She considered her recognition of all the Hydarnes-sourced IP domain addresses as being transliterated from original Arabizi as more a fluke than unusual or even supernatural clairvoyance, which was how Irvine had exaggerated her suggestion in the first exhilaration of even partial deciphering. And how she thought of it again now as she sat before her computer in the stark Langley office, asking herself how she could possibly make another contribution.
The simple, as always self-honest, answer was that she couldn’t. Monkton hadn’t called back and there’d been no update from Irvine at Fort Meade. The only addition to the evening TV news announcement of the Senate enquiry, which she already knew about, was of a promised CIA statement the following day about Abu al Hurr’s death. Leaving Sally with the choice between an empty evening at her Watergate service apartment or an umpteenth re-examination of the GCHQ and Fort Meade downloads on her Langley computer. She chose Langley for its secure telephone link to Irvine. Who would already have used it to call her if there’d been any breakthrough. They were now relying on GCHQ to provide it, from whatever else—whatever new—GCHQ intercepted. Irvine could be right, of course: there was no proof they had anything new. It was a surmise, from the British withdrawal, which was a result of career fears. There could after all be something among all the mathematical hieroglyphs she was looking at. Careful, Sally warned herself. If there were, she’d already accepted it wasn’t she who’d have the eureka moment. How close, though, could GCHQ conceivably be? She could gauge—or at least make a calculated guess from what she had in front of her—that directly hidden in every intercepted Vevak Facebook post was the partial transliteration.
Sally closed her split screen to concentrate entirely upon the British cache, remembering as she did so that it was GCHQ who’d snared both Kermani and Smartman. With that came the further recognition that Kermani was the only interception whose domain address was in the name of a known Persian historical figure, the shah assassin Mirza Kermani. Was using the revolutionary’s name significant? Or was she trying too hard?
There had been three encoded Kermani messages. The first according to date and for which GCHQ had sought American help had transliterated from the original Arabic into twenty-four Roman letters and numerals. Nine—AANBLEEYE—were potential decryption. Still encoded were WIQQFDNCMLN59NM. She knew from the time she’d spent at Irvine’s side that single letters were rarely if ever repeated in translation after their first use, and that some single letters represented a block. Some letters and figures were meaningless decoys. Digital dots and separations could also have letter significance. Until at least half were decoded, it was usually impossible to separate a string into comprehensible words. After thirty minutes she gave up trying to make sense out of the first block of nine. Kermani’s second message ran to forty-two letters, numbers, and digital characters. There were ten hopeful decodes—ICEOUFLUIS—and thirty-two failures.
With eye-blurring concentration Sally worked for a further two hours through every English-collected message from Kermani, running over into Smartman, Anis, and Swordbearer exchanges shared with Fort Meade, before finally abandoning the effort, acknowledging the pointlessness. She briefly considered telephoning Irvine’s direct Fort Meade line but abandoned that idea, too, grateful to finally get to her Guest Quarters apartment, too tired to bother with food.
At exactly 3:00 a.m. by her illuminated bedside clock, Sally came abruptly and fully awake, the awareness complete in her mind. She couldn’t be right. It had to be an aberration, a fatigue-induced hallucination that she could check unbeknownst to anyone when she got to Langley in the morning.
She lay open-eyed in the darkness for another fifteen minutes, isolating it again and again and becoming surer every time that she was remembering correctly, before throwing off the bedcovering. It was the morning. Why was she waiting?
39
It took just fifteen minutes for Sally to confirm she hadn’t been hallucinating and only another ten for her to assess the significance of her realization. Four a.m. in Washington, DC, was 9:00 a.m. in London. David Monkton answered his direct line on its first ring.
‘I know the British target and believe I can confirm the American through it. We’ll know for sure when we run some numbers through Fort Meade’s computers.’
‘Where are they?’ monotoned Monkton.
‘The RAF base at Waddington, Lincolnshire, and a USAF base somewhere here.’
‘From Waddington drones are flown against Al Qaeda IS and the Taliban in Afghanistan and in Pakistan.’
