Gavin picked up his sandwich. Before taking a bite he said, “So… you know how they did it. Does that help you figure out who did it?”
“Not really. But the target selection does. I’d say this was someone working on behalf of the Islamic State. Why they picked her specifically, I have no idea.”
Gavin shook his head. “But ISIS didn’t steal this OPM data. That’s so far out of their abilities it’s not even a consideration.”
Jack said, “Well, Vadim Rechkov didn’t steal the OPM data, either. But this incident looks like it came from the intel leak Rechkov used. I’m thinking the entity who stole the OPM data and built a targeting package on Scott Hagen did the same thing for Barbara Pineda, only this time he gave his targeting package to ISIS.”
Jack added, “He’s a one-stop shop. He’s got the intel and the means to exploit it.”
Gavin said, “These are two very different skill sets involved. Makes me think this isn’t one guy. It’s a group working in concert.”
Jack considered what Gavin was saying. “You’re right. We’ve been thinking the hack was some government actor. But social engineering of this type, using open-source intelligence to determine patterns, that’s what you see in the criminal sector.”
“What do you mean?” Gavin asked, surprised at the statement.
“Getting passwords, identity theft, stuff like that. Sounds like cybercrime. Not cyberwarfare.”
“Yeah… you’re right. But whoever did this, it wasn’t some teenager calling customer service lines to trick call center employees into giving out passwords. Like I said, this targeting data is top-notch investigatory work.”
“Agreed,” Jack said. “It was someone first-rate. A criminal or a criminal organization able to scoop up this classified intel, and to exploit it. So… where would you go to find the best in the world at that?”
Biery shrugged. “Some places are known for cybercrime. The Russians are great. Central Europeans, too. There’s a group in Taiwan stealing identities all over the world, but they haven’t gone after secure government databases. North Korea pretty much sucks at it, but they try… a lot. Hell, even here in the U.S. there is a robust cybercrime problem. You could find some criminal organization in any one of these places and see the skills to expand the raw intel by social engineering and open-source investigations, but how did they get the data in the first place? And why? Why would a private company do this, when there are banks to hack, credit card records to exploit? Individuals to rip off on a large scale. All the easy money for them.”
Jack said, “What if one of these private companies was doing the bidding of a nation. An enemy of the U.S.”
Gavin nodded quickly. “Yeah, that does happen, but usually on a smaller scale. Some nations’ intel agencies contract with existing criminal hacking concerns, often based outside of their own borders, to do the dirty work. The company tries to penetrate our systems on behalf of their client. China does it all the time. They work with private hackers all over the world to try to raid American government networks. Sometimes they even get something out of it.” He took another bite of his turkey sandwich. “But in this case, since we have different types of targets being compromised, it sure doesn’t look like China is involved. I mean, why would China be involved with the Russian kid? Why the hell would Beijing use him as a proxy assassin against a Navy captain?”
Jack said, “I can’t answer that. But the U.S. government is looking for the state actor. What do you say we start digging into the cybercrime aspect of this? We can research organizations, study the criminal groups who have been particularly successful. Is there something more small-scale we can do to look for fingerprints of the criminals?”
Gavin shrugged. “Like I said, we need to figure out the why to figure out the who.”
“Would the private company sell off the data to the highest bidder?”
Gavin made a face. “Shit. I wouldn’t. That would be suicide. Evil Hacking Company Inc. doesn’t know who it’s working on behalf of, because of all the cutouts between themselves and the state actor, right?”
“Right,” agreed Jack.
“But the state actor is the one who hired Evil Hacking Company Inc., so they know exactly who they are.”
“Of course,” Jack said, then connected the dots Gavin placed. “Which means, if Evil Hacking Company Inc. decided to sell the data it stole on behalf of the Russians, for example, the Russians would be pissed, and they would just fly to Bangalore or Singapore or wherever and start killing off the senior staff of the company.”
Gavin said, “Or tip off the USA about who just stole all their data.”
“Right,” Jack said. “The state actor would have put a lot of time, money, and risk into this op, they aren’t going to let anyone screw them over and survive.”
Gavin deadpanned, “We computer hackers are a stalwart bunch, but we aren’t the types brave enough to go toe-to-toe with Chinese assassins.”
Jack smiled, even though he felt further from a solution that he did before. Suddenly, though, another thought came to him. “What if someone stole data from the ones who stole the data?”
“You lost me.”
“What if… what if the private enterprise who snatched the OPM data for the state actor got ripped off? Another company stole it out from under them, or a pissed-off employee who works for them decides he wants to make money selling off the exploited files.”
Gavin said, “Possible.” He thought for a moment more. “Honestly, you might be onto something. It’s as good a theory as any for why so many different types of bad actors are apparently abusing the same data, which looks to be pilfered on behalf of a government.”
Jack rubbed his eyes. His head hurt from thinking this through. “If somebody did swipe the files, how would they go about selling them off to Iran, Indonesia, a private Russian citizen, ISIS, and whoever the hell else? Could they really reach out individually to just the right person in each government without getting exposed for what they were doing?”
Gavin said, “Sorry, Ryan… can’t help you there. I’m the computer guy. That’s spy shit.” He laughed to himself. “I’m not aware of an eBay for spies.” He laughed at his own humor, but he did not laugh for long.
“Unless.”
Jack cocked his head. “Unless?”
“I mean… If you want to sell something illicit, you do it on the dark web.”
“That’s for like drugs and stuff, right?”
“It’s a safe way to conduct business between two parties without knowing who the other party is. If I were a thief who’d ripped off the criminal enterprise I worked for, screwed over a very dangerous state actor in the process, and wanted to make money by dealing with terrorist groups, organized crime, and other nasty state actors out there… I’m not placing an ad in The Wall Street Journal with my office address. I’m going to the dark web. I can open up my own little marketplace there, trade in Bitcoin with a Bitcoin hopper so that there is no way I can possibly be traced.”
Jack felt a tingle in his spine. He was onto something solid, he knew it. “Awesome, Gavin! Let’s go to the dark web and start hunting for this marketplace! Maybe there will be some clues into who is behind this whole thing.”
Now Gavin gave Jack Ryan, Jr., a disappointed look. Jack had received this look from Gavin Biery many times in his years working at The Campus.