Piper picked me up in a chauffeur-driven Bentley. We drove fast. There were cars sticking close behind us.
‘Whatever’s being thrown at us online is part of a concerted operation,’ she said. ‘It’s at scale, and individuals within UK intelligence are interested. I don’t know if that works in our favour or not.’
‘Are the intelligence services going to be at the meeting today?’
‘Not to my knowledge.’
We approached a group of people outside a police station. I saw, too late, that they were holding placards, and that Elena Yussopova stood to the front. Our eyes locked as she stared through the Bentley’s windows. I turned away, swore.
What were the consequences of that? I didn’t have my identities clean, that was the problem. I was floundering.
We stopped on Nurzhol Boulevard before I had a chance to attempt any more questions. Cafestar was a restaurant on the grand avenue running between ministerial buildings and elite apartment blocks. It was encased in snow. In season, no doubt, the café’s terrace would be shared between high-end escorts and ministerial wives showing off Paris fashion and international school English. All that seemed to relate to another world right now.
‘Ms Piper.’ A big grin from the young waiter on door duty. He beckoned me through. A GL5 guard stood inside like a sullen maître d’, jacket fastened over his gun. A nod at Piper, a hard look at me. Callum Walker sat with a man and woman at a circular table in the centre of the room: white napkins, heavy cutlery, bowls of fruit and cafetières. There were no other customers; either the place had been cleared especially or it wasn’t popular with the morning crowd.
I was introduced as a Russia expert assisting Piper Anderson. No one seemed to want to mention Vectis by name. The man beside Walker was Tom Chambers, former foreign secretary, now lobbying for Saracen. I could have done without active Westminster around. He was silver-haired and freshly shaved, in a tailored navy suit, silk tie and handmade Italian shoes. With him was Lynn Cook from Saracen in a blue Chanel suit. We all shook hands. I took a seat next to Chambers. On the table, among croissant crumbs, smashed blueberries and bowls of granola, were copies of yesterday’s media coverage of the trip and a timetable for today.
Chambers took an iPhone from Walker, glanced at the screen, passed it to Cook. She raised an eyebrow, passed it to me. It showed a dead man on a mortuary slab, face blackened with bruises, mouth a mess of broken teeth. His left ear hung on by a flap of skin.
‘He was arrested last night at the protest in Semey,’ Walker said. ‘Died in the police station. His brother got the photo.’
Piper took the phone. ‘Has it gone international?’ she asked.
‘Not yet.’
She shut her eyes, opened them, passed the phone back to me. ‘What do they want, these protesters? No drilling? Human rights?’
‘I don’t know,’ Walker said. ‘I’m more concerned by who’s retweeting this image. This one’s a troll. Scroll down.’
I scrolled down to a clip of Putin giving a speech. It concerned his favourite theme: the break-up of the Soviet Union as the greatest geopolitical catastrophe of the twentieth century, leaving millions of Russians stranded outside the Russian Federation. A minute in, he dismissed Kazakhstan as a recent invention: ‘The Kazakhs have created a state where there was never one before.’
‘Is that true?’ Chambers asked.
They looked at me. I paused it.
‘Technically,’ I said. ‘I’ve not seen this speech before. Where’s it from?’
‘It’s hard to confirm if it’s genuine,’ Walker said. ‘Our Moscow office isn’t aware of it either. It’s got over eighty thousand retweets in Kazakhstan alone.’
‘How many people are even online here?’ Chambers asked, looking puzzled. A waiter approached.
‘Please,’ Piper said, handing me a menu. ‘Everyone, eat. The croissants are amazing. They fly in the pastry.’
I ordered coffee and a croissant, double-checked the staff folding napkins in the shadows. The lighting was soft, a lot of it coming from a tall glass box filled with bottles of wine, like a trophy cabinet. Chambers speared the remains of his eggs Benedict.
‘You say this is a concerted operation?’ he said. ‘Kremlin-based?’
‘I suspect so.’
This provoked a deep breath. Chambers looked to Piper. ‘You’re keeping Jack in the loop?’
‘Daily.’
Jack, I thought. Jack Burrows at the Foreign Office.
‘We may want to make that hourly.’
Piper said: ‘For now we want to neutralise this as far as possible. It may be that attack is the best form of defence; whack-a-mole isn’t working.’ She looked at me, eyes wide, waiting. ‘Toby?’
‘Kazakhstan’s independent,’ I said. ‘Whatever Putin might say, this is a strong, proud, independent country. We’ve got nationalism on our side.’
‘Nationalism,’ someone said, as if testing the word.
‘If they’re peddling a “Kazakhstan belongs to Russia” line, you want blogs promoting Kazakh independence, authentic Kazakh identity. A secular one, modern, outward-looking. Nationalism not nationalisation.’
‘Nationalism not nationalisation.’ Piper wrote it down.
‘There’s Kazakh warriors you want to bring into play.’
‘Got any names?’
‘There’s one called Raiymbek, eighteenth-century. That could be the pseudonym of someone writing a blog called Kazakh Independence.’
She scribbled furiously.
‘And the independence stuff: like anti-Putin?’
