Ghost: Page 14

  She eyed him. ‘I thought you were tech-ops at MI6. Field support and that kinda thing.’

  ‘I was. See, Arquebus was part of a cross-agency initiative involving all the UK actives. Six and Five, GCHQ, Defence Intelligence, even SO15 were read in on it . . . I was part of a group from K Section at Six, brought in to assist on the design. We were going to build the software tool equivalent of a Special Forces operative. Configurable for any threat environment. Highly adaptable . . .’ He paused, letting out a sigh. ‘Shamoon. Crash Override. Stuxnet. Any of those names mean anything to you?’

  ‘I heard of that last one,’ said Lucy. ‘Computer virus. Used in an attack on Iranian nuke enrichment plants, back in 2010. Screwed with their systems.’

  ‘Basically, yeah. But it’s more complex than that.’ Marc gestured at the screen. ‘So, Stuxnet was – allegedly – developed by the US and Israel to throw a spanner in the works of Iran’s nuclear weapons program. They wanted to stop them refining bomb-grade uranium in violation of UN treaties, but putting airstrikes on the labs wasn’t a viable option. Mostly because no one knew for sure where all the Iranian facilities actually were.’

  ‘They deployed this virus instead?’ said Delancort.

  Marc nodded. ‘Yeah. It could attack not only the sites that were known to exist, but the ones that were hidden as well. Stuxnet penetrated the industrial command systems of the nuke plants and broke them from the inside out. It was clever. It used multiple zero day exploits to get in and do damage subtly. If it hadn’t been for some computer security nerds catching on, it would never have been found. Iran had their own version, Shamoon. They used it on the Saudis to mess with petrochem plants and bank servers—’

  ‘I would appreciate it if you were less free with the technical jargon,’ Delancort broke in. ‘What is this “zero day”?’

  ‘It’s a critical software vulnerability,’ Marc noted. ‘Deep in the code, a bug that the original programmers missed. It’s like finding a loose brick in the wall that only you know is there. Marry that to an agile malware program and you have a way to get in and kill an entire computer network, if you apply it correctly. Stuxnet worked like that, and Arquebus was designed to do the same. You could plug in a zero day the same way you’d load a warhead on the tip of a missile. Aim it at the target, and . . .’ He trailed off. ‘The British government saw what happened to the Iranians and they wanted the same offensive capability.’

  ‘Which begs another question,’ said Delancort. ‘Why did Wetherby have a copy of it?’

  Lucy watched Marc’s expression harden as he framed his reply. ‘Because I think . . . I think that Ghost5 stole it.’

  *

  Project Arquebus had been, in the end, a bloody mess.

  A few months before the Palomino incident, the horrific explosion on board the freighter in a French harbour that had killed the rest of OpTeam Nomad, Marc Dane had been seconded from his unit to the Arquebus programming and evaluation group. In a blandly modernist office block in Cambridge, concealed behind the false front of mobile app developer, a covert software design lab operated under the aegis of GCHQ. Marc was there to provide a field technician’s point of view on the final stages of the software’s development, evaluating and refining the program that MI6 and the other agencies had collaborated on.

  Marc recalled that he didn’t rate the idea that much. Arquebus was meant to be a jack-of-all-trades, capable of pure digital espionage, directed attack or subtle sabotage as the mission demanded. But it was master of none of those theatres, in danger of becoming a cobbled-together compromise instead of the sleek do-everything weapon desired by the grey men on the Joint Intelligence Committee. He contributed where he could, but the project wavered on the verge of cancellation.

  Until one rainy night, when a massive digital attack came out of the depths of the dark web and hammered down the lab’s firewalls.

  Marc saw it happen. He remembered the raw panic in the room as the security team watched the spikes of malware blow through their defences and commence a vicious ‘wiper’ assault on every database in the building. It was the virtual version of a scorched-earth raid, a critical mauling of the lab’s network that erased the contents of each hard drive it touched.

  When it was over, Arquebus was in pieces. Backups of earlier prototypes still existed on GCHQ servers, but they were incomplete and only partly functional. The lab’s security had been thought impregnable. To reconstruct the software would take months, but in the wake of the penetration of the network, the focus moved fixing the blame rather than any meaningful recovery of the project.

