Trojan Horse Page 3

  Now he had it. He’d left his office to use the restroom. He’d finished the final draft and decided to take a break before composing the e-mail to Walthrop. He left the office and passed . . . Carlos Estancia, his supervisor. Why didn’t he think of that immediately? It was so obvious. The man didn’t like him. How many times and in how many ways had he shown that? But had Estancia popped into his office during the time Herlicher had been gone and quickly altered the report?

  How long had he been gone? Herlicher considered it and was crestfallen at his conclusion. Five minutes. No more. That was simply not enough time for anyone to make the subtle changes in the report. And on reflection, the extent and quality of the alterations were certainly beyond Estancia’s ability. The man was a moron.

  Suddenly Herlicher collapsed in his chair. Now he remembered. He’d performed a final copy edit, then had sent at once. There had been no delay.

  There’d been no time for anyone to sabotage his report. None. Maybe, maybe, I really am losing my mind.

  4

  LONDON, UK

  WHITEHALL

  FOREIGN AND COMMONWEALTH OFFICE

  RESEARCH GROUP FOR FAR EAST AFFAIRS

  5:33 P.M. GMT

  Lloyd Walthrop was still angry with Herlicher. The man had called and left a voice mail and now had sent by e-mail an explanation Walthrop refused to read. The German was a cretin. Walthrop had always taken him to be a weasel but until now he’d assumed the man would deal with him honestly, at least until it was in his interest not to.

  He’d first met Herlicher the previous year at a Madrid conference on the state of the Iranian economy. It was an area of official mutual concern. At the time he’d seemed a mild-mannered, if a bit paranoid, German bureaucrat. The only thing notable about him was that he worked for UNOG in Geneva. Even that wasn’t especially significant until he’d let drop that his primary duties were with the UN Office for Disarmament Affairs and that he served on the committee tasked with producing any United Nations’ status reports and recommendation on Iran’s nuclear program. That had caught Walthrop’s attention, as he assumed it was meant to.

  Walthrop had been pleased at the contact. Since then, they’d exchanged e-mails and reports but in recent weeks he’d impatiently waited for a new nuclear report. Herlicher had been assigned its actual writing and that struck Walthrop as a coup for himself.

  Though officially assigned to the Foreign Office, the key aspect of Walthrop’s job was to gather intelligence from the various branches of the UK government and to funnel it to those who needed to know. Occasionally he acquired an interesting tidbit from an EU source and when he did, that was so much frosting on the cake. Unofficially, he’d been asked to pay special attention to the imminent UN report on Iran.

  According to his sources, the situation there was coming to a head. More than one national intelligence agency was reporting that detonation of an atomic device in the Iranian desert was forthcoming. There was serious talk of meaningful international action. Iran had flaunted the UN inspectors and sidestepped sanctions for too long. His reading of the current state of the world was much as it had been just prior to Operation Iraqi Freedom and Operation Desert Storm before it: Something was going to happen.

  Some of what Walthrop did was presented officially, though confidentially, but the greater part found its way to the necessary hands through informal back channels. From time to time he was called on to brief leaders in Parliament and the office of the prime minister. It had long been this way in British intelligence. He’d attended the right schools, knew the right sorts, and over the decades had demonstrated his loyalty and judgment. Outside certain circles he was unknown, and he very much preferred it that way.

  He’d wondered at first if Herlicher had known his true position in the UK government but over the following months realized he did not. He’d targeted Walthrop for no other reason than he worked in the Foreign Office. But once Walthrop had indicated an interest in the German’s work, the two had formed the sort of bond that existed between colleagues possessed with mutual needs. The Brit wanted to know what UNOG was going to report before it became common knowledge while the German was looking for a leg up in Brussels. One hand washed the other.

  Walthrop turned back to the foolscap on his desk and reworked his report with a pencil. He knew it was all quaint, very archaic; his assistant chided him about it from time to time, but he simply couldn’t think straight on one of those computers. He detested the things—and he didn’t trust them. After all, the things were now connected, like so many tunnels from house to house, and the so-called firewalls and other security measures built in or installed failed to work with depressing regularity.

  Not that Walthrop wasn’t a man of the twenty-first century. He preferred travel by jet to the alternative and in the last year had developed an appreciation for video conferencing. He couldn’t help wondering about the security of it all but was assured there was no issue and he was careful with what he said.

  Still, all those bits and pieces of electronic data out there somewhere was troubling. Better if important information was set down to paper and locked away with a trusty guard outside. Walthrop didn’t think of this as old-fashioned, rather as just so much common sense, though he had to admit there seemed a dearth of that in recent years.

  One evening he’d expressed, once again, his dislike of computers. His wife had pointed out that his voice was carried by telephone with electronic pulses, that a telly was nothing more than a computer screen—to which he allowed that explained a great deal to his way of thinking. Why his war with the PC? she asked.

  He’d explained it to her again. He knew his protestations sounded silly when uttered but there it was.

