The Operative (13 page)
Authors: Andrew Britton
CHAPTER 8
WASHINGTON, D.C.
F
acing the Pentagon from the green, tree-clustered slopes above Bolling Air Force Base, the Department of Homeland Security’s vast new 4,500,000-square-foot facility occupied federal land on the west campus of St. Elizabeth’s Hospital in Washington, D.C. All bald concrete and glass, it housed more than sixty DHS offices, which had been previously scattered across Washington, Virginia, and Maryland, though the vast majority had been relocated from the department’s original temporary headquarters at the historic Nebraska Avenue naval complex across town.
acing the Pentagon from the green, tree-clustered slopes above Bolling Air Force Base, the Department of Homeland Security’s vast new 4,500,000-square-foot facility occupied federal land on the west campus of St. Elizabeth’s Hospital in Washington, D.C. All bald concrete and glass, it housed more than sixty DHS offices, which had been previously scattered across Washington, Virginia, and Maryland, though the vast majority had been relocated from the department’s original temporary headquarters at the historic Nebraska Avenue naval complex across town.
It was here that the National Operations Center, or the NOC, worked year-round, twenty-four hours a day, seven days a week, to monitor, protect against, and manage foreign and domestic threats to the United States under the umbrella of the DHS Office of Operations Coordination and Planning. While it shared some similarities with the FBI-SIOC synergy, the DHS-NOC relationship was a much more separate and different wheel on the massive wagon driving the nation’s homeland security efforts. Thus, while SIOC served as an intelligence hub for law enforcement and investigative agencies, the NOC was the focal point for information flowing between state, regional, and tribal governments abroad, as well as private infrastructure elements—power and telecommunications grids, mass transit companies, airlines, school systems, hospitals, and other essential service providers. The idea was for these wheels to spin in smooth coordination and keep the wagon moving forward, rather than flying off its axles when things got bumpy.
Despite all the happy talk about cooperation, there were still rivalries between the subsystems in each of the branches. SIOC and the NOC competed for funds and thus competed with one another. Brenneman had learned that early on, which was why only SIOC had a voice in today’s meeting. But that did not mean the NOC hadn’t turned its considerable resources on the convention center attack.
The NOC’s Social Network Monitoring Center, or SNMC, was located on the second floor of the building, in a large, nondescript room with rows of computer workstations along the aisles. Established in 2008, the unit monitored social media networks and other public Web sites for information related to terrorist activities. In accordance with Constitutional privacy guarantees, the NOC was barred from setting up fraudulent user accounts and was restricted to utilizing publicly available search engines and content browsers. But its Web-based platforms had been configured to skim through and pluck potentially valuable morsels of intelligence from Internet traffic.
Of the social networks, Facebook, Twitter and, to a lesser extent, Myspace—with their combined 800,000,000 unique monthly visitors—received the most attention, although there were scores of other personal and professional networking sites, from Plaxo to LinkedIn, which accounted for millions of additional users. Also identified, sorted, and analyzed were scraps of information collected from blogs, news sites, online forums, and message boards that might, in NOC parlance, contribute to “situational awareness and establish a common operating picture” of a particular threat or event.
On the day of the Baltimore Convention Center attack, DHS 10:00–5:30 action officers Dick Siegel and Clare Karl were preparing to carpool home to the Arlington County suburb where they both lived. Workers on the 5:30–1:00 shift were just beginning to arrive. They exchanged quick, impersonal hellos with their daytime counterparts. All the shifts shared desks, which limited the personalization and added to the sterility of a room that was already function oriented.
It was Siegel’s turn to drive, and he’d been about to grab his cell phone from his desk when there was a three-tone computer ping alerting him to a “situation.” He glanced at the leftmost of his three monitors, the one earmarked for general use, and saw the red-boxed “alert” prompt.
“Got something,” he told Karl, who was already watching other officers checking the update. She stepped behind Siegel as he leaned over the keyboard.
“Hope it’s not important,” she said. “I have a T-ball game to get to.”
“I think we’re playing you,” Siegel said.
Almost as soon as word of the attack reached the NOC, the first dribbles of intel began coming from the center. The SNMC’s automated software applications, or web robots, generated hundreds of meta tags that enabled them to sniff around for suspicious or otherwise noteworthy keywords, and the ones that got the Twitter bots hopping at approximately 5:15 p.m. that Sunday evening were all of a kind:
explosion, blast, bomb.
explosion, blast, bomb.
“What the hell is this?” Siegel wondered aloud as updates came up on the other two computer screens.