‘As well as in Yemen and Somalia,’ expanded Sally.
‘What makes you so sure?’
‘The first intercepted Vevak message in the Kermani group, the one for which GCHQ asked for NSA’s help,’ listed Sally. ‘Waddington’s post code, LN5 9NA, was hidden in the encryption.’
‘Is that all?’ pressed Monkton.
It was impossible to discern the doubt, but Sally guessed it was there. Not hiding her irritation she said, ‘I think complete postal coordinates in an encoded Iranian intelligence communication for a British air base from which drone attacks are mounted against Al Qaeda IS and Taliban targets justifies a security alert!’ She was breathless, jagged voiced, when she finished.
‘So do I,’ punctured Monkton in three words.
Shit, he’d off-balanced her again, Sally acknowledged. ‘And would be doubly justified when we uncover the zip code.’
‘It’s your four thirty in the morning,’ Monkton unnecessarily pointed out. ‘You’re surely not proposing to wait until Fort Meade wakes up to run your zip-code search when GCHQ is fully operational right now!’
Sally smiled in anticipation of her recovery. ‘No, I’m not proposing that! I’m sure about Waddington—and glad you agree with me—and believed alerting you was my first priority. The Fort Meade unit is awake: they’re working a twenty-four-hour rota. With their technology they’ll do in minutes a search that would physically take me hours and still risk a mistake or an oversight. If there’s a match, GCHQ get the complete package, which keeps to our agreement, and if there isn’t, they get what’s applicable to them, to England, without wasting their time.’
‘Logically argued,’ conceded Monkton after a pause. ‘Next question: When?’
‘We don’t have that, not yet. But we can be in place, ready, ahead of any attack. We’re not expecting it to be a long wait, are we?’
‘Not if the indicators are right. You—and Meade—have got an hour.’
‘Thank you.’
‘And well done. Once again.’
* * *
Sally recognized the drawl but couldn’t remember the name, which wasn’t offered in return when she identified herself. He said he’d wake Irvine, but Sally suggested he run the check first: she could be wrong.
‘You got the zip?’
‘Two, off the Internet: 89018 and 89070,’ offered Sally. ‘Try 070 first: I’m guessing it’s base-dedicated.’
‘Give me your number.’
It was Irvine who called back. ‘We located both: 070 in the third Kermani post, 018 in Swordbearer’s first. It’s definitely Creech Air Force Base at Indian Springs, Nevada. And you should take up clairvoyance as a profession.’
‘I’ll think about it as a career change,’ dismissed Sally.
‘Who else knows?’
‘Monkton. But he’ll leave you to tell GCHQ when I tell him it’s definite.’
‘I’m on my way down.’
‘I’ll be here.’
‘And congratulations.’
Which was the word Monkton used when she called him back, twenty minutes short of his deadline. So why, she wondered, wasn’t she feeling more satisfied? It didn’t improve even when she made a connection they could follow to get the date for the attacks.
* * *
‘Bradley fell over himself for a breakfast meeting, so I came down myself; so it made sense to carry on personally,’ said Ben Hardy. He’d taken a chance arriving at Pennsylvania Aven
ue unannounced, but so far it looked as if he’d pulled it off.
‘Absolutely,’ agreed the FBI director.
‘He’s one hell of an angry guy.’
‘What’s he got to say?’
‘Everything and anything you want to know about Operation Cyber Shepherd, I guess,’ exaggerated Hardy.
‘Let’s hear it!’
‘Devised by Irvine—first name Jack—whom you know from Homeland meetings. Comes with heavy baggage. Father was the U.S. ambassador to Lebanon who almost caused a Middle East war trying single-handedly to get Hezbollah, Fatah, Hamas, and Israel all tucked up in the same bed—’
‘And skewed a presidential election here because the Jewish vote didn’t go to the incumbent’s second term re-election,’ broke in Bowyer, remembering.
‘The link continues, after a fashion. Irvine’s a computer geek. Worked in Israel with Conrad Graham perfecting the sabotage of Iran’s nuclear development.’
