“And the gray hats?” asked Goines.
“Well, let’s face it,” said Schoeffel. “How much of the world is black or white? An argument can be made that in business, as in politics, most of what happens falls into some kind of gray area. And so a gray-hat hacker falls somewhere between a black hat and a white hat. These hackers don’t necessarily work for their own personal gain or to wreak anarchistic damage, and though technically they may commit crimes, arguably they do so for ethical reasons.”
“‘Ethical’?” echoed Albertson.
“From their perspective, sure. We’ve had gray hats hack their way into government systems, including NORAD and other highly sensitive and supposedly closed systems, in order to raise awareness of possible vulnerabilities. Sometimes they’ll hack into a piece of expensive commercial software, or work their way into something like an online pay service like PayPal and then contact the companies in order to alert them before a black hat can do real damage. Some of them consider themselves watchdogs, or cybervigilantes, or superheroes. And there are a few gray hats who hack into databases in order to act as whistle-blowers for perceived crimes. We saw that with the Panama Papers a few years ago, and with Snowden before that.” Schoeffel paused and assessed the panel, pleased to see that no one’s eyes had glazed over, and that they were all following her. “The simple truth is that there is no such thing as a perfect system. There are always flaws and code errors and bugs. These exist because computer code is written by human beings and perfection of function, while a goal, is probably not attainable. People will always make mistakes. Knowing this, hackers look for those errors and exploit them. The more attractive the target — or the benefits of hacking that target, such as with banks — the more aggressive and determined the attacks are.”
“What can we do to stop it?” asked Albertson.
Schoeffel had to resist the impulse to shrug. She took a sip of water instead and wished there were something stronger in the glass. A tall vodka and tonic with cherries and lime would smooth the edges of her eroded nerves.
“Well, one thing we can do is up the funding for the WhiteHat counterintrusion program being developed by DARPA,” she said.
“That’s one of Major Schellinger’s programs?” mused Goines. “It’s very expensive.”
“It’s a lot less expensive than the alternative,” said Schoeffel. “We need to seriously up our game, because hackers are constantly upping theirs. Think of it as a guerrilla war. The hackers are the mobile resistance and—”
“They’re terrorists,” snapped Albertson, emphasizing his point by slapping his palm down on the table. It was one of his signature gestures, and Schoeffel suspected that he grooved on seeing people flinch. Probably equated a natural reaction to a sudden noise with his listeners reacting to him.
“Okay, sure, then let’s change the metaphor,” said Schoeffel with as much patience as she could shove into her tone. “Hackers are terrorists, which means they’re small, covert, and can blend into ordinary society. They are not an enemy state, and they don’t have a ZIP code. Computers are portable, which means that anywhere a hacker sits — a table at Starbucks, a couch, a seat on the B train — he’s able to turn into his command center. The hackers’ weapons are their computers, Internet access, data, and their own personal skills. When they launch an attack, there is no smoking gun, no explosion to draw the eye. They can sit next to you in a cybercafé, use a portable device to remote-hack your cell phone or the chip in your Visa card and go online to destroy your life. They can use public utilities and free Wi-Fi as tunnels to get into the mainframes owned by big business, banking, credit-card companies, research laboratories, government agencies, and the military. Our current mechanism for countering these attacks is good, but, because of the natural bureaucracy and the size of our government, adaptive change is correspondingly slow. An elephant can defeat a lion in a straight fight, but the lion is faster and more agile and can often inflict damage and escape. When it returns, it targets the young and weak in the elephant’s herd, inflicting a different and perhaps deeper kind of damage.”
“How bad can this get?” asked Goines.
Schoeffel tried not to wince at the naïveté of the question, especially coming from someone on this committee. “We’ve already seen glimpses of how bad it could get. The cyber-terrorist Artemisia Bliss, who called herself Mother Night, created a network of cyberhackers. The Seven Kings organization used computer viruses to compromise the software systems of our entire military. They hacked the GPS on Air Force One and nearly plunged this country into chaos.”
“You’re talking about what?” asked Goines. “A cyberversion of 9/11?”
Schoeffel shook her head very slowly. “No, sir, I am talking about something much, much worse. You see, every time a cyberterrorist does something that draws the eye of the public and gets big media coverage — as with Mother Night, the Seven Kings, and ISIL last year with the attempt to use drones to release smallpox — the fact that they’re stopped isn’t enough. A hacker, a planner, a terrorist, or anyone else gets to look at the nature of the attack, evaluate the successes and defeats, see how the attack was ultimately stopped, and use all of that as a teachable moment. So much can be learned from those cases. So much can be deduced and induced and inferred. It’s no different from generals studying the accounts of previous campaigns when planning a battle. There is as much to learn about why Napoleon lost at Waterloo as there is about how Wellington won.”
There was utter silence in the room.
Schoeffel said, “I am not afraid of a cyber-9/11, ladies and gentlemen. I am afraid of a cyber-apocalypse.”
CHAPTER EIGHTEEN
Before I did anything else, I called Sam Imura at the Warehouse and brought him up to speed.
“I’ll take care of it, Joe,” he said. “But… you’re sure this wasn’t Seif al Din?”
“It’s your town, Sam. Have you had a zombie apocalypse lately?”
“Point taken. I’m just having a hard time processing the thought of a skinny fourteen-year-old girl brutalizing two grown men. Even if she had rabies.”
“Which is why I want our people looking at the tox screens and taking a real damn close look at those nanites.”
“Do you really believe there are nanites in the girl’s blood?”
“Doc Jakobs is old, and he’s a well-known conspiracy theorist,” I said. “He once told me that he believes reptilian aliens are controlling both parties in Congress. So… you tell me.”
Sam snorted. “He may be right about Congress.”
“That’s what I told him. Point is he’s a bit daffy.”
“Does that mean you’re not opening a file on this yet?”
“Nope. It’s weird and nasty, but it doesn’t have DMS painted on the fender. Not until we know for sure that what Doc Jakobs told Sean is accurate. For now, I’m calling it a 70/30 in favor of Doc being too old and crazy.”
“Someone’s bugging your brother’s house, though.”
“Which is why I’m going out there,” I said. “I don’t know that the bugs are part of this case. Sean has worked a lot of homicides tied to organized crime, and he’s done some counter-terrorism task-force stuff, so those bugs could be unconnected to the girl. I don’t want to jump the gun, but no matter what’s happening, this is freaky by Sean’s standards. So until I know for sure that this is anything more than a slightly weirder day on the job for a homicide cop in the big, bad city, I’m not making my visit official.”