The Exphoria Code

by Antony Johnston

  “All done?” asked the policeman.

  Bridge smiled as he ushered her out of the house. “All done.”

  21

  They were the right keys.

  Brockley Gate. TR7. That’s all Ten had said, but it was enough. Out of context, to someone who didn’t have the keys, or know Ten himself, it might appear meaningless. Brockley Gate was easy enough to find, a cul-de-sac of private lockups not far from his house. But the lockups weren’t numbered in any way that resembled TR7, and when Bridge looked up the postcode, she discovered TR7 was for Truro in Cornwall. Anyone following that thread would be on a wild goose chase.

  But the keys themselves had a homemade fob, a thin strip of paper folded once over the key ring and completely bound in sticky tape as a crude form of waterproofing. It was old, browning from light exposure and however many kinds of dirt, grease, and oil had been transferred from Ten’s hands. Creased, crinkled to within an inch of its life, and curling at the edges. Underneath the layers of tape, the blue ballpoint ink of what Ten had written there seemingly decades ago was visible. Just two digits, 18.

  At this time of night, the lockup area was deserted. Bridge noticed the silent, dim red pulsing operation light of a CCTV camera mounted high on a corner wall, watching for thieves. But she was no thief; she had a key.

  Lockup number 18 was one of the larger units, as wide as two of the nearby houses, with a double-width rollup door. She inserted Ten’s key in the lock and turned it. With a solid metallic click, she felt it give and unlock. She pocketed the key, then lifted the door open with a grunt.

  Inside it was completely dark. She had a flashlight on her iPhone, but didn’t use it right away. To whoever was watching on the other end of that security camera, it would look pretty dodgy if she didn’t appear to know where the light switch was. So she stepped inside, lowered the door behind her, and waited till it was completely closed, enveloping the lockup in complete darkness. Then she activated the flashlight, and found the light switch.

  Bright halogen strips temporarily blinded her, but as her sight returned she knew she was in the right place. Tool racks lined the walls. Where the racks ended, metal shelves filled with parts and smaller tools filled the space. Next to the wall-mounted power point was a workbench covered in half-built parts, oily chamois leathers, an oil-stained portable stereo, stacks of CDs, an electric kettle and a coffee mug. The workbench was as untidy as anything in Ten’s house. The tool racks and shelves, by contrast, were extremely neat and well arranged.

  And in the centre of the unit, in differing states of repair, were four sports cars.

  Bridge smiled to herself. Ten hadn’t been bullshitting at all. They were real. The only problem now was that she knew very little about cars. Sure, she could drive. Advanced Driving and Pursuit was one of the many courses she’d undertaken at the Loch, though not her best, and once she got out of the driver’s seat she stopped caring. To her, cars were nothing more than tools, a means of getting from A to B, and in London there were a multitude of ways to do that without the indignity of having to drive yourself.

  So none of the cars were immediately recognisable to her, although she definitely remembered a couple from the days when Tenebrae_Z used to post occasional ‘Adventures in Elbow Grease’ photo sets to uk.london.gothic-netizens, for the benefit of the half-dozen other members who oohed and aahed over them. Ten was always careful never to show anything that could give away his location, or include his own face in the photos — another reason why some had cast doubt on whether he was pulling their legs. But the more Bridge looked around the garage itself, the more she recognised it from the background of those pictures. She glanced over the manufacturer badges of each car. A green Austin-Healey, a white Lotus, a blue MG…

  And there, a bright red Triumph TR7.

  It was a funny-looking thing, a triangular wedge that was all hard angles and corners, none of the smooth curvature associated with modern sports cars. She’d seen it somewhere before, and not just in Ten’s photos from the garage. A Bond film, maybe? She smiled and shook her head, wondering if that was why Ten had chosen to direct her to this car in particular. But direct her to it was all he’d done, and now she had to figure out why. She found the keys to the TR7 on a rack hanging above the work bench, opened the car door, and slipped inside.

  The first thing she noticed was how small it felt. She couldn’t imagine driving this thing for more than five minutes without needing to stop and stretch her legs. The thought made her realise that she had no idea how tall Ten was, no context for his own comfort in a vehicle like this. On the one hand, why buy a car too small for you to sit in comfortably? On the other hand, she knew enough about restoration geeks to guess Ten may never have intended to drive the car. She’d noticed on her initial walk around the exterior that it had no licence plate.

  What was she looking for? She didn’t know, but Ten must have thought it important enough to send her here, and specifically to this car.

  Like most old cars, the interior was sparse. The driver’s side had a small coin shelf, but all she found in there were two small screws. The gearbox was uncovered, affording a view down into the guts of the car, which made the lack of anything meaningful quite obvious. She turned round in the seat, wondering if there was something in the back — then laughed at herself when she came face to face with the rear window, and remembered that cars like this didn’t have back seats. Probably didn’t have much boot space, either. Not exactly designed for a family holiday; more for a day trip out to the country house, all goggles and driving gloves.

  Gloves.

  The glove compartment was locked, and she wondered who on earth would need to lock a glove compartment? But there was a second, smaller key on the TR7’s ring that opened it.

