Bound God

Chapter 9: Second Chair

Ch. 5 — Second Chair

Breaking in was a skill. Breaking into BND was the skill every other skill got measured against.

Coin looked back at the man behind him.

Wade had one ankle crossed over the other knee, screen tipped away at an angle, one hand up near his jaw. If tonight had been a resort in Hawaii instead of a foreign intelligence service, the posture could not have been better. Half an hour, and Coin had not once seen the man hurry. Whatever was on that screen, he was reading it the way you read something you have already decided to enjoy, and it was working on Coin the way a song you almost know works on you.

Him, though. He would admit this much, in the privacy of his own skull: he was a little nervous.

He was, on the whole, a law-abiding person who did an unauthorized thing on the side now and then. That was the fair version. He had been inside other countries' services — small ones, the kind where the whole intelligence apparatus is one rack in a closet and a router still running the password it shipped with. Nobody lost sleep over that. He had never once put his hands on the official network of a country that would notice, and he had kept it that way on purpose, for years.

And now.

Come on. It's BND. When does this come around?

That was the whole argument, and it won by a mile, because under the caution and the rent and the thesis he had not started, he was somebody who liked a fight. He had spent twenty-five years keeping that off his face. Not out of shame — because he liked being alive more, and he had never once had to choose between the two. Cover his back. Put a real number in front of him. The fight came up through him like water finding the seam in a wall.

All right. The Germans had never done anything to him. The Germans were going to have a night.

*Come on, gorgeous.*

He