by Jack Davis
Antonescu shook his head furiously. “Mihai no like bad pictures. Mihai no look at children pictures.”
“Well then you have to explain to us why they’re on your…explain why they are on a computer only you use.”
Antonescu didn’t hesitate. “Mihai no know how bad pictures got in computer. Mihai no know they there. Please, Mihai help you find out how they are there. Mihai good vorkink vit computers. Mihai help, please?”
The agent was quiet for a moment before he said, “Mihai, we can look at some of the logs and determine a lot. If you make us prove everything there will be no deal for you.”
The agent spun Mihai around and walked back to the living room.
“One Phone Call.” (10/17/09, 1126 hours)
The Thing was only slightly surprised seeing Antonescu’s number come up on the cell. It was awake but hadn’t gotten out of bed yet. It wished It’d been able to have a Mountain Dew before having to discuss business this early. As the systems administrator for the entire SUNY IT Enterprise, the Thing was used to taking calls nights and weekends. It expected the call from Antonescu to be about a problem with the weekly backups or some user infecting a part of the network after picking up a virus from a porn site the previous evening. It knew the situation had to be relatively serious because Antonescu could handle most problems himself. The Romanian had become very helpful in many ways.
When Antonescu said, “The Secret Police are in my house and arrestink me,” the Thing was even more astonished than when the accounts had been hacked. The Thing hated surprises.
It viewed Itself as a master chess player, always two steps ahead of opponents, leading them into traps. Now, twice in less than a week, It had to deal with troubling unexpected situations. Situations where It had to react based on someone else’s move. Certainly, It had planned for this possibility, which was why Antonescu was calling It instead of the police being at the front door. Still, the Thing didn’t like the situation; It liked to be in complete control of everything, at all times. These two problems had thrown the balance of Its nicely regimented life out of kilter. It consoled Itself with the knowledge that there was a foolproof plan in place.
“Please talk to Secret Police. Please explain mistake. Mihai no guilty. Mihai vork for you.”
“Mihai, I have to make some calls. Don’t talk to anyone until I call you back. Do you understand?”
“Yes, but—”
The Thing cut him off, “You might have to spend the night in jail, but you’ll certainly be out by Monday. I will take care of everything. Don’t worry.”
Knowing the Romanian’s childlike personality and thinking it might buy more time, It threw in, “You did the right thing by calling me.”
Hanging up, the Thing was frustrated and curious, but within a few minutes, slightly exhilarated. It had set traps leading to Antonescu for just this purpose. It tried to figure out how the Secret Police—FBI, probably—had gotten as far as Mihai. The Thing wracked Its brain to figure out what had led them to the Triple Cities.
Starting the cleanup procedure, It began to get angry. Everything had to be eliminated, all evidence of the hard work and planning had to be destroyed; how unfair.
How am I going to continue my work now that my shield is gone? If I kill someone else, they’ll know it wasn’t Mihai…I’ll have to wait until after they execute him. Then I can start again. But it will be years before they inject Mihai. I can’t wait that long. …but what if Antonescu isn’t being arrested for the murders? What if it’s for hacking? How did they get to Antonescu? The unanswered questions were maddening. The headache started.
Eliminating the last piece of physical evidence, some GHB, a thought came—this’ll be on the local news. Those vultures had to have a source within the world-class JCPD. They should be able to shed some light on this and answer some questions.
The problem was, the local newscast wasn’t on until five o’clock. It would have to wait three hours. Being a true product of the “I-want-it-now” generation, three hours might as well have been an eternity. The internet had nothing.
Once any trace of the logical evidence had been taken care of, curiosity, anger, and even a little anxiety started to take their toll. The big question, was what had Antonescu been arrested for? From the phone call it didn’t appear that Mihai had mentioned the Thing, but that would only last another day, at most. For heaven’s sake they probably did a reverse lookup of the number immediately after Antonescu hung up.
The Thing had anticipated an interview eventually and taken that into account. In all versions of the plan, It envisioned being interviewed by the police. Picturing the prospect now that it was a certainty, It might enjoy the interaction. Getting to play the game against a live opponent would be an extension of his travel persona to a degree. Like the PvP, in WoW. It could be fun to outwit someone face-to-face. That part was appealing.
It would have to do a little mental preparation for the encounter, but not much. Would the interview be with an FBI agent or just one of the local drones? It wanted a suitable opponent. The outcome would be the same, but the Thing liked the thought of beating one of the best.
To prepare properly, It needed to know what they were looking for on Mihai’s machine when they had inevitably stumbled onto the child porn It had deposited. The problem was not knowing if they were investigating the hacks, the credit card fraud, or even possibly the murders. It hated to dispose of things unnecessarily, but better safe than sorry. There wasn’t anything other than the videos and pictures of victims It couldn’t replace, and those were safe and secure under Mihai’s name on a server in Canada. Still, the uncertainty of not knowing enough to make informed decisions was bothersome. On top of everything else, It was still without the mechanism that could have helped him pass the time. Warcraft was not available. While time seemed to grind to a stop, the headache continued.
