“Right. Each pixel is assigned a number-a red, blue, and green value, usually ranging from zero to two fifty-five, depending on the intensity. Each of these are, in turn, stored in eight bits, starting at one twenty-eight and jumping down to one, halving as they go, so one twenty-eight to sixty-four to thirty-two, and so on. A difference in one or two or even four in the RGB value is imperceptible to the human eye-”
“You’re losing me,” Brian said. “Bottom-line it.”
“You’re essentially hiding characters inside a digital photo by slightly altering its pixels.”
“How much information?”
“Say, a six forty by four eighty image… half a million characters, give or take. A good-sized novel.”
“Damn,” Chavez muttered.
“That’s the hell of it, though,” Jack said. “If they’re using stego, they’re probably smart enough to keep the messages short. We’re talking about a dozen or so altered pixels in an image containing millions. It’s the proverbial needle in a haystack.”
“So how hard is it to do the encoding?” Chavez asked. “Any way we can track it that way?”
“Not likely. There are tons of shareware and freeware programs out there that can do it. Some are better than others, but it’s not a specialized thing. Doesn’t have to be, when only the sender and recipient have the decryption key.”
“How about pulling the messages out? Can it be done? What’s that involve?”
Rounds answered, “It’s essentially reverse-engineering each image-deconstructing it, figuring out which pixels have been altered and by what amount, then pulling out the message.”
“This sounds right up the NSA’s alley,” Brian said. “Can we tap-”
“No,” Rounds replied. “Love to, believe me, but intercepting their traffic is one thing. Trying to hack into their systems is another. Anyway, we might not need something that strong. Jack, are there commercial programs out there?”
“Yeah, but whether they’ve got the horsepower we need, I don’t know. I’ll start looking around. If nothing else, we might be able to model our own program. I’ll check with Gavin.”
“So the Tripoli thing,” Dominic asked. “I assume we’re thinking it was a URC op?”
“Right. All of the tangos were from URC affiliate groups-half of them from a Benghazi cell, the other half a mixed bag.”
“A pickup game,” Jack said. “From everything I’ve read, that’s pretty unusual for a URC job. Usually they’re keen on cell integrity. That’s got to mean something.”
“Agreed,” Rounds said. “Let’s start a thread and see where it goes. Why did they break routine?”
“And where are the other Benghazi members?” Brian added.
“Right. Okay, back to the stego: Unless this is an aberration, we have to assume it’s standard URC practice and may have been for a long time, which makes our job a whole lot tougher. Every message board and website the URC has ever used or is currently using is a potential source now. We need to scour them for image files-JPEGs, GIFs, bitmaps, PNGs. Anything.”
“Video?” This from Chavez.
“Yeah, it can be done, but it’s harder. Some of the compression stuff can mess with image pixels. Better to concentrate on still images and screen caps for now. So we grab everything we can and start dissecting for embedded messages.”
“We should make sure we have a benign IP base, in case anyone’s keeping track,” Jack suggested.
“How about giving me that in English?” Brian said. “You know me, big dumb Marine.”
“IP is Internet protocol-you know that string of numbers you see on your home network… like 67.165.216.132?”
“Yeah.”
“If we bombard these sites with the same IP and somebody’s watching, they’ll know they’re getting probed. I can have Gavin set us up on a random rotation so we’ll just look like regular visitors. Maybe even ghost them to other Islamic websites.”
“Good,” Rounds said. “Okay, let’s keep going. What else? Toss it out there.”
“Any way to check when pictures are posted on a website?” Dominic asked.
“Maybe,” Jack replied. “Why?”
“Match the post dates against e-mails, known operations, that kind of thing. Maybe a picture being posted prompts an e-mail, or vice versa. Maybe there’s a pattern we can start to build on.”
Jack made a note. “Good idea.”
“Let’s talk assumptions,” Chavez offered. “We’ve been assuming the Emir’s still somewhere in Pakistan and Afghanistan. When’s the last time he’s been confirmed there?”
“A year ago,” Jack replied. “We’ve tossed that around, the idea of him having relocated or even changed his appearance, but there’s no evidence of it.”
“Pretend there is. Why would he move?”
“Either operational reasons or we were getting too close to his bolt-hole for comfort,” Rounds said.
“Where would he go?”
“My vote is Western Europe,” Dominic said.
“Why?”
“Borders, for one thing. A lot easier to move around.”
The Schengen Agreement had seen to that, Jack knew, having standardized border controls and entry requirements among most EU nations, making travel between them almost as easy as moving between states in North America.
“Don’t forget currency,” Brian added. “The euro’s accepted just about everywhere. It would make moving money and setting up house a whole lot easier.”
“Assuming he hasn’t changed his appearance, it’d be a lot easier for him to blend in somewhere in the south, the Med-Cyprus, Greece, Italy, Portugal, Spain…”
“A whole lot of territory,” Brian observed.
“So how do we triangulate?” Rounds said.
“Follow the money,” Dominic offered.
“Been doing that for a year; so has Langley,” Jack replied. “The URC’s financial structure makes the Knossos Labyrinth look like a place-mat maze at Denny’s.”
“Nice obscure reference, cuz,” Brian said with a grin.
“Sorry. Catholic education. The point is, without a corner to peel back, I think the financial angle is a nonstarter. At least by itself.”
“Anybody modeled it?” Chavez asked. “Take what we know about their money handling, tie it to e-mail traffic and website announcements, and cross-reference those with incidents?”
“Good question,” Rounds replied.
“I’d be surprised if the NCTC and/or Langley hasn’t already tried that. If they’d had any luck, the guy would be in the bag.”
“Maybe,” Rounds said, “but
“If The Campus ain’t done it, it can’t be done?” Brian offered.
“Exactly. Let’s assume they haven’t tried it. Or let’s assume they did try it but in the wrong way. What would it take to do it right?”
“A custom-made software application,” Jack replied.
“We’ve got the people and the money. Let’s explore it.”
“Gavin’s gonna start hating us,” Dominic said with a smile.
“Buy him a case of Cheetos and Mountain Dew,” Brian shot back. “He’ll be fine.”
“How about we put some boots on the ground in Tripoli?” Dominic said, changing directions. “This embassy job didn’t happen in a vacuum. Let’s go down there and shake the tree. Maybe Benghazi, too.”
Rounds considered this. “I’ll put it to Sam and Gerry.”
They kicked the ball around for another hour before Rounds brought the meeting to a close. “Let’s break up and get to work. Meet again tomorrow morning.”
Everyone filed out, save Jack, who’d rotated his chair to stare out the window.
“I can see the gears turning,” Chavez said from the doorway.
