“OK can you do that ASAP?”
“We have to. Let’s take that server out of use right away.”
“Okay and then when you’ve done that, run another comparison between the restored crime-scene sample and both reference samples: that’s Elias Claymore and Louis Manning.”
“Will do.”
Greenberg was about to say more, when he suddenly remembered the airhead who had phoned up a few days ago. He hadn’t told her the password. All he had told her was that it was his mother’s maiden name. But he hadn’t told her what that was. He had been hoping that she would call him back after she phoned during the day and asked one of his colleagues all those questions about him. They had teased him mercilessly about that afterwards.
She had asked about his age and his eyes and his zodiac sign!
He realized what had happened. She had “social engineered” him – and one of his colleagues. Once she had his birth details it would have been no problem to find out his mother’s maiden name. But she had sounded so dumb on the phone.
An act of course!
How could I have been so stupid?
He tried to put it out of his mind as he looked at the file allocation table. Then he remembered something else.
“Dr Alvarez, I noticed that there are also extra reference samples file for Elias Claymore, Bethel Newton and Louis Manning. According to the properties, these are mitochondrial DNA profiles.”
“Yes that’s right. We do mitochondrial DNA profiles on reference samples as a matter of course. But we decided to use Y-STR on the evidence samples.”
“And you haven’t got any more evidence samples?”
Alvarez thought for a moment.
“Let me just check.”
He typed in something at his own computer and smiled.
“Oh I’m wrong. There’s another nail sample – the thumb of the victim’s other hand.”
Greenberg smiled.
“Well maybe it would be a good idea if addition to the new Y-STR test we also do a mitochondrial DNA profile on that last piece of evidence – just to cover all the bases, ‘scuse the pun?”
Alvarez smiled.
“That’s a good idea. I’ll get right on it.”
Tuesday, 1 September 2009 – 6:45
Andi was sleeping in her hotel room in San Francisco, or at least trying to. It had been a sleepless night as she had tossed and turned, after yesterday’s events in court. She had been expecting to call Gene as a hostile witness, but that had all been postponed till Wednesday. So all Andi could do was worry. She had finally managed to fall asleep in the wee hours of the morning. But the silent peace of her early morning slumber was not to last long. It was shattered by a heavy pounding on the door. Squinting against the dawn light, she staggered downstairs to answer, and looked through the spy-hole to see several police officers.
What on earth was going on?
“Yes?” she shouted through the door.
“FBI, ma’am! Would you mind opening the door?”
She opened the door in haste.
“Special Agent Caine Ma’am,” he said, flashing a badge in her face. “Are you Andromeda Phoenix?”
“Yes,” she replied hesitantly.
“I have a warrant for your arrest,” he said, holding out the warrant, “and another to search these premises.”
“Arrest? What’s the charge?”
“Illegally, accessing a government computer without authorization.”
Tuesday, 1 September 2009 – 10:35
“Your Honor,” said the diminutive but feisty lawyer, “my client is a man of limited means but has strong roots in this community where he has lived for twenty seven years.”
Andi was sitting with a group of other unrelated defendants in a crowded District Court, along with dozens of other defendants. She felt uncomfortable with Alex sitting next to her, yet comforted that he was there. It was embarrassing to feel that she needed his assistance, yet reassuring that he had dropped everything else he had to deal with – at a moment’s notice – to come to her aid.
There were also quite a few journalists milling around. Usually an arraignment court isn’t a particularly newsworthy venue. But some one had tipped off the press about the celebrity defendant and so there were a lot of reporters, packed in along with the usual suspects and the low-life shysters looking an easy fee – “court-house leaches,” Alex called them.
“Bail is set at fifteen hundred dollars,” said the arraignment judge. “Next!”
Andi and Alex were signaled to step forward by a bailiff. When Andi took her place before the judge, Alex went with her.
“Case 08-31-09-2346, United States versus Andromeda Phoenix,” said the clerk, rattling if off like a machine-gun. “US Code, Title 18, Part I, Chapter 47, Section 1030, Paragraph 2, Clause C, Unauthorized access to a computer used in interstate communication, one count. No priors.”
“Is the defendant represented by counsel?”
“Yes your Honor,” said Alex. “Alex Sedaka. I appear on behalf of Miss Phoenix and my client pleads Not Guilty.”
“Does the prosecution oppose bail?”
“No Your Honor. The accused has no priors and strong domestic and professional roots in the community. Therefore the prosecution does not see her as a flight risk.”
The duty prosecutor knew that she would make bail regardless. Although Andi had been living in the community for less than three months, it was now her home and she had an unblemished record.
The US Attorney in charge of the case would probably offer her a plea-bargain on the lines of probation and maybe community service – teaching computer skills to disadvantaged kids. She wasn’t really a threat to anyone. As far as he could tell she had just got overzealous trying to get information to help her client.
