Zero Days, page 4
Schoenberg sent his car to the airport, a big black chauffeur-driven Mercedes, which waited while Drayton checked into his hotel and then drove him to the Lake Tegel house. All the German had told him was that he was to head a small team of cyber investigators with a simple mission: to find Cerberus and put it out of business. As the car cut through the late morning Berlin traffic, Drayton looked at his phone, at the notes and news clippings he’d gathered on Schoenberg. It didn’t take long to read; he was embarrassed by how little he really knew about his new employer. An online search had turned up a barebones résumé. A string of top German government jobs. The energy ministry sandwiched between technology and security roles. Drayton had called in a favour from a State Department staffer, now on the Europe desk, who added more, but not much, in an email that read like a stream of consciousness.
‘Hey Chuck. Couple of conversations. Gossip mostly. Seems he was once some sort of liaison for the intel folk. Technology. Cyber. That kinda stuff. Smart, lot of respect. Hard to fathom though. Smooth. Pretty weird ideas on cyber arms control. Like he believes in that stuff. Been pushing it at the EU, UN and a bunch of other acronyms I won’t bore you with. Big no-no here. We’re busy tearing up treaties, not signing new ones. America first. Fucking madhouse. You got out at the right time. Cheers.’
The only personal information Drayton had gathered was four years old: pillow talk mostly, with Schoenberg’s wife, none of it flattering. Mean. Aloof. Obsessive. Secretive. A cold bastard. They were some of the milder descriptions. She was hardly objective, but it put Drayton on guard.
Schoenberg met him at the door of his house with a firm handshake and a smile that was impossible to read. The first thing the German said was, ‘Welcome back to Berlin.’ He placed a hand on Drayton’s back, guiding him as they walked side by side towards the living room. It was a warm sunny day and the room was humid and stuffy, windows flung open to capture an almost non-existent breeze. Mostly it captured flies and the noise of aircrafts. Schoenberg poured wine. A dry white Riesling. A mousey housekeeper served pork schnitzel and salad.
Drayton was determined to clear the air, to start things off on a good footing. ‘About your wife, about Maria, I just want you to know…’
Schoenberg raised a hand. ‘She was my third wife and not the best. You probably did me a favour, though I could have done without the publicity.’ He paused to sip his wine. Slowly, lingering. Drayton wasn’t sure how to respond. It wasn’t the reply he’d expected. He let the silence hang, before Schoenberg said, ‘And how’s your ex-wife? Debbie isn’t it? She didn’t take it well.’
‘Not at all well,’ Drayton replied, trying not to show his surprise at the question. Drayton had struggled to find information about the German; Schoenberg appeared to have had little trouble digging into the American’s past.
Drayton tried to steer the conversation towards Schoenberg, towards what he’d done after the energy ministry, after Maria. But the German swatted away the questions like the flies hovering over the table. A faint grunt and a shrug to tell Drayton it wasn’t something he regarded as interesting or relevant.
‘Prost,’ he said, raising his glass. ‘You took down the Black Viper syndicate. More than 200 hackers in seventeen different countries. The biggest cyber bust of all time. Quite an achievement.’
‘I was proud of that,’ Drayton said, and he meant it. A year-long investigation. Black Viper was the name of malware that could remotely take over a person’s computer, even recording the strokes on the keyboard. It picked off online banking passwords, or just about anything that was personal and sensitive and could be used for extortion. Drayton set a trap, a honey trap he called it, and he lured in the viper, tricking and turning it, until it led him back to the hackers.
‘Agile defence, isn’t that what you call your system?’ Schoenberg asked.
‘I never called it anything. That was the newspapers. It’s not rocket science. More like common sense. There’s a big shortage of that in the tech industry. You have to understand the mentality of the hackers, what drives them. It’s more about psychology than technology.’
‘Yes, an entomology of hackers you called it. I like that. Treating them like insects.’