  And, of course, there was another issue. What he wouldn’t acknowledge to her was that he didn’t type all that well. He’d only learned at university and had never been very good at it. The computer only made things worse by pointing out an endless stream of mistyped words and questionable use of grammar. He preferred to write his letters and reports out in longhand then transfer them by typing into his computer. It wasn’t perfect, it was very slow, but his wasn’t a fast occupation.

  Whatever his reasons he was never entirely comfortable with computers. More than once when he’d opened an interesting attachment he’d inadvertently downloaded a virus. It had happened often enough for his lack of computer prowess to become a subject in the greater office. In fact, he’d had a bit of trouble with Herlicher’s attachment as he recalled.

  Earlier that day when it arrived he’d glanced at the subject line and felt a wave of satisfaction. At last! He clicked on the attachment, but instead of opening the file he saw the following:

  OfficeWorks has stopped working.

  A problem caused the program to stop working correctly.

  Windows will close the program and notify

  you if a solution is available.

  Below the message was a button that read, “Close program.”

  Now what is this? he’d thought. Why would he want to close the program? And just how did Windows expect to get back to him? This was one of those questions he never got an answer to. And if Windows, whatever that was, could get back to him about this problem that meant Windows, or whoever controlled it, knew what was taking place in his computer. That was exactly what he was talking about.

  OfficeWorks sounded familiar. He considered that a moment then, slightly embarrassed, realized it was the name of the office word processing program his division used. The bright kids from IT had assured him that almost everyone in the world used it. It was the best there was.

  If it was so good, Walthrop thought, why did it stop working?

  He closed his e-mail program. He’d learned that starting it up again usually fixed any problem he ran into. Then he’d gone to Herlicher’s e-mail and double-clicked on the report. This time it opened without a problem. That was more like it.

  He now realized that his response to Herlicher the moment he’d
finished reading the report had been an indulgence. He’d been needlessly harsh and berated himself for it. The man might be a suspicious fool but he had his uses and now he’d cut him off as a source.

  Of course, he’d misled Walthrop badly, and the Brit had made the mistake of confiding his expectations about the results of the pending report to the foreign secretary. Now his professional reputation, or at least his judgment, was at risk. Just the day before Walthrop had received a note reminding him to make available the advance copy of the UNOG report.

  He should never have confided his expectations and with that realization he understood the true object of his anger: himself. He shook his head in wonder. Here he was at fifty-two years of age, and still relearning the lessons he’d thought he’d absorbed decades earlier.

  It was, Walthrop decided, the excitement that had been the cause. He’d been eager from the moment when he realized he was being provided with an advance look at the imminent ODA Iran report. This was one of those tidbits for which he was famous within his circles. He’d let pride govern his actions.

  Not that the UK government ministries gave the United Nations much credence. It had done nothing to stop the spread of nuclear weapons and technology and wasn’t likely to in the future. But when the UN, of all organizations, condemned Iran by stating categorically that it was about to detonate a nuclear bomb he believed that would finally compel military action. At long last, the United States, Britain, and France were prepared to initiate a military strike to prevent a nuclear test and to cripple the Iranian nuclear program.

  As Walthrop understood it, Iran had scheduled detonation of its first atomic bomb for April 26. The essential fuel to make the bomb possible would be processed and ready about ten days earlier. The UNOG report, Herlicher had told him, was due to be released on April 13. That would give the world powers just three days before the enriched uranium was ready, or thirteen days to disrupt the testing site if that was the plan. These were very short timeframes but for such a vital issue they were entirely feasible. Now what had looked like a near certainty was all at risk because the ODA had buckled at the knees. That was the only explanation he could see.

  The thought of Iran with a nuclear bomb scared the daylights out of Walthrop. Ever since the Shah was replaced by fanatical clerics, Iran had been the primary source of financial support to Muslim terrorists the world over. The ongoing conflicts in the Middle East were primarily caused by Iran, which supported both Hamas and Hezbollah. Certainly, Israel did little to help herself but it was Iran constantly tossing petrol on the fire.

  Supporting such terrorist organizations with state income was Iranian policy. As long as the mullahs held control of that vast nation with its enormous oil wealth, worldwide jihad would continue. And there were times when Walthrop was persuaded that he was one of the few in the Foreign Office who truly appreciated the inevitable consequences.

  Once Iranians had the Bomb, Walthrop had no doubt they’d place it in the hands of nut jobs willing to use it. And if his colleagues in the government took any comfort at all from the thought that Iran would stop with bombing Tel Aviv and that the destruction of Israel would bring an end to this madness they were very much mistaken in his view.

  Because Walthrop had not the slightest doubt that the second major city on that list was London itself.

  He just couldn’t believe that the UN was once again going to back away from the self-evident. Last week when he’d encountered Herlicher in the lobby of the UN building in New York, the German had confided that UNOG had received material from a highly placed source in Iran and that the report he was authoring would give a detonation date and recommend immediate action. Then he’d sent this monstrosity to him instead. More of the same endless dribble. What use was the man? What use, for that matter, was the United Nations?

