The Ethan Galaal Series: Books 1 - 3

by Isaac Hooke

  "Yes, it does," Bretta agreed. "Which is why I trained for months in virtual reality and live fire shoot houses, too. But my training wasn't all weapons. She'd give me specific real-world tasks, like in a mall I'd have to approach ten random people, one at a time, and borrow their cellphones, surreptitiously replacing the devices with a matching model from a stash of phones I kept inside my jacket. If someone noticed the switch, she'd make me approach another ten. It was like kidon training all over again, but with less emphasis on seduction."

  "So what happened?" Ethan pressed.

  "When she considered me ready, Sam offered me a position in her outfit. Said the best place for me to enact vengeance was with her. She promised me that she had access to cells and information that the Mossad could only dream of. Her only condition was that I abandon the Houthi cell.

  "I was taken aback. Stunned. I reminded her of the vengeance she had promised me, and her only response was that it would come, in time. I turned her down and returned to the Houthis. I didn't inform the other field officers, of course, but they would have known I was back, given the surveillance they were performing on the house. My husband reluctantly allowed me to stay in his residence, but he had already taken another wife in my absence, even though in theory he needed permission from me, the first wife. But that was good because I no longer had to share his bed.

  "I waited, biding my time, until my husband gathered the cell for a meeting one day. They assembled in his family room, mostly to debate the meaning of various hadiths and passages from the Quran while they chewed their qat and burned their incense and dined on chicken and rice. In the middle of the evening, growing weary of their religious talk, I struck. I had no evidence, nothing to prove what they were planning, other than rumors and innuendo. But I killed them all."

  She paused for a moment. "I fled the scene immediately and called Sam from the Yemen Mall. I told her what I had done. She revealed that not only had I eliminated a cell without gathering proper intel, I had killed one of her low-level assets who had been in attendance. She told me I could never work for her, not anymore. She had no use for operatives who couldn't function objectively, she said. Operatives who allowed themselves to be blinded by vengeance.

  "When I called my boss at the kidon he was furious. He told me I was supposed to have abandoned the country months ago after the beating. He commanded me to report to the other officers in Sana'a for immediate recall. He said I was too unstable for the field, and that after the psychiatrists were through examining me, I'd be lucky to have a job. I told him to go to hell."

  "He didn't take that too well I'm guessing," Ethan said.

  "No. He promised to send kidon officers to hunt me down, probably the very same men I had worked with. I don't know how they found me, but they did. I was walking through the cramped streets of Sana'a's Old City, making my way home. I heard the muezzin's call to prayer and as if on cue masked kidon gunmen pulled up in a Toyota Hilux and tried to abduct me.

  "But Sam rescued me. She must have been watching me for some time, because her team immediately surrounded the gunmen. Both sides pointed assault rifles at one another. A five-way Mexican standoff. Sam entered the deadly circle alone and led me out. I jumped in her black hatchback and we drove away."

  "She forgave you? After you killed one of her assets?"

  "No. She made that clear. But she did tell me a story of a young woman much like myself who had once been sent to infiltrate a terrorist cell. A young woman who was similarly beaten and left for dead. A woman who returned to her oppressors and systematically hunted them down, one by one, without mercy."

  "That woman was Sam, wasn't it?"

  Bretta pressed her lips together, hard. "She never said, but I'm fairly sure it was. She told me it was partially her fault for not warning me she had an asset embedded in the Houthi cell. She also told me she hated to see such potential go to waste, especially when she had invested so much time in me. She agreed to hire me on a trial basis, try me out on some smaller operations. If I proved myself she might consider taking me on full-time."

  "And here you are today."

  "Here I am," Bretta agreed. "Told you it was a long story." She slid a spoonful of pâté into her mouth.

  "So what about the Israelis? Did they give up hunting you?"