Karl had moved to her desk.
“You seeing these tweets?” Siegel asked.
Sitting at the workstation on Siegel’s right, Karl was nodding slowly. “I think we should report this to—” She suddenly interrupted herself. “Holy Mother of God, Dick. Look at the TA board!”
Her eyes had snapped up to a sixty-five-inch flat-panel angled downward from the top of the wall in front of her, where the national threat assessment level was on constant display. It had jumped straight from “guarded” to “severe,” bypassing the “high” alert advisory.
She looked at Siegel and he at her, but only for a moment. They had been here several years apiece and had never seen that kind of leap.
It took only seconds for reports of what was happening in Baltimore to flash across the lower third of their screens. These were identified by their sources: Fox News on top, CNN in the middle, MSNBC at the bottom. At the same time phones throughout the room started ringing, beeping, and singing, and there was a low hum of voices talking to sources, superiors, and one another. The room crackled with portent; this was why the unit had been formed, its reason for being, validation for all the stiff necks, sore backs, and strained eyes that went with monitoring Internet chatter day after day.
Siegel felt like he had as a boy of ten, a budding fisherman in a deep pool of water who’d suddenly, unexpectedly felt his boat rocked by something big and powerful. He knew, now as then, what he had to do, what his father had trained him for. But in an instant he was no longer navel-gazing in dreamy tranquility but was aware of the much bigger, much more active world around him.
For NOC cyber-snoops, the responsibilities and protocols of data collection during a crisis were well defined. Each action officer had a preassigned duty, and Siegel’s was to trawl the Twitter feed, capturing and sorting meta-tagged updates of interest while scanning subjects trending within Twitter’s own network. This was a simple matter, since trending topics were determined by commonly repeated terms that were either user hashtagged or detected by Twitter’s internal search bots. Twitter then listed these on a home-page sidebar that could be set to view either worldwide or localized trends.
Siegel had picked up on the tweets from Colwriter123 early in his search. Showing up on the network as frequent re-tweets—when one user copied and posted another user’s message to disseminate the information—they appeared to originate from the convention center. They had been floated to the top by the scan programs because there was an event taking place with a larger than normal number of dignitaries from the D.C. area. Now that he looked at the latest tweets, they seemed to give very precise information about what was going on inside the center, even indicating where a particular group of hostages had been segregated.
Appeared
and
seemed
being the operative words, because Siegel had to allow for the possibility that the tweets were part of a ghoulish hoax. His gut told him they weren’t, though, because a number of the abbreviations Colwriter123 had used were not standard and they came at irregular times, as though the tweeter were trying to impart information in a hurry. Fully 80 percent of faux tweets could be ruled out by those two criteria.
Appeared
and
seemed
being the operative words, because Siegel had to allow for the possibility that the tweets were part of a ghoulish hoax. His gut told him they weren’t, though, because a number of the abbreviations Colwriter123 had used were not standard and they came at irregular times, as though the tweeter were trying to impart information in a hurry. Fully 80 percent of faux tweets could be ruled out by those two criteria.
Added digging reinforced Siegel’s initial conviction. According to his user profile, Colwriter123’s real name was Colin Dearborn and he was a journalism major at the University of Virginia, a self-described “new media evangelist.” The profile page also bore a link to a column he wrote for the school newspaper, where a peek at his most recent piece revealed that he had been planning to tweet what he termed “live dispatches” from the career fair at the Baltimore Convention Center.
That essentially clinched the tweets’ authenticity as far as Siegel was concerned, but to add further confirmation, he went back in Colwriter123’s timeline to search through the updates he’d posted in the hour or so leading up to the attack. Colwriter123 had been a busy, prolific correspondent during that period, tweeting about everything from the degree of courtesy and helpfulness at individual booths to the high price of fast food at the concession stands. He had even included observations on security lapses, which Siegel himself found troubling, and had hashtagged his tweets with the term
#BaltimoreCareerFair
to make them easy to follow. From the event mark forward, Colwriter123 had been sending updates that read like combat reports from the front lines. The kid was impressive: not only did he have courage, but he was showing a composed, perceptive eye for what was important.
#BaltimoreCareerFair
to make them easy to follow. From the event mark forward, Colwriter123 had been sending updates that read like combat reports from the front lines. The kid was impressive: not only did he have courage, but he was showing a composed, perceptive eye for what was important.
