Arnie said, “Jack, sorry, but the optics are horrible on this. The opposition in Congress and in the media are going to spin this as you admitting America is a war zone.”
“I’ll take the hit and explain the situation as best I can.”
Arnie then said, “The legal age for handgun carry varies from state to state, but it’s twenty-one or higher in a lot of places.”
Ryan said, “If we can send an eighteen-year-old out with a gun to fight overseas, we can give him a gun to protect himself and his family at home.” He turned to Dan. “I expect you, as AG, to fend off any legal opposition.”
Murray didn’t like it, it was clear, but he said, “Of course. We need to put limits on this, though.”
Ryan said, “Nobody carries a weapon who is drinking. Zero tolerance, and that has to be stressed at every step along the way during implementation.”
Burgess said, “Absolutely.”
Jack said, “I don’t know if it will help, but it will let the terrorists know they aren’t out there shooting fish in a barrel.”
Dan Murray next gave an update on the investigation. There was some progress to report. The DoJ had been looking into flight manifests from the United States to Central America during the time frame of the Language School training in El Salvador. Through this they had so far identified eleven of Musa al-Matari’s potential terrorists. Four of those successfully ID’d were among the dead in Virginia and North Carolina, and all the rest were currently missing from their residences.
Additionally, possible identities of some of the other ISIS assets working in the United States had been discovered by the FBI via the tip lines. A used-car salesman stopped coming to work, a student never dropped out of class but had not attended in the past two months. These and a few other tips were being looked into and they appeared promising, but Murray explained that the FBI was taking these good tips along with thousands of bad ones, and agents and analysts were in the process of working like mad to find out who really was missing and a threat, and who was just playing hooky or happened to be unliked by someone who felt like getting the government to harass them.
Murray said, “Jack, our tip line is exploding. And yes, it’s exploding from jerks who think the Indian who makes their sandwiches at the deli is a Muslim terrorist, that’s definitely happening, but it’s also exploding from Muslim men and women in this country that want nothing to do with any of this bullshit. ISIS has killed a lot of people, and more of them have been Muslim than anyone else.
“We’re hunting two brothers and a sister in Chicago who just fell off the map a few months ago, nobody knows what happened to them. Multiple tips came from Chicago Muslims about these two. A similar thing in Atlanta. A mosque there said one of their more outspoken and radical regulars just stopped coming in and is not answering his phone. Timing is right for this being a Language School student.”
Ryan said, “That’s good to know we are hearing from others inside the Muslim community. It would be a damn ironic thing if all this brought this country a little bit back together.”
Murray said, “I’ve directed everyone in the DoJ to reach out to the community and to make sure they tread carefully, so we don’t do anything to screw up the goodwill we are getting.”
Ryan said, “We have identified men and women who are dead or who are not where they are supposed to be. We are putting their pictures out there, but so far we haven’t caught anyone. We have thousands of agents looking for the perpetrators, but Musa al-Matari could be in some tiny apartment somewhere running this whole thing from his phone, if he is in the U.S. at all. And even if Bob puts a pistol on the belt of every serviceman and -woman in America, the terrorists have bombs and suicide vests, that somehow manage to go off even after they are dead or incapacitated.
“Long term, Dan, you’ll get them, but in the short term they are killing people and creating a lot of propaganda that makes them look powerful and us look weak.”
Murray said, “I don’t disagree with anything you are saying. Look, we could be even more aggressive with some of our tactics, but let’s lay our cards on the table. The objective here is to stop these attacks as soon as possible but, as AG, a close secondary objective for me is to prosecute the criminals.”
Ryan said, “That secondary objective is far less important to me. Putting Musa al-Matari on trial is something I don’t anticipate, and it’s frankly something I’d happily do without.”
Murray said, “I understand that. The tools in my toolbox all revolve around the legal system, and I remain beholden to them. Maybe someone with a different set of rules . . .” His voice trailed off.
Mary Pat Foley interjected. “Dan, if I am not mistaken, there is an employee at Gerry Hendley’s shop who retains his FBI credentials.”
Murray nodded instantly. Clearly this is what he had been getting at. “In a general sense I know the work Hendley and his team have done, both at home and abroad. Since Dominic Caruso remains on loan from us to their outfit, even if just on paper, I would be happy sharing information between myself and their very effective operation. It can only help in our . . . investigation.”
Jack said, “Let me think that one over, Dan.” Dom Caruso was President Ryan’s nephew, and his first thought was to keep The Campus out of domestic operations, even though he was well aware they had operated within America’s borders in the past.
AG Murray said, “Fair enough, Mr. President. Just wanted to throw it out there.”
—
The meeting broke up, but Mary Pat stayed behind. “Any specific concerns you might harbor about bringing The Campus in to help locate Musa al-Matari?”
Ryan looked at her. “Is that a joke? I will always harbor concerns about The Campus’s activities. General and specific.”