  "There were a few more close calls in the early days, but for the past eight years, I haven't heard a whisper out of the kidon. I think they might have actually given up. Bigger fish, and all that. Maybe Sam threatened them." She stared off into space. "You know what the worst of it is? I can never visit my family in Israel ever again. Nor even contact them. They're under observation, I'm sure of it." She wrapped her fingers around the silver angel wing she wore at her neck. "My little sister gave this to me. I'll never see her again."

  "Sorry to hear that."

  "Don't be. This was my choice."

  Ethan nodded. "We all make our choices."

  "We do." She paused. "It's funny. I don't know what Sam saw in me back then. I was a lost, beaten-down, angry soul. The idealistic little girl who wanted to make a difference in the world was long dead. But she took me in."

  "Like you said, she saw herself in you."

  Bretta pursed her lips. "I guess so."

  "You have to give her credit, Sam does have a penchant for spotting potential. She hired me, after all." Ethan smiled widely.

  Bretta ignored the quip. She remained silent for a moment. "She's like a mother to me."

  Ethan nodded. "I think most of us who work for her have similar feelings. For me, she's the big sister I never had. When she hired me, I was in a dark, dark place. She got me out. Gave me hope. Purpose. She turned us into finely-honed weapons, you and I. Sharp, precise blades. We excise the bad from the world, leaving the good in place."

  "We do," Bretta said. "Still, sometimes I wonder. I've been through enough to know by now that good and bad are only a matter of perspective. The men we fight, they believe we are the bad ones. How do we know they're not right?"

  Ethan cut away a chunk of chicken from his dish. He chewed it, gathering his thoughts for a moment. "Our government has launched unmanned drone strikes that kill innocents. It has organized hunter killer raids on civilian villages. It has enacted foreign policies that destabilize entire regions. Some of those actions were mistakes, others intentional. Those are our dark days, the times when we're the bad ones, even though in the end we're only trying to protect ourselves.

  "Still, the bad things we do are overshadowed by the misdeeds of the enemy. When you have men performing ethnic cleansing in the name of religion, and planning terrorist attacks to kill thousands of civilians worldwide, it's pretty clear to me who's on the side of good and who's on the side of evil."

  Bretta forced a smile. "Will the world ever know peace?"

  Ethan shrugged. "As long as there are men who have something others want, there will always be wars."

  18

  In addition to the drones, Ethan had other intelligence gathering methods at his disposal. One was the use of a laser microphone. Each morning, he stepped to the edge of the tree coverage and erected a tripod, affixing the laser mic to the mounting plate. With the help of a built-in range finder, he bounced the laser off the distant windows of the winery outbuilding. The glass panes served as an acoustical diaphragm—the varying air pressure from any sound waves would impart vibrations onto the window, which the laser would detect and convert back into sound.

  After three days, the laser microphone finally picked up muted conversation at a time when the caretaker was definitely not inside. Though Ethan couldn't hear what was said, nor the language used, he confirmed that at least two people were living in the winery, probably a man and a woman, judging from the vocal ranges.

  The support team gave them some other spy tools. Law enforcement credentials and badges. A portable police light and siren. A cellphone signal blocker. A radio scanner. A Stingray. The scanner allowed Ethan and Bretta to listen in to any unencrypted radio ca
lls, but they caught only the occasional French trucker: the usage of CB radios was still surprisingly popular among that lot. The Stingray, on the other hand, emulated a cellphone tower, and allowed them to spy on cellphone calls and data. Since it collected data from all phones nearby, in crowded areas and cities it was useless without knowing what serial number to hone in on. But in a place like this, with only a few neighbors and passing cars, the usage was ideal.

  The Stingray worked by exploiting a vulnerability in the 2G protocol, as GSM didn't require authentication with the base station in cellphone towers. By jamming the 3G and 4G networks, the Stingray forced the cellphones to downgrade to 2G. It worked great in the countries Ethan usually operated in, where 2G was the best signal the residents could hope for. But in First World countries, they had to use the device with care so as to not disrupt the service of too many cellphone users, which would flag their presence to the phone provider, and potentially the local intelligence agency.