Five o’clock finally arrived. It watched one channel and recorded the others. All led with Antonescu’s story. The local reporter, standing outside of Mihai’s apartment, with yellow police tape across the front door, said Secret Service agents had arrested thirty-nine-year-old Mihai Antonescu of 614 Croker Avenue in Johnson City. They cut to a clip of the police spokeswoman explaining how the local police were working with the Secret Service on the case. She said that Mr. Antonescu had been arrested for computer crimes. She said other charges were pending, then went on to provide background information about Antonescu, where he was originally from, where he worked, nothing the Thing cared about.
When the spokeswoman finished, there were questions from the media. They asked her about the involvement of the Secret Service and if Antonescu had threatened the president. The officer was flanked by an individual who appeared to be an agent. As the camera focused on the agent, the spokeswoman explained that the Service had jurisdiction to investigate a wide range of criminal offenses, including computer crimes. She stressed Antonescu had not threatened the president. After more inane questions, the officer said that Antonescu was being held pending a preliminary hearing on Monday.
The news crew interviewed neighbors, who all said the same things: Antonescu was a very nice man and always helpful. None of them could conceive of him doing anything criminal; they were shocked.
Eventually, they cut back to the live shot of the newswoman standing outside of the apartment. She blathered on with the anchor about the unique aspect of the Secret Service involvement but didn’t provide any helpful information.
Again, the Thing had occasion to curse the ignorance of others. This time it was the news media.
Computer crimes! Computer crimes! How could a group, not just a single individual, but a whole group of individuals who called themselves professional journalists allow the police spokeswoman to get by with stating the suspect was arrested for computer crimes. It was like saying he was arrested for a traffic offense. Since there were about a thousand different possible traffic offenses, the idiots would have asked which one: drunk driving, speeding
, reckless driving—which one was it? They would have asked the cunt spokesperson that, wouldn’t they? But they let computer crime go as if there was only one type. Unbelievable.
The pain behind the Thing’s eyes started to grow.
While the news was still on, It went to the Secret Service website and learned that in addition to threats against the president, they investigated a whole host of other violations, including false identification and all manner of computer crimes and fraud.
The Thing calmed slightly; the thought of outwitting the Secret Service was even more appealing than the FBI. The game was getting more interesting and exciting.
Now even more focused, the Thing went back to thoughts of preparation. It needed to know what had led the agents to Johnson City. After looking at the website, it was between credit card fraud, computer intrusions, and false ID. Unless there was some additional information, It would have to prepare for each. Three scripts, a little more work, but It hadn’t planned so well for so many years for nothing. There was no reason to stop being thorough now.
Working through responses, the Thing felt It could turn the tables on whoever came for the interview. It could use their questions against them and figure out why Antonescu had been arrested. Always five steps ahead of the police till now; there was no reason the situation should change. It would have the interviewer explain how they caught Antonescu. Until then, the Thing decided to be prudent and put in place the Triple-Cites Exit Strategy, a last resort to be sure, but still It needed to stick to the plan.
Preliminary Results of Network Analysis (10/17/09, 2130 hours)
Greere received the first feedback from the SUNY Chief Information Security Officer after finishing a late dinner. The preliminary results showed that Antonescu had two accounts on the network.
One was a standard account that all help desk and customer support personnel possessed. It authorized privileges to allow employees to access users’ accounts to help them fix problems.
The second account had “super-user” status for the entire network. The SUNY security technician described it as having “godlike” access. With that account Antonescu could do anything on the network, and just as important, “no one would know it.”
Through the super-user account, Antonescu would have access to the whole SUNY IT system—including the financial systems. He would have access to the databases where all credit card numbers were housed. That piece of information prompted Greere to ask the team to check what kind of connections and reciprocal agreements SUNY had with other state systems.
The next piece of evidence against the Romanian was based on Greere prompting the CISO to look at the access to the library server at SUNY, Plattsburgh. The previous USSS search had identified that machine as the termination point for all the other state college and university systems. The records showed Antonescu had administrative privileges for the machine and had accessed it within the past month.
There was nothing else in the file on Antonescu other than correspondence from users, all positive. There were close to a hundred complimentary letters and emails dating back to the year he was hired.
“You guys notice anything unusual about this file,” asked Morley after closing it.
“Just that everyone seems to love this guy,” said Greere. Swann shook his head.
Morley continued, “Yeah, but what’s missing?”
Greere hunched his shoulders and looked at Swann who did the same. Then both looked at their Morley.
“This guy has hundreds of emails, and letters of appreciation from End- Users beginning the month he started. No complaints that I saw. Yet there’s not one employee-of-the month awards, no cash rewards, recognition letters—nothing. Seem odd to you two?”
Now both men nodding in agreement.
“Doc when you interview Antonescu’s sup tomorrow ask him about it.” Morley opened the file. “Says here he lives locally. His name is Craig Lublin.”
