“And if Israel plays the best defense,” says Richter, “Russia plays the best offense.”
“But now we have Augie.”
Richter nods, his eyes narrowing. Noya looks at Richter, then at me. “And you are confident you can trust this man, this Augustas Koslenko?”
“Noya.” I open my hands. “I’m confident that I have no other choice but to trust him. Our people can’t unlock this thing. They can’t even find it.” I sit back in my chair. “He tipped us off to it. If it weren’t for him, we wouldn’t even know about it.”
“So he says.”
“So he says,” I concede. “True. Look, whoever is ultimately behind this, the SOJ or Russia or someone else—yes, they may have sent Augie to me. He may have some ulterior motive. I’ve been waiting to hear it. I’ve been waiting for some demand, some ransom. I’m not hearing it. And remember, they tried to kill him. Twice. So for my money, he’s a threat to them. Which means he’s an asset to us. I have my best people, and your best people, and Juergen’s best people, watching every move he makes downstairs, listening and learning and probing. We even have a camera on the room, just to keep an eye on him.” I throw up my hands. “If anyone has a better idea, I’m open to it. Otherwise, this is the best thing I can do to try to avoid…” My words trail off. I can’t bring myself to say them.
“To avoid…what?” asks Richter. “Do we have a sense of the possible harm? We can all speculate. We can all conjure up nightmare scenarios. What does the boy say?”
It’s a good segue, one of the principal reasons I’ve asked the German chancellor here today.
I turn to Alex, standing in the far corner of the living room. “Alex, bring Augie up here,” I say. “You all should hear this for yourselves.”
Chapter
59
Augie stands before the world leaders present in the living room, fatigued and frazzled, wearing ill-fitting clothes we found for him after a shower, overwhelmed in every way by the events of the last twelve hours. Yet this young man seems not even slightly fazed by the company he is keeping. They are men and women of tremendous accomplishments, with incredible power at their fingertips, but in this arena, he is the teacher, and we are the pupils.
“One of the great ironies of the modern age,” he begins, “is that the advancements of mankind can make us more powerful and yet more vulnerable at the same time. The greater the power, the greater the vulnerability. You think, rightly so, that you are at the apex of your power, that you can do more things than ever before. But I see you at the peak of your vulnerability.
“The reason is reliance. Our society has become completely reliant on technology. The Internet of Things—you are familiar with the concept?”
“More or less,” I say. “The connection of devices to the Internet.”
“Yes, essentially. And not just laptop computers and smartphones. Anything with a power switch. Washing machines, coffeemakers, DVRs, digital cameras, thermostats, machine components, jet engines—the list of things, large and small, is almost endless. Two years ago, there were fifteen billion devices connected to the Internet. Two years from now? I have read estimates that the number will be fifty billion. I have heard one hundred billion. The layperson can hardly turn on a television anymore without seeing a commercial about the latest smart device and how it will do something you never would have thought possible twenty years ago. It will order flowers for you. It will let you see someone standing outside the front door of your home while you are at work. It will tell you if there is road construction up ahead and a faster route to your destination.”
“And all that connectivity makes us more vulnerable to malware and spyware,” I say. “We understand that. But I’m not so concerned, right at the moment, about whether Siri will tell me the weather in Buenos Aires or whether some foreign nation is spying on me through my toaster.”
Augie moves about the room, as if lecturing on a large stage to an audience of thousands. “No, no—but I have digressed. More to the point, nearly every sophisticated form of automation, nearly every transaction in the modern world, relies on the Internet. Let me say it like this: we depend on the power grid for electricity, do we not?”
“Of course.”
“And without electricity? It would be chaos. Why?” He looks at each of us, awaiting an answer.
“Because there’s no substitute for electricity,” I say. “Not really.”
He points at me. “Correct. Because we are so reliant on something that has no substitute.”
“And the same is now true of the Internet,” says Noya, as much to herself as to anyone else.
Augie bows slightly. “Most assuredly, Madam Prime Minister. A whole host of functions that were once performed without the Internet now can only be performed with the Internet. There is no fallback. Not anymore. And you are correct—the world will not collapse if we cannot ask our smartphones what the capital of Indonesia is. The world will not collapse if our microwave ovens stop heating up our breakfast burritos or if our DVRs stop working.”
Augie paces a bit, looking down, hands in his pockets, every bit the professor in midlecture.
“But what if everything stopped working?” he says.
The room goes silent. Chancellor Richter, raising a cup of coffee to his lips, freezes midstream. Noya looks like she’s holding her breath.
Dark Ages, I think to myself.
“But the Internet is not as vulnerable as you are saying,” says Dieter Kohl, who may not be Augie’s equal on these matters but is far more knowledgeable than any of the elected officials in the room. “A server may become compromised, slowing or even blocking traffic, but then another one is used. The traffic routes are dynamic.”
“But what if every route were compromised?” Augie asks.
Kohl works that over, his mouth pursed as if about to speak, suspended in that position. He closes his eyes and shakes his head. “How would…that be possible?”
