by Sara Rosett
When they left the mercado, Zoe and Jack had taken a rambling route through the streets of Madrid, keeping an eye out for anyone who might shadow their steps. After strolling for about half an hour without a sign of anyone behind them, they stopped at a small hotel tucked away on a quiet street several blocks away from the royal palace. The hotel didn’t have an actual lobby downstairs, only a small tiled entranceway with a dusty plastic plant and a window set in one wall where the night clerk had dispensed the old-fashioned key and taken their passport details.
Jack closed the curtains over the window that looked out onto a tiny square. “It’s not quite in the same league as the Hotel Premier. More like one-star instead of five.”
“Just what I was thinking, but it does have one big bonus—no Jug Ears hanging out in the lobby.” Zoe dropped the shopping bag along with her messenger bag on the bed.
Jack pulled out his laptop, and Zoe retrieved the lip balm from her flowered makeup case and removed the cap. Jack inserted the drive in one of the ports on his computer. He clicked away on the keyboard. “First, let’s scan this for viruses.” After a few minutes, the program ended, and Jack said, “It looks okay.”
He angled the screen so they could both see it and selected the external drive. He scrolled through the list that popped up. “Looks like about twenty files.”
The filenames were strings of numbers and letters that didn’t make any sense to Zoe. “Too bad they’re not named with something we can understand,” Zoe said as Jack clicked on the first file.
The screen filled with a document. Zoe stared at the text for a bit. “I can’t read it. Can you figure it out? Is it code?”
“Yes, it’s definitely code.” Jack clicked through the various documents, taking a quick look at each one. “But not all of the files are programming code.”
“That one looks like a manual of some sort,” Zoe said. “I can actually understand some of the words.” The page listed commands in an orderly fashion, but also contained strings of words and letters that Zoe couldn’t decipher.
Jack clicked back and forth between a few of the documents. A stillness went over him.
“What is it?” Zoe asked.
“Give me a minute,” Jack said. “Let me look again.” He went back to the documents, scrolling and reading, then he stood and walked around the room, his hand over his mouth.
Zoe wanted to hop up and demand he tell her what he was thinking, but the room was too small for two people to be pacing, and Zoe had learned that Jack liked to work out his thoughts before he spoke. She always liked to talk things through, but Jack was the opposite.
Finally, he turn to her and dropped his hand. “If that’s what I think it is, then…” He shook his head and waved a hand at the computer. “That’s some scary stuff.”
“What do you think it is?”
“A zero-day.”
“Your tone is ominous, but I don’t know what that means.”
“It’s a vulnerability in software. The reason it’s called a zero-day is because the flaw has been there from the moment the software was released. The developers weren’t aware of it, and so every copy of the software contains the vulnerability. It’s a gap in the software that hackers can exploit to get access to all sorts of stuff—computers, phones, routers, and even televisions.”
“So you’re saying it’s a hack,” Zoe said. “All these files are instructions and code to…exploit the vulnerability, as you phrased it.”
“Yes, and it’s worth a lot of money, if it’s what I think it is.”
It took a lot to ruffle Jack, and he truly looked shaken up. The tension she’d felt all day increased, settling into a heavy knot in her stomach. “How much do you think?”
“If it’s what I think it is…then we’re talking millions.”
Zoe looked at the lip balm tube, which stuck out from the computer port. It looked like something you’d buy at a novelty shop, a gimmick. It was hard to imagine that it could be worth so much. “I guess that explains why the sketch was stolen, and why Jug Ears followed me around Madrid. He must be after the info on the flash drive. If you’re right about it being a—um—zero-day thing—then it’s worth a whole lot more than a painting by Martin Johnson Heade—even an undiscovered one.”
Jack said, “Zero-days are big business. Remember that hacking competition I told you about at the conference? The money the winner of that competition got would be chump change compared to what a hacker could get for it on the open market. And that wasn’t a zero-day hack.”
“Open market?”
“Black market—or, technically gray market—would be a better term. All sorts of groups will pay for that type of information—criminal gangs, legitimate businesses, and even governments. In fact, governments are the number one client for these zero-day hacks.”
“Clients?” Zoe said. “That makes the whole thing sound kind of corporate.”
“Some of the interested parties are definitely corporate. Some businesses search out these vulnerabilities and then sell them to corporations and governments.”
“You don’t mean legitimate, publicly-known companies?” Zoe couldn’t keep the skepticism out of her voice.
“Yes, I do. Some of them even have venture capital funding.”
“That’s amazing.”
“And lucrative. But we don’t know if that’s what we have for sure.” Jack’s frowning gaze went back to the computer screen. “I’m still learning about all this stuff. We need an expert.”
“Fortunately, we know someone like that.”
Zoe pounced on the phone when it rang. Carla had not been in when Zoe called, and Zoe had to leave her a message, which left her feeling irritated and worried. She’d paced back and forth inside the tiny hotel room, wishing she had gone with Jack to do “a little shopping,” as he called it.
Carla’s voice, breezy and relaxed, came through the line. “Sorry I missed your call. I was at yoga.”
