by Reece Hirsch
Something seemed to bloom deep inside Tao’s chest, like a small, dark flower—the sort that might secrete a toxin. He knew instantly that this was a scene he would be returning to later, whether he wanted to or not. Finally, the man’s grip loosened, and his hand fell limply to his side.
Tao removed all of the money from the wallet, wiped it down for fingerprints, and tossed it in a bush. He knew he couldn’t walk out through the main gate, so he would need to find another exit. After checking to make sure that Naruse was gone, Tao stood and walked on up the hill.
He strode quickly along the narrow stone path, studying the black iron fence that bounded the park, looking for a way out. Tao heard voices shouting in the distance. Naruse’s body had been discovered more quickly than he had expected, probably by park security looking for closing-time stragglers.
He quickened his pace but kept it short of a run. At last he spotted a cherry tree near the fence. Tao pulled himself up on the lower branches and climbed over onto the fence, then jumped down on the other side.
Five minutes later Tao was once more moving through the densely crowded streets of Shinjuku. He stepped into a crosswalk that seemed to be about a hundred yards wide. When the light turned, Tao was swept along like a petal on a river, feeling pleasingly anonymous.
He was safe now.
Another job successfully completed. One step closer to his salvation.
The trick to being a competent hit man wasn’t in the killing but in how you felt about it afterward. This was his third hit, so he felt qualified to generalize. Tao had received some basic training in weapons and hand-to-hand combat from a People’s Liberation Army instructor, but he was not particularly well practiced in the lethal arts. The characteristic that had distinguished him thus far in his brief career was the ability to remain focused on the task at hand, both before and after the killing. It had always helped Tao to know why he did what he did, and whom he did it for.
But this time felt a little different from the others. Tao wished fervently that Naruse hadn’t grabbed his wrist and forced him to look into his eyes. Something had changed in that moment. His attitude toward his work would be different from this point forward, but he wasn’t sure yet if that would make it easier or more difficult.
3
It was 7:00 a.m., and Chris was waiting to cross Market Street as the Pirate Ship passed in the pale morning light. The Pirate Ship. That was how he always thought of the massive shoeshine stand on wheels as it rolled to its place of business for the day. It was like a decrepit, vaguely ominous parade float, consisting of black-painted, jerry-rigged plywood that elevated three chairs for the customers to sit high above the Financial District as their expensive footwear was buffed.
The proprietor, a heavyset black man with close-cropped gray hair and an improbable top hat, was pushing the stand into place, along with his two employees. As the stand slid into its patch of turf next to the taxi stand of the Grand Hyatt, the proprietor stepped back and let his colleagues finish the job.
The man turned to Chris, who was advancing toward him through the crosswalk, and looked him over bottom to top, starting with the shoes.
Apparently, Chris’s black slip-ons were not as well maintained as they might have been, because the man delivered his signature line in a stentorian voice: “Where is your pride?”
After leaving his girlfriend in bed to satisfy the whims of his billionaire client, Chris could only mutter to himself, “Excellent question as always.”
Chris swiped his security pass, wiped his shoes on the antistatic mat, and entered the law firm’s computer forensic lab on the thirty-eighth floor of Four Embarcadero Center at 7:30 a.m. Zoey was already there, and it looked like she had been there a while. The second large cup of coffee stood next to her bank of three monitors, and a greasy breakfast sandwich wrapper was crumpled beside them.
She was leaning over and adjusting something strapped around her ankle.
“What’s that?” he asked.
“It’s a HealthBot,” she said, tightening a Velcro fastener that held a small device with a display face that looked a bit like a digital watch.
“And what is a HealthBot?”
“It’s a new product from our client FrostByte Technologies. They were handing out free samples to the staff to celebrate their IPO.”
“So what does it do?”
“Well, it’s a pedometer, but it also monitors your heart rate, calories burned, and temperature. Stores everything in the cloud. Since I find working out at the gym to be mind numbing, I figured it was worth a shot. Maybe I’ll move around more and burn more calories if I’m monitoring it.”
“Good idea,” Chris said. “After all, you were the one who was just arguing that playing BioShock Infinite was exercise.”
“I put a lot of body English into the gaming console,” she said. “It works all the muscle groups.”
“Maybe the HealthBot will help you realize that you shouldn’t be eating those things,” Chris said, pointing at a bag of chili-cheese jalapeño barbecue chips on her desk.
“You don’t understand,” Zoey said. “Those are flavor blasted, Chris. Literally blasted with flavor. See, it says so right there on the bag.”
Chris was booked on a flight to Shanghai out of SFO later that morning, but he wanted to spend some time in the lab first, gathering all of the information available on the Zapper intrusion. The forensic lab was an invaluable resource in Chris’s practice, from solving thefts of confidential data by rogue employees to tracking down hackers.
