The Director: A Novel

  “I’m Valerie Tennant,” said Sandoval, thrusting a hand toward the young man in the turtleneck. “You must be Mr. Grulig.”

  The German stood there awkwardly, not sure whether to advance or retreat. Sandoval walked toward him, arm still extended.

  “Thank you for coming,” she said. She gestured toward the table where she had been sitting. “Please have a seat.”

  Grulig walked uneasily toward the table. His minder stood by the door. Grulig spoke fluent English, the product of a lifetime on the Internet, but the minder spoke to him in German, saying he would wait downstairs.

  “Ich werde jetzt gehen, Stefan, Sie sprechen zu lassen. Ich werde im Erdgeschoss, wenn Sie etwas brauchen. Ich erwarte Sie in über, was, eine Stunde?”

  Grulig looked uncomfortable at the thought that his companion was leaving him alone with this strange woman. He shook his head at the mention of an hour with her.

  The minder shrugged.

  “Whatever,” he said in English, and then retreated out the door.

  Grulig sat down uneasily at the table across from Sandoval. She put a business card before him. He studied it, but didn’t pick it up.

  “I work for a computer security firm called Scylla Security Solutions,” she said. “We do penetration testing, security consulting, custom software patches. One of our German clients has a problem, and we were told you were the best. We can pay you very well.”

  Grulig gave a little snort at the notion that she would pay him for his artistry.

  “Don’t be silly,” he said. “If I wanted to be paid for what I know, I could make more in a week than your company earns in a year.”

  “Perhaps,” she said, “but we make more money than you might think. You may not have heard much about us, but we are very successful.”

  He snorted again. She obviously didn’t really understand who he was or what he did.

  “If I wanted to sell a zero-day exploit, you know how much I could get? A million dollars, maybe more if it’s an iPhone exploit. Do I sell it? No. Why not?”

  He studied her, through eyes that were black beads of alienation.

  “Because I don’t take a shit on the church floor, that’s why, and the Internet is my church.”

  “Wow. Okay, got it. But can I tell you my client’s problem? You can decide if you want to help later, when I’m done.”

  “I don’t want to help,” he answered flatly. “I am here only because my friend Henning, who is downstairs, asked me as a special favor. And I owe him so many things. But I can tell you now, your problem is not my problem.”

  Sandoval nodded in agreement, and then went ahead with her pitch anyway, as if she hadn’t heard a word.

  “My client’s problem is that there is a hacker underground in Russia that is hiring people as mercenaries.”

  Grulig stuck out his tongue.

  “Duh,” he said. “Everyone knows that.”

  “Yes, but these mercenaries have gotten so good that my client thinks they can penetrate any network. Even the networks of governments.”

  He eyed her warily. He had a soft face, now that he was close. He was frightened. That was the look in his eye. Not arrogance, but fear.

  “Which government are you talking about?”

  She paused as she weighed her answer. He was ready to bolt. She might only have a few more minutes with him. There was no reason not to say it.

  “The United States.”

  He bit his lip, and then rapped the table with his knuckles.

  “I knew it.”

  He pointed to her “Scylla” notebook.

  “You work for one of the agencies.”

  She stared him dead in the eye. There was no answering this question, ever. She pressed ahead.

  “My client is interested in an organization called Friends of Cerberus, and another one called the Exchange. You must know about them, or you can help me find out. That’s why I wanted to see you.”

  Grulig swept his stringy hair back from his face. His hands seemed to tremble for a moment. His face, pallid from days and nights staring at computer screens, seemed to have lost any color it had.

  “Lady, whoever you are, you are going to get yourself killed, and me, too. These are names that don’t exist.”

  “Yes, but they do. We heard them. And do you know who we heard them from?

  Grulig didn’t answer, but his eyes showed that he was interested. Scared, yes, but also unable to resist listening to what this American woman was saying.

  Sandoval fixed him in the eye again. She could be tough and unyielding in dealing with sources. That was her gift: She looked soft, but she wasn’t.

