“Attribution confidence?” Batista asked, curious if it was the same known actors or someone new.
“We’re high confidence on this one. The digital fingerprints are pretty well known by the NSA at this point. We traced the attacks back to PLA Unit 61456, their critical infrastructure warfare group. It stumped us at first, but looking back on similar attacks, we found the codes matched against what we saw in the Colonial Pipeline sequel from last year and the year before. Sloppy if you ask me, but we’ll take it.”
Mara Whitford, the State Department liaison, removed her reading glasses. “That’s good work, Darnell. It sucks that Beijing will deny involvement. They always do.”
Cross shrugged. “Eh, so what? Let ’em deny it. We know it was them and we stopped them.” Cross’s street edge began to show in his tone. “So, if you can believe this, we actually got lucky on this one. We’ve got packet captures, malware signatures, even sloppy OPSEC on their command infrastructure. It would appear one of their operators forgot to sanitize his time zone data. Using that and some other tools, we back-traced the attack to, I kid you not, the Shangri-La Hotel.”
Batista nearly spat his coffee out. “Whoa, wait a second. You guys managed to trace this hacker back to a hotel in Guangzhou?”
Cross nodded. “We did. But without a visual verification to know if it’s legit, we can’t say for certain that it truly originated there and wasn’t a proxy.”
Batista sat back in his chair, absorbing the information. Around the table, his team processed the implications. The PLA hackers had been targeting American port automation processes for years. The automation of America’s transportation and logistics networks had been a game-changing revolution in productivity. Fewer workers, faster throughput, predictive maintenance. Unfortunately, that efficiency now looked like a new vulnerability.
“OK, recommendations. I mean, is it possible we could get eyes on that hotel, maybe see if there’s something to it?” Batista asked, keeping his tone neutral.
Cross straightened as he answered. “We’re coordinating with DHS and with port authorities on immediate patches that should take care of the issue. But, sir, we need a more thorough security review of our automation architecture.”
“OK, meaning?”
“Meaning we built these systems for efficiency, not necessarily resilience.” Cross pulled up architectural diagrams. “Every automated crane, every autonomous truck, every AI scheduler, they’re all potential attack vectors. We need air gaps, manual overrides, offline contingencies in case next time we don’t get so lucky and prevent them from having some fun inside our systems.”
“Huh, yeah, fat chance of that. That’ll cost billions,” Rooke observed.
“I don’t know about that, but it’s cheaper than losing a port for six months,” countered Cross, meeting his gaze. “I mean, ask Baltimore what happened when their terminals went down in twenty-eight. That resulted in seven billion in economic losses.”
Batista turned to Dr. Helena Yuryevna, their disinformation specialist. The former Russian academic studied the attack patterns with unsettling intensity. “Helena? You look like you’ve got something.”
“Da, I am thinking…” Her accent thickened when she concentrated. “These probes, they are not random. Look at the timing.”
She commandeered the display, overlaying attack time stamps with other data streams.
“December twenty-sixth, they probe LA. December twenty-eighth, Houston. January second, Newark. January fourth, Miami.” She paused. “Now look at ship arrivals.”
New data flowed across the screen. Container vessel schedules. Chinese-flagged ships highlighted in amber.
“Every attack coincides with COSCO vessel arrivals. The hackers are using their own ships as collection platforms.” Yuryevna smiled coldly. “Very clever. Park a signals intelligence suite in a container, intercept local wireless traffic during port operations.”
“Good Lord, really?” Cross began scribbling out a message to send after he returned to his computer. “Damn, I need to alert the field offices about this once our meeting’s over.”
“No worries, but do it quiet,” Batista cautioned. “No need to tip our hand yet. Let’s see if maybe we can try and catch ’em in the act.”
As Cross wrote urgently in his notepad, Batista studied the broader picture. The PLA wasn’t just probing defenses, they were mapping vulnerabilities. Building target packages. Preparing.
“All right, people. Good catch on this.” Batista’s tone sharpened. “Darnell, I want you coordinating with Evan at NSC. We need a classified annex on port vulnerabilities added to the next Presidential Daily Brief.”
“Copy that.”
“Rooke, work with CYBERCOM on active defense measures. If the PLA wants to play in our networks, let’s make sure they find some surprises.”
The cyber commander grinned. “I’ve got some ideas. Honeypots that look like ICS vulnerabilities but actually map their attack infrastructure.”
“Do it. Helena, work up some counternarratives. When Beijing denies involvement, I want us ready to expose their operations.”
“With pleasure.” The Russian’s smile could have frozen vodka.
Batista checked his watch. Twenty minutes into the meeting, and already his year looked complicated. “Mara, State’s going to need talking points for our allies. Especially Singapore and Rotterdam. If the PLA’s hitting our ports, theirs are probably next. Oh, and see if we have anyone in Guangzhou who might be able to pay a visit to this hotel to do some recon work for us.”
“Sure, I can look into that for us. I’ll draft something today,” Mara confirmed.
“Good.” Batista surveyed his team once more. “Questions on the port situation?”
Silence. They were professionals. They knew the stakes.
“All right, then.” Batista pulled up the next agenda item.
The displays shifted to some recent high-resolution satellite imagery. The first image it showed was the Trans-Siberian Railway’s main hub located at the Russian-Chinese cities of Zabaikalsk — Manzhouli. This was the predominant route for both passenger and rail freight moving between the two countries. The caption next to the image indicated that sixty percent of all freight moving into Russia from China traversed this line.
The second and third images showed two air bases in Belarus, Balbasava and Baranovichi. Both had undergone extensive modernization and expansion over the past five years. They now had additional parking aprons flanked on either side with overhead protection and drone nets to help protect the autonomous one-way attack drones and loitering munitions. The high-resolution images showed increased air cargo activity, and neatly parked rows of wheeled military vehicles ranging from four- and six-passenger vehicles to larger five-ton transports and fuel trucks.
“OK, people. Let’s talk about the elephants in the room.” Batista’s voice cut through the tension as he began. “First, let’s start with this announcement from Foreign Minister Qiao. Apparently, the PRC plans to refer to President Ching-te as Governor of Taiwan Province.” He paused, letting that sink in. “I’ve directed the Taiwan Study Group to accelerate the timeline for the delivery and operational status of their mission to be ready by the first of April. What I need to know from the rest of you is this: Does the PRC plan to enforce these customs inspections with military force via a civil police action? A Hong Kong 2.0. Is this more saber-rattling, or the start of the next round of trade talks with the Grain Consortium?”
Mara Whitford leaned forward. “Jim, I need to share something first.”