‘It was an attempt to classify them by motivation. Fun, money, anger, patriotism. That sort of thing. And by who they are. Kids, pros, the hired-guns. And the coders who craft the malware, because that’s how a lot of them see it, like a craft. There are loners, firms who run it like a business, intelligence agencies. And every combination and variation in between. You’ve got to understand them before you can hit back. Sometimes really silly things give them away. We located a cyber espionage ring in China because they were working nine to five and took weekends off. They were predictable. Bureaucrats.’
‘And the Russians, what are they?’
‘The Russians are smarter. Work with criminal syndicates. Keep it deniable. Once you’ve figured out what you are dealing with, once you’ve ticked the boxes, that’s when you can turn the bug around. Treat it like an agent, a secret agent, and make it work for you.’
‘Turn it into a double agent?’
‘Yes, if you like. Feed it plausible stuff at first, win the confidence of its controllers, make them think the bug’s still working for them, until it leads you back to their computers, provides you with their secrets.’
‘Impressive,’ said Schoenberg, refilling their wine glasses.
He pulled a photograph from the inside pocket of his suit jacket and placed it on the table. The thing Drayton noticed first was the purple hair, long on one side, shaven on the other, and the piercing blue eyes, showing little sign of emotion. A stud through her nose, the rings through her lip and eyebrow, sparkling under the light from the camera’s flash.
‘Do you know her?’ Schoenberg asked.
‘Should I?’
‘What does the photograph tell you?’
Drayton picked it up. ‘That she’s confident. Arrogant, maybe. I’d guess she’s good. Plenty of attitude. A rebel. A dangerous combination in a hacker.’
‘She was all of those – and more,’ Schoenberg said, putting the photograph back in his pocket.
‘Who is she?’ Drayton asked.
Schoenberg ignored the question.
‘And of course you were there at the beginning, weren’t you Chuck? The first known attack by Cerberus, at the Mountville Memorial Hospital in Washington DC.’
Drayton froze, a slab of schnitzel hanging in limbo, halfway to his mouth, his mind back in the dingy control room they’d set up at the hospital, from where he’d watched as the bug worked its way into the hospital’s computer system, making relentlessly for its target. Single-minded, avoiding his traps, getting ever closer, until he’d shouted, ‘Shut it down. Shut the fucking thing down.’ But the system would not shut down, the bug had taken control, and by the time Drayton reached the wards, running, yelling, ripping plugs from the walls, fourteen people were dead. And on the crippled computer monitor above them, the jumping lines and flashing lights, the vital signs of life, had been replaced by a single flat line beside the image of the snarling three-headed dog.
‘What happened at the hospital Chuck?’
Drayton struggled to regain his composure. The whole thing was supposed to classified. A CIA operation, and the official explanation for the deaths was contaminated drugs, the doctors blamed.
‘The bug got through. People died,’ was all he said in reply.
‘And that’s why you went off the radar. You blame yourself. Your defences failed. That’s why you hid yourself away?’
‘I wasn’t hiding,’ Drayton replied sharply. ‘I needed time.’
‘Hard to imagine, isn’t it Chuck, that this crime-filled cyberspace was once so full of utopian promise.’
‘Cyberspace doesn’t exist,’ Drayton snapped back. ‘It’s not some abstract force, some magical kingdom, some fucking Narnia. It’s real people at keyboards and screens, doing real things, bad things. You have to understand those people, you have to get inside their heads, go through and tick the boxes, figure out what drives them before you can shut them down.’
‘And what drives Cerberus? Which of your many boxes does it tick?’
Drayton thought for a moment, sipping his wine. Then he said, ‘Sometimes I think it ticks them all. Sometimes none at all.’
*****
Schoenberg’s organisation was called simply the Berlin Group. It was a bland and meaningless name, which was precisely as he liked it. It had been set up under the authority of Interpol, the international police organisation, to coordinate the investigation into what was already being described as a grave threat to the world’s computer systems.
