The Loyal Nine (19 page)

Slash followed him out without saying a word. When they reached the ground-level foyer, Sharpie called them over the radio.

“Nomad, this is Sharpie. I have one Middle Eastern-looking gentleman holding two take-out bags walking toward the intersection of Floreal and Voltaire from the south. Hold in position.”

“Copy that,” he said, taking up a hidden position in the foyer with his team.

“He’s turning in your direction,” whispered Sharpie.

“Can you take him out? I need you in the Range Rover, ready to pick us up at the intersection in ten seconds, or we’re going to be running from the police,” said Steven.

“You want me to drop him on the street?” asked Sharpie.

Slash started to protest, but Steven held out a finger, silencing him.

“We’ll toss him in the bushes on the way out. Mission accomplished,” said Steven.

“Don’t you want to know who these people are?” asked Slash.

“Not really,” said Steven. “I’m not being paid to gather intelligence, and neither are you. Drop him, Sharpie.”

After Sharpie reported “target eliminated,” they left the building and crossed the road, heaving the body over a waist-high hedge lining the sidewalk. Sirens wailed in the distance as they drove south on Avenue Frederic-Cesar-de-la-Harpe—toward their marina. Slash spoke up for the first time since they left the apartment building.

“Did anyone check the Semtex for a buried detonator?” he said.

“That was the first thing I did when we staged the gear in the SUV,” said Bugs.

“Guys, I know this one stinks a little, but it doesn’t stink that bad,” said Steven.

“This one reeks, brother. You just wait and see. I don’t know who we iced back there, but they sure as shit weren’t preparing to attack the peace conference. Might have been spying on it, but that’s it,” said Slash. “One way or the other, Control got their shit wrong—or they purposely gave us the wrong shit. Neither scenario works for me.”

Bugs stared at Steven with a neutral face.

“What do you think?” asked Steven.

“I think I might have another look at that Semtex before the boat gets too far in the harbor,” said Bugs.

Chapter 27

February 10, 2016

73 Tremont

Boston, Massachusetts

John Morgan sipped coffee as he glanced at the headlines scrolling across the television monitor in his office. His thoughts were interrupted by an intercom buzz from his assistant, Malcolm Lowe.

“Yes, Malcolm,” said Morgan.

“Sir, Miss O’Shea on the line for you,” replied Lowe.

Morgan pushed the phone’s speaker button without acknowledging Lowe and gruffly took the call.

“Good morning, Miss O’Shea,” said Morgan.

“Good morning, Mr. Morgan,” said Katie. “As requested, I have a synopsis of the Switzerland matter, which I will be providing to DNI Clapper this morning.”

“Go ahead with your summary.”

“Yes, sir,” said Katie. “Sir, the security team assigned to the Lausanne peace talks was notified of a potential ISIS terror cell. Active intelligence suggested this cell was prepared to initiate an attack on the Iranian delegation to the talks on the opening night of negotiations.”

“Continue, Miss O’Shea.”

“Sir, Langley notified the team through their customary channels of the imminent attack and the team responded accordingly. However, there was a problem,” said Katie.

Morgan was stoic. “Get to the point, Miss O’Shea.”

“Mr. Morgan, the information passed on by the CIA was flawed,” said Katie. “They did not encounter an ISIS operation, but rather eliminated a deep-cover Mossad surveillance team and a senior Israeli diplomat.”

Morgan was not surprised by this revelation. The peace talks needed to fail
with
a resulting escalation of hostilities between the participants. The death of the Israeli diplomat was collateral damage but enhanced the effectiveness of the operation.

“What else will your report reveal?” asked Morgan.

“Swiss officials are incredulous, especially with the Israelis,” said Katie. “The entire European Union delegation has condemned the attack but has also sternly objected to the espionage activities of Mossad during a peace conference such as this one. Likewise, the Iranian delegation has rebuked the Mossad operation and returned to Tehran. Tensions have intensified after the Israelis formally accused Tehran of sponsoring the attack. I have just received word that a Sa’ar 5-class corvette has fired upon and destroyed a coastal radar site near Chabahar on the coast of the Gulf of Oman.”

