Rogue Code (37 page)

“Where did you hear that?”

“A colleague notified me. It’s not important who. I was able to confirm that a warrant has been issued for his arrest so we aren’t dealing in confidences here.”

“I’d still like to know who told you.”

“Let me tell you about Jeff, including information you won’t find in official records, or at least not those you can access. I think when you learn just who he is, you’ll rethink the direction of your inquiry.”

“I’m listening.”

*   *   *

After Alshon disconnected, he was furious. He’d had targets pull weight before. It was inevitable in any significant investigation and all of his were significant. He’d anticipated a call such as this at some point, though, this was a bit early from his experience; but he’d never had one claim his target was innocent on national security grounds before, and he didn’t like it one bit.

Just who did these people think they were? When he’d been with the Bureau, he encountered this from time to time. Someone who’d provided information to another government agency would pull a string and the boss would get a call. Snitches were devious people in his opinion, and those who sold information to the Company, or the Defense Intelligence Agency or any of the alphabet soup agencies involved in national security were weasels. They were only on the side of the angels by accident. They’d learned what they learned by working with the bad guys, by doing bad things. They had no commitment to anything beyond their own survival. Calls like this had never succeeded at the Bureau, at least not in his experience.

This Lifton had told Alshon quite a story. You’d think Aiken was James Bond to hear him tell it. He saved the world at least twice. Well, it wasn’t going to work. Alshon knew bad apples when he found them, and these two were rotten.

But as the workday drew to its exhausting close, as he prepared to go home for a few hours’ sleep, Alshon’s thoughts turned back to what Livingston had told him about Campos. It made sense that Aiken had an inside man. It made no sense to him that this was a Campos operation. No, it was the Company men; of that, he was certain.

56

COMPANHIA CERO

MOOCA DISTRICT

SÃO PAULO, BRAZIL

5:53
P.M.

The warehouses were laid out in the shape of a square-cornered U. The open end through which deliveries and shipments were made faced the rear away from the street. The entry opening was a secured expanse of steel grating topped with spear points and electric wiring. In the middle were large sliding automatic doors controlled from a guard post there. This was the only way in or out. The exterior of the warehouses was a solid wall fifteen feet high, lacking a single window or doorway. This outside wall was also topped with spear points and electrical wiring.

All of this was standard in Brazil. What was new, and unseen, were the motion detectors and sophisticated surveillance cameras Jorge César had installed in anticipation of his two visitors. The warehouse had not been used for some months, and the contained loading area showed the evidence of disuse, dirt blown into corners, bits of paper gathered here and there, the entire expanse looking abandoned. Only the offices of Companhia Cero had remained operational, and César had sent that small staff home as soon as he’d received his orders.

The warehouse had been owned or controlled by Nosso Lugar for more than two decades. It was located in a commercial district, and though there were city efforts to revitalize the Mooca District with some success, they’d not yet extended to this area. When they did, Bandeira would sell the facility for a nice profit. For now, its advantage to the organization lay in its relative isolation as it was surrounded by similar structures and because it lent itself to a wide range of activities. In just the last decade it had been a transfer point for human trafficking, a processing facility for soft drugs, a storage and transfer point for hard drugs, and a weapons cache. Now, with César’s practiced eye at work it had been turned into a killing zone.

The security chief had placed his three best men, Didi, Zico, and Cafu, on the roof to establish triangulated fire. He occupied the office in which he kept on lights after dark. With him was Paulinho, a former special operator with the army. These two gringos, Aiken and Renkin, had no chance.

The plan was simple enough: Ramos in New York had made it possible for the men to know that what they wanted was in São Paulo. He’d sent them a threat in the form of a digital photograph, careful to leave in place the GPS coordinates to this location. He’d told César that these men would discover it, and with the heat on them in the United States it was highly likely they’d take the bait, if for no other reason than to get away.

The
chefe
was confident, and even Ramos said he thought it would work. Still, César thought the likelihood the pair would show up to be quite low. In César’s experience only trained agents of some kind would travel so far with the intention of taking proactive measures. It was far more likely the two would just go to ground. That was the human reaction for most smart men. Those not so smart went home and waited for the police.

It was possible they’d come and if not, he knew whom he’d contact in New York to take care of them. In the meantime, he had his orders. The only hard part of the operation was all the waiting, which was why he’d selected his best men. He had a score who knew how to shoot, only a handful who knew how to wait.

Bored with scanning the security screens on the computer, César stood back from one of the office windows overlooking the loading area so he could not be seen and examined the loading area again. He’d looked at it from outside, both by day and night, to see the impression it formed. At either time it was apparent that the Companhia Cero offices was the only occupied point in the facility. They’d be drawn to it, under the guns of his snipers.

And they would come at night, which was why the lights were on. They’d want to find the offices unoccupied so they could access or steal the computers. That was what they were after. And if it was going to happen, it would be tonight, or the following at the latest, though it was possible they could come anytime in the next week. If they hadn’t arrived by Friday, he planned to inform the
chefe
there was no reason to maintain the operation beyond keeping a single gunman in the office.

Scrutinizing the scene, he was satisfied. He’d had the men damage the security gate to make it consistent with the current condition of the warehouse. There was no guard at the post and it was possible to simply push either of the gates back by hand far enough to slip in. He’d done it himself.

César lit a cigarette and returned to his seat. Paulinho sat in the corner, his IMBEL MD97 resting on his lap. César offered him a smoke, and he shook his head.

Let’s hope it’s tonight, César thought.

57

TRADING PLATFORMS IT SECURITY

WALL STREET

NEW YORK CITY

6:21
P.M.

