Chapter 19

My first national crisis reared it’s ugly head two weeks later.

“James,” I said answering my ringing cellphone. At the time the damn thing had not rung since Desiree had given it to me almost six months ago. I was beginning to think that no one had my number. It was 21:40.

“Your Highness, this is the Prime Minister.”

“What can I do for you Mr. Bianch?”

“We have had a breach at Server Bunker 24.”

“Physical or hack?”

“Hacked, your highness. I am sending one of my assistants to brief Lady Desiree and yourself.”

“Thank you.”

No sooner had I hung up than my phone rang again.

“James,” I said.

“Your Highness the government has just informed us that we have had a server farm hacked,” I heard Desiree inform me.

“I am aware of that. Please have Benson ask my mother to meet us in the briefing room. The Prime Minister is sending one of his vice-ministers to brief us. I suppose you have someone who should join us also?”

“Yes, Your Highness,” she said.

“James,” mother said by way of greeting.

We we the only two in the room. The briefing room was a high tech conference room. It had the most up to date display and computer interface equipment I had ever seen in real life. The table was big enough to seat about a dozen with additional chairs against the walls for staff members.

“Does this happen very often?” I asked.

“A couple of times a year. Usually the customer handles most of it. We only become really involved if there is a chance the attack is physical.”

“You mean to the server farm itself or one of the trunks.”

“Yes.”

Just then Desiree entered. I did not recognize the fellow with her. He looked to be in his mid thirties. Like most Mariners I could see he was fit. I could easily see him on skis. He was as tall as Desiree. His clothes were traditional, which meant a suit jacket and tie.

“Your Highness, This is George Bonetti, one of my cybersecurity specialists.”

“Highness,” George said giving a slight bow.

“Go ahead and be seated,” I said.

Desiree’s phone beeped. She checked the message.

“The Prime Minister has sent over Claude Lucchese. He’s the permanent vice-minister of defense. His portfolio covers cyberattacks.”

In just a few minutes Benson appeared leading another man. He was in a suit. He had a case.

“Highness, Vice-Minister Lucchese,” Benson announced.

The man stepped into the room and bowed. “Highness”

“Please be seated and tell us what’s happening.”

“Your Highness, at approximately at approximately 20:02 an unauthorized user logged in to the system of the Adult Times site. This software is hosted on servers in Sever Bunker 24. They had admin privileges and restored an existing snapshot of the database of users to an off site cluster they called ‘NewTimes’.

“The snapshot took approximately 30 minutes to complete. At that time they reset the password to the users database. At 20:43 internal alerts reported the password change. At 20:45 the unauthorized user initiated deletion of the user database.

“By this time internal monitors were screaming both at Adult Times’s admin support company and here. Because of the holiday...”

“Holiday?” I said. Suddenly I realized what he meant. Today was Thanksgiving in the States. “That meant the admin company only had phone support.”

“Yes, Your Highness. As the database began to vanish users started seeing only blank screens and we began to get tech support calls.”

“We run their tech support?”

“Yes, Your Highness, under a separate contract. Fortunately Tier II almost immediately realized it was a hack. They attempted to contact the company responsible for administration of the database but could not get a response.”

“No wonder. It would have been quarter to three on the Thanksgiving holiday.”

“Fortunately it is not a holiday in Mariner. Our server tech called Edoardo Baio at Terabyte Technic. He made the decision to block all non-Mariner accounts. That kicked the unauthorized account off.”

“What about the PII [personally identifiable information] on that unauthorized restore?” I asked.

“Terabyte Technic has people working on it. We may get lucky there. We think the hacker is using resources on another Mariner Cluster. If that’s true we may be able to do something about that.”

I looked at the digital clock on the wall next to one of the giant flat screens. It had been only an hour and a half since the breach.

“Are the system’s still down?”

“Yes. They have a backup and it’s being restored now. We’ve open admin access only to the on-call tech. We know now the original account that was compromised, but not how many other accounts were compromised after the hacker got admin privileges.”

“So what does this company do?” I asked.

Desiree looked at Bonetti.

“Highness, it’s an adult dating site for people who want to engage in affairs,” George said.

“You mean like Ashley Madison?”

“Not exactly. Its for couples looking for singles or other couples.”

“So a site for swingers. Was this a politically motivated attack?” I asked.

“Politically motivated?” George asked.

“Yes. Did someone want the information so they can blackmail users or embarrass politicians or business people who might be on the site?”

“Are you thinking maybe state actor, Highness?”

“No. A state actor would have transferred the files to their own servers. I’m thinking morality police, either freelance or political action group.”

“Perhaps,” Lucchese said. “Motives are unimportant. Our first priority must be to keep our customers online and their data protected. Now that it has been copied they have failed to protect their users.”

“If you find that data on a Mariner serve take it offline.”

“Highness,” Lucchese said. “That would cut off services to our other users.”

“Yes it would. How long would it take to isolate the stolen database if we found it on one of our machines?”

“No more than twenty minutes to either purge it or isolate it in software.”

“Not long enough to copy the entire database elsewhere. My decision stands. If you find the copy on a Mariner server physically disconnect it from the net and keep it off until you purge the copy. Then restore services.’ I turned to my spymaster. “Desiree I want this hacker. I want these guys to know if they screw with one of our customers we will come after them.”

“Highness the hacker is almost certainly in a country immune from extradition.”

“So don’t try to extradite them. They want to play online let’s make that painful for them.”

“Personal retribution?” she asked.

I nodded. “With plenty of publicity. I want to hurt them and have people know we’ve hurt them.”

Both Lucchese and Bonetti looked uncomfortable.

“That could result on us being the subject of DoS attacks by their friends. All kinds of other problems, Highness. We can’t...” Lucchese said.

I slapped my hand on the table. Hard. There was silence.

“They get away with this shit because those of us who have to power to stop them find it more convenient to let them get away with it. The Americans let it go because an insecure internet plays into the hands of their intelligence services. The Russians because it gives them asymmetrical warfare advantages against the Americans. The Chinese because they have no problem controlling all of the networks entering their country. They can play whatever game they think is adventitious to them. Well so can we.

“I want hackers to sweat when they think about hacking one of our systems because of what will happen to them if they succeed. So that they’ll go find an easier target in the U.S. or the Eurozone or Asia.”

“Yes, Your Highness,” Bonetti said.

“Good news, James,” Desiree reported.

I was in my office now. I had not gotten much sleep in the last two days. I gestured for my Champion to take a seat. Emelia was behind her and I saw her take a tray from Marie with a tea set on it. She let Desiree take her seat and then poured cups for both of us. She then set the tray on a side table and withdrew.

I looked at my spymaster.

“The software used is identical to malware used in an attack on San Placer Isles website last year.”

“So it was morality police,” I said.

“San Placer has a lot of very wealthy clients,” Desiree said.
“Yes they do. So many that I know their web page has much better security than say your average theme park. I already know you practically need two factor authentication just to check out the resort packages there. It’s not like they’re set up to attract business from the masses. Anyone who gets passed their front page has already been vetted. The attack was looking for data on customers. I’ve read the report.”

Desiree’s face did not show her surprise, but I knew her well enough to see it in her eyes.

“So, the tool used on the San Placer attempt was not that unique,” she finally continued. “It did however, have a unique rewrite of a specific subroutine. We know where that came from. Ferizaj Kosovo.”

“But the hacker isn’t in Kosovo are they?”