With her sunny smile and her golden blond hair, Carla was the opposite of what most people thought of when they heard the word hacker, but she was excellent at it. She refused to give Zoe the full story on how she’d made her living before she put on a white hat and went to work for major corporations that relied on her to check their cybersecurity.
Zoe gave Carla a quick summary, describing what had happened over the last day.
“Of course I’ll take a look,” Carla said. “You know I love stuff like this.”
“We’re not one hundred percent sure what it is.” Zoe switched the phone to her other ear. "It might be something…illegal or dangerous.”
“Even better.”
“Okay, well, in that case, Jack will be back any minute, and you can talk to him. He thinks it may be—”
“Don’t tell me what Jack thinks,” Carla said. “It’s better I go into it without any preconceived notions.”
Zoe heard the key in the lock of the hotel room door. “There’s Jack now. How do you want to look at the files? Do you want me to email them to you?”
She laughed. “You are an innocent at this stuff, aren’t you?”
“I think I should be offended,” Zoe said.
“Don’t be. You haven’t had a need to know this.”
“Until now.”
“You better put Jack on,” Carla said. “He’s brushing up on cybersecurity, isn’t he?”
“Yes, he can speak your language. Or at least a little bit of it.”
Jack tossed several plastic shopping bags on the bed, and Zoe handed the phone to him. “It’s Carla. She’s in to help us, but says she needs to talk to you.”
Jack said, “Hello, Carla.” He cut his gaze toward Zoe as he listened. “Yes, she does have a way of getting herself involved in…interesting situations.”
Zoe rolled her eyes. “It’s not my fault someone put that flash drive in a painting I was picking up.”
Jack smiled back at her, then his face turned serious as he said to Carla, “Okay, I’ll call you back i
n a moment.”
Zoe opened the shopping bags that Jack had tossed on the bed. “Three burner phones?”
“You can never have too many burner phones.”
A few minutes later, Jack used one of the new phones and called Carla. He tucked the phone next to his shoulder and hitched the rickety chair closer to the desk as he tapped on his computer. Jack’s conversation drifted into discussions about proxies, tunneling, secure areas, and other jargon with acronyms that Zoe didn’t follow.
Zoe paced a circuit around the room, her thoughts going to the many questions she didn’t have answers to. She’d been so wrapped up in figuring out what was going on that she hadn’t thought about why the flash drive had been in the frame. Was it to get it back to the States? To Thacker? His company focused on high-tech home security. Was it something for his business…? A look at a competitor’s technology or something groundbreaking that would give him an advantage in the market? But why would someone send digital information on a flash drive? Surely it could be sent through one of those secure connections, like the one Carla and Jack were using now.
Zoe walked to the window, and peeked through the slit in the curtains. The street below was empty, which should have made her feel better, but the knot of tension she felt didn’t ease.
Jack called to Zoe, “We have a verdict,” and put the phone on speaker. She let the curtain fall back into place.
All the teasing and lightness had gone out of Carla’s voice as she said, “You guys need to be extremely careful. This is dangerous. Zero-day stuff always is.”
Jack blew out a breath. “I thought that’s what it was.”
“But this one is really tantalizing—it’s for mobile devices,” Carla said and went on to name the top-of-the-line phone. “That’s like the holy grail. Criminal gangs would pay… I can’t even tell you how much.”
“And governments even more,” Jack said, his voice somber.
“Right. It would allow them to unlock any phone, anywhere, anytime. Passwords, credit card data, birthdates, internet browsing, phone calls, contact lists, you name it, they’d have access to it.”
“And we do everything on our phones now,” Jack said. “It would be complete access to someone’s life.”
“Stocks, investment portfolios, banking information,” Carla went on. “The possibilities are endless.”
They were all silent for a few seconds. Zoe felt as if a new weight had settled on her shoulders.
Carla’s voice came over the line again. “I don’t need to tell you again to be careful, do I?”
“No,” Jack said. “Already on it.”
“What will you do?” she asked.
Jack ran his hand over the back of his neck and shook his head. “I don’t know yet.”
“I can contact a friend, see if I can get in touch with a developer connected to the company,” Carla said, her voice tentative.
“Do that.”
“Okay, I’ll let you know.”
“Good. I’m going to destroy this phone,” Carla said. “I recommend you do the same for that one.”
“In five minutes,” Jack said, “this one won’t exist either.”
28
Jack headed for the door with the cell phone. “I’ll be right back.”
Zoe went back to her pacing routine until he returned, his hands empty. “It’s gone?”
“Yes.” He went to the bed and picked up one of the two remaining burner phones and removed it from the packaging. “See. Told you we’d need more than one.” He flashed a quick grin, which made the burden weighing on her seem not quite so bad. At least they were dealing with this together.
“I’ll always buy my burner phones in multi-packs,” Zoe said, then turned serious. “So Carla is trying to get in touch with the developer so we can give them the hack?”
“Yes.”
“You don’t think the police would do that?” Zoe sat down on the bed and removed the rest of the items from the shopping bag, several packages of flash drives along with lip balm in the identical brand that the flash drive was packaged in. “You know I’m a fan of doing things the unconventional way, but this seems like a situation where we should drop everything in the lap of the police and hightail it home—with the blue butterfly painting, of course.”
