The Devil's Code

by John Sandford

  “You can get stubborn,” she said. “But I still reserve the right to split, you know that.”

  “Anytime,” I said. That’d always been the deal, and she’d always been protective of her identity, background, and home. Nobody knew much about LuEllen; not even me.

  We watched television for a half hour, and I got cleaned up. We saw one item on Bobby, which said just that he’d been caught, and was believed to be a leading member of Firewall, and was coordinating the attack on the IRS. The attack was still going on, and the government was considering an extension of filing dates for quarterly business returns. Congress was squealing like a herd of stuck pigs.

  “You were right about what gets them excited,” LuEllen said.

  We went out to breakfast, but neither of us said much. I spent the time trying to figure out what to do next, and one thing kept coming up: call the cops. The problem would be to get the cops to listen, especially since (a) they thought they knew what was going on, and (b) we were the bad guys.

  “Not having Bobby to do research is like . . . I don’t know. Like going blind,” I told LuEllen as we walked back to the hotel.

  “What more research do we need?”

  “Anything that would get the bureaucracy running in a different direction. They’re tearing up the world looking for fifteen or twenty of us, and we haven’t done anything—I mean, nothing that they think we did. Somebody has to talk to them.”

  “Not me.”

  “Of course not; you’re not in jeopardy. But I might try to find somebody I could talk to. I could find somebody, if I had Bobby.”

  Back at the hotel, I changed to shorts and a T-shirt, and went for a run, the cell phone clipped uncomfortably into the shorts. LuEllen went shopping. I did three miles, fairly hard, and the exercise felt good after all the time cooped up in cars and planes and small rooms. When I got back, I jumped in the shower again, for a quick rinse, and was just toweling off when John called.

  “It’s not him,” he said. He sounded bubbly, which was not usually the case. “The guy they busted is white. They just had a picture of the cops walking him into federal court.”

  “Ah, Jesus. I hope our guy’s okay.”

  “So do I. He can’t run—not literally, anyway. He needs to stay at the . . . business.”

  “If he calls, tell him I need him.”

  “Do that,” he said.

  After hanging up, I turned the television down and went out on the Net. Trying to learn about the NSA and find some names. I got nothing but bullshit. But I have a few mailboxes scattered around, under different names and IDs; and when it became obvious that I wasn’t going to get anything useful off the Net, I checked the box at AOL. I found a message: six digits, beginning with 800.

  “Bobby,” I said aloud. He knew a couple of the boxes. I tried the next one, and found seven more digits. The last box was empty. I picked up my laptop, got the acoustic earmuffs out of my travel bag, and headed for the door.

  I called from a drive-up pay phone at a gas station two miles from the motel, using the muffs. Earmuffs are a valuable item, if you travel. It makes no difference what the country, what the phone system, or what the line voltages are—if you can get an audible signal from your home Internet service provider, you can get online. I dialed using the old protocol, and after getting the “?,” I typed in “k.”

  THAT WASN’T ME.

  NO SHIT . TELL ME , WHAT DID THE WOMAN DO AFTER THE AMAZING EVENTS ON THE MISSISSIPPI ?

  I got a couple of seconds of silence, as he thought about it. I wanted some confirmation that I was actually talking to Bobby, and he was quick, Bobby was. He came back with a woman’s name. The right one.

  MARVEL.

  I NEED SEVERAL NAMES OF NSA GUYS THAT I CAN TALK TO PRIVATELY ABOUT FIREWALL . SERVER IN MD HAS NSA CLIENTS . FIREWALL RUMORS MAY COME FROM NSA.

  FBI BE BETTER TO TALK TO. NSA MAY DISAPPEAR SERVER MATERIAL.

  WOULD PREFER TO TALK TO INPERSON . FBI HAS GUNS .

  OK. WILL CHECK NSA NAMES.

  MAYBE GET FBI NAMES ALSO .

  I CAN DO THAT.

  WILL YOU BE AT THIS NUMBER ?

  NO. CHANGING NUMBERS WITH EACH CONTACT, LIMITING CALLS TO 2 MIN. WILL LEAVE NEW # FOR YOU LIKE THIS TIME. WILL DUMP NSA INFORMATION TO SF BOX.

