Cries of the Lost (16 page)

Most of these skills and knowledge had been acquired during a long and involved assignment helping an insurance carrier design identity theft coverage. My job was to work with the underwriters and actuaries to define exposures. I did this by assessing the tactics of the identity thieves themselves. In addition to becoming expert in stealing people’s identities, I spent a lot of time with computer security people who gave me great insight into the vulnerabilities and breach points of even the most robust defense systems.

So even though I didn’t have the chops that came from hours at the keyboard poking and prodding at security walls, I did understand the principles and best practices of your everyday successful hacker.

With these thoughts, I stood at the base of the data fortress that enclosed the
Dirección General de la Policía y de la Guardia Civil,
the governing authority of the Guardia Civil, and peeked in.

The first option was to select English translations, which I summarily rejected. Only the thinnest layer of information would be available in anything but Spanish. I moved through the outer layer quickly, arriving at the first guarded portal. Instead of testing the lock, I used standard commands to open up the hard code.

It was in a programming language I understood reasonably well, and the person who had written it was reasonably artful and efficient. This was good and bad, since a sloppier hand would have left more inefficiencies to exploit.

I settled in for several hours, studying every line of code and learning the rhythm of the program, searching for a way to get through the web-based layer and into the databases that lay behind.

It didn’t happen that day, or that night, but eventually I stumbled over a string of code that delivered an administrative shortcut, and like throwing the switch on a teleporter, I flicked into a new server, a new database and a new reality. Then promptly hit a wall.

Where the layer I’d just pushed through was likely handled by an outsourced service, possibly offshore, the enterprise servers had been built up over years with the heavy hand of security clearly present. It made sense. It’s what you’d find in any corporate database.

But at least I was partially in, and had access to the file structure, some of the directories, and other peripheral information. I could study that, which I did for another four days.

I apologized to Natsumi for disappearing so long into cyberspace, but she would have none of it.

“This is a big city. The Prada alone can take four days to explore. I have no complaints.”

Another way I look at the current state of large-order IT is you have an enterprise system, usually with big data management capabilities, living at the core. I see this as the mother ship, around which swarm dozens, sometimes hundreds, of subsystems that are linked in through a variety of channels. I knew this to be the structural nightmare facing security people, charged with keeping the core impregnable, yet allowing all these motley websites, servers and applications, over which they had little control, to interconnect.

This was my next angle of attack. I started searching for pathways from the data center in Madrid out to the local command posts and their subsidiaries spread out across the country.

I assumed that interoffice communications would be the least secure, given the sadly false expectation that threats mostly come from outside. But not in this case. Somewhere on the IT staff sat a very clever, hard-nosed functionary responsible for internal security who took the job very seriously. I mentally tipped my hat, and shifted over to nodes less likely to fall under his domain.

And that’s where I found the wormhole. Some enterprising tourist bureau in a small town in Valencia had teamed up with the community affairs director of the local Guardia Civil—who was looking to polish up the
comandancia’s
public image—to start a common website. You could go there and not only discover exciting tourist attractions, but also get pointers on safe driving and all the public services your hometown guardias provided.

The site used a content management system that allowed access by both the tourist bureau and the police via identical passwords. The first step was to crack into the tourist bureau’s email server through a simple phishing exercise. That gave me the user name of the site’s webmaster. I used this to ask the CMS to send me a new password. The second the email hit the admin’s mailbox, I copied the new password and deleted the email. I entered the login information and dove into the administrative files.

As hoped for, the CMS had several directories through which I could connect with the operating system on the server that ran the
comandancia’s
management system. I found the screen where I could give myself full administrative privileges, which laid bare every file on the server, including personnel.

Of all the files, this was the one most likely to be linked back to the core system, since a central operation would have to handle the bulk of the administrative requirements.

I was moving fast, driven both from the thrill of the chase and the fear that an alarm was about to go off on the desk of that wily internal security guy in Madrid, who could block me out in an instant, or shut the server down entirely.

Fortunately, that wasn’t going to happen, though I didn’t know that then, my nervous system crackling with a mixture of excitement and dread. Or disappointment, as when I reached a request form to obtain copies of personnel files. I requested the one belonging to Colonel Domingo Angel and was denied access. There was no getting around this one, and I shouldn’t have been surprised. There was likely no more sacrosanct repository than a ranking officer’s personnel file.

But I searched on, now several hours into the exploration, my eyes watering and my wrists and fingers literally cramping up. Natsumi came in the room a few times, bringing in tea and sandwiches and bottled water. If I’d asked her to, she would have pressed wet washcloths to my brow or massaged the kinks out of my shoulders and back. But a light hug was all I asked for and all she dispensed, and I was happy for that.

