Naomi had been exposed to her fair share of pain and suffering in her short career, but she had never experienced that kind of guilt or sorrow, and now, as she thought about what Ryan had endured, she prayed that she never would.
She shook off her morbid thoughts as Kealey crossed the last few feet. He gave her a little nod and said, “Hey.”
“Hi,” she replied, attempting a hesitant smile. “You’re late.”
“Well, I didn’t expect you to have something this fast.” She’d called him at Langley thirty minutes earlier. “I drove straight over.”
“I didn’t think Director Landrieu would let you get past security.”
Kealey scowled at the man’s name. “Is he around?”
“I haven’t seen him.” The smile faltered, and she looked away. “Listen, Ryan, I know you don’t want to talk about it, but I just want to apologize for what I said last night. Harper let me walk in there without any—”
“It’s fine, Naomi.” She looked at his face quickly, but there wasn’t a trace of what she had seen the night before.
“Really, it’s not your fault,” he continued, “and I’m sorry for snapping at you. You couldn’t have known, but let’s just drop it, okay?”
“Okay.” She blew out the breath she’d been holding and turned to business, tapping a few keys on her keyboard. A list of names and dates instantly appeared on her screen. “The contents of Anthony Mason’s hard drive, as requested.”
Kealey was stunned. “How did you do this?” he asked.
“Simple, really. I booted from a standard Windows XP CD and used this to create a new administrator password.” She held up a 3.5-inch disk between her fingers. “The software was developed at Stanford a few years ago. Basically, it takes advantage of an existing loophole by disguising decryption code as a driver. Once installed, it allows the user to bypass the SYSKEY
utility in the SAM.”
Kealey shook his head slowly. “I have no idea what that means.”
“SAM stands for Security Accounts Manager,” she explained. “It’s a database in the registry where user passwords are stored in Windows NT.”
“I thought you said he was running XP.”
Naomi waved her hand dismissively. “XP is just a commercialized version of NT 4.0. But as I was saying, the SAM is fairly difficult to crack because passwords in NT are protected with a hash function. A hash is an algorithm that rewrites data as a series of apparently random numbers and letters. The hash is complicated enough, but you can’t even begin to contend with that until you break through SYSKEY, which encrypts the hash in turn. It’s like a firewall on top of a firewall.”
“Sounds complicated,” was all Kealey could think to say.
“It is,” she agreed, “but that’s not all. Mason also used EFS, which stands for Encrypting File System. It’s notoriously difficult to circumvent because it uses four different keys, both public and private. Fortunately, that’s where he finally slipped up.”
“How?”
She smiled and said, “I’m glad you asked. You see, when you use EFS to encrypt an entire folder, every file created in that folder is automatically protected, but it works differently when you encrypt files individually, which is what Mason did. In that case, EFS creates a plaintext backup before encryption. Once the encrypted file is saved on the disk, the backup is automatically deleted.”
“But if it deletes the backup, how can you—”
“Deleting a file doesn’t necessarily make it disappear, Ryan. They have to be overwritten before they’re wiped off the tape. Older files are overwritten first, so I was able to salvage parts of the recently deleted manifests using a disk-editing tool. It’s not a complete list, mind you, but it’s the best I could do.”
“I’m surprised he didn’t try to erase the whole drive.”
“Why would he?” Naomi asked. “According to what you said last night, it didn’t sound like he expected to survive the raid. In light of what happened, I’m surprised he went as far as he did in protecting his files.”
“I guess you’re right,” Kealey conceded. He leaned over her shoulder and surveyed the screen.
“So what did we get?”
She continued to scroll through the list. “I haven’t had the chance to go through everything yet, but so far, I’ve been focusing on shipments departing the U.S. I haven’t found a client list yet, but see these names here? I think they indicate container ships. On the left side, we have manifests. Unfortunately, Mason’s containers are not specified. The shipments didn’t go out on any regular basis, but they all seem to have found their way to a limited number of destinations.
Only I can’t tell if these are the final destinations or just stopping points. Tarabulus, Banghazi, Tubruq, Port Said East… pretty exotic. Do any of them sound familiar?”
He looked at the names first, but nothing popped out. He agreed with Naomi; they sounded like vessels. Then he turned his attention to the cargo manifests. “What do you think?”
“Well, Tarabulus is a port city in Libya. That’s the only one I recognize.”
“My guess is they’re all ports,” Kealey said, eyeing the screen closely. “But that doesn’t help us.
I already know most of the weapons traveled overland once they came off the boats. Kassem arranged the transportation, but he didn’t do much apart from that. He definitely wasn’t kept in the loop. What we need are arrivals. Lists of shipments that didn’t originate with Mason. I want to know who was supplying him.”
She shot him a quick look. “Ryan, where are you going with this? Nothing connects Kassem and al-Umari, or Kassem and Vanderveen, for that matter, and that’s what we’re supposed to be focusing on.”
Ignoring her question, he gestured toward the consignments on the left side of the screen. “Look at that list, Naomi. That’s a huge and varied quantity of weapons. Now, how many of those have been picked off dead insurgents in the last few months?”
The question caught her off-guard, but she saw his point. “Umm, none?”
“Exactly. None. So where are they going?”
She considered briefly. “They could be building up to something. Trying to take out the prime minister was pretty audacious, but maybe that was just an opening play.”
“It’s possible, but who was behind it? We know Vanderveen was involved in the bombing of the Babylon Hotel, but who’s funding him?”
“Maybe it was a one-off. Al-Umari might have hired him personally.”
“Then why did Rashid make the tape? Why did he sell that refinery? If he only needed Vanderveen to take out al-Maliki, it wouldn’t have taken that kind of money.”
Pointing back to the screen, he said, “It seems like at least some of this stuff would have shown up by now. More to the point, I can’t see the insurgency being patient enough to sit on these kinds of arms for an extended period of time, and some of the shipments go back five months.”
She was a little confused. “Are you saying the insurgency wasn’t responsible?”
He shook his head. “No, there’s definitely a clear link between Mason and Kassem, and Kassem was working with the insurgency. But we do have some contradictory evidence. Look at what you told me last night. The guys that bought the refinery from al-Umari are connected to the Iranian president. I’m still trying to understand how that fits in.”
She nodded. “Me, too.”
“I just don’t see Mason being able to carry this off alone, Naomi. Brokers who move this kind of equipment usually have the protection of at least one major government. They don’t operate out of a warehouse on U.S. soil. I mean, he was definitely the most visible part of the whole operation.”