Rogue Code

by Mark Russinovich

  She drank her coffee and considered the odds. She had tonight and tomorrow for computer time. Maybe she could turn up something, but didn’t think it likely. What she needed was to link what was taking place to the rogue code’s real authors. The ease with which she’d fooled the bank manager had set her mind to considering another option. But first, there was something else she could do now. She picked up her cell phone to call her boss, Clive Lifton, in San Francisco. He answered at once.

  “Daryl, when are you coming back? I need you.”

  “I’m not sure, Clive. Things are complicated. Listen, I need your help.” For the next ten minutes, she filled him in on what was taking place. His company, CyberSys, Inc., was small but highly regarded in the cybersecurity community. His annual CyberCon was one of the most respected of its kind and was attended by both private contractors and government agents. His contacts throughout the cybersecurity world were extensive.

  “That’s quite a story,” he said when she’d finished. “So the SEC is convinced that Jeff and Frank are thieves. But from what you tell me the setup isn’t all that clever.”

  “Robert Alshon is the senior investigator. I’m hoping you know him.”

  “Alshon. Alshon. I have a vague memory of a large man with a shaven head and mustache. If that’s him, we met once, briefly, but I should know people who know him. It’s the same everywhere. What do you want me to do?”

  “Talk to him. At the least slow him down, get him to dig deeper before he lands on Jeff and Frank with both feet.”

  “You say that warrants have already been issued?”

  “That’s what Frank said. Alshon was able to get the NYPD involved. That’s why they left the city.”

  “Where are they?”

  “The less you know, the better, Clive. Will you do it?”

  “Of course I’ll do it. I just don’t know if it will do any good.”

  52

  POUSADA VERDE NOVA

  RUA MANUEL DE PAIVA

  SÃO PAULO, BRAZIL

  2:34 P.M.

  The hotel’s Web site had been true to the nature of the Pousada Verde Nova. Frank had selected it during their layover in Miami primarily because of its location. Tropical in design with a cobblestone parking area, the small hotel had a restaurant and featured both inside and outside dining. Quiet, with Wi-Fi throughout, it was situated three blocks from the nearest busy street. It was the kind of hotel that appealed to out of country travelers. It made you want to lounge about, drink too much beer, and do absolutely nothing. It was ideal for their purposes as it was easy to blend in.

  Jeff had found the long flight south both physically and mentally exhausting. The passports cleared Newark and Miami without difficulty and there’d been no trouble at the Guarulhos International Airport. Frank had assured them that traveling as two Canadian businessmen would be easy.

  Once they’d left Miami, Frank had offered him an Ambien, but Jeff had refused. He’d taken the drug once before, and it had left him dazed for the next twenty-four hours. He couldn’t afford such a luxury right now.

  When Frank first announced his intention of flying south to collect information at the likely source or to find someone in the know, Jeff had objected, arguing that it was too dangerous. If anything went wrong, they’d end up in a Brazilian jail.

  And just how reliable was the information on São Paulo anyway? They found nothing when they’d first cracked the code, and they’d looked hard for such a connection. Now, out of the blue, came this picture. Daryl was right. They’d been lured here.

  He didn’t share Frank’s optimism, if that’s what it was. There seemed to Jeff virtually no chance they could run this thing down here or find someone who could confirm their suspicions and be made to talk. They had no idea if São Paulo was even the end of the trail. For all they knew it was just another stopping point for the money. And as for the hackers, the operation could very easily have been outsourced to them from most anywhere in the world. In Jeff’s view this was the longest of shots. He’d told Frank this as forcefully as he could before they’d left New York.

  “If we stay here in New York, we’ll be arrested, with all that means,” Frank had argued. “We’ve already discussed it at length. Even with Daryl’s help we can’t do this working only with computers. You need to come with me.”

  “To Brazil?”

  “Absolutely. We can’t stay here. If we do, it’s just a question of time. A moving target is a lot harder to find. We’ve got cash and in Brazil cash is king. If this lead comes to nothing, we’ll hole up there and work this for the long run. There are few better places in the world in which to be a fugitive. The Brazilian authorities won’t cooperate with the SEC or FBI. They don’t view so-called white-collar crime the same way as the U.S. And we don’t have to show identity cards to function there so we can assume whatever name we want. There’s also a larger expat community in Brazil than you realize and in the south there’s a large number of Brazilians who originated largely from Germany. We’ll be invisible or close to.”

  “I don’t know.”

  “I speak the language.”

  “You speak Spanish, Frank. The language in Brazil is Portuguese.”

  “Close enough. Jeff,” Frank said with a winning smile, “trust me.”

  * * *

  After checking in to the Pousada Verde Nova, they showered and changed, then had a light snack with bottles of Brahma, a local beer. Frank had unspecified business and left, saying he’d be back in a bit.

  Jeff lay on his bed and tried to sleep, but his restless mind refused to shut down. Running into Agnes had been upsetting. His mind had been filled with fear, fear that she knew there was a warrant out for his arrest, that she’d been playing him and had run off to tell the police where to find him. It was ridiculous he knew, but he’d had to fight to suppress the surge of terror that threatened to engulf him.

