by Jack Davis
“Copy,” came the response from the phone.
Greere, who was the point of contact with Blizzard’s security department, went next. “Everything that Jaime and Kay said is true. Blizzard received the subpoena and has been very helpful. They confirmed Alvaro sent the message and received the response from MichaelTAA.
“They did say that the MichaelTAA account was uncharacteristically quiet in the end of September but had picked up again in October. They’re pulling together account information for MichaelTAA and we should have it within twenty-four hours.”
When Greere got back to his desk he had renewed vigor, but little time. After the horrific morning commute, Morley made everyone promise to leave “at a reasonable time” to get a start on their extended weekend. Greere and Swann were only too happy to oblige.
Exiting the conference room, Swann told his friend, “I need twenty minutes to help Murray work on Anthony’s hard drive. We’ll head out right after that.”
“Sounds good,” responded Greere as he picked up his list and began to reach out for the next site, number thirteen. The site was Sweet Southern Swingers. It had been one of the top twenty-five housewives’ sites based upon the previous month’s hits. After three rings, Greere heard, “We regret to inform you that Sweet Southern Swingers has been removed from the web after the tragic death of Tabitha and Ted. Expressions of sympathy can be left after the beep or sent via email to the web address. All other correspondence and matters of a business nature should be referred to Attorney Beau Yardley, at 912-555-5567. Thank you.”
In the interest of time, Greere decided against calling the lawyer knowing he wouldn’t be able to provide technical information regarding the website. He moved on to the next site and put Sweet Southern Swingers on the Un-contacted pile.
50 | Operation Aggravation
NYFO, 10/13-14/09, 0600 hours
Morley was always able to think very clearly while running. He thought it had something to do with blood flow to the brain during exercise, or endorphins, or some other physiological factor. Whatever the cause, Morley liked to start most mornings with some type of aerobic activity. If he had a particularly vexing problem, he would try to make that activity running.
On that brisk Tuesday morning he was doing a long run along the West Side Highway. The chill October air helped push the pace. While going through the case, one aspect—Alvaro—became clear.
The main reason for having Alvaro in the game was his contact with MichaelTAA, and since they now had an all-encompassing avenue into that aspect of the case through Blizzard, they really didn’t need to keep him on the line as the primary means of interaction. Following the money could now be done through Western Union, PayPal and e-gold.
Morley’s mind moved forward; his pace increased. He’d do what Swann had recommended: he’d launch a strike against MichaelTAA. It would be in keeping with the culture the suspect was used to, so it shouldn’t raise any law enforcement flags. It would cut Alvaro out of the picture, making his life less dangerous. It would also push their suspect, potentially opening new avenues to investigate, and possibly causing him to make a mistake.
By the time Morley was back in the office, he had a two-pronged attack planned. One would be against the WoW account, and the second would be against all the known accounts the suspect used to transfer and access money.
His first move was to call, not email, Swann and Greere. Knowing they commuted together he wanted their considerable combined brainpower working on the plan as soon as possible. “Put your devious minds to productive use and come up with a plan…but it has to be legal.”
“How legal?” was Swann’s response.
By the time the Swann and Greere reached Morley’s office Posada and Pencala had been briefed on the plan. All were now more amped up than their boss. They started planning like it was a military operation, albeit a covert one.
“Before we start, I have a confession to make,” said Swann. He hesitated. “I’ve been playing WoW…a lot. I started when we were in the Bahamas, ya know, to understand what Alvaro was saying. The more I learned, the more I liked it.” Swann lowered his head and voice, “I think I’m addicted.”
Mimicking the greetings at AA meetings, Greere joked, “Hi, Keith,”
Swann looked up grinning. “But really, I’ve learned a lot, and when PJ told me what he was thinking, I contacted the midnight security team at Blizzard to run a scenario past ’em.”
“Do tell,” said Morley. He leaned in and put both elbows on his desk.
Swann rubbed his hands together in a manner indicating he was considering where to start. “We raid MichaelTAA’s character account. With a little help from the WoW team, I can steal all the items from his character and clean out his various game bank accounts.”
“That happens,” asked Pencala.
“Not a lot, but it does happen occasionally. The security team was a little hesitant to discuss the problem at first, but after a few minutes, they came around. With over ten million accounts, a lot of them owned by kids, password security isn’t always the first priority. Accounts do get raided.
“The staff was quick to point out that they almost always catch the offender and restore the characters gear and gold. The offender is banned, but they admit that they can normally just open another account.”
“I was on the call with Doc,” said Greere. “And if our boy’s the kind of anal asshole Peyton and the WoW security team thinks he is, this’ll put him into orbit. They’re certain he’ll try and retaliate, that could open up investigative avenues.”
The last sentence was as much a question as a statement.
Swann was at the edge of his seat. “That’s not the best part.” He looked at Greere as if for confirmation. “When a player’s account gets raided, there is process they have to go through to get the gold and gear back, and to make sure the player wasn’t involved.
“They send the WoW help desk an email explaining the situation. The staff reviews it, then, depending upon the nature of the complaint, it goes in a particular queue. The WoW guys told me that in cases of account raiding, it took about a week to review the claim to determine if the player was involved or not. Then, it could take up to another week to reconstitute the account.”