  “I’ll tell you, Stefan. We heard those names from a Swiss named Rudolf Biel. Do you know who he is?”

  Grulig nodded.

  “Poor kid,” he said.

  “Yeah, that’s what I think. And I’d like to do something about the people who thought he was so disposable.”

  Grulig shook his head. But he was in her space now. He could have gotten up and walked away five minutes ago, but not any longer.

  “So let me ask you again, Stefan. Can you help me understand this Exchange and the Friends of Cerberus?”

  “Who am I talking to?” asked Grulig. There was a slight tremor in his voice. It was as if he had been pulled toward a precipice and forced to look over the edge.

  “Just me. I’m an American. That’s enough. Nobody from my country knows I’m here. Nobody knows I’m meeting with you, except the man who set it up with your friend Henning, and I’m not telling you who that is. I know this is dangerous. That’s why I haven’t told any of the people I work with. I just need to know what the fuck is going on.”

  Her profanity seemed to startle him. It was incongruous. He looked at the door. He looked out the window at the Brandenburg Gate, lighter than air for all its immensity, the stone glowing in the morning light. He looked at her and then began to speak, his voice shaky at first, but then steadying.

  “You must be very stupid, or very smart, I can’t tell which,” he said.

  “I’m just ordinary, but I’m worried, and I need help.”

  “Me, too,” he answered.

  “That’s a start. Tell me about Cerberus and the Exchange.”

  Grulig shook his head at the mention of these names again.

  “You don’t understand anything, do you?”

  “Probably not. So help me out.”

  “You think this hacker underground is a bunch of criminals. Sleazy guys from Sochi and Kiev who are selling shit and killing people who get in their way. Right?”

  “Yes. I guess so. That’s true, isn’t it?”

  “Of course it’s true. But who do you think are the buyers in this market? Do you think it’s some kind of hacker godfather, who buys up all the exploits and sells them in a thieves’ den?”

  “I don’t know. Tell me. Who are the buyers?”

  “The buyers are governments. Good governments and bad governments. Sometimes the buyers are companies, so they can fix the vulnerabilities. But more often they are governments that want to use them to get inside networks and systems.”

  “The U.S. government is a buyer?”

  He snorted again, and then laughed out loud.

  “You are stupid. Of course the U.S. government is a buyer, when it needs to be. But really, that is not the point.”

  “No? What’s the point, then?”

  “The point is that the buyers and sellers are inside each other. It’s not enough to buy exploits. The governments want to buy the people who create them. There are no more black hats and white hats. It’s all the same hat. They’re all working together.”

  “What’s the Exchange?”

  “A name for something that doesn’t have a name.”

  “Meaning what?”

  “It’s a market. The boys who pretend to take these systems down are also the ones who help build them back up. They are all traders in the same market. The people who are doing the defense a
re also doing the offense. You see what I mean? Sometimes they want to give this show a name, so they call it the Exchange, or they call it Carderplanet, or Stuxnet, or Flame. I don’t care. They are shitting in my church, all of them. They shit on the altar. I hate them. Do you hear me? I hate them.”

  She wanted to hug the German, with his fuzzy turtleneck sweater and his dirty hair. Yes, she was beginning to understand.

  “It’s not enough to hate them,” she said. “You have to stop them.”

  “I cannot. You cannot. They are destroying cyberspace, but it’s worse than that. People talk as if ‘cyber’ were a separate electronic space, but information is the air we breathe. How can they buy and sell the air, these bastards? They are destroying life and freedom. I cannot bear it.”

  He closed his eyes and swallowed hard. There were no tears, only the sniffling and a nervous cough.

  “Who are the Friends of Cerberus?”

  “They are liars. Cerberus has no friends.”

  “Okay, then, what is Cerberus?”

  “Cerberus is the dog that guards the gates of hell. Everyone knows that.”