Since taking over as head of the lab, Zoey had given it her own personal touch. The windowless room was ringed with computer monitors, and an image bounced from screen to screen as if it were circling the room. It was a photo of the Clash’s Joe Strummer with the caption in bold red type, “I Fought the Law—And the Law Won.” Zoey wore an antistatic band secured by Velcro around her wrist with a wire that ran to a grounding point under the desk. Static was the enemy in a computer forensic lab, as it could instantly destroy valuable evidence.
She cast an appraising look his way. “You didn’t go back to bed, did you? You look like you could use some coffee.”
Chris picked up the paper cup next to the monitor and took a big sip. “You’re right,” he said. “Thanks. So how’s your day going?”
“So stressful that I’m pretty sure someday I’ll be acting it out with puppets,” Zoey said. “I hate working with that new security team at Zapper. Talk about a bag of cats. Everyone over there thinks they’re running their own independent investigation.” Chris had updated Zoey on the Zapper assignment by phone earlier that morning, and she had already been fully briefed by Dez Teal.
Zoey was every bit as egocentric and skilled as any member of Zapper’s new all-star security team. Before Chris had hired her to run his computer forensics lab, Zoey had been a hacker, but more of a hacktivist and prankster than a black hat. Bringing her into the staid law-firm environment had been a bit of an experiment. So far the experiment seemed to be working, but some days were better than others.
“I think Saperstein buys into the ‘team of rivals’ approach,” Chris said.
“More like Lord of the Flies if you ask me,” Zoey said. “But I did manage to get some information out of them, and I also uncovered several new clues. It’s not like this is the first major intrusion based out of China. It seems to be the same crew that we’ve been chasing for a while now.”
Over the past few months, Chris and Zoey had helped several clients respond to APT1 hacks, but they had never gotten close to identifying their source.
Chris sat at the monitors next to Zoey. “What have you got?”
“Well, we’ve got a dead-end IP address that originates from the Pudong New Area of Shanghai. And guess who has a headquarters in that district?”
“I’ve got a pretty good guess, but why don’t you tell me?”
>
“People’s Liberation Army, General Staff Department, Third Department, Second Bureau.”
“So you think we’ve found the ones behind APT1?”
Zoey pulled up a photo of a modern, generic eight-story office building that stood alone behind an imposing security fence. “This appears to be the unit’s new headquarters building on Datong Road in Gaoqiaozhen, which is in the Pudong New Area.”
“What do they do there?”
“Well, I dug up some public but extremely obscure PRC records that provide clues. For example, here’s correspondence with China Telecom where they’re agreeing to provide state-of-the-art fiber-optic communications infrastructure for the building. The installation is being offered at a discount because it’s for national defense.”
“What makes us think that it isn’t just standard defense work?”
“Well, while we don’t know what’s going on inside that building, we do know the type of people they’re hiring. And it suggests that they’re playing offense, not defense.”
Zoey pulled up job listings translated into English, and Chris leaned in to see.
“Looks like they’re staffing an IT department, looking for people with computer security and network operations experience.”
“Right,” said Zoey, scrolling down through page after page of job listings. “But look at how many of those people they’re hiring. Hundreds of them. They’re assembling an army of network security geeks.”
Chris looked at the listings again and added, “And everyone has to be able to speak English. Almost all of APT1’s targets have been in English-speaking countries.”
“Exactly.”
“What else have you got?”
“Well, it’s hard to tell what a particular unit of the PLA is up to because they disguise their units’ identities using MUCDs.”
“Which stands for?”
“Military Unit Cover Designators. A five-digit number. But there’s a Unit 61398 that I think must be the Third Department, Second Bureau. I tried Internet searches and found absolutely no results that linked the two. Don’t you think that’s odd?”
“Not if they really aren’t connected.”
“But I’ve scoured Chinese academic journals and municipal records and found some references to the areas of expertise found in Unit 61398. See, here’s a member of the Heibei Chamber of Commerce who says in minutes of a meeting that he learned English at the unit. And here are academic articles that list Unit 61398 as a source of technical information on topics like covert communications, operating system internals, digital signal processing, and network security.”
“The Heibei Chamber of Commerce? You’re digging deep here, aren’t you?”
“Nothing escapes the all-seeing eye of Zoey.”
“Does the Zapper team have all of this?”
“Some, but a lot of it is my work.”
“This is good. You’ll be very popular with the new security team over there.”
Zoey grinned. “They could have just hired me and saved themselves a lot of money.”
“But you’re already getting the big bucks here, aren’t you?”
“If you say so.”
“Seriously,” he said, “this is great work. Let me know right away if you find anything else.”
Zoey and Chris had set up a secure website separate from the law firm’s IT system that they could use to chat securely and exchange video and documents from anywhere in the world.
“I will,” she said. “But what do you intend to do once you get to Shanghai? They aren’t going to just let you stroll through the front doors of that building on Datong Road.”
“I haven’t figured that part out yet.”
“Be careful. The PLA will probably be watching for someone like you.”
“Are you worried about me?”
“I’m worried that you’re going to try to handle this the way you handle all those other solo script kiddies that you’ve tracked down in the past. What you’re dealing with here is basically the Chinese army. Don’t underestimate them, superspy.”
