by Reece Hirsch
Less than a year before, Chris had gotten the news that his thyroid cancer was in full remission. The aftershock of that event was still rippling through his life, altering everything, but in ways that were subtle and hard to pinpoint. It was like the air that he was breathing now had more oxygen to it. Somehow nearly dying had both made him value life more and made him willing to risk more.
And while he was engaging in this moment of self-assessment, Chris had to consider the next logical question. Why did he embark on these sorts of missions at all? He could just stay in his office in San Francisco, enjoying his view of the Bay and advising on privacy and security regulatory matters. You don’t find many regulatory attorneys rotting away in Chinese prisons.
Chris knew the answer—this was what he was good at. Whatever this was.
Chris stared at the third-floor window of the apartment building for a couple of hours. Finally, he decided to take a calculated gamble. He stood up, left a generous tip for the owner of the stand, and walked over to the building. The proprietor watched him go.
What sounded like a frenetic Chinese game show blasted from a television set on the first floor. Chris examined the names on the mailboxes. The name of the third-floor resident was Bai Hsu.
Chris climbed the narrow stairs to the third floor and paused, contemplating his exit strategy if things went south. He rapped on the door.
The hacker opened the door and seemed surprised to see an unfamiliar face.
“Láo jià, nín huì jiăng yīng yŭ ma? Excuse me, do you speak English?” Chris asked.
“Yeah. What can I do for you?” The answer—spoken in impeccable English—didn’t surprise Chris. English proficiency was one of the requirements for working in Unit 61398.
“I’m from the US, and I’d like to ask you some questions.”
“This is not a good time for me.” The hacker tried to shut the door, but Chris planted his foot in the doorway and leaned in.
“That would be a mistake. I know where you work on Datong Road. I know what you do.”
“I don’t care what you think you know.”
“Do you want your bosses to know that you’re working for us?” Chris raised his voice a bit when he said it.
The hacker glanced nervously around the landing at the doors of the other apartments, clearly afraid that one of his neighbors was overhearing the conversation.
“I could say that more loudly,” Chris said, “in case your neighbors didn’t hear.”
Hsu froze for a moment, weighing two unappealing options, then said, “Come inside.”
Chris stepped into the apartment, which was lined with inexpensive particleboard bookcases stuffed with science fiction and coding manuals. It was a first-decent-job apartment, a clear step up from student lodgings, but not yet the sort of place where an adult would live. An iMac on a desk in the corner was by far the nicest item in the room, and it was plastered with Japanese anime images.
As soon as the door closed, Hsu said, “You’re going to have to leave, or I’ll call the police.” He seemed agitated, stepping back behind the kitchen counter to put some space between them, the confident, wisecracking fellow from the bus nowhere to be seen.
“Your name is Bai Hsu, right?” Chris asked.
After a moment’s hesitation, he said, “Yeah. What’s yours?”
When Chris in turn hesitated, Hsu added, “I know you won’t give me your real name, so unless you show me your passport, this conversation is over.”
Chris produced the passport and held it out for Hsu, never letting it out of his grip.
“Christopher Bruen,” he said. “Well, Chris, I’ve got a feeling that if I call the police and give them your name, they’re not going to let you leave the country. So tell me what it is that you want.”
Chris explained what he was looking for—proof that APT1 was conducted by the People’s Liberation Army and that they had stolen Zapper’s proprietary algorithms.
“I don’t know anything about that,” Hsu said. “And even if I did I couldn’t provide that kind of information to you.”
“You’re afraid of going to jail?”
“Yeah, I’m very afraid of going to jail. You’re asking me to disclose state secrets.”
“So the state is behind this?”
“I’m not saying anything to you.”
“Look, we already know that the PLA is behind the hacks. And I’m going to explain to you why you should be even more afraid of me than you are of the PLA. We know all about the work being done on Datong Road. If you cooperate with us, no one will be able to trace anything back to you.”
“What are you talking about? Nothing can be traced back to me, because I’ve given you nothing.”
“If you don’t help us, we’re going to make it very clear to your bosses that you supplied us with information about the operation.”
“That’s a lie, and no one will believe it.”
“The team at Zapper is pretty sophisticated. They’re capable of making things look very bad for you.”
“Not sophisticated enough to keep us out,” Hsu said with a note of pride.
“No, I’ll give you that.”
“And even if you could send me to prison, I could make sure that you go right along with me.”
“There’s no need for anyone to go to prison. I just need some information. I’m going to guess that I wasn’t lucky enough to have stumbled upon the one person who has all of the details about the Zapper intrusion. But I bet you know who I should talk to.”
Hsu moved into the living room. “It’s not fair to put me in this position,” he said. “I had nothing to do with the Zapper hack. I didn’t work on it personally.”
“Okay, but you know someone who did, don’t you?”
Hsu drew back the curtain and looked down on the pedestrians passing in the street, probably checking to see if someone was observing his apartment. “You could have been followed here.”