  When Frank returned, Jeff said, “Frank, I appreciate your commitment to secrecy, I really do, and understand the culture. But in this case, I think it’s misplaced. You want me to trust you and I do, but put yourself in my place. I need to know more. Tell me about this.” He held up the passport.

  Frank sat in a chair, a fresh bottle of beer clutched in his hand. “You’ve got a point. Old habits. I’ll just give you the highlights, since there are necks on the line here.” He took a pull, then continued, “The Company does a lot of its business off the books.”

  “You mean it outsources.”

  “Yes, but not just that. A contract operator has less of a trail back to the Company if anything goes wrong. Deniability. For one, he’s got a life insurance policy on him so the U.S. government isn’t paying his widow death benefits. It’s a ‘no questions asked’ situation, and they’ve used it a lot, especially since the start of the war on terror, as it’s known. The problem is that outsourced agents can’t get what they need directly from the Company. This is not a new issue. When the CIA was created, it set up companies in the U.S., Europe, and around the world, run by agents at first, later by patriots. With Company resources and good business management you’d be surprised at how successful some of them have become. You’d even know a name or two. So when an operator needs cash, a job title, things like that, these companies step up.

  “So … passports. Not every such operation is legal. That’s how independent operators get weapons, communications gear, and the such. At least one of them specializes in identities. They have a stash of perfectly legitimate blank passports from a number of countries, including Canada. They prepare them just the way the Canadian government does. Now, here’s the tricky part; they’ve got a source inside Passport Canada. That’s a quasi-independent government agency that reports to the Citizenship and Immigration office there. It’s been a disaster from the first. Passport Canada hires people without proper clearance, issues felons passports; it’s a mess. So this guy working there inserts all the information directly into the official government database. I’m telling you, Jeff, thes
e passports are in effect the real deal. Now, I need you to trust me. I’m as exposed as you are.”

  “All right, then. Thank you.”

  Frank removed a cell phone from his pocket and slid it over. “Here’s a throwaway. Keep it charged and with you. There’s a strip of masking tape across the back with your number and mine.”

  Jeff glanced at the phone, then slid it into a pocket. “Should we be worried about Agnes?” He hadn’t expressed his concern or fears in transit not being entirely sure their conversations were secure.

  “Naw. I was once in … now, where was it? Oh, yeah, Rome. Anyway, I was in Rome, eating dinner with someone I was running, when this guy comes up all smiles. We’d gone to high school together, wanted to know how my wife was, shook my hand until I thought it would fall off, gave me his business card, hinted he wanted to join us, then seeing I wasn’t going to invite him he moved on.”

  “Awkward. What did you tell the man you were with?”

  “Mistaken identity.”

  “Did he believe you?”

  “No. The funny thing about it was I’d never seen the other guy before. I’d never gone to school with him, and he didn’t know me. He had my name wrong and that of my wife. It really was mistaken identity. So there you are. Agnes won’t be a problem. If we become a national story or the cyber community spreads word around, then she’ll try to put two and two together. If she likes you, she’s not likely to call the authorities because she’ll have her doubts, especially Agnes. Federal law enforcement has lost a lot of credibility since the Patriot Act and PRISM. And even if she tells someone about seeing you, the Miami airport feeds lots of places in the world.”

  “It’s the gateway to South America.”

  Frank nodded. “There’s that. But, Jeff, you give them too much credit. You’re not traveling under your own name. They’d have to use facial recognition to spot either of us and take it from me, since my group developed that software to its current state, it is nowhere near as fast or simple as the movies make it seem. I know their capability, and it’s limited. Mostly they catch people because people do stupid things, or act guilty. That’s why you need to put this out of your mind. For the next little while, you are Doug Bennett. Think about your cover story, don’t flash too much cash and ogle the babes. That’s the national pastime down here.”

  “What about Carol?” Jeff asked. He had no one who needed to know he was on the run but Frank had a wife and family.

  “Carol is fine.”

  “I don’t understand. How can she be fine with all this going on?”

  Frank took a pull of his beer. “She knew what I was when we met, or at least not long after we met. She’s the reason I made the career change but that didn’t happen overnight. She’s lived with this before. We have a code, just in case.”

  “What kind of code? What’s it for?”

  “It’s for emergencies when I might have to go to ground. I was still in the field for over a year after we started living together, so I gave her a code expression. Whenever she heard or read it from me it meant I was fine but had to vanish for a while and couldn’t be in touch with her. She was to do nothing. Not call anyone, not talk about it.”

  “Couldn’t someone from the Company keep her posted, so she wouldn’t worry?”

  Frank smiled. “Jeff, you are an American original. The Company might very well be why I was pulling my vanishing act.”

  “You’re not serious.”

  “After all you’ve been through since 9/11, and especially these last few days, you still don’t get it. The field is no different than Langley was. Remember those days? Management has its own agenda, the best and brightest are few and far between, motives are muddled. As often as not out there my adversary was the home office. Dealing with the official enemy was pretty straightforward and with most of the enemy operators there were rules we followed.”

  “Rules? In espionage?”

  “Of course. We all had families. One rule was that they were off limits. There were others.”

