Hunt the Dragon (13 page)

Office 39 also employed another fifty to a hundred men and women who worked overseas—some in front companies in Switzerland, Thailand, and Dubai, which were used to buy and sell military equipment and procure parts and technology for the nuclear weapons program. Others ran operations including selling cigarettes and counterfeit currency, and drug trafficking. In recent years, according to Min, Office 39 had made billions of dollars manufacturing crystal meth and selling it in places like the Czech Republic, Sweden, Latvia, Slovakia, Finland, Thailand (where it is known as
yaba
), and the Philippines (where it is called
shabu
).

Office 39 also kidnapped young women from places like Thailand, Vietnam, and the Ukraine to serve as sex slaves to top regime officials, managed a large Internet hacking operation, and stole industrial secrets. Illegal activities in foreign countries, Min explained, were often farmed out to local criminals and gangs. Chou's code name was the Dragon, and he called all the shots.

He also had a hand in managing Office 99, which raised funds by selling missiles and military equipment to countries like Syria and Iran, and Office 35, whose focus was to undermine the government of South Korea. Many of the billions of dollars in assets Chou accrued annually were stored in bank accounts in Switzerland, Dubai, and Macau.

Anders opened a folder and spread across the table the documents that had been smuggled over the border. They appeared to be hand-drawn plans of the various Office 39 facilities. As Min started to explain what they were and how Office 39 worked with other branches of the North Korean government and military, the air conditioning died and the lights went out.

The South Korean officials fidgeted and chattered nervously, but Min kept his eyes focused on Crocker across the table. A few minutes later a navy orderly knocked on the door and reported that the city of Honolulu had suffered a large-scale power outage. If the electricity wasn't restored shortly, he said, the base would begin firing up its emergency generators.

“How long do you expect that to take?” Anders asked.

“Five minutes tops, sir.”

His mind quieted, Dawkins turned off the light and slipped under the coarse sheets. Usually when he got in bed, Sung left quietly, except on those rare occasions when he asked her to stay. He hadn't done so tonight, which was why he watched with curiosity as she entered the bathroom through the door beyond the foot of his bed.

He knew almost nothing about her life. Judging from her appearance, he assumed she was in her late twenties. In conversation she sometimes referred to her family, but she never talked about how big it was, or whether she had a husband or children. Dawkins had always been introspective and self-involved, but during his captivity he spent even more time thinking about his own family.

Now he lay on his back with his eyes closed, remembering a picnic with Nan and Karen on the shore of the Potomac. Karen, who was five at the time, had been given a pink Barbie kite for her birthday. He watched her run with it attached to a string, trying to get it to take flight as the sun glistened off the river and her dark hair flew behind her. He heard her squeal with excitement, “Daddy! Mommy! Look at me!”

Sensing something moving above him, he half opened his eyes and saw a shadow. Sung leaned over him and whispered, “Mr. Dawkin, I show you something.”

“In the morning, Sung.”

“Important. I show now.”

The breeze along the Potomac carried the faint scent of cherry blossoms. Sung shook him. “Come to bathroom. Bring you glasses. I show you, Mr. Dawkin.”

Her aggressive behavior surprised him. He sat up and watched her beckon him with her hand.

“Okay, Sung. You sure this can't wait?”

He put on his glasses and shuffled across the cold tile floor. Sung had entered the small five-by-five-foot space ahead of him. He saw the planes of her face shift under the bare light.

“What?”

She held a thin finger up to her lips, reached behind the rust-stained shower curtain, and turned on the water. He had always assumed his quarters were bugged and had been careful never to talk about anything that could get him in trouble. Now he watched her unscrew a five-inch-long plastic cylinder, reach inside it, and remove a piece of paper. He assumed the cylinder had been hidden somewhere on her body.

She carefully unfolded a small sheet of paper with blue handwriting on both sides.

“Where did you get this?” he asked.

Sung pushed the paper under his nose. “For you, Mr. Dawkin…for you.”

