“So you’re saying that turning anyone’s phone into a superbug is as easy as fixing a parking ticket?”
“I’ve never fixed a parking ticket,” I said. “I don’t drive. Is it hard to fix a parking ticket?”
Joe drummed his fingers on the table. “Not if you’re rich or well connected. Or so I’m told.”
“Yeah,” I said, “rich or well-connected people could turn any phone into a mobile bug. In theory there’s no reason this is limited to Android phones. It could work by pushing out updates to iTunes, or Firefox, or any app. They’d just need a signing certificate and—” I stopped talking, because I’d just remembered that there hadn’t been anything about the signing certificates in the leak. “And things like that. So theoretically, any computer, any phone, anything that updates itself automatically could be turned into a bug once these things are installed.”
My hands were sweating. Joe and the rest of the office may not know what a “signing certificate” was, but Liam did, and he looked like he was committing every word I uttered to memory. “Uh,” I said. “Also, once your computer is infected with this stuff, it’s possible that people other than the police or whoever bugged you will start to watch what you do.”
Joe put his hand up again. “Explain?” he said.
“Oh, well, here’s how it would work. Say I pay someone to bug your computer. Now your computer has some malicious software on it that can, I don’t know, look out your camera, listen to your mic, watch your keystrokes, snatch files off your hard drive, the whole thing. The bug will have some kind of control software, a program that I run to access your computer. Maybe that program lives on a server somewhere else, in which case anyone who breaks into that server can then break into all the infected computers and phones and stuff. Or maybe it lives on your computer, so if I take over your computer, I can jump from it to all the infected computers. But also, if someone figures out that your computer is running the bug, maybe they can connect directly to your computer—like they could hang around outside your house and crack your WiFi password and wait for your computer to log on, and then snag it, or maybe they don’t know who you are and they just sit at Starbucks all day waiting for anyone with the bug to join the network and then they grab the computer’s controls.”
Flor put up her hand. “How realistic is this? I mean, this all sounds pretty scary, but can you give me an idea of how many computers have been infected this way? In the real world, is this something I need to worry about? Or is it like being struck by lightning?”
I shrugged. “I guess I’m the wrong guy to ask about that. I’ve never used this stuff, never shelled out a hundred grand for one of these boxes. I’m guessing if the police buy them, they must use them. I mean, you could think of this as HIV. Your computer has an immune system, all the passwords and so forth that stop it from being taken over by parasites. Once it’s bugged, it’s got a compromised immune system. So parasites can come in and infect it.” I thought a moment. I was calming down. No, that’s not right, I was just excited now, and not scared, because it was kind of cool that everyone in the office was hanging on my every word. It made me feel important and smart. “Actually, it’s like the network has an immune system, including things like Internet Service Providers who don’t conspire to trick your computer into downloading malicious software. When your ISP’s router tells you a file is coming from Google or Apple or Mozilla, your computer assumes that that’s where the packets are coming from. But once you start monkeying with that, once you create a procedure that tells ISPs to start secretly lying to their customers, well, it seems to me like you can expect that to start happening.”
“So what do we do?”
“Oh,” I said. “Well, for Android, that’s easy. It’s open and free, which means Google has to publish the source code for the operating system. A group of privacy hackers have created an alternate version called ParanoidAndroid that checks a bunch of places every time it gets an update and tries to figure out how trustworthy it is. It used to be really hard to install, but it keeps on getting easier. I’ve made up a little installer script that you can download from the intranet that makes it even simpler. Just plug in your Android phone and run the script and it should just work. Let me know if it doesn’t.”
“But how do we know we can trust your script?” Flor said. “Maybe you’re bugging us all.”
Liam practically leapt to his feet: “Marcus would never do that—”
I had to laugh. “No, she’s right. You’re right, Flor. You’ve got no reason to trust me. I’ve only been here a couple of days. I mean, you guys asked me to work here, so it’s not likely that I’d have planned to take over this place with malicious software, but maybe I’m the kind of guy who goes around doing it all the time.” I thought about it. “So, you could google everything I just told you and download ParanoidAndroid yourself—but maybe I planted all that information there for Google to find. I guess it all depends on how paranoid you’re feeling.”
