While I was working on the machine, LuEllen had been going through paper files in the outer office, using her flash. "All bullshit," she said. "Tax forms, bank statements, advertisements."
One of the forms listed Toby Bloch as owner of 100 percent of Bloch Technology stock. "Is that the guy you talked to?" I asked. I crumpled up the blanket and tossed it back on the futon, more or less as it had been.
"That's the guy. Toby."
"All right. Nice little business he has here."
With everything back in place, we listened at the door, heard nothing, and walked out; out to the car, and we were gone. Nothing to it.
But there was trouble back at the ranch. I wouldn't go online with the server until after midnight, when there was less chance that the real system operator was online. Instead, I checked with Bobby, to see if he had anything more on Jack Morrison or Firewall. He did.
look at news programs. firewall attacks irs with dos. big trouble now. attack maybe starts in switzerland. style feels german.
will look. anything on jm?
jm flies to baltimore-washington international on monday before shooting, returns same night. rented hertz, 64 miles. no more detail. also flies to bwi on thursday afternoon back friday morning. no car, no hotel on card.
thanks. will look at news.
this is *very* dangerous.
later.
I thought about that until LuEllen said, "What?"
"Jack Morrison was in town the night Lighter was killed," I said.
"That's not good."
"No. But Lane's lecture about Jack and guns. that's still pretty straight. I still can't see Jack shooting anyone." "What's this about the IRS?"
"I don't know," I said.
"Bobby seems more worried about that than about Jack."
"Jack's dead," I said.
I checked the Times and Washington Post online editions, but they had nothing on the attack on the IRS. CNN had a story, but like a lot of CNN stuff, most of it seemed to have been garbled by a mentally challenged paranoiac; I clicked over to The Wall Street Journal, which had a short item.
A denial-of-service (DoS) computer attack aimed at the internal revenue service has caused a major disruption in the handling of end-of-quarter business tax filings, an IRS spokesman confirmed this afternoon.
The attack, which began this morning, is continuing. The attacking group has identified itself as "firewall."
A denial-of-service attack attempts to flood the target with huge numbers of legitimate-looking transactions, eventually overwhelming the target computer's ability to cope with the numbers.
While official department of justice sources said that the attack is limited, one high-level IRS official, who asked not to be identified, said that there has been a major disruption of end-of-business-quarter tax filings. He said that "tens of thousands" of business quarterly returns were involved and said that the attack seemed to be spreading.
An FBI spokesman said that many of the DOS calls appear to be coming from small-college computer labs.
"What apparently happened is that some individual or group planted small attack programs inside these open computers, and designed them to go off at the same time. We are getting in touch with these schools as we identify them, asking that they go off-line long enough to remove the programs from their computers. Most of them have no idea that their computers are participating in the attack," FBI spokesman Larry Conners said.
Conners said that the attack program is an unsophisticated one, but the IRS official said that it takes advantage of the fact that the IRS computers must be open to the outside to receive legitimate tax returns. The attack involves sending and resending hundreds of legitimate-looking, but slightly flawed returns, which the IRS computers then attempt to return to the sender. As the volume built, the computers were no longer capable of handling the flow of traffic.
"Individually, the attack filings wouldn't be a problem; the problem is that they just keep coming, over and over, from so many different sources," the IRS source said.
The FBI's Conners said that the attack may have started in Switzerland, with the attack programs planted as long as a month ago.
"If the attack isn't sophisticated."
"It's not sophisticated, but a fire ant isn't sophisticated either," I said. "But you get a few thousand of them swarming up your shorts, and you've got a problem. If the feds get really pissed, and start hammering on that list of names, who knows where it'll end?"
"There've been other attacks like this. I read about one in Newsweek."
"Yeah, but there's a huge difference," I said. "Before, they were messing with private businesses. The politicians' public attitude was, well, that's too bad, but the real feeling was, fuck a bunch of private businessesthose guys got too much money anyway. But now, these guys are messing with the politicians' money."
"Ah."
"Yeah. Big 'Ah.' "
The JPEG photo that Bobby sent me was still on my hard drive. I opened it, and took a look. A parking lot, apparently taken from a fairly high angle. Three men in suits were walking across a parking lot full of pickup trucks. All three of them were carrying briefcases, and one had his face turned up toward the camera. The resolution of the JPEG was not high enough to make out the faces. All of the photos, Bobby had said, were the same.
"So who are they?" LuEllen asked.
"I don't know."
"If the picture's important. it must be that the three shouldn't be together. You know, like a gangster and a cop."
"Or a Chinese and an American," I said. "Look at this guy. there's something about him that looks Oriental."
"Shape of his face. unless it's a woman."
"Huh. I don't know." And I didn't.
Late that night I went into Bloch Tech's server. There's so much stuff in a server, even a small one, that there's no real-time, hands-on way to sort through itit's not like flipping through a book. It's like flipping through a library, like trying to make sense of Jack's disks.
I did a search for references to Firewall, and found several hundred in saved e-mail and in postings on Web sites. Six accounts seemed to have a lot of traffic about Firewall. I went into the administrative files, pulled the accounts, and copied out names and addresses. As I finished, I noticed a peculiarity: they were all new accounts, they'd all signed up in the last two weeks, and they'd all paid the up-front minimum of three months by check, rather than opting for credit-card payments.
"Damn it, I'll bet the names are fakes," I told LuEllen. I saved the names. I could ship them to Bobby later, and have him look them up.
Since I had the administrative files up, I checked for Jack Morrison and came up empty; then, on the off-chance, I checked Terrence Lighter, and got a surprise. Lighter had an account on this server, and better yet, his e-mail had dozens of letters. A few were encrypted, so I skipped over those. Most of the rest were letters to and from collectors and dealers in antique scientific instruments, apparently a hobby of his.
And there was one letter that said, unencrypted and in the clear, the Sunday before last:
Mr. Morrison. I will see you tomorrow at my office at 8:30.
Please bring the files with you. Thank you. T.L. Lighter.
CHAPTER 12
At three in the morningmidnight Pacific timeI called Lane. Green answered the phone and said, "We got somebody on us."
"What do you mean?"
"Somebody watching. Not close, but they're around. It's almost like being paranoid, but I've seen one carit's green, and I think it's a Camrya few too many times, and a face looking toward us. Always a couple of blocks away."