Gray Day

by Eric O'neill

  Hanssen checked his watch. “We leave in fifteen minutes.”

  “I’ll reserve a car.”

  I took five minutes to find Garcia and reserve the black Tahoe. Five more minutes to make him swear that it would be waiting when we reached the parking sublevel. I spent the final moments in a stairwell filling Kate in on our unannounced departure. She planned a search of Hanssen’s car while we met with Sheymov in Reston.

  Garcia kept his promise. Hanssen and I climbed into the black Tahoe and sped onto Route 66 toward Virginia. It would take us over thirty minutes to drive there and as many to return. Kate’s team would have plenty of time to accomplish their search. I’d have plenty of time to shoot the shit with Gray Day.

  As soon as we got in the car, Hanssen returned to our conversation about marriage and children. He still had a stick in his craw about my boast that Juliana would out-earn me. I had to promise to win the bread for my hypothetical future family to shut him up.

  The meeting with Sheymov and his team fascinated me. Invicta had developed a hardware device that Hanssen thought could protect the FBI’s systems while, at the same time, making them run more efficiently. Invicta’s device, if it worked as promised, would mask the location of FBI computer systems, making it hard for an external attacker to identify a particular computer by continually changing the IP address of that computer. This would solve the conundrum of how to allow an FBI employee to access classified information and the Internet on the same machine. Sheymov’s product was an early hardware solution for creating what we now know as virtual private networks. Today most VPNs rely on software to mask a user’s computer from Internet eavesdroppers. Millions of people around the world use software VPNs. Citizens under the thumb of authoritarian regimes like China and North Korea quietly use them to access websites and bypass restrictions on content. Savvy computer users across the world use them to explore the Internet anonymously, to hide their identities from government surveillance and marketing agencies, or to secure their transactions from cyber thieves. Sheymov’s solution was to protect computer systems by using hardware to establish a point of defense—like a gateway—before information ever arrived on the user’s computer.

  During the Hanssen investigation, most agents hadn’t yet been issued official FBI email addresses. We used external email addresses from providers like AOL, Yahoo!, and Hotmail to send and receive personal email. In retrospect, this wasn’t the best idea, considering that in 2013, cyberattackers (believed by the intelligence community to be Russian and working on behalf of the Russian government) breached Yahoo! and stole all of the company’s 3 billion user accounts. Yahoo! took three years to discover and disclose the breach and spent another four investigating it.

  In 2016, Yahoo! disclosed that a second attack in late 2014 had stolen an additional 500 million user accounts. This time the FBI uncovered evidence that pinned the breach on the Russians. In March 2017, the Department of Justice indicted four Russian agents for the 2014 breach of Yahoo! and theft of accounts that included names, email addresses, telephone numbers, dates of birth, passwords, and some encrypted and unencrypted security questions and answers. The defendants included two officers of the FSB and two criminal hackers with whom they conspired to bust into Yahoo! But because the United States and Russia do not have an extradition treaty, the Russian government cyber spies remained outside the DOJ’s reach. That same year a cyber attacker who went by SunTzu583 offered over 1 million decrypted Yahoo! and Google accounts for sale on the dark web, the Internet’s black-market underbelly.

  But financial and political motives for hacking often go hand in hand. In early September 2017, the credit-reporting agency Equifax disclosed that unknown hackers had obtained sensitive personal and financial information for millions of consumers. The attack began in May 2017 through a known exploit in back-end software for web applications called Apache Struts. A security researcher had told Apache about the flaw, and Apache had published a patch that would fix it. Unfortunately for Equifax and many American households, attackers learned about the vulnerability before Equifax managed to install the patch. The attack continued until July 2017 and siphoned consumer data from 148 million American households, including Social Security numbers, birthdates, addresses, 200,000 credit card numbers, and dispute information for 180,000 Americans. The dispute information is most concerning because it included personal identifiable information that sophisticated attackers could use to gain entry into medical records, bank accounts, employer email accounts, and internal networks—virtually anywhere that a person may have an online presence. State-sponsored attackers are universally blamed for the Equifax attack. Many are pointing the finger at China. I’m still betting the Russians are behind the breach.

  Why would Russian intelligence want to steal Yahoo! accounts and possibly steal consumer information from Equifax? Simple. Infiltrating email accounts allows spies to collect credentials that provide access to particular networks they’re targeting and create virtual trusted insiders within those networks. Because most people use the same username and password over multiple accounts, and rarely activate two-factor authentication, stealing information about one account can open the doors to many others—from online bank accounts and corporate email accounts filled with valuable intellectual property to sensitive government databases. Armed with an insider account, a Russian spy could monitor government-agency systems to inform policy decisions and collect information on US defense and attack capability. Russia can also use email espionage to boost their flagging economy by gaming our stock market with insider information and stealing cutting-edge technology before we build or develop it fully and send it to the market. The breach of Yahoo!, which the company’s board blamed on “failures in communication, management, inquiry and internal reporting,” also allowed FSB spies to wade through the accounts of diplomats, journalists, Russian officials, and politicians critical of the Kremlin. Considering how the Kremlin treats dissidents, the Yahoo! breach may still have deadly implications.