You see, Walter Cabot, this is why you should trust my judgment
. The Sa’ar 5 fleet was built for the Israeli navy by Huntington Ingalls Industries, which Morgan helped Cabot purchase. Morgan would be sure to inform Walter Cabot of this ancillary benefit to the Lausanne operation. War had always been a lucrative business for the United States. Keeping the weapons factories and high-tech plants fully operational not only created jobs but generated valuable exports for the economy. War had little to do with one adversary versus another. War had everything to do with who got the biggest part of the Defense Department’s lucrative pie.

Chapter 28

February 10, 2016

The Hack House

Binney Street

East Cambridge, Massachusetts

Lau orchestrated the systematic and inconspicuous transfer of the Antrim Street Hack House to the Lofts at Kendall Square, a location far better suited to their needs. Situated within convenient walking distance to MIT, the Zero Day Gamers traffic would attract little attention. Besides location, the Lofts had been designed to serve as residences and workspaces. Open floor plans, private balconies and sound-insulated walls were just a few of the key amenities intended to attract engineering and technology professionals. Lau especially appreciated the lack of on-site security. The last thing he needed was a documented log of arrivals and departures. He designated one of the bedrooms as his crash pad and the other as his office. The open spaces had been optimized for the Gamers and their new business venture, which got off to a rocky start.

Lau and company had received numerous offers via HackersList and two other prominent online services—NeighborhoodHacker.com and HackerForHire.com. Most of the requests were mundane privacy intrusions, with fees ranging from a few hundred to several thousand dollars. Lau and his coconspirators had started to lose hope, when an interesting request hit all of the boards at once.

We need a raise.

We need leverage.

We need justice.

We need your help.

Lau stared at the post for hours, trying to decipher its meaning. The words held a particular significance to Lau, because they were his impetus for creating the Zero Day Gamers—
raise, leverage, justice, and help
. After careful consideration and a long meeting with his partners, Lau reached out to the anonymous poster. The specifics of the request required a meeting.
There are criminals, and then there are criminals
. The ethical implications of their new business had to be discussed.

He leaned across the kitchen island, one of the few horizontal surfaces not occupied by electronics equipment, and nodded at his trusted associates.

“We have a serious offer on the table—mid six figures most likely,” said Lau. “But the offer brings up an issue we haven’t discussed.”

Lau had their attention. Malvalaha, a Red Bull addict, cracked another can and perked up in his chair.

“We’ve been contacted by the Culinary Union in Las Vegas,” said Lau. “The CU Local 226 represents nearly sixty thousand casino and hotel workers in Vegas. They also have very strong political ties. For our purposes, they have extremely deep pockets, and I get the sense they will spare no expense to maintain their power over the industries they serve.”

“Why don’t they just call on their politician friends?” asked Fakhri. “Lining pockets is their job.”

“True, but in some states, their influence has been significantly diminished. Think Scott Walker in Wisconsin and Brian Sandoval in Nevada,” said Lau.

“What do they propose?” asked Malvalaha.

“Contract negotiations with the major casinos of Las Vegas are at a standstill,” said Lau. “Rank-and-file members are living paycheck to paycheck, so they don’t have the stomach for a prolonged strike. The casinos, bolstered by Governor Sandoval, have refused to come to the table. They need our help to gain some leverage over the negotiations, but first they want to send a message,” said Lau.

“How big of a message?” asked Fakhri.

“They want us to shut down the casinos,” replied Lau.

“Shutting down a casino won’t be a problem,” said Malvalaha.

Lau interlocked his fingers and cracked his knuckles before responding.

“They want us to shut them
all
down.”

Chapter 29

February 12, 2016

The Hack House

Binney Street

East Cambridge, Massachusetts

Lau was deep in thought driving down Cambridge Street. The Zero Day Gamers’ first deadline rapidly approached, and they hadn’t identified a foolproof way to achieve the Culinary Union’s desired result—a coordinated takedown of the Las Vegas Strip’s power grid.

Lau took a right on Fulkerson Street toward their new location on Binney. As he passed the Kennedy-Longfellow School for Children, he read their signage.
Real-life curriculum through field experiences
. Lau laughed out loud in the car, realizing that his role at the Hack House was similar to the teachers at Kennedy-Longfellow. He was leading his Gamers through some very real-life experiences—
for a profit, of course
.
You better step up today and teach them something, Professor Lau.

