Jack nodded. “It is personal. And that will help me focus on it. It won’t be a distraction to my work.”
Gerry looked him over a few seconds. “That’s all I wanted to hear. Thank you both. Let me know if you need anything at all from me. One call to Dan or Mary Pat or Jay, and I might be able to get you more information or resources.”
—
Hours later, Jack and Gavin were deeply engrossed in the intel sent over from DoJ on their secure laptops. They were seated on opposite sides of a long table in a third-floor conference room, and did little more than read through what was known about each incident and what had been done to date to find out how the information on the victims might have been obtained by bad actors.
Early on they decided to split their evaluation and analysis. Gavin would focus on the work that had been done in the countercyber realm, digging into the investigation to date on possible hacks or unauthorized data access that might involve all the compromised parties.
Jack, on the other hand, focused his attention on all non-cyber-related investigation avenues. Human spies, insider threats, unauthorized sharing of intelligence through friendly liaison relationships the U.S. intel community had with other nations, anything that might have been either accidental or deliberate that could have put these targeted men and women’s names out into the open.
As he read through the incidents again, Jack tried to figure out just what had to be known about each person involved in order to make them a target. He found this the more interesting part of the problem. It seemed to him that someone had worked very hard to tailor the intelligence to the targeting of these specific individuals.
The Scott Hagen incident was the first, and then a CIA NOC officer who had been arrested in Iran after entering the country.
The Iranians had claimed on state-run TV that they had proof the man’s name was Collier and that he had been in the American spy service for eleven years. The CIA had discerned, through sources and methods not shared in the files sent to The Campus, that the Iranians had used a fingerprint reader to determine Stuart Collier worked for the CIA.
This was curious to Ryan. He couldn’t imagine any accidental scenario where a CIA officer’s fingerprint was exposed in a way Iran might get hold of it.
As he and Gavin toiled through the afternoon, Jack sent some queries to analysts in-house, and Gavin reached out to some other personnel in his information technology section.
On Gavin’s side of the equation, he learned the work the NSA had done evaluating the chance that some classified network had been breached was preliminary; they’d been looking into this as a potential intelligence breach for only a few days, but so far they’d found no evidence of new, successful cyberattacks on the U.S. government that could have led to this information getting out.
The two men took a lunch break in the midafternoon. Gavin picked at a salad he’d brought from home, while Jack ate a grilled chicken sandwich ordered in from a nearby deli.
While they ate Jack bounced what he’d learned off the older man. “The U.S. intel community, or at least those members looking into this compromise, seem to think the leak is one person who knew all the people burned by the leak.”
Gavin said, “Highly unlikely.”
Jack was prepared for the pushback. Gavin was a computer guy, so Jack felt sure from the beginning Gavin would assume this was some sort of a computer leak. “Mary Pat says NSA has run a security review on all networks run by the agencies involved and they found nothing amiss. Also, the fact that many different groups seem to be benefiting from the breach leads the government to the belief this isn’t one nation stealing information. The few nations with the potential know-how to break into U.S. networks aren’t the type to share intel across so broad a spectrum. That makes it look, to them anyway, like there is a government mole who is selling off this intel to multiple parties.”
Gavin said, “NSA did a review and found no hints of a breach, so they have effectively eliminated the possibility this has been done via a hack. They’re digging deeper, but their preliminary findings are sending everyone except for a few eggheads at NSA off looking in other directions.” Gavin shook his head. “I still believe this was cyberespionage of some sort. The fact they haven’t detected a data compromise doesn’t mean there wasn’t a data compromise.”
Jack was worried Gavin was too dug in to his theory, but he didn’t press any further. The last thing he needed was to entrench the Campus IT director further to one side of this or another. Good analytical thinking required an open mind, and Jack wasn’t at the stage where he could draw any tight conclusions and close his mind off enough to argue.
—
Four hours of nonstop reading and working later, Jack rubbed his eyes and turned away from his laptop, ready to ask Gavin if he wanted to go out to grab dinner together and then come back and work into the evening. But when Jack looked across the table he found the big man looking right back at Ryan with a grin on his face.
“Umm . . . you okay, Gav?”
Gavin answered the question with little hesitation. “I have a theory.”
“Let’s hear it.”
“E-QIP.”
Jack had no idea what the hell that meant. “What’s e-QIP?”
Gavin’s excitement was obvious in his voice. “It’s the government database that houses all applications for security clearance. The SF-86. Doesn’t matter if you’re Army, DNI, NSA, Department of Commerce, FBI . . . a contractor designing a new dump truck for the Air Force. Anybody who has applied for a security clearance has filled out the SF-86, a super-long questionnaire, one hundred twenty some-odd pages. All that data is housed in one database. If you are telling me a bunch of different government types from across all agencies and military branches have been compromised, I’ll tell you to look right there.”
Jack thought it over. “You are saying to find the commonality, you have to go back to the first thing these compromised parties did to become part of the classified world? To their original application for classified access?”