  For all his talk about counterintelligence, Hanssen spent most of our time at the Information Assurance Section focusing on prevention. He sought a way to stop external attackers from accessing internal FBI computer systems that could access both FBI NET and the Internet on the same machine. Searching for hardware and software solutions at Invicta was Hanssen’s response to the first requirement of effective cybersecurity: technology.

  People and process are the other two requirements, and the ones many companies trip over. Even the best security technology is just window dressing if employees aren’t trained to use it effectively. With the right combination of technology and training, companies can gain visibility into attacks as they occur in real time. They can watch the attack land, figure out where it originated, and track how it moves within a system once the breach occurs—called the “attack killchain” in cyber lingo. Actively hunting for threats is the key to discovering attacks before they can do irreparable harm. But in order for threat-hunting to work, cybersecurity and counterintelligence have to play nicely with each other.

  Equifax had invested in sophisticated security and had hired one of the top security threat research teams to protect its data, but an alleged dispute between the company and its security consultants just before the breach may have slowed the company’s threat hunting. And when people aren’t actively using technology to hunt spies, bad guys slip through the cracks. In other words, in a world where spies have become hackers, cybersecurity professionals must become spy hunters. They can never relax their guard.

  But spies don’t use a single playbook; they write the next attack as they go along. Hanssen attacked the FBI’s most vulnerable point, internal computer systems, during a time when institutional bias had the FBI searching outward for a mole instead of inward. While the FBI sought to defend the United States from Russian spies, Hanssen attacked from within, using misdirection and detailed knowledge of security systems
and procedures to protect himself. Through the years, he’d been able to siphon off information not because Russia had managed to hack FBI NET, but because with Hanssen on their side, they didn’t need to. The FBI wasn’t securing themselves from their own people. As long as Hanssen pointed the FBI in the wrong direction, Russia was guaranteed to win the cybersecurity game.

  Hanssen smiled a lot at Invicta. My dour and withdrawn boss was flaunting an amicable, friendly, and likable side. I understood what was going on: Hanssen had taken me on his job interview. The FBI faced time pressure to catch him not only because he was about to make a drop but also because he might get a better offer in corporate security. Spying may have fed Hanssen’s ego, but so would a cushy corporate job with stock options.

  Meanwhile, I had another, more pressing, problem: Hanssen cut the meeting short without warning or explanation. We bid Sheymov’s team a cheerful goodbye and hurried down to the car. I didn’t have time to call Kate or to send a page from the two-way pager on my hip. I tried to slow-step our way through the parking lot, but Hanssen would have none of it.

  “I have other appointments,” he said. One hand jiggled the keys in his pocket and the other made a winding motion in the air. “Get in the car.”

  * * *

  I started the car and pulled out of the Reston parking lot in full grandpa style: extended stops at intersections, exaggerated care when changing lanes, driving five miles under the speed limit.

  Hanssen’s patience vanished. “If you don’t drive like you have somewhere to go, you can walk and I’ll take the wheel,” he ordered.

  My mind raced. I fought to keep my eyes off the clock, a certain sign to Hanssen that I was worried about the time. If Hanssen walked straight to his car as soon as we arrived at HQ, he’d find the silver Taurus missing. Judging by his anxiousness to get back, this was a real possibility. It’s impossible for someone to boost a car from the garage of one of the most secure buildings on earth; Hanssen would know the FBI had moved it. This would kick him in the pants hard enough to somersault him way over the suspicion line and into Paranoiaville.

  I had to stall without rousing his suspicions. I made a turn off Route 66 onto the streets that would take me across the Key Bridge and into Georgetown.

  “Where are you going?” Hanssen asked. He had this habit of tapping the dashboard with his index finger when I drove. It reminded me of my father teaching me to drive when I was fifteen and on a learner’s permit. Dad would put his finger on the dashboard and tap faster when I accelerated too aggressively. I hated it then, and I hated it more now.

  “I’m taking us back to headquarters,” I said.

  “Why didn’t you take the parkway?”

  I glanced over at him and raised an eyebrow. “Boss, I’m SSG, remember? This is what we do for a living. M Street is a shortcut.”

  He crossed his arms and slumped back in his seat. Having divorced his finger from the dashboard, he tapped his foot.

  Anyone who has lived in the DC area for two weeks, or gone shopping in Georgetown once, could call my bullshit. The M Street traffic nightmare never ends, and for once Murphy helped me out. A truck had broken down in the middle of the two-lane road, and streams of cars had to squeeze by on the right. I drove us into the queue and choked back a smile.

  “Moron,” Hanssen said. “Imbecile!” He balled one hand into a fist. “Idiot.”

  The words barely penetrated anymore. The traffic would give the search team plenty of time to sew up the car and get it back to Hanssen’s parking spot before I drove into the garage.

  Before I could congratulate myself, Hanssen’s seat belt spun away from his chest and clinked off the glass window before slamming home. He grabbed his bag from between his feet and shot me a dismissive glare. “I’ll walk the rest of the way.”

