by Jack Davis
After a second, Sean smiled.
“Kissing a girl is a big step. There’s a lot to take into consideration. She may like you…” PJ continued to try and stall for time to think… “What’s this girl’s name?”
“Beth.”
“Beth may like you, but not enough to kiss you, yet.” Then he thought he had an out. “I think Saint V’s may have a no kissing at school policy.” God I hope so. “You don’t want to get suspended, do you?”
Sean’s shoulders slumped. “No.”
“Of course not.” PJ stood and rubbed Sean’s head affectionately. “Buddy, I’ve got to get on the road before the traffic gets horrible. Don’t do anything more than hold hands until we talk more about this. Tonight, when I get home. Okay?”
“Yeah.”
PJ gathered his bags to head out the door. “Go back upstairs and try and get more sleep.”
As Sean shuffled through the living room, he suddenly turned back, as if he’d forgotten something important. “PJ, don’t tell Mom-mom I want to kiss a girl.”
“I won’t. Don’t worry. Concentrate on school, not girls. I’ll be home around eight.”
Update, Blizzard Games, Cows Flaming (10/05/09, 0800 hours)
By 0800 hours, all the agents except Greere were assembled in the ECTF conference room. At 0804 hours when the lone holdout rushed in, Morley asked the group for any updates.
The big piece of new information was the receipt of the data from Blizzard Entertainment, the makers of World of Warcraft. While the agents were still in the Bahamas, Swann had sent out an IOD to the Los Angeles Office. The request was for any and all information regarding the WoW account associated with Alvaro and MichaelTAA.
Greere and Swann had received the overnight package from the West Coast agents at 0700 hours and had been digging through it. The packages included both the documents from Blizzard and the case notes of the LAFO agents.
Greere explained that in phone conversations with their counterparts in LA the previous day, he and Swann had learned about the level of security employed by the game company. “Truly impressive” was the comment. The LAFO agents explained that considering World of Warcraft had well over ten million subscribers worldwide—some with multiple accounts—all paying fifteen dollars a month, the company could easily afford the best security money could buy. In the ultra-competitive online game milieu, having world-class security was essential.
The LAFO agents also felt it important to relate the psyche of many of the gamers. Warcraft had a cult following “not unlike Star Trek or European football…without the real violence or athleticism.” A few websites and blogs were provided for Greere and Swann to get an idea of the fanaticism of the players. The annual convention, Blizz Con, drew people around the world. The attendees dressed in homemade costumes to resemble the characters they played in the game. The costumes could cost upwards of ten thousand dollars. Basically, they were described as a strong and active sub-culture involving millions of people. The game was an addiction to some and there were hundreds of stories of people losing touch with reality through the game. There were even a number of documented cases where a player’s characters were specifically listed among items in divorce settlements. The LA agents wanted the case agents in New York to have some idea of what they were getting into prior to opening the package and seeing the raw data.
The file on the account holder MichaelTAA was extremely thorough and went back six full years. The account holder was a Mr. Keith R. Nelson, whose Yahoo email was KEITHNELSON999. The monthly fee was paid through a Western Union account in the same name but without the middle initial. Blizzard did not require additional information to open a WoW account, so they were unable to provide any personal information about Mr. Nelson.
The account was opened the year that Warcraft became an online game. Nelson was considered a “Classic” customer in that his account had been opened during what was now called the Classic Age of WoW. Nelson actually had multiple accounts, each with multiple characters. Blizzard kept detailed account information regarding all its accounts, to the point that over the past four years, they could show exactly how many minutes each character, not just account, was logged on to the game. The agents thought they had been given inaccurate information when the printout showed that Nelson had played just under fifteen hundred hours the previous year. Quick math revealed he would have had to play an average of four hours a day. The Blizzard employees explained that while this amount of time was at the high end of the spectrum, it was by no means in the top ten percent. When the LAFO agents asked for more granularity, Blizzard was able to show that Nelson played almost every night for a few hours, then five to six hours on the weekends. His normal log-on time was just after six p.m. PST.
The only other item of note in the report was the contact with the WOW help center. A review of the account showed a number of emails into the help center, but they were more along the line of complaints. Over the past two years, as far back as that system kept records, Nelson had contacted the help center seventy-three times. Four had to do with game play issues, the other sixty-nine were complaints. The complaints ranged from claiming other players’ characters were bullying users to them using inappropriate or obscene language. Nelson seemed bothered by other gamers who used profanity. In most complaint emails, MichaelTAA mentioned, “kids could be playing and might be reading this filth.”
Another point that was not in the file, but the Los Angeles case agent felt he should pass along, was the type of characters Nelson created and played. The only reason the agent had even thought to mention it was the emphasis the Blizzard employees had placed on it.