  Inside was an owner’s manual, a logbook, and a Western Digital portable hard drive.

  Chances were that nobody except Ten had touched the drive, but Bridge wasn’t in the mood to take chances. She wasn’t carrying latex gloves, but did have a pack of tissues in her coat pocket. She used one to pick up the drive, turned it over in her hands — two terabytes, she noted — and placed it in her inside pocket.

  The train ride home seemed to take days.

  22

  “Sorry, but the number you have dialled is not in service. Please replace the handset and try again.”

  Bridge never understood the point of that last bit. Try what again, exactly? Dialling the same number, on the off-chance it might have come back into service in the last three seconds?

  The number was the one Ten had called to speak with the man who’d been posting the ASCII art pieces, and arranged to meet twenty-four hours ago. The man Ten described as ‘just a bloke’, but who had presumably killed him. Far from ordinary. But when Bridge dialled it, the very polite pre-recorded woman’s voice delivered nothing but disappointment.

  To get the number, she’d had to decode the ASCII posts. To decode the ASCII posts, she’d had to figure out the encryption method. And to figure out the encryption method, she’d had to read through Tenebrae_Z’s notes, on the cloned hard drive.

  Bridge had returned home, found an old Thinkpad laptop, disabled all its networking capabilities just in case, dug a USB cable out of her desk drawer, and hooked up the WD hard drive from Ten’s garage. To her surprise, the drive wasn’t password-protected. It was a clone dump of his Alienware laptop, the whole shebang. She could have booted directly off it if she’d wanted to, but resisted that urge in case doing so might somehow lock her out.

  She also resisted looking through the gigs and gigs of personal stuff. Andrea Thomson and her people at Five would undoubtedly comb through all of that, but Bridge wasn’t sure she wanted to see it. The more she knew about Declan O’Riordan, the more her own image of Tenebrae_Z slipped away. She wanted to hold on to that image for a while longer.

  Instead, she went straight for the desktop directory nam
ed ‘ASCII posts’. Inside were text-file copies of all the Usenet posts Ten had found, just like Bridge’s own copies. But he’d found almost a dozen more files than she had, and more importantly, the folder also contained several files Ten had written himself. And one of them was called Master_Decode.txt.

  It contained a list of fourteen entries, one for each ASCII post, labelled ‘Date — clues — message’.

  Apr 28 - Thatcher/Wellington - “May 1/2100/Holland”

  May 15 - Pastime/Raccoon - “Cavendish-17-05-1230-urgent”

  Jun 18 - Recalcitrant/Fallujah - “June 20/2200/Gladstone”

  ‘Recalcitrant’ and ‘Fallujah’. Those were the answers from the Times crossword of June 18th. So that was the paper they were using. But how had Ten decoded all of these posts? How was this information hidden in ASCII art? And what on earth did the crossword answers have to do with it?

  Bridge stared at the file, turning the questions over and over in her mind, letting her thoughts drift out of focus and waiting for the answers to surface.

  Perhaps they used the Times out of a sense of tradition. Or perhaps because it was one of the few newspapers you could be sure to find in every major city of the world. Or, as she’d previously thought, perhaps the man posting the ASCII art was a genuine old-school spy from the days of the Cold War, and the Times was simply one of the few papers that had endured.

  The dates and times meant the codes were probably rendezvous arrangements, but she had no idea what the other words and names could mean. Some were formatted strictly, some were more haphazard. More than one sender? They all used the same black-hole email address, but that didn’t mean it was the same person using that email every time. Some messages read like instructions more than meeting appointments. They were all different character lengths, yet every ASCII art post was the same 78 x 78 grid. That was puzzling, though she also noted each post had a varying number of whitespace characters, owing to the arrangement of text into the ‘pictures’. So it was possible they all had different character lengths, too, once you removed the blanks. Perhaps those message lengths related to the post length, somehow. A substitution code? But that would be too simple. If it was just ROT-13 or a similar sub cipher, Bridge and Ten would both have spotted it within minutes. Character appearance frequency alone would give it away. There had to be something more complex here.

  Was it possible the posts were mostly a red herring, where the crossword reference was the only real information in each, and the remainder really was plain old ASCII art? Ceci n’est pas une pipe, and all that. But Ten said he’d found a phone number in one of the posts, and there it was, right in the decoded entry from two nights ago. How could you get that, and all these other messages, from two crossword puzzle answers? She thought of book lookups, where both messengers had a copy of the same edition of the same book, and looked up words in the book to render a message. But that would require much more than two words, and there were no number references in the crossword answers themselves. It all came back to these bloody crosswords, and how on earth you could combine them with the ASCII to decode a block of text…

  Bridge groaned, then laughed, as the answer came to the surface.

  Symmetric keys.

  Modern cryptography contained a multitude of methods for encoding messages. The most common was public/private key pairing, where one half of the ‘key’ that would unlock a secret message was publicly known, because it was useless without the other half — the private half, which was kept secret. Millions of secure online connections and internet transactions around the world relied on public/private key pairing every day. But there was another kind, simpler though no less hard to break if the parties involved were careful. Symmetric-key encryption, in which the same key was used both to encode and decode a piece of data…or a message.