Running down Colwriter123’s post-event timeline, Siegel examined the replies to his tweets from other users. Each of these showed the respondent’s username after the @ symbol, enabling Siegel to click on his or her profile and see whether it offered anything of interest. Like criminals returning to the scene of a crime, terrorists were known to follow reactions to their sociopathic activities.
The tone of the responses ran the predictable gamut, ranging from deeply concerned to callously idiotic, but Siegel didn’t immediately see anything useful in them. Then he noticed repeated tweets from someone with the username AlDearborn
.
A relative, possibly the young man’s mother. The posts looked like direct communications with the kid from someone who was trying to help him, which was more than enough to grab Siegel’s eye on its own. But the most recent post made him stare at the screen with acute fascination, a long, low whistle escaping his lips.
.
A relative, possibly the young man’s mother. The posts looked like direct communications with the kid from someone who was trying to help him, which was more than enough to grab Siegel’s eye on its own. But the most recent post made him stare at the screen with acute fascination, a long, low whistle escaping his lips.
“You got something?” Karl asked.
“Maybe.”
She was too involved in her own research to look over. Siegel read the tweet again. It had been sent just two minutes ago, according to the timeline, and it read:
Leave yr phone somewhere w/vol LOUD. In 5 min. it will ring, DO NOT answer. #BaltimoreConventionCenter // Stand by.
Siegel hastily clicked on the user’s account profile. It belonged to Baltimore psychologist Allison Dearborn—and she was CIA. But what was the purpose of those instructions she gave him about his phone? The hashtagged term had popped out at him, too.
Baltimore Convention Center.
Ms. Dearborn had clearly wanted her tweet to attract the attention of someone other than Colwriter123. Someone a CIA employee must have hoped would be monitoring Internet traffic for messages from the center.
Baltimore Convention Center.
Ms. Dearborn had clearly wanted her tweet to attract the attention of someone other than Colwriter123. Someone a CIA employee must have hoped would be monitoring Internet traffic for messages from the center.
Someone like himself.
He was not about to sit around guessing, nor did he intend to just flag the tweets and kick them upstairs. These looked much too critical.
“Clare, hold the fort. I’ll be back,” Siegel said, springing from his seat.
Karl looked at him inquisitively. “What is it?”
Siegel didn’t answer. He was already hustling up the aisle, feeling like a ticking clock thundercloud had just appeared over his little boat on the pond... .
Word reached Max Carlson in a circuitous fashion, which was unbecoming for the secretary of Homeland Security.
With his cell phone deposited in the small lead-lined cabinet outside the woodshed—which was what Carlson and other old-timers called the Situation Room—he’d been out of touch with the Office of Operations Coordination’s acting director, Joseard Levy, who had oversight of the NOC and was responsible for keeping Carlson in the loop. Under most circumstances, Levy would have left Carlson a routine voice message. For a higher priority communication, Levy would have routed a call to the Situation Room, where a watch officer would have informed Carlson of its receipt; if the secretary felt the message warranted an immediate callback, he would excuse himself from the presidential huddle and return the call from one of the encrypted privacy phones that sat in soundproofed booths outside the conference room. But the information that had come out of the NOC was of such crucial importance that DHS protocol required it be conveyed directly to the president himself in the event that Carlson wasn’t immediately available.
That was precisely what occurred, even though Levy was always kept informed of Carlson’s whereabouts and had known he might be found not 10 feet apart from the president inside the Situation Room. So when a watch officer called to inform Brenneman that OOC director Levy was on the phone with urgent news, Carlson couldn’t have realized it was coming from his own department, least of all Joseard Levy, his right-hand man.
The call lasted less than a half minute, during which time the president said nothing other than “Yes?” when he picked up and “Thank you” when he put down the receiver. Then he briefed the others. The Homeland Security chief hadn’t viewed it as a personal slight; ego had nothing to do with this. It just felt odd to have the commander in chief tell him what his own people had learned: that within the last five minutes instructions were sent to one of the hostages, Colin Dearborn, a student at the University of Virginia, from an account belonging to his aunt Allison Dearborn.
Other books
Casca 22: The Mongol by Barry Sadler
Stealing Magic (Vampire Primes) by Susan Sizemore
Surreal (Divine Trilogy #3) by R.E. Hargrave
Rebel Elements (Seals of the Duelists) by Giacomo, Jasmine
The Immorality Engine by George Mann
Lucky Bang by Deborah Coonts
The Rancher and the Redhead by Suzannah Davis
Tex by S. E. Hinton
Guarding Mari by Ella Grey
The Real Italian Alphas by Bonnie Burrows
