Ли Чайлд - The Sentinel

‘I don’t like this.’ Sands took Rutherford’s hand when he set her cup on the table and looked up at him. ‘I don’t like this one little bit. Someone’s trying to kidnap you? That’s not OK. The Bureau should be all over this. We need to keep you safe.’

‘That’s what Reacher told the cops yesterday but they weren’t too impressed.’ Rutherford sat down next to Sands. ‘I’m still pretty much persona non grata around here.’

‘How about you, Sarah?’ Reacher said. ‘Have you got any contacts from your Bureau days? Anyone who could light a fire under this?’

‘Maybe,’ Sands said. ‘I still know some people. I could make some calls. Maybe kick up a few sparks, at least. Have you got any idea what Rusty has that they want, whoever they are?’

‘We’re still trying to figure that out.’

‘Maybe I can help. I bet they want the same thing I’m here to get. The system we created. Or part of it, at least.’

‘Why would anyone want that piece of junk?’ Rutherford slumped back. ‘It didn’t work.’

‘It didn’t work the way we hoped. That’s true. But that doesn’t mean it was a complete failure. Something you said when the attack first happened didn’t quite make sense to me, Rusty. It kept on bugging me. So I ran a bunch of simulations and I think I found something.’

‘That the whole thing was a giant waste of time?’ Rutherford said. ‘That we would have been better off creating a crossword puzzle app for people learning Swahili?’

‘I can’t believe you didn’t see this yourself,’ Sands said. ‘There’s a giant clue right there in your backup.’

‘No. There’s nothing in the backup. Nothing overwrote what was already there on whatever crappy second-hand servers I used to cobble it together.’

‘That’s exactly the point.’

‘Oh my God.’ Rutherford stood up and pressed his palm to his forehead. ‘Sarah, I love you.’

‘So your system did work?’ Reacher took a sip of coffee. ‘You said it didn’t.’

‘Right,’ Rutherford said. ‘It didn’t.’

‘So why would anyone want it?’ Reacher said.

‘It comes down to the way ransomware works,’ Sands said. ‘Attacks don’t happen all in one go. Imagine a computer network is like an enemy fortress. If you want to capture it you don’t just lob a grenade over the wall and hope the soldiers are all killed. You start by infiltrating your best guy. You smuggle him past the defences and leave him to sneak around inside for a while. Get the lie of the land. Draw maps for when your main force arrives. Find out where all the good stuff is hidden. And see if there are any traps to avoid. In our case, for traps read backups. Backups are kryptonite to ransomware. There’s no point in locking a bunch of data if your intended victim has a clean copy. He’d just laugh in your face. And that’s a big problem because some of these groups are in the game for prestige as much as they are for cash. So if they find a backup – which are usually only connected briefly to capture a snapshot of any recent changes and then get taken offline or even off site for safe keeping – they immediately deploy a special kind of program. A particularly sneaky kind. We call it a trident because it does three things all at once. One, it destroys all the data that’s already been backed up. It’s either wiped clean or replaced with porn or taunting messages, or things like that. Two, it prevents any new backups getting saved. And three, it sends spoof signals to the organization’s management system saying that everything is working OK. That way it avoids alerting anyone to what’s happening and adds to the blow when the main systems lock up and the ransom demand is posted.’

‘But your backups didn’t get wiped,’ Reacher said. ‘Or overwritten with porn. Did they?’

‘No,’ Rutherford said. ‘Something stopped that from happening. But nothing new was saved. And spoof management reports did get sent. That’s why I thought we’d be OK after the attack. And why I was so shocked when we weren’t.’

‘Cerberus interfered,’ Sands said. ‘It broke one spike off the trident. It’s the only explanation. I ran simulations using copies of the most recent ransomware we’ve come across, and here’s where things get interesting for the people who are chasing Rusty. In eight out of nine tests, not only was the existing data untouched, but a fragment of the malicious code was retained on the backup system. It was somehow caught by Cerberus when it stopped the disc from getting wiped.’

‘Enough of a fragment to unlock the town’s computers?’ Reacher said.

‘No,’ Sands said. ‘It doesn’t work that way. But it could reveal who’s responsible. It’s like when a bank robber wears a mask but the security cameras pick up his gang tattoos.’

‘That must be why these guys are trying to get their hands on it,’ Rutherford said. ‘They must have analysed the system maps the ransomware sent back to them. Seen something they didn’t recognize – Cerberus. And figured out what it could do. Maybe put that together with the reports in the press about the old data being the only thing that survived. You should have seen the headlines. Rutherford’s Rusty Ransom Response was my favourite. But we have a different reason to want it. Maybe millions of different reasons. Right, Sarah?’

‘That’s why I’m here,’ Sands said. ‘There’s life in the guard dog yet. It’s not the product we thought it was going to be. It obviously doesn’t prevent ransomware attacks happening. But if it bulletproofs any backed-up data, that’s the next best thing. A lot of organizations would pay a lot of money for that. All we need is the servers you were using. Bench tests are fine, but we need to make sure it really was our system that saved the old data. Not some random malfunction. So let’s go get them.’

‘We can’t get them.’ Rutherford flopped back down. ‘When I thought the system had failed I threw everything in the trash.’

Speranski was in his study, looking through catalogues from electrical wholesalers, trying to find the closest thing to a World War II anti-aircraft searchlight, when his secure phone rang again.

‘We were right,’ the voice at the end of the line said. ‘It was an ambush.’

‘How bad?’ Speranski said.

‘Could have been worse. The main team, four people, went into the garage. They read the situation, planted a tracker on Rutherford’s car, and got out unscathed. The drifter got the two guys who stayed outside.’

‘Are they dead?’

‘No. But they’ll be out of the game for a while. He knocked them around pretty good. And one of them got bitten by a rat before he was found. They were left in a couple of dumpsters.’

‘Does the Center know?’

‘Yes. But don’t worry. The police didn’t get involved. No members of the public saw anything. No attention was drawn. They’re not pulling the plug. But they are making a change.’

‘What kind of change?’

‘They’re bringing someone in. Denisov. The rest of the team is stood down to surveillance only until he arrives.’

Speranski paused. He had never worked with Denisov. But he had heard of him. Denisov had started out as an interrogator. The human polygraph, he was called. Due to his appearance. And his temper. His ability to loosen tongues. And bowels.

‘I thought Denisov wasn’t used in the field any more,’ Speranski said. ‘Too many unfavourable outcomes.’

‘No, he is,’ the voice said. ‘He’s been in Chechnya for the last five years. Broadening his repertoire. Working on his self-discipline. He’s rehabilitated now. Back in favour with the people who count.’

‘And they’re letting him loose on Rutherford? Isn’t that overkill?’