“So, full disclosure, except for the artwork.”
“Something like that.”
“It won’t work.” Jack switched on the phone, then went to work opening the next burner phone. “This is bigger than the local police, bigger than art theft.”
“Harrington would cringe at that description,” Zoe said. “Art theft is as bad as any other kind of theft.” They’d had many discussions about the sliding scale police forces used to prioritize their investigations. Resources usually went to solve crimes against people, not property. “So you think we should go bigger? What would that be?”
Jack worked to free the phone from the encasing plastic. “The embassy.”
Zoe was surprised. It wasn’t like Jack to suggest they go to his former employer for solutions. He knew firsthand how much red tape was involved in dealing with government agencies. “But you don’t like that idea either,” Zoe said. “I can tell from your tone.”
Jack tossed the second burner phone on the bed and sat down beside her. “Once we turn the zero-day over to anyone connected with any branch of government—the police here, the U.S. Embassy, whoever—it goes into a black hole. It will disappear. The government won’t contact the developers and let them know about the flaw so it can be fixed.”
“You’re saying they’ll exploit it for themselves.”
“Right. It will be another tool for spying on foreigners and maybe—probably—their own citizens.”
“Really? You think the government—our government—would do that?”
“I know they do. Just look at the leaks coming out of the NSA and the CIA. They’ll hack anything they can and keep the info about the vulnerability to themselves.”
“Then I hope Carla comes through with a contact for us.”
“I do, too.”
Wednesday
Carla’s call came late the next morning. “I’m sorry, guys. I tried everyone I could think of and no one will return my calls.”
“I guess it’s Plan B,” Zoe said. Jack gave a nod. They didn’t have to talk about it. They’d already rehashed their options for half the night and all of the morning.
A Metro ride and a short walk brought them to the U.S. Embassy, which was located in a blocky rectangular building that felt unimaginative and bland after the Neo-classical and Baroque architecture that Zoe had seen in Madrid.
“How are you doing? Still having second thoughts?” Zoe asked as the embassy came in sight. A soldier armed with an automatic weapon patrolled the sidewalk in front of the entrance, distracting her from noticing anything else about the building or neighborhood.
“More like fifth or sixth thoughts,” Jack said.
Zoe stopped walking. “We don’t have to keep the appointment, if you’re still worried.”
“No. We’ve been around and around on this. It’s too dangerous to keep it to ourselves.” Jack reached for her hand and they started walking again. “We have to at least float the idea that we have it, and see what their reaction is.”
Jack’s quasi-diplomatic background had come in handy. He’d made a call that morning to his friend Ash Hawker—“that is his real name,” Jack had sworn—who Jack had met years ago while working in Naples. Ash was now assigned to Madrid and had pulled some strings. Zoe and Jack had an appointment with Mr. Gerald V. Clement at two o’clock.
After making their way through several layers of security, Zoe and Jack finally reached Mr. Clement, who turned out to be a middle-aged man with thinning brown hair, a pallid complexion, and a stooped posture that stayed with him even when he stood, as if he spent so much time hunched over a keyboard that his body was permanently stuck in that position.
His hand shake was sweaty, and Zoe
had to resist the urge to dry her palm on the skirt of her dress as she and Jack took their seats in the narrow space allotted for two chairs, their backs pressed against the fabric cubicle wall. A gold nameplate sat at the edge of Mr. Clement’s desk facing them. It was the only impressive thing in the tiny space.
He turned and positioned his hands on his keyboard as he asked in a voice only slightly louder than a whisper, “Now, which one of you has lost your passport?”
Zoe and Jack exchanged a glance, then Jack said, “I think there’s been a misunderstanding.”
“Oh, you’ve both lost your passports.” He made a tsking sound and began typing. “It does happen occasionally. Most unfortunate…”
Jack spoke over the clatter of the keyboard. “Neither one of us has lost a passport. I think Zoe should tell you what’s happened. She’s had a bit of trouble here in Madrid.”
Mr. Clement turned back to them and reached for a pen, which he knocked off the desk. He bent, disappearing for a moment, then popped back up. “Trouble?” he asked in his soft voice. “To do with your passport?”
“No, it’s about a painting,” Zoe said. “I arrived in Madrid on behalf of Mr. Fredrick Thacker, who was interested in a painting that was for sale at the Cabello Gallery. The painting was authenticated on Monday, and I arranged to pick it up the next day—”
The phone on Mr. Clement’s desk rang. He held up a finger. “One moment, please.” He answered in his quiet tone, then listened a moment. “But I emailed it last week…” He twisted his chair to his computer and opened his email program.
The conversation went on for a few moments. Jack said to Zoe in a low voice, “Not what I expected. Maybe I don’t have quite the same pull with the embassy that I thought I did.”
“Maybe it’s your friend Ash who doesn’t have the pull—”
“Sorry about that.” Mr. Clement replaced the receiver and clasped his hands together, his gaze fixed on Zoe. “You were saying?”
“When I went to pick up the painting at the gallery—”
The phone rang again. Mr. Clement held up his finger. “One moment, please.” He listened. “Right, yes… Well, here, I can tell you.” He swiveled to his computer again.