DARKNET CORPORATION (21 page)

“Hello. I hope you can help me. I have an appointment on Tuesday the 15
^th
at 2:30. I wonder if you can change that for
me?
” Bill
held his breath for the response.

“Mr Wood?” she said.

“Yes.
That’s right,” he lied.

“We could make it the following Monday, at the same time. Would that work
for you?” she chirped.

“Yes. That’s fine. No problem. Will you send me out a new appointment
card?” he fished.

“Sure. We’ll do that, of course, Mr Wood”. Bill could hear her smiling.

“You’ve got my address?” Bill crossed his fingers.

”Eh…..” Bill could hear her tapping keys on her computer. “346 The Drive,
Ilford?” she queried.

“Yes! That’s right. Thank you so much. Goodbye”. Bill put down the phone
and shouted, “Hallelujah!” Then he picked it up again and called Cullen. Gower
came on the line.

“Wood lives at 346 The Drive, Ilford. Go get him!” Bill was exuberant.

“Wow. How did you find him?” Gower asked.

“I’ll explain later, once you got him in irons!” Bill replied.

“NO! I need it for the warrant. We can’t go busting down doors unless we
can justify our information...” Gower insisted.

Bill explained his ruse and identified the source as Gentle Dental and
this satisfied Gower, who promised that they would have a SWAT team there in no
time. Bill finally felt that the syndicate’s safety was more in jeopardy than
his was for the first time.

Chapter Twenty Four

Bill looked up the SIS organisation directory on the intranet and found
out where counter-intelligence was in Legoland and who the senior people were.

The Directorate of Security and Public Affairs is the
counter-intelligence section of SIS and the floor in Legoland that they occupy
is further secured from the rest of the intelligence community in the building.

Bill walked out of the lift and was confronted by a reception desk with a
series of conference rooms behind it. There was no sign of anyone else. The
counter-intelligence people were all behind locked doors in secure areas.

The receptionist, a young black man with short hair
and a white shirt and black tie, asked, “Can I help you sir?”

“Yes, I’d like to speak to someone about a potential security breach
inside SIS,” said Bill, not sure how such a momentous statement would be
received.

The receptionist was unfazed and showed no reaction whatever, but simply
asked to see Bill’s security badge. He wrote down details from it, rose and
asked Bill to wait in meeting room 1, showing him to the door of the room and
then disappeared into the secure area.

A minute or so later a man in his late thirties, quite chunky, possibly a
bodybuilder, wearing dark trousers, black shoes and a white shirt and tie
walked in and proffered his hand to Bill. Captain Hodge?

“I don’t use the rank much these days” Bill said as the man waved his
hand for them to sit. He closed the door and sat close to Bill, crossing his
legs, leaning a clipboard on his thigh.

“I’m Phillip. You came about a potential security breach?” he raised his
eyebrows just a touch, interrogatively.

“Yes. It might all be coincidences, but I think it is more than that and
in fact most of it is unexplainable without there being a leak,” Bill began. He
related everything he thought was relevant to the SIS involvement in
Dinner-Jacket and said only as much as was necessary about the operation itself
as was needed for context.

Phillip scribbled notes as Bill spoke. After Bill finished speaking
Phillip asked, “…and do you have suspicions as to who might be involved?”

“It could be anyone that was able to see the border flag on me coming
across in the Eurotunnel and who had used his login to get access to the
Dinner-Jacket operation database. But it had to be someone who had access to
SIS networks to do both and who walked across the street to make that call.
It’s a man, based on the voice,” Bill surmised.

Phillip was gazing at him intently. He was equally as capable of
summarising the clues to the person’s identity from what Bill had already said.
He wanted Bill’s suspicions, which he had not offered yet. “…and who do you
suspect?” Phillip insisted.

Bill looked at Phillip for a long time, weighing up how much trouble
would he cause with unsubstantiated allegations.

