‘Which presumably provides a starting point for your tech wizards to dig deeper?’
‘Precisely. That said, in our case we’re dealing with the dark web, remember? No domains. No domains means no lookup facility. And the Dark Desires server won’t be connecting directly to the internet in the usual manner; it will have layers of protection which ultimately broadcast a completely different IP to the outside world.’
Bliss exhaled softly. ‘All right. So its own security measures effectively disguise the address of the source.’
‘That’s it in a nutshell.’
‘So, for example, if its address was 1.1.1.1, the security stuff might tell us it was 2.2.2.2 instead.’
‘Bang on.’
Bliss thought about the logistics and the definitions of the example given. ‘But whoever updates the website with new information or removes the old won’t be working on the server itself, will they?’
‘Almost certainly not. More likely a computer terminal or laptop.’
‘So are they likely to also have all this same level of protection?’
‘That’s a great question, but impossible to answer, I’m afraid, until we know what device or devices are being used. See, an organisation will probably have its own private network – so if you use one of its devices, it’ll be directed through the same route out onto the internet. If that’s the case, it becomes even more secure, because its private network is hidden from anyone or anything outside the organisation.’
Bliss thought about Lewis Drake, his operation and the people who worked for him. If you were going to run Dark Desires without either him or his other employees being aware, it was unlikely that you would do so from within the operation’s own organisational framework.
‘What if the source isn’t inside the organisation’s private network? Is the server still likely to have that level of protection?’
‘The server will still be protected in the same way,’ Glen Ashton said, jumping in for the first time. ‘It’s standard protocol these days to place a server behind a proxy and a VPN. Only a real amateur would fail to protect such a valuable and private resource.’
‘Fair enough. But how about the device they’re using to update it?’
Ashton nodded. ‘Now we’re getting down to the real nitty-gritty. We have to assume it’s still protected with a VPN – or possibly even several of them – but most likely not inside a private network as well. However, it’s far more likely that the person doing the updates uses a suitably secure laptop, tablet, or home PC. Possibly even their phone.’
Bliss’s technical knowledge was limited, but he was capable of following the logic of it. ‘So if I’m getting this right, you’ve reached the point where your software is attempting to breach the security on both the server and the device connecting to it?’
‘Yes. And we got there because we were eventually able to establish a pattern. It’s to do with that upstream and downstream IP traffic Gul mentioned before. We can tell which devices are being used to look at data and even download data, but more importantly in this instance, which ones upload data. There is always some back and forth, up and down, but a greater preponderance of one will tell us who is doing what. We’ve managed to identify both – now we wait while the software does its job and finds its way through the security.’
Bliss tried to keep the pieces flowing in order to see how it might all come together to produce the information they needed. Meanwhile, Chandler sought her own clarification. ‘Let me see if I’ve wrapped my head around it: you’ll eventually be able to identify the exact computer this mostly upstream traffic comes from?’
The face Ansari pulled before responding suggested Chandler was close but not quite there. ‘Provided they’re not going through a local network, yes. If they are, we’ll hit another wall. We can tunnel under it, but doing so would be illegal. In truth, what we’re doing could already be construed as an illegal act, but at least it’s one we can argue about afterwards.’
‘So the best we could hope for in those circumstances is to contact the organisation concerned and ask them to track it down and tell us.’
‘That’s correct. Which, in this case, they will obviously refuse to do.’
Chandler glanced across at Ashton. ‘So what can the NCA do about that, Glen? Issue a warrant and threaten to close them down if they don’t comply?’
Ashton considered the question before replying. ‘It’s a legal quagmire. If we can prove they are functioning as an organised crime outfit, if we can prove trafficking… the onus is on us to provide evidence to the CPS that the organisation is operating illegally. If we do that, then we can seize it all and analyse it at our leisure. But that also depends on who owns the hardware and where they’re based, and reaching that point will be hugely time-consuming. I’d say the best chance we have is that some of the traffic is coming from a device with mid-level security that we can breach. If whoever is doing the updating does it from a home laptop, we’ll benefit from the domino effect. It’ll mean we can find their provider. If we find their provider, we can find their router. If we find their router, we find them.’
Bliss put this together with what he and Chandler had discussed on their way back from London. If Dark Desires was being run by Drake’s people without his knowledge, then in all likelihood it would not be receiving the technical security privileges of that operation. For all he knew, it was a one-man band using a home laptop – or a one-woman band using hers.
It quickly became clear that they had two main leads: get to their killer directly through the girls he used, or via the website from which he sourced them.
‘Gul,’ he said, ‘what if I were to suggest that the person running