“It would be possible with time, patience, and skill,” says Augie. “If the virus was not detected when it infiltrated the server. And if it stayed dormant after infiltration.”
“How did you infiltrate the servers? Phishing attacks?”
Augie makes a face, as if insulted. “On occasion. But primarily, no. Primarily we used misdirection. DDoS attacks, corruption of the BGP tables.”
“Augie,” I say.
“Oh, yes, I apologize. Speak English, you said. Very well. A DDoS attack is a distributed denial-of-service attack. A flood attack, essentially, on the network of servers that convert the URL addresses we type into our browsers into IP numbers that Internet routers use.”
“Augie,” I say again.
He smiles in apology. “Here: you type in www.cnn.com, but the network converts it to a routing number to direct traffic. A flood attack sends bogus traffic to the network and overwhelms it, so the network stalls or crashes. In October of 2016, a DDoS attack shut down many servers, and thus many prominent websites in America, for nearly an entire day. Twitter, PlayStation, CNN, Spotify, Verizon, Comcast, not to mention thousands of online retail operations, were all disrupted.
“And then the corruption of the BGP tables—the border gateway protocol tables. The service providers, such as, for example, AT&T—they will essentially advertise on those tables who their clients are. If Company ABC uses AT&T for Internet service, then AT&T will advertise on those tables, ‘If you want to access Company ABC’s website, go through us.’ Let’s say you’re in China, for example, using VelaTel, and you want to access Company ABC’s website. You will have to hop from VelaTel to NTT in Japan, and then hop to AT&T in America. The BGP tables tell you the path. We, of course, just type in a website or click on a link, but often what is happening almost instantaneously is a series of hops across Internet service providers, using the BGP tables as a map.
“The problem is that these BGP tables are set up on trust. You may recall that several years ago, VelaTel, called ChinaTel at the time, claimed one day th
at it was the final hop for traffic to the Pentagon, and thus for some period of time, a good portion of Internet traffic intended for the Pentagon was routed through China.”
I know about it now, but I wasn’t aware of it then. I was just the governor of North Carolina back then. Simpler times. The understatement of the century.
“A sophisticated hacker,” says Augie, “could invade the BGP tables at the top twenty Internet service providers around the world, scramble the tables, and thus misdirect traffic. It would be the same effect as a DDoS attack. It would temporarily shut down Internet service to anyone served by that provider.”
“But how does that relate to the installation of the virus?” asks Noya. “The object of a DDoS attack, as I understand it, is to shut down Internet service to a provider.”
“Yes.”
“And it sounds as if this—this scrambling of the BGP tables has the same effect.”
“Yes. And as you can imagine, it is very serious. A service provider cannot afford to lose service to its customers. That is its whole reason for existence. It must act immediately to fix the problem or it will lose its customers and go out of business.”
“Of course,” says Noya.
“As I said before, misdirection.” Augie waves a hand. “We used the BGP tables and the DDoS attacks as platforms to invade the servers.”
Noya raises her chin, getting it now. Augie had to explain all this to me more than once. “So while they were focusing on that emergency, you snuck in and planted the virus.”
“An accurate enough summary, yes.” Augie cannot help but beam with pride. “And because the virus was dormant—because it was hidden and performed no malicious function—they never noticed.”
“Dormant for how long?” asks Dieter Kohl.
“Years. I believe we started…” He looks upward, squints. “Three years ago?”
“The virus has been lying dormant for three years?”
“In some cases, yes.”
“And you’ve infected how many servers?”
Augie takes a breath, a child prepared to deliver bad news to his parents. “The virus is programmed to infect every node—every device that receives Internet service from the provider.”
“And…” Kohl pauses, as if afraid to probe further, afraid to open the door to the dark closet to find out what’s hidden inside. “Approximately how many Internet service providers did you infect?”
“Approximately?” Augie shrugs his shoulders. “All of them,” he says.
Everyone wilts under the news. Richter, unable to sit still, rises from his chair and leans against the wall, folding his arms. Noya whispers something to her aide. People of great power, feeling powerless.
“If you have infected every Internet service provider in the country, and those providers have, in turn, passed on the virus to every client, every node, every device, that means…” Dieter Kohl falls back in his chair.
“We have infected virtually every device that uses the Internet in the United States.”
The prime minister and chancellor both look at me, each turning pale. The attack we are discussing is on America, but they know full well that their countries could be next.
Which is part of the reason I wanted Augie to explain this to them.
“Just the United States?” Chancellor Richter asks. “The Internet connects the entire world.”
“A fair point,” says Augie. “We targeted only the ISPs in the United States. No doubt there will be some transfer to other countries as data from American devices is sent abroad. There is no way to know for certain, but we wouldn’t expect the spread to be significant. We were focusing on the United States. The goal was to cripple the United States.”
This is far broader than our worst fears. When the virus peeked at us, it was on a Pentagon server. We all thought military. Or government, at least. But Augie is telling us it goes far, far beyond government usage. It will affect every industry, countless aspects of daily life, every household, all facets of our lives.
