#KillAydaKhoury - Chapter 2
NSA Special Collections
Fort Meade, Maryland
My signals assurance team has gone to the Iranian nuclear negotiations in Vienna without me, and the State of Utah is threatening to retaliate for the domestic spying scandal by turning off the water at the data center and burning our servers to a crisp.
The office is full of Internal Affairs investigators and it’s witch-hunting season, but maybe that’s exactly what I need, if this leak turns out to be internal. There’s a certain surrealism to clocking in and investigating Anonymous, but we’re not supposed to be killers, and Hart's leaked agent is dead.
Monitoring of the Google complex—apologies to Snowden and Manning, I'm really guilty—tells me YouTube had an execution video up before they took it down ten minutes ago.
My counterpart at CIA’s end of Special Collections has messaged me to tell me Hart should be on a plane home from Ankara.
The phone rings and I put on my syrupy Ventrilo gaming-voice for CIA. I'm viralpanacea and I'll be your healer today. "Ayda Khoury here."
"You gave that talk about tracking people by cellular hardware identifiers?" I feel like I should recognize the man's voice.
"I want you to find someone. Alex Hart never made his flight."
He wants me to try the cell phone tracking I talked about last year at DEF CON, the one my mom wants me to use for Samir. The kidnappers could have thrown Hart’s phone out, but they’ll expect the Chief of Station's contact list to be valuable if nothing else. Odds they kept it are pretty good.
They could have pulled out the battery. Please tell me Hart had a smartphone with a captive battery.
"Who am I talking to?"
"Jasper. Global Investments.”
Global Investments is a local pseudonym for CIA, and I recognize the pseudonym Jasper. He's not a hacker or cryptographer; he's everything wrong with CIA. An Iran-Contra arms-for-hostages negotiator whose verdicts came out not guilty--but made him infamous and confined him to a declared embassy desk for the rest of his career. I'm obligated by policy to call him by his CIA pseudonym, but everybody knows who he is. Jasper’s real name is Jack Kolda, a bureaucratic snake whose hostage negotiating history put him across the table from the current Iranian President, years ago when the President was just an up-and-comer political functionary. Now Jack Kolda's the appointed chief negotiator for Vienna.
"Hi Jasper." I keep the sweet Vent voice on. No one wants to make enemies in Langley with the investigation going on. "What kind of phone did Hart have? And was he on Turkcell, Avea, or something weird? I need his phone number, and if you guys ever had the IMSI, it would help." I remember who I'm talking to. "That's the International Mobile Subscriber Identity."
"I'll find out." He hangs up.
My phone buzzes. An email address I don't recognize, and not a one-use like my friends might use. Subject line: It's Samir, he took my phone.
Thank God. He’s talking to me after all. Right there is why I sold out for a solid government paycheck, more money than our parents, and math problems so big they've got their own gravity. And I don't even get to go to Vienna.
If I ever see my little brother again I'm going to kill him.
I email back: Where are you?
He writes: Library. He let me come to school. He thinks I'm on his side.
I don't actually have any verification it's him. If Dad were setting me up, he would have texted me from Samir's phone, wouldn't he? That would tempt me to call back for voice recognition; he wouldn’t do that. He would have used Samir's normal email, wouldn't he? No way he doesn't have the password to it.
I write back: Are you on mine?
It's a dangerous thing to ask. If it's our dad spoofing Samir, he'd have ammunition to say Mom and I were plotting against him.
See, it's not custodial kidnapping, Samir consented. And he went to school and everything. Even if it was a couple of days later.
So if it’s really Samir, I could have evidence he's an unwilling kidnap victim, no matter what he says in court. A hostage will say anything they're told. I would know.
The desk phone rings.
"Please tell me it was an Android or something," I say.
"I need you to come up here." Not Kolda. NSA legal office.
"Sorry, can't yet. I've got the Ankara leak."
"Is it about the custody hearing?" I asked the Agency's chief counsel for legal advice for my mom after her last lawyer ignored the abuse and advised her to settle for a mutual restraining order and joint custody. Mark Laurent the chief counsel recommended us a family lawyer, a classmate of his from Yale, who's still fighting for us. I know Laurent’s friend is lowering his rates for us. Even so, it's where all my money and Mom’s goes, and I owe Laurent too many favors I haven't figured out how to pay back.
