Last Breath

by Michael Prescott

  She hoisted herself all the way out, into a corner room with two windows letting in the moonlight.

  Knelt for a moment, wheezing, fighting for air until her lungs were clear and she could raise her head and see where she was.

  It was a kitchen. A break room, more accurately, for the benefit of the office workers who would inhabit this building. Sink, dishwasher, counter space. The floor was parquet, lustrous in the moonlight, a small touch of elegance that explained the plywood subfloor. Parquet flooring on a concrete base would absorb moisture from the stone, then buckle and fail. Another thing the building inspector had told her.

  She struggled to her feet, unlocked a window and raised it. An alarm went off. Every building in the complex must be wired. It was okay. Adam already knew she was inside.

  She glanced again at the floor—so shiny—then at two cans with hinged metal handles resting in a corner. She sniffed them both, then picked up the second one and hauled it through the window as she climbed out.

  Adam was coming. She could see the brightening glow of the BMW’s headlights.

  She ran, lugging the can. It was heavy, gallon-sized, and it slowed her down, but she would not abandon it.

  It might be just what she needed to turn this battle in her favor—and give her ex-husband a very nasty surprise.

  51

  “So how do we get in?” Brand asked, pacing the office while a cold wind howled and bleated outside. “We don’t have time for a low-and-slow, and if we bombard them, they’ll get their guard up right away.”

  “I know,” Rawls said, staring at the homepage of the cellular phone company whose server he had to break into.

  There were two obvious methods of testing a company’s perimeter defenses. Low-and-slow port scanning was one way. Data packets, small enough to be missed by most intrusion-detection software, were sent to the corporate network over a period of days. Entry was accomplished by flying under the radar and taking a long time—low and slow. Eventually all open ports would be identified, and a skilled hacker could map the network.

  The alternative was to bombard the target with data packets—an NMap FIN scan, in hacker argot. There was nothing slow about this approach, but unfortunately it wasn’t clandestine either. An all-out scanning attack would trigger an immediate security alert.

  Rawls needed to get in fast but surreptitiously. Tall order, but there was always a way.

  His fingers moved across his keyboard and pulled up a program that allowed him to launch a null session—a NetBIOS connection established with a blank user name and password. A null session could get him into any vulnerable server and allow him to read some of its contents.

  “You can’t get to Nolan’s account that way,” Brand said, watching over his shoulder.

  “I’m aware of that, Ned.” Rawls heard testiness in his own voice. Well, it was after 2:00 A.M. He had a right to be testy.

  The null session got him into the corporate server and gave him read-only access to the registry. “They’re running NT 4.0,” he said, “service pack five, option pack four.”

  “Outdated,” Brand observed.

  “That’s what I was hoping for. You remember the problem with this build of NT?”

  “There were lots of problems.”

  “The big one.”

  “You mean the i-i-s-hack thing?”

  “You got it.”

  “There’s been a patch for that since last year.”

  “But if the sysadmin hasn’t upgraded his OS, he may not have kept current on the patches either.” Rawls was already searching his hard drive for a file named “ncx.exe.” He uploaded it to the Baltimore field office’s Web site, then typed a telnet command, sending a 500-byte file—a small program called “iis-hack”—to port 80 of the cell-phone company’s Web server. The port was open, as it had to be in order to receive Internet traffic. The question was: Would it run the program, or had the server been upgraded with a security patch that would reject the file?

  “No way they didn’t patch it,” Brand said.

  “There are hundreds of holes in NT,” Rawls countered. “No one can patch them all.”

  “Don’t even need a patch, really. Sysadmin just has to disable script mapping for .HTR files.”

  “Well, let’s hope he didn’t.”

  They waited. The “iishack” program would instruct the server to find the “ncx.exe” file at the Baltimore field office’s URL. It would take a couple of minutes for the file to be downloaded and run. Or the request might already have been denied.