He squinted through his glasses and started to read:

“Sir, my name is Dr. R. S. Shivan. I was a professor of nuclear engineering at the Tata Institute of Fundamental Research in Mumbai before I was kidnapped and forced to come here. TIFR is the Indian version of MIT. Part of my university training was at the University of Rochester. I have a PhD in nuclear engineering from the University of Michigan. I was brought to NK against my will over a year ago. Since then and after some delays due to illness, I have been working to solve the challenge of miniaturizing a nuclear weapon to fit in the warhead of an Unha-3 intercontinental missile. I don't know if you know this, but that is an important component of what the NKs are trying to achieve. As of this week, that critical engineering problem has been solved, which is both good and bad. The good part is that soon, God willing, I will be allowed to return to my home in India. It is my understanding from being privy to many details of the Unha-3 program that there are very few engineering and rocketry issues left to solve before NK is able to launch a nuclear strike at targets in China and the US. It is my fear that this is what the NKs are planning to do. Based on numerous things I have seen and experienced during my year in captivity I believe that they are going to foment a war between China and the US and use this as a cover to invade and take over SK. This isn't a theory. I have spoken to people here who have told me this. It's a very alarming situation. I have several questions for you:

1. How long have you been in NK?
   
2. What are you working on?
   
3. What is the status of your project?
   
4. Do you know anything else about NK plans?
   

“As I mentioned above, my project has been completed. I am hoping to be allowed to return to India soon. Once I am home I will talk to officials of my government and tell them to alert the US. I have heard you are American. I don't know if that is true or not. If you tell me your name and where you live, I will communicate with your government and your family. I am a faithful servant of God and your colleague in captivity, Dr. R. S. Shivan.”

As Dawkins finished reading, his entire body started to tremble. With the shower hissing to his right he stared at Sung, who seemed more psychologically complex than she had moments before. Maybe daring, maybe cunning or deceitful. Perhaps some of all three.

He tried to grasp the choices he faced and their implications. “Have you read this?” he whispered so close that their noses almost touched.

“No, Mr. Dawkin.”

“Do you know what it says?”

“No.”

“Where did you get it from?”

“Woman like me. Work here for different man.”

“Do you know this man?”

“No.”

“Have you seen him?”

“Yes.”

“What does he look like?”

“Black hair. Brown skin. Same height as you.”

“And this woman, does she have a name?”

Sung nodded. “Chiang-su.”

Dawkins had never heard of her. “Does she perform the same functions for that engineer as you do for me?”

She looked confused.

“Do you trust her?”

Sung nodded.

F
ive minutes
had passed, and Crocker was starting to sweat through his shirt. He kept thinking about the blackout in Las Vegas, and couldn't help wondering whether that event and this power outage were connected. Across the table, Min was describing the elaborate underground facility on the island of Ung-do, off the east coast of North Korea, that housed Office 39's new high-tech money counterfeiting facility, complete with intaglio press.

Crocker started to see where this was headed, which excited him. He'd been to North Korea once before, in '03, on a mission to knock out a radar and listening station in the north. He and his ST-6 teammates parachuted at night into freezing water, climbed into a Zodiac, and motored to shore. By the time they reached land the six men were suffering from hypothermia, their feet and hands were numb, and their clothes and gear had frozen. They spent the next three days climbing icy mountain trails. At night they slept huddled together on a bed of sticks to stay off the frozen ground. One night, one of Crocker's feet slipped off the bed and was frostbitten.

He still felt it more than a decade later. That mission to North Korea, three hundred miles north of Ung-do near the city of Kimchaek, had ended in success. Ung-do, according to the map Anders brought up on his computer, was approximately 102 miles east of the capital of Pyongyang and roughly on the same 39th parallel of north latitude. The island was covered with a forest of pine trees, which provided perfect cover for the large excavation project started in 2007. With the help of Iranian and Russian construction engineers, the North Koreans had expanded a series of natural caves. It was here, according to Min, that 2HK1 counterfeit hundred-dollar bills were being printed.

Interestingly, it was off Ung-do where the spy ship USS
Pueblo
had been seized by the North Koreans in 1968, sparking a very tense international standoff. One American sailor was killed when the ship was fired upon by a North Korean submarine chaser. The remaining eighty-two crew members and officers were captured and held in North Korean prisons, where they were starved and tortured. Almost a year later, the officers and crew were released. The vessel itself was never returned and was publicly displayed in North Korea as a monument to resisting the American imperialists.

All this had happened a year before Crocker was born. The United States had issued an apology and a promise never to spy on North Korea again. Thinking about it now pissed him off. Why do we back away when rogue countries like North Korea act aggressively? He didn't pretend to understand international politics, but he knew that you couldn't allow a criminal regime like the one that ruled North Korea to get away with anything without risking a much bigger challenge later. It was one of the laws of the streets he'd learned as a teenager. You couldn't let a punk insult you in public and walk away. You had to punch him in the mouth.

“What are we going to do about the presses?” Crocker asked when the emergency power finally came on.

Anders blinked and frowned. “We'll get to that now. Be patient.”

Dawkins sat at the wooden table raking his hand through his thinning hair. He'd been staring at the blank page in his notebook for almost an hour and hadn't written a single word. If he responded to Dr. Shivan in any way, he'd be revealing himself. There was no question about it. What if Dr. Shivan didn't exist? What if the note was a ruse by the North Koreans to test him?

Any reply—even “I wish you well but have nothing to say”—could be construed as an act of complicity. And he didn't want that.

On the other hand, judging from the tone and content of the letter, which he had reread a dozen times, Dawkins believed there was an eighty percent chance that Dr. Shivan was who he said he was. Assuming that was true, the temptation to tell him details about himself so that he could communicate them to U.S. authorities upon his release was very strong. He desperately wanted his government to know where he was, and he wanted his captivity to end. But if the letter was fake, any response would serve to diminish his chances of ever reuniting with his family.

Dawkins wasn't adept at rational thinking in difficult emotional circumstances. He usually did everything he could to avoid situations like this, and if he failed, he relied on Nan. Now, no matter how he examined the dilemma, the biggest, loudest part of him told him to think about his survival. The safest course was best. His release and return home had to be the paramount goal. The voice in his head argued that he wasn't only thinking of himself. His return to the States would be good for everyone—him, Nan, Karen, and even his countrymen. If Sung and Chiang-su were doing this of their own volition, they were taking an enormous risk for reasons that weren't apparent to him. If, on the other hand, they were doing this on the regime's orders, they were being cruel.

But what did he know about their lives and the political and personal pressures they were under? He hadn't been aware of Chiang-su's existence before tonight. And if he had to characterize Sung's behavior over the many hours they'd spent together, he would have to say gentle and sympathetic. Nothing she had said or done had given him any indication that she harbored any hostility toward him or the United States.

Nor was she naive. Sung had to know that the note put her in danger. He wanted to convince himself that by not responding to Dr. Shivan, he would be doing the best thing for her, too.

But he couldn't. A quieter, more contemplative part of his psyche wanted to learn more from Dr. Shivan about the underground facility and the state of the North Korean nuclear missile program. It urged him to somehow take advantage of the opportunity offered by Sung and Chiang-su. He spent the rest of the night trying to come up with a plan that would afford him maximum deniability and the greatest chance of success.

In the morning when Sung arrived with his breakfast, he summoned her to the bathroom and turned on the shower. With the water hissing, he said, “Tell Dr. Shivan to call this number…seven, zero, three, seven, one, five, eight, two, eight, seven. Ask to speak to Bird, and tell her where I am.”

Late the following night in a secure room at Naval Amphibious Base in Coronado, CA, Crocker met with James Anders, his assistant Dina Brooke, an analyst from the CIA North Korean desk, and another analyst from FBI Cyber Division.

Anders said, “Everything we discuss here will be preliminary and subject to executive approval, because of the mounting atmosphere of hostility between us and China. I want to talk about that, and I also want us to start looking at possibly launching an op against the printing presses on Ung-do.”

“It's about time we did something,” remarked Crocker.

Dina Brooke, a very serious young woman with long dark hair and glasses, reviewed the causes of the recent tensions between the two superpowers. Over the past month a dozen cities in the United States had experienced power outages similar to the ones he had witnessed in Las Vegas and Honolulu. All of them had occurred when an unauthorized person or entity hacked into the local power utility's supervisory control and data acquisition system.

They had done this, the FBI Cyber Division expert explained, by bypassing the local power utilities' security measures and compromising the Domain Name System (DNS). By changing the mapping between the utilities and the IP addresses of their physical servers, the intruders were able to direct traffic heading for the utilities' domains to the wrong IP addresses—addresses of servers under their control.

The hackers then fired massive amounts of network traffic at the host, which caused it to become overwhelmed and drop legitimate traffic. Using these protocols and others, they essentially took over the local utilities' computer systems and directed them to power down the outflow of electricity.

Why the hackers had done this was unclear. Analysts at the FBI and CIA theorized that the people behind the cyberattacks were either operatives of an enemy state or a terrorist organization trying to spread fear throughout the United States.

After hundreds of man-hours of tracking and investigation, the FBI Cyber Division had identified People's Liberation Army (PLA) Unit 61398 near Shanghai as the likely source of the attacks. Unit 61398 was a viable candidate, the FBI expert explained, because it had been the source of previous hacking attacks on U.S. government agencies and businesses. Since 2000, ninety percent of cyberespionage on the U.S. originated in China.

Public utilities were particularly vulnerable, according to the FBI expert. “All it takes is the right Google search terms to find a way into the systems of U.S. water and power utilities. And this isn't unusual. Many industrial control systems are hooked up to the Internet. If they don't change their default passwords and you know the right keywords, you can find their control panels easily.”

When White House officials lodged a formal complaint with the Chinese government, the Chinese responded angrily, in part because they had been experiencing cyberattacks of their own, targeting banks, businesses, and government agencies, including PLA offices and installations. They pointed a finger at the United States and the same top-secret U.S. cyberwar units that had created the computer worm Stuxnet, which had infected the software of at least fourteen industrial sites in Iran, including a uranium-enrichment plant.

This worm, first discovered in June 2010, was an unprecedentedly masterful and malicious piece of code that attacked in three phases. First, it targeted Microsoft Windows machines and networks, repeatedly replicating itself. Then it sought out Siemens Step 7 software, used to program industrial control systems that operate equipment such as centrifuges. Finally, it compromised the programmable logic controllers. The worm's authors could thus spy on the industrial systems unbeknown to the human operators at the plant and even cause the fast-spinning centrifuges to tear themselves apart.

Two years later the International Telecommunication Union, the UN agency that manages information and communication technologies, discovered another very sophisticated piece of malware forty times larger than Stuxnet, which they called Flame. On investigation it turned out to be a precursor to Stuxnet that had somehow gone undetected.

While Stuxnet's purpose was to destroy things, Flame's was to spy on people. It spread through USB sticks and infected printers shared by the same network. It could also exchange data with any Bluetooth device, and through directional tunnels linked to Bluetooth enabled computers to steal information from other devices and embed itself from two kilometers away.

The scariest and most revealing aspect of Flame was how it got into computers in the first place—through an update in the Windows 7 operating system.

Because of the enormous amount of time, money, and resources needed to develop malware like Stuxnet and Flame, cyber experts around the world suspected that a large government was behind their development. And because Stuxnet had been targeted to disrupt Iran's nuclear enrichment program and Flame had infected millions of computers throughout the Middle East, international experts suspected the United States and Israel, either working separately or together.

The Chinese had reason to be suspicious of the United States. But this time, according to Dina Brooke and the FBI expert, the United States was innocent. “The charges directed at us have been thoroughly investigated,” Brooke said, “and are absolutely untrue. It's possible that the hackers involved are acting for some third party and are using the U.S. and Chinese servers as proxies.”

Crocker, who understood very little about computer systems, found all this fascinating. Before the cyber experts were dismissed, he asked one question.

“If it's possible, as you say, to hide behind or piggyback off someone else's server, could some other country, like Iran or North Korea, be behind these attacks?”

“The short answer is yes,” Brooke said. “With all the available stolen credit cards and Internet proxies, it's really quite easy for attackers to become invisible.”

Crocker smelled a rat. He thought the North Koreans were up to something, maybe with the help of the Iranians, maybe on their own. He didn't want to hear more hedging from Anders, who was now saying that given the recent tensions with China, the White House would be averse to any contingency in terms of North Korea that could directly or indirectly serve to further offend the Chinese.

Fuck Chinese sensibilities,
he said to himself.
If the North Koreans are counterfeiting our currency and hacking into our power grid, let's kick their butts.

During a coffee break, Crocker stood on the steps of National Amphibious Base headquarters looking out on San Diego harbor. Seventeen years ago he had suffered through BUD/S training a few hundred yards from where he stood now—eight months of ass-kicking that involved endless runs on the beach, calisthenics, obstacle courses, swimming, boat drills, fast roping, land navigation, and dive training. Out of a hundred guys in his class, twenty-three had graduated.

Seventeen years ago he had driven cross-country in a beat-up TR6 with no brakes. Since then he had suffered all kinds of scars and bruises in places all over the world. As he watched Anders talking into a cell phone on the lawn, he marveled at how much the world had changed in seventeen years. When he received his SEAL Trident there was no war on terrorism, no ISIS, no Homeland Security, no FBI Cyber Division, and no cyberespionage.

Who knows what the next seventeen years will bring?

Whatever the new threats were or where they came from, he knew it was imperative that the United States respond with intelligent, decisive action. Dithering over a reply to al-Qaeda after the bombing of the U.S. embassies in Dar-es-Salaam and Nairobi and the attack on the USS
Cole
had led to tragedy. An ill-advised invasion of Iraq and the failure to act in Syria had encouraged the rise of ISIS.