“If I’m a spy, then I guess that would make you my handler, right? I’ve always wanted one of those.”
“You’re hopeless,” Zoey said. “Just go and get on the plane. And I hope you’ve already seen the in-flight movie.”
4
On the twelve-hour flight to Shanghai, Chris had plenty of time to contemplate just how sketchy his plan was. For the moment, it consisted of little more than going to the Pudong New Area of Shanghai and staking out the building that appeared to house APT1. He was going to need a more subtle approach than that, or he would soon be enjoying the hospitality of the People’s Liberation Army.
If the Zapper intrusion was state backed, then the government might even be expecting this sort of response. And the adversary, whoever it was, had gained access to Zapper’s systems for an extended period, so there was no telling how much they knew about the company and Chris’s relationship to it. Chris tried to dismiss these musings as low-grade paranoia. Paranoia was a good default position in his line of work, but there was a point at which it became counterproductive.
He reviewed the few tools he had at his disposal: a laptop loaded with EnCase forensic-imaging and analysis software, software for running dictionary and brute force attacks to crack passwords, a write blocker, a set of small screwdrivers, and some plastic baggies. All of the software was disguised on his laptop to look like home videos. It wasn’t much of an arsenal, but Chris found that the most valuable information he obtained was usually through what hackers referred to as social engineering.
Of course, even a routine business trip to China had to be treated like a mission behind enemy lines. It had to be assumed that the Chinese government was prepared to use military-grade technical resources to gain an advantage for the home-team companies. Chris always observed secure protocols when doing business in the PRC. He did not make sensitive calls over Chinese telecom lines. He never brought his personal laptop or phone into the country, instead using loaners that could be wiped clean when he was done. During negotiation sessions, he turned off his phone and removed the battery to ensure that no one could remotely activate its microphone. To foil key-logging software, he carried his Internet passwords on a flash drive so that he could copy and paste them rather than keying them in.
Chris was fairly confident that his cover story for the trip would withstand any questioning he might be subjected to at the customs desk. He was scheduled to meet with a Chinese consumer electronics company headquartered in Shanghai. He had represented the company for many years and had even learned to speak passable Mandarin for their benefit. The company no longer needed his services, because they had failed to gain traction in the US market. Nonetheless, the company had agreed to a meeting, ostensibly to permit Chris to make a last-ditch attempt to rekindle the business relationship. The general counsel, whom he had worked with for many years, had been too polite to refuse his insistent request.
The interminable flight also gave him plenty of time to think about his relationship with Zoey. Since his wife Tana’s death seven years ago from cancer, Chris hadn’t really had a serious relationship—well, with one exception, which had ended badly, to put it mildly. Even though he had not led much of a life since Tana’s death, the loner habits that he had acquired were tenacious. It wasn’t that he missed his former life. That wasn’t it at all. It was more like certain muscles had atrophied over the years, and he was stretching and testing them again for the first time in a great while. He wasn’t used to talking so much for one thing.
When Chris first met Zoey, he could not have imagined that they would end up together. She was quirky, opinionated, and loud—his exact opposite in many respects. To Chris’s surprise, that appeared to be what he had been looking for.
Chris inventoried some of the things that he had learned about Z
oey since they had begun seeing each other. Although this should have been blindingly obvious, she was not Tana. Unlike the calm, sunny Tana, Zoey was a bit of a cynic, at least outwardly. Zoey was messy, where Tana had been meticulous. Sometimes Zoey stayed up all night drinking coffee and chatting online with her hacker friends. She said the late-night sessions were research for work, but Chris worried that she might still be engaging in hacktivism or, worse still, some hack that might cross over into illegality. In short, living with Zoey was in no way a return to the old patterns of his life with Tana. A new blueprint was required.
Now that he had given her a key to his apartment, it was only a matter of time before his colleagues at the law firm found out about it. He was already bracing for the conversation that he would have one day soon with Don Rubinowski, the firm’s managing partner, about sleeping with the director of his forensic lab. He had no idea where his relationship with Zoey was headed, but he wasn’t about to bring it to a halt just because it was improbable or inconvenient.
The plane’s wing dipped as it circled for landing, and he was able to get a look at Shanghai spread out before the delta of the Yangtze River, which was glinting under steely afternoon skies. Observing the city endlessly sprawling beneath him, he had a visceral recognition of the scale of modern China. He knew that Shanghai was the world’s largest city proper by population, but seeing it from this vantage point was another thing.
Chris was equipped with a stack of tourist guides, determined to look as much like a common sightseer as possible. He’d actually spent much of the flight absorbing an array of touristy factoids. For example, the derivation of the city’s name: shàng meant “above,” and hăi meant “sea.” Upon-the-sea.
Shanghai was the symbol of twenty-first-century China, and the airport announced that fact with its manta ray–like roof design. As he strode quickly through the terminal, the effect lingered. He felt like he was in the belly of some great sea beast as he passed through a cavernous atrium suspended by skeletal-looking struts.