Christopher Reich - Rules of Vengeance

“We’d detected a problem with our security networks.”

“What kind of problem?”

“Are you familiar with our work at Nuclear Safety and Security?”

“I’ve worked with some of your colleagues regarding pirated radioactive materials,” said Graves. “Uranium, plutonium, the like. Until I learned about the stolen laptops, it had crossed my mind that that might have been the reason for your visit.”

“I’m afraid not. The reason for our trip is more in line with another of our mandates that has to do with ensuring the safety of nuclear installations-both how they’re run and how they’re protected.”

Kate looked at Graves, who returned her glance coolly.

“We’re not worried about a physical attack,” Dibner continued. “You could crash a 747 into the containment building of any plant in Europe and it would more or less bounce off. Absolutely nothing would happen. Short of a concentrated military assault with laser-guided munitions, we’re safe. Even then, it would be difficult to provoke any large-scale release of radiation that would harm the civilian population. The reason for our trip has to do with cybersecurity.”

“Hacking into a plant’s control systems?” asked Kate.

“That’s where the greatest risk factors lie. Think of each plant as a castle with four concentric rings of defense.

“To get from one ring to the next you must navigate through firewalls that get more and more impenetrable as you near the innermost ring.

“The outermost ring is the Internet. The second ring is the local area network-a firewall that protects the plant from outside incursions. The next ring is the most important. It’s called the Plant Control System, or the PCS. Remember, all radioactive materials reside inside the reactor vessel, and it’s there that the steam is generated to run the turbines and create energy. The PCS monitors all control systems to keep the process within safe boundaries. Every system is monitored by four separate computers, or four redundant systems. If two of these computers detect an operating error, they trip the safety systems.”

“That’s only three rings of defense,” offered Graves respectfully.

“The fourth is the Reactor Protection System. And, should all else fail, there is the Engineered Safeguard System. By that I mean the actual machinery inside the plants that physically prevent an incident if the PCS were to fail. But it’s the Plant Control System that has us worried.”

“Has there been an incursion?” asked Kate.

“Not as such. But there have been attempts. All you need to know is that someone was able to get past a firewall at three different plants.”

“Just how far past?”

“Far enough. We caught the incursion instantly. They never got close to being able to issue one command on their own. We have too many fail-safes in place. As a last resort, we can take manual control of all systems and thwart whoever is trying to break in.”

“Any luck tracing where the hacker originated the attack?” asked Graves.

“None.”

He continued: “Does that mean that you came to Britain because one of the compromised plants was in the UK, or was there another reason?”

“One of the plants was at Sellafield, though we’d like to keep that information under wraps.”

“I see,” said Kate. “So Robert Russell’s communications with you had nothing to do with your trip?”

At the mention of Russell’s name, Mischa Dibner’s face fell. “Who told you about him?”

“Did you know that he’d been killed?” asked Kate.

“I saw it in the newspaper. I was disturbed.”

Kate went on: “In the course of our investigation into his death, we came upon information that he had reached out to you. Is that accurate?”

“It was Russell who alerted me to keep watch for forays against our systems.”

“Can you be more specific?” asked Graves.

“He said that he’d learned of a state-sponsored plan to get inside a plant and cause damage. He thought the target was probably in continental Europe, and he was most insistent that it would take place very soon. But he refused to hint at who was behind the plan.”

“And why did you believe him?”

“Because in the past three months we’ve had over a hundred cyber-attacks against our plants and he was able to name nearly every one. In my book, he’d established his bona fides. We’d planned on meeting yesterday morning to go over ways we could tighten our security.”

“At One Victoria Street?” asked Graves.

Dibner nodded. “I didn’t learn about his death until after the bomb against Ivanov.”

“Ivanov was a decoy,” said Graves. “The attack was a coordinated bid to force you and your team to leave the building and then steal the laptops while you were gone.”

“That’s impossible. No one apart from the six members of our team knew about the meeting.”

“And your higher-ups?” suggested Kate. “I imagine you had to clear the visit with the director general.”

“We’d never do anything of this nature without his approval.”

Kate smiled understandingly. “How long ago did you float the meeting?”

“Seven days.” Dibner sighed and seemed to shrink on the spot. “I see what you’re driving at. Of course you’re right. A good many people knew about the trip. Let me assure you both that I passed along Russell’s warnings and that we’ve seen no unusual behavior anywhere to indicate that an accident is imminent.”

“Until the laptops were taken.”

Dibner swallowed hard as the realization hit home.

There came a knock at the door. An assistant entered, carrying a tray of coffees, and handed them around. Graves sipped his appreciatively. “Well, then, what do the laptops contain that would make them the object of such a well-planned operation?”

Dibner smiled ruefully. “Correspondence, field inspection reports, confidential country assessments, personnel information. I can’t begin to imagine everything that is on them.”

“Anything especially sensitive?”

“God, yes.” Dibner looked up, her black eyes sunken deep in their sockets. “Several of them were holding emergency codes that allow the IAEA to circumvent every cybersecurity measure I described to you.”

“What good will they do someone?”

“In theory, whoever possesses the codes can access the control room of any nuclear plant in the European Union without triggering an alarm. The codes were put in place to allow professionals to operate the plant from a safe distance in case of an emergency. But I wouldn’t worry. As soon as we discovered the laptops were missing, we activated a kill switch, sending a command that effectively obliterated their hard drives.”

“And how soon was that?”

“We were allowed back into the building at five p.m.”

“Six hours,” said Graves.

“More than enough time for someone to make a copy of the hard drive,” said Kate.

“Even with the codes, it’s impossible to precipitate an accident. Those plants are staffed with the best-trained engineers in the world. The moment they noticed something awry they would take manual control of the plant. The final say will always remain in the control room. With men and women. Not with machines.”

Graves pushed back his chair and stood. He helped Mischa Dibner with her coat and showed her to the door. Kate accompanied her down the hall. “Mrs. Dibner, why do you think someone would go to such an effort to get the codes if they really can’t do any harm once they have them?”

“In this game, knowledge is everything,” replied the director of Nuclear Safety and Security at the IAEA. “Maybe by stealing the codes, these people hope to gain an insight into current safety measures. Perhaps they just wanted to make us feel vulnerable.”