  Before I signed off, I gave him the information that would give him system administrator status at the Bloch Technology server, and suggested that he look at the client list.

  WILL DO THAT. MUST GO.

  TAKE CARE .

  YOU TOO.

  LuEllen was waiting when I got back. I quickly filled her in on what had happened. “So what do we do now?” she asked.

  “Wait. Until Bobby gets us a contact.”

  “And you want to talk to this guy personally.”

  “Yeah. If we do it online, or call, as far as he might know it could be some teenaged crank. If we look him up personally, we can be a little more definite.”

  “It’s a risk.”

  “Yeah . . . And you know, I’ve been thinking. Bobby thought maybe we should go to the FBI instead of the NSA, because the NSA might just decide to dump whatever’s on that server. So if he gets us some FBI names, maybe we should drop a note to them, too.”

  “Let’s think about it.”

  We went out and hit more golf balls, and went to another movie, which also sucked—there’ve been a whole line of movies starring old action-adventure stars paired with much, much, much younger women; they’re kinda creepy—and kept checking the mailbox. At two o’clock, the SF box, which has an ancient heritage going back to the original Well, popped up with three paragraphs of type.

  The recommended NSA contact was an executive in the security section, a woman named Rosalind Welsh. She was high enough up that she could talk directly to the top levels of the bureaucracy, far enough down that she’d not have any minders. And, Bobby said, she was newly divorced, with a son going to college. Her husband was also an NSA exec, but he was showing a new address, while Rosalind Welsh kept the Glen Burnie address and the old phone number. All of that, taken together, meant that she was living alone.

  We also got five names with the FBI, including the personal home phone number of the director. If we used it, I thought, we should get some attention . . .

  And finally, Bobby said,

  RAN BLOCH SERVER CLIENTS AGAINST NSA ROSTER. OF THREE THOUSAND CLIENTS, 1844 APPEAR TO BE NSA.

  AMAZING . NSA IS FIREWALL .

  MAYBE.

  GET OUT OF SERVER . I MAY TALK TO FBI.

  YES.

  If I was going to talk to Rosalind Welsh personally, I needed to cover my face and hair. LuEllen recommended a Halloween mask, since Halloween was coming and they should be easy to find, and because from any distance, they don’t look like masks. We drove all the way to Philadelphia to get it: a full-face molded rubber mask of Bill Clinton. It worked fine, except that I couldn’t talk very well through the mouth slit, and we wound up snipping off the lips with sewing scissors. We got a plastic water pistol from a toy store, and a baseball hat to complete the outfit.

  We went to Philadelphia because it was only two hours away by car, and LuEllen had contacts there—a gun guy who I’d met once, and now, it turned out, a phone guy. We got another cold cell phone, guaranteed for a week, for $300. We were back in Baltimore a little after seven o’clock. Glen Burnie is south of the city, and we were scouting Welsh’s house at seven-thirty.

  “Lights; she’s home,” LuEllen said.

  “So we cruise it a couple of times, and I hit the door.”

  “You’re gonna scare the life out of her . . . and the other problem is, what if there’s somebody in there with her?”

  “There’s a garage window,” I said. “I can check the garage on my way up—see how many cars are in there.”

  “Not perfect,” she said.

  “Nothing is . . .”

  We didn’t need to do it, anyway. We were cruising the place for the third time, picking out a place for
LuEllen to wait with the car, when Rosalind Welsh walked out the front door of her house, did a few stretches in the driveway, and jogged off down the street. We rolled slowly past, and I got a look at her. She was probably fifty, and ran with the earnest, hunched-up stance of somebody who hadn’t been running long, but was determined to lose the armchair ass.

  “Let’s do it on the street,” I said. “Stop ahead of her and let me out in front of a house without lights. I’ll bend over the car like I’m saying good-bye, and when she comes up, I’ll stop her.”

  “She’ll see the car. Maybe get the plates.”

  “Pull into a driveway, so we’re sideways to her. When I stop her, I’ll turn her around, and you pull out and go around the corner. When I’m done, I’ll get her jogging the other direction.”