Greere couldn’t contain himself. “With our boy’s level of activity, a delay of up to a week would seem like an eternity. It’ll chew him up inside.”
Morley was suddenly not present mentally. He closed his eyes and concentrated. “Guys, waddya do when you can’t get something resolved via email?”
Pencala picked up on where her boss was going. “You call.”
“Bingo,” exclaimed Morley, “give the attractive young Group Leader a prize; and what can we do to phone calls?”
“Trap and trace ’em,” said Greere, looking at Pencala in a playful, mocking manner.
“Exactly.” Morley turned to look at Swann but got a, “Wait, wait, wait,” from Greere who gave an expectant stare.
Morley responded with a flat affect, “Exactly, give the,” he raised his eyes as if having difficulty coming up with a word, “sturdy middle-aged Group Leader.” He smiled with satisfaction.
“You didn’t even try,” protested Greere sitting back, crossing his arms, and smiling.
“If you don’t mind, I’d like to continue.” Morley looked at Swann, “When we’re done here, I want you to get back on the horn with your pimps at WoW and find out how we make the trap and trace work from their end. Figure out what kinda paper they’ll need?”
“Got it.”
“Jaime, I want you to reach out to the AUSA and find out what he wants in the way of guarantees for us to move forward.” Posada nodded.
“Kay, talk to the guys downstairs and make sure we have everything we need for the technical part of this, and that it’s all operational.”
“Okay.”
Morley’s mind was working as rapidly as it had while he was running. “Ron, in your email on the Western Union angle, you
said that the IRS has no record of anyone by the name of Keith Nelson with the social security number listed on the account as having paid taxes in the past five years.”
“Yep.”
“I wanna be able to freeze that account at the same time we hit his WoW account.”
This brought a huge smile to everyone’s face. They finally realized the magnitude of pain Morley was planning to inflict on MichaelTAA.
“From my time working asset forfeiture, the IRS can freeze the account and require the account holder to come into an IRS office and explain the discrepancies,” declared Morley.
“Beautiful,” chuckled Swann.
Morley wasn’t done. “Ron, have Western Union flag the account as having been hacked. They’ll generate an official automated response email something to the effect of, ‘There is a problem with this account. For more information please contact the Fraud Claims Division.’ I want a trap and trace up on that line too.”
He turned to Pencala. “Where are we on the other payment methods Alvaro mentioned?”
“With the names and nics we have, we’ve drawn a blank with PayPal, e-gold, and all the others I’ve contacted. Western Union’s the only follow-the-money path we have currently.”
Morley was silent; he shifted his gaze to the window for a moment. “Okay. We’ve got enough for right now. Get to work and let me know when your individual tasks are done. Thanks.”
Late the following morning all the preparations had been completed. Now all Morley needed to do was brief up the chain for approval, and then present to the US Attorney’s Office.
The least technical but by far the most satisfying was Swann’s email to the suspect. The first part of the message was a cut and paste of MichaelTAA’s previous email when he fried Miguel’s machine.
To Whom It May Concern,
I found your little bug and stepped on it. Have fun restoring your system, or should I say buying a new one. This machine belongs to me.
MichaelTAA.
To this, Swann added,
MichaelTAA,
You were right, I couldn’t restore my system, had to buy a new one…WITH YOUR WU ACCOUNT MONEY, BEEEOTCH!!!! Have fun restoring your WoW account, or should I say buying a new one. This machine, your WU account, and your WoW account BELONG TO ME!
Awesome Sauce.
Porn Site Trace-Back (10/14/09, 1700 hours)
Morley was in a sour mood as he left his office for the now standard 1700 hours briefing. Hours earlier he’d been informed by Brown that HQ had refused the request to install the trace-back programs.
Brown parroted what he had been told by headquarters, “They don’t want us to install anything on machines that we don’t own, or have authorization to use, due to the potential liability of breaking the recipients’ machines. Also, because we don’t know exactly where the program is going after the first hop, they don’t want you to use the trace-back program. If it goes across international boundaries, it could be considered an “Act of War.” Brown used air quotes to emphasize the last phrase.
Then Brown admonished Morley for using the program on Alvaro’s computer. He ended with what Morley knew would be his safety net if things didn’t go well. “I didn’t authorize it.”
“I know, I couldn’t find you and since ASAIC Kensington was in her office I got her to sign. We were running short on time, there was so much going on, Alvaro had to get back to Mexico.” Morley raised both palms as if to say there was nothing else he could do.
“And now I have to clean up your mess. HQ and the SAIC are furious.”
Morley knew that was a lie; he didn’t feel as bad about his as his boss continued.
“I haven’t liked this case from the beginning. It’s like everything your squad does. It’s seat-of-the-pants, hurry here, hurry there. Gotta do the raid ‘tonight,’ can’t wait ’til morning. Then the next morning have to have buy money immediately. Then your crew goes to the Bahamas, gets in a fight, and you get shot.”
