Kidd and LuEllen: Novels 1-4

by John Sandford

  “Three. One is a standard office, one has the computers, one has a futon on the floor and a miniature refrigerator where he keeps his Cokes.”

  “Is he in there alone?”

  “There’re two desks, but one of them looks pretty unused—like maybe a part-timer. I got the phone number.”

  She’d pissed me off a little by casually talking to the guy. “We’re gonna have to do a really light break. If we screw anything up, he’ll remember talking to you. He’ll remember your face.”

  “I thought it was worth the effort. And you know what? There is no security. The rest rooms are on the second floor. I went into the ladies’ room, and there’s a drop ceiling, but it’s a mess above it. If we went up, and anybody came in to clean up . . . they’d know.”

  “So what do we do?”

  “I’m thinking about it.”

  “All right.” I looked at my watch. “Let’s go get some deodorant, and then we can hang out for the day. You can think.”

  We found a drugstore, and I bought a travel-sized can of a woman’s deodorant, the kind that advertises actual freshening powder in its spray, and a couple of Cokes. We drank the Cokes on the way back to Carter-Byrd. This time, LuEllen slumped in the seat while I went inside, carrying her briefcase so I looked like I had a reason to be there.

  The building was essentially a long string of business offices opening off central hallways that ran the length of the building. There was nobody in the hall when I walked inside, and I made a left, slipped the deodorant can out of my pocket, and gave it a couple of shakes. Bloch Technology was the third door on the left. I spotted the keypad as I came up, looked both ways, and then gave it a thorough spraying with the deodorant. I waved my hand in the air a couple of times to disperse the smell as best I could, then headed back out. Total time in the building, less than one minute. Total people encountered, none.

  “So let’s go hang out,” I said.

  We hung out, more or less; I took her to a driving range, where she hit golf balls, and very well, with a five-iron older than she was, and with a three-wood that was not only wood, but was no bigger than her fist. I did some quick sketches of her swing. Later, we caught a movie, and in between, I got back to Bobby, who had what he called a curiosity: a sudden spate of rumors on the Net that Firewall was planning a major attack. Bobby knew about Rufus and the Monger; I suggested that he call Rufus and have him trace the latest round of rumors. And I had a new question of my own, that popped into my head just as we were signing off. Bobby said:

  WILL TRACE RUMORS SOONEST.

  OK.

  CALL TONIGHT.

  YES . NEW THOUGHT : LOOK AT AIRLINES . SEE IF JM FLEW IN DAYS BEFORE HE WAS KILLED .

  YES. WILL ALSO CHECK GAS CARD. ALSO, JPEG IN YOUR BOX.

  THANKS .

  I downloaded the JPEG, which is a picture format, and saved it to examine later. After the movie, which sucked, LuEllen pointed me at a sporting goods store, where she bought a spool of black monofilament fishing line called Spider Wire. We went back to the motel, looked at the movies she’d made that morning at Bloch—five Dell servers sitting on heavy plastic benches with a monitor and keyboard off to the side—then had a slow dinner at a fast diner. The nerves were getting on top of me, like they always do. After dinner, we went back to the motel, picked up her bag, and at seven o’clock, when it was good and dark, we were back at Carter-Byrd.

  There were maybe forty offices in 2233. Seven or eight still showed lights—Americans work all the time, no getting around it. Bloch Technology was not one of the lighted offices; Bloch’s futon was only a tiny cloud on the horizon.

  We took the end space in the parking lot, and LuEllen tied one end of the Spider Wire around the steering wheel, led the line out through the window, across the lawn to the door. She checked to make sure that nobody was coming from inside; she did a quick knot on the outside door handle, cut the line at the spool, and strolled back to the car. When she was back, and inside, she pulled the line tight, until it stretched, absolutely invisible, directly across the sidewalk to the door.

  “Now, if somebody wants to use the sidewalk, they’ll simply have to go around,” I said. “Either that, or garrote themselves.”

  “If somebody comes, we cut the string. It flies halfway back across the yard, and nobody sees it.”

  “Did you ever do this before?”

  “No, but I read about it.”

  We sat in the lot for twenty minutes before the door opened: and the rest worked just like LuEllen thought it would. The guy pushed through the door and walked away, headed toward his car in the parking lot. She put pressure on the door as it slid closed . . .

  “Gotta hurry,” she grunted. “I don’t know if the line’ll hold. The door’s heavier than I thought.”

  “Hang on, hang on . . .” I didn’t want the guy who was leaving to see me get out of the car. When he was up the hill, I hurried across the lawn. She’d stopped the door just as it touched the doorpost. I pulled it open, and snapped the line off the handle. We were in.

