John Sandford - The Devil's Code

She was still standing there when I turned the corner. She called after me, "Nice talking to you, Bill."

A little guts.

"So are you going to call the FBP" LuEllen asked, as we rolled away

"Absolutely. If we get two bunches of bureaucrats fighting over the server, it'll be harder to keep it hushed up."

I made the call from a pay phone, working down Bobby's list of FBI agents' names and home phone numbers. The first two weren't home. The third guy was named Don Sobel, and he answered the call on the first ring. He sounded like he was talking through a mouthful of shredded wheat; in the background, I could hear the Letterman show.

"Mr Sobel," I said "I'm a member of the computer community. I'm calling to tell you that this group, Firewall, which is supposedly attacking the IRS, was invented by the National Security Agency."

"Who is this?" The way he asked, I knew what he was thinking: crank.

"I'm calling several different people," I said, "So if you're interested in keeping your job, you should write down this name. Bloch Technology. B-L-O-C-H. The company has an Internet server in Laurel, Maryland, at the Carter-Byrd Center.

"Just a minute, just a minute, let me get this down," he said

I spelled the name again, and then said, "The server is the source of the Firewall rumors. If you check the client list, you will find that most of the clients are NSA people. You will also find that the first mentions of Firewall all come from this computer, several days before the name went public. The rumors were planted by an NSA contract company called AmMath, of Dallas, Texas. A-M-M-A-T-H. AmMath is also involved in the murder of an NSA official named Terrence Lighter. L-I-G-H-T-E-R. Are you getting this."

"Give me that name again, Lighter."

I spelled it again and then said, "NSA security people are on the way to Bloch Tech right now. There may be nothing left to discover if the FBI isn't there to watch them. You can call an NSA security official named Rosalind Welsh"I spelled her name and gave him her phone number"to ask about the server."

"What about." he began.

"Good-bye," I said. I hung up, and we took off.

"Now," I said. "Somethings got to happen."

What the European hacks were doing to the IRS was simple enoughthe programming could be done by mean little childrenbut their organization showed some good old German general-staff planning. They must have worked for weeks, getting into the computer systems of not only a lot of small colleges, but, as it turned out, into the computers of several big retailers.

Without studying the problem, I would have thought that getting at the retail computers would be almost impossible, without a physical break-in to get at security codes. I was wrong. It appears that several of the big online retailers spent all their security money on protecting credit-card and cash transactions, and making sure that nobody could fool with their inventory and sales records.

But they had other computers that specialized in routine, automatic consumer contactscomputers, for example, that would do nothing but send out standardized e-mails informing the customer that his order had been shipped. For these computers, no great security seemed necessary.

They were perfect for the hacks. They were optimized for sending outgoing mail, and once the hacks were inside them, they could easily be set up to ship the phony IRS returns. At the peak of the attack, the bigger online companies were sending out thousands of phony returns per hour.

That would have been bad enough, but the hacks had taken it a step further: they didn't have the returns sent directly from the retailer to the IRS, but rather bounced them off the customers. When the retailer sent an acknowledgment of a purchase, the IRS file was automatically attached, but would not show up on the customer's computer screen. What would show up was a legitimate receipt or other message, plus a message from the hacks that said, "For auditing purposes, and your shopping protection, please acknowledge receipt of this message by clicking on the 'Acknowledge' button below. Thank you."

Every customer who clicked on the "Acknowledge" button was actually sending a message, but not to the retailer. The message was one of the phony returns, and went to the IRS. When the IRS tried to track the messages, they'd find they came from thousands of individuals all over the country, all of whom denied knowing anything about it.

The attack was continuing the following day when LuEllen and I loaded into the rental car and went for a noon-rush-hour drive on Interstate 10. We picked the Interstate because if we were moving fast, we'd be switching phone cells every few minutes.

"Hate to waste a perfectly good phone," LuEllen grumbled.

"That's why we got it," I said. Using one of the new cold phones, I direct-dialed Welsh at her NSA number. Nobody answered.

"Not there," I said, hanging up.

"What does that mean?"

I thought for a moment, and then said, "I told her I'd call her. But it's Sunday, and maybe she thinks we've only got her home phone. I'll bet she's home, sitting on the phone."

"With a bunch of FBI agents."

"Yeah, well."

I dialed her home phone and she picked up on the fifth ring. On the fourth ring, I said to LuEllen, "Maybe they don't fuckin' care." I was about to hang up, when I heard the phone shuffle, and then her voice.

"Hello?"

"This is Bill Clinton. I spoke to you last night. Did you go to Laurel?"

"Yes, we did. Is this a cell-phone call?"

"Yes."

"Then we will have to be circumspect. We looked at the account you were speaking about, but there wasn't any traffic of the kind you described, between the gentleman here and the gentleman from Dallas."

"There was last night."

"We think that the file in question may have been altered. Did you place an administrative account named B. D. Short on the Laurel installation? For your own uses?"

"No, we didn't."

"Then someone unknown has been burning files."

"I told you who it was."

"We are looking into that," she said. "We want you to stay in touch, though, and we also want to send you a file and have you look at two photographs. Can you take a quick transmission if I switch over?"

"Just a minute." I wasn't ready for that; it seemed uncommonly cooperative. I turned in the car seat, reached over the back, got out the laptop, and turned it up. "I'm just bringing it up," I said.

"I'll have to say, to be honest, that I didn't appreciate your approach last night. You scared me."

"I regret that," I said. I had the line that would go from the modem to the phone wrapped in a bundle, and fumbled it as I tried to pull off the rubber band while still talking on the phone. The bundle dropped between my legs and I had to lean forward to get it. As I did, with my head at a low angle, I noticed a helicopter a mile or so ahead, hovering above a line of buildings. I picked up the bundle of wire, undid the rubber band, and clipped it into the laptop and the phone, and called up my communications program. A moment later, I was ready.

"Switch over anytime," I said.

"It's about a hundred K, so it'll take a minute or two," she said. "If you're ready, here it comes."

I got a tone and hit the enter button on the laptop; a moment later, the download began.

"What's going on?" LuEllen asked.

"They're shipping a couple of pictures they want us to look at," I said.

"An unusual show of cooperation," she said wryly, echoing my own thoughts.

"Yeah, I." And as I started to say it, I looked right out the passenger window. There, a half mile away and running parallel to us, was another helicopter. "Shit!"

"What?" She'd picked up the tone in my voice as I plucked the wire out of the computer and shut down the phone.