“What you’re telling us,” says Chancellor Richter, his voice shaky, “is that you’re going to steal the Internet from America.”
Augie looks at Richter, then at me.
“Yes, but that’s just the beginning,” I say. “Augie, tell them what the virus will do.”
Chapter
60
The virus is essentially what you call a wiper virus,” says Augie. “As the name suggests, a wiper attack erases—wipes out—all software on a device. Your laptop computers will be useful only as doorstops, your routers as paperweights. The servers will be erased. You will have no Internet service, that is surely true, but your devices will not work, either.”
Dark Ages.
Augie picks an apple out of the fruit bowl and tosses it in his hand. “Most viruses and attack codes are designed to infiltrate surreptitiously and steal data,” he explains. “Think of a burglar who sneaks in through a window and tiptoes quietly through a house. He wants to get in and out without detection. And if the theft is ever detected, it’s too late.
“Wiper attacks, on the other hand, are noisy. They want you to know what they’re doing. There’s no reason to hide. Because they want something from you. They are, essentially—well, not essentially—they are actually holding the contents of your device hostage. Pay the ransom or say good-bye to all your files. Of course, they have no particular desire to delete all your data. They just want your money.”
He opens his hand. “Well, our virus is a silent wiper attack. We have entered quietly and infiltrated to the maximum extent possible. But we do not want ransom. We want to delete all your files.”
“And backup files are no help,” says Dieter Kohl, shaking his head. “Because you have infected them as well.”
“Of course. The virus has been uploaded onto the backup files by the very act of backing up the systems on a routine basis.”
“They’re time bombs,” I say. “They’ve been hiding inside devices waiting for the moment they’re called into action.”
“Yes.”
“And that day is today.”
We look around the room at one another. I’ve had a couple of hours to digest this, having had all this explained to me by Augie on Marine One. I was probably wearing the same holy-shit expression on that helicopter that all of them are wearing right now.
“So you appreciate the consequences,” says Augie. “Fifty years ago, you had typewriters and carbon paper. Now you only have computers. Fifty years ago—in most cases, ten or fifteen years ago—you didn’t rely on connectivity to run so many of your operations. But now you do. It is the only way you operate. Take it away, and there is no fallback.”
The room is quiet. Augie looks down at his shoes, maybe out of respect for the grieving, or maybe out of apology. What he is describing is something that he had a big hand in creating.
“Give us an idea of…” Noya Baram rubs her temples.
“Oh, well.” Augie begins to stroll around again. “The examples are limitless. Small examples: elevators stop working. Grocery-store scanners. Train and bus passes. Televisions. Phones. Radios. Traffic lights. Credit-card scanners. Home alarm systems. Laptop computers will lose all their software, all files, everything erased. Your computer will be nothing but a keyboard and a blank screen.
“Electricity would be severely compromised. Which means refrigerators. In some cases, heat. Water—well, we have already seen the effect on water-purification plants. Clean water in America will quickly become a scarcity.
“That means health problems on a massive scale. Who will care for the sick? Hospitals? Will they have the necessary resources to treat you? Surgical operations these days are highly computerized. And they will not have access to any of your prior medical records online.
“For that matter, will they treat you at all? Do you have health insurance? Says who? A card in your pocket? They won’t be able to look you up and confirm it. Nor will they be able to seek reimbursement from the insurer
. And even if they could get in contact with the insurance company, the insurance company won’t know whether you’re its customer. Does it have handwritten lists of its policyholders? No. It’s all on computers. Computers that have been erased. Will the hospitals work for free?
“No websites, of course. No e-commerce. Conveyor belts. Sophisticated machinery inside manufacturing plants. Payroll records.
“Planes will be grounded. Even trains may not operate in most places. Cars, at least any built since, oh, 2010 or so, will be affected.
“Legal records. Welfare records. Law enforcement databases. The ability of local police to identify criminals, to coordinate with other states and the federal government through databases—no more.
“Bank records. You think you have ten thousand dollars in your savings account? Fifty thousand dollars in a retirement account? You think you have a pension that allows you to receive a fixed payment every month?” He shakes his head. “Not if computer files and their backups are erased. Do banks have a large wad of cash, wrapped in a rubber band with your name on it, sitting in a vault somewhere? Of course not. It’s all data.”
“Mother of God,” says Chancellor Richter, wiping his face with a handkerchief.
“Surely,” Augie continues, “banks were some of the first companies to realize their vulnerability and to segregate some of their records onto separate systems. But we had already infected them. That was the first industry we targeted. So their segregated networks are just as compromised.
“The financial markets. There are no longer trading floors. It is all electronic. All trading through American exchanges will stop.
“Government functions, of course. The government depends on the collection of revenue. The tax rolls for income tax. The collection of sales taxes, excise taxes, and the like. All of it, gone. Where will the government get the money to function, to the extent it can function?
The President Is Missing Page 22