  LuEllen had programmed Bloch’s phone number into her cell phone earlier in the evening, and dialed the number as she got out of the car. The hallway leading past Bloch Tech was empty. I walked to the door, LuEllen close behind, and mimed a knock: we could hear the phone ringing inside. No answer.

  As I mimed another knock, LuEllen turned off her phone and pointed a little battery-operated black light, the kind teenagers used to buy in head shops, at the keypad. The powdery crystals in the deodorant fluoresced in the light—except for the three that had no powdery crystals.

  “Four-six-seven,” she said. “But there are four digits in a Vermond lock. In this model. So they repeated one of them.”

  Nobody in the hall: I took a dime notebook out of my pocket and began scrawling number combinations as quickly as I could write, calling them out as I jotted them down. The thing about number pads is, with ten digits, there are 10,000 possible combinations. Getting inside with a brute-force attack is tough. And a few locks, but not this one, were alarmed, or would lock up, after a certain number of incorrect combinations. Then they could only be opened with a key.

  But if you know the four digits involved in the combination . . . ah, then there were only twenty-four possible combinations. If one of the digits is repeated, like it was here, and you don’t know which, the number goes up to thirty-six. But most people start their combination with the lowest number, in this case, a four. We started with four-four-six-seven, and went to four-four-seven-six, and to four-six-four-seven, and so on. We were lucky, hit it on the eighth combination, and pushed into the darkened office.

  “Gloves,” LuEllen said.

  We pulled on vinyl gloves, and followed the hair-thin beams of the flashlights into the server room. The Dell servers looked like five little dwarfs, lined up for breakfast; the room was windowless, and windowless was good. The futon was rolled into a corner of the third room, with a fuzzy blue blanket tossed carelessly on top of it. LuEllen, using her flash, found a roll of tape in the outer office, and brought the blanket into the server room. We taped the blanket to the wall so it covered the door, and then LuEllen slipped under the blanket into the outer office, and closed the door behind her. I pulled the blanket so it covered the door completely, and turned on the light.

  “Light’s on,” I said. Then I turned it off, and LuEllen pushed back inside.

  “Almost perfect,” she said. “There was a little tiny dot of light near the right corner . . .”

  We rearranged the blanket and I went to work on the machines. Servers are nothing but specialized computers, optimized for communications and storage. If you’ve got a relatively modern home computer, you could use that as a small server, with the right software. In this raid, we wouldn’t be going after the content inside the servers. We wanted access, rather than content. I spent twenty minutes pawing through Bloch’s software and service-maintenance manuals, and then got into the servers themselves. They were running on a
standard off-the-shelf UNIX server package. I had root in five minutes, with an outside maintenance account. Then I dumped in a little access program of my own; I’ve done this before. After checking it, I shut down local access, turned the light off again, pulled down the blanket, and cleaned up the tape.

  While I was working on the machine, LuEllen had been going through paper files in the outer office, using her flash. “All bullshit,” she said. “Tax forms, bank statements, advertisements.”

  One of the forms listed Toby Bloch as owner of 100 percent of Bloch Technology stock. “Is that the guy you talked to?” I asked. I crumpled up the blanket and tossed it back on the futon, more or less as it had been.

  “That’s the guy. Toby.”

  “All right. Nice little business he has here . . .”

  With everything back in place, we listened at the door, heard nothing, and walked out; out to the car, and we were gone. Nothing to it.

  But there was trouble back at the ranch. I wouldn’t go online with the server until after midnight, when there was less chance that the real system operator was online. Instead, I checked with Bobby, to see if he had anything more on Jack Morrison or Firewall.

  He did.

  LOOK AT NEWS PROGRAMS. FIREWALL ATTACKS IRS WITH DOS. BIG TROUBLE NOW. ATTACK MAYBE STARTS IN SWITZERLAND. STYLE FEELS GERMAN.

  WILL LOOK . ANYTHING ON JM?

  JM FLIES TO BALTIMORE-WASHINGTON INTERNATIONAL ON MONDAY BEFORE SHOOTING, RETURNS SAME NIGHT. RENTED HERTZ, 64 MILES. NO MORE DETAIL. ALSO FLIES TO BWI ON THURSDAY AFTERNOON BACK FRIDAY MORNING. NO CAR, NO HOTEL ON CARD.

  THANKS . WILL LOOK AT NEWS .

  THIS IS *VERY* DANGEROUS.

  LATER .

  I thought about that until LuEllen said, “What?”

  “Jack Morrison was in town the night Lighter was killed,” I said.

  “That’s not good.”