Phillip had experience of this reticence before and knew what Bill was
thinking. He jumped in, “Your suspicions are, by definition, unsubstantiated
and probably even unfounded. I need to know if you have any inkling of who it
might be to eliminate them, or at least to have somewhere to start looking. But
I have to say, if your personal login has been used, the IP address of the
workstation that logged in will be on file and it won’t take long to flush it out.
From there it’s a simple matter to examine the activities of the officer
involved to fully define what offences might have been committed.

Your cooperation doesn’t need to be disclosed. If we cannot establish
clear evidence independently of your testimony, then we won’t have a case
anyway. You won’t be asked to ‘give evidence’ or whatever.
All
right?”

“Well I have been a little suspicious of my boss, Fenton Curry. It’s just
body language and use of particular terms. Things like that,” Bill admitted.

“Terms like….?” Phillip probed.

“He used the term ‘dongle’ for the USB stick we obtained from a drug
smuggler. The same term was used by the person the drug smuggler called when he
lost the USB stick. I just thought that was a little unusual.”

“Anything else?”
Phillip pressed.

“Not really. It’s just a feeling that something doesn’t gel,” said Bill.

“OK. Thank you Mr Hodge. Please let me know if you have any other
observations. Please don’t speak to anyone about this matter. I will only
contact you again if I need to ask you questions, otherwise we’ll take it from
here.” Phillip stood and shook Bill’s hand and showed him out.

Phillip Bristow returned to his office and looked at the log of SIS
system logins and selected William Hodge. Several lines appeared with date-time
stamps and six different IP addresses associated with them. Phillip minimised
the screen and looked up the network management system and identified where the
IP addresses terminated. One was in the communications area; one was in Bill
Hodge’s office, and the others were on two separate floors other than either of
these two locations. None of these could be directly associated with Fenton
Curry.

Phillip smiled. “The game’s afoot,” he thought. He shouted out his office
door for his assistant. When she stepped in he gave her instructions for
sources of information to be pulled and examined; schedules of activity for
Fenton Curry to find out where he was at every minute for the last two weeks
including system activity, email and phone logs; video surveillance for the
areas of the all of the locations identified from the network system, including
areas where Bill Hodges office might be visible; and Fenton Curry’s hard copy
security file.

Not everything in counter intelligence was digitally recorded; ‘Eyes-only’
classified material required physical control. She looked up from her notes and
asked for the investigation number. He turned around and keyed in the barest
details to set up a new ‘investigation’ and once the number was allocated, gave
it to her.

-|-

John
Buttrose
called Bill. He stopped him and
said he was busy and would call back.
Buttrose
was
clearly a little surprised that he had picked up the call at all, if he was
busy, but had no option but to hang up.

Bill jumped up and went out of his office looking for a spare desk. He
decided against the one he had used to call the dentists, just in case, and
chose another empty desk and called GCHQ. When he had John
Buttrose
back on the line he apologised and asked why John had called.

“We’ve received a set of materials; a physical USB stick from The
Metropolitan Police and an image of one from the
Hesse
State Police in Germany, as well as a laptop hard drive image. The laptop hard
drive was pretty much the same as the one we analysed before, except that it
had several table sheets that matched the printed versions the German police
found in Frankfurt, which I understand you are aware of?”
Buttrose
explained.

“Yes. I know about the raid in Frankfurt. I asked them to send the
materials to you,” Bill responded.

“OK. Well it looks like the tables were used to print the sheets and
sticky labels that were used on envelopes. Anyway, the good news is that we’ve
been able to break the passphrase on both USB sticks and recover the private
keys on them. Both of the USB’s have identical software on them as we saw on
the original USB.”

“Excellent. So we can login to their network and see more than we could
see before?” Bill suggested.

“Well…not quite. There are a number of issues. Firstly; the USB from
Germany will be known to have been compromised by the people running the
system, assuming that they know about the raid by now. So it’s unlikely that
the key will still be enabled. The physical USB from the Metropolitan Police
is, I understand, from a search where the suspects may not know that we have
it. Is that right…
Humpf
?”
Buttrose
asked.

“Well it’s a 50-50 bet that they don’t know yet. They might have guessed
that we have found it, but they can’t know for sure,” said Bill.