Part Twelve
57 | IRS Cleveland Investigation
Johnson City, New York, 10/18/09, 0642 hours
Morley was up early the next morning to go for a run. He ran while on travel every chance he got. It let him see more of the area than he otherwise would.
The difference in temperature between Manhattan and Binghamton surprised him. It was cooler than he’d anticipated. The overcast skies, which he was told was a fixture in the area, didn’t help matters.
Glancing at his BlackBerry before heading out the door, Morley noticed an email from Tom Whitledge of the IRS. It had come in at 1:06 that morning. It was in response to a request Morley had made to the ECTF partners to search for any cases mentioning MichaelTAA or the hacking code found on Alvaro’s box. When he saw the time of the email he smiled, knowing Whitledge was as much of a workaholic as anyone in the government.
The file attached to the email indicated IRS case, 03-146-0112-06 Heller, (Carl and Teri), was a standard tax fraud case out of Cleveland, Ohio. The victims, Carl and Teri “Hell on Heels” Heller, ran a porn website and were suspected of having underreported the number of subscribers by about twenty-five percent. The informant in the case was a former friend of the couple, who had had a falling out. The subpoena, forensics—accounting and computer—revealed the suspects were skimming between eight to twelve thousand dollars a year off the top.
The agents went back as far as they could—five years—and put together a solid case charging the Hellers with over fifty K in unreported income. While it wasn’t the case of the century, it was a good case for that district and was set to go before the grand jury for indictments in the latter part of April 2007.
The case had been administratively closed in March when the Hellers were found murdered in an empty house that was for sale in one of Cleveland’s suburbs. The email provided the local department’s case number and the detective’s contact information.
Whitledge also confirmed the forensic image of the hard drive had been kept, and he had requested a mirror image be given to the local USSS office.
In his response, Morley thanked his friend warmly and promised to keep informed.
Then it was off for a short, fast run before breakfast.
Coffee and the Savannah Case (10/18/09, 0800 hours)
The agents met at a small diner across the street from the motel at 0800 hours for breakfast. Before the food arrived, Morley updated the group regarding the IRS case. Since it involved both the hacking code and the nic MichaelTAA, everyone listened intently until he got to the part about the murder. No one noticed the look of shock on Kruzerski’s face, but everyone noticed when he began frantically fishing for the phone in his pocket.
Ignoring the questioning looks, he dialed a number as if his life depended on it.
“Detective Kniese, this is Agent Kruzerski of the Secret Service; you tried calling me yesterday.
“Sorry I didn’t get back to you earlier. We were in the middle of a search warrant that led to an arrest warrant. I didn’t get your voice message until late last night. In it you mentioned murder victims?”
While Kruzerski was finishing the call, Murray, who had been his partner for the calls to the porn site systems administrators, explained that the Savannah case was one of the few they had not heard back from yet.
Kruzerski had a stunned look on his face as he hung up. “Get this, the detective in Savannah could give-a-shit-less about the hacking, he’s investigating the most gruesome murders he’s ever seen. The couple ran an Internet porn website featuring the wife.”
58 | A Rocket Sled
Johnson City, New York, 10/18/09, 0845 hours
After Kruzerski’s call with the detective, Morley directed the group to meet at the JCPD. He had Kruzerski call the PD dispatcher and let the detectives know the new information and the possible danger posed by Antonescu. He also requested a conference room with teleconferencing capability and a whiteboard. He had Greere and Swann call Pencala and Posada to tell them to be ready at 0945 hrs. Morley called Mak and Peyton t
o have them dial in.
At 0945 hours the telephone bridge was connected, and Morley started the meeting briefly outlining what they knew. “Folks, we have three sets of murders over the course of the past decade that had distinct similarities.
“The victims were husbands and wives who ran internet porn websites specializing in a particular type of porn. All were tortured, mutilated, and murdered.
“The venue for all the crimes had been secluded vacant houses that were for sale.”
Since no member of law enforcement believes in coincidence, everyone in the room and on the phone knew this pattern meant one thing: a serial killer was responsible and had been on the loose since at least 2001.
Morley stressed that they were still unsure about the connection between the killings and the hacking, but since there was a potential link and they had the hacker, following that to its logical conclusion seemed like their best avenue of approach.
Swann, Greere, and Posada, being most familiar with the online culture, had the most difficulty with the notion of the hacker and the killer being the same person. It went against everything they had observed and known about the community for close to three decades. They were quick to point out that just because there might be some sick person out there killing porn website hosts, it didn’t mean the pervert hacker who had infected some of the same sites was involved. Greere pointed out the hacking code had been found on several sites where the hosts were very much alive. He cautioned that while the thought of tracking down some as-yet-unknown serial killer appealed to everyone, the group could not make a firm connection without more information.
Morley concurred. “Lionel, you look into the Virginia homicide. Brian, you take Savannah. Ron, you take the one in Cleveland. Connect the locals and look for anything that ties them together, DNA, fingerprints, correspondence—anything. Send them all of the identifiers we have on Antonescu.”