  “This worries me.”

  “Yeah, well. It’s better than the door.”

  “If she screams?” LuEllen asked.

  “I’ll run.”

  This was the only part of what I do that bothers me—the involvement of innocents in ways that might hurt them. For the most part, when I’m working, I’ll take information from one place and deliver it to another. In most cases, I can make at least a thin argument that what I do benefits the population as a whole—encourages competition, saves jobs, etc.

  But sometimes, although I regret it, I involve an innocent. Like this lady, a bureaucrat, a little too heavy, earnestly chugging off the pounds on a quiet suburban street. Whatever else came out of it, I was about to scare the hell out of her. I wouldn’t do it, if not for the Firewall thing . . .

  I pulled the mask over my head, put on the cap, and got the plastic gun out. LuEllen guided us past her again and pulled into a driveway a half block ahead. I got out, and bent over the open door: LuEllen said, “A hundred feet, seventy-five, fifty, forty, shut the door and make your move.”

  I stood up, slammed the door, and turned to the sidewalk. Rosalind Welsh was twenty feet away and smiled reflexively as I turned toward her. I said, feeling the rubber edges of the mask flapping against my lips, “Mrs. Welsh. Stop where you are. I have a gun pointed at you. Don’t scream, just stop, and I won’t hurt you.”

  As I said the words, I moved to block her; she tried to turn, but I said, sharply, “Don’t,” and when she saw my face she opened her mouth and shrank away, and I said, sharply, “Don’t scream: I won’t hurt you. I just want to talk.”

  She looked all around, and I stepped close, directly between her and the car and said, “I have to ask you to turn around. We’re going to back the car out of the driveway and we don’t want you to see the license plates. If you do . . . well, you don’t want to see them. Just turn around and look straight ahead, and when your back is to the car, I’ll walk around and face you . . .”

  I tried to keep talking quietly, in a nonfrightening way, explaining what was happening: giving her something to focus on. When she was turned, I edged around her and said, “Don’t look at the car.” LuEllen backed out of the driveway and turned at the corner.

  “I’m one of the people the NSA is putting out rumors about—I’m supposedly a member of Firewall, along with several friends. But we are not,” I told Welsh. “We began researching the situation, trying to figure out what was going on. Are you aware of the source of the Firewall rumors?”

  “Sir, we don’t have much to do with trying to find Firewall. That’s the FBI . . .” She was scared, on the edge of bolting. Calling me sir.

  “The Firewall rumors are coming from an ISP called Bloch Technology in Laurel,” I said. “It’s a private server whose clients are almost all NSA employees. We believe that the NSA is Firewall and will inform the FBI of our conclusions tonight.”

  The fear was receding; I could see it in her eyes. She’d become interested in what I was saying. “You think the NSA is attacking the IRS?”

  “We think a group of European morons is attacking the IRS and jumped on the Firewall name because it was already notorious and it sounds neat.”

  She asked, “Have you ever heard of a man called Bobby?” I hesitated, but in hesitating, answered the question. “So you have.”

  “Yes.”

  “The FBI and our security people are debriefing him now,” she said. An implied threat, showing a little guts.

  Again I hesitated; but they’d find out soon enough what they had. “That would very much surprise me,” I said, “since he’s the one who got me your name. This afternoon.”

  Her eyebrows went up: “You’re joking.”

  “I’m afraid not. The guy you picked up may be named Bobby, but he’s not Bobby.”

  “What about Terrence Lighter?” she asked.

  Now I had to make a decision; again, a tough one, but what the hell: “Have you heard the name Jack Morrison?”

  “Yes.” Nothing more.

  “Then you know he was supposedly shot to death by a guard at one of your contracting companies—AmMath, in Dallas.”

  “He was definitely shot to death by a guard.”

  I held up a finger: “We don’t think so. We think he was killed by the same people who killed Lighter. Look at Lighter’s outgoing e-mail; he’s on the Bloch server. Then look at Morrison’s travel. He came to see Lighter twice last week, the last time, the night Lighter was killed. The Lighter and Morrison murders go together, and they were coordinated through an ISP that’s basically a server used by your people.”

  She shook her head. “Why should I believe you?”