That didn’t make cooperation any easier. The world’s big cyber powers were already riven by mutual suspicion. The German government acted as a sort of honest broker, providing support and an office in Berlin, often known as the city of spies – an irony never lost on Wolfgang Schoenberg. It was his show, and he’d personally chosen Drayton, Milo Müller and Holger Norgaard to be his inner circle, figuring that only a small and tightly focussed team of investigators, working in secrecy, could defeat Cerberus. And that suited Drayton just fine.
They called on outside help when they needed it, tapping into a cast of international police, spies and analysts – which Schoenberg called his outer circle, his itinerants, who came and went as needed. They were drawn from throughout the world, from tiny Estonia, which punched well above its weight in the dark cyber jungle, to the big cyber beasts of US, Russia, China and the UK.
The Berlin Group occupied four rooms on the tenth floor of a new building overlooking the main intersection at the glistening heart of Potsdamer Platz. They were the only occupant of that floor. The building was made of red brick and glass. Lots of glass. The architect had won a city award for ergonomic design, but Norgaard warned that on hot days it was like working in a microwave oven.
The rooms were linked by a meandering corridor. Schoenberg occupied a corner office, though his occupations were brief and cautious. He preferred the privacy of his Lake Tegel home for any conversation of consequence.
In another office, Milo, Norgaard and Drayton had desks and computers, rarely used. Their workspaces of choice were the gloomy corners of trusted bars and cafés. Drayton’s favourite was the Control-Delete Bar, around the corner from the office, so-called because the owner repaired computers when he wasn’t serving beer. His name was Fritz, which was also the name of his dog, an elderly and flatulent Dachshund. With its short, stubby legs and long body, it bore more than a passing resemblance to its owner.
Drayton took an instant liking to his two new colleagues, if not to flatulent Fritz. They had a boyish enthusiasm for computers, and an almost mawkish fascination with the dark cyber world. And he liked their attitude, the eagerness with which they went after hackers.
Norgaard had been the youngest head of the Norwegian Cyber Defence Force before his call to Berlin, and he never missed an opportunity to remind them of that. Not in an arrogant way but in a way that said, ‘I may be the life and soul of the party, but I know what I’m talking about.’
He knew computers the way a neurologist knows a human brain, down to the smallest misfiring neurons, but he also knew how to explain the digital grey matter in something approaching plain English. That was unusual in the computer world, and Drayton admired him for it.
Milo was one of those geeks who had trouble communicating with anything that didn’t have a screen, but he was a master of the sewer that was the dark web, home to criminals, perverts and predators of every possible size and shape. Drayton had him trawling the hacker chat rooms and forums looking for patterns and clues that might help lift the cloak of hacker anonymity and lead them to Cerberus.
In the early days, long beer-fuelled evenings had a habit of lapsing into child-like reminiscing about hackers they’d known and busted. Anna, on the evenings she’d joined them, had quickly grown bored, and Drayton couldn’t blame her for that, especially when they began to recycle the same old exploits and Cerberus remained as elusive as ever.
Norgaard boasted of his operations in Oslo, how they’d busted an international cybercrime outfit which called itself the ‘Lords of Mayhem’. ‘They were selling all kinds of malware. Good stuff. Powerful stuff. We traced their server, but instead of taking it down, we hacked them. Hacked the fucking hackers. Took it over. So all the orders came to us. Not only were we able to bust the hackers, but the big customers too.’
Drayton told them about China, where he’d been assigned after Berlin, how they’d cracked the computers of a cyber spy ring by infecting the online menu of the takeaway place they used. ‘When they clicked on the dumplings to place an order they got a whole lot more than soggy flour and chewy meat.’
‘The dumplings, the fucking dumplings, that is just so neat,’ said Milo, hanging on every word of the other two men, both almost twice his age, as if they were battle-hardened veterans recounting epic tales of war.
‘It’s why I love this job. The buzz when you take down a hacker,’ Norgaard said. ‘What about you, Drayton. What made you take the job?’
For a few moments Drayton said nothing. ‘You’re right. We have to keep the hackers from winning,’ he said, but he lacked conviction. It’s personal. I’m here because of what happened in a grim hospital ward in Washington DC. Because I fucked up and people died. Because I want to sleep at night. Any of those would have been a more honest answer.
