Rogue Code (28 page)

“I don’t know.” Alshon made a note. “I’ll have a background done on every key employee who could work this from the inside. Can you give me those names?” Flores nodded. “We’ll find the link if there is one.”

“The other part of this, sir, is that the operation is ongoing.”

Alshon was shocked. “You mean they’re still at it?”

“Absolutely. If anything, it looks like its accelerating in frequency.”

Alshon wrinkled his forehead. “They’re on the run. How can they do that? Are you positive this isn’t automated?”

“Yes. What’s happening is being human directed. My thinking was the same as yours initially, that they’d have to shut down in the circumstances, that if they did anything, it would be to delete code and cover their tracks. I think we really need to consider that a number of others are involved. Or—” She hesitated. “—whether these two are even involved at all.”

“What do you mean?”

“Unless we can connect them with someone on the inside going back several years I think we need to consider that they’ve been set up.”

“Set up?”

“Right. Assume for a minute, they are fall guys. They were brought in to conduct a penetration test. We know they succeeded. In doing so they encountered the code for this illegal operation. Whoever is doing it could have made it look like they were the culprits to discredit them and divert attention.”

“That seems a stretch.”

“Yes, but I don’t find it any more implausible than Aiken opening a brokerage account in his own name and carelessly dropping malware the IT security trolls were sure to spot.”

“I’ll keep it in mind, but innocent men come forward. They don’t run and these two are running like rabbits.”

“Yes, sir. That’s your area. I just wanted to point out the possibility. Just keep in mind that if they are guilty, they’re doubtless part of a much bigger team. This is very sophisticated. And I really don’t see how they can be doing what is currently taking place from a hotel room with laptops.”

“I’ve been at this a lot of years, Susan. I know crooks when I see them. These two are bent. I can smell it. I’ve alerted NYPD and local FBI. They’ll flush them out, and when they do, they’ll roll over like all the rest.”

“Yes, sir,” Susan answered, her eyes steadfastly planted on her notes.

42

TRADING PLATFORMS IT SECURITY

WALL STREET

NEW YORK CITY

10:43
A.M.

The office was as busy as on any workweek. Bill Stenton scanned the cubicles. Everyone was here. He’d not given orders, but somehow word had spread that this wasn’t a weekend to spend time at home.

He sat back in his chair, swiveled away from his door, closed his eyes, and wondered how things could ever had gone this far. Yesterday had been a disaster. Alshon from the SEC had stormed in with a search warrant and a team of investigators, ostensibly to search the office where the Red Zoya men had worked. In fact, Alshon’s team had been everywhere, eyeing trusted employees suspiciously, looking across desks distrustfully, obstructing the hallways, intruding in the normal flow of work. It had been terrible.

Alshon had made it worse by speaking to Stenton in such a way as to indicate that he wasn’t entirely trusted. Maybe that was an over interpretation, Stenton thought, but the investigator had answered questions with questions and had not taken him into his confidence.

When the SEC was finished, “for now” Alshon said, his team had stripped bare the office Aiken and Renkin had used, leaving nothing but fixtures and the desks behind. What was the point of that other than as a show of power? All the equipment they’d taken belonged to this office but Stenton was in no position to complain, nor did he want to. It was the turmoil and suspicion that troubled him.

Afterwards, he’d gone with his senior staff to a quiet watering hole. The discussion had inevitably turned to what had taken place earlier. From what they’d witnessed and what investigators said, it was apparent that Aiken and Renkin were suspects in a major crime. His colleagues kicked around what they’d heard, talked about it, and decided that this time the SEC was barking up the wrong tree. More than one on his team knew Aiken by reputation and refused to believe he was a criminal. “They don’t always get it right,” one said.

“Yeah, but they always make it look like they do,” another answered.

And that bothered Stenton because he was now having serious reservations about what was taking place. He’d called the colleague who’d recommended Aiken so forcefully and quizzed him at length.

