not sure where exactly I should be heaping the praise.”
“You always have been a ‘glass half-full’ guy,” said Swann.
Greere turned to Morley. “Yeah, how ’bout a little less stick and a little more carrot there, boss?”
Morley grinned as he looked at Kruzerski and asked, “I’m sorry, I didn’t mean to interrupt. What’s the bad news?”
This brought another laugh from the whole group.
“Keith has that.”
“I should have guessed it would be Doc,” said Morley as he shifted his gaze to Swann.
“As always, I was multitasking while I was in the Bahamas. You’ll see that on my T&A as overtime.” He paused for effect. “I told you I sent out the code to a number of people before I left. When I came in this morning, I got some of the results. Three people were able to decompile it…oh, that reminds me, you owe ‘a$$d3str0y3r’ five hundred bucks.”
“Give me a name for the confidential fund, and I’ll put in a chit to the ASAIC.” Morley knew he’d have to go around Brown and submit the request through Kensington.
Swann nodded, “Anyway, two cows and one very sharp prelate were able…”
“Cows? Prelates? Who comes up with these terms?” asked Morley.
“Let’s try to stay focused, boss,” Swann began again. “As I was saying, the individuals…I sent the code to, were able to decompile it and sent it back. The author signed his work ‘MichaelTAA’.”
To Morley’s constant amazement, real hackers, people who were unbelievably smart, just could not stand the thought of not getting credit for their work. Worse yet, someone else taking credit. They almost invariably put something in their code identifying themselves as the authors. It was somewhat like the taggers that spray painted any surface. Even though they knew what they were doing was a crime and by signing their work they could be giving the police what they needed to identify them, arrogance made them do it anyway.
Swann continued, “None of the three had ever heard of MichaelTAA before, although they were very impressed with his work. I reviewed it and I tell you, this guy’s good. He’s close to being cow good, if he’s not there already. He’s obviously a classically trained programmer but has learned everything else himself. It’s not elegant like something
you would expect from a cow, but it has a simplistic, workman-like beauty that anyone can appreciate. Just the fact none of us know this guy says a lot. He’s not new, you can tell he has been at this for years, but he has never come to the attention of this small group. It’s somewhat like finding a previously unknown species. This guy’s a master; he’s worth going after.”
Posada nodded, and Ron spoke up, “Jaime and I aren’t as good at programming as Doc, but from what we know, this guy is the best we’ve seen.”
Morley thought their respect for their opponent was interesting but misplaced. “First, let me apologize for my inability to provide you with criminals who are up to your standards. We will see what we can do about that in the future. Second, if the criminal admiration society of the New York Field Office is done for the day, maybe you could start concentrating on how we can put this bell cow…wait for it…out to pasture.” Morley smirked in satisfaction at his pun.
The others grimaced or groaned. Swann continued in fake disgust, “I sent the nic to all of the folks I can trust in the community. If they know anything, I should have something back by this evening. I also gave it to Lionel to run in all the standard DBs.”
They all looked at Murray. “I put it in the system a few hours ago. I haven’t had a chance to see if we have had any hits yet. I’ll check as soon we’re done.”
Swann continued, “There’s more, and it’s regarding Miguel’s extra-crispy computer. Remember I told you Lopez’s machine looked like it was too well patched to have been done by someone without a lot of knowledge?” He didn’t wait for a response. “When I went to that machine this morning to get ready for the sting, it was completely dead. I mean dead dead. I thought it might just be the monitor, but when I tried to hook up another monitor, it got the same french-fry treatment. I called Ron and we’ve spent the past three hours trying to assess the situation. What we found was a little bit of awesomeness. Whoever this MichaelTAA is, the bot he has on Lopez’s machine must have found mine. He had to have analyzed it and then launched something back down the wire. I tell you what—it is the Predator of malicious programs. It chewed up everything in its path. It even went after the innocent printer and monitor we had hooked up to the UC machine.” Somewhat sheepishly, Swann added, “We’ll need to replace ’em.” Then in his upbeat tone again, “We were able to isolate the code and sent it off to a few folks in the community to study.”
Morley jumped in, “I’d like you to see if you can reverse engineer that code. I can think of a few friends in Beijing who could use a Predator in their network.”
“Will do, I think we can tame the beast and harness its power for good.”
Swann eyed Posada, who picked up the conversation. “While Keith and Ron were trying to rebuild the machine, Kay and I figured we’d take a look at Alvaro’s machine and see what had happened to it. I proxied in and we looked around. I went to the sub-file where Keith’s program should have been and found it had been removed. In its place there was text.” He read from a piece of paper.
To Whom It May Concern,
I found your little bug and stepped on it. Have fun restoring your system, or should I say replacing it. This machine belongs to me.
MichaelTAA
Morley raised his eyebrows. “This guy plays hardball. It’ll make it even more fun to send him to Rikers.”
“I was able to find our friend’s bot on the image that we initially took of Lopez’s box,” said Swann. “I made a few copies and am sending them out to the same group of grey hats asking them to do a compare and contrast, and confirm that the source of the code for the pharmaceutical hack in Delaware is the same as the one on Alvaro’s machine. I’ll let you know as soon as I have something definitive.”
“The good news is our adversary thinks we’re another hacker, not LE,” offered Morley.