  “Boss, wait, I—”

  My phone shocked us both. I held up one hand and fumbled for my phone with the other. Hanssen tracked the black Nokia on its way to my ear.

  Kate’s voice. “Where are you?”

  “I’m sorry, Juliana,” I repurposed my panic into anger and pushed it into my voice. “I’ll remember to pick up dinner.” I paused. Kate remained silent. “No law school tonight, remember?”

  I glanced at Hanssen. He sat, stone faced, one hand on the door handle.

  “I’ll try to be home on time,” I said. “I’m stuck in traffic right now on M Street. I might be a little late.”

  Hanssen’s sigh belonged in junior high school drama class. He scowled and opened his door.

  “Juliana, I have to go…”

  Hanssen got out of the car and walked up M Street, blue bag swinging off his shoulder. Sitting in the car, alone, I understood Hanssen’s game. His odd mannerisms, the way he pushed his shoulder into me, his clicking pen and jingling keys, the way he insulted with one breath and complimented with the next. Hanssen was playing a game of balance.

  As long as Hanssen was forcing me to react to him, my investigation was bound to fail. I spent so much time trying not to screw up the case I had tried to win it only once, when I’d dared search Hanssen’s office. Boyd would have told me that each time I reacted to Hanssen, the spy changed the circumstances of our battle and forced me back into a never-ending OODA loop. I had to break the loop and make Hanssen react to me.

  I ended the call and slammed the car into park. Angry Washingtonians screamed at me with their car horns as I slid across the front seat and chased after Hanssen.

  “Boss, boss, wait!”

  He turned and looked from me to the flashing hazard lights of Garcia’s Tahoe. “What the hell are you doing?”

  “I need you to get back in the car.”

  He stopped. Hanssen didn’t just stop moving or talking, he went cold. No jingling keys or clicking pens. No foot tapping or finger pointing. His stillness was menacing.

  “Why?”

  An undercover case comes before everything else in an operative’s life, especially when that case puts billions of dollars, numerous careers, and the security of the United States on the line. Relationships suffer. Birthdays are forgotten. Friendships fizzle. Dates sit alone in cafés waiting for you to appear. You flush away those things that matter to you, all in the pursuit of winning.

  And sometimes, during that pursuit, you reach deep inside yourself for inspiration. These are the moments that make undercover work the dirtiest business in counterespionage investigations. I’d already sacrificed my faith. I had one quiet part of myself left to give.

  “It’s Juliana, boss,” I said. “I need your advice.”

  He waited.

  “We had a big fight last night.” Totally true. “It was because of you.” Also true.

  Hanssen’s head shifted to the side. It was subtle, but his nonverbal cues let me know he was listening.

  “Juliana told me she doesn’t want to have kids for a while,” I said. “I brought up what you told me yesterday, about kids being the purpose of marriage. She didn’t take it well.” I glanced back at the shouting drivers and honking horns. “I thought we could have some time to discuss it in the car, but I didn’t know how to bring it up.”

  “Do you swear?” His eyes bored into mine, equal to any lie detector.

  “No,” I said. “I’m not going to take the Lord’s name in vain just to make you feel better.” I turned to walk away. Then stopped. “I need your help!”

  I didn’t need to act or lie to project my indignation. How dare Hanssen test me when I had just poured my heart out to him? I spun and walked back to the car, feeling Hanssen’s eyes on my back, willing with all my might for him to follow. With wooden motions, I returned to the driver’s seat of the Tahoe and fastened my seat belt.

  Hanssen spent the slow drive back to the office lecturing me on the purpose of marriage and the role of the man and the woman in the marriage. I smiled and nodded at the right poi
nts, and knew that nothing he told me would ever fly with my very independent wife.

  I stopped the Tahoe beside Hanssen’s silver Taurus and hoped that this time the search team had lined the tires up precisely in the parking space. But Hanssen focused on me with a face that slowly softened. He told me that marriage presents challenges and that my first responsibility as a Christian was to my home. I recalled a passage from The Way. “By good example good seed is sown; and charity compels us all to sow.” I’d let Hanssen in to a personal struggle with Juliana. Hopefully he’d jump at the opportunity to lead by example.

  “There are ways, Eric.” Hanssen paused with one foot outside the door. “You just have to have faith.”

  “I have faith.”

  “Then everything will work out fine.”

  He wished me a good night and turned toward his car. I watched him back out and turn toward the ramp out of the garage, then shifted the Tahoe into drive. Before I could pull forward, Kate leapt into the passenger seat.

  “Cutting it a little close,” I said.

  She eased the sidearm she concealed under a short sport coat and leaned back. “What do you think he meant?” She fell silent as I parked the Tahoe back under Garcia’s Reserved sign.

  “Have I told you, you’d make a good ghost?”

  “A few times.” She grinned.

  “I think he’s one of those people that thinks money solves all our problems.” I slapped the car in park. “I don’t think money has solved his.”

  “Good answer.” She vibrated with excitement. “Jackpot.”

  “Jackpot?”

  “We searched the car. Smooth move turning on M Street, by the way.”

  I wasn’t in the mood for jokes or congratulations. I’d done my job, but I felt dirtier for it.