The employee had been very eager to pull the agent aside to say that he had “noticed something extremely unusual with the account.” The agent was hoping for some type of information of investigative value when the Revenge of the Nerds-looking technician dropped what he obviously thought might be the bombshell that could blow the case wide open. He earnestly explained that “Nelson had only ever created Alliance characters.” When the agent said he didn’t play and didn’t know what that meant, the intrepid amateur sleuth said they were all “good guys.” And if that weren’t enough, most of his characters’ classes were paladins, with an occasional priest or druid class. These were the good guy classes of the good guy race.
The overly enthusiastic employee went on with a great deal of animation and vigor, explaining to the agent that, “It was extremely odd for someone who had been involved with the game as long as Mr. Nelson not to branch out into other classes, if only to learn their strengths and weaknesses.” The agent felt it was probably worth mentioning, but not important enough to be including in the file.
Prior to departing the Blizzard campus, agents had to explain to the security personnel that the subpoena only covered the account information and did not allow the Service to ask Blizzard to monitor the account. They stressed they were not requiring them to monitor the account. They did, however, make sure the Blizzard reps understood that if they took it upon themselves to review the account as part of an ongoing quality assurance audit, it would only be for their own records, and was in no way at the behest of the Secret Service. The point was made, and the agents knew they would get a call if anything unusual happened with the Nelson account.
Greere closed by telling the group he’d go over the account in detail after the meeting and pass along anything else of interest.
Swann told the group that from everything he’d reviewed, ninety-eight percent of Nelson’s account access came from one internet service provider. The other two percent came via one other ISP. “We’ll have the information on both ISPs by Monday.”
Alvaro’s account was much less interesting, but exactly what the agents had expected. Very little use, one character who only interacted with other characters associated with MichaelTAA.
Swann went next and said he’d gotten a few vague responses from the hacking community regarding his query on MichaelTAA. While no one cla
imed to know anything specific, they knew enough to “suggest” the Service make sure they polled their foreign counterparts, especially the Canadians and the Brits, regarding some large-scale network intrusions.
Greere interrupted, “Already on it. I should have something back in a few days.”
Swann went on to say the cows were positive the individual in question wasn’t one of them. They stated in no uncertain terms that they considered the kind of behavior exhibited by MichaelTAA unacceptable. Swann smiled and explained there were unwritten rules between individuals at that level of ability. They knew one another by reputation and treated each other, if not as friends, at least as respected associates. They would never knowingly destroy a machine under the control of another Bell Cow. It was akin to a nuclear strike and lead to immediate retaliation. It was the cold war philosophy of mutually assured destruction. That kind of behavior would take down significant portions of the net. Swann referred everyone to the 2003 East Coast blackout. “That’s what happened last time a disagreement between BCs got outta hand.”
Swann said, “My friends recommended I flame MichaelTAA immediately for breaking the unwritten law. They want me to send malicious code back down the line toward the last known machine of the offender. They feel MichaelTAA needs to learn his lesson, and soon. They recommend a scorched-earth policy against all of his accounts.”
Swann paused. “It could also push MichaelTAA into making a mistake.”
Morley cocked his head. “I’ll consider it, but there are some huge downside risks. We’ll have to think through all the possible ramifications. Draft a plan and outline the potential consequences.”
When their turn came, Murray told the group he and Kruzerski had run the nic through all the databases and come up with three hits. He was waiting for calls back from two, but he’d spoken to a Captain Price in Virginia. “He gave me the background of the case and is sending an image of a hard drive for analysis.”
Cauterize the Wound (10/05/09, 0930 hours)
Prior to the meeting, Morley already had his course of action plotted. Nothing in the briefings changed his mind. After everyone had given their updates, he spoke up.
“With everything we know about the sophistication of our adversary, I think it best we cauterize the pharmaceutical wound.
“Jaime, work with Doc and Ron, to come up with an email from Lopez that will tell our target the numbers have been compromised and he needs ones from a different source.”
Posada looked at Swann who nodded. “We’ll draft something like ‘the mats are no good anymore,’ and then ask for more, ‘but not from that realm.’ That should do it.”
Morley smiled. “Good, he’ll assume the pharmaceutical company discovered the intrusion and contacted the credit card company who deactivated the numbers. Based on what Lopez says, if MichaelTAA knows the numbers and PII aren’t good anymore, he’ll stop using them. They’ll be as good as dead, and we can stop worrying about that part of the case.”
Morley kept going, “This should also force our target to send numbers taken from someplace else and provide us another avenue to work on. At the same time, I want the rest of you to keep running down other leads, particularly the payment angle; follow the money.
“Am I missing anything?” Morley paused to give a chance for input. When no one said anything he continued, “Thanks again for all your hard work on this. I’ll set up regular briefings to keep everyone on the same page. Doc, can you stay after for a second?”
“Doc, can you or one of your cyber friends, develop a bot for Lopez’s machine that could remain undetected by our adversary?”
Swann didn’t hesitate. “He’s good, but he’s not great. I’ll be able to come up with something. It may take a while.”
“We don’t have a while. I can reasonably hold Alvaro for another day, possibly two. I need to have something by Tuesday afternoon.” He paused and grimaced slightly. “There’s something else I need. I want a program you can attach to Alvaro’s electronic payment. When he,” Morley corrected himself, “When we, make the payment I want to know where it goes and ends up…again without tipping off this MichaelTAA.”
