Because of something I’d told them to do. I was no better than a terrorist.
The DHS got their budget requisition approved. The President went on TV with the Governor to tell us that no price was too high for security. We had to watch it the next day in school at assembly. My dad cheered. He’d hated the President since the day he was elected, saying he wasn’t any better than the last guy and the last guy had been a complete disaster, but now all he could do was talk about how decisive and dynamic the new guy was.
“You have to take it easy on your father,” Mom said to me one night after I got home from school. She’d been working from home as much as possible. Mom’s a freelance relocation specialist who helps British people get settled in in San Francisco. The UK High Commission pays her to answer emails from mystified British people across the country who are totally confused by how freaky we Americans are. She explains Americans for a living, and she said that these days it was better to do that from home, where she didn’t have to actually see any Americans or talk to them.
I don’t have any illusions about Britain. America may be willing to trash its Constitution every time some jihadist looks cross-eyed at us, but as I learned in my ninth-grade Social Studies independent project, the Brits don’t even have a Constitution. They’ve got laws there that would curl the hair on your toes: they can put you in jail for an entire year if they’re really sure that you’re a terrorist but don’t have enough evidence to prove it. Now, how sure can they be if they don’t have enough evidence to prove it? How’d they get that sure? Did they see you committing terrorist acts in a really vivid dream?
And the surveillance in Britain makes America look like amateur hour. The average Londoner is photographed five hundred times a day, just walking around the streets. Every license plate is photographed at every corner in the country. Everyone from the banks to the public transit company is enthusiastic about tracking you and snitching on you if they think you’re remotely suspicious.
But Mom didn’t see it that way. She’d left Britain halfway through high school and she’d never felt at home here, no matter that she’d married a boy from Petaluma and raised a son here. To her, this was always the land of barbarians, and Britain would always be home.
“Mom, he’s just wrong. You of all people should know that. Everything that makes this country great is being flushed down the toilet and he’s going along with it. Have you noticed that they haven’t caught any terrorists? Dad’s all like, ‘We need to be safe,’ but he needs to know that most of us don’t feel safe. We feel endangered all the time.”
“I know this all, Marcus. Believe me, I’m not a fan of what’s been happening to this country. But your father is—” She broke off. “When you didn’t come home after the attacks, he thought—”
She got up and made herself a cup of tea, something she did whenever she was uncomfortable or disconcerted.
“Marcus,” she said. “Marcus, we thought you were dead. Do you understand that? We were mourning you for days. We were imagining you blown to bits, at the bottom of the ocean. Dead because some bastard decided to kill hundreds of strangers to make some point.”
That sank in slowly. I mean, I understood that they’d been worried. Lots of people died in the bombings—four thousand was the present estimate—and practically everyone knew someone who didn’t come home that day. There were two people from my school who had disappeared.
“Your father was ready to kill someone. Anyone. He was out of his mind. You’ve never seen him like this. I’ve never seen him like it, either. He was out of his mind. He’d just sit at this table and curse and curse and curse. Vile words, words I’d never heard him say. One day—the third day—someone called and he was sure it was you, but it was a wrong number and he threw the phone so hard it disintegrated into thousands of pieces.” I’d wondered about the new kitchen phone.
“Something broke in your father. He loves you. We both love you. You are the most important thing in our lives. I don’t think you realize that. Do you remember when you were ten, when I went home to London for all that time? Do you remember?”
I nodded silently.
“We were ready to get a divorce, Marcus. Oh, it doesn’t matter why anymore. It was just a bad patch, the kind of thing that happens when people who love each other stop paying attention for a few years. He came and got me and convinced me to come back for you. We couldn’t bear the thought of doing that to you. We fell in love again for you. We’re together today because of you.”
I had a lump in my throat. I’d never known this. No one had ever told me.
“So your father is having a hard time right now. He’s not in his right mind. It’s going to take some time before he comes back to us, before he’s the man I love again. We need to understand him until then.”
She gave me a long hug, and I noticed how thin her arms had gotten, how saggy the skin on her neck was. I always thought of my mother as young, pale, rosy-cheeked and cheerful, peering shrewdly through her metal-rim glasses. Now she looked a little like an old woman. I had done that to her. The terrorists had done that to her. The Department of Homeland Security had done that to her. In a weird way, we were all on the same side, and Mom and Dad and all those people we’d spoofed were on the other side.
I couldn’t sleep that night. Mom’s words kept running through my head. Dad had been tense and quiet at dinner and we’d barely spoken, because I didn’t trust myself not to say the wrong thing and because he was all wound up over the latest news, that Al Qaeda was definitely responsible for the bombing. Six different terrorist groups had claimed responsibility for the attack, but only Al Qaeda’s Internet video disclosed information that the DHS said they hadn’t disclosed to anyone.
I lay in bed and listened to a late-night call-in radio show. The topic was sex problems, with this gay guy who I normally loved to listen to, he would give people such raw advice, but good advice, and he was really funny and campy.
