Chapter Three
Diana toggled a switch. The computer monitor went blank, and the image of the virtual room that had been on the screen reappeared, projected across the upper half of the blank wall opposite them.
Ashley’s mouth fell open. “Wow.”
“Shh,” Diana said, suppressing a smile. She felt a little like the first time she had ridden a two-wheeler, zooming past Ashley, who watched from astride her Hot Wheels. Her glee had been short-lived. A week later, Ashley was riding a two-wheeler, too, self-taught.
Diana hooked on her earpiece and typed in some coordinates. Moments later the image of her office dissolved, replaced by MedLogic’s chrome-and-glass corporate building. A box appeared in the corner of the screen and she typed in the pass code, then swiped her index finger across the fingerprint reader on the side of her keyboard. A bell sounded.
“Nadia Varata,” Diana said into the microphone.
The building exterior dissolved and MedLogic’s conference room materialized around Nadia. Projected across a full wall, the replica of a corporate conference room, complete with a long table and a white board, felt like an extension of Diana’s office.
The suited male avatar, standing beside a window with Diana’s slide show already running in it, belonged to Jake. He even looked like Jake, or at least the way Jake had looked when Diana had last seen him in the flesh, more than six months earlier when he’d been slim with thick, reddish hair that grew like straw thatch, and had a fondness for John Lennon wire rims.
Five other avatars, all belonging to employees of MedLogic, sat at the conference table. Diana recognized the CFO Michael Courtemanche and head of security Anish Chander. She’d met them at previous meetings. Both wore suits and ties. Jake had already started to run Diana’s presentation.
“This is surreal,” Ashley whispered. “Can they see the real us?”
Diana shook her head and shushed her. She clicked on her virtual briefcase and dropped it onto the conference table. Then she sat Nadia in a chair.
Jake continued delivering the presentation. “And here’s the inventory showing every storage device that’s been connected to your back-end systems for the last three months,” said Jake. The presentation showed a long list of devices and serial numbers.
For all Diana knew, Jake could have been anywhere in the world where he could get a wireless connection with enough bandwidth to run OtherWorld. As he continued, summarizing the security analysis they’d done, a text message popped to the top of her queue.
JAKE: YOK?
Yes, she was fine, she texted back. Just late.
Jake’s avatar explained how they’d methodically traced every connection until they’d discovered a laptop with a data file that had no business being on its hard drive. The laptop also had a little program that automatically copied its files to another location out on the Internet.
Diana typed:
NADIA: T4 TO
Thanks for taking over.
Back came:
J: NO BD
Actually, it was a big deal. She shouldn’t have been so late that he had to fill in for her. It was unprofessional.
The slide presentation was replaced by a window with video that showed the real Jake sitting opposite the unfortunate employee who owned the laptop with the suspect files. The poor woman—the name SONYA LOCHTE floated briefly on the screen and then disappeared—looked to be barely out of her mid-twenties. She had wispy pale blond hair, down to her shoulders, perspiration glistening on her forehead, and a deer-in-the-headlights look in her eyes.
“I . . . On my computer?” Ms. Lochte touched her neck. Pink streaks ran up her pale throat, from crisp white shirt collar to her chin. “I’m in marketing. You tell me there’s files on my computer that shouldn’t be there? I believe you. But honestly, I have no idea what you’re talking about.”
“Marketing.” Diana recognized the voice and the derisive snort that followed. An empty voice balloon appeared over the head of CFO Michael Courtemanche’s avatar. Diana wondered if in real life the guy had hair like Matthew McConaughey too.
“It’s entirely likely that she has no idea what happened,” Diana said, a voice balloon appearing over Nadia’s head. Outside attackers often probed until they found a vulnerable entry point, poked a hole, and then exploited it low and slow without anyone being the wiser.
“We can’t afford employees in any department who don’t understand security protocol.” Courtemanche again. Diana didn’t bother to point out that it was doubtful that any of their security protocols would have prevented this particular incursion. “We’ve confiscated her computer and locked her out of the system. At least it was an easy fix.”
A text message from Jake streamed across.
J: F**IDIOT
Diana agreed. The guy was a complete idiot if he thought that confiscating poor Sonya Lochte’s computer was all it was going to take to solve the problem. She pressed her palm into her forehead. When was that aspirin going to take hold?
“Was the data encrypted?” Diana asked, even though she knew the answer. She’d already examined the stolen spreadsheet. Its cells contained unencrypted data—letters and numbers that meant nothing to her.
A moment of silence stretched out. “Felix?” The voice balloon was over Chander’s head.
“Of course it was encrypted.” This bold-faced lie was from an avatar wearing a dark suit. That had to be Felix Manning, their director of IT.
“Hmm. I wonder if you were using AES.” Diana feigned innocence, knowing full well that they had not used Advanced Encryption, the latest industry standard. “We’ve found, in some cases, that our clients think they’re protected when they’re not. We can run a few tests, help you troubleshoot—”
Manning cut her off. “I’m satisfied that the problem is solved. It’s clearly an inside job.” He sounded so smug, but she knew he was blowing smoke. There was no way to tell if the attack had come from outside or in.