“Anything else you want, say a fin from the Loch Ness Monster, fur from Bigfoot?”
Morley rolled his eyes. “I’d settle for agents who weren’t sarcastic, but I think that’s up there with the fur and fins.” He looked at the younger agent. “Can it be done by tomorrow?”
Swann thought out loud, “We’ve got some beacons and phone-home programs that I may be able to modify. Whatever we do, it’s gonna have to be a lot less noisy than any OTS product to get past this guy.”
“I don’t care what you have to do, work with your nefarious buddies in cyberspace if you have to, but get it done.”
Phone Calls (10/05/09, 1100 hours)
“Morning, Mak.”
“Morning, PJ. Is today the day you tell me what I want to hear?”
“Talk about your open-ended questions,” said Morley good-naturedly. “I guess that depends on what you want to hear.”
“We can start with the senator’s issue.”
Morley explained his plan.
“If I’m hearing you correctly, this will take the senator’s info out of play. It won’t be for sale any longer.”
“That’s correct.”
“It should calm things down.” She paused. “I gotta say, the tone of the daily phone calls has been more and more frantic over the past few days.
“PJ, I should call this down to DC so people in the halls of power can relax a bit. I’ve also got to meet with the Bureau about their case in thirty minutes. I’ll contact you later tonight to get the full story.”
“If it’s after nineteen hundred call my cell. I gotta get home. Until then I’ll be at my desk knocking out all the paperwork for this little grenade you’ve dropped in my lap.”
“Sorry, I owe you.” Kensington’s voice had a tinge of remorse.
After he was off the phone with Mak, Morley called Dunn. “Morning, Myron. Got a minute?”
“Only if you’re gonna tell me you’re releasing my clients and are ready to put them on a plane later today with an official apology from the Secret Service.”
“Yeahhhh, about your clients and sending them back to Mexico, how long would you feel comfortable having them stay in New York as guests of the US government?”
“Please tell me you are kidding. They shouldn’t be here in the first place. Setting aside the fact they were practically kidnapped while on vacation and Maria’s pregnant, they have two small children at home who are worried sick and in need of their parents. It is inhumane to keep them here a minute longer than necessary.”
Morley had gotten the answer he expected. He knew with Dunn it was going to be like buying a car. He also knew this was why he had given his mother and Esther Lingram Dunn’s contact information.
“I’ll need at least another three days to get things in place so Alvaro can work off the charges against him. Maria can go home whenever she wants, but Alvaro has a lot more to do to work off the nut.” Morley braced for the explosion from the other end of the line.
“Three days! Three days! You’ll be lucky if I give you three hours before I go to a judge and tell him what you are doing.”
“Fine, have it your way. Go to a judge, and we’ll have to release him to the Mexican Consulate here in the city. Is that what you want?”
“I didn’t know that the federal government was sentencing people to death for credit card fraud these days.”
“You’re tying my hands here, Myron. I want to work with you, but we can’t get anything together today. Listen, he wasn’t supposed to be back for another day anyway. Let’s split the difference and we’ll put him on a plane in a couple days.”
“Tuesday night, they can say the flight was overbooked and they decided to stay another day. I can live with that, as long as all charges are dropped in the US.”
“If he allocutes to everything and helps us with the t
race, I can get Chris to sign off on that.”
“When you have Carpenter’s word, you have a deal.”
“I’ll have him call you on this number within the hour.”
After Morley hung up, he called Carpenter. The AUSA was more than happy to not have to wrangle with Dunn. The two men were deep in a discussion of the potential avenues the case could take when Morley got a call from Kensington.
“Chris, can I put you on hold, I have another call. Thanks.”
“Mak, I got Carpenter on the other line, can I call you back?”
“Tell him you’ll call him back PJ, we’ve got problems. Big problems.”
Federal Agents (10/05/09, 1424 hours)
“C’mon in Lionel and close the door behind you.”
From behind his desk, Morley watched Murray’s eyes as he saw Kensington in the corner of the office. There was concern.
“You know ASAIC Kensington?”
“Yes. Afternoon, ma’am.”
Kensington just nodded.
“Am I in trouble, boss?”
Morley let the question hang while his agent took a seat. “That depends on how you answer our questions.”
He saw the word “our” caused Murray to quickly look at Kensington again.
“Lionel, you’ve been around the block. You know this isn’t official; otherwise it wouldn’t be me asking the questions, it would be IA. That said, give your answers a lot of thought. If you don’t feel comfortable answering anything, it’s in your best interest to not say anything. Do you understand what I’m saying to you?”
“Yeah, boss. But I gotta say you’re scaring me a little.”
“Good, you need to be scared. You need to take this deadly seriously. Your career, and Brian’s, may hang in the balance.” Morley could tell he had Murray worried. Unlike an interview with a skel, there was no reason to keep his agent on tenterhooks. He nodded at Kensington.