  When two and a half minutes had passed according to Rawls’s wristwatch, he entered a new telnet command and reconnected with port 80 of the victim server.

  “Moment of truth,” Brand said, leaning closer to the screen.

  The corporate homepage vanished, replaced by a black screen with the copyright notice for Windows NT. Below it flashed a DOS prompt.

  “We’re in,” Rawls breathed. The flickering C: looked beautiful to him.

  He was past the firewall. He had access to the corporate server.

  Quickly he scrolled through the directory, then went to accounts, entering the Read command followed by Adam Nolan’s account number, which was probably the filename.

  A request for log-on identification came up.

  “Shit.” Brand sighed. “I guess their security’s not as lame as I thought.”

  “We can crack it.” Rawls returned to the directory and located a list of user names. No passwords were shown, but he didn’t think he’d need one. He scanned the list until he found the user name backup. He tapped it with his fingertip. “Sounds like a back door.”

  Brand agreed. “Give it a shot.”

  Back doors were simple means of access left in place by maintenance and diagnostic personnel who didn’t want to be bothered with memorizing complicated user IDs and passwords. Often they left the manufacturer’s default settings intact. Even when they modified the settings, the changes were usually easy to guess.

  Rawls went back into Accounts and typed the user name backup. A password request came up. He retyped backup. He knew how a lazy person’s mind worked. It was easier to remember one word than two.

  A moment later the screen filled with lines of text. Adam Nolan’s account in detail.

  “Man, you are on a roll,” Brand exulted.

  The most recent cell-phone activity came at the end of the list. Nolan’s last call began at 19:54 Pacific Standard Time and continued for three minutes twenty-three seconds. The terminal cell site was given as a string of figures—the cell tower’s latitude and longitude.

  Rawls wrote down the numbers, then stood and pulled out his cell phone. “I’m calling LA. Can you clean up?”

  “No prob,” Brand said, settling into Rawls’s seat.

  Rawls pressed redial and heard the long-distance call go through. Behind him, Brand went about the business of covering their tracks. He would schedule the deletion of the ncx.exe file from the phone company’s server, and for good measure he would go into the server’s log file and erase all references to the intrusion. He would delete “ncx.exe” from the field office’s Web site, as well. It wouldn’t be a good idea for anyone to find it, since what Rawls and Brand had just done was highly illegal.

  “Walsh.” The familiar voice from three thousand miles away.

  “We’ve got the cell site.”

  “This fast?”

  “What can I tell you, Morrie? We’re bona fide federal agents. We’re the best of the best.”

  52

  In the farthest corner of the office park, C.J. found the warehouse.

  It was a large metal shell of a building with hangar doors and two smaller doors, all padlocked. Cut into the side wall was a casement window four feet square—intended, presumably, for ventilation.

  She peered at the window, looking for evidence of security wiring—a magnetic contact sensor or a sound-activated glass-break detector. In the dim light, with the moon hidden behind the roof of t
he warehouse, she found it hard to be sure.

  There.

  Strands of wire, barely wider than individual hairs, ran up the sides of the glass and connected to small black nodules.

  Pressure sensors.

  Break the glass, and the alarm would go off, even before she had a chance to reach inside.

  Well, that was all right. Might even be helpful, in fact. The noise of the alarm would add to the confusion and urgency she was counting on.

  The window faced an alley that ran between the warehouse and the complex’s perimeter fence. Fig trees grew outside the fence, and their leaves, shed in winter, had blown over the loops of razor wire to lie in dry drifts along the alley. C.J. knelt and touched them, heard them crackle under her fingers.

  Perfect.

  Elsewhere in the complex, the two alarms—one from each building she had violated—must still be ringing, though she couldn’t hear them from this distance. Couldn’t hear the BMW’s engine either, but she knew the car was out there, circling like a shark, trolling for its prey.

  Adam would find her before long.

