by Akart, Bobby
“Listen, you guys know the drill. It’s like your old Budweiser commercial—why ask why? Our employers pay us well. They give us the latest in high-tech gear. In fact, it’s stuff Her Majesty’s Armed Forces know nothing about.”
One of the American men began to chuckle. “I bet the chi-comms know all about it. Those hackers have all of our secrets.”
“Well, maybe so,” the team leader continued. “Regardless, I wasn’t provided a reason, and anything else is speculation on my part.”
The American shrugged and appeared indifferent. “I’m just curious, that’s all. Regardless of the motivation, it’s gonna fit a pattern of concert attacks in recent years. They’ll be chasing their tails, pointing the fingers of blame.”
The Australian spoke up. “You’re right on that, mate. They never figured out the reasoning behind the Mandalay Bar shooting in Vegas. The Rascal Flatts concert in Indy was evacuated due to an anonymous security threat.”
The Brit added, “And in Manchester, the Ariana Grande concert suicide bomber was identified as a bloody Islamist. For our purposes, there will be no discernible reason for the attack, so it can’t be tied to us or our employer.”
The men sat in silence for a moment as they contemplated his words. Then one of the Americans asked, “And do you have any idea who our employer is on this job?”
“I do, and no, I won’t tell you. Trust me, you don’t want to know.”
The men shrugged and went about their preparations. They studied a printed map of the arena and confirmed their assignments. After a final sweep of the apartment that had been rented for them a month earlier, they gathered any trace of their personal effects and made their way through the parking lot of the apartment complex, systematically dropping trash bags of clothing, leftover food, and the map of the stadium into the dumpsters. Despite it being the New Year’s holiday, it was a Thursday night, and the waste management trucks would be through to empty the dumpsters around ten o’clock. Any trace evidence of their presence would be incinerated just before midnight, when the fun began.
Chapter Five
Undisclosed Residential Location
The messages were always cryptic. Coded in such a way that certain sets of eyes could understand them all, while others were more compartmentalized based upon their sphere of influence. Everyone had a job to do. Some required physicality and military training. Others simply used the powers afforded them by way of their position. And then some, like the lonely young man sitting in the dimly lit basement of his home and surrounded by computer monitors, used their expertise. The common thread between them all? A sense of duty and the ability to respond on a moment’s notice.
The message was short, but its words had a profound meaning.
!!!mG4VJxZNCI 12/31 19:34:28
As the snow cascaded downward,
The wild rides halted immediately.
One instance among many more,
As we seek Justitia Omnibus.
Fare thee well.
He set his phone aside with the message on the 4chan chat board still in plain view. He reached to his side to pull open the desk drawer. At first, he hesitated, not sure if he was ready to fulfill his handler’s wishes. He’d been paid well and given everything he needed.
But he’d contemplated his exit strategy on many occasions. He’d begun to stockpile supplies and cash. He had a vehicle that would go anywhere, under any circumstances. Although he was not an outdoorsman, he’d studied how to survive in the woods.
Not on these computers, of course. He was sure he was watched. His keystrokes monitored. Prying eyes were everywhere, and not just through camera lenses. His handlers were capable of anything.
The small black book had been given to him after he’d proven his loyalty. To be sure, he was once a rising star within the ranks at INSCOM, the United States Army Intelligence and Security Command garrisoned at Fort Belvoir, Virginia.
He had come out of high school as a broken teen. Constantly bullied as a nerd, and due to his being undersized compared to his classmates, the seventeen-year-old was not ready for adulthood. He worked on the Geek Squad at Best Buy for a while, but his real passion was not repairing computers. He preferred hacking them instead.
Just to be clear, he never engaged in criminal enterprise, at least not in his mind. Yes, he was guilty of accessing unsuspecting coeds’ wireless cams on their laptops and watching them from time to time. Later, he decided to try his hand at cyber intrusions upon small businesses’ computer networks. He was more of a gremlin than a full-blown hacker up to nefarious activities.
None of this paid the bills, however, and he soon became bored. With little going for him, he walked into the Army Recruiting Office in Tampa, Florida, and enlisted. It was a decision that changed his life.
He entered basic training and found himself overwhelmed by the rigors of the Army. In need of warm bodies due to attrition in recent years, the Army kept him in the program. One fateful day, he was having a conversation with another following their successful completion of the third and final field-training exercise known as the Forge, when he brought up his computer acumen as it related to hacking.
A senior drill sergeant pulled him aside and began to quiz him about his statements and expertise. A day later, he was sitting in the offices at INSCOM in Fort Belvoir, speaking with two of their technology personnel. The rest was history.
He moved on from basic training and took a position in the electronic and information warfare areas of responsibility at INSCOM. There, he was groomed under the careful, watchful eyes of the Military Intelligence Corps.
Four years later, he was at the top of his game, assisting Army Intelligence in their never-ending challenge to keep track of Chinese and Russian military assets. At one point he was brought on board to conduct pen testing, a term used by hackers for penetration testing of a computer’s network, looking for vulnerabilities and security weaknesses.