John audibly took a deep breath and said, “OK. We have a plan. If we
simply logged in and tried to use any of these systems they may well have
people watching or monitors that would flag it and switch the credentials off.
But if they don’t know we have the physical USB we can use it to connect to the
server and not activate any of the systems.”

Bill was perplexed and asked, “How does that help us, exactly?”

“Well, what we can do is parse internet traffic for the packets the USB
software will send to the server just keeping the connection up.

Let me explain. The hidden instant messaging service on the target server
must communicate with the laptop with the USB on it to show its presence. It’s
called SIP, session initiation protocol. It sends messages back and forth at
the protocol layer even if the user doesn’t do anything. So we can monitor for
these message strings being sent and received by a server somewhere out there
in the cloud. Because we know the key and what messages the protocol uses we
know exactly what the strings will look like.

The beauty of it is that if we don’t activate anything it is much less
likely it will flag up anything unusual. If anyone is watching the network,
there will be nothing for them to see, other than the icon in the Instant
Messaging application to show that ‘sourcer7’ is ‘available’.

To make it even more obscure, we can start the session in the middle of
the night when it’s highly unlikely that anyone is sitting looking at it. You
would be able to see the ‘Sourcer7’ identity come up with an icon as ‘present’
on the Instant Messaging system but if nobody is looking at that service it
won’t be noticed and we can run it for longer, which will increase the chance
that we find the networking messages.”

“OK,” said Bill, “I think I follow. You can connect without doing
anything and that’s more likely to avoid getting observed and it will create
networking messages you might be able to trace on the Internet. And you can
find this particular message out of everything going on, in the whole
Internet?” Bill asked.

“Err, well that’s classified, but yes we have hooks into routers
everywhere, apart from a few Chinese ones. If you are happy with that, we will
set it up to start tonight.
Humpf
?”

Bill gave his approval and hung up.

-|-

Detective Chief Superintendent Cullen stepped out of his car in The
Drive, Ilford and walked into number 346.

The SWAT team that had ‘served’ the search warrant by ‘opening’ the doors
were decamping and packing up gear.

A police officer who had been assigned to secure the premises saluted the
senior detective at the front door and noted Cullen and Gower as entering the
premises at 5.22 p.m. in his notebook.

Cullen walked from room to room taking in everything. This was a far
different accommodation to the ‘bedsit’ in Clapham. This was ‘style’.

Someone had spent considerable money on refurbishing this place; double
glazing; parquet flooring; gourmet kitchen; one room set up as a home theatre
with a massive flat screen television and audio system; another room set up as
a gymnasium with expensive looking equipment; yet another as an office. It
would be a comfortable five bedroomed home for a family, but it was a luxurious
bachelor pad.

There was little personal tone; no family photographs; knick knacks, or
books, just a few magazines; water sports and military themes. As a home, it
was modern and minimalist but with every conceivable comfort.

Cullen started looking in drawers and cupboards absorbing the
implications of every detail, thinking of the embarrassment of Hodge finding
the stash in the radiator. He did not want to be hoodwinked here.

Gower was leafing through papers in the office while an officer unplugged
the desktop computer and another police photographer flashed repeatedly while
collecting images.

-|-

George Wood was driving up The Drive when he saw the commotion outside
number 346 and pulled into a side street and parked half on the footpath where
the double yellow lines stopped.

“Shit!
Police.
They’ve found me,” he thought, consciously
managing the panic that was rising in him. “What now? The house is blown.
The office?
Or just lie low in a motel or something?” He got
out and walked to the edge of the house on the corner and peered around at what
he could see.

A black, unmarked van went past, full of
balaclava’ed
SWAT officers. Wood tried to look casual and turned away to avoid his face
being observed. As soon as they passed he went back to his car and drove off,
thinking furiously, “Was the car blown too? How did they find me? Why are they
after me? What do they know?”

He drove the few hundred yards to Redbridge underground station and
parked in the car park. There were plenty of spaces with people going home at
this time of night. He looked around feverishly trying to think what
incriminating evidence he had in the car and took the GPS unit and stuffed it
into one pocket and lifted sales dockets for petrol and groceries that were in
the central console and shoved them into the other.