  The Stingray could also send exploits to a cellphone's baseband device, which was a dedicated ARM processor that managed the antenna. Since radio functionality was timing-dependent, the baseband processor utilized a small realtime operating system, or RTOS, that ran separately from the main OS, be it Android, iOS, or PalmOS. The RTOS was stored in firmware and loaded at phone startup. With some cellphones, the Stingray could issue certain exploits to the baseband processor, allowing Ethan to flash the firmware with a stealth version of the RTOS that converted the phone into a remote microphone. The firmware flash capability had worked great in the past, but phones weren't as susceptible these days—telecommunications vendors had patched many of the bugs. Well, there would always be new exploits: the NSA had an entire team of software engineers whose sole task was to search for zero-day exploits in the various baseband devices out there.

  Lastly, the Stingray could be used to disrupt cellphone communication entirely, by setting the jammers to outpunch all provider frequencies, including 2G, disabling every phone in the area. When a more localized disruption was desired, ordinary cellphone signal blockers were preferred, at least by Ethan.

  With the Stingray, Ethan picked up roughly five to eight cellphones in the vicinity at any given time. He instructed Bretta to drive further along the rural road, and then took another measurement. Some of the serial numbers representing the different phones dropped out, new ones appeared, others remained constant. After five more measurements at different locations on the road surrounding the estate, Ethan was able to triangulate the location of a cellphone operating inside the main chateau. Unfortunately, the caretaker didn't use his phone very much, and when he did, he called his mother in Bergerac to the northeast. Ethan sent the suite of baseband exploits to the phone, but none of them stuck.

  Ethan also had another Stingray for sat-phones, and the functionality was similar to the cellphone version. With it he determined that a satellite Internet device was running in the winery. Unfortunately, all the data sent by that device was encrypted. He searched the rooftop carefully with the Hornet, but hadn't been able to pick-out any satellite antennas among the slate tiles. He tried sending along similar exploits crafted for satellite baseband processors, but none of them executed.

  Sam reported that her people had found a backdoor in the remotely-configurable Cisco routers that provided the DSL data and digital voice feeds for the estates. She sent techs down to open up the interface boxes on the utility poles beside each vineyard to identify the proper lines for the exploit. When they were finished, she was able to monitor the Internet and voice data of every estate, without leaving behind any physical evidence of wiretapping. She had once again bypassed the local gendarmerie.

  For Ethan's particular vineyard, Château Couleurs Du Vin, Sam reported that the caretaker was obsessed with Internet weather sites, and checked them multiple times a day, apparently looking for the best time to harvest. He also browsed viticulture and winemaking forums, and posted occasionally, usually to brag about his knowledge of wine production. He accessed three encrypted sites: the destination IPs mapped to Facebook, Gmail, and Netflix.

  Sam had her contacts at Gmail and Facebook send daily data dumps of the respective accounts. They found emails of minor importance, online order receipts for groceries and Netflix, spam, some messages to his mother in Bergerac and ex-wife in Bordeaux, and various wine-related mailing lists he subscribed to.

  Sam executed social media connection analysis software against his Facebook account. The caretaker didn't have any "friends" with suspicious Arabic names, nor was he a part of any jihadist fan pages. The Facebook data revealed his full name, of course, and with it Sam pulled his credit card history. Nothing stood out.

  The caretaker continued to send supplies to and retrieve garbage from the winery outbuilding. Ethan and Bretta still hadn't seen anyone else emerge from there. Growing frustrated, Ethan finally asked Sam for permission to sneak into the winery outbuilding and plant surveillance devices. He knew it was risky, especially since the occupants never left the place, but Sam said no: she wanted to be sure they had the right vineyard first.

  "Anyone could be in there," she told him. "Migrant squatters. A refugee family. The caretaker could be harboring them without the owner's consent."