  “No, really, do you know anything about it? Please.”

  He smiled, almost sweetly.

  “Well, I helped to build it, I should know. Cerberus is the Cerberus Computing Club, here in Berlin, in every German city and town, all over Europe, even in America. It is the home of people who love the Internet, and hate boundaries, and love freedom—and will take action, yes, truly, take action to prevent people from harming our blessed chaos. The Internet took power away from governments and companies, you see, and now these bosses want it back.”

  “Can I meet Cerberus?”

  He laughed, merrily now.

  “No. And yes. Who do you think you are talking to?”

  “To Cerberus?”

  “A part of it. But Cerberus is everywhere. I told you before. How can you meet the air? You breathe it. It’s free.”

  “I need to ask again. It’s important. Who are the Friends of Cerberus?”

  “They are false friends. It can only be a trick. I have heard the name, but never from someone I trusted. Most of what you hear about Cerberus from the outside is false. Your information is probably a lie, too, I think. But honestly, I don’t know.”

  The sky over Berlin was darkening as the weather changed. A shadow fell across the conference room in the gleaming building on Pariser Platz. The change of light seemed to alter Grulig’s mood. He looked at his watch. The nervous look returned to his face. His eyes darted back and forth, as if he felt claustrophobic in the room. She was losing him.

  She fixed him in the eye again. She took his hand, but he pulled it away.

  “Who killed Rudolf Biel?” she asked. “I need to know. Was it this Exchange Mafia? Or someone else?”

  He stood up, shaking his head.

  “You, lady, are so crazy and stupid. Didn’t you understand anything I said? It is all the same. There isn’t a team called Exchange that is fighting a team called, I don’t know, USA, or China, or Russian Mafia. When you pull it apart, it’s all one team. How can I say who killed him? Don’t you get it? It doesn’t matter. It’s what I told you: There are no black hats and white hats. There are only golden hats, the ones with the money.”

  “So they can read America’s messages, the secret ones from the agencies? I need to know.”

  “Some messages, maybe. But I am telling you, it is Laocoön: You cannot tell apart the body of the serpent and the arms of the man. The agencies are hungry for exploits, to do their own dirty work. They get inside every system there is, and we never know why. One day they are in Iran, another day in Switzerland, a third day in China. Is there a goal, or is there only this dirty game? I do not know. But it is dangerous.”

  Grulig moved toward the door. Sandoval reached out and held his arm, but he pulled away.

  “Stay,” she said. “Let me help you.”

  He shook his head, the matted hair falling across his eyes.

  “No.” He walked toward the door. “Do not come with me. Do not follow me. Do not ever contact me again. You got this Swiss boy killed, this Biel. That’s what I think. And you will get me killed, too, so goodbye. I never met you. I never talked to you. I will never see you again.”

  “Please wait. I need help.” She almost shouted the words.

  “You need to think about what I said, lady. That is all the help from me there is. No more, after that. If you try to come after me, it will be a mistake. I do not make threats. I don’t believe in threats, or war, or violence, or flags. But I promise you that if you try to contact me again, or reveal my identity to anyone, I will know. And you will pay a very big price.”

  With that, he was gone, out the door. Sandoval thought of following him, thought even of making a crash call to Berlin Station in the U.S. Embassy, two hundred yards away on the other side of the Brandenburg Gate. But she had given her word to Grulig that she would protect his anonymity. And there was something else: She had been instructed not to talk to anyone else in the agency except the man at the top.

  19

  WASHINGTON

  The consul general in Hamburg was a middle-aged man, never married, and he didn’t like talking about personal matters when he could avoid it. Kitten Sandoval told him the next morning, when she was back from Berlin, that she had a personal medical issue, “women’s plumbing,” and needed to fly home to see her Washington doctor. He didn’t ask any questions. She didn’t contact Berlin Station or EUR Division back at Langley, not wanting to be caught later in a lie.