“I’m feeling moderately paranoid, with a side of prudence and common sense,” Joe announced, getting a laugh. “I’ll install it. Then what do I do?”
“Nothing, unless your phone throws a warning about an update. Then you can google it or ask me, or rely on your own judgment. There’s a paranoia flag for Ubuntu Linux, too, if any of you are running that—it’ll tell you if an update doesn’t match up with the fingerprints on the public servers. Sorry, but I don’t know about anything comparable for Mac or Windows.” I stood with my hands folded again. “Is there any more pizza?”
* * *
Jolu threw a little instant browser chat app up on darknet for us, and started it off with
> ALL RIGHT, WHO SPILLED THE BEANS? FIRST RULE OF DARKNET IS NO ONE TALKS ABOUT DARKNET —Swollen Rabbit
“Swollen Rabbit” was the handle he’d chosen for himself—he’d also put up a nickname generator to help us all choose random, single-use, cool-sounding handles for the system.
I felt like he wasn’t taking this very seriously—all those caps and the jokey tone. We were dealing with a plutonium spill and he was treating it like a minor nuisance.
> This is serious folks. Swollen Rabbit, are you sure it was a leak from one of us and not a break-in? —Nasty Locomotive
> it’s impossible to be sure but yeah. I’ve been over the logs and I don’t see anyone except us. Maybe someone’s got a screenlogger infection or something? —Swollen Rabbit
Oh yeah, of course. Maybe we were bugged. That’d be a weird form of humor: to use a bug to spy on someone who’d found a leak about bugs and then leak the leak to the press using the bug.… It was weird enough that it made me feel dizzy if I thought about it enough. I decided to fall back on Occam’s Razor. The idea that someone blabbed was a lot simpler.
> I know I can trust you and the rest of our crew and Tasty Ducks
—that was Ange—
> but what about all your friends? —Nasty Locomotive
> Wait why should we trust YOUR crew? Who died and made you infallible? —Restless Agent
That was one of the people Jolu had brought in, though I didn’t know anything else about him (or her). Jolu and I had decided it’d be better if we kept everything on a need-to-know basis. I didn’t need to know who Restless Agent was, just that the handle represented someone Jolu trusted utterly.
But Jolu or no, I found myself getting ready to clobber this Restless Agent person. How dare anyone call Darryl and Van and Ange and me into question? Ange, meanwhile, had already read the message on her screen. She was sitting cross-legged on my bed, hair in her eyes, bent over her laptop. As soon as my fingers began to pound angrily on the keyboard, she said, “Woah there, hoss. Calm down.”
“But—” I said.
“I know, I know. Someone is wrong on the Internet. Count to ten. In ternary.”
“But—”
“Do it.”
“One. Two. Ten. Eleven. Twelve. Twenty. Twenty one. Twenty two. One hundred. One oh one. One oh two.”
I stopped. “Wait, I lost count. Is one oh two ten or eleven?” I could count in binary when I was angry, but counting in ternary—base three—took too much concentration. “Fine, you win. I’m calm.”
> You’re right, you can’t. —Tasty Ducks
> You don’t know us and we don’t know you. And we can’t keep this up if someone here is showing off by letting blabby writers into the darknet. So what do we do? Shut it down? —Tasty Ducks
> I could turn on logging and make it visible to everyone. Then we’d know who got to see every document. If a doc leaked we’d have the list of everyone who saw it. If enough docs leaked we’ll be able to narrow down the list and find the one person who saw everything —Swollen Rabbit
> Assuming only one person is blabbing —Nasty Locomotive
> Yeah maybe we’re all running our mouths —Poseidon Snake
That was another of Jolu’s buddies.
