Chapter 26: Hard Evidence

I sat in a food court a block away from the office drinking black coffee and setting up my plan of attack. Someone with access to the company security cameras had set me up by editing footage from security cameras so it looked as though I was making a midnight raid on the manufacturing facility. Someone had also posted footage from my incident in front of the building on a video sharing site. I suspected I was being taunted. If I could triangulate on the two events and the missing ten seconds of network logs, I was pretty sure I would find out who was playing games inside EFC. I set up my laptop with a cellular connection and logged onto the company network.

The path led me through a dusty attic in the EFC archives. The camera system was an early model that came out nearly twenty years ago. The company had made minor additions and modifications to the system over the years, updating to higher resolution cameras, improving their archiving system, and transferring data to the cloud. Occasionally, they replaced or added cameras but it was essentially the same system they started with. In fact, I discovered many of the company’s systems were outdated. The network technology, managed by Don Abrams and Allen Yarborough, was state of the art. On the other hand, accounting systems that were set up when the company was founded were essentially unchanged, the biggest advances being updates to current software versions.

My usual method is to scan through huge amounts of data very quickly, looking for anomalies and inconsistencies as much in the form of the data as in the actual numbers and names. But as I strolled through this dusty archive with neatly labeled boxes stacked in rows that no one would ever touch, I was struck by a uniform feature rather than an anomaly. One name kept appearing on the records of every significant development and installation in the company for decades. An employee number that was mostly zeroes.

The company leaked like a sieve. But it wasn’t leaking money—not in the normal sense. How clever to send me into the system looking for an embezzler. EFC was losing money because every promotion, system, update, and account had been sold to the highest bidder in the biggest corporate espionage case I’d ever heard of.

“Jen, this is Dag.”

“Good morning. How are you feeling?”

“My head hurts, but it doesn’t look like there’ll be any long-term damage.”

“That’s good to hear. When can we expect to see you in the office?”

“Jen, how long have you been with the company?” As far as I was concerned I wasn’t planning to come into the office again, but she didn’t need to know that yet.

“Eighteen months. Why?”

“When did you put together the team?”

“That was my assignment when I was hired.”

“Always the same team members?”

“We’ve had a little change in the past year, but pretty stable—only the best and brightest.”

“What is the most significant project the team had executed before I came on board?” There was silence at the other end. For a minute, I thought Jen had just disconnected instead of answering me, but I waited.

“You know, don’t you?” There was another pause as she tried to outwait me. I’d figured it out, but I needed to hear it. So far I was just making assumptions. I heard a door close and then Jen spoke lowly and rapidly. “I’m so sick of this crap. The team was put together to assess and expand the company’s ability to respond to a cyberattack. It was to focus on rapidly identifying and neutralizing a new threat. You were invited onto the team to provide a target. You’d be let loose inside the firewall and the team would track and neutralize any attempt you made to access data. Whatever Arnie hired you to do undercover was just a ploy to get you to search through every possible sensitive point in the system. You were to be the threat and we were to stop your investigation. It turned out you were slipperier than we anticipated and the team’s efficiency has risen thirty percent since you arrived. I’m sorry, Dag. It wasn’t personal. No one knew who you were. It was just a lucky draw that Arnie hired you instead of some other hacker.”

That hurt. But it hadn’t been random. Arnie had known the work I’d done on the Henderson case. He knew if he waved the red flag of stealing corporate funds, I’d charge at it. He wasn’t expecting I’d actually find something.

“You’ve been played, Jen. I’m only here to distract you,” I said. “Tell the team you don’t think I’m out of the game yet. In fact, I’m sending you a file that suggests that I’m still in the system even though I’m not in the office. They should stay alert for what I do next.” I sent her the login information for six smartcards that I’d received from my bug on the manufacturing facility. That would expand their target awareness and give them more to look out for, even though I had no intention of using any of them again.

There is a longstanding principle regarding the control of mass behavior, explored in social studies, politics, and philosophy. The best way to hide a real internal threat is to focus on or create an imaginary external threat. Hitler managed it brilliantly. Bush managed it somewhat less successfully, but well enough to send the country to war for more than a decade. Countless other politicians and business leaders had managed it. Launch the rumor of a takeover bid from a rival company and watch the deflated stock value rise long enough to cover a cash shortfall that can’t be explained. Fabricate an external threat to rally the troops around and you will get them to ignore a very real internal danger. It’s what Lars was teaching us in our Navy intelligence drill. You could even avoid—or start—a revolution. EFC was focusing its top talent in the company on stopping an imaginary external threat. None of them knew there was a very real problem inside.

And the one person who was on every team that implemented a system, who had a top level engineering degree, who had been feeding me material as a cover for my activities, sat a few doors down from my office masquerading as an administrative assistant.

I needed just a few more bits of data to tie it all together—an actual trace of information leaving the company. I began writing a routine that would help me tag and identify the controller. I would need to lure the team back into an engagement, but I already knew who the target was.

I packed up my computer and headed back to Capitol Hill just before noon. I’d transferred my virus into the system where it would lie dormant until one of several key phrases appeared on the network. When that key phrase appeared, the virus would activate and bundle the user’s ID and every file they touched and ship it to me. I’d set up a game tonight and tomorrow it would all be over.

I arrived at Andi’s house right at noon and was greeted like she hadn’t seen me in weeks. I smelled something delicious as I went into the house.

“What is that wonderful aroma?” I said.

“Homemade bread,” Andi responded. She placed a long sensuous kiss on my lips and then whispered in my ear. “Before we go in, please take this.” She handed me a thick brown envelope. “It’s all the material I’m going to give to Cali. I’d like you to look it over and help me make sure it ... well, that it won’t hurt her. Now that I’ve decided to tell her, I’m nervous. I don’t want her to think any of this was her fault.” I took the envelope and slid it into my backpack. I kissed her again.

“I’ll look at the stuff, but when it comes down to it, it’s because Cali loves you and you love her that it will all work out. Don’t worry, darling.”