  Sandoval caught an early connector flight from Tegel to Munich and flew home to Dulles on Lufthansa. She bought the economy ticket in her true name, and booked herself a room at the Crystal City Marriott. Before she left, she sent an encrypted message to the director’s pseudonym account, saying that she would be in Washington that night. She asked him to suggest a location for a secure meeting.

  Sandoval watched movies all the way home. She half paid attention as her mind wandered over the events of the past few days. She was in what her father liked to call “las profundidades del océano.” The deep ocean. The gravity of what she had done made her nervous, but it was also what she had wanted for years: a chance to make a difference, with everyone watching, to be the heroine of the play.

  Sandoval had progressed in her career by taking little risks, measured ones. She had come to the CIA by way of Arizona State University, in the usual sort of quiet referral: She had been nearing completion of her master’s in global legal studies, hoping to work for the FBI or the DEA, when her dean summoned her one day and said the CIA recruiter was coming to town. He said Sandoval had the right skills: She was bright, conscientious, spoke fluent Spanish as a second-generation immigrant. Her Mexican-born father was a naturalized citizen and Marine Corps veteran who took her to the firing range each weekend. She knew her way around guns, and she had an easy way with people.

  The CIA had a lily-white reputation, but Sandoval knew that if they were sending recruiters to ASU, they wanted to give at least the appearance of change. Sandoval went off to the interview, and the first surprise was that the CIA recruiter was a Hispanic woman herself, who had served abroad and seemed to embody the slogan on her promotional brochure about how the National Clandestine Service was “the Ultimate International Career.”

  In the days after the interview, Sandoval could imagine herself being that woman, having that career and being a soldier like her father, but different. With the encouragement of her dean, she applied to the agency and eventually became a career trainee, on her way to the Clandestine Service. She did a first tour in Managua, where she hadn’t liked her boss, and after that an awkward stint with L.A. Division in Washington. She switched to EUR, first in Madrid and then, after six months of German language training, to Hamburg. She had never stepped outside the boundaries in all that time, or felt she needed to.

  The events that had begun with the Swiss walk-in, Rudolf Biel, were differ
ent. Sandoval had started coloring outside the lines: It was free-form, and although she had recently found a seeming ally in Weber, she knew he wouldn’t be able to protect her if things went wrong. He was new and inexperienced; she knew more about the CIA than he did.

  A message was waiting on Sandoval’s phone when the plane landed at Dulles. The director proposed a meeting at seven-thirty the next morning, and gave the address of Stormhaven Casualty, an insurance office in the flat suburb of Fairlington in Alexandria. Sandoval checked into the Marriott and lay awake in bed for several hours, her mind a white buzz. She took an Ambien and slept a few hours, then awoke a little after four a.m. and couldn’t get back to sleep. After she had showered, she put on too much makeup, but that was better than too much fatigue.

  Sandoval took a taxi to the address in Alexandria the next morning. She arrived at seven-fifteen, but it took twenty minutes for them to clear her downstairs, so she arrived in the secure second-floor reception area late and embarrassed.

  Weber had his feet up on the coffee table of the windowless room they had prepared for the conversation. He popped up from the couch and shook her hand. Sandoval had never met him before. He looked like one of the fraternity boys at ASU, too young for the job.

  “I’m sorry I’m late, Mr. Director,” she said.

  “¿Qué húbole, güey?” said Weber.

  “Do you speak Spanish?” she asked enthusiastically.

  He shook his head.

  “The chief of my security detail told me how to say, ‘What’s up, dude?’ Want some coffee?”

  She nodded yes, and an aide brought in a huge platter of muffins, donuts, pastries, cookies and fruit, along with a giant coffee urn. The word had gotten around that the director liked snacks. It was enough to feed the EUR Division. Sandoval took some fruit and a cookie.

  “Thanks for coming,” said Weber. “You’re sticking your neck out.”

  “Yes, sir, I am.” She looked away.

  “Well, it feels good, doesn’t it?”