The Shadow Patrol

knowing Amadullah or Daood?”

Wells had considered that idea. But going back to Kabul was unappealing. The mole would have his defenses ready, and Wells didn’t have the leverage to break them. The Ariana felt like a trap.

“I think I’m better off staying away. So I’m going to Kandahar, shake some hands, maybe see if I hear anything about drug smuggling.”

“Long shot.”

“I know, but that was half my cover for coming over here anyway. I might as well stick to it. Until you find Daood. Get that big brain in gear, Ellis.”

14

Daood. Dawood. Daud. Daoud.

Bad enough that Ellis Shafer couldn’t find the courier, didn’t have a hint of who he was. Almost a week after talking to Wells, Shafer couldn’t even be sure how to spell the guy’s first name.

Like many Muslim names, such as Ibrahim and Yusuf, Daood was a Quranic version of a Jewish Biblical name, in this case David. Muslims chose names from a relatively small pool. Their favorites included Abdul, Ali, Hussein, Khalid, and the always popular Muhammad, a name given to tens of millions of Muslims worldwide — and a few unlucky Christians, too. Daood and its variants weren’t quite as popular. Still, Shafer had hundreds of thousands of potential targets.

He wouldn’t be going door-to-door.

AFTER HIS TALK with Wells, Shafer’s first call went to Fort Meade. He asked the NSA to track the e-mail address and phone number that Wells had gotten, and search its e-mail and voice databases for references to men named Daood. But his hope for a dose of technological magic didn’t pan out.

The agency started with an e-mail to Amadullah’s Gmail address. The e-mail looked like a standard account-maintenance message, but opening it would infect the host computer with a virus that would broadcast the IP address of the server connecting the computer to the Internet. The agency could use the virtual address to pin down the computer’s physical location. But the plan was a bust. As far as the NSA could figure, Amadullah never used the Gmail account. As for the cell number, the NSA was already tracing it as part of its surveillance of the Thuwanis.

The broader e-mail and phone searches Shafer had requested also came up dry. The name Daood appeared hundreds of times in the agency’s databases. But after two days of combing through suspect messages, Shafer found nothing that appeared remotely related to trafficking or the Thuwanis. He wasn’t surprised. The CIA officer running this plan would know just how good the United States had become at tracking Internet traffic.

The voice records had their own problems. The NSA’s voice database was spottier than its e-mail counterpart. Nearly all e-mails worldwide passed through a handful of electronic junctions that the United States tapped. But phone companies tried to keep calls inside their own systems to avoid paying interchange fees to other phone companies. A phone call from Islamabad to Peshawar might never leave Pakistan, making it harder to trace. And even if the NSA did have the calls in its databases, finding them in a blind search would be extraordinarily difficult. The agency couldn’t possibly hire enough Arabic and Pashtun speakers to go through all the calls in its databases. It had spent hundreds of millions of dollars on voice recognition programs that listened for obvious words like bomb and martyrdom—as well as more subtle ones like container or antibiotic. The NSA could also query the software to track specific words. Calls pegged as suspicious were passed to human analysts.

But the software was spotty. Computers had a hugely difficult time parsing and recognizing human speech, as anyone who’d ever called an airline 800 number knew. And the agency particularly disliked blind searches, which used huge amounts of computing power and generally came up dry. So Dr. Teresa Carter, who oversaw the programs, told Shafer.

“You’re telling me it’s impossible,” Shafer said.

“We can try. But I need to know, will finding this man Daood stop an imminent threat to American civilians or military personnel?”

Shafer hesitated. “I can’t guarantee that.”

“In that case, given the other projects we have queued up, we can’t treat this request as a top priority.”

“A medium priority?”

“It’ll be on the list.” Her voice was cool. “Mr. Shafer, we’re currently tasked on other searches that have a direct probability of saving lives. You may not believe me, but I want to help. If there’s an imminent threat, call me and I’ll push.”

SHAFER HATED being reminded how much the CIA relied on the wizards across the Potomac. The Luddite in him was almost happy to find out that technology wasn’t totally infallible. But he needed a new way to shrink the target pool. He decided to flip the search, look from the inside out instead of the outside in. Specifically, he would assume that Daood was already connected with the agency, that whoever was running the trafficking hadn’t recruited him cold.

If Daood had ever worked for the agency, his real name would be kept in a database at Langley, Shafer knew. Even before they were officially recruited, agents received code names — Sparrow, Gemstone, Medallion. Case reports and files always referred to them by those names. Under normal circumstances, only a handful of people would know an agent’s real name. But all agents also had their names and biographical information sent to Langley and saved. The reason was simple: the CIA mistrusted everyone, even the agents it recruited. Most especially the agents it recruited. If they were suspected of being doubles controlled by their home governments, counterintelligence officers and desk officers at Langley might need to know who they really were. So each regional desk kept a database of biographical information.

But keeping the names at Langley came with its own risks. In 1985, a disgruntled counterintelligence officer named Aldrich Ames had given the real names of the CIA agents in the Soviet Union to the KGB. Several were executed. After the Ames scandal, the agency tightened access to the databases. They were no longer stored at each regional desk. Instead, the Directorate of Security stored them on encrypted hard drives in a vault that could be opened only upon a written finding signed by an assistant deputy director. Once a database was pulled, two 128 -digit key codes were required to unlock it.

Given the importance of the databases, Shafer understood the precautions. But they meant that he couldn’t search the databases quietly. Word of the search for Daood would likely leak to Kabul. Shafer didn’t know what the mole would do if he heard.

He did have one other option: the “Kingdom List.” Even inside the CIA, the existence of the Kingdom List remained a closely held secret. It contained the name and basic biographical information of everyone that the agency had ever recruited, active or retired, dead or alive.

The list was stored in a cavern in West Virginia, part of the underground complex where the president would be evacuated if Washington faced a nuclear attack. A written finding from the president, vice president, or national security advisor was required to see the Kingdom List. It could be decoded only in the presence of the agency’s director or most senior deputy director. Theoretically, it provided the ultimate backup in case of a catastrophic nuclear attack on the Langley campus.

In reality, a nuclear attack big enough to destroy Langley would probably destroy all of Washington. In reality, the list served as the last defense against a top-level mole. For example, if the director suspected that an agent in Russia could prove that his deputy was a spy for the FSB, the list would give him a way to contact the agent directly without anyone else inside the CIA knowing.

Shafer wondered whether Duto would give him access to the list. Probably not, especially since they still had no hard proof that the mole existed. But it was worth asking. He called the seventh floor, Duto’s direct line.

“Director’s office.” The voice wasn’t Duto’s.

“Where’s Vinny?”