> Logging sounds like a good plan. If we can all see what everyone’s done, it’ll keep us all honest —Nasty Locomotive
> Unless I’m the rat in which case I could be editing the logs and you suckers would never know —Swollen Rabbit
> Ell Oh Ell. You’re such a comedian. If you’re the rat we’re all dead meat. Don’t be the rat, dude —Tasty Ducks
“All right, fine, that’s settled for now,” I said. “Thanks for keeping me from turning into Angry Internet Man.”
“Any time. It was kind of weak for you to just say ‘how can we trust your friends’ where everyone could see it.”
I wanted to argue, but it wasn’t really an arguable point. After all, I’d lost my cool when Restless Agent did exactly the same thing.
“Yeah, okay, fine.” I paged up and down through the monster spreadsheet with its 800,000-plus rows. “So what are we going to read through today, anyway?”
“More of the lawful intercept stuff, I guess. There’s hundreds more suggested docs. Since the story’s out there, it’d make sense to find out more.”
“Okay,” I said. “You take suggested docs from the first half, I’ll take the ones from 400,000 onward. My mom says you’re welcome to stay for dinner, by the way.”
“Deal,” she said, and we got to work.
* * *
One thing about the darknet docs I should probably mention: they were mostly unbelievably boring. Rows of numbers. Indecipherable memos written in bureaucratic jargon, laden with acronyms and names of people and agencies I’d never heard of. It was tempting to skip over these and look for juicy ones—or at least ones I could understand—but every so often I’d find something that made some other doc make sense, a piece of the puzzle falling into place, and I’d be glad I’d read it.
For example, there was a list from the San Francisco Unified School Board about schools that had participated in a “laptop anti-theft trial” that had run the year before. It used some kind of phone-home software on all the school-issued laptops that checked in with the school district every day or two. The district used it to track down stolen laptops—getting IP addresses from the software and turning them over to the cops. I noted without much interest that Chavez High was on the list of trial sites, the name standing out immediately, seeing as how I’d carried a backpack with the school’s name through four years of attendance.
But ten or fifteen documents later, I found myself looking at a brochure for a product called LaptopLock, which was the product used in the trials. I wondered why Jolu’s algorithm had tagged this stuff as relevant to the lawful intercept documents—which keywords had made it jump out. It turned out that the matching words were “covert activation” and “webcam.” “Covert activation” was self-explanatory—if you had software that phoned home after a laptop was stolen, you wouldn’t want it to advertise that that was what it was doing. “Attention thief: I am about to tell the police your IP address. Do you want me to continue? [OK] [CANCEL].”
But why would you want to activate the webcam on a stolen laptop? I paged through the brochure. Oh, right, to take pictures of the thief. The software could covertly activate the webcam—turn it on without turning on the little “camera on” light—take a pic and silently send it back to the school board. Well that was creepy. I wondered if any students had ever found a password and login and used that little “feature” to spy on other students. My laptop sat open on my desk all the time—when I was sleeping, when I was getting dressed, when Ange and I were—
Yikes.
So then I went digging for more docs. I had a product name now, something I could use to search on, and hoo-boy were there a lot of hits for LaptopLock in the darknet docs. I did my sort-by-date trick and found myself reading through emails from a worried IT manager at the San Francisco Unified to her boss about the fact that there was a principal who was using LaptopLock’s administrative interface to watch students—not laptop thieves—at all sorts of hours, including early in the morning (when they might be getting dressed) and late at night (when they might be sleeping).
The IT manager had looked at the principal’s shared-drive folder and found thousands of pics of students and their families, sometimes naked, sometimes asleep. There was also audio and video of students and their parents having private conversations. The IT manager’s boss was furious—because the IT manager wasn’t supposed to be “snooping” on school principals. The argument got more and more vicious, as the IT manager pointed out that her snooping was nothing compared to this principal, and ended with the IT manager’s resignation letter. I felt bad for her—she was an honorable geek, and it wasn’t easy to find new jobs in this bad old modern world of ours.