‘Deeper than that. You’ve got plenty of history to draw upon. Kazakh servitude to the czars; legends in which they brought together all the clans to fight against Russia.’ We had a look on her MacBook, found a romantic oil painting by some Englishman showing the hordes gathering with incongruous spears. ‘The Bolshevik invasion saw hundreds of Kazakhs fleeing south. They call it Aktaban Shubryndy, running to the bone.’
‘I like that.’
‘Get people talking about historical injustice: the famine introduced by collective farming; Kazakhs burning their grain and slaughtering their cattle rather than letting them fall into Russian hands. You could have a Pinterest board of famine pictures.’
‘I’ll get our team on it.’
‘And keep Galina onside,’ Chambers said.
‘We’ve booked the Marriott’s thirty-eighth-floor bar for her birthday celebration,’ Piper said. ‘There’s a catering team coming from Paris. It’s under control.’
My coffee and croissant arrived. Both were good, as promised.
‘Toby,’ Piper continued, ‘I’m told you read Kazakh.’
‘A little.’
‘Can you check this?’
She pushed the draft of an article towards me. It talked about all the good work Saracen was doing. Accompanying the piece was a photograph of the Caspian refinery, its vast metalwork lit against the night. It had a Union Jack flying.
‘Is this for local readership?’
‘Yes.’
‘The piece is great. I wouldn’t stick a Union Jack on the Caspian. And I’d get the word “land” in there,’ I said. ‘Land is the main treasure. You’re helping them be prosperous so they can keep their land.’
‘Clearly no one’s told them what’s under it,’ the woman from Saracen muttered.
‘It’s symbolic. Oil will go, not the land.’
‘But it’s oil they’re against.’
‘They’re not against it; they just don’t think they’re getting dividends. Tell them poverty here’s dropped from around fifty per cent to four per cent in the last fifteen years. That’s people not dying. It wasn’t because of NGOs, it’s because companies got the black stuff out of the ground.’
‘Hear, hear.’ Chambers pushed his chair back and rose. ‘I’ve got to run. Toby, been a pleasure.’
Chambers and Cook had to return to the trade delegation. They were late for a tour of a factory manufactu
ring asthma inhalers. Stefan had messaged. He said we had a problem; he’d explain if I could suggest somewhere safe to meet.
THIRTY-SIX
I found a motel on the edge of the city’s industrial area. Migrant workers smoked together in the overheated lobby, hi-vis vests steaming on radiators. There was a shop beside reception selling alcohol and microwave food. I booked a room, checked it, closed the curtains and returned to the car.
‘Meet at the lorry park on the Alash Highway,’ I told Stefan. ‘Ten p.m. Pull in. I’ll flash my lights, then follow me.’
I drove back to where the road forked, then pulled off behind the rusting frame of a disused petrol station, hidden from the road but still able to see the vehicles passing. At five minutes to ten Stefan’s rental BMW passed. No other vehicles around. I pulled back onto the road, overtook him.
Inside the motel room he removed his laptop from its aluminium case, opened it. The screen showed a photo of the Vectis office. Then a second picture, closer to floor level – the junction box for the ethernet.
‘Someone’s already done it.’
‘Done what?’
‘Hacked them.’
Stefan changed windows, logged into a discussion forum. Halfway down a black screen filled with monospaced text someone had posted an almost identical picture: same office, same junction box.
‘The forum’s called Abysm, probably the smallest, most select hacker community on the net. Eighty or ninety members, a lot of them pros. The US Department of Justice has tried to take it down on several occasions. The set-up is invite only: you have to show how you’re going to be useful for the other members, so there’s a culture of bragging, a lot of sharing tips, trading tools. On Monday 20 November, a guy calling himself nomad9 says he’s been approached for a job; talks about somewhere ultra-secure that he’s been asked to get into.
‘“Been asked to do a thing”, were his exact words. It’s an isolated systems network, behind multiple firewalls. The target organisation’s clearly sensitive. All data’s encrypted when it’s transmitted, so he needs to get access internally. He posts some details; there’s a conversation about potential vulnerabilities, a joke about it being banking or military.
‘First he thinks about replacing a keyboard with an identical one containing a keylogger, thereby getting all the passwords. He says his client would be able to make the swap and then retrieve the memory chip.’
‘Which suggests his client is someone already inside the organisation.’
‘Right. This is the make of keyboard in the office: Corsair K95.’
‘That’s right.’
‘Then he says his client reckons the target’s too savvy for that. So he sources a replica ethernet box and puts a device in it that can sit on the Local Area Network, between the target and the server, grabbing all the traffic as it passes through. It’s a classic man-in-the-middle attack. From what he describes online, the device involves a crossover cable and a wireless card: the data he or his client wants to see is transmitted wirelessly and he’ll have picked it up easily enough. Gets in, does all the things I did, except then he disappears off the face of the earth.’
‘What happened?’