"No—" he starts.
"God, don't scare me like that. I've got to go. I'm really sorry."
My phone shows no notifications, only my lock screen image of an Iranian protester holding a sign denouncing former President Ahmadinejad’s idea of interal economic relief. The sign says DOWN WITH POTATOES, featuring the word the press always translates DEATH, as in DEATH TO AMERICA.
I refresh my email app. Silence. Samir got caught using the school library computer for email, or the period ended and he had to go to class.
The office line rings.
"Samsung Rugby 4, on Turkcell," says Kolda. He gives me a phone number. "Station didn't record the IMSI."
A flip phone. Figures Hart would be a good spy; no smartphone for him means no application layer data for me from location-based services. No wifi requests either, so no tracking by the BSSID.
The methods from my DEF CON talk aren't going to work here.
"I have to give a briefing in two hours," says Kolda, "Tell me something I can use."
Kolda isn't CIA's Special Collections liaison and doesn't really have the authority to order me to drop everything and look for CIA's missing officer, but I'm going to pretend I didn't know that, if it means I get to save somebody for a change.
I can use a paging request exploit on Turkcell's GSM network to at least find the phone, whether it's still with him or it's been handed off by the kidnappers, but to do that, I need one like it. We have all kinds of cutting edge equipment in this place, but what I can't just check out from the depths of Stores is a flip phone from the 20th century.
I put Kolda on hold and send an office email round Special Collections:
Friend of Jasper's at the Other Government Agency is missing, pls send help + Samsung Rugby 4.
It doesn't matter what I think of Jasper, it matters what they think of Jasper. This town—the borderless power exchange called Washington—runs on what we call wasta at home and quid pro quo in the white Washington political complex.
I rescue Kolda from the hold music while I wait for an answer. "I need somebody at Ankara Station to talk to me, and listen for a paging request I'm going to send."
Kolda worked Ankara Station once. It's case study stuff now, common knowledge. The arms-for-hostages hearings forced him into a long run as a declared desk spy. That's Washington justice. Not even a commuted sentence.
Waiting. Waiting for Samir and waiting for a flip phone. Who were you, Alex Hart? The files I can access tell me he had diplomatic cover. My joint Special Collections resources with CIA tell me Hart’s real name is Raoul Felice, but he's got a Facebook page under the pseudonym, a profile of a whole diplomatic corps life under a fake name, and a daughter who let him friend her on Facebook. He’s got photos taken with friends in Ankara under the name Hart. He mentions a wife but he's got too much class to use her name online. This profile's friends must all be diplomatic corps. They don't use her name when they post either.
Mark Laurent the chief counsel emails me: When you get a chance, come up to my office.
Am I in trouble? Whatever Laurent wants, it's the kind of thing he can't or won't talk about over company email. I mentally go over the list of what that could mean while I head down into the depths of Stores to fill out carbon copy paperwork to borrow a modem. All the latest toys at our fingertips and what I really need now is a dialup modem. The guy working the desk looks at me funny, like he knows something I don't, and I catch myself second-guessing my whole method even though I haven't mentioned the details to him.
Is Laurent making me testify at someone's LOVEINT hearing?
I'd do it. Stalkers get jail time.
What if he found out I was—am—Anonymous?
When I get back to my desk this hipster girl, the type to carry a flip phone, is leaning on the back of my chair, waiting for me. Her badge color says cryptography and her perfect makeup says new enough to be trying to impress. She holds out a Rugby 4 to me, then retracts her hand.
"For Alex Hart?" she asks.
Yeah, okay. I can't blame her for wanting to know or wanting to feel like a hero. I nod.
She hands me the phone. "No firmware changes, no taking it apart. It’s not from Stores; it’s mine.”
She should know better. Hardware that’s been in other hands is good as rekt.
"Nope. No changes. Thanks—"Her badge says Brooke Kinman. "Brooke. I'll remember." I give her a facsimile of a confident smile. Washington wasta. Two years ago I was her, or at least I would have been if I were skinny and blonde.