Mary Pat said, “They do good work. Good, honest, confidential work.”
“No argument from me on that.”
“And Dominic can handle himself.” She paused. “They all can.”
She was talking about Jack, the President understood. He didn’t like being the one involved in sending his son into harm’s way, but, he recognized, that ship had sailed long ago. Since the day Jack joined the organization, against his father’s wishes or knowledge, he had been in peril.
Mary Pat said, “There is no way John Clark would let Jack Junior be involved in the States in something this high-profile.”
“Yeah, well, if he doesn’t send my kid, he’ll send my nephew, or somebody else’s kid. I have no right to balk at the plan because my son is in the mix.”
“If you didn’t care that your son might go into harm’s way, then you wouldn’t be much of a father, Jack.”
Ryan smiled at the floor, but then his face hardened. “I’ll give Dan the go-ahead to brief Dominic.”
“I’ll call Gerry and give him the heads-up that this is coming. They’ll need time to prepare.”
Ryan nodded. “Al-Matari is averaging three hits a day now, and it won’t be any time at all till the copycats start coming out of the woodwork. Whatever it takes, Mary Pat.”
47
By eight Jack was already sitting in the conference room holding his third cup of coffee of the morning and leaning over a computer, his workspace all but covered with handwritten notes, printed sheets, and books, and his one laptop had turned into three.
Jack had been spending night and day studying the attacks in America, one by one, trying to find out how his unknown adversary put all the pieces of the puzzles together from the Office of Personnel Management records and open-source intelligence.
For Jack it had become nothing less than an obsession. At the office all day with Gavin sitting across from him, then home, a beer on his coffee table as he sat on the floor with his laptop in front of him. He dug through books on OSINT methods, marveling at what was out there, lamenting the fact most average people couldn’t imagine how much of t
heir lives was available to anyone who wanted to investigate.
For many of the recent attacks he’d had to look no further than the business networking website LinkedIn to determine how the identity intelligence expert working on behalf of the Islamic State had been able to connect the OPM data to current intelligence community employees. Their names and often their pictures were listed, along with their education and work history, identifying themselves as workers in the intelligence field at CENTCOM or Fort Bragg or for public and private organizations in the D.C. area. So far three of the victims and one more intended victim had a profile that made it obvious they were involved with human intelligence and targeting operations in the Middle East, and Jack had no doubt in his mind several of America’s best and brightest minds in this field were now dead because of their decision to network on LinkedIn.
With a little more work, Jack could see how even clandestine employees of the government, most of whom had no online identities to speak of, were still vulnerable via family and friends letting information slip.
Gavin entered with his own cup of coffee, gave Ryan a nod, and then took his regular seat at the conference table.
As soon as he sat he said, “I’ve come bearing gifts.”
Jack didn’t even look his way. “You don’t eat donuts anymore, so I doubt that there’s anything you have that I’m interested—”
Jack stopped abruptly. He looked up now. “You talked to your friend at NSA. The guy with the back door to Reddit?”
Gavin corrected him. “I didn’t say he was a friend, and I didn’t say he had a back door. But I did get into the private message sent by the user you mentioned.”
Ryan snatched a pen off the table and scrambled to find a blank page in a notebook nearly filled with scrawl.
Gavin looked at his computer. “5Megachopper5’s message reads as follows: ‘I’ve been following your story, my friend, and I think I can help. If you truly want to do that which you claim, I will provide you with all the information you need to make it happen. I am prepared to prove myself to you, and I want nothing in return other than to see that justice is done for Stepan’s life.’”
Jack just said, “Wow.”
“He provides an address that can only be accessed by TOR for Rechkov to use to communicate if he is interested. It’s a dead link now. And then, the day he sent the PM, the guy we are after shut his Reddit identity down. I assume that means Rechkov did make contact with him.”
“So . . . we’re screwed,” Jack said. “Right back where we started.”
“Not at all,” replied Gavin. “I’ve been going through the contents of Rechkov’s hard drive, just like a dozen other forensics investigators, but unlike them, I am the only one who knows about the URL, and the date of the communication on Reddit. All this information was logged on his hard drive by the date. Remember, Rechkov was a fledgling computer scientist himself, so he has tens of thousands of pages of code saved as text files, all part of his studies, and it’s kept haphazardly all over his drive. But it occurred to me Rechkov might have tried to get some info on this person communicating with him, at least just to make sure it wasn’t the U.S. government trying to catch him in a sting. I found a few pages of code in a txt format saved on Evernote, a note-taking app, that he’d put there in the days after the Reddit communication, so I went through it, line by line, late last night.”
Gavin waited to be prompted by Jack.
“And?”
“And Rechkov left a clue as to who he was communicating with. In the code was the creator’s username, Polygeist999.”
Jack just said, “You lost me.”
“Rechkov determined this username was affiliated with the person who set up the dark website.”
“I thought 5Megachopper5 did that.”