It wasn’t just the San Francisco United School District where a principal got a little power-crazy with the old LaptopLock control panel. It turns out that pretty much every school district had someone (or a few people) in positions of power who felt that spying on students was part of their job. But in the case of the San Francisco Unified School District, that someone was a certain school board member named Fred Benson.
Once upon a time, Fred had been a vice principal at Chavez High, and from that lordly height, he’d presided like a warden or a king, doling out harsh justice against anyone who offended his delicate sense of conservative morality.
Such as, ahem, me.
But old Fred had “retired” when it became clear that San Francisco and California were no longer going to put up with a city occupied by the forces of “law and order”—that is, the torturing, kidnapping, lying paramilitary who’d taken the city hostage in the name of “protecting us from terrorism.” It had been so sad to see him pack up his desk and hit the bricks, just another casualty of the war on the war on terror.
But Fred was a retired athlete, the kind of thrusting, vigorous guy who just can’t take it easy. He’d run for the school board—unopposed, except for a crank candidate who’d been convicted of three counts of felony fraud in a real estate swindle, who nevertheless got nearly half the vote—and had been collecting a tidy public salary and enjoying his ascent to the exalted pinnacle of the education system by bossing around teachers and trying to impose his “leadership style” on the whole school district.
In case you didn’t catch it, I don’t like this guy.
But even I was surprised to discover that old Fred was such a prolific user of the district’s LaptopLock system. After all, he wasn’t responsible for students at all, but look at that, he requested so many specific LaptopLock activations that the district’s IT department had given him his own login, to save on work. Someone in that department wasn’t happy about it, and that person had helpfully logged Fred’s many, many, many uses of the system.
Did I say uses? I mean abuses.
“Come on, we’ve got to leak this,” I said. “I mean, come on, Ange. Seriously? You don’t think I should go public with this?”
“No, Marcus, I think it’s a really stupid idea. You’ve just got through yelling at everyone about a leak. Once you do it, everyone’ll do it. We agreed that we’d catalog the whole
dump, decide on the highest priority stuff, then publish it in a way that kept us all safe. If you get us all busted tomorrow, Masha and Zeb are doomed. Hell, we’re doomed. You don’t have any right to put us all in jeopardy just to settle a score with some vice principal you have a hate-on for.”
“He’s a Peeping Tom! It’s not just a personal vendetta. People have the right to know that this guy is spying on their kids. That could have been me, Ange. I’ve still got friends at Chavez High, kids that Benson hates—you can bet he’s all over them, night and day.”
“You’re just picturing him sitting in his house and rubbing his hands and getting off on all his power and secrecy, admit it. Benson’s not the worst monster in these files. Look at what the others have been up to. Look at 439,412.”
I scrolled to the line, read the summary:
STATE DEPARTMENT BILL OF LADING. FREIGHT FORWARDING FOR LAWFUL INTERCEPT APPLIANCE TO SYRIA. SEE 298,120
And 298,120:
EMBASSY STAFF INTELLIGENCE REPORT ON TORTURE-MURDER OF DISSIDENTS CAUGHT WITH LAWFUL INTERCEPT APPLIANCE
“Oh,” I said.
“Yeah,” she said. “Oh. So cut it out. Maintain discipline. This isn’t kid’s stuff, it’s the big leagues.”
And before I had a chance to get angry with her—really angry, the kind of angry you get when you’ve been totally wrong and someone calls you out and you don’t have any excuse so you get mad instead—my mom called up the stairs, “Marcus, Ange, time for supper!”
* * *
There’d been a time when we’d had “family dinner” practically every night—either something that my mom or dad cooked in a huge frenzy of pots, pans, clatter, and smells, or, if everyone was too tired, something from a delivery restaurant. I’d even been known to cook from time to time, and I liked it, though it took a lot of energy to get started. Facing down the empty kitchen always seemed like a major chore. But I made a mean rack of lamb, and when I cooked pizza, there weren’t ever any leftovers, no matter how much I made.