“Yes, Center.”
“You should limit your activities around town, and I will insist your guard is doubled.”
Now Zha asked, “What will we do about the Americans?”
It was clear Center had already given this consideration. “For now? Nothing other than warn Fourteen-K to be on the lookout. This is a critical time in Operation Earth Shadow; we can’t do anything overly”—he searched for the word—“kinetic to this operative without receiving too much scrutiny from the Americans.”
Zha nodded.
“We will wait for now. Later, when there is no longer any reason for us to remain in the shadows, we will leave Hong Kong and we will have our friends here take care of Mr. Adam Yao of the CIA.”
THIRTY-ONE
Jack Ryan, Jr., dropped into the chair in his cubicle at eight-thirty a.m., as he did each workday.
He had fallen into a predictable morning routine. Up at five-fifteen, coffee with Melanie, a jog or a workout, a kiss good-bye, and the fifteen-minute drive to work.
Once in the office, normally he would start his day by picking through overnight traffic sent from the CIA down in Langley up to NSA in Fort Meade. But that had changed since the cyberhijacking of three American drones. Now he spent more time watching traffic flow in the opposite direction. The cybersleuths at NSA were delivering daily updates to CIA about their investigation into the attack.
Jack read the information from NSA each morning, hoping the folks over there would get to the bottom of the affair quickly, but the drone hijackings were not something The Campus was working on officially. No, Jack and the other analysts were still digging into the investigation of the Istanbul Drive, but he read every bit of data he could understand from NSA to see where they were with the investigation.
He’d even had a long conversation with his girlfriend about the events. He’d become something of an expert on keeping his tone light and only semi-interested when he discussed Melanie’s work, although in truth he wanted to pick her brain like the highly skilled intelligence analyst he was. She was working on the matter for Mary Pat Foley, but at this point the computer forensic people at NSA were running lead in the investigation.
There was a new development this morning. Hard evidence, as far as Ryan could tell from the data, that Iran was involved in the UAV attack.
“Damn,” said Ryan as he took notes down on a legal pad for his morning meeting. “Dad is going to have a coronary.” Jack’s father had fought it out with the United Islamic Republic several years ago, kicked Tehran’s ass and assassinated its leader. Even though Iraq and Iran were once again two separate nations, Ryan wasn’t surprised to see that the Iranians were still causing trouble.
Ryan figured his dad would take this news out of NSA and start preparing his retaliation.
Jack spent much of the morning reading NSA-to-CIA traffic, but when he’d finished going through all the new data from Fort Meade he quickly thumbed through CIA internal communication. He did not see much here regarding the UAV matter, but he noticed that one of his data-mining targets had received a flag.
Jack clicked on the program to launch it.
Ryan used data-mining software to hunt through CIA traffic for key terms, and daily he got anywhere from ten to one hundred hits on terms such as “Libya JSO operatives,” “computer hacking,” and “assassination,” and as he waited to see what flagged term had just appeared in CIA traffic, he hoped it was something that would help him get the operational stand-down lifted on The Campus.
When the software launched, he blinked his eyes several times in surprise.
The flagged term was “FastByte22.”
“I’ll be damned,” Jack said. The hacker of the Istanbul Drive had shown up in a CIA cable.
Quickly Ryan read the cable. A CIA nonofficial cover operative named Adam Yao, based in Hong Kong, had found an American computer hacker of Chinese descent named Zha Shu Hai living and working in a Hong Kong neighborhood. Zha, Yao explained, may also be using the computer handle FastByte22 in cyberspace, and he is definitely a fugitive from American justice.
Yao pointed out in his cable that the hacker had been a penetration tester for defense contractor General Atomics, and had been imprisoned for offering to sell secrets about drone hacking and classified network penetration to the Chinese.
Jack said it again: “I’ll be damned.”
Adam Yao suggested that CIA send a team to Hong Kong to follow Zha to learn more about his actions, associations, and affiliations in HK to determine if he may have been involved in the recent computer penetration of the Department of Defense’s secure information network.
Jack Ryan, Jr., had read thousands — no, tens of thousands — of CIA cables in his four years working at Hendley Associates. This particular correspondence seemed to him to be very thin on details about how Yao found Zha, how Yao linked Zha to the name FastByte22, and what sort of activities Zha was now engaged in. This Adam Yao fellow seemed to be offering up just a small piece of the puzzle to Langley.
Langley declined Adam Yao’s request for support in surveillance of Zha Shu Hai.
Jack reached into CIA records to look into this NOC Adam Yao. While they were accessing he looked down at his watch; the morning meeting would be starting in just a few minutes.
Twenty minutes later Jack was on the ninth floor, addressing the rest of the operatives, Gerry Hendley, Sam Granger, and Rick Bell. “NSA says they have a long way to go, but they have found a Trojan on their secure network at Creech Air Force Base in Nevada. One of the lines of code steals the software for flying the drones, and then orders the software to be sent to a server on the Internet.”
Bell said, “If the DoD network isn’t attached to the Internet, then how can the software get exfiltrated to an Internet server?”
Ryan explained, “Anytime somebody uses a remote hard drive, which they have to do to update software or to put new data on the network, the Trojan sneaks pilfered data onto hidden portions of the drive automatically, without the user knowing. Then, when this drive is later plugged into a computer with Internet access, the data immediately is snuck out to a command server controlled by the bad guys. If the malware is any good, then it all happens on the down low.”
Domingo Chavez said, “The old way to defend your position was called ‘the Three G’s.’ Gates, guns, and guys. That method doesn’t slow these guys down a bit.”
Sam Granger asked, “Where was the data sent?”
“The data was sent to a network server, a physical computer, at Qom University of Technology.”
“Qom?” Caruso did not recognize the name.
Ding Chavez blew out a sigh. “Iran.”
“Those sons of bitches,” muttered Sam Driscoll.
Sam Granger said, “Looks like CIA’s suspicions are confirmed.”
Jack said, “That’s not exactly true, Sam. This virus wasn’t controlling the drone; this virus is a Trojan that recorded every bit of the control software and exfiltrated it back out. The Trojan points to a university in Iran, but in order to fly the Reaper they would have had to spoof the signal. They would need a ton of equipment and some expertise, but that doesn’t mean they couldn’t do it.”
“So, was it Iran?”
“I don’t know. The more I think about it, the more I am suspicious. This line of code makes it so obvious, it looks to me like whoever set this whole operation up wants Iran to be implicated.
“I’d like to bring Gavin into the meeting to get his take on it,” Jack said. “This is pretty much all that Gavin Biery thinks about.”
Rick Bell balked. “True though that might be, he is not an analyst.”