He was in his element. He had a process, which he developed, that was ultimately adopted by others within his unit. He spent an inordinate amount of time conducting reconnaissance by gathering information about the targeted system. He would identify possible entry points, conduct several penetration tests, and record his findings for his superiors.
Using comparison models of other systems, he would eventually create a map, so to speak, of the target computer system. To look for weaknesses, he’d systematically test an organization’s security policy compliance, the computer operator’s security awareness, and finally, the target’s ability to identify and respond to his intrusions.
The current administration turned the nation’s cyber-warfare capabilities from a defensive posturing to being placed within its weapons arsenal. For decades, the Russians had used cyber attacks on critical infrastructure as a precursor to war. The Chinese preferred to steal military secrets with their efforts. INSCOM was tasked with following the Russians’ method of military tactics.
He became an expert in accessing and potentially shutting down critical infrastructure on Russian targets, whether it be utilities, communications, financial markets, or transportation systems. In order to gain advantage in a military conflict, crippling one of these major components in a nation’s critical infrastructure became a primary strategy in war planning.
He was becoming the best in his field, respected by his co-workers and appreciated by his superiors.
Then he was kidnapped.
It was never the intention of the kidnappers to cause him bodily injury. His life certainly wasn’t worth ransoming. He was, as his kidnappers assured him, a potentially valuable asset. During the twelve hours he remained tied to a chair and blindfolded, he was assured that he wasn’t going to be killed. They only sought two things from him, and he needed to understand their request was serious.
Cooperation and loyalty.
He asked if they expected him to betray his government. He insisted that he was a soldier and would never turn on the United States of America. He was ass
ured that the plans they had in store for him would not require such a betrayal. He was simply told trust the plan.
So he did, and for the last nine months, he’d followed instructions and was paid handsomely for it. He still reported to duty at INSCOM, but he fulfilled his obligations to his nameless, faceless handlers. The ones who watched him.
And although he’d grown comfortable with the arrangement, he knew someday his time clock might be punched, or he’d have to disappear, hopefully on his terms.
Chapter Six
Undisclosed Residential Location
He opened his little black book, as he unimaginatively called it, and studied the initial sequence of codes and numbers. The first three exclamation marks indicated a level of priority, with one being the lowest and three the highest. The date and time stamp was generated by the chat board.
The message was encrypted as always, and he looked into his book to decode the string of characters and numbers. He underlined the ones of significance based upon the code sequence and key provided to him.
!!!mG4VJxZNCI 12/31 19:34:28
As the snow cascaded downward,
The wild rides halted immediately.
One instance among many more,
As we seek Justitia Omnibus.
Fare thee well.
The number 4 represented the mode of delivery, in this case, the 4chan website, a social media site that allowed users to post anonymously. It was split into various chat boards discussing such topics as sports, entertainment, and politics. A similar site known as 8chan was also used from time to time. It differed slightly in that 4chan was moderated by administrators, and 8chan generally was not.
He thumbed through the sequence of letters and studied the sentences. Only certain words were considered important and part of a potential directive. To the casual conspiracy-minded observer, reading the post as a whole, they might point out the phrase Justitia Omnibus. This was translated from Latin to read justice for all in English. He also knew it by another meaning.
The Seal of the District of Columbia depicted Lady Justice hanging a wreath on a statue of George Washington. The motto of the District was Justitia Omnibus, justice for all. Others might arrive at this conclusion on their own, but only he knew it made the District the designated target of his activities.
He finished decoding the rest of the statement and set his glasses on his desk. He rolled his neck around his shoulders to relieve some stress and flexed his fingers. To his left was an undercounter refrigerator. He retrieved a miniature bottle of Tropicana orange juice and took a sip.
He spoke to himself aloud. “Last chance, pal. Whatcha gonna do, boy?” He could’ve shouted at the top of his lungs and not a soul on earth could hear him unless, of course, his watchers had their own form of listening device within his basement, which he affectionately dubbed the Cave.
After another moment consumed with conflict and introspection, he scooted his chair up to the modular desk and ran his fingers across his keyboard. He’d reached a decision.
This was a victimless hack in his mind. He wasn’t directly killing anyone. In fact, in his mind, it was slightly humorous to derail the plans of the partygoers who were out carousing and enjoying adult beverages on New Year’s Eve. He wasn’t going to any parties, nor was he invited to any. There was no local pub nearby to ring in the New Year with a hearty chorus of “Auld Lang Syne.” Why shouldn’t some other people be miserable like I am?
His desk resembled the cockpit of a modern airliner with eight flat-panel monitors at the ready. He pulled up different sets of notes on his upper-level computer monitors, which were mounted directly to the wall.
One was labeled AIRPORTS—Reagan and Dulles. Another was labeled AMTRAK. The next screen was marked BUS TRANSPORT—MegaBus, Battle’s and Vamoose. The final screen was marked WMATA—DC Metro.