“Jeff’s the best there is,” the man had repeated. “I’ve known him for years. It was a shame he left the CIA, but he’s proved his worth time and again.” The man related two incidents when Aiken had uncovered malware that was steadily looting companies. “You recall that Anonymous hack of RegSec? It was Jeff who figured that out, plus he came up with a way to identify the hacker at the conference he was attending.”

When Stenton continued to express reservations his colleague had told him stories he’d heard, how Aiken had hunted down two cyberterrorists in person, how his girlfriend had been kidnapped by a gang and he rescued her. “He’s as straight as they come,” he’d said. “Check around, Bill. You’ll see I’m right.”

Stenton had declined to say why he’d called but had taken the man up on his suggestion and called two more contacts in the industry, people he’d not talked with before. Both knew Aiken by reputation and both spoke very highly of him.

Now Alshon was telling him that Aiken was dishonest. How could that possibly be true given what Stenton was being told? People don’t just change their nature. Aiken had had plenty of chances to steal before, and in places with far less security. Here, he was all but sure to be caught.

Alshon had let drop that something was amiss in their system and had been for some time. Stenton found that impossible to believe, the harmless bot notwithstanding. The system had performed as expected, and their security measures, the finest in the industry, had detected nothing. Absolutely nothing.

And if Aiken were the guilty party, how could he have managed to steal for a year and then arranged for Stenton to hire him?

It was impossible. There was simply no way he could have hacked their system before he was hired, but that was what Alshon was suggesting. And if it was a coincidence, that was too improbable to even consider. Stenton had conducted a nationwide search for just the right man and ended up hiring the hacker who’d already penetrated his system?

Impossible was the word for it.

Stenton’s head throbbed. He’d kept his drinking under control with his staff but later, at the bar near his apartment, he kept at it until after midnight. He turned slightly toward his desk, picked up the Red Zoya summary, and flipped through it again. The papers quivered ever so slightly in his shaking hand.

Frank Renkin had left this summary of their findings. It was all there. How they’d successfully penetrated the impregnable system. How they’d discovered rogue code in it, code that had been there a year or more, just like Alshon had said. Renkin and Aiken had asked for a face-to-face to go over their findings in detail.

Stenton lifted the last page. The pair had recommended that Stenton get the IT people on the rogue code at once to get it neutralized, then reverse engineer it to determine what it did and how it managed to penetrate their system.

Was that something criminals would do? Hardly.

Then there was the attack on Aiken to consider. One of his employees had speculated that it could be related to his work somehow.

Could it? Stenton hadn’t even considered the possibility until then. But when he finally examined Red Zoya’s summary, he could see plenty of motive for someone to want to put Aiken out of action, though it looked as if they’d moved too late. What if Aiken was on to something and someone decided to stop him? It was far-fetched though not impossible. Assuming that to be true, where did it lead? Who would want to stop him? The hackers obviously, assuming the report was correct.

The first question to consider was who would know Aiken was working here. Stenton had kept the hire discreet and no one knew what he’d been hired to do. His staff had seen the men at work, but Aiken and Renkin were low key, not attracting attention to themselves. Next, and most troubling, was who would know they claimed to have discovered this rogue code? The obvious answer was the one he disliked the most—someone working in this office. Because that meant the hacker was a trusted employee.

Stenton knew all these people; he’d personally hired many of them. He rubbed shoulders with them every day. He’d never experienced the slightest doubt about their integrity. But from long experience, he knew that anyone can violate a trust. He’d seen it before. One of his employees at Wells Fargo had been caught in a pretty basic computer theft. It turned out she had a biker boyfriend who’d given her no choice. So it could happen.

Then there was the media and the frenzy the
Times
article about that bot was causing. The market had taken a real fall on Friday, and the international markets were suggesting it was in for more of the same on Monday. He’d been forced to meet with his boss and assure him that the accusations of the disgruntled former employee who leaked the story were unfounded, that the bot was simply harmless. Stenton’s response, he told him, had been to bring on board the finest team he could locate to conduct a pentest to locate and plug any holes.