‘His messages stop. Rumours start a few days later: he’s either been killed or arrested. Someone says they think he was in Astana, but there’s nothing on the news. Someone knows his family and they say he’s disappeared. A few friends drop into the forum to say he’s not contactable in the real world either. The last they heard, he’d stumbled across something crazy, something way bigger than he expected. The whole thing’s become news in the community, people circulating the pictures he posted, trying to figure out what he was on to. There are rumours that maybe the British intelligence services were involved, then CIA, Mossad, FSB.’ Stefan turned to me. ‘Now I’ve just tried to hack the same organisation.’
‘Do you know who he is?’
‘Nomad9 is a guy called Ruslan Batur. Pretty shit-hot, worked for the Kazakh government on cybersecurity between 2012 and 2014, but fell out over some of the things he was asked to do. He’s got a history of using his skills for political ends: hacktivism, connections with human-rights groups.’
‘Got a picture of him?’
‘Mugshot, from an arrest in 2015.’ Stefan clicked the mouse and brought up Ruslan Batur’s mugshot. Batur was twenty-two in the photo: with shoulder-length dark hair, large eyes and a wispy attempt at a beard. ‘According to people online, at least ten individuals have been questioned about him over the last few days, in six different countries.’
I showed Stefan the CCTV footage of Batur in the Mega Mall on his way to pass what he’d found to Joanna, and then the shots I’d taken of his corpse.
‘You knew it,’ Stefan said. ‘You knew he’d been killed and still sent me in.’
‘I didn’t know who he was or what he’d done. I’ve been trying to find those out.’
‘Jesus Christ. You said Joanna Lake was working for Vectis. Now she’s spying on them. So who was she actually working for? I’m trying to figure out who’s most likely to kill me.’
‘No one’s going to kill you.’
‘This is something big, isn’t it?’
‘What makes you say that?’
‘There have been attempts to wipe even talk of the hack from message boards,’ Stefan said. ‘Look.’ He brought up a page of code. ‘One hacker site, Black Hat, published a report, nine a.m. US time, connecting the disappearance of Batur to the conversations on Abysm, suggesting he may have stumbled into information to do with an intelligence service. It gets blown offline an hour later. By their own account they were hit by a DDoS attack – they posted a grab of their server log.’
DDoS: Distributed Denial of Service – a technique used by criminals, bored teenagers and intelligence services alike to derail a target website by bombarding it with communication requests until it goes into meltdown.
‘The style is distinct,’ Stefan said. ‘Most attacks piggyback on multiple computers to get scale. This one just fools the host into thinking it’s receiving excess communication. It’s trying to put together the fragments of data being sent, but getting the wrong information, so thinks it’s overloaded when it isn’t. The beauty of this technique is that it leads to buffer overflow. The host starts to wipe the data it already has.’
‘Seen it before?’
‘I helped devise it.’
‘What do you mean?’
‘It looks like what we called Slow Clap. The bosses at GCHQ were queasy about piggybacking civilians’ PCs to get their mass of attackers, so I helped develop techniques using software errors and security gaps that could be run off one PC only. Pretty ingenious, if I say so myself. You can take a target down solo.’
‘Are GCHQ the only ones with it? What about you guys?’
‘Not from me. But these things catch on fast. Like I say, what’s going on?’
‘Do you have any idea what Batur got?’
‘No.’
‘Is there any chance of us repeating the hack?’
‘There’s no way. It’s locked down now.’
‘Do you think there might be a copy of the stolen data anywhere?’
‘I’m not sure I’d go looking for it if there was.’
‘I need malware for Aliya Savinova’s phone: an exploit for Androids, one that would work on an LG G5.’
‘I can get them to send something through. But you’re not going to crack this alone.’
‘You think I can just drop it?’
‘No, I think you’re in trouble. That’s what this is about. I can’t stick around.’
‘I’m not asking you to.’
Stefan sighed. ‘What’s Aliya Savinova going to give you? She won’t know who she’s working for.’
‘Everyone knows something. And she interests me.’
‘She hates the West.’
‘She likes hating the West. She’ll enjoy my company.’
THIRTY-SEVEN
Evotec sent thr
ough the malware a few hours later, along with a ‘pattern of life’ file for Aliya, including professional and friendship networks, educational history and financial records for both her and her family. She had some extra money coming in, a personal account with Halyk Savings Bank of Kazakhstan that received monthly transfers of 300 dollars from a business account at the Asia Credit Bank in the name of ACT Strategic Communications. No ACT Strategic Communications came up online.
I dialled the number she’d given me. The way someone answers a call is usually informative in itself. Are they in the environment you’d expect? Any suggestion of a delay while devices are initiated? My call was killed after five rings. I sent a text.
It’s Toby. Can you call me?
Aliya texted back. In five minutes. She called in three and a half. She sounded happy.
‘Toby, hello.’
‘Can you speak?’
‘Yes, briefly.’
‘I read a story by the writer you recommended.’
‘Already?’
‘“The Edge of Things”. I found it online. I began reading it last night and couldn’t stop. I think the writer is hugely talented.’
‘You do?’
‘Do you know them well?’
‘Quite well.’
‘I have a friend who edits a literary magazine in London. I think they would be very interested in doing something with her work. He is very interested in literature from other countries.’
‘Really?’
‘Yes. Are they contactable?’
‘I think so. I will find out.’
A Shadow Intelligence Page 24