Gavin nodded. “That’s it. After the initial application for classified access, their subsequent information would have been moved to the issuing authority. The Department of Defense, DoJ, Department of State, or wherever. But the first file created for anyone entering the classified-access realm is all kept at the same place.”
Jack asked, “Okay, who manages e-QIP?”
“The Office of Personnel Management.”
The younger Ryan thought it over for a few seconds. “I like your thought process, Gavin, but you can’t seriously think nobody at NSA or DIA or CIA has come up with and tested this theory yet.”
“Sure, they thought of it, then they checked to see if e-QIP got hacked. When they didn’t find evidence of it, the investigators moved on.”
“But you’re certain they missed something.”
“I’m certain of this. There is no other linkage between those involved, which means, yeah, I’m certain they missed something. It happens.”
“What about the theory that an individual in the government had all this intel on different people, a mole? Just because there are a lot of different agencies and branches represented in this, that doesn’t rule out a mole. Take Chavez, for example. He knows everybody. You could bring him in here right now and he could give the name of a CIA NOC, a SEAL Team assaulter, a Department of Commerce investigator, an Air Force fighter pilot, and twenty-five other men and women with classified access.”
Gavin shook his head. “This is a data breach, I’d bet my reputation on it. This isn’t one guy spilling the beans on his buddies working in government.”
Jack said, “I’m not saying I’m on board with your theory, but let’s say you’re right. What country has the skills to get into the OPM network?”
Gavin really thought this one over for a long time. “It’s not what we’ve seen fro
m the Chinese. The Russian government, either. Those would be the ones who could most easily break into OPM unnoticed, but they aren’t the ones involved in this attack.”
Jack said, “I agree with that. Russia could be passing out tidbits of pilfered intel to Iran. China could be passing out tidbits of pilfered info to the North Koreans. But neither of them are going to be handing targeting intel of a U.S. base in Italy over to ISIS. You could almost think that China might do it to screw with us domestically, but the risk versus reward just isn’t there. They’d have to know the reaction we’d have if we found out this was going on.”
Gavin said, “I’m going to try to narrow down the hunt for the culprit by reverse-engineering the problem. Give me some time to try to understand what it would take to get into the OPM’s e-QIP database. When I figure out how someone got in, I’ll look for the hallmarks of the attack that will give me a better idea of who might be involved. It will give us a smaller subset of villains to look for.”
Jack said, “Okay . . . but that’s your wheelhouse, not mine. What can I do to help?”
Gavin looked back down to his laptop. “I’m gonna be here awhile. You could go find me something to eat. Nothing too heavy . . .”
Jack laughed a little. “Two questions: Who are you, and what have you done with Gavin?”
Gavin Biery just raised his eyes from his computer.
Jack said, “Never mind. One kale salad, coming up.”
“I’m not a vegan, Jack, I’m just trying to cut back a bit. Don’t kill me.”
Jack stood and headed for the door. “You just work. I’ll worry about dinner.”
25
Abu Musa al-Matari had spent the early morning watching the news out of Sicily on the television in the living room of his safe house, a brownstone on North Winchester Avenue in the Lincoln Square neighborhood of Chicago. Algiers and Tripoli sat with him, along with Rahim, the thirty-four-year-old leader of the Chicago cell.
The other cell members were all out in the city, buying items such as flashlights, phones, extra food and water, fertilizer and nails to build improvised explosives, and medical gear. It was busywork for the team, but al-Matari had nothing for them to do.
Although the others in the safe house celebrated the attack in Sicily, chanting “Allahu Akbar” with each new revelation about the death toll or image of the damage, quietly al-Matari was fuming. He knew this was the type of intelligence the Saudi had promised him, and the Saudi spoke nothing of a similar operation going on in Europe in concordance with the American attacks. This was important information for the operatives on the ground here in the U.S., and the Saudi seemed to be playing favorites by handing out intelligence to whomever he had operating in Europe before al-Matari had even been given his first target.
The Yemeni then spent the day trying to reach his contact, the man he knew only as the Saudi. Al-Matari and each of his cell members had loaded the application Silent Phone onto their smartphones, and with this app they could communicate via end-to-end encryption, using either instant messaging or voice calls, and they could also send files to one another.
Al-Matari, however, was the only one in America who had access to the Saudi, in theory anyway. And he’d been trying unsuccessfully to reach his shadowy benefactor all day long.
For some reason the Saudi wasn’t returning al-Matari’s messages or calls. With each passing hour, time where al-Matari learned more and more about the attack in Sicily from the local news while the man who was supposed to send him his attack orders here in America remained nonresponsive, the Yemeni’s anger grew. He knew the Sicilian attack was an Islamic State action—they’d proven it with social media posts of the attackers setting off from Syria—and even from the small bits of information he could glean from the twenty-four-hour news networks he could tell it had all the hallmarks of a targeted act, using specific intelligence on the whereabouts and histories of the victims, exactly as he had been promised.
