White-Hot Hack

  “Get Kate back on the road?” Charlie asked. His tone wasn’t unkind, but it held more than a hint of the reserve that showed itself every time they spoke, which told Ian he still resented the implication he had anything to do with Ian’s doxing.

  “Yeah. Her dad and brother are meeting her halfway.”

  “She’ll be fine. North Charleston is the only outage.”

  “For now.”

  Disabling the Eastern Interconnection wouldn’t require bringing down every substation; compromising one out of every three would place a crippling load on those that were still functioning until they too succumbed and fell like dominoes as their systems strained and faltered under the increased weight.

  When the task force figured out what the hacktivists were planning, the FBI had appointed teams who’d been dispatched to assist the utility companies in preparing for an attack. The protocol they put in place specified that if a substation were to fail, its power load would be split between several others so as not to overpower it and start a cascading outage. This had worked exactly the way they’d hoped it would when North Charleston fell, but the task force could not afford a false victory, so they remained vigilant even as they breathed a sigh of relief over clearing their first hurdle.

  “Do we know what they used for the attack?” Ian asked. Most of the prior attempts to attack the power grid were attributed to a specific malware called BlackEnergy.

  “We should know soon. Forensics is working on it now,” Charlie said.

  Fifteen minutes later, Phillip motioned to the task force and they gathered around him in a loose huddle.

  “One of the forensic analysts has identified the malware. It’s not BlackEnergy, although we’re probably all going to wish it was.”

  “What is it?” Ian asked.

  “It’s custom. Something they’ve designed for their own use. They’ve used an open-source programming language that isn’t especially sophisticated as far as technology goes, but it’s working well enough to get the job done.”

  “Why wasn’t the malware uncovered during the scans?” Tom asked.

  “Maybe they hadn’t deployed it yet,” Ian said. “They could have sent phishing e-mails that appeared to be from businesses and organizations the utilities regularly corresponded with. There would be no reason to fear clicking on the link or opening the attachment because they’d probably been sent long before we warned them of the possibility of an attack. Then the infected computers sent the access data to a server, which kept the channel open until they needed it. Now they’re sending the payload with a wiper utility that’s destroying parts of the system’s hard drive and causing the actual loss of power. The malware not only stops certain processes from running, it also erases the stored information. Then a backdoor opens, which gives them all the remote access they need.”

  “That’s why the utility company in North Charleston first reported being unable to access their systems. Now that they’re dark, they’ve got a backdoor, which means they can’t control them at all,” Phillip said.

  “They’re building a botnet,” Charlie said.

  The revelation surprised no one. Ian hated to admit it, but the hacktivists had come up with an ingenious way to link together an aging infrastructure that often seemed connected by paper clips and string.

  “Do you realize how long it would take to make sure enough substations were compromised to allow for a widespread outage?” Tom asked.

  “Months,” Charlie said. “Maybe longer.”

  “That means we wasted our time telling the utilities to patch all their holes,” Brian said.

  “So what city’s next?” Tom asked.

  “My vote is for Columbia. I imagine they’ll keep linking their way north until they reach DC,” Charlie said.

  Phillip asked the agent running the electronic map to mark North Charleston with a pinpoint of red light and the remaining cities between North Charleston and DC in white. It was easy to see the path the attack might take as the string of white lights crawled to the north.

  Half an hour later, the noise level rose and the chatter intensified as an agent announced that approximately 130,000 residents in Columbia, South Carolina, no longer had power.

  “Sometimes it sucks to be right,” Charlie said.

  Everyone in the room looked toward the electronic map on the wall and watched as the light representing Columbia, South Carolina, changed from white to red.

  CHAPTER THIRTY-FOUR

  An hour and a half into her drive, Kate stopped just outside Hagerstown, Maryland, to use the bathroom and fill her gas tank. Ian had sent a brief text.

  Ian: Major outages reported in North Charleston and Columbia. Don’t worry. Just keep driving. Love you.

  Kate: Just stopped for gas. Will get back on the road ASAP. Love you too.

  Fingers of dread worked their way up her spine. Did that mean more cities in South Carolina would follow? Then North Carolina and Virginia? Would the outages nip at her heels until she met up with her dad and brother? What if they traveled faster than she could?

  She pictured what driving in a blackout would be like and was grateful she’d just filled her tank.

  Her brother called as she was placing the nozzle back on the pump.

  “Hey, Chad,” she said as she screwed the gas cap on and got back in the car.

  “Are you listening to the news?”

  “It’s already on the news?” Before she’d pulled into the gas station, she’d been listening to music.

  “You know about it?”

  “Ian sent a text. I’m at a gas station. I thought they’d try to keep it out of the news.”

  “Good luck with that. Pretty hard to ignore an outage that big. It probably didn’t take long for the media to get on it.”

  “Did they say what caused it?”

  “They said the utility companies are working on it, but they didn’t provide any details. It looks like we’ll reach each other in a little under three hours. We’re at three-quarters of a tank, but we’re going to top off as soon as we pass the next gas station. Make sure you do the same in another hundred miles or so.”