Then, as often happens, a mundane little function showed itself, at first so innocuous as to be invisible, but then it hit me like a bolt.

It was in a series of search links, along with things like Locate Post, Locate Communications Staff, Locate Regional Dispatch, Locate Animal Control, there was one simple link, Locate Retired Officer.

Two clicks later I had the P.O. Box, telephone number and email address of Colonel Domingo Angel.

“P
ACK YOUR
bag,” I told Natsumi. “We’re going back to France.”

“The Côte d’Azur?”

“Close. Aix-en-Provence. A few hundred miles west of the Cap. Up in the hills.”

“One of the coordinates?” she asked.

“No. Retirement home of Colonel Angel. I think.”

“You cracked it.”

“More or less. I couldn’t get his file, but I have a P.O. Box in Aix, a cell phone number and an email address. It’s a good start.”

“Is there anything you don’t know how to do?”

“You don’t have to know. You just have to find.”

I
DECIDED
to drive there from Madrid. My reasoning was complicated, and not wholly reasonable. After being cooped up for most of the month in that residential hotel room, I longed for fresh air and open spaces—not to be trapped in the confines of shuttle buses, waiting areas and passenger cabins.

And I couldn’t take another gauntlet of security checks, with stern uniformed officials staring down at our passports, then over at us from behind bullet-proof glass; black-shoed sadists wielding electronic wands and shoving us through Orwellian X-ray machines; those tense moments before takeoff when a member of the ground crew comes aboard and whispers to a flight attendant.

Crossing the border by car wasn’t nothing, but it wasn’t the same.

For our car I chose an Opel Insignia, thinking it was a good size, comfortable, yet unassuming. I had no technical basis whatsoever for my assessment, but that was the mood I was in.

After cramming the car full of our luggage and gear, I checked out and we fought our way through the city traffic; and with Natsumi and her smartphone in navigation mode, we were soon soaring across the tawny, windswept plains of Castilla-La Mancha.

“Seems to be an appropriate part of the country to be driving through, given the odds of a successful venture,” I said.

“Huh?”

“Don Quixote.”

“Never read it.”

“Just as well. You’d likely think the guy was an idiot.”

“Do you read books, Arthur? I mean, did you?”

So much of our time together was spent demarcating our lives before and after I was shot, and before she was tossed unwittingly into the world that shooting had created.

“I read everything. Everything that kept my attention past the first page. No bias, no patterns. Fiction, nonfiction, coffee table books, newspapers, technical papers, magazine articles, cereal boxes, instruction manuals, pamphlets from the Jehovah’s Witnesses. I was a professional researcher. Information was my stock in trade—and a lifelong obsession, which explains the profession.”

“Is that still you?” she asked, in the guileless way she often did.

I looked at her so she could see my face when I answered. “It is. I just haven’t had the time to read.”

How could I explain to her that the hurtling, bobsled run of our lives together bore no resemblance to the life I once led? She was a very smart woman. She got it intellectually. But her experience gave her no context for understanding.

“What about you?” I asked. “You haven’t dealt a single hand of blackjack since I hid you out in my apartment in West Hartford. You don’t get the urge?”

“Blackjack was my night job. By day I wrote research papers on Münchausen Syndrome by Proxy for my degree in psychology. That’s when a mother, usually not a father, makes her kid sick so she can get lots of attention from medical professionals. I think I liked the subject because my mother always told everyone I was the perfect picture of health, even when I was hacking up my lungs with the flu.”

“You revere your mother,” I said.

“I do. She had to toughen me up for life, but she would never let anything really bad happen to me.”

“My sister made all the health decisions in my family. From the time she was about eight.”

“Quite a kid,” she said.

“She’s now a cardiologist, as you know. My parents were uneducated, but smart enough to listen to their kids, who were.”

“My real father died before I had a chance to know him. He was working on a high-rise office building and fell off a scaffold. It takes over ten minutes to walk the distance he traveled in just a few seconds. My mother told me he was an honorable man, but nowhere near as fun as Chief Warrant Officer Jimmy Fitzgerald.”

I looked over at her again. She had her head on the headrest and her eyes closed. A small, slim person, barely a hundred pounds soaking wet, she still managed to take up a lot of the cubic footage of whatever space she occupied.

“You miss him,” I said.

“I do. He was a drunk, but a happy drunk. While other drinkers got nasty, he just wanted to give away his money, what little he had. And ya can’t love people any more than Jimmy Fitzgerald loved me and me mum,” she added, in a perfect Irish brogue.