Finally, at ten p.m. Chicago time, he looked down at his phone and saw he had a new message from the Saudi instructing al-Matari to call. He immediately stepped into his private quarters on the second floor of the safe house and dialed the man’s number. After taking a few seconds for the end-to-end encryption to be established, the Saudi answered.
“I received ten calls and messages from you. I am a busy man. What is it that cannot wait?”
“I see you are busy. Busy in Italy. You should have told me there would be attacks in Europe.”
The Saudi showed no contrition at all. “You have several cells under you, but you are just one part of the international operations of the caliphate. No one promised you full-scope knowledge of all worldwide operations.”
“Listen to you. You aren’t even a member of the Islamic State.”
“Don’t doubt my loyalty, or my resolve, brother.”
Al-Matari didn’t trust this Saudi one bit. He was about to snap back a retort when the man spoke again.
“Anyway, you should be glad the Americans have other places to focus their attention.”
“Well, I am not glad. I am here, my operatives are ready, and each day we wait to begin is a further threat to the security of our operation. You promised me targets!”
“And you shall have them.”
“When?”
The Saudi sighed, then said, “I understand your concern, but I have been very busy with other important affairs. Give me one more day. I will have something for you then.”
Al-Matari was not going to be led around by the nose by this man. “Perhaps I should begin choosing alternative targets.”
The Saudi shouted into the phone now. “One day! Do nothing for one day!”
The Yemeni in the Chicago brownstone replied, “If I don’t hear from you in twenty-four hours, if you don’t have operations for my teams, then I will begin without your intelligence.” Musa al-Matari disconnected the cell, his hands shaking. He wasn’t sure if it was fury at the Saudi or the passion he felt to start his work.
—
More than 7,000 miles away, Sami bin Rashid looked at the dead phone in his hand, then out the window to his office at the Dubai skyline.
“Waa faqri,” he said. Damn it.
It was obvious al-Matari thought the Saudi was holding out on him, but the truth of the matter was that bin Rashid’s contact, the man who had promised to pass him intel on American military and intelligence targets inside America, was holding out on bin Rashid. Yes, he’d passed on the intelligence about Sigonella air base, and a few more European-based targets, and these bin Rashid sent on to ISIS’s Foreign Intelligence Bureau. Most all of their operations against the West had been in Europe, and bin Rashid knew enough about their organization to know that the head of ISIS’s FIB himself was born in France to Tunisian parents and raised in Paris. Clearly from yesterday’s news, active European cells had been called in to execute the Sicilian attack, but Sami bin Rashid had no command and control over this operation at all.
He wasn’t Foreign Intelligence Bureau of ISIS—as al-Matari had said, he wasn’t even ISIS.
What he was, however, was the guy with the money and the intelligence to craft the American operation. Or, at least, that was how he had sold himself.
But up till now he had failed to come through, and the reason bin Rashid did not have the targets was also the reason he was not forthcoming to al-Matari about the delay.
The bastard who did claim to have the real-time targeting intelligence was putting more money on American-based packages. He’d sold the intel on a Navy pilot in Italy, and on other men and women in and around other bases in Europe involved in the attacks on ISIS, but he’d recently doubled his fee for American intelligence inside America, citing his own security. It was a ridiculous claim. The man had spent the past four months promising to Sami bin Rashid to deliver that which he now refused to deliver, and all the while he knew his secur
ity was just as good, or just as lax, as he made it for himself.
Bin Rashid knew this was just a shakedown for more money; the man was an infidel with no god, and this was to be expected. But bin Rashid had worked on the outskirts of the business and intelligence worlds for his whole career, and knew he needed to push back against the greed. He had been in the game long enough to know that acquiescing to a source’s demands often only led to more demands, and he’d argued more than once with the unknown man he knew of solely by his code name, INFORMER. But now time was running out. Al-Matari was a strong-willed man, of this bin Rashid had no doubt. If he didn’t get targets immediately, the man staged in the Chicago safe house would start attacking sites across America, and he and his cells would be lost without maximizing their impact while alive and operational. Bin Rashid knew the only way America would come to the Middle East in massive numbers would be if the President of the United States had his back to the wall with his own military and intel leaders, and this would happen only with a real military and intelligence threat.
Bin Rashid needed targets, and he needed them right now. He’d ask Riyadh for the approval to pay INFORMER what he wanted, and he’d make it clear to the man with all the information that there would be no more negotiations.
—
Four hours later Sami bin Rashid finally had his approval from the intelligence director of Saudi Arabia, the money had been moved into covert Dubai accounts, and bin Rashid was ready to purchase quality intelligence.
Now the Saudi in Dubai held his phone to his ear and waited while a secure connection was established between himself and INFORMER. To his relief, the call was answered quickly.
INFORMER, whoever he was, spoke English with some sort of an accent that bin Rashid did not have the ability to discern. He wondered if the man was Russian, but that was one hundred percent conjecture.
INFORMER said, “Good day, my friend. How may I be of service?”
The Saudi had spoken to INFORMER a few times over the phone, and now, as always, he found the man lighthearted and almost charming, as if everything was calm and going according to plan, no matter the topic at hand.