“Why don’t you just use the local copy on your machine?” Wallace asked him.
“Ooh, good trick question!” Peter said. “It’s like I told you. There is only one copy. It’s on the DVD. I am not about ripping you off.” The DVD appeared as an icon on his desktop. He opened it up, and it showed but a single file. He dragged that over to the thumb drive’s icon and waited for a few seconds as the files were transferred. “Now, two copies,” he said. He dismounted the thumb drive and removed it. “Voilà,” he said, holding it up. “The goods. As promised.”
“Not until I agree that it is what you have claimed.”
“Go ahead and check it out!”
“Oh, I’ve looked at the sample you sent. They were all legit credit card numbers, just like you said. Names, expiration dates, and all the rest.”
“So what are you getting at?”
“Provenance.”
“Isn’t that a city in Rhode Island?”
“Since you are an autodidact, Peter, and I have a soft spot for autodidacts, I’ll forgive you for not knowing the word. It means, where did the data come from?”
“What does that matter, if it’s good data?”
Wallace sighed, sipped his club soda, and looked around the feast hall. As if willing forth the energy needed to go on with this stupid conversation. “You are misconstruing this, young man. I’m trying to help you.”
“I wasn’t aware I needed any help.”
“This is proactive help. You understand? Retroactive help — the kind you’re thinking of — is throwing a drunk the life preserver after he’s fallen off the pier. Proactive help is grabbing him by the belt and pulling him to safety before he falls.”
“Why should you even give a shit?”
“Because if you end up needing help, boy, owing to a problem with the provenance of these credit card numbers, then I’m going to need it too.”
Peter spent a while working it out. “You’re not in business for yourself.”
Wallace nodded, managing to look both encouraging and sour at the same time.
“You’re just running the errand — acting as an agent, or something — for whoever it is that’s really buying this.”
Wallace made expressive gestures, like an orchestra conductor, nearly knocking over his club soda.
“If something goes wrong, those people will be pissed off, and you’re afraid of what they’ll do,” Peter continued.
Wallace now went still and silent, which seemed to mean that Peter had at last come to the correct conclusion.
“Who are they?”
“You can’t possibly imagine that I’m really going to tell you their names.”
“Of course not.”
“So why do you even ask, Peter?”
“You’re the one who brought this into the conversation.”
“They are Russians.”
“You mean, like … Russian mafia?” Peter was too fascinated, yet, to be scared.
“‘Russian mafia’ is an idiotic term. An oxymoron. Media crap. It is vastly more complicated than that.”
“Well, but obviously…”
“Obviously,” Wallace agreed, “if they are purchasing stolen credit card numbers from hackers, they are by definition engaging in organized criminal activity.”
The two men sat there silently for a minute while Peter thought about it.
“How these people come to engage in organized criminal activity is quite interesting and complicated. You’d find it fascinating to talk to them, if they had even the faintest interest in talking to you. I can assure you it has nothing in common with the Sicilian mafia.”
“But you just got done threatening me. That sounds like…”
“The cruelty and opportunism of the Russians are greatly overstated,” Wallace said, “but they contain a kernel of truth. You, Peter, have chosen to trade in illegal goods. In doing so, you are stepping outside of the structures of ordinary commerce, with its customer service reps, its mediators, its Angie’s List. If the transaction fails, your customers will not have any of the normal forms of recourse. That’s all I’m saying. So even if you’re a complete shite-for-brains with no regard for the safety of yourself or your girlfriend, I’ll ask you to answer my question as to provenance, because I still have a choice as to whether I’ll proceed with this transaction, and I’ll not go into business with a shite-for-brains.”
“Fine,” Peter said. “I’m working with a network security consultancy. You already know that. We got hired by a clothing store chain to do a pen test.”
“What, their pens weren’t writing?”
“Penetration test. Our job was to find ways of penetrating their corporate networks. We found that one part of their website was vulnerable to a SQL injection attack. By exploiting that, we were able to install a rootkit on one of their servers and then use that as a beachhead on their internal network to — to make a long story short — get root on the servers where they stored customer data and then prove that their credit card data was vulnerable.”
“Sounds complicated.”
“It took fifteen minutes.”
“So these data you’re trying to sell me are already compromised!” Wallace said.
“No.”
“You just told me that the client has been tipped off to the vulnerability!”
“That client has been tipped off. Those numbers were compromised. These numbers are not those numbers.”
“What are they, then?”
“The website I’ve been telling you about was set up by a contractor that subsequently went out of business.”
“No wonder!”
“Exactly. I looked through archived web pages and shareholder disclosures to learn the names of some of the other clients who’d hired the same contractor to set up retail websites during the same period of time.”
Wallace thought about it, then nodded. “Reckoning that it was all cookie-cutter.”
“Yeah. All these sites are clones of each other, more or less, and since the contractor went belly-up, they haven’t been keeping up with security patches.”
“Which is probably why you got hired to do the pen testing in the first place.”
“Exactly. So I did find a lot of cookie-cutter sites that shared the same vulnerabilities, including one big one. A department store chain that you have heard of.”
“And you then repeated the same attack.”
“Yeah.”
“Which is now traceable to that consultancy you work for and its computers.”
“No no no,” Peter said. “I worked with some friends of mine in Eastern Europe; we ran the whole thing through other hosts, we anonymized everything — there is absolutely no way that this could be traced to me.”
“These friends of yours work for free?”
“Of course not, they’re getting part of the money.”
“You trust their discretion?”
“Obviously.”
“That explains why your initial contact with me came through Ukraine.”
“Yes.”
“It’s good to have that loose end tied up,” Wallace said primly. “But the biggest loose end of all is still loose.”
“And that is?”
“Why are you doing this?”
Peter was stuck for an answer.
“Just tell me you’re addicted to cocaine. Being blackmailed by your dominatrix. It’s perfectly all right.”