  Spurred into action, MI5 uncovered evidence that one of the cover company’s software engineers had a connection to a known cut-out for the Chinese Ministry of State Security, and the situation quickly escalated. GCHQ’s vetting procedures were called into question and co-operation between the British intelligence agencies faltered. Within weeks, responsibility fell at the feet of a group known as Unit 61398, the cyberwarfare division of the People’s Liberation Army.

  Marc went back to Nomad, and while the Arquebus project group struggled to rebuild, the hawks in the JIC demanded a direct and forceful response to what they now believed was a pre-emptive digital strike by China against the United Kingdom.

  The rest of the story had come to Marc in pieces, through hearsay and dark rumour. One of 61398’s top hackers died in the toilet of a Singapore casino from a bullet though his right eye; in return, MI6’s OpTeam Javelin lost half their number during a mission in Hong Kong when they were ambushed by a trio of PLA shooters. Eventually, the trail of tit-for-tat attacks between the Chinese and the British were stalled by clearer heads before the conflict could intensify. Both sides reluctantly declared the scales balanced, and backed off.

  The ceasefire also sounded the death knell for Arquebus. The program was shut down, the funding behind it diverted elsewhere. Forever tainted by the fallout of the attack and the deaths that had followed it, the unfinished project was buried. GCHQ went back to the cheaper option of collaborating with the Americans on building their digital espionage tools.

  But no one had ever really believed the men in Beijing who swore that the wiper attack was not their doing.

  *

  ‘The fact about Ghost5,’ Marc said bleakly, as he concluded his story, ‘is that they have a track record for this kind of operation. The clue’s in the name, right? Ghosts. They move around without leaving a trace, except when they want to. And if they don’t want to be known for whatever they did, they find a way to point the finger at somebody else. They did it with the FSB a while back, leading the Russians down a blind alley after a bunch of Chechen separatists . . .’

  ‘You reckon Ghost5 did the same to the Brits with this Arquebus hack?’ said Lucy.

  ‘Yeah.’ He glanced at Delancort. ‘That could be it. They left false leads for MI5 to follow. You said Kara used to be with them, right? So she had to have been there when the Cambridge lab was attacked. She’s got the skills – enough to have concealed Ghost5 duplicating the Arquebus software under cover of wiping the network.’ Marc scowled at his own conclusion. ‘I dunno, maybe someone paid them to do it, or maybe Ghost5 were acting on their own. But it fits the circumstances.’

  ‘She never said a word about it.’ Marc watched Lucy turn a glare on Delancort. ‘And you kept that part of her past hidden from the rest of us.’

  ‘Kara’s contract with Rubicon has – had – a number of very specific clauses,’ noted Delancort. ‘Her new identity was one of them. The concealment of her previous exploits was another.’ He met Lucy’s gaze. ‘We all have history that we would rather leave behind, n’est-ce pas?’

  The hard truth settled on Marc as his thoughts drifted away from the moment. Kara was someone he had put his trust in, not only during the operation in Chamonix but many times before. If not for her being part of the Rubicon team, the Special Conditions Division might not have stopped the bombing in Washington, the plans of a pira
te warlord to set off a nuclear device in the heart of Europe, or any one of the other threats the SCD had quietly neutralised.

  But he had been burned before, in his time at MI6, when traitors within his own team had revealed themselves. Perhaps it had been naive to believe that couldn’t happen again within Rubicon’s close-knit ranks.

  Delancort was right. Everyone in the SCD had come from somewhere else, dragging the legacy of past misdeeds and mistakes behind them. But as Solomon promised, it was a place for second chances. Now that sentiment seemed hollow.

  ‘Dane.’ He looked up as Delancort addressed him. ‘Some of the data we found on Kara’s secret partition shows evidence of incoming email messages from a blind server, the same one Wetherby used to reach out to the smuggler, Kyrkos. But she deleted them all and never responded.’

  ‘She blanked him?’ Lucy considered that. ‘Why? She didn’t want contact from someone in her old life, or . . . what?’

  Marc remembered the look on Kara’s face when he had returned to the staging point in France. She had to have known then. Right at that moment, Kara had been putting together the pieces of the lie she needed to get Marc to help her.