“I don’t think so.”
“Of course you don’t.”
Chris remained silent, waiting for Hsu to make the next move. Just as nature abhors a vacuum, most people abhor silence and feel an irresistible need to fill it, even to the point of making incriminating admissions.
After a few long seconds, Hsu said, “I think they brought in two specialists to work on Zapper. Independent contractors. There were others involved in processing the extracted data, but those two guys seemed to be doing most of the penetration work.”
“Do you have their names?”
Hsu seemed to recognize that he’d reached the point of no return. He took a breath and stepped past it. “Li Owyang and Bingwen Ma.”
“Do you know where they live?”
“No, but I do know that you won’t find them in Shanghai. When the operation was over and Zapper finally discovered the intrusion, they both left the unit. Li said that he was going to visit his sister, and I think Bingwen was going with him. He said she lived in Longhua, Shenzhen, and worked at the Commsen factory.”
Chris was familiar with the Commsen factory in the Shenzhen district, north of Hong Kong, where hundreds of thousands of employees worked in massive facilities, manufacturing smartphones, tablet computers, and other devices, largely for US tech companies. Chris’s own smartphone probably originated in one of those vast factories. It wouldn’t be easy to track down Li Owyang’s sister in that sea of workers.
“Do you know her name?”
Hsu shook his head.
“How about her address?”
“That’s all I’ve got.”
“Are you sure you don’t know anything else about her? Anything at all.”
“She worked on tablet computers. Li and I talked about it once. Her job involved—what was it?—signal integrity. I think that was it. There. Now will you please leave me alone?”
“Your name won’t be mentioned, and you’d better forget that we ever met.”
“Don’t worry about that,” Hsu said, already ushering him to the door.
Chris stopped short of the threshold. “Just a couple more questions and I’ll be gone. You do work for the PLA, don’t you?”
“I thought you already knew that.”
“We were ninety percent sure.”
Hsu looked him unsteadily in the eye. “I’ll put it this way. Do you think I’d be this scared if it wasn’t the PLA?”
“Okay, I’ll take that as a yes. But what do they intend to do with the algorithms?”
“I don’t have access to that sort of information. I’m just a technician. Please leave now. I mean it.”
Chris nodded and left without another word. He wandered back through the ramshackle street, where the drunks were now a larger presence than the night-shift factory workers. A few hostile, distrustful glances were directed at him. In the tourist-friendly confines of the Park Hyatt and on major thoroughfares like the Bund, Americans seemed to be welcome enough. But here, far from the tourist zone, it appeared that opinions were divided as to whether he belonged.
He was going to need help to find Li Owyang’s sister and the two hackers. It was time to deploy his secret weapon—Zoey.
6
The next morning Chris decided it was safer to connect with Zoey outside the hotel. Using the so-called Great Firewall of China, the Chinese government employed a number of methods for censoring Internet communications, including blocking access to many Western sites, but it couldn’t screen all online content. To censor social networking sites and other online businesses, the Chinese government had turned to the private sector.
In order to remain in business, online companies were required to hire “editors” to monitor their sites and scrub potentially offensive statements. The editors, like white blood cells fighting infection, constantly scoured web postings for the latest signs of dissent or unauthorized expression, often disguised using coded language. As soon as one code word was identified and expunged, another would appear. For example, the imaginary date of May 35 was sometimes used to refer to June 4, the date of the Tiananmen Square massacre. Despite the never-ending game of Whac-A-Mole, the end result was a system more efficiently repressive than the government could have managed by doing the job itself.
Another common technique was “packet filtering,” which terminated a text/data communication when a certain number of controversial keywords were detected. In his conversation with Zoey, Chris intended to avoid controversial keywords like “Unit 61398,” “APT1,” and “Zapper algorithms.” Nonetheless, he figured that there was a greater likelihood that the PLA would be monitoring Wi-Fi connections originating from the Park Hyatt, a popular venue for foreign visitors.
Chris found a tea and coffee shop off of the Bund with Wi-Fi and the right noise level. Not so quiet that the café’s other denizens could easily overhear, but not so crowded that there would be people close at hand to eavesdrop. He used their prearranged secure website to connect with Zoey via encrypted Skype connection, an approach designed to evade the Great Firewall.
When the Skype connection blinked on, he was faced with the welcome sight of Zoey, who was in her natural habitat—the firm’s forensic lab. A large coffee cup blocked part of the foreground.
“Nice to see you,” Zoey said. “Are you okay?”
“I’m fine, but I’ve reached a bit of a dead end.”
“Time to use your lifeline.”
“That’s right.”
Chris proceeded to describe his meeting with Bai Hsu and his search for Li Owyang’s sister in Shenzhen.
“That’s pretty good progress, considering you just got there.”
“Thanks, but I don’t know where to go from here. I could go to Shenzhen and ask around for the sister, but I don’t think that’s very likely to be productive.”
“Commsen,” Zoey said. “I’ve read about that place. Talk about your needle in a haystack.”