As he waited to turn left onto Binney, Metallica’s “Enter Sandman” blared through the Forester’s speakers. Before the light turned, he pounded the steering wheel with both hands. “Fuck me, of course!”

Lau squeezed his car into a tight parking space a block away, not wanting to waste the time searching for a rare spot closer to the Lofts. He jumped out of the car and jogged down the street, forgetting to take the keys out of the ignition. He composed himself near the lobby entrance to avoid attracting attention.
Why didn’t I think of this before?

When Lau entered the Hack House, he found everyone clicking away at the tools of their trade.

“Listen up, everybody. Let’s recap what we know so far. Starting with the obvious. The big prize—the Hoover Dam—is out of reach, because it hasn’t presented us with any Internet-connected vulnerabilities,” he started.

“Our best option is to create a series of cascading failures. By taking down one major power plant, we can create cascading failures throughout the grid. The hell with the Hoover Dam, right?” Lau stopped to take another deep breath as the Gamers nodded their heads in agreement.
This is a teachable moment
.

“Fakhri, we have a primary cascade target, right?” asked Lau.

“Yes, the Clark Generating Station on the east side of the valley,” said Fakhri. “This is Nevada Energy’s primary power plant, generating one thousand one hundred megawatts from several sources. Electric, natural gas and solar. It’s the valley’s largest energy supplier.”

“What happens when we take Clark Station offline?” asked Lau.

“All of Nevada Energy is interconnected,” said Fakhri. “When Clark goes down, nearby grids take up the slack, including the generating stations like Chuck Lenzie in the northern part of Clark County. Our research shows that Lenzie can’t handle the entire load transfer from Clark Station. At a minimum, Las Vegas would experience temporary rolling blackouts. The worst-case scenario, or best case in our view, would be a total blackout—especially if we hit Clark Station at night.”

“In a perfect world, we would be doing this in the middle of summer, to allow for the added power requirements of air-conditioning units in the one hundred ten degree desert heat,” said Malvalaha.

“Walthaus, why haven’t you attempted a pen test on the Chuck Lenzie system?” asked Lau.

“Lenzie has newer technology, and its firewall has proven to be impenetrable,” said Walthaus. “We believe the Lenzie Station primarily services the residential power grid of North Las Vegas. This is just a theory, but we don’t believe Nevada Energy will have the balls to create rolling blackouts along the Strip, on a Saturday night, in order to keep the lights on for North Las Vegas. They’ll drop the suburbs before they drop the Strip.”

Lau was proud of his class—
they have done their homework
.

“Malvalaha, what do we know about the Clark Station operating system?” asked Lau.

“It appears they have a Trend Micro built system running Windows-based Server 2008 or newer,” said Malvalaha. “Our pen tests have allowed us to sneak a peek, but we didn’t want to prematurely alert them to vulnerability. Getting in is one thing, having fun is another.”

“There’s an important issue regarding the Clark Station that we haven’t discussed,” said Lau. The room stared at him, not sure if he was asking them a question or if he’d answer it himself. “Didn’t we learn through a press release that Nevada Energy hired OSI Technology for its infrastructure communications network—the SCADA software?”

“Yes,” replied Malvalaha. “OSI created SCADA, which is an acronym for supervisory control and data acquisition. SCADA is used by industrial utilities to provide interconnectivity across various platforms and networks throughout the utilities’ network. In ‘09, Nevada Energy announced an upgrade to its system by incorporating the SCADA network.”

“How does SCADA work?” asked Lau.

“The entire network is interconnected,” said Malvalaha. “For example, in the case of a water utility, SCADA interacts with multiple remote terminal units, or RTUs. These RTUs have programmable logic controllers, which process data via sensor signals and communicate the information back to SCADA. In the example of water utility, if there were a major 10-75 alarm fire, significant water resources would be required. The RTU in that sector would detect the increased flow requirement and communicate the information back to SCADA, which in turn would control pump speeds at other RTUs in the utilities’ system to accommodate the increased need.”