Manning added, “And we triple-wiped the laptop.”
Damn. Diana had baited that laptop’s hard drive with a phony data file that had in it a homing device that would have enabled her to trace the hackers.
“In that case, we should be all set,” Jake said. “Don’t you agree, Nadia?” I so do not, Diana wanted to shoot back. Customers were right, except when they weren’t and then they didn’t want to know. “Nadia?”
“Right,” she finally said. “All set except for some recommendations. Shore up your firewalls and intrusion prevention systems, stuff like that. I’ll send over a report with the details. Meanwhile, we’ll get started tracking down these criminals and—”
“At this point, the ball is in your court, Felix,” Jake said, talking over her. “It sounds as if you’re confident that you have the situation under control . . .”
“Anish?” IT director Manning asked.
“Completely,” Chander said.
“But if everyone just rolls over and—” Diana started.
A text message popped up on her screen:
J: BACK OFF
Chander continued. “I’m well aware that I’m responsible for security, and I’m satisfied that our people have this issue covered. We can take it from here. We’ve been assured.”
“Been assured?” Diana winced as she heard the shrillness in her own voice. But really, what was that supposed to mean? And who exactly had assured them? She hated it when victims simply plugged the breach and folded. That’s what hackers depended upon. When victims didn’t come after them, they’d go on probing for the next unguarded entry point. In fact, Daniel would have called that the hackers’ greatest and most unappreciated service to industry—finding chinks in corporate armor.
There were a few uncomfortable moments of silence.
“Nadia. Jake.” Courtemanche spoke up. “I appreciate the work you’ve done for us. Thank you so much.”
Blah, blah, blah. Diana swallowed her frustration.
“It’s been our pleasure working with you,” Jake said. “We’ll send you our final reports. And, of course, the invoice.” He chuckled.
“Of course. Send it to my attention,” Chander said. “And we trust you’ll continue to observe the nondisclosure?”
A new text message streamed across.
J: O&O
Over and out? It was more like Over and don’t let the door smack your sorry asses on the way out. Diana transported Nadia home.
“Know what that reminded me of?” Startled, Diana turned around. She’d nearly forgotten that Ashley was in the room with her. “Client I once had. Bugged out after I’d met with them for hours, worked up an entire ten-page proposal, then she goes, ‘Sorry, the event’s been canceled.’ Only it’s not. Turns out they’re using my proposal to spec an RFP for other hotels to bid on.”
“That sucks.”
“Yeah, it sucks. But there’s one thing I’ve learned. Whatever you do, don’t take it personal. ”
But Diana was taking it personal. This wasn’t the first time she’d seen this happen. Neponset Hospital five months ago. Unity Health Insurance six weeks later. When she’d pointed out the similarities to Jake—two clients rushing for the exit when they’d barely gotten past hello—he’d told her to grow a thicker skin. Now this was number three.
“I’m not being paranoid,” Diana told Ashley.
“Did I say you were? Actually, I thought you were very . . . tactful.”
“I made an effort. But I don’t get it. I mean why—?”
“Weren’t you listening to them?”
“They didn’t say anything. It makes no sense.”
“That’s the point. Trust me. This has nothing to do with you. You can bet they’ve got some hidden agenda, some internal thing going on.”
Diana stared at Ashley. Of course she was right.
“They pulled the rug out from under you?” Ashley went on. “So? Big frickin’ deal. Move on.” She stood, held her hands together in prayer, and drew them up and down, slicing the air in front of Diana. “I grant you absolution. As of this moment, it is officially not your problem.”
More excellent advice. But once Diana saw a pattern, she was like a terrier going after a bone. That’s what had drawn her into hacking in the first place—one puzzle after another, each more complex than the last, waiting for her to connect the pieces.
Besides, it pissed her off when clients hired them to stop the hemorrhaging, then opted for a Band-Aid. Each time it happened, it pissed her off more.
“This isn’t the first client who’s done this,” she said. “Hit the panic button and shut us down rather than track the problem to its source.”
“Maybe it’s easier for them to just pay someone off. They definitely wanted you to stop digging.”
“Pay someone off?” Diana remembered Chander’s words: We’ve been assured. If they’d been hit up for payment in return for silence, then the last thing they’d want would be for her to keep sniffing around.
“You’re right,” Diana said. “The publicity could have done serious damage. They warehouse data for some of the biggest hospitals and health-care companies in the country. If someone’s got them by the short hairs, dammit, I’m going to find out who.”
“You are, are you?” Ashley narrowed her eyes at Diana.
Diana didn’t answer. But with or without their client’s cooperation, she was going to find out what was going on. Otherwise Gamelan was doing nothing more than playing a glorified version of Whack a Mole. At least this time she’d anticipated the speed bump. Only time would tell if she’d baited the laptop in time.
“I know that look,” Ashley said. “What are you up to?”