  Walthrop glanced at his e-mail and briefly considered opening Herlicher’s new message. His telephone had rung three times since he’d replied to the report and he’d not picked up, letting it roll over to voice mail. The German had nothing to say he wanted to hear.

  Walthrop sighed. It wasn’t the end of the world—at least, not yet.

  5

  WASHINGTON, D.C.

  GEORGETOWN

  K STREET NW

  3:21 P.M. EST

  Jeff Aiken stared at the computer screen as he eased back in his chair. Outside, a gray rain fell as it had all day, the streets dark and slick. He’d returned from Atlanta the night before, preferring the comfort of his home to another night in a sterile hotel, and had worked remotely, running the final tests of his fix.

  His financial sector client was a household name in the southern states. Malware had been detected by its in-house IT staff during a routine scan of the outbound network traffic from the servers. It had identified bursts of data directed at IP addresses somewhere in Russia. They had been unable to determine the origin of the traffic so Jeff had been summoned.

  He’d spent three days in Atlanta. There he’d made a virtual copy of the server using a tool that took a “live” system and produced an image of it. With his forensic tools he located a rootkit-based virus. Rootkit was an increasingly common and very troublesome technique for cloaking viruses from standard detection. They were increasingly popular with malware writers. It had been their prevalence in the attack code two years before that had made the Al-Qaeda viruses so difficult to identify.

  During his forensic investigation Jeff determined that the virus propagated from system to system employing a vulnerability, ironically in one of the major security suites, another household name, this one worldwide. He established that it was installed in all his client’s systems. The IT department had discovered the hole and patched it pretty quickly but, as was the case for most corporate IT staffs, they’d held off installing the patch to make certain it wouldn’t cause problems on their servers. The uninterrupted performance of the Web site and database was nearly always considered to be most critical. It was during that delay they’d been infected.

  The good news was that the virus was a generic botnet host, not one of the newer, far more sophisticated versions designed to target the company specifically. It was the kind of broad digital aggressor every company encountered from time to time. They’d dodged a bullet because if a virus specifically targeted at them had penetrated their system, it would have caused financial havoc on the company’s customer accounts.

  Once he grasped the nature and extent of the infection Jeff had recommended that they utilize the best-case solution, which was to “repave” their system. This meant reinstalling the operating system and server applications, then restoring all the data from the uninfected backups. The CEO had balked at the downtime this would entail, calculating it would be both disruptive and expensive. Instead, Jeff had been told to cleanse the system.

  Though faster and cheaper, this was the least certain approach. The enormous size and complexity of the system meant there were countless digital holes in which malware might lurk. Jeff could never be certain he’d cleaned everything. But he understood the practicalities of a functioning business; this was not a laboratory situation. And he understood that taking the system down to rebuild it would have created significant issues of trust and reliability with the company’s clients.

  No antivirus signatures had been established for the virus as yet. This was how the usual antivirus programs uncovered malware. As a consequence, Jeff had to do it for himself by defining a series of steps to purge the virus from the system. This malware-cleaning solution then became a script that the company could run on their live server. It would seek out the tentacles of the virus and surgically sever them, deleting its files after the malware had been immobilized.

  He’d alerted his contacts in the antivirus security industry to the new virus and made his fix available once he’d developed it. His connections were extensive and he was widely respected in his field because of his work to advance the state of antivirus research and in creating effective countermeasures.<
br />
  Jeff had run a test of his solution before leaving Atlanta and it checked out. He’d then left the system to the IT staff while he flew home. He’d just spent the day remotely running additional tests, really for his own peace of mind. It all looked good, but as he’d tried to explain, this approach always left bits and pieces of the virus behind like so much clutter scattered across a factory floor or piled in corners. Generally that was no problem, but do it often enough and you slowly contaminated the operating system in subtle ways that adversely effected its efficiency and security. Well, they’d been warned.

  In the quiet of his house he heard a car drive by, its tires splashing as it passed through standing water. Finished, Jeff disconnected from the Atlanta system, then opened his accounting spreadsheet to calculate the bill.

  Daryl was away—again. Since the events of two years before when they’d nearly been killed obtaining the codes needed to partially counter the force of a cyber-attack on the West by Al Qaeda, they’d been a committed couple. She’d resigned as director of US-CERT Security Operations located at Arlington, Virginia, and joined him in his private IT security company, Red Zoya Systems LP. The name was a takeoff on the zero day applications that had made the Al Qaeda attack so frightening.

  Though neither of their names had surfaced in the media after blunting the Al Qaeda attack, within certain circles they were superstars. Word of their exploits, both accurate and wildly exaggerated, had spread throughout the cyber-security industry. The result was more work than they could comfortably manage.

  Their fees continued to pile up in the bank as neither of them had the time to spend their income. They worked out of their Georgetown Redstone town house, though; on any given day one or both of them were out of the city or country on a project. They stayed in touch remotely, but the work tended to be all-consuming. Partly it was their nature, but it was primarily the demands that came with the job. By the time they were summoned the situation was always critical.