  “I will.” She started the car and pulled out of the parking lot. “See you soon.”

  As she drove west on I-70, Kate switched to a news station and listened to an update on the power outage. Chad had been right when he’d said that details were scant. They were probably being withheld so as not to plunge the country into panic mode. If people knew the loss of their power was imminent, would they try to lay in supplies, causing a panicked run on grocery stores, or would they flee, creating a gridlock in an attempt to escape the blackout? She thought of Susan. Phillip had likely taken just as many precautions as Ian, but it still bothered Kate to think Susan would have no one with her if the power in DC and the surrounding areas went out. And who knew how long it would be before Phillip made it home?

  Kate adjusted the cruise control, raising her speed from seventy to seventy-five after deciding a speeding ticket would be a small price to pay for reaching her dad and Chad sooner.

  Forty-five minutes later on US 40 right outside Cumberland, Maryland, the Porsche began to lose speed. At first she thought she’d accidentally tapped the button and disengaged the cruise control, but when she pressed down on the gas, the car continued to slow. When it became apparent she might be stranded in the middle of the highway, she had no choice but to pull to the shoulder. There had to be something wrong with the car because she hadn’t been going fast enough to trigger Ian’s speed alarm, and besides, he had his hands full and likely wouldn’t be able to do anything about it even if he wanted to.

  She tried to start the car, but she couldn’t get the engine to turn over, and her repeated attempts had probably flooded the engine. She’d wait ten minutes and try again, and if the car still wouldn’t start, she would call her dad and Chad and wait for them to come get her.

  A car pulled off the highway, slowed to a crawl, and came to rest right behind her bumpe
r. She could make out the faint glow of lights floating like a halo above the next town a mile or two down the road, but the fairly desolate stretch of road she was on was dark with only a few cars passing by. She heard the slam of a car door and took a few deep breaths. Probably just a concerned motorist making sure she was okay.

  She double-checked that the doors were locked and reached for her phone, her finger hovering over the keypad. If they asked her if she needed assistance, she would tell them she’d already called for a tow truck and refuse any invitation to get out of the car.

  Right before the person came into view, when they were still slightly to the rear of her driver’s side window, her seat belt unclicked and the Spyder’s locks popped up. And when the door opened and the interior light came on, she screamed as Zach Nielsen shoved his hands underneath her and propelled her over the console and into the passenger seat as if she were nothing more than a rag doll.

  CHAPTER THIRTY-FIVE

  For a few seconds, she forgot how breathing worked. Her shallow, panicked inhale failed to inflate her lungs to their full capacity because when she exhaled there didn’t seem to be enough air to blow out.

  Zach typed something into his phone, and the door locks clicked into place again. The engine turned over with ease, and the voice of the news reporter burst forth from the stereo, the volume seeming too loud in the small space. He jabbed at the dial to silence it. The illumination of the dashboard lights allowed Kate to see him better. Gone were the warehouse-worker clothes he’d been wearing when he’d visited the food pantry. Instead he wore a button-down shirt and dark jeans, and his short hair looked freshly trimmed. To anyone else, it might have appeared as if they were going on a date or heading to a gathering with friends. Kate reached toward the floor for her purse, thinking by some miracle she might be able to grab her pepper spray, but Zach blocked her wrist before she could get to it.

  “I don’t know what you’re reaching for in there, but don’t try it again.” He took the purse and set it on the floor of the driver’s side. “I don’t want you to be afraid, Kate. I don’t mean any harm, and I promise this will go smoothly, but only if you cooperate.”

  “Ian will give you whatever you want.” She spoke quietly, trying to keep it together and not give him the satisfaction of hearing the tremble in her voice.

  “Of course he will. I have his wife. Now give me your phone.”

  She pulled it from the front pocket of her jeans, unlocked it, and set it on the console. Arguing or resisting would be futile—if she didn’t hand it over willingly, he’d take it anyway. They sat in awkward silence as he turned off her location devices. Then he put the phone in his pocket, buckled his seat belt, and pulled back onto the highway. She wanted to ask where they were going, but all of the potential responses terrified her, so she said nothing. A beeping sound filled the interior.

  “You need to put your seat belt on,” he said, and she obeyed. “Maybe it’s because of your work at the food pantry, but you strike me as someone who would never ignore a safety rule. I really do admire you for helping all those people back in Minneapolis. It tells me what kind of person you are.”

  Kate’s mind raced as she tried to piece together what had happened. Maybe Ian had been right about Charlie. Maybe he and Zach had been working together, and the reason they’d accessed footage of the garage camera wasn’t to see what cars they drove, but to hack the cars’ networks and set up some kind of remote alarm that would let Zach know which car was in use. It had probably infuriated them when they’d switched out the cars and Rob started accompanying Kate everywhere she went. Charlie had been the one to call and summon Ian back to headquarters, and what better time to apprehend Kate than when he’d be totally immersed in his work with the task force? Ian had probably mentioned that Steve planned to meet Kate halfway between DC and Indiana, otherwise how else would Charlie know Kate would be alone on this very stretch of road? Once Zach hacked into the Porsche’s network, he’d have access to her exact route and all the tools he would need to take control of the car the same way Ian had.