“Nah, that’s a throwaway name he used on Reddit. Polygeist999 is another name he used.”
Jack scratched his head. “So . . . Rechkov figured out he was talking to someone online associated with another username. How?”
“Maybe something this guy sent him, or by hacking into a service this guy revealed he was a member of. No way to know, but it’s nice that that asshole Rechkov left us a clue.”
“How is that a clue?”
Gavin said, “I used link analysis on Polygeist999, to see if it, or a version close to it, shows up in other places online. It’s been used hundreds of times in different permutations. ‘Padding,’ it’s called. It could be 1Polygeist999, or Polygeist9991 or he might throw an ampersand in there or something else. Computer people often use variations, depending on what they are working on, and they are different enough that it takes high-level link analysis to figure out that all the different permutations are one and the same person. I went to my friend at the NSA, you know, the one who doesn’t exist, and had him run some reports for me. The Polygeist username first showed up in March of last year on an apartment service in Romania. After that it was everywhere, different types of computer and technical sites, coding, hacking, illegal downloads, et cetera.”
Jack said, “Romania?”
“Yes,” Gavin confirmed. “And the link analysis gives us other usernames that show up multiple times along with Polygeist. Dozens and dozens of uses of this name and others linked to it, all tied to e-mails, computer code, domain registrations, et cetera.”
Together Jack and Gavin began entering the different names into search engines and databases to try to find something that would stick out. Their target inhabited dozens of different online personas, and he was all over different sites, many having to do with obtaining open-source intelligence. But they needed more. They needed to link him to a real identity. Moreover, they were looking to find some way this character had some relationship with the jihadists, a relationship with the intelligence community of any nation in the world, or something that would show them that this person who contacted Rechkov with intel from the Office of Personnel Management and a plan to kill a Navy commander had some motive for doing so.
As they came up with new information, they put it in their shared link-analysis database. This led to more names, all associated with the initial username Polygeist999 and its permutations.
It was slow, arduous, and complicated work, but less than an hour and a half into it, Gavin called across the table. “Are you seeing what I’m seeing?”
“That no matter what you do, you can’t trace back any of these usernames before March of last year?”
“Yeah. It’s like he was born that month. I wonder why he just started in March and exploded like he had been doing this sort of thing his whole life.”
Jack looked up slowly from the computer. “It began with him joining an apartment-hunting website in Romania, right?”
“Yes. Maybe he was trying to hack into it, or he was researching someone who lived in Romania and did business on the website. Maybe he could have been looking up a floor plan of one of his intended identity theft victims. We don’t know.”
Jack said, “I interpret that information more literally. I think he needed a place to stay, so he joined the site.”
Gavin hadn’t even considered the fact there might be a straightforward and benign reason for the person’s actions. He said, “Why do you think he needed a place to stay? You think he’s actually Romanian?”
Jack said, “Yes, and he needed an apartment, because he just got out of prison.”
“Prison? Where the hell are you getting this?”
“There is no online activity for any accounts, usernames, e-mails, et cetera, et cetera, that take place before March nineteenth of last year. What if he’d been locked up, without computer access? You know a guy like this doesn’t just appear out of nowhere online. His skills take years and years to develop, but the link analysis with websites and usernames just begins, as if the man is a fully formed computer and OSINT expert on day one. We have enough data here to cast a wide ne
t, and we aren’t finding anything from more than sixteen months ago.”
“It is a possibility,” Gavin allowed.
“Do we have a way to look into Romanian prison records?”
“With some work I can do that, but we don’t know when he got out exactly, and it would still be a needle in a haystack.”
Jack said, “Yeah, but it’s a smaller haystack than we had yesterday.”
Gavin chuckled. “You’re right about that. I’ll get to work on the Romanian government networks and swim downstream into the prison records. It’s going to take me a couple of hours.”
In the end, it took less than four minutes before Gavin shouted in the conference room, startling Jack. “I’ve got him!”
“You found Polygeist? How the hell did you do that so fast?”
“Because I didn’t have to hack into the Romanian network. Instead, I just ran a search of U.S. government DoJ records of Interpol convictions. I got a list of cases the DoJ was involved with in Romania. There are a hundred thirty-eight of them, but only seventy-one led to conviction. Of those, only twenty-eight have been released. Of those released, only twenty-one were released on or before March nineteenth of last year.”
Jack was impressed, but he was about to be a lot more impressed. “Message me those names and I’ll start to—”
Gavin kept talking. “Of those twenty-one released on or before March nineteenth, exactly one of them was released on March nineteenth.”
Jack stood from his chair. “You’ve got a Romanian cybercrime personality released on the day the Polygeist entities started cropping up around the Web?”
“I do indeed. The prisoner’s name is Alexandru Dalca. He was held in Jilava Prison for a term of five years, ten months, and sixteen days. Before he went in he had his own online cyberfraud network, bilked customers out of millions.”