“The NSA has other hackers you know,” Decker said. “You could always go back to Camp Stuxnet.”
Ivanov blanched. “Gulag Stuxnet, you mean. You wouldn’t.” He stuffed the rest of the candy bar into his cavernous mouth. “Don’t get mad — get Vlad. You see.” He opened his mouth. “All gone, Mat.”
“Mat? Eb tvoju mat’,” cursed Decker in Russian. His accent was flawless.
“What’s Stuxnet?” asked Armstrong.
“A computer worm designed to penetrate and slow down Iran’s nuclear efforts,” said Decker. “Came out of Bush’s Olympic Games program. Took out nearly a fifth of Iran’s centrifuges at Natanz before it somehow escaped.”
“Escaped? You make it sound like a zoo animal,” Armstrong said. “What do you mean escaped?”
“In the old days, CIA introduced faulty parts and such into Iran’s nuclear systems, but that didn’t do much,” said Ivanov. “Then, General Cartwright of StratCom persuaded George W to try a computer worm instead. Remember, this was after the President had been caught overstating Iraq’s WMDs. So, since he’d already cried wolf once with Saddam, Bush turned to cyberwarfare, figuring no one would believe him enough to support traditional attacks on Iran. The plan was to gain access to the Natanz plant’s computer controls and take down the centrifuges they were using to refine uranium. To dissuade the Israelis from carrying out their own preemptive military strike, the Shin Bet was brought into the program. That way the Israelis would know it was working. And, for a while, it sure did.”
“What happened?” asked Armstrong.
“In the summer of 2010, shortly after a new version of the worm had been activated, it escaped,” Ivanov said. “It was designed to stay in the Natanz machines but it spread to some engineer’s laptop when it was hooked up to the centrifuges. Later, when the engineer took his laptop home with him and went online, it jumped to the Net. For some reason, the worm failed to recognize the environment had changed.”
“Bad programming by the Israelis,” Decker said. “That’s what I heard.”
“It wasn’t Unit 8200,” countered Ivanov.
“That’s Israel’s Cyber Warfare group,” Decker explained. “How do you know?”
“Because I know those guys,” Ivanov said in a huff. “I’m telling you, it wasn’t their code.”
“Then it must have been yours.” Decker suddenly remembered that Ivanov was Jewish. Russian, by way of Astoria, Queens.
“Wasn’t ours either.”
“Then who, Vlad? Someone messed up the code. It wasn’t the man on the moon.”
The young Russian shrugged. “I don’t know. We’re still trying to figure that out. Maybe you should look into it.”
“Me!” Decker laughed. “I’m not a programmer, Vlad.”
“You got skills, yo. Go on. Tell Armstrong.”
“Tell him what?”
“About your new algorithm. It runs against server logs. Super elegant. Worked like a charm against Westlake. That’s how he spotted the break-in. It was simply a matter of waiting it out after that. How did you get the idea for it, anyway?”
“The naseeb,” Decker answered.
“The what?”
“It’s a kind of pre-Islamic Arabic verse, a poetic convention. Functions like a Western ‘Once upon a time.’ You know.” He stared at Ivanov, then at Armstrong on screen. “It settles the audience by setting the scene with something familiar, in this case the revisiting of a deserted camp. The Tuareg use it all the time in their poetry.”
“Oh, yeah. That cleared it right up,” Armstrong said.
Decker sighed. “In the Tuareg oral tradition, since nothing’s been fixed, written down, the same poem changes with each recitation, with each poet. Different interpretations and styles. Different details. Different names, even, in some cases. But the themes remain constant. Like the one about revisiting a deserted old camp in the desert. One such poem begins, ‘Is it because of a deserted camp whose traces are erased/That you tarry in a hidden trap of ecstasy, of love,/A place where tears are shed.’ That’s what my program was intended to do. To look for abnormalities in programming themes, algorithms exhibiting cipher characteristics across server log data sets.”
“Chasing pointers,” said Ivanov.
“My brother-in-law owns a Touareg,” Armstrong said, slurping his coffee.
“They’re a people,” said Decker. “Not just a VW SUV. They live in the Sahara.”
“What turned you on to pre-Islamic Arabic verse?” queried Ivanov. “That’s arcane even by my standards. You don’t get out much, do you, Decker?”
Decker laughed. “Not when you only count 3:00 AM raves.” Then, his crooked smile faded. “A suspect attached to the El Aqrab case was a Targui. That’s what they call Tuareg in the singular. Ali Hammel. From Algeria. I was studying his culture.”
“I hate to break up this fascinating ethno-poetical analysis,” said Armstrong. “But isn’t it time yet?” He glanced at his watch. “Now I know why I opted to work in the field instead of hanging out with you analyst types back at headquarters. Arabic poetry. Saharan love themes. Vital to Homeland Security.”
Ivanov leaned into Decker and stage-whispered, “I think Special Agent Armstrong mocking us.” His Russian accent was preposterously thick now. “I know my Engleesk not good but I can taste irony.” He stood up and put his nose to the camera. “He isn’t on yet. It’s only 2:30. He generally doesn’t get started again until 3:00.” Then he pulled back and stared blankly at Decker’s workstation panels, made of some gray washable fabric, at his orderly desk, lined with stack upon stack of tidy reports, color-coded, and finally at Decker himself.
“Speaking of hidden traps of ecstasy and love, how come you don’t have any pictures up in your cube? Everyone else does.” Ivanov fell back on his ball, spun about. “Crandall and Peterson have their wives. Thompson and McCullough, their kids. Keene and Margolis, their girlfriends.” He nodded at the other workstations in the Cryptanalysis Section, or the Crypt, as it was commonly called. “Even Castro has her significant other. But not you.”
“Haven’t found the time,” Decker answered.
“You’ve been assigned to the NCTC for six years.”
“Been busy, I guess.”
Decker was relieved to hear a small ping coming out of his terminal. He glanced at the thermal image of H2O2’s loft. The red dot marking the suspect had moved back to the living room. “He’s online again,” Decker said.
With the Associate Director’s approval, they had kept H2O2 under surveillance for the last seventy-two hours. During that period, he’d spent most of his time holed up in his loft in east Philly. His movements were becoming predictable. He generally woke up quite late, ate breakfast at home, and went online around noon. He surfed news sites and chat rooms, read email, and downloaded porn for the next hour or so before starting his serious hacking around 3:00. The day earlier, he had returned to the Westlake Defense Systems server at 2:53. It had only been for a minute or so, and he hadn’t entered any new code. He’d just lurked about for a while, no doubt checking to ensure things looked normal.
“I still don’t see why we just don’t arrest him,” said Ivanov. “He crack-rooted a top secret facility.”
“You know the procedure,” said Decker. “Stronger case when you catch them online, the connection still open. Otherwise they always claim they were out buying a taco some place at the time. Someone else was using their terminal.”
“I can tell that it’s him.”
“How do you know?”