  She kicked the leaves into a thicker pile not far from the window, making a nice firm bed. It was all part of her plan—a dangerous plan, but she would risk it. She was through hiding. She had wriggled into her last crawl space. She had played the victim long enough. Now it was time to go on offense.

  Adam thought she was weak. Well, let him find out how weak she was.

  She expelled a breath of pure rage and saw it turn to frost in the night air, chillier than before.

  He had tried to fumigate her, for God’s sake. Like a cockroach.

  Even now he must think he had her trapped. She couldn’t escape the office park, couldn’t enter any buildings without setting off an alarm, couldn’t hide outside because there was too little cover.

  Couldn’t run. Couldn’t hide.

  But she could fight. That was the one thing he hadn’t counted on.

  She knelt and pried off the lid of the one-gallon can she’d swiped, using a sharp stick for leverage. Slowly she swirled the can’s contents.

  “I’m going to win this game, Adam,” she whispered. “And you—you son of a bitch—you’re going down.”

  53

  The distance from Brentwood to the Santa Monica Municipal Airport was two miles, a trip that normally took about fifteen minutes in the congested streets. The police convoy made it in five, with Tanner in the lead, flashing the light bar of his squad car and blaring the siren.

  He pulled into the airport parking lot just as the big Sikorsky helicopter was setting down on the helipad. The Sikorsky was one of four U.S. Navy SH-3H Sea Kings recently purchased by the Sheriff’s Department, three of which had been adapted for search and rescue operations. Most of the time, this meant carrying paramedics to remote locations, but occasionally it was a Sheriff’s SWAT team that took the ride.

  Tonight was one of those times. A SWAT squad led by Deputy Garrett Pardon was already forming up. The Sikorsky, which had flown north from the department’s Aero Bureau station in Long Beach, would head to a county airfield east of downtown LA, which would serve as the rendezvous point.

  Tanner wasn’t part of Pardon’s squad, but he figured Pardon wouldn’t object to another man on the job. And if he did, to hell with him. Tanner had come this far, and he wasn’t bugging out now.

  He waved the LAPD detectives—Walsh and Cellini, and the two others whose names he hadn’t caught—out of their unmarked cars and led them across the asphalt to the chopper. The air crew hailed him when he climbed aboard.

  “Hear we’re lookin’ for a bad guy,” the pilot yelled over the thrum of the motor.

  Tanner nodded. “Near San Dimas. Got a cell site and that’s all.”

  “Cell tower in that part of the county could cover a lot of territory.”

  “That’s why we need to be airborne. For the bird’s-eye view.” And for speed, Tanner added silently. There was no faster way to cover the thirty-seven miles from the Westside to San Dimas than by air.

  The chopper’s interior had been stripped down for medevac use, and the only seats were benches along the walls. Walsh and the others took their seats, and instantly the Sikorsky was under way, floating upward as the land diminished to a checkerboard of lights. Tanner saw that the Sea King was equipped with a video display screen that showed its current location, tracked via GPS, superimposed over a moving topological map. Heading and distance were displayed on the screen in digital readouts. There would be a FLIR display as well—Forward Looking Infrared, which picked up the heat signatures of vehicles and even persons, showing them on the video screen.

  If Adam Nolan was there, they would spot him. And C.J. too—if she was alive.

  Tanner shifted restlessly. The Sikorsky was flying fast, but maybe not fast enough.

  He thought of the slick blond man in the lobby of the Newton station house, the guy who dressed like a young lawyer and conveyed a lawyer’s phony charm, and he wondered if the fucker was murdering C.J. right now, at this minute.

  “Hang on, Killer,” he breathed, talking to her across the miles. “Cavalry’s coming.”

  54

  Adam had to admit that he was now seriously ticked off.

  He’d thought for sure the exhaust fumes would get her. Instead she was still on the loose, and time was passing. It was already 11:35—much too late. His only consolation was that his cell phone hadn’t buzzed. The police hadn’t tried calling him yet.