  “No. But Lane’s lecture about Jack and guns . . . that’s still pretty straight. I still can’t see Jack shooting anyone.”

  “What’s this about the IRS?”

  “I don’t know,” I said.

  “Bobby seems more worried about that than about Jack.”

  “Jack’s dead,” I said.

  I checked the Times and Washington Post online editions, but they had nothing on the attack on the IRS. CNN had a story, but like a lot of CNN stuff, most of it seemed to have been garbled by a mentally challenged paranoiac; I clicked over to The Wall Street Journal, which had a short item.

  A DENIAL-OF-SERVICE (DOS) COMPUTER ATTACK AIMED AT THE INTERNAL REVENUE SERVICE HAS CAUSED A MAJOR DISRUPTION IN THE HANDLING OF END-OF-QUARTER BUSINESS TAX FILINGS, AN IRS SPOKESMAN CONFIRMED THIS AFTERNOON.

  THE ATTACK, WHICH BEGAN THIS MORNING, IS CONTINUING. THE ATTACKING GROUP HAS IDENTIFIED ITSELF AS “FIREWALL.”

  A DENIAL-OF-SERVICE ATTACK ATTEMPTS TO FLOOD THE TARGET WITH HUGE NUMBERS OF LEGITIMATE-LOOKING TRANSACTIONS, EVENTUALLY OVERWHELMING THE TARGET COMPUTER’S ABILITY TO COPE WITH THE NUMBERS.

  WHILE OFFICIAL DEPARTMENT OF JUSTICE SOURCES SAID THAT THE ATTACK IS LIMITED, ONE HIGH-LEVEL IRS OFFICIAL, WHO ASKED NOT TO BE IDENTIFIED, SAID THAT THERE HAS BEEN A MAJOR DISRUPTION OF END-OF-BUSINESS-QUARTER TAX FILINGS. HE SAID THAT “TENS OF THOUSANDS” OF BUSINESS QUARTERLY RETURNS WERE INVOLVED AND SAID THAT THE ATTACK SEEMED TO BE SPREADING.

  AN FBI SPOKESMAN SAID THAT MANY OF THE DOS CALLS APPEAR TO BE COMING FROM SMALL-COLLEGE COMPUTER LABS.

  “WHAT APPARENTLY HAPPENED IS THAT SOME INDIVIDUAL OR GROUP PLANTED SMALL ATTACK PROGRAMS INSIDE THESE OPEN COMPUTERS, AND DESIGNED THEM TO GO OFF AT THE SAME TIME. WE ARE GETTING IN TOUCH WITH THESE SCHOOLS AS WE IDENTIFY THEM, ASKING THAT THEY GO OFF-LINE LONG ENOUGH TO REMOVE THE PROGRAMS FROM THEIR COMPUTERS. MOST OF THEM HAVE NO IDEA THAT THEIR COMPUTERS ARE PARTICIPATING IN THE ATTACK,” FBI SPOKESMAN LARRY CONNERS SAID.

  CONNERS SAID THAT THE ATTACK PROGRAM IS AN UNSOPHISTICATED ONE, BUT THE IRS OFFICIAL SAID THAT IT TAKES ADVANTAGE OF THE FACT THAT THE IRS COMPUTERS MUST BE OPEN TO THE OUTSIDE TO RECEIVE LEGITIMATE TAX RETURNS. THE ATTACK INVOLVES SENDING AND RESENDING HUNDREDS OF LEGITIMATE-LOOKING, BUT SLIGHTLY FLAWED RETURNS, WHICH THE IRS COMPUTERS THEN ATTEMPT TO RETURN TO THE SENDER. AS THE VOLUME BUILT, THE COMPUTERS WERE NO LONGER CAPABLE OF HANDLING THE FLOW OF TRAFFIC.

  “INDIVIDUALLY, THE ATTACK FILINGS WOULDN’T BE A PROBLEM; THE PROBLEM IS THAT THEY JUST KEEP COMING, OVER AND OVER, FROM SO MANY DIFFERENT SOURCES,” THE IRS SOURCE SAID.

  THE FBI’S CONNERS SAID THAT THE ATTACK MAY HAVE STARTED IN SWITZERLAND, WITH THE ATTACK PROGRAMS PLANTED AS LONG AS A MONTH AGO . . .

  “If the attack isn’t sophisticated . . .”

  “It’s not sophisticated, but a fire ant isn’t sophisticated either,” I said. “But you get a few thousand of them swarming up your shorts, and you’ve got a problem. If the feds get really pissed, and start hammering on that list of names, who knows where it’ll end?”