“Yes and no,” said Greere. “If we go back and have Lopez ask for more numbers right away, after just getting some, MichaelTAA will definitely know something’s up. That avenue is shut down to us for the immediate future. We think we should go after our target via World of Warcraft. Since the target still thinks Lopez is viable, he probably hasn’t killed that account. We hit Warcraft with a subpoena for MichaelTAA’s account information and go after him that way. Depending on how much cooperation we get,” Greere cleared his throat and looked around as if to make sure no one unwanted was listening, he continued, “we send a more stealthy little program through their network to ID this prick.”
“Way to make us all party to conspiracy to violate 1030,” responded Morley, referring to the statute in the US Criminal code (18 USC 1030) criminalizing unauthorized access to computer networks.
“Oh…yeah, sorry.”
Swann jumped in to help his friend. “That would only be the case if someone were caught; they won’t be.”
“I’m sure our friend MichaelTAA is thinking the same thing,” Morley mused. “Let’s follow up on all the things we have going. Let me think about what we want to do with Lopez. I’ll let you know by tomorrow morning. Thanks for all the hard work.”
39 | The Dalton Case Revisited
Leesburg, Virginia, 10/02/09, 1532 hours
Captain Steve Price of the Leesburg PD was surprised when he received a phone call from a Secret Service agent in New York. He was even more surprised when he found out it was in reference to a case that was almost a decade old. Agent Murray explained how he had associated the nic, MichaelTAA, from the Dalton case to a current intrusion investigation.
Price remembered the case because of the gruesome nature of the murders but had no recollection of the nic MichaelTAA. He gave Murray an overview of the investigation and his department’s final theory that the couple had been murdered by a disgruntled customer. He told the agent that he didn’t agree with that assessment. “Too much planning went into the killings for it to have been a customer who flipped out.”
Price explained he had been requested to complete the forensic analysis of the couple’s computer network but had not participated in the investigation beyond that aspect. He told Murray his department was never able to develop any good suspects from the clients identified on the computer search. Price said that because of 9-11 and sadly, the couple’s lifestyle, after September not much effort was put toward clearing the case. Since there hadn’t been any similar incidents in any of the surrounding jurisdictions, or within the state for that matter, the investigation remained in the cold case section.
When Murray asked if they did any follow-up on the hacking aspect of the case, Price had to admit they hadn’t. “None of us felt the hack had anything to do with the murders. We all just assumed it was someone looking to get free porn by hacking into the Daltons’ site.”
He was sure he’d run the nic through the appropriate DBs, without any hits. Other than that, Price didn’t remember much about that aspect of the case.
When Murray asked if they had retained the evidence from the computer, Price said yes. “Since there’s no statute of limitations on murder and it’s unsolved, all of the evidence had to be kept. I’m sure the original hard drive is in the evidence room.”
“Captain, we need a copy of the image so we can run tests. I’ll shoot you the paperwork as soon as we’re off the phone,” said Murray.
“I’ll send you the case file electronically as soon as we’re off. Then I’ll get the drive from the evidence vault and forward you a copy by COB.”
40 | Monday Overload
Morristown, New Jersey, 10/05/09, 0425 hours
The alarm clock in the adjacent bedroom startled PJ awake. The luminous display on his watch read 0425. What’s Sean doing up at this hour? PJ closed his eyes and stretched. Must want to talk before I leave the house.
Five minutes later, dressed in sweats, a hoodie, and a Yankees cap, Morley quietly stepped into the hallway. It was dimly lit by a shaft of light coming from Sean’s partially open bedroom door.
“Hey, buddy, what’re you doing up?”
The do
or opened, bathing the hallway in light. “I wanted…”
“Shhhhh.” PJ put his finger to lips. “Let’s talk downstairs. I don’t wanna wake Mom-mom.”
Sean, dark hair tousled, Transformer pajamas slightly askew, nodded eagerly.
PJ set his bags on the counter and went to the refrigerator, “You want some orange juice?”
“No.” There was a long pause before, “I have an important question to ask you.”
PJ poured the juice and gave his full attention. “What’s up?”
“Have you ever kissed a girl?”
PJ sputtered as he choked on the juice. It took a few seconds before he could answer. He set the glass down and wiped his chin. “Yes.” He nodded. “Yes, I have.”
“Did you like it?”
The elder Morley was glad he didn’t have more juice in his mouth for the second question. “Yeah, I did.”
Wanting to avoid another question he wasn’t prepared for, as much as wanting to know what was prompting the inquiry, PJ jumped in, “Why are you asking these questions?”
Sean looked at the table for a moment and fidgeted. “There’s a girl at school I like, and I want to kiss her.”
PJ’s mind went down two logic-trees almost simultaneously. He was fairly certain that St. Veronica’s Parochial School took a dim view of students, even ones without Downs Syndrome, kissing. Adding Sean’s “special needs” program status into the equation complicated matters even more. PJ’s mind raced. “Whoa, let’s hold on a minute. Does this girl like you?”
“I think so. She says she does. We held hands yesterday on the playground.” Then almost as an afterthought, “Is kissing a sin?”
PJ was caught off guard again. He repeated the question to gain time. “Is it a sin? Well, if you care deeply about the person you are kissing, I don’t think it is.”
“Danny says it is.”
“Danny O’Shea? I guarantee you Danny’s no expert in God or girls. I wouldn’t look to him for advice on either. He’s probably just jealous that a girl likes you.”