  Without the key the message was garbage, impossible to decode using even the most powerful supercomputers in the world. But if you possessed the key, and knew which method had been used to encode it, the least powerful computer in the world could combine the two and decode it instantly. That was the weakness in symmetric keys; only one piece of information needed to leak for the data to become vulnerable. But the delivery method here was obscure, and the decoded messages filled with jargon. The sender must have been very confident the key wouldn’t be discovered, and even if it was, the encoded messages would mean nothing.

  They weren’t entirely wrong. With the contents in front of her, courtesy of Ten’s decoding efforts, Bridge still didn’t really know what she was looking at.

  A plethora of encryption algorithms was available to encoders, most of them based around calculations using enormous prime numbers. But then she remembered that only a few had one important thing in common; no matter what message you put in, you could ask the encoder to output an encrypted result of fixed length. One word, two words, a whole paragraph, it didn’t matter. Whatever you put in, you’d get back a coded message of fifty characters, or a hundred, or two hundred, or whatever you asked for.

  She smiled as all these pieces locked together in her mind, like a puzzle board. The ASCII art posts were encoded output, of a fixed length, with the exception of the final characters that referenced the crossword puzzle answers. Those solutions couldn’t be matched to random output, meaning they had to be chosen, and that in turn meant they must be part of the encoding process. So, what if the original message and the two crossword answers were all entered into specialised software, using a fixed-length algorithm to output the final encrypted text…which was then posted to the internet, disguised as a piece of ASCII art. All the recipient had to do was copy and paste the ASCII text, remove any white space and line breaks, and feed it back through the software using the two crossword puzzle answers as the key. Hey, presto, and the original message would appear.

  It had been hiding in plain sight all along. The whole thing, staring her right in the face. Bridge took some solace from the fact that even knowing all this, without identifying the encryption algorithm that had been used, she still couldn’t have been expected to decode the messages when she and Ten were first looking at them.

  But she could have had a bloody good go, and judging by the notes on his hard drive, that’s exactly what Ten had done. Methodically working through all the newspapers, and all the fixed-length-output algorithms, no doubt producing mountains of garbled nonsense before he hit on the one that returned a message. A date, a time, followed by words, names…and, in one instance, a phone number.

  Bridge called it, and heard the recorded message informing her the number was out of service. That didn’t surprise her. If Ten had stumbled upon some kind of criminal enterprise (and what else could it be, with this level of secrecy and subterfuge?) then the messengers would use disposable ‘burner’ phones, cheap Android models from China and Korea that criminals bought by the dozen, and used just once or twice before dumping them in the Thames. If they hadn’t before now, realising their code had been broken by some random guy in London would have driven them to destroy their current phones.

  Along with Declan O’Riordan.

  She scanned the fourteen other messages. Most were the regular meeting schedules, or the shorter format which she presumed came from a second messenger. Three older messages also contained phone numbers, but like the most recent one, they were no longer in use. And then there were two messages that broke from the usual jargon:

  Feb 10 - Existential/Libor - “Project codename EXPHORIA - source embedded”

  Mar 2- Ballot/Trafalgar - “First handoff - success - delivery soon”

  Exphoria. It meant nothing to Bridge, but the message itself said it was a project codename, and the remainder of those messages made the hairs on her arms stand up.

  Source embedded. First handoff. Delivery soon.

  23

  “How the hell do you know about Exphoria?”

  Giles was already annoyed at Bridge for
calling him out of his Friday breakfast meeting. When she then opened the conversation by asking what ‘Exphoria’ referred to, his reaction made her wonder if maybe this wasn’t the best way to begin.

  “Wait,” she said, “let me back up. Declan O’Riordan sent me a scheduled email in the event of his death, and it led me to this.” She placed the hard drive on his desk. “It’s a cloned copy of the hard drive from his laptop. Five don’t know about it…” Giles’ eyes threatened to outgrow his glasses. Maybe this wasn’t the best tack, either, but now Bridge was committed, and she walked him through everything. From the moment she received the email on her phone the night before, through obtaining the garage key, finding the hard drive in the glove compartment, searching through the files on the hard drive, figuring out the encryption method, and finding references to the ‘Exphoria’ project codename, embedded sources, and handoffs. Finally she said, “Whatever Exphoria is, I think there’s a mole.”

  Giles wasn’t often lost for words, and when he was, it was normally because of someone in Whitehall — frustration at a SPAD, PPS, sometimes senior mandarins or even ministers. But not this time. His mouth opened and closed in silence, then he narrowed his eyes at her while taking a long, steady breath.

  At the back of her mind, she’d known her actions last night were at best rash and unauthorised, and at worst simply illegal, but she had to get to the bottom of it all. The problem was that she didn’t have the faintest idea what ‘it’ was until she read the decoded messages, and somehow she didn’t think that would cut much slack with Giles. He had the look of a man about to do something necessary but unpleasant — like, say, sacking one of his best analysts.