  “There’ve been other attacks like this. I read about one in Newsweek.”

  “Yeah, but there’s a huge difference,” I said. “Before, they were messing with private businesses. The politicians’ public attitude was, well, that’s too bad, but the real feeling was, fuck a bunch of private businesses— those guys got too much money anyway. But now, these guys are messing with the politicians’ money . . .”

  “Ah.”

  “Yeah. Big ‘Ah.’ ”

  The JPEG photo that Bobby sent me was still on my hard drive. I opened it, and took a look. A parking lot, apparently taken from a fairly high angle. Three men in suits were walking across a parking lot full of pickup trucks. All three of them were carrying briefcases, and one had his face turned up toward the camera. The resolution of the JPEG was not high enough to make out the faces. All of the photos, Bobby had said, were the same.

  “So who are they?” LuEllen asked.

  “I don’t know.”

  “If the picture’s important . . . it must be that the three shouldn’t be together. You know, like a gangster and a cop.”

  “Or a Chinese and an American,” I said. “Look at this guy . . . there’s something about him that looks Oriental.”

  “Shape of his face . . . unless it’s a woman.”

  “Huh. I don’t know.” And I didn’t.

  Late that night I went into Bloch Tech’s server. There’s so much stuff in a server, even a small one, that there’s no real-time, hands-on way to sort through it—it’s not like flipping through a book. It’s like flipping through a library, like trying to make sense of Jack’s disks.

  I did a search for references to Firewall, and found several hundred in saved e-mail and in postings on Web sites. Six accounts seemed to have a lot of traffic about Firewall. I went into the administrative files, pulled the accounts, and copied out names and addresses. As I finished, I noticed a peculiarity: they were all new accounts, they’d all signed up in the last two weeks, and they’d all paid the up-front minimum of three months by check, rather than opting for credit-card payments.

  “Damn it, I’ll bet the names are fakes,” I told LuEllen. I saved the names. I could ship them to Bobby later, and have him look them up.

  Since I had the administrative files up, I checked for Jack Morrison and came up empty; then, on the off-chance, I checked Terrence Lighter, and got a surprise. Lighter had an account on this server, and better yet, his e-mail had dozens of letters. A few were encrypted, so I skipped over those. Most of the rest were letters to and from collectors and dealers in antique scientific instruments, apparently a hobby of his.

  And there was one letter that said, unencrypted and in the clear, the Sunday before last:

  MR. MORRISON. I WILL SEE YOU TOMORROW AT MY OFFICE AT 8:30. PLEASE BRING THE FILES WITH YOU. THANK YOU. T. L. LIGHTER.

  12

  At three in the morning—midnight Pacific time—I called Lane. Green answered the phone and said, “We got somebody on us.”

  “What do you mean?”

  “Somebody watching. Not close, but they’re
around. It’s almost like being paranoid, but I’ve seen one car—it’s green, and I think it’s a Camry—a few too many times, and a face looking toward us. Always a couple of blocks away.”

  “What do you think?”

  “We need to get out of here. If we can lose them, I’d feel a lot easier. Here, we’re pinned like butterflies.”

  “Okay. We’ve got a couple more things to do here, but we’ll be in Dallas the day after tomorrow. Or the day after that, not later than. You could surprise them somehow, get out to the airport, ditch the car, get on a plane.”

  “What if they’ve got people in Dallas?”

  “Fly to Seattle first,” I suggested.

  “All right; I’ll talk to Lane about it.”

  “How is she?”

  “Antsy. But here, you talk to her.”

  Lane came on and I told her about Jack and Lighter, that Jack may have found something at AmMath that needed Lighter’s attention. She didn’t immediately pick up on the problem of the second trip.

  “I knew something was going on,” she said. “If Jack was talking to this guy, and this guy was killed, then we’ve got to tell somebody. This proves it. That something was going on with AmMath.”

  “It doesn’t prove anything in particular,” I said. “And the second trip—that’s a problem.”

  “I don’t see a problem. The guy—”

  “They’ll say Jack shot him,” I said.

  That stopped her only for a few seconds: “But we know he didn’t,” she argued. “He wouldn’t do that.”

  “They’ve got a gun in Texas that was stolen in San Jose years ago. They’ve got witnesses who say he was the shooter, and one of those witnesses took a bullet in the chest. Now, if they ever get around to looking, they can show that he flew into Baltimore late in the afternoon—after working hours—and flew back the next morning. His NSA contact was murdered right in the middle of that time period, and he never said a word about it to anyone.”

  That stopped her for a little longer: “Okay. That sounds bad. When you put it that way. But maybe he didn’t even know about it . . .”