Tonight I couldn’t laugh. Most of the callers wanted to ask what to do about the fact that they were having a hard time getting busy with their partners ever since the attack. Even on sex-talk radio, I couldn’t get away from the topic.
I switched the radio off and heard a purring engine on the street below.
My bedroom is in the top floor of our house, one of the painted ladies. I have a sloping attic ceiling and windows on both sides—one overlooks the whole Mission, the other looks out into the street in front of our place. There were often cars cruising at all hours of the night, but there was something different about this engine noise.
I went to the street window and pulled up my blinds. Down on the street below me was a white, unmarked van whose roof was festooned with radio antennas, more antennas than I’d ever seen on a car. It was cruising very slowly down the street, a little dish on top spinning around and around.
As I watched, the van stopped and one of the back doors popped open. A guy in a DHS uniform—I could spot one from a hundred yards now—stepped out into the street. He had some kind of handheld device, and its blue glow lit his face. He paced back and forth, first scouting my neighbors, making notes on his device, then heading for me. There was something familiar in the way he walked, looking down—
He was using a wifinder! The DHS was scouting for Xnet nodes. I let go of the blinds and dove across my room for my Xbox. I’d left it up while I downloaded some cool animations one of the Xnetters had made of the President’s no-price-too-high speech. I yanked the plug out of the wall, then scurried back to the window and cracked the blind a fraction of an inch.
The guy was looking down into his wifinder again, walking back and forth in front of our house. A moment later, he got back into his van and drove away.
I got out my camera and took as many pictures as I could of the van and its antennas. Then I opened them in a free image-editor called the GIMP and edited out everything from the photo except the van, erasing my street and anything that might identify me.
I pos
ted them to Xnet and wrote down everything I could about the vans. These guys were definitely looking for the Xnet, I could tell.
Now I really couldn’t sleep.
Nothing for it but to play windup pirates. There’d be lots of players even at this hour. The real name for windup pirates was Clockwork Plunder, and it was a hobbyist project that had been created by teenaged death metal freaks from Finland. It was totally free to play, and offered just as much fun as any of the $15/month services like Ender’s Universe and Middle Earth Quest and Discworld Dungeons.
I logged back in and there I was, still on the deck of the Zombie Charger, waiting for someone to wind me up. I hated this part of the game.
> Hey you
I typed to a passing pirate.
> Wind me up?
He paused and looked at me.
> y should i?
> We’re on the same team. Plus you get experience points.
What a jerk.
> Where are you located?
> San Francisco
This was starting to feel familiar.
> Where in San Francisco?
I logged out. There was something weird going on in the game. I jumped onto the LiveJournals and began to crawl from blog to blog. I got through half a dozen before I found something that froze my blood.
LiveJournalers love quizzes. What kind of hobbit are you? Are you a great lover? What planet are you most like? Which character from some movie are you? What’s your emotional type? They fill them in and their friends fill them in and everyone compares their results. Harmless fun.
But the quiz that had taken over the blogs of the Xnet that night was what scared me, because it was anything but harmless:
> _ What’s your sex
> _ What grade are you in?
> _ What school do you go to?
> _ Where in the city do you live?
The quizzes plotted the results on a map with colored push-pins for schools and neighborhoods, and made lame recommendations for places to buy pizza and stuff.
But look at those questions. Think about my answers:
> _ Male
> _ 17
> _ Chavez High
> _ Potrero Hill
There were only two people in my whole school who matched that profile. Most schools it would be the same. If you wanted to figure out who the Xnetters were, you could use these quizzes to find them all.
That was bad enough, but what was worse was what it implied: someone from the DHS was using the Xnet to get at us. The Xnet was compromised by the DHS.
We had spies in our midst.
I’d given Xnet discs to hundreds of people, and they’d done the same. I knew the people I gave the discs to pretty well. Some of them I knew very well. I’ve lived in the same house all my life and I’ve made hundreds and hundreds of friends over the years, from people who went to day care with me to people I played soccer with, people who LARPed with me, people I met clubbing, people I knew from school. My ARG team were my closest friends, but there were plenty of people I knew and trusted enough to hand an Xnet disc to.
I needed them now.
I woke Jolu up by ringing his cell phone and hanging up after the first ring, three times in a row. A minute later, he was up on Xnet and we were able to have a secure chat. I pointed him to my blog-post on the radio vans and he came back a minute later all freaked out.
> You sure they’re looking for us?
In response I sent him to the quiz.
> OMG we’re doomed
> No it’s not that bad but we need to figure out who we can trust
> How?
> That’s what I wanted to ask you—how many people can you totally vouch for like trust them to the ends of the earth?