  “So this is how it’s gonna go down,” Zach said. “Like you said, Ian will give me whatever I want, and what I want is money. Your husband has a lot of it, so it only makes sense. When we get to the airport, I’ll use your phone to call him and give him an amount. He’ll wire me the money, and approximately 2.5 seconds after I receive it, it’ll be gone again. If he tries to put me off or delay payment because he wants to set up some kind of bullshit FBI rescue, you’ll get on the plane with me and we’ll fly to another location. I don’t think he’ll like that at all.”

  “You can’t fly,” she said, the words rushing out before she could stop them.

  “Why the hell not?”

  And then Kate knew.

  It wasn’t Charlie after all.

  It wasn’t anyone working for the FBI.

  The airports that relied on the Eastern Interconnection had surely been briefed and were standing by, waiting for the signal to ground all flights whether their airport still had power or not. It was doubtful the general public would know anything about the warning. But if Zach and Charlie were working together, their plan would not include any kind of air travel, at least not in the immediate future.

  “I just meant flights can be delayed.”

  “We’re not flying commercial. The pilot will take off when I tell him to.”

  Kate didn’t know which airport Zach planned to use or what he would do when he discovered the plane couldn’t take off.

  Or what would happen if it could.

  Her elation that Charlie was not involved was short-lived, because no matter how happy it made her to know he had nothing to do with it, she still had a frightening problem to solve.

  “Are you the one who doxed Ian?” Her right hip had caught the edge of the console when he shoved her, and it throbbed.

  “Do you even need to ask? I thought you were brighter than that. I was poking around in a network trying to get past a firewall one night when I encountered another hacker. I wasn’t that surprised actually. We figured the feds were on to us. They’re always hiding behind their aliases, trying to catch us doing something we shouldn’t, and this hacker seemed to know this was someplace he might find one of us.”

  Kate remembered when Ian’s laptop alarm had gone off in the middle of the night and she’d been so worried he’d have to leave.

  “So we’re battling it out, and I got curious and decided that instead of trying to get past the firewall, maybe I should try to determine who this guy is and where he’s located. I figured the information could be valuable. So naturally he’s hidden his IP address, but I’ve got this amazing tool—it’s like a little cell phone tower—that intercepts Wi-Fi signals and shows me their locations. I bought it off a guy at a hacking convention, and let me tell you, it wasn’t cheap but it sure has come in handy. There’s some triangulation involved, which is a giant pain in the ass, and he must have pulled the battery on his phone because I lost him literally seconds after I homed in on his location, which was your street. I still had some work to do, but once you get that far, it’s really just a matter of legwork and patience.”

  Kate remained silent. She would not give him the satisfaction of asking for more information. It didn’t matter though, because he kept on talking.

  “There are places where we store facts about our FBI friends. Screen names, aliases, pictures. That sort of thing. I copied all the images on file and I studied them. Once I relocated to your city, I stationed myself outside the apartment buildings on your street, and I observed the people coming and going. Even though the picture’s pretty old, there was no mistaking the man who walked out the front door of yours one morning. By the end of the week, I knew where he lived, the name of his pretty girlfriend, and her job at the food pantry. But would you believe I still didn’t know his name?”

  Yes, Kate could absolutely believe it.

  “It took me a few weeks to figure it out. I had to be careful
not to draw attention to myself from the other carders, because that was the kind of thing a lot of people would be interested in. Eventually, I learned the picture of him had come from an old MIT yearbook. One of the forum members who went to college with him had heard from a friend of a friend that he’d been forced to work for the FBI after getting busted hacking something big.”

  With the FBI, Kate thought. Not for.

  “That’s when I tracked down that yearbook, found the picture, and learned his name was actually Ian Bradshaw. Not that I can find his real name anywhere online. I mean, the guy has more aliases than anyone I’ve ever known. But after a few more conversations with his college buddy, I discovered Ian Bradshaw had once done some programming for a certain start-up venture. It was all very hush-hush apparently, but where there are contracts and lawyers, there are also records if you’re willing to dig and know where to look. As a former attorney, you probably know all about that. I already wanted to dox him because we knew the feds were starting to close in, and I’m not a big fan of jail. That’s when I realized extortion is a much faster and more efficient way to acquire wealth than stealing credit card numbers, and his lovely girlfriend would make an excellent bargaining chip. My own little distributed denial of service attack. But then Mother Nature had to come along and fuck everything up with a storm, and the message board blew up with all this chatter about an undercover hacker named Ian Merrick whose car had plunged into the Mississippi. When someone posted that yearbook photo and I realized Ian Merrick and Ian Bradshaw were the same person, you cannot even imagine the extent of my rage.”