  Why didn’t she just ask me? The question pushed to the surface of his thoughts. Kara had spoken about trust. That was the point around which all of this orbited. She couldn’t trust me with the truth about Ghost5 because she knew how I would react.

  ‘All we can be certain of is that Wetherby was killed for the data you found,’ Delancort said, nodding toward Marc’s laptop. ‘If he met with Kyrkos, it is because he had something to trade.’

  ‘You said Arquebus was incomplete when it was taken.’ Lucy looked to Marc for the answer. ‘So what value would it have?’

  He shook his head and tapped the screen in front of him. ‘Here’s the thing: the software on Wetherby’s drive isn’t what was copied from the Cambridge lab. It’s more than that. This is like, Arquebus 2.0. It’s a finished version. Shit, it’s better than the original design!’

  ‘So all this time Ghost5 have been . . . improving it?’

  ‘Yeah,’ Marc said grimly. ‘There’s code in the program configuration for targets, internet IP addresses that would act as the virtual front door of whatever they wanted to attack.’ He worked the keyboard, highlighting a section of data. Strings of numbers scrolled down the wall-screen, blinking blue. ‘There’s a bunch here that correspond with physical locations in Germany. Dusseldorf, Cologne, Berlin. Another cluster halfway around the world in Taipei. And here, San Francisco.’

  Lucy became very still. ‘There was a massive power outage when we were in San Francisco. The terrorists we were tracking had outside help. Are we assuming this is part of the same thing?’

  ‘Assim has the tablet computer Lucy brought back from California,’ Delancort explained. ‘I think you will need to compare notes with him.’

  ‘Yeah,’ Marc said, with a nod. ‘Taking down a power grid is exactly the type of mission Arquebus was designed for.’

  ‘You mentioned Taipei.’ Delancort stared at the table in front of him, thinking. ‘There was a major train collision in Taiwan a few days ago.’

  Marc nodded again, remembering the radio report he had overheard in France. ‘Yeah, that tracks. Again, we’re talking about a soft target for an infrastructure attack by digital means. What do you want to bet that we’ll find similar incidents if we dig in to news reports from those German cities?’

  ‘I heard a woman,’ said Lucy. ‘Talking online with the Soldier-Saints before the lights went out. From the way it happened, I guessed she was running the tech side.’

  ‘Madrigal.’ Marc dredged the name up from the depths of his memory, from an old MI6 security briefing.

  Lucy reacted with a jerk and jabbed a finger into his shoulder. ‘White, forties-fifties maybe. Redhead. American.’

  ‘You saw her?’ Marc’s eyebrows rose. ‘She’s the only one of the original members of Ghost5 still alive.’

  ‘I didn’t exactly see her,’ Lucy admitted. ‘The image had a digital mask.’

  ‘In my experience, people who live in the shadows only venture from them when they are motivated by fear or by greed,’ offered Delancort. ‘Go on. What do you know about her?’

  Marc shrugged. ‘There’s a lot of rumours and half-truths in the black hat community. Oftentimes, it’s deliberate. To muddy the waters, yeah? I mean, back in the day when they first appeared, Ghost5 were pure hacktivists. They had an anti-globalisation, pro-freedom agenda, and all that. But somewhere along the line they became darker and more destructive. Madrigal is the handle for a hacker from the bad old days of dial-up and acoustic modems – she’s the original ghost. No one knows who she is or where she came from.’

  Lucy sneered. ‘But now she’s showing her face, more or less. That’s not good tradecraft.’

  ‘Yeah,’ Marc admitted, ‘but that’s only useful if there’s a name to go with it. I guarantee you this, if Madrigal had a past, it’s gone. All that’s left is the legend.’ He reeled off a list of possibilities. ‘She’s an anarchist, she’s ex-KGB, she’s former CIA, a teenage computer prodigy, she’s the daughter of old-skool phone phreakers from the sixties . . . Take your pick. If she was legit, she’d be up there with Gates or Jobs, that’s the tale.’

  ‘At first I thought this was those Combine assholes resurfacing,’ said Lucy. ‘But this doesn’t have their stink on it. If these Ghost5 hackers are selling their skills to any nut-bar with an AK and an axe to grind, these could just be the opening shots.’

