access to the computers to physically plant a device before they were shipped out. Who could hack into JWICS?”
“Well, at least forty countries have military cyrberwarfare units.”
“Forty!”
“In the next three years that number is likely to double.”
“Doesn’t that worry you, Angela? Doesn’t any of this get to you?”
“Pat, this is my job. I deal with it every day. China has more honor students than we have students. Russia has four-year college degree programs on hacking. There are tens of millions of hacking attempts against the Department of Defense each week. It’s the reality of the world we live in, and we just have to work with what we have and stop whatever we can.”
I could see why she looked perpetually under the gun, and I empathized with her. “Sorry. So now, today, any ideas which countries have the technological savvy to get into JWICS?”
“Right now? Russia, Brazil, Israel, China-the US-North Korea. Maybe three or four others. Probably half a dozen citizen hacker groups in China could do it.” She hesitated for a moment, then added, “As well as a handful of individuals who could pull it off.”
I had a feeling she’d been a little uncomfortable noting that individuals could hack into JWICS because she knew I’d been friends with one of those people until last year, when I figured out he was involved in a biotech conspiracy. He’d been ready to kill Lien-hua, and when I stopped him, he was electrocuted and slipped into a coma. Terry had died not long after that, and even though he’d been a traitor and wanted to murder the woman I loved, he’d been my friend for a long time before all that, and his death had really bothered me. Actually, it still did.
“Once you pwn a system,” she said, drawing me out of my thoughts, “you’re home free.”
“Pwn? You mean control it? Compromise it?”
She nodded her approval that I was familiar with the hacker term. “Once you own the source code or the rootkit, you can download or destroy data, overload circuits, transfer funds…” As she typed at her keyboard and eyed the computer code flickering in front of her, she continued rattling off her list: “Turn off air traffic control communication, shut down safety valves at power plants, blow up refineries, reroute trains, take hospitals offline…” Then she added offhandedly, “Basically, take down a country.”
Wow. This was such an encouraging conversation.
Though I knew that Iraqi insurgents had hacked into our drones, the Chinese had gotten into our power grid, and at least one of the fatal airline crashes in the last few years was due to malware in the navigational system, I tried to reassure myself that Angela was almost certainly overstating things. “But aren’t there firewalls in JWICS? Antivirus programs? Encryption software? User authentication, that sort of thing, throughout the network?”
“Forging the response to the DNS server can get you past a firewall. A skilled hacker can crack an LM hash algorithm in seconds, even NTLM hashes can be cracked quickly with pre-computed cryptanalytic tables. Getting past authentication protocols takes a little longer, but we’re talking minutes not hours. Hacking 101: identify the system’s countermeasures, probe for vulnerabilities, access the system, crack the passwords, gain privileged access, hide, exploit, transmit.” She thought for a moment. “A morale computer would be a good attack vector on the sub.”
“No good. Crewmen on a nuclear sub wouldn’t be allowed to communicate with the outside world via the web because it might give away their location.”
“Good point.” She spoke softly as she scrolled through the lines of code on her right-hand screen. “Tell me more about this hypothetical question that isn’t hypothetical.”
“To put it bluntly, I want to know if it’s possible for a hacker to remotely fire a ballistic missile from one of our nuclear submarines.”
I thought she’d be rattled by my question, but she took it completely in stride. “Once you’re at the root level and have administrator access to a weapons system, you’re only one keystroke away from Armageddon.”
“Now you’re just being melodramatic.”
She chose not to reply, and her silence seemed to buttress her point. “So are we talking a domestic or foreign threat?”
“Domestic.” Then I thought of Eco-Tech’s international ties. “But it might be internationally funded.”
“Let me think about that.” She typed quickly for a moment, then said, “I’ve got a GPS location for you.”
“Fantastic.”
She gave me the coordinates, and when I opened another tab on my web browser and punched them in, the Bureau’s satellite mapping program brought up a cabin that lay less than a mile from the Schoenberg Inn. “Give me a sec to call this in, Angela. In the meantime, see if you can come up with a way to remotely fire that missile.”
70
I phoned Tait and gave him the address. “Start there, move out. I think there’s a good chance Kayla might be there.” Then I called Natasha to see if she could go process the site.
“Do you want Jake to come with me?”
“Yes.”
End call.
Good, good, good. A break.
Back to Angela.
“Do you have actionable intel here, Pat?” she asked.
“Not yet. No.”
“But you’re thinking there’s someone who might try this? Try to hack into a nuclear sub? This Eco-Tech group?”
Everything I had so far was circumstantial, a loose network of clues all pointing in one direction, held together merely by assumption and hypothesis rather than conclusive facts: the word of an assassin, speculation about the involvement of an environmental activist group, an uncertain agenda.
“Yes.” I tried to sound more confident than I was. “That’s what I’m thinking.”
“But Eco-Tech is anti-nuke, Pat. Why would they try to detonate a nuclear weapon?”
“I have no idea.”
“Well, even if they wanted to, I just don’t think they have the resources or personnel.”
“They might have a Navy information warfare officer with them.”
She was quiet. “No, I still don’t see it happening.”
“You just told me ‘one keystroke away from Armageddon.’ Right?”
“I was probably overreaching. When you’re talking about firing a nuclear weapon, there are just too many redundant systems. Don’t you need to have, what, two, three people turn keys at the same time?”
“I’d say at least that many.”
“There you go. Plus authentication codes, scripted orders, verification protocols. Even if you were able to somehow get the launch codes, one person can’t set off a nuclear device by himself. You cannot physically be in two places at the same time to turn the keys.”
“But could you bypass those two people and their keys altogether, just like bypassing the Cloud?”
Angela looked at me quizzically.
This was one time I did not want to be playing devil’s advocate. “Turning the keys doesn’t actually fire the weapon, the computer does that. The keys simply tell the computer what to do. What if you could insert the code that would tell it what to do-”
“You mean without the keys turning.”
“Yes. One person can’t be in two places to simultaneously turn two keys from different parts of a room or a sub, but one person could turn them simultaneously-”
“From inside the computer.” Her voice was soft and frangible. “Theoretically, yes, once you pwn the system.”
“You just said theoretically, Angela.”
The look of worry on her face deepened. “I’ll contact USCYBERCOM and the Pentagon. Ask them to raise the