  “So how many times did you have to hide from the Company?”

  “That was just an example of why I needed a private code. I actually only kept my head down from the home office once and that was just for a few days until the situation corrected itself.”

  Jeff started to ask, then stopped. What Frank might very well mean was that he’d corrected the situation personally. “Okay.”

  “You never know when your past might catch up with you, so I kept the code alive. I called Carol when we went to ground so she knows I’ll be out of touch for a while.”

  “Still, she must be worried.”

  “Oh yeah. No matter how hard you try you always worry.”

  53

  MITRI GROWTH CAPITAL

  LINDELL BOULEVARD

  ST. LOUIS, MISSOURI

  3:01 P.M.

  Jonathan Russo looked up from the code and nodded to Alex Baker with approval. “We’re getting there,” he said.

  “How much are we committing?”

  “Everything. Opportunities like this don’t come along that often. We have no idea how many high-frequency traders will be in on the action, skimming the cream, and we have losses to make up for.”

  “I’m concerned no matter how good our algo looks. The new IPO software the Exchange is using is still buggy. I called a contact there, and she’s not sure it’ll be fixed by Wednesday.”

  “Are they going with it anyway?”

  “She says they are, though there’s a revolt going on with the staff. But the Exchange committed to it publicly, and they are being told it has to fly.”

  “That’s a hell of a way to run a railroad.”

  Baker shrugged. “You know what they’re like.”

  “I’m afraid so. I like what I see here,” Russo said, indicating his screen, “but I want you to triple-check our exit code. We’ve established parameters in which we’ll do well. If the trades migrate out of the parameters, we have to be sure we’re no longer participating. I think we’re secure in that regard.”

  “I’ll be working on that all day tomorrow.” Baker stopped but seemed poised to say more.

  “What?”

  “I’m concerned the algos are getting too complicated.”

  “They are sophisticated, no doubt about it.”

  “They are time consuming to trace and too much of the code has been generated by other code. I have to use tools to understand some of it.”

  “Nothing new there.”

  “In this case, though, it is. I frankly don’t understand some aspects of our algos. I know that the tools say they’re fine and that they test out on our machines but…”

  “So what’s the problem?”

  “I don’t understand them except in the most general way. I could write a short paper describing how they function but I can’t explain the details of the functionality.”

  “Yes, it’s not like the old days, but we’re going to see more and more of this, Alex. The day will come when code will write all code. We’ll just tell it what we want it to do.”

  “Not soon, I hope. I don’t trust it.”

  Russo leaned back. “Don’t tell me that you want to hold off? If the algo really isn’t ready, we shouldn’t use it. But you don’t know that, do you?”

  “No. I’m just uneasy is all.”

  “It’s always that way with something new. We’ve never been this aggressive before, this committed.”

  “That’s it I guess, plus we had that problem last week, when the test had run just fine. Okay, late tomorrow, I’m shutting it down to changes, then we’ll run a number of scenarios in-house. If all goes as expected, we’ll be good to go. We’ll deploy the update two hours before trading begins Wednesday morning.”

  “I’m depending on you. I’m exhausted. I’m going home for some rest and I’ll be in late tomorrow. We’ve a long day ahead of us once I get here.”

  Russo watched Baker leave his office. He understood what the man was saying
. When he started out, he’d written code from scratch. Later, he basically copied and pasted, then adapted code he had crafted already. Only when he went to work for Jump Trading, had he returned to writing code from scratch, at least in the beginning. Now every high-frequency trading company copied where it could, duplicated functions, producing nearly identical algos. They made money even then, but every edge you could encode meant a lot.

  In Russo’s view this code was conservative compared to what he’d really like to do. He was already thinking of how it would be rewritten for the next major IPO. He’d squeeze the other HFTs out, that’s what he’d do. They’d never know what hit them. He was expecting to do well on Tuesday, and was prepared to bail out at signs of trouble, even overriding the program if he didn’t like what he saw. Despite his desire to plunge after the algo problems and losses of the previous week, there was too much on the line to be taking needless risks.

  54

  TRADING PLATFORMS IT SECURITY

  WALL STREET

  NEW YORK CITY

  3:17 P.M.

  Back in Manhattan, Daryl had found an image of a NYSE employee ID online, printed a copy at Kinkos, affixed a passport photo she had taken there, laminated it, and attached it to a lanyard. While it looked authentic, it didn’t have the RFID chip on it that would open secured doors when swiped past a reader.

  The name on the card was that of a woman from the Server Systems Group at the Exchange taken from the employee information Jeff and Frank had compiled during their reconnaissance. Besides being on vacation and from a department that would give Daryl latitude to move around, she bore a vague resemblance to Daryl, at least based on the small photo in the company directory.

  Daryl now stood outside the Wall Street building housing the offices for Trading Platforms IT Security and waited for a crush of employees, preferably one with several young women. It didn’t take long. She blended in with a stream, hanging close to three laughing and chatting women. Each swiped her card as she passed through a waist-level security gate. Daryl hurried behind the woman in front of her, sliding through before the gate closed while swiping her card. The security guard’s attention was elsewhere and the chattering group hadn’t noticed her tailgating behind them.