After seeing Campos, Daryl rode the elevator up a floor and headed directly to the ladies’ room. It was the one secure place for her in the building. In the farthest stall she gathered her thoughts. She had her man, she felt sure. What to do next?

Daryl wondered if she’d aroused his suspicion. She’d pressed the issue with him, and he’d clearly been uncomfortable. But what was he going to do about it if she had? What
could
he do? Call security and have them check her out? Hardly. No, he’d be confused about how to react. Most of all, the man had his own secrets, and the last thing he’d want would be to draw attention to himself, which was what would happen.

She decided to return to the unoccupied cubicle and see if she could uncover incriminating information about this Campos. Perhaps from his e-mail she could find an accomplice within the building, or even better, confirm the link to Brazil and the Companhia Cero office in São Paulo. With that she’d have enough to go to the SEC and this nightmare would be finished.

Back at the computer she tried to backtrack accesses to the jump servers. After copying them off to her laptop, she scanned them visually. The logs were voluminous and recorded tens of thousands of standard connections and attempted connections over the past several days that constituted the usual background noise of a computer network. The logs included regular backup account connections, policy management software, and security scanning software accounts. From the logs, she hoped to identify unusual behavior, then by tracing it to its senders connect Campos and any allies he had to the malware. This would constitute hard evidence the SEC would not be able to ignore and even if it failed to lead immediately to vindication for Jeff and Frank it would begin the process of revealing the truth.

Not spotting anything visually, she ran one of Jeff’s log analysis tools. Given the size of the logs it would take an hour to get results, so she turned to researching Campos by entering his name into DRS to see what she could learn about him. It took twenty minutes for her to eliminate names before identifying the right Campos out of the one hundred or so that matched.

His full name was Marco Enfante Campos. He’d attended university in the United States and worked for New York Life for a time before joining the New York Stock Exchange. He wasn’t on Facebook, LinkedIn, Toptical, Twitter, or any other social network she checked. She was able to locate an address and telephone number for him. She ran a credit check, and he came back above average but not with a top score as he didn’t have enough debt. She could follow up, but it would take more time than she had. And what was the point? She was checking out a cover identity because Marc Campos from Porto, Portugal, was clearly not who he really was.

She turned back to Jeff’s program, which had just finished. He had logged the accesses he and Frank had used so she wouldn’t confuse their activities with those of the rogue code authors. She soon listed the other connections that stood out because of their infrequency or irregularity. It noted several that corresponded to the record of the history Jeff and Frank had given her of the connection times. It also called out several others over the past week that were unusual because they were sporadic and came from a single system, employing the account of the user who managed the server.

It was highly unlikely these were legitimate. Someone had hijacked the account and was using it to upload software in order to conceal his true identity. Daryl worked to trace the trail back to the actual originator by analyzing the logs from the source system, but had no luck. He’d hidden his path well. The only conclusion she reached was that he had to be working within the system, which meant he was on one of these three floors. She considered trying this from Marc Campos’s end, but knew how secure his system would be. He’d probably have installed alerts to notify him when unexpected connections were made to his computer. Instead, she kept at it from the other end, trying different parameters on Jeff’s program that might highlight something it hadn’t caught the first time.

After another hour, she decided it wasn’t going to work, not today at least. Every time someone passed in the hallway she tensed. She knew it was hurting her concentration. But she didn’t want to just walk away with what little she had. She needed more. And she needed a different approach.

Back in the hallway she saw the number of workers was reduced by about half. She wondered when the rest would finally leave. She felt conflicted because she needed bodies for cover, though the more employees there were, the greater the likelihood she’d be discovered.

Daryl took the elevator back to the fifteenth floor. She’d decided on two or three follow-up questions in the event Campos was still working. In addition to his usual work he was managing a major fraud and the clock was running.

She braced herself as she reached his workstation. Empty. She looked about her, then stepped in. His jacket was on a coat hanger. She patted his pockets, found something hard, reached in, and drew out a cell phone. She stepped outside and went directly to her auxiliary office, the last stall of the ladies’ restroom.

If necessary, she was prepared to steal the phone even though that would alert Campos beyond whatever suspicion he already had. She’d rather just copy its data, but it was locked with a PIN. It was running Android, and that was good. Two years earlier, when she’d been working with Jeff, the two had been hired by the U.S. government to discover vulnerabilities in the Android operating system. They’d found several. Eventually, the government had notified Google, and they were fixed, but cell phone companies were in the business of selling phones and services, not updating software, and it was too common for even known vulnerabilities to never be patched. The logic was that the owner would buy another phone before anything bad happened. With luck he’d have a vulnerable one.

She ran her exploit code app on her phone. It listed the Bluetooth devices nearby, the only one of which was Campos’s phone. The very first vulnerability she had found was a bug in the Bluetooth driver. She selected it, and the app successfully exploited the vulnerability, dropping code into the phone, which unlocked it. This gave her access to the phone’s apps, including e-mail, photos, call history, and voice mail. She copied all of these into her laptop. Though the download proceeded quickly, it seemed to take forever. She found herself sweating and drew several deep breaths to calm down.

Finished, she put her laptop away, left the stall, and pressing her lips together, hurried back to the cubicle. No sign of Campos. She returned the cell phone to the same pocket and went directly to the elevator, as excited as she’d ever been. Surely, surely, there was something useful in what she’d taken. There had to be.

58

POUSADA VERDE NOVA

RUA MANUEL DE PAIVA

SÃO PAULO, BRAZIL

9:49
P.M.