‘How’s Cyber Shepherd work?’
‘It hits terrorists before they hit their intended targets: simply takes them out.’
‘Now there’s a lot to think about,’ mused Bowyer.
* * *
‘You spoken to Graham?’ demanded Irvine before he entered her office, ignoring his own. He’d jogged from the parking lot and was breathing heavily.
‘Tried to, when he didn’t contact me,’ said Sally, who’d known Graham would have been aware from the omnipresent internal security of her nocturnal return. ‘He’s unavailable until mid-morning, which is a bonus. I’ve got an idea of how to find out when they’ll hit.’
‘How?’
‘[email protected]. Isn’t that where he’ll be, but where you couldn’t find him: hacked into a military base?’
Irvine shook his head in bemused realization. ‘Shit, yes! He’s got a botnet in a computer somewhere there.’ In his excitement Irvine pulled up from the only other chair to lean over the desk towards Sally. ‘That’s it! We’re gonna get him!’
‘No, we’re not, not that easy. We’ll only get one shot. One mistake—the vaguest hint that we’re looking, know where to look—and we’ll lose him, lose everyone: those in England, others elsewhere, and the Hydarnes access.’
Irvine eased back into his chair, the euphoria gone. ‘The concealment will be good, the best. We know it will.’
‘The best. But you’ve got to be better because you’ve got to do a lot more than just find it. When you do—and get past all the obstacles—can you hack into him: put a botnet inside a botnet to see everything that passes between Smartman and Hydarnes without their knowing you’re there?’
‘Yes.’
Almost too quick, worried Sally, and wished she hadn’t. ‘Have you done it before?’
‘Yes.’
‘Then we can stop it all, like we did before.’
‘What can go wrong!’ clichéd Irvine, confidence returning.
‘That one mistake.’
* * *
The objections were immediate and predictable. With Irvine listening—and prompting—from her side, Sally openly spoke to Monkton from her monitored CIA line, wanting to prepare the overhearing Conrad Graham for the inevitable disagreement to follow. For the first time she consciously welcomed Monkton’s unnerving silence for the uninterrupted opportunity it hopefully provided to persuade the man that for them to get the attack date, there should be no immediate response beyond the Internet search for Smartman.
‘It’s a virtual certainty that Smartman is embedded somewhere within the Creech IT system, reading everything. He might even be an airman serving on the base. So there can’t be any abrupt and visible military buildup of men or equipment,’ Sally warned. ‘Absolutely paramount, no electronic communication containing any reference—the slightest indication—to what we know. Every communication has to be handwritten on non-electric equipment and hand-couriered. Both GCHQ and NSA have established beyond doubt that domains have been shared on at least two darknet sites. Jack, who’s with me, has already advised GCHQ to sweep Waddington’s entire IT systems for a duplicate of what we’re sure is a Smartman botnet at Creech. Technically GCHQ can get into Smartman’s hack and read his traffic. That’s how we’ll get the date.’
For the first time ever betraying an emotion—incredulity—Monkton said, ‘You’re guessing, an absolute and utter guess, that Smartman has hacked into a Creech IT system! You’re proposing, on the basis of that absolute and utter guess, that America—and we, here in the UK—do nothing in the hope that, first, you’re right; secondly, that Irvine’s unit will find the intrusion; thirdly, that they’ll be able to invade it without being detected and finally get a date for the attack. And only then, according to your reasoning, do we do something about trying to protect ourselves!’
‘No!’ denied Sally desperately. ‘I don’t know the geography around Waddington from here. There must be a base, facilities of some sort, close enough covertly to move in personnel and equipment with helicopter support to bring defence in within minutes.’
‘You’re proposing a variation of Sellafield all over again,’ accused Monkton. ‘But at Sellafield we had our defence inside, waiting, as well as outside.’