Brown pointed his chubby index finger at Morley. “You’ve lost control of the case and your squad. That’s what I see.”
Morley sat forward in the chair. He’d resolved to go around his boss again. “Tommy, we’re in a critical point in the investigation.”
“You’re always at a critical point in your investigations. The answer is no. I’m not gonna go back and push the SAIC to readdress this issue with HQ; that’s final.”
Morley left the office with a feeling of resignation; not for the case, for his relationship with Brown. He was going to go around him and suffer the consequences.
Morley knew the reservations the Service had as an agency to using tools like the ones he planned to employ. They were valid. The US government had been struggling for years to decide if offensive computer operations were considered an act of war or espionage. Like the physical realm, there was a fine line between the two. Lawyers at the DOJ were deathly afraid of having to try and take a side on the issue. He also knew that because most cybercrime cases resolved overseas, and involved computers not owned by the US Government, the restrictions practically killed any chance at a successful outcome to the case. To solve this investigation would require taking chances. Morley was prepared to do just that and take the consequences.
His mood lightened seeing the team assembled in the conference room. There were pizza boxes on the table and good-natured banter amongst the agents. He was resolved not to let Brown or HQ ruin everything his agents had worked so hard to bring to this point.
Picking up a piece of pizza, Morley folded it in half. “Anything new with Alvaro?”
Posada shook his head. “I’ve told him he’s on hold for the time being. He said he’s gonna have to do something very soon; his crew is looking to him for direction, and he has nothing to give ’em. They’ll accept what he said about his source drying up and him looking for a new one, but he can’t keep ’em on hold forever. It’s gonna get really scary, really quick.” He paused. “What should I tell him?”
“Tell him to do whatever he has to do to keep himself and his family safe short of crime…” Morley thought for a second, “crime against the US, that is. I’ll call Dunn and see if they’ve been in contact. He needs to figure something out. It isn’t something we should be orchestrating.”
Morley moved to Swann. “Are the programs ready?”
“Yeah, we were able to trace back one hop when our target acknowledged the email from Alvaro. We’ll see if it’s from the same location when MichaelTAA sends the new numbers. If it is, the program will log the second hop and that’ll be our new jumping off point. And so on and so forth.”
The refusal he’d just received from Brown pushed itself forward into Morley’s mind. He hated to disobey superiors, even ones as moronic as Brown. He pressed it back into his subconscious as Swann continued.
“For the infected porn sites our programs are ready to install on every system where we received authorization from the owners. They’ll be ready to trace back any contact by MichaelTAA as soon as I’m given authorization to install.”
Greere raised his hand. “I have a couple things. You asked me to run this past the US Attorney. He told me if this goes to a grand jury, we’re gonna have to write up some very basic explanations, such as a hop is movement from one computer to the next.”
Morley looked at Swann again. “You did one of those for a trail a couple years ago, didn’t you?”
“Talk about painful. I wanted to include breathe and blink commands at the end of each sentence it was so dumbed down.”
“We all have to make sacrifices, Doc. Find it, dust it off, and give it to Ron to pass to the AUSA.”
Swann nodded and Greere continued, “The US Attorney was hesitant about sending something downstream but had enough faith in us to authorize it.”
Morley weighed in. “I’ll be the conduit for all information flow about this topic to ASAIC Brown and beyond. Is that clear?” He stopped and looked slowly around the room making sure everyone knew what he me
ant. “I’m not gonna put the SAIC between HQ and us. We’ve gotten a thumbs-up from the folks who will have to prosecute the case. Any questions get referred to me, ‘to avoid misinformation.’
“Keith, you have authorization to install the trace-back programs and fire ’em up.
“I sent an RFI out to all the ECTFs, and our federal, state, and local partners here in New York. IRS replied they might have something. I should know more tomorrow, midday.”
Morley went around the room and asked if there was anything else anyone had to add. When no one answered, he could see in their eyes they were anxious to get back to MichaelTAA’s big surprise.
The group spent the rest of the evening eating pizza, ingesting caffeine, and getting everything set. They worked late but were satisfied with the results by the time they left for the night. Everyone felt certain the following day would be one of the most aggravating days of MichaelTAA’s online life. They couldn’t wait.
Morley hit send at 1623 hours and launched out his now required daily update. Everything that could be done to ensure success the following morning had been done. Now he faced a microcosm of the dilemma that had been plaguing him for months. Should he go home and spend what was left of the day with Sean, the gentle soul who claimed to understand why PJ had to work so many late nights and weekends, but who spent hours sitting looking out the window waiting for PJ to come home? Or could he do what he desperately wanted and go to the little apartment on the Upper East Side?
“Come over tonight. We can get sushi and then spend the evening in bed. I can have you all to myself…please.” The voice on the phone had been at once seductive and melancholy.
Execute (10/15/09, 0430 hours)
The team had taken the calculated risk that MichaelTAA had a real job. With that assumption, and the information they’d been provided about his user habits from Blizzard, the window of opportunity for taking down his accounts without him being online and possibly doing something to prevent it was from 0500 hours until 0700 hours. That pushed the meeting time in the office to 0430 hours.