Chapter 6: Paper Trails

WE LIVE with the mistaken belief that digital files are somehow safer than old fashioned paper files. Haven’t we been told since the dawn of the Internet that the Internet is forever? ‘Don’t post that picture because you can never remove it from all the places it will be posted.’ It’s a contradiction that we believe the ‘cloud’ is somehow a safe place for our information while our privacy is made vulnerable on the Internet. And they are the same thing.

Well, Hacker X had proven that he could erase someone from the Internet, and all digital trace that he existed. And he’d apparently taken credit for my attack on Philanthropolis and the Patterson Empire. Nice guy.

Except that meant he knew who I was. I was worried.

It took a few days to reach a full agreement with Jordan. The simple fact that FinCEN was willing to pay me in tax-free, or tax-paid, bearer bonds was enough to convince me they were serious about putting me on this case. Bearer bonds hadn’t been issued in the United States since the 1980s as part of the agency’s drive to stop money laundering. Now, you had to buy Eurodollar Bonds in foreign countries and even then, you couldn’t transport them into or out of the country without declaring their value and paying tax on them.

I’d found that out when I stashed the bonds the Mexican government gave me and decided to transfer most of the money FinCEN had paid into the instruments. When I brought them back into the country, I had to declare them and show an IRS agent that I had transferred post-tax dollars from my account in Seattle to buy the bonds in Mexico City. They really wanted to charge me tax on them again.

Any financial instrument with a value of over ten grand had to be declared going into or out of the country. Stocks, cash, bonds, treasury notes. And if one became a stickler about it, even the American Express cash cards they gave me for expenses. The thing is, you can take any number of credit cards and bank cards in and out of the country with any limit. But credit card transactions are logged and reported. Amex cash cards are not. They just happen to look almost the same. The missing bit of information on the cash cards is the key to their value. They function by PIN and there is no name on the card or associated with the account.

FinCEN was making it possible for me to travel anonymously, or under any name I chose.

Did I believe they couldn’t track the cash cards? No.

On the other hand, one of the things that had saved my bacon when I was investigating EFC was a credit card transaction and receipt in my wallet from a gas station a hundred miles away time-stamped when I was supposed to be breaking into the company’s manufacturing facility. There was a place for a paper trail.

And a way to use one to deflect interest in me.

“Maizie girl. How about a road trip?” I’m not sure she understood what I was saying, but something in my voice must have said “GO!” The little dog was out the door and downstairs in a flash. There were two quick barks at the front door, then she bolted back upstairs with leash in her mouth. I heard Mrs. Prior huffing upstairs behind her.

“You’re leaving again?” Mrs. Prior asked from the top of the stairs.

“Maizie and I need some time to get to know each other better. I’m thinking we’ll drive down the coast—maybe all the way to San Diego and back. My car needs to be driven occasionally to get the oil circulating, you know,” I said.

“How long will you be gone?” she asked, eying the overnight bag I brought from my room.

“Oh, not more than three weeks or so.”

“I’ll watch things here for you and bring in mail. Call if you need anything.”

I can be ready to walk out the door for a three-week trip in twenty minutes. Ten if I’m in a hurry. I don’t need that much and part of the purpose of this trip was to equip myself for a much longer journey if it proved necessary. I can open up the Mustang and get to Las Vegas in two days, so I figured three to San Diego.

Not so when traveling with a dog.

In addition to my small bag of clothes and backpack with computer equipment, I needed a dog bed that would fit in the passenger seat, a special harness that looped into the seatbelt so Maizie could ride safely, a twenty-five-pound bag of dog food, doggie dishes, poop bags, a huge box of doggie treats, dog brush, and two and a half gallons of water in case she got thirsty.

As casual as she was about saying ‘have a nice trip,’ Mrs. Prior still accompanied me to Pet World to make sure I purchased things that Maizie liked. Add to the list a ball and three squeaky toys.

After stopping at every rest area along the freeway, Maizie and I finally made it to a cheap motel on the north edge of Portland, Oregon in time to eat dinner and stretch out for the night. I used a cash card for the room, the meal, and fuel for the Mustang. At every truck stop I visited, I withdrew $500 from one of the cards. I was going to be carrying a lot of cash soon. I revised my time to San Diego to a week—maybe ten days.

But Maizie and I were having fun.

After Maizie had chased her ball up and down the hallway until she was exhausted, I settled in with my new laptop and started searching around the perimeter for Hacker X. Jordan had given me a pretty hefty file of what they knew about the guy. The attack on Carlisle and on Philanthropolis were only part of his exploits, or at least part of the exploits he’d been credited with. I had to remind myself that he was being credited with at least one attack that he didn’t do, which meant there could be more than one hacker who was carrying out the other attacks, either independently or in a coordinated effort. I could be looking for a cyber army.

The FBI is responsible for investigating and protecting against cybercrime in the US. Some of the paper files Jordan gave me had names and information about investigators redacted. I’d insisted that he deliver paper copies of all the information, and the file was nearly two inches thick. He’d tried to give me a laptop, provide a hard drive, and suggested a thumb drive with all the data on it. I was taking no electronic ‘gifts’ from the Federal Government. I was still stinging from EFC tricking me into being a rabbit for their hounds under pretense of investigating a security breach. If I was just a training exercise for the FBI, they’d at least have to work to find me.

One of the reasons for the road trip was so I could connect through a wide variety of locations and internet portals. I was actively blocking my hardware identification so my searches appeared to come directly from the motel’s front desk. Their guest WiFi was laborious, but the secure office WiFi had reasonable response. And I could hack into it.

The profile the FBI had put together was pretty amazing. You have no idea how much they know about you without actually knowing who you are. According to the FBI, Hacker X was a white male in his late forties, lived or had lived on the West Coast, had probably worked for a large tech company, was protecting a family, was non-religious but not necessarily anti-religion, probably served in the Armed Forces in his twenties, was college educated and not just a self-educated hacker, and might be terminally ill. Yet their search had not zeroed in on a person. He had erased himself.

I worked around the edges of what they knew. I started by using my personal search engine to compile a list of tech companies located in Washington, Oregon, and California. That narrowed things down to just a little over ten thousand. I cross-checked the list against the term ‘cyber security’ and reduced the list to about a thousand. Of course, a lot of companies have some mention of cyber security, but I was interested specifically in those that produced or were involved with providing network security software. It was just a hunch, but if the hacker had worked in the tech industry like the FBI profile said, chances were that he’d had an opportunity to work with the nuts and bolts of security systems. The nature of his attacks had been against networks and not primarily against individual computers.

My list was down to just over a hundred companies.

By the time I’d manually sifted through the profiles of each company, it was nearly breakfast time.

Maizie stretched and we went out for a walk. Then I stretched out on the bed and caught some shut-eye.

She was dancing on her hind legs and ready to go by the time I was out of the shower. After a bite to eat, I located a big chain discount store and bought an unlocked smart phone, but no SIM. We used to call these ‘burner’ phones, but they were just a cheaply produced cell phone that could be attached to nearly any GSM network. That’s good for world-wide travel. The U.S. is pretty backward about cellular access. We prefer to serve the providers rather than have providers serve customers.