  His luck couldn’t hold much longer. He had to find her, kill her. Had to win.

  “Nobody fucks with me. Nobody makes me their bitch....”

  He steered the BMW past the padlocked gate, circling the front of the complex. His car windows were down to let in the cool night air and the sound of a new alarm, if one should ring. When the office park was finished, the security system would be linked to a monitoring station in San Dimas, but either the telephone hookup had never been established or it had been disconnected when the project fell into limbo. Roger Eastman hadn’t been clear on the details when Adam quizzed him over drinks, but he had been lucid enough on the one point that mattered—the alarm would not draw a crowd.

  At the time Adam had been worried that he himself might inadvertently trip the system. It hadn’t even occurred to him that C.J. could get loose.

  The BMW motored along the south side of the office complex, its high beams searching the night. He stared through the web of fractures in his windshield, looking for any hint of a human figure.

  He had underestimated her, he supposed. Probably he should have killed her right away, while she was chloroformed and unconscious. Would have been simpler that way. Nothing would have gone wrong.

  But he’d wanted to let the full four hours pass. Wanted to match the Hourglass Killer’s MO.

  And there had been more to it, hadn’t there?

  He reached the rear of the office park and guided the coupe among a checkerboard of poured foundations. The only building back here was a warehouse occupying the northeast corner.

  Yes, there had been more than simple practicality. Even leaving aside the serial killer’s MO, he’d wanted to see her squirm and sweat as long as possible, wanted her to feel the bottomless fear of true helplessness, and most of all, he’d wanted her to be awake and alert when he caressed her neck and the caress became a strangling squeeze....

  He still wanted it, all of it. Still wanted to choke off her last breath while staring into her frightened green eyes.

  Except somehow that no longer seemed good enough, satisfying enough, did it? She had injured him, humiliated him, outmaneuvered him. She had put him through hell, and now he wanted her to find out what hell felt like.

  He cruised past the big front doors and the alley on the side, still looking into every shadow.

  The Hourglass Killer didn’t torture his victims. But maybe it was time to risk playing a little fast and loose with the MO. Make her suffer a little more ...

  He’d pi
cked up some ideas from those S & M Web sites he’d visited. He might put some of them into practice—

  There.

  In the alley. Movement.

  He spun the wheel, the BMW’s high beams cutting through the shadows, and yes, there she was, retreating at a run down the strip of grass between the warehouse and the fence.

  She’d taken cover there. Wrong move, C.J.

  He gunned the motor. The tires kicked up a spray of dirt as the coupe accelerated, barreling into the alley, closing in on his prey. C.J.’s lithe figure came into focus in the halogen glare, blond hair bobbing on her shoulders, arms and legs pumping. She still had a nice tight ass, he noticed, with a distant memory of cupping his hands over her buttocks and feeling their lean muscular strength.

  He stamped harder on the gas pedal, and then C.J. sprinted to her right and picked up something that looked like a paint can, flinging it with both hands.

  He hit the brakes, expecting the can to shatter the windshield.

  But it wasn’t aimed at the car. It flew through the side window of the warehouse, setting off a new alarm. C.J. scrambled through the window frame and disappeared into the darkness within.

  Adam parked the BMW near the window. He left the lights on, engine idling, as he prepared for the endgame.

  She was finished now. The warehouse, as he’d noted on his reconnaissance missions to the office park, had only this one window. Its remaining means of access were two huge doors and two smaller ones, all securely padlocked.

  C.J. was cornered. He could track her down and then do whatever he liked with her and make it last a good long time.

  With a smile he removed a flashlight from the glove compartment, then pushed open the car door and limped down the alley, his shoes crunching on dry leaves.

  With the flashlight to guide him, finding her shouldn’t be hard. The warehouse was big—sixty thousand square feet, by his estimate—but it would be empty. No hiding places, no crawl space, only an open floor penned in by metal walls under a high metal roof.