> Um 20 or 30 or so
> I want to get a bunch of really trustworthy people together and do a key-exchange web-of-trust thing
Web of trust is one of those cool crypto things that I’d read about but never tried. It was a nearly foolproof way to make sure that you could talk to the people you trusted, but that no one else could listen in. The problem is that it requires you to physically meet with the people in the Web at least once, just to get started.
> I get it sure. That’s not bad. But how you going to get everyone together for the key-signing?
> That’s what I wanted to ask you about—how can we do it without getting busted?
Jolu typed some words and erased them, typed more and erased them.
> Darryl would know
I typed.
> God, this was the stuff he was great at.
Jolu didn’t type anything. Then,
> How about a party?
he typed.
> How about if we all get together somewhere like we’re teenagers having a party and that way we’ll have a ready-made excuse if anyone shows up asking us what we’re doing there?
> That would totally work! You’re a genius, Jolu.
> I know it. And you’re going to love this: I know just where to do it, too
> Where?
> Sutro Baths!
Chapter 10
What would you do if you found out you had a spy in your midst? You could denounce him, put him up against the wall and take him out. But then you might end up with another spy in your midst, and the new spy would be more careful than the last one and maybe not get caught quite so readily.
Here’s a better idea: start intercepting the spy’s communications and feed him and his masters misinformation. Say his masters instruct him to gather information on your movements. Let him follow you around and take all the notes he wants, but steam open the envelopes that he sends back to HQ and replace his account of your movements with a fictitious one. If you want, you can make him seem erratic and unreliable so they get rid of him. You can manufacture crises that might make one side or the other reveal the identities of other spies. In short, you own them.
This is called the man-in-the-middle attack and if you think about it, it’s pretty scary. Someone who man-in-the-middles your communications can trick you in any of a thousand ways.
Of course, there’s a great way to get around the man-in-the-middle attack: use crypto. With crypto, it doesn’t matter if the enemy can see your messages, because he can’t decipher them, change them and resend them. That’s one of the main reasons to use crypto.
But remember: for crypto to work, you need to have keys for the people you want to talk to. You and your partner need to share a secret or two, some keys that you can use to encrypt and decrypt your messages so that men-in-the-middle get locked out.
That’s where the idea of public keys comes in. This is a little hairy, but it’s so unbelievably elegant, too.
In public-key crypto, each user gets two keys. They’re long strings of mathematical gibberish, and they have an almost magic property. Whatever you scramble with one key, the other will unlock, and vice versa. What’s more, they’re the only keys that can do this—if you can unscramble a message with one key, you know it was scrambled with the other (and vice versa).
So you take either one of these keys (it doesn’t matter which one) and you just publish it. You make it a total nonsecret. You want anyone in the world to know what it is. For obvious reasons, they call this your “public key.”
The other key, you hide in the darkest reaches of your mind. You protect it with your life. You never let anyone ever know what it is. That’s called your “private key.” (Duh.)
Now say you’re a spy and you want to talk with your bosses. Their public key is known by everyone. Your public key is known by everyone. No one knows your private key but you. No one knows their private key but them.
You want to send them a message. First, you encrypt it with your private key. You could just send that message along, and it would work pretty well, since they would know when the message arrived that it came from you. How? Because if they can decrypt it with your public key, it can only have been encrypted with your private key. This is the equivalent of put
ting your seal or signature on the bottom of a message. It says, “I wrote this, and no one else. No one could have tampered with it or changed it.”
Unfortunately, this won’t actually keep your message a secret. That’s because your public key is really well known (it has to be, or you’ll be limited to sending messages to those few people who have your public key). Anyone who intercepts the message can read it. They can’t change it and make it seem like it came from you, but if you don’t want people to know what you’re saying, you need a better solution.
So instead of just encrypting the message with your private key, you also encrypt it with your boss’s public key. Now it’s been locked twice. The first lock—the boss’s public key—only comes off when combined with your boss’s private key. The second lock—your private key—only comes off with your public key. When your bosses receive the message, they unlock it with both keys and now they know for sure that: a) you wrote it, and b) only they can read it.
It’s very cool. The day I discovered it, Darryl and I immediately exchanged keys and spent months cackling and rubbing our hands as we exchanged our military-grade secret messages about where to meet after school and whether Van would ever notice him.
But if you want to understand security, you need to consider the most paranoid possibilities. Like, what if I tricked you into thinking that my public key was your boss’s public key? You’d encrypt the message with your private key and my public key. I’d decrypt it, read it, reencrypt it with your boss’s real public key and send it on. As far as your boss knows, no one but you could have written the message and no one but him could have read it.
And I get to sit in the middle, like a fat spider in a web, and all your secrets belong to me.
Now, the easiest way to fix this is to really widely advertise your public key. If it’s really easy for anyone to know what your real key is, man-in-the-middle gets harder and harder. But you know what? Making things well known is just as hard as keeping them secret. Think about it—how many billions of dollars are spent on shampoo ads and other crap, just to make sure that as many people know about something that some advertiser wants them to know?