“Can you help me narrow things down?”
“Maybe. If these two hackers, Li Owyang and Bingwen Ma, are so good that the PLA would bring them in as special contractors for that project, then I can’t imagine they wouldn’t leave a footprint in certain circles.”
“Your circles?”
“Well, yeah. I’m going to reach out to some Chinese dissidents that I’m acquainted with. They’re hacktivists, but they’re bound to know some of the people who’ve gone to work for the government.”
“It can be a fine line between black-hat and white-hat hacking,” Chris said, thinking of the variety of pros that Paul Saperstein had recruited to defend Zapper. “At least in the US. Think it’s a similar deal in China?”
“Well,” Zoey said, “both sides are competing for the same talent pool, so when someone’s as good as these two probably are, word gets around. The problem is that if they’ve done anything interesting it was probably under a handle.”
“Be careful.”
“You be careful. I’m the one sitting back here in my office in San Francisco sipping my Peet’s, and you’re the one messing with the PLA.”
Chris wanted to talk to her about the apartment key that he’d given her before leaving, and what that meant for their relationship. But that was a conversation better conducted face-to-face, not over Skype. “How are things back there?” he asked instead.
“Well, I’m getting calls every other hour from the team at Zapper wondering if you’ve got anything for them. What should I say?”
“Tell them I’m following a lead, and that I’ll let them know when I have something. I’d better sign off before someone notices this encrypted transmission.”
“Okay,” Zoey said. “I’ll see what I can find. I’ll leave a message on the secure site when I have something.”
“While you’re working on that, I’m going to head for Shenzhen.”
“Just a sec,” Zoey said, raising a hand as if to stop him from signing off. “Let’s just say that I do find the address for Li Owyang’s sister. And it leads to the hackers. What are you going to do? It’s not like the PLA is going to return the algorithms.”
“True. I don’t really know yet. At the very least I’d like to come back to Saperstein with hard evidence of who stole the algorithms and why. Something he can use to pressure the White House into pressuring China.”
“Yeah,” Zoey said. “Because the Chinese government is so susceptible to external pressure. Look, just be careful out there. And I’m expecting you to bring me back an egg roll, okay?”
7
The Number Three Detention Center in Shanghai was a massive, tan two-story complex that could have been confused with a manufacturing facility but for the high wall studded with barbed wire around the perimeter. The squared-off arch over the building’s entrance was emblazoned with the red-and-gold insignia of the People’s Republic.
Tao passed through metal detectors operated by paramilitary guards in blue uniforms with winged badges that made them look like airline pilots. He waited anxiously in the antiseptic visitation area until Wenyan was escorted to a seat on the other side of the glass. Tao always dreaded the first glimpse of his brother. Like time-lapse photography, the transformation occurred with unnerving rapidity. With each visit, Wenyan looked thinner, more dead behind the eyes.
Some might say that Wenyan was lucky he had been granted the rare privilege of receiving visitors, but there was a reason for that. Wenyan had friends—of a sort—in one of China’s most powerful families.
Three years ago, Li Chen, the wealthy son of the president of an automobile factory, killed a pedestrian while drag racing through the streets of Beijing. The victim, a thirty-two-year-old mother of two from a rural town, was hurled twenty yards and died on impact. Li Chen was said to have joked with his rich friends and smoked cigarettes while he wai
ted for the police to arrive.
Tao’s brother, Wenyan, had worked in the same car factory run by Chen’s father. Putting together transmissions on an assembly line had been a decent job, and Wenyan had hoped eventually to rise from the factory floor to a lower management position. One day Wenyan finally caught the eye of Mr. Chen, but it was not for the meticulousness of his work.
Chen, who usually remained upstairs in his office, paced around the factory floor in a visibly agitated state, examining the faces of his workers, all of whom assumed that a wave of layoffs was on the way. Chen stopped before the station of Wenyan Zhang and invited him up to his office for a “conversation.” As Wenyan told the story, you could practically hear the thrum of the assembly line skip a beat as everyone tried to observe the exchange without staring. Wenyan knew that this could be many things—a firing, a promotion, an accusation of theft—but it was unlikely to be a conversation.
Once the door of his office closed behind them, Chen began by noting the close resemblance between Wenyan and his son Li. Then he made the astounding proposal that Wenyan serve Li’s four-year prison sentence for vehicular manslaughter in exchange for a fee of roughly a hundred eighty thousand yuan, or thirty thousand dollars.
Wenyan had been speechless. He’d never really believed the stories about the practice of dǐng zuì, or “substitute criminals,” which had been associated with the Chinese criminal justice system since the nineteenth century. He also had not been left with much of a choice.
For one thing, Chen was talking about a substantial amount of money. In addition, Chen said he would fire Wenyan on the spot if he refused the offer. Finally, the wealthy and party-connected Chen vowed that if Wenyan did not serve his son’s sentence, Wenyan would never be hired for any job that had a future.