‘So far al Aswamy, Al Qaeda, Iran, whoever the hell all these people are, have lost in everything they’ve attempted. But still won,’ fought back Sally. ‘They haven’t caused any real damage or physical harm, but they’ve still generated global hysteria. Here’s their cherry on the cake: hitting the two places from which they’ve been hit and thousands killed. This is their pièce de résistance. We can’t just prevent it. We’ve got to get al Aswamy and all the other jihadists and publicly arraign them—publicly show they’ve failed and can only posture.’
There was a silence now Sally didn’t welcome. Monkton said, ‘Your reasoning is skewed, Sally. And all this is academic anyway. I promise I’ll put your thinking forward, but it isn’t our decision, is it? We elect people who know better than us to decide things like this.’
‘That argument didn’t work at all, did it?’ sympathized Irvine at the end of the exchange.
Neither did Irvine’s when he tried to make the same, now rehearsed pitch to the already-rehearsed Conrad Graham, whose rejections were familiar to both. ‘And now this operation can at last be properly organized,’ completed Graham. ‘Pending the findings of the congressional enquiry, the president’s appointed me acting CIA director. I’m already operational. And very much in charge of Operation Cyber Shepherd.’
An hour later the CIA issued its Abu al Hurr statement. It included, in full, a medical certificate signed by two doctors attesting that the man died from an aneurysm rupture of the aorta. The autopsy also established that the aneurysm was a long-standing and obviously undiscovered condition. Concluding the long-running and misleading coincidences, Algeria arraigned a captured terrorist from their leading Al Qaeda faction who’d confessed to involvement in the Madrid atrocity committed by James Miller and Milton Kline. It had, insisted the man, been a single act, unconnected with any other Al Qaeda or jihadist activity.
John Poulter’s telephone call, patched through from Fort Meade, halted Irvine and Sally as they were about to leave Langley. Poulter said that after some reconsideration, GCHQ felt the circumstances required the closest and direct co-operation. Irvine told the other cryptologist he felt the same and was glad there’d been a rethink.
On their way to the Owen Place safe house and its secure computer links to Fort Meade, Irvine said, ‘I’ve got a good feeling about how this is going to turn out.’
Sally wished she had, too.
40
Conrad Graham’s parting insistence that Irvine remain instantly available—which Graham also demanded of Sally, who didn’t intend on going anywhere—meant Irvine’s staying in Washington, which Sally welcomed on every level. She hadn’t expected to miss Irvine as much as she had during his Fort Meade absences and balanced her conscience twinge with the professional recognition that his secure Owen Place
computer bank would give her unrestricted access not just to his own unit’s eavesdropping but to all Cyber Shepherd traffic with GCHQ as well. And it wouldn’t stop there. Her minimum twice-a-day conversations with David Monkton and morning and afternoon sessions with Conrad Graham would provide an overview of each of the drone-base protections that began at Waddington and Creech within two hours of the attack alert.
Sally was relieved that voices in addition to hers had echoed her concern at an obvious military buildup at either air base. Only a dozen officers—men as well as women, commanded by two undesignated wing commanders—were to be moved onto the Waddington base. All but two would be military communication specialists and technicians with closed-circuit contact with the outside Special Forces and military defence units. The other two were IT experts who would liaise with outside GCHQ colleagues, supplied with their owners’ or users’ bona fide IP domain codes to pick their way as quickly as possible through every base computer mainframe, desktop, laptop, and connected cell phone for [email protected]. The force waiting outside was to be divided between four neighboring RAF bases—Coningsby, Cranwell, Digby, and Holbeach—all within five minutes’ helicopter flying time of Waddington.
Concealment of an outside military reaction force was more limited in Nevada, but from the planned schedule appeared already to have been effectively prepared. Nellis, ten minutes’ helicopter time from Creech, was the only nearby holding area of sufficient size, but there had already been a Pentagon announcement of a desert-survival training exercise to cover the encampment, under canvas, of two hundred SEALs and Special Forces only a mile from Creech. The inside command contingent was to be made up of twenty officers, again male and female, who were to enter in twos and threes during that early evening and night. Five were the core segment of a fifteen-strong Meade IT sweep team—independent of Irvine’s unit—hunting Smartman.
The Cloud Collector Page 30