She hovers and waits with me until Ankara Station calls me back. With a phone like Felice's, and ATDT commands issued to my dialup modem, I measure the time delay between call initiation to this phone from a public switch telephone line and the moment it actually rings. Dad was an old-school phone phreaker. It's the kind of thing he would have done—destructive thought pattern. Stop. Run script.
I'm looking for the paging channel request on the PCCH, the broadcast downlink channel all cell phones listen for, to the handset. Mean delay 8.8 seconds, median 7.0 seconds, standard deviation 4.5. 5 seconds ensures the paging signal has consistently been sent. It can't be long enough for the handset to ring or his kidnappers will know what I'm doing.
"I'm sending it," I tell my counterpart at Ankara Station. "Tell me what you get."
I send the command to Hart's phone and count. 5...6...disconnect. Paging signal sent.
"I see it," says the male voice on the other side of the world, "I've got a shortlist of IMSIs for you; do it again."
There it is. Now we have an IMSI for Felice's phone and we can track the hardware instead of the number. We know what tower his phone is listening to, and I can hear the officer on the other end summon someone and pass the information along.
Twenty plus hours after his kidnapping, what are the odds it's still with him?
"Okay next trick," I say. Just in case Ankara Station can't get to him fast enough or they leave the phone on but ditch it somewhere. "Who's with him?"
We can see who's on the same base station transceiver as him, but that only gets us a long list.
Kolda, impatient, calls back on the other line. I recognize the prefix as a White House line. "What have you got for me?"
"I've got a list to work with—"
"The President is under pressure to give a statement. Give me more than that, even if he can't say it on television. This one's a career maker, Khoury."
Cold-hearted bureaucratic bastard. "We've got IMSIs; I'll see if any of them are people we've collected from before, but I can't promise you—"
"I'll spin it. Call me," he snaps. "Even if I'm still in the briefing."
"Yessir." I get the feeling if I don't deliver it'll be time to polish my resume. For government contractors I DDoSed when I was a kid. No one else would touch a guilty domestic spy with a 40-cubit pole.
I set the database looking for the new list of IMSIs and finally head for the legal office, with marching orders from Brooke to tell her what I find. I owe her that much.
Laurent probably wants to talk about how this leak happened. We're all going to be polygraphed again to satisfy IA we're not the leak, like they did to find out who shared their passwords with Snowden. I've survived all the polygraph tests and IA questioning, even the ones that asked me about Anonymous. Growing up with my father taught me to lie.
"Sit down and shut the door." Laurent takes off his glasses, rubs the bridge of his nose for a second before putting them back. "The NSA would like you to testify at the congressional hearing, on the subject of domestic surveillance and friendly spying."
"Anon just outed an officer in Ankara—" He wants to talk about the Snowden leaks? Now?
"This is a criminal investigation, but it's an investigative hearing, not a trial. You have the right to an attorney, but I wouldn't—"
"Isn't that you?"
"I'll be attending," he says, "but my role is to represent the NSA, not you."
"What do I do, call the ACLU? They'll burn me at the stake for working for the NSA." I don't have the money for this. When I got this job I felt rich. I socked away money for the divorce lawyer, I put down a deposit on an apartment for Mom and cosigned the lease. The savings are almost gone, and Dad still sends me emails accusing me of talking Mom into filing for divorce and threatening to get me fired from NSA for spying on him. I'm not even guilty of that. I should have been. I might have caught Samir.
"If I were you I wouldn't seek legal representation. These things blow over; You'll be allowed to come back to work eventually..."
He'd better just mean I'll have to take time off for the hearing, and he's asking me to give away my rights but you don't talk back to authority, especially authority that's done something for you, so I keep my mouth shut.
"These hearings are common. It will go better for you afterward if it doesn't look like you thought you had to defend yourself from the Agency."
"Why'd they pick me?"
"I'm going to guess it was the office email that said 'I cracked Google, exclamation point, exclamation point, one, exclamation point.'"
"You read my mail?"
"Don't you read mine?"
No, actually. Add him to the list of people I should have been spying on if I'm going down for this. "Was it even illegal? Why didn't you tell anyone it was illegal?"
"It was completely legal. We're covered by the FISA Amendments Act and Twelve Triple Three."
"Then what are they doing?"