“Your Honor,” said Alex, “in view of the prosecution’s favorable statement, I would ask the court to release the accused on her own recognizance.”
“Any objection from the government?”
“No, Your Honor.”
“In that case the defendant is released on her own recognizance. I’ll set the pre-trial thirty days from now. Hopefully the three of you should be able to work something out by then.”
This was a coded suggestion from the judge that they should agree on a plea bargain.
Andi and Alex were led away by a bailiff to a Clerk to get the paper work sorted out. Later, a horde of news-hungry reporters swarmed around them as they left the Ronald V. Dellums Federal Building – actually two buildings nicknamed the “Madonna Buildings” because from above their pyramid-shaped roofs were vaguely reminiscent of the singer/actress’s pointy bras of the late nineteen eighties. The building, which housed, amongst other things, the Oakland Division of the US District Court, Northern California District, consisted of two 18-story towers interlinked at ground level by a three-story glass atrium and near the top by a two-story sky bridge.
Alex put a protective arm around Andi as he shepherded her through the gauntlet of reporters.
“Ms Phoenix,” asked a man, thrusting a microphone into her face, “does this case have anything to do with your defense of Elias Claymore?”
Alex turned her away without a word, shielding her from the reporter’s inquisitive eyes with his arm. A female reporter was poised on the other side, waiting to pounce.
“Ms Phoenix is it true that you logged on to the CODIS database in a desperate search for evidence to exonerate your client?”
“No comment!” snapped Alex angrily.
The female reporter pushed closer and held out her microphone close to Andi’s mouth.
“Ms Phoenix?” she persisted.
Alex pushed the microphone away.
“Ms Phoenix has no comment,” he said again, firmly.
As the barrage of questions continued, Alex forced a path through the crowd of reporters and guided Andi to Juanita’s waiting car. They got in the back and Juanita floored the pedal before Alex even had the chance to say “dri
ve.”
“I’m glad to see you’ve finally learned the art of keeping your mouth shut,” said Alex as the car roared away from the prying eyes of the reporters.
“She’s going to pay – the fucking bitch!” said Andi.
“It’s no use getting angry now. We’ve just got to figure out who’s behind this and nail ‘em.”
“Oh I know who’s behind it all right! It’s that bitch Lannosea!”
“The person whose been sending you the eMails?”
“Of course it is! Who else could it be?”
“But do you know who that is?”
“Not yet. But I intend to find out.”
“How?”
“I think it’s one of Claymore’s victims from the past”
“What makes you think that?” asked Alex.
“The things she said… the anger… the bitterness.”
“Well if you’re right then she shouldn’t be too difficult to find. That reminds me – call David.”
“Why?”
“When I told him about your call from the courthouse he told me that had some results on some probes. He said you’d understand.”
Without another word, Andi pulled out her cell phone and pressed two keys.
“Hi Andi. Glad you made R-O-R.”
“How d’you know?”
“I heard it on the radio. Where are you now?”
“I’m in Juanita’s car, with your dad. We’re on our way back to the office.”
“I see that Lannosea has upped the ante,” he said wryly.
“It looks like it.”
“Anyway listen, you remember those probes I set up on your account? Well they’ve created a traceroute log of what happened these past few days.”
“What did you find?” she asked eagerly.
“That unauthorized access to the DNA database was done via your office Wide Area Network but it ultimately traced back to the hotel where you were staying.”
Andi froze.
“They’re doing it from the hotel?”
“It’s worse than that. I was able to get the MAC number of the computer they were doing it from.”
The MAC number had nothing to do with Apple Mac computers. It was an identification number that identified an individual computer.
“And?”
“It came from your laptop Andi.”
“My laptop!”
This sent a jolt through her. When could it have happened? She had her laptop with her at all times as far as she could remember. The only time when she had left it was when it was in the car when she went into the rape crisis center. Could some one had got into her car, used her laptop – via the WAN of Levine and Webster – and then switched if off and left the car looking untouched all the in the space of a few minutes?
“Is it possible for some one to spoof a MAC number?”
“A few years ago I’d’ve said, yes, but only if it was a very experienced hacker. Now anyone who can do an internet search can download an off-the-shelf MAC spoofing program. You can get an evaluation version free or the standard version for thirty dollars.”
“But how would they have got my MAC address to spoof it? Only the IP address is transmitted with the message header. The Mac address is only transmitted to the initial service provider.”
“Maybe that’s where they got it. From the company WAN.”
“You think some one at Levine and Webster.”
“If the hacker could access the network there then they might be able to get the MAC address from there, if you use the laptop at work. Does anyone else have access to your computer – I don’t mean just now, but generally.”
Andi hesitated. She knew the answer to this. But didn’t want to think about it.
“Gene wouldn’t have the knowledge to do this sort of thing.”
“Gene?” he sounded surprised. She forgot that he didn’t know what she had found out last Wednesday. As far as the rest of the world knew, Gene might have the opportunity, but she wouldn’t have had the motive.