  ‘Bespoke terror attacks,’ said Delancort, framing the horror of it in a single sentence. He eyed Marc. ‘You know the capabilities of this software weapon. How bad could it get?’

  ‘Theoretically . . . if they have the right exploits to weaponise . . .’ He swallowed hard as the full scope of it became clear. ‘Anything connected to the internet becomes vulnerable. From the phones in people’s pockets to air traffic control systems, nuclear reactors, power grids, financial servers. Aim it at the right place, and you could knock out a dozen vital utilities at once. Plunge a whole country into chaos overnight. The disaster would pretty much write itself.’

  ‘You always bring such good news,’ said the other man dryly.

  ‘We may be the only ones who know about Ghost5’s part in this,’ added Lucy. ‘The FBI and the Secret Service had no intel on them being part of the Soldier-Saints plot. If they’d have known, Gonzalez would have told us.’

  ‘That’s how Madrigal likes to work,’ said Marc. ‘Fade away and let someone else take the blame.’

  ‘We cannot reveal this to the American authorities, not for the moment,’ Delancort said firmly, pre-empting Lucy’s next words. ‘Otherwise there will be unpleasant questions about why Rubicon employees removed a piece of evidence from a federal crime scene.’

  ‘And then there’s the whole fugitive-from-justice thing,’ added Marc.

  ‘So we wait for these nerds to drop an airliner out of the sky or do something equally shitty?’ Lucy’s tone rose.

  ‘No,’ said Marc, folding the laptop shut. ‘We have a smoking gun here, and no one else knows that we do.’ The next move formed in his mind’s eye. ‘I know Arquebus. I can pick it apart. And maybe we can get a line on what Madrigal is planning.’

  EIGHT

  The rain rattled against the window of the S-Bahn carriage as the train left Tiergarten and headed west over the canal. Kara watched the patterns formed by the droplets, unfocusing her eyes until the streets and buildings of Berlin on the other side of the glass became a blur of boxy concrete forms. She had no reflection in the window, her face hidden beneath the cowl of the dark-green hoodie she wore under her leather jacket. The clothing swamped her skinny and angular form.

  People moved around her as the train pulled into the next stop, and she ignored them. Perhaps she should have been acting with more care and attention to her surroundings, observing the travellers in the other seats in case one of them w
as a watcher. But she trusted in her own skills. She had done enough in her escape from France to make certain that no one from Rubicon could track her. Every device she carried had been scrubbed clean or digitally neutered, every place that a locator could have been hidden ruthlessly searched a dozen times over. She had sanitised herself with the singular, machine-like focus of an obsessive-compulsive, and so she knew she was free.

  In a way.

  It was much harder to escape what followed Kara inside her head. The alien sense of guilt that lay in her chest. She imagined it as an egg made of cold, grey-white stone, pressing down on her lungs with a force that was almost physical. It accreted there as she ran, fleeing Chamonix to here, into a constant drizzle that she could not get free of.

  She thought about Marc Dane’s voice crackling down the encrypted satellite feed to her earpiece, and picked apart their last conversation for the twentieth time. There had been a distinct tone in his words, just before she told him she was sorry and severed the connection. A note of knowing. The imminent understanding that she was about to abandon him.

  But it couldn’t be helped. Kara had committed herself to this course. This was how it had to be. Dane was resilient and adaptable. She imagined he would be able to get to safety. If not . . . she would remember to be sad about it later.

  A sense of inevitability fell over her and Kara closed her eyes, letting herself slip into memory. Like the train, her life was moving on a set of rails, one of countless hard-coded pathways inexorably leading her back to where she had begun. A loop line, doubling over on itself. It didn’t matter what she wanted; the route had already been marked out, back into Madrigal’s orbit.

  To who Kara Wei really was.

  ‘There’s a good chance that you’re gonna be charged as an adult,’ said the man from the group home. ‘You know what that means? They ain’t gonna wait until you turn eighteen!’ She’d never bothered to learn his name. He existed in the same way as the other adults in her life, as random forces of nature more than actual people. They would blow through, a tornado tearing at her, ripping up her shit, then dissipating and leaving pieces to be picked up in their wake. ‘You listening to me?’