"Truth be told? Trying to find a scapegoat ahead of the primaries. Nothing's going to come of it; it's just political jockeying. You'll be put on temporary administrative leave. Your access to privileged information will be temporarily revoked; it will be restored when this is over."
"What about Alex Hart?"
"Ankara Station will go after Alex Hart."
Sometimes I think the biggest crime in government is giving a damn.
"I have an IMSI search running downstairs. Hart's kidnappers—"
"Special Collections will deal with it."
I'm at least sharing the search results with Kolda.
Laurent opens the door. The interview's over. Physical security is waiting in the hall to escort me off the premises.
They take my badge and march me past wide-eyed technicians who wonder if they’re next. Security drives me all the way to the Visitor Control Center and they're not discreet and everyone thinks I did something wrong and they're right and all I did was what I was told to do, sat in Milgram's room and pushed the button, like all those people rootcrysis and I would have mocked mercilessly for having no will and no spine.
I don't even get to find out if the IMSI search found anything.
How did Kolda survive his Congressional hearing? It was a long time ago, closed and under pseudonym, but it was famous, entry on Wikipedia famous, and he even got to be chief of Ankara Station before it made the complete circuit of Washington and leaked out into the press that Jack Kolda was Jasper was COBALT and the Agency decided he was unsafe, rewarded or punished him with a desk in Langley. I don't think I'm supposed to talk about the investigation, so I don't call. He's probably giving the briefing anyway.
I walk to the stop for the 202 and ride all the way to the Red Line train station to make the two hour trek into Langley. I used to wear my NSA badge on the bus lest somebody look at me like I was a terrorist casing Fort Meade. I'm glad I don't have it now, or someone will realize I'm the NSA Eye of Sauron who spied on them, because they might be terrorists or because we were ordered to or because it was awesome to be able to stand in front of the deputy directors for Special Collections and tell them how I cracked Google and found a way to track IMSIs. They even sent me to DEF CON when NSA was allowed back again.
I thought I would get to go again this year and take another shot at the Über Badge. Stop. Destructive. I will go, because the hearings will be over by then, and I'll get to say something nice about using a paging channel request to save Alex Hart, because he'll be alive.
Who else can check IMSIs for me? North Ridge Consulting. The private intelligence contractors are all still reeling from the publicity damage Ed Snowden did by existing, but North Ridge has an NSA liaison, Joseph Hodges. The line rings and rings and a woman's voice picks up. "This is Farah."
"Raked over the coals for the leak."
"Crisis meeting with everybody else."
"Why not you?" Who are you?
"Haven't had access long enough."
"What are you doing in Hodges' office?"
"Unpacking. Who's this?"
"Ayda Khoury, NSA."
"Ayda Khoury, you're thoroughly burned here. Toxic."
I don't believe you. I don't believe everyone in Washington knew this was coming but me, or that it happened this fast. "What's his new extension?"
She gives me an extension number. "If you like him, think about whether you want to compromise him by calling for help while you're under investigation."
What if she's right? Kolda wouldn't have given me Alex Hart if she was right, unless maybe NSA got the idea from North Ridge. Unless NSA asked North Ridge who could be exposed as guilty even though Ed Snowden tried not to give names. Who they could throw under the bus for the primary. Or Hodges or somebody had something to gain because, like Kolda said, this is a career maker.
"Hey," I ask her, "Is North Ridge chasing down the Alex Hart thing?"
"I'm afraid I can't discuss that with you." There's a snap in her voice I recognize, the same tightness when Mom tried not to say Dad had punished her for something I'd done.
Like Alex Hart is already dead and there's nothing to do but keep it from the world.
Just teasing, honey. Nothing serious.
"Jasper and I have got IMSIs—" I tell her.
"Global Investments Jasper?"
"Yeah." I feel weird suddenly, having this conversation on the Metro. Even though I haven't said anything that's actually secret, just hearing her talk about the CIA on my cell phone gives me the creeps. Secrecy mythology.
Her outlook does a 180. "What do you need?"
I want to tell her, but how do I trust someone sitting in Hodges' office, with new access, too eager to help me?
"I need to know who I'm talking to."
"Ask Jasper. If you can help us find Alex Hart you'll be invincible. Tell him to call Silver at North Ridge. Tell him it's Farah these days." She politely disconnects.