  "Why would the caretaker buy migrant squatters satellite Internet access?" Ethan asked.

  "I don't know," Sam said. "But leave the winery outbuilding alone for now."

  "You're willing to break local surveillance laws, and yet you won't let me target the most obvious hideout."

  "Listen," Sam said. "That we're breaking the law is precisely why I don't want you to go rushing into this headfirst. We have to tread carefully. Maybe there are terrorists inside, maybe not. If we're caught breaking and entering at any of the vineyards, and the local police are called in, we're going to have to step way back. And that's not something I'm prepared to risk at the moment."

  "Maybe we should have involved the police in the first place," Ethan grumbled.

  Sam eventually relented, giving him and the other teams permission to install listening devices in the associated vineyards. The rule was, they had to do it during the day, without sneaking onto the properties, and without breaking in. While it wasn't what Ethan wanted, it was better than nothing. A first step, anyway.

  The support teams sent a French-speaking operative to visit each vineyard in turn. He played a real estate agent who pretended to have a client interested in buying the property. The operative carried covert listening devices in his briefcase and intended to plant them, but at most of the vineyards, including Ethan's, the operative was turned away at the door.

  Ethan asked Sam for permission to install a listening device at the Château Couleurs Du Vin vineyard himself. Surprisingly, she said yes. He needed an excuse to get into the chateau, and potentially the winery outbuilding, so she had her people turn off the DSL and phone network access using the remote exploit.

  The next day, Ethan arrived at the chateau in an Opel Movano van plastered with fake Orange S.A. telecom logos. Dressed in the blue coveralls of a phone technician, he knocked on the front door.

  The mustached French caretaker answered. He wore his usual denim work shirt and suspender pants.

  "I'm from Orange," Ethan said in poor French.

  "Sacrebleu! About time. I pay good money for my Internet service, and I expect it to work!"

  The Frenchman led him inside, past the cloakroom, dining room, and a lounge that opened onto a terrace overlooking the vineyard, stopping inside a small den. A computer sat on a desk, alongside an Orange Livebox DSL modem/router combination.

  Ethan pretended to test the line, then asked the caretaker to bring him to the basement. The Frenchman led him downstairs, past a bar, small gym, wine cellar and laundry room. He stopped inside the boiler room.

  "Here is the phone box," the Frenchman said, then left him to work.

  When the man had gone, Ethan opened his toolkit and planted tiny, voice-activated listening devices throug
hout the basement area. He chose inconspicuous locations: under a bar stool, above a squat rack, and so forth.

  When that was done he returned upstairs and placed more devices. He found the caretaker waiting in the kitchen, and surreptitiously planted another listener underneath the edge of the granite counter top.

  "Finished," Ethan said in his terrible French. "But I need to upgrade your Livebox." When the man regarded him suspiciously, Ethan added: "It will improve performance."

  Ethan took the official Orange Livebox modem/router and plugged in the new device, which looked exactly the same as the old one, complete with "Livebox" lettering. It contained a voice-activated listening device inside, as well as a remotely-accessible internal hard-drive that backed up all Internet data.

  He called Sam on the sat-phone and spoke a few inconspicuous French codewords. A moment later her people remotely reactivated the phone line via the hacked router.

  Ethan showed the caretaker that the phone and Internet were now working, and he gave him a number to call in case of difficulties, which would ring support team Six-Blue based out of France.

  He also left behind an official-looking thumb drive, complete with Orange S.A. logo, and told the Frenchman it included free productivity software. The thumb drive contained the Regin malware, which would execute as soon as plugged in, allowing the NSA to spy on every item of data that was sent on that computer and any other machines on the same network. Installing Regin might have been overkill, considering that they already had the wiretap on the DSL Cisco router, and backup logging taking place inside the fake Livebox, but it never hurt to have redundancies in case of failure. Besides, with Regin in place, if anyone ever tried to run I2P, the NSA, and hence Sam, would be able to read everything that was sent.