The third room was set aside for the itinerants, available to them should they need a place to log in, which mostly they didn’t. Most would never dream of going online via a connection that had not been vetted multiple times.
The fourth space, the biggest, was a conference room. The room was stark, its decoration minimalist. White walls, a large rectangular table at the centre. A coffee machine in one corner. Three large screens hung at one end of the room. The biggest, in the middle, carried a graphic, an attack map, purporting to show live cyber-attacks, data firing around the globe like missiles. It looked like a scene out of Star Wars, and Drayton thought it would make a good addition to Anna’s gallery. It was Schoenberg’s way of injecting some urgency to the meetings that took place below.
Schoenberg had hung a series of photographs alongside the picture windows – the room’s only artwork. An image from the 1920s, when Potsdamer Platz had been Europe’s busiest intersection, location of the world’s first traffic light. Another of the place in ruins at the end of the war. Then as a desolate wasteland, the Berlin Wall running through the middle of it. A kill-zone between east and west, where East German guards took out anybody trying to cross.
Now it had been reincarnated, restored to its former glory – or so the developers said. Drayton watched as flocks of electric scooters, the latest additions to Berlin’s sharing economy, scurried back and forth, doing a pretty good imitation of the East German guards.
The conference room was the busiest of the four rooms, where Schoenberg and his team sat down with the men he called the Cardinals. They came from US, Russia and China and were described officially as ‘liaison,’ a title as bland and meaningless as their official biographies:
Ric Cullen. American. Aged 41. On secondment from the FBI. Career details: cybercrime analyst. Forensic officer. Previous roles: blank.
Igor Strykov. Russian. Aged 53. On secondment from the Russian Foreign Ministry. Career details: Senior analyst, cross-border crime. Previous roles: blank.
Wang Yang. Chinese. Aged 54. On secondment from the Cyber Space Administration of China. Previous roles: blank.
Drayton was introduced to them at the end of his first week in Berlin, when Norgaard whispered in his ear, ‘You’re about to see international cooperation in action. Surly, bad-tempered and paranoid.’
A ransom note carrying the image of Cerberus, the snarling three-headed dog, was displayed on one of the big screens.
‘Broken English. Interesting,’ Cullen said, running a thumb and forefinger through a short goatee beard. He spoke in a sharp, aggressive tone. ‘Our analyses suggest the hacker may be a native Russian speaker.’
Strykov laughed. A cynical, wheezy laugh. ‘Niet, niet, niet. Your analysts are wrong Ric. Hackers use crap English to disguise themselves. It’s hacking 101. A smokescreen. The worse the English, the more likely the hacker is English. Or American.’
Cullen sat back in his chair, which creaked under his large and athletic frame. ‘That’s very helpful Igor,’ he said, his words oozing with scorn, running a hand over his closely cropped hair. ‘Perhaps you can share your analyses. Or those you promised last week. What are your thoughts Mr Wang?’
Wang sat stiffly in his seat, focusing on something beyond the window. He spoke rarely, and when he did it was in a dry, stilted monotone, as if he was making a political speech to the Politburo.
‘My government is committed to full disclosure and the full sharing of data on the criminal enterprise,’ he said. Then stopped without providing either.
They circled each other warily, liking scrapping dogs. Over the weeks it would become a ritual. From time to time one of them would throw a few cyber morsels on the table to try to draw the others out, but always careful not to do or say anything that might reveal their techniques or capabilities.
Schoenberg filled the blanks in their résumés.
‘Strykov’s GRU, Russian military intelligence,’ he told Drayton. ‘for years he ran their cyber operations.’
‘But the GRU runs cybercrime groups. I mean ‘Fancy Bear’. Isn’t that the GRU?’ said Drayton.
‘It is, and they hacked US elections. Elections in Germany and France. The World Doping Agency, banks, journalists. The governments of Georgia, Ukraine, Estonia. Fancy Bear’s got quite a record. Mostly politically motivated.’