He studied his notes. He’d been tasked early on with pen testing of each of the major infrastructures of a dozen of the nation’s largest cities plus Washington. Transportation, communication, utilities, and financial markets were all potential targets. Once he’d established a particular methodology for entering the computer systems of each of the subcomponents, like Reagan National Airport, he would conduct pen testing periodically to make sure countermeasures hadn’t been adopted.
This was how he filled the extra hours of his day when he was away from INSCOM, in addition to monitoring chat boards and social media for instructions. Now he had work to do.
He set about his task. The keyword Fare in the post indicated he was to target transportation infrastructure that was ordinarily paid for with a fare.
The bus transport companies were the easiest to deal with. They were small companies with an unsophisticated firewall. It was easy for him to access their servers individually and schedule a DoS for the precise time indicated in his instructions.
He thought of the ramifications of his cyber attacks and others like them. The message had read One instance among many more. He was not the only one participating in this plan, which he was admonished to trust.
A DoS, or denial of service attack, was used to temporarily interrupt a web server’s ability to connect to the internet. The common method of attack saturated the target network with external communications requests to the point the computer system was unable to respond to legitimate web traffic. The result was server overload and a shutdown of the entire system, creating chaos within the bus transportation network.
The servers at Washington Dulles and Reagan National airports would be attacked in a similar fashion, except the intrusion would involve the airlines as well. In this case, he would use a DDoS, or distributed denial of service attack, to completely weigh down the computer systems of the airports and the airlines that service them.
He would employ multiple servers around the world to remotely access the computer systems of the two airports and the three major airlines that service them—American, United, and Delta. Each of the remote servers controlled multiple computers, both public and private, around the world. All of them would simultaneously attack the servers at the two DC airports, bringing air travel to a standstill.
Amtrak would receive treatment similar to the airlines. The Washington Metropolitan Area Transit Authority, or WMATA, consisted of both bus and rail transportation. The bus transportation could be halted by a DoS attack easily enough.
The DC rail system was a little more complicated. Because the rail system encompassed such a wide area, he thought it best to take down the dedicated power grid for its lines. He was instructed to undertake a cascading failure of the entire rail system without creating widespread power outages throughout the District. It could be done, but he hadn’t war-planned it.
The trains would be brought to a halt, and the power would be taken down in the stations and tunnels, adding an extra layer of chaos. He smiled as he added his own demented twist to the instructions he’d been given. He planned on creating a cascading failure by penetrating DC Metro’s antiquated Windows-based servers.
He logged on to his VPN, a virtual private network, which prevented his identity being tracked by cyber investigators. His earlier pen tests had allowed him to sneak a peek without prematurely alerting the IT department at WMATA of his presence.
“Now that I’m in,” he mumbled, “let’s find their schematics and see what kind of software they’re using.”
He raced through the internal servers of the WMATA, his fingers clicking faster than the screen could keep up. After several minutes, he found what he was looking for. The WMATA used an Automatic Train Control software, which dealt with all aspects of train operations from routes, scheduling, operations, and communications. Most importantly, it provided safety and protection by monitoring life-critical functions of the trains.
“Hello, SCADA, old and out-of-date friend,” he said with a smile as he dug deeper into the network.
SCADA, which is an acronym for supervisory control and data acquisition, was used by industrial utilities t
o provide interconnectivity across various platforms and networks throughout the utilities’ network.
Many energy and transportation utilities around the world used SCADA despite the widely reported weaknesses and vulnerabilities the system was subject to. He reached for a USB drive and inserted it into a laptop that sat on the desk to his left. The portable computer went everywhere with him, you know, just in case he had to make a quick exit from public life.
His adrenaline was pumping as he navigated through the laptop in search of the perfect worm to insert in the SCADA system. Do-gooder companies like Symantec always professed to be one step ahead of hackers, but, of course, they were wrong. If they were one step ahead, there would never be a cyber intrusion, right?
The hacker community had a network, which he was part of. He rarely contributed anything of value, although he did post things from time to time to disrupt Russia’s activities in Syria. On one such occasion, it got a Russian Sukhoi Su-24 shot down near the Syrian-Turkey border by a Turkish F-16.
The Turks swore the Sukhoi violated its airspace. What they were unaware of was the hack performed on their air defense radars that had temporarily moved the positioning of their border vis-à-vis the Russian aircraft. They thoroughly convinced the Russians that their military fighter had deviated into Turkish airspace, when it had not.
The hack, and the subsequent downing of the aircraft, created an international incident, with Moscow blaming Washington for not informing them of the aircraft’s deviation. Washington never admitted that their data differed from Turkey’s. Eventually, the matter went away.
He was applauded by the hacker community for providing the tools necessary to disrupt geopolitical affairs, and as a result, complex hacks were shared with him on a regular basis. He would deploy one of them that New Year’s Eve to bring the DC Metrorail system, along with the entirety of Washington’s transportation apparatus, to a screeching halt.