  “Don’t. Just investigate. You’re a security executive. Do your job.”

  I glanced back over my shoulder: we’d been talking for two or three minutes, I thought, but it felt like an eternity. “I’ve got to go. I will call you, to find out if you’re moving on the case. If you are, we won’t have to. If you don’t, we will, and we make no guarantees about who gets hurt. We will call the FBI, tonight, about the Bloch Technology server.”

  I took a step back, and she said, “Would you have shot me if I screamed?”

  I looked down at the pistol in my hand, shook my head, and tossed it to her. She picked it out of the air as I jogged away. “It’s not loaded,” I said as I went. “I didn’t want it to leak on my pants.”

  She was still standing there when I turned the corner. She called after me, “Nice talking to you, Bill.”

  A little guts.

  So are you going to call the FBI?” LuEllen asked, as we rolled away.

  “Absolutely. If we get two bunches of bureaucrats fighting over the server, it’ll be harder to keep it hushed up.”

  I made the call from a pay phone, working down Bobby’s list of FBI agents’ names and home phone numbers. The first two weren’t home. The third guy was named Don Sobel, and he answered the call on the first ring. He sounded like he was talking through a mouthful of shredded wheat; in the background, I could hear the Letterman show.

  “Mr. Sobel,” I said. “I’m a member of the computer community. I’m calling to tell you that this group, Firewall, which is supposedly attacking the IRS, was invented by the National Security Agency . . .”

  “Who is this?” The way he asked, I knew what he was thinking: crank.

  “I’m calling several different people,” I said, “so if you’re interested in keeping your job, you should write down this name. Bloch Technology. B-L-O-C-H. The company has an Internet server in Laurel, Maryland, at the Carter-Byrd Center . . .”

  “Just a minute, just a minute, let me get this down,” he said.

  I spelled the name again, and then said, “The server is the source of the Firewall rumors. If you check the client list, you will find that most of the clients are NSA people. You will also find that the first mentions of Firewall all come from this computer, several days before the name went public. The rumors were planted by an NSA contract company called AmMath, of Dallas, Texas. A-M-M-A-T-H. AmMath is also involved in the murder of an NSA official named Terrence Lighter. L-I-G-H-T-E-R. Are you getting this . . .”

  “Give me that name ag
ain, Lighter . . .”

  I spelled it again and then said, “NSA security people are on the way to Bloch Tech right now. There may be nothing left to discover if the FBI isn’t there to watch them. You can call an NSA security official named Rosalind Welsh”—I spelled her name and gave him her phone number—“to ask about the server.”

  “What about . . .” he began.

  “Good-bye,” I said. I hung up, and we took off.

  “Now,” I said. “Something’s got to happen.”

  13

  What the European hacks were doing to the IRS was simple enough—the programming could be done by mean little children—but their organization showed some good old German general-staff planning. They must have worked for weeks, getting into the computer systems of not only a lot of small colleges, but, as it turned out, into the computers of several big retailers.

  Without studying the problem, I would have thought that getting at the retail computers would be almost impossible, without a physical break-in to get at security codes. I was wrong. It appears that several of the big online retailers spent all their security money on protecting credit-card and cash transactions, and making sure that nobody could fool with their inventory and sales records.

  But they had other computers that specialized in routine, automatic consumer contacts—computers, for example, that would do nothing but send out standardized e-mails informing the customer that his order had been shipped. For these computers, no great security seemed necessary.

  They were perfect for the hacks. They were optimized for sending outgoing mail, and once the hacks were inside them, they could easily be set up to ship the phony IRS returns. At the peak of the attack, the bigger online companies were sending out thousands of phony returns per hour.

  That would have been bad enough, but the hacks had taken it a step further: they didn’t have the returns sent directly from the retailer to the IRS, but rather bounced them off the customers. When the retailer sent an acknowledgment of a purchase, the IRS file was automatically attached, but would not show up on the customer’s computer screen. What would show up was a legitimate receipt or other message, plus a message from the hacks that read, “For auditing purposes, and your shopping protection, please acknowledge receipt of this message by clicking on the ‘Acknowledge’ button below. Thank you.”