“She has access to my laptop… some of the time. But not recently.”
“And as you say, she wouldn’t have had the knowledge of how to spoof a MAC address… let alone a motive.”
“So what do we do next? asked Andi.
“Well, there’s something you should be thinking about. Let’s take an off-the-wall scenario and consider what if some one did somehow manage to gain temporary access to your laptop. We know that the person downloaded a file from the Bethel Newton rape case.”
“So?”
“That means then they might have left some tell-tale sign on your computer.”
“Holy shit! I almost missed that!”
“Well what I suggest is that you check it out when you get back to the office. Let me know what you find. In fact, if you can connect it up with PC Anywhere, I’d like to do a hard drive image.”
“Okay. Thanks David. Bye.”
She put the phone away and became aware of Alex’s eyes upon her.
“Good news?”
“It could be Alex... it could be.”
Tuesday, 1 September 2009 – 11:05
Twenty minutes later they were back in the office. Alex had decided not to quiz her about this latest development immediately but to let her calm down first. Her animated conversation with David had perked her up somewhat but when he asked her about the “good news” she had refused to elaborate. He sensed that she didn’t want to jinx it by talking prematurely. She would tell him in her own good time.
So now Andi sat alone in her office, searching through the laptop’s hard disk for any trace of what was downloaded from the DNA database. She was checking deleted files too. If Lannosea had really managed to gain access to the computer to log on to the Ventura LDIS and downloaded anything, then even if she subsequently deleted it, the ghost of the file would probably still be there on the system. Even if she overwrote it completely, there should be a record in the activity log.
She had to find it.
File, by file, deleted file by deleted file, she searched the disk, using a range of software tools and utilities devised for system management. Finally she saw something that made her eyes pop open. There was a file called EliasClaymore.dna and then another called nailmidfngr.dna. As she looked further, she discovered something very interesting. The nailmidfngr.dna file had been created locally on this computer, whereas the EliasClaymore.dna file had simply been downloaded.
But then as she continued to look through the deleted files, she found the shadow of another downloaded file, also called nailmidfngr.dna. This had been downloaded at about the same time as EliasClaymore.dna and then deleted. It was clear that the hacker, had downloaded the EliasClaymore.dna file and then used it to create a false evidence sample file. But why also download the real evidence sample file if they were planning to overwrite it on the DNA server with a fake one?
Maybe it was because they needed to refer to the metadata in the file header, to get it right on the forged version. Or maybe Lannosea had originally planned to create a fake Elias Claymore sample – using the real evidence sample – and then changed her mind and decided to do it the other way round.
Andi decided to compare the forged evidence sample file with what she presumed was the real one.
But what she saw this time made no sense. Because the original evidence sample file that had been downloaded and deleted was the same as the new one that the hacker had created.
Why overwrite a file with another identical copy?
Wednesday, 2 September 2009 – 9:20
“But that doesn’t make sense,” said Bridget.
She was talking on her cell phone to Victor Alvarez, from her car at San Francisco International airport, having flown in to be available to help Sarah Jensen on this, the most crucial day in the trial of Elias Claymore. It was going to be an uphill struggle winning the case if it continued. And if it didn’t, they’d have a hell of a job persuading Bethel Newton to testify at the retrial.
“But why would anyone do that?”
“Maybe the person who did it didn’t know that it was the same profile. Maybe they meant to upload something else and instead uploaded the same file they’d already downloaded.”
Bridget was trying to concentrate on what Dr Alvarez was telling her while at the same time navigating her way out of the airport parking lot. She didn’t relish the prospect of the morning drive across the Bay Bridge in commuter time.
“Do we know who did it?”
“Greenberg said he’d passed on some information to the FBI. I heard on the radio that Andi Phoenix was arrested in connection with it. But the hacker may have hijacked her computer with a Trojan, or spoofed her IP address. At any rate, she was released R-O-R and we’ll have to wait for the evidence hearing.”
“In any case, that still doesn’t help us resolve the question of who is actually guilty.”
“Not in itself,” said Alvarez. “The way things stand now, we’ve got two suspects, neither of whom can be eliminated by the DNA, and in both cases the chances of a random match are 500 to 1.”
“It’s worse than that, Victor. We’ve got one suspect who was identified by the victim and another who matches the age of the perp. We’ve got one who matches the description of the perp and the other who used to match that description when he was younger. We’ve got one suspect who owns a car that matches the one described by the victim and another who was caught driving that car with false number plates. We’ve got one suspect who was a rapist in his youth and another who has no priors for rape but was arrested when he tried to rape a reporter who’s covering the case.”
“The thing is,” said Alvarez, “I haven’t been able to get through to Nick Sinclair or Sarah Jensen on their cell phones. And I don’t want to leave a message with the Alameda D.A. ‘cause that might dump ‘em in the shithouse.”
No Way Out Page 28