He’d felt sick to his stomach defending himself that way, realizing too late that his superior might have already heard about the SEC investigation. Fortunately, the raid hadn’t happened until the next day, but Stenton knew he’d be back before his boss on Monday, trying to talk his way out of all this. His story was losing credibility even to himself. There’d been a harmless bot, he’d hired a company, the men were suspected by the Exchange’s IT department of looting accounts, and the SEC had launched an investigation, searching their office, questioning his staff. He’d heard warrants were outstanding for the pair.

This was his area, he was responsible. It almost didn’t matter what the truth was any longer because events were discrediting him with every passing hour. When it came time for heads, or a head, to roll, he hadn’t the slightest doubt his would be on the chopping block.

Stenton turned away from the door. He didn’t need this, not on top of his usual responsibilities and the endless meetings he was attending about the pending Toptical IPO. He’d never expressed his reservations about the new algo the Exchange was going to use as it had not been his decision and no one had asked. But the test runs had all experienced glitches and there was a pervasive sense of unease he could detect among those responsible for it. The IPO had to come off without a serious problem. With the stock market reeling the credibility of the Exchange was at stake. Too much depended on its success for there to be a failure like that experienced by BATS or even a snafu like the Facebook IPO.

What a disaster that would be, Stenton thought.

On Friday, he was asked specifically about the integrity of the Exchange’s trading platform, and he’d answered there were no problems, despite what
The New York Times
was reporting. Looking back at the Red Zoya summary, though, then recalling the earlier report from the Chicago office, he realized something very likely was amiss. Could it have anything to do with the IPO? There was without question enough money at stake to make it a ready target. And the fact that the Exchange was employing a new algo was common knowledge. The
Wall Street Journal
had dedicated a long article to it. New algos were always a place for shenanigans as the unexpected often occurred, even without interference.

Stenton found himself taking shallow breaths and forced himself to fill his lungs deeply. His uncontrolled eyelid tic was back. His wife had complained about the weekends he was working, among other things. He promised her that wouldn’t happen when he’d taken this job, and now it turned out he’d promised something he couldn’t deliver. And she didn’t even like living in Manhattan.

But Stenton had a more pressing issue, one that had gnawed at him ever since he’d first learned of Alshon’s investigation. Stenton had hired Jeff Aiken. What if, despite everything he’d been told, Aiken was guilty? What if he’d planted this rogue code the previous year?

God, Stenton thought, no one will believe my hiring him was a coincidence. No one. He’d be finished, not just here, but anywhere significant. And he’d deserve it, because it was him who’d let the fox into the hen house.

He glanced at his watch. Too much time. His first drink was at least three hours away.

43

A ROCHA

EDIFÍCIO REPÚBLICA

RUA SÃO BENTO

SÃO PAULO, BRAZIL

12:33
P.M.

A Rocha restaurant occupied the entire tenth floor of the Edifício República. To dine here meant Victor Bandeira did not have to leave the building, and his bodyguards could position themselves inconspicuously near the elevator.

The restaurant was busy as usual on a Sunday. Many of those who dined here regularly brought their wives and families directly from Mass. Bandeira sat at his usual corner table with the commanding view of the floor, acknowledging nods in his direction. He ordered a drink as he waited, wondering why he should be waiting.

He’d been drinking too much lately, he decided. He’d confided his concerns to no one. That was one of the prices he paid for being on the top. There was no one with whom he could share everything. Information was power and the more information he gave away the weaker he became. Such had been his experience.

Carnaval was the most ambitious operation of his career and must succeed. He’d spoken directly with Ramos about it and the man had expressed his unease. “I’m concerned that it’s too much, too fast,” he’d said respectfully.

Bandeira understood, but the allure of $10 billion in a single stroke had been more than he could resist. Now he was committed, and there was no turning back. He was satisfied that Grupo Técnico in Rio was doing what had to be done. Ramos had assured him the same was taking place in New York. Still, it was asking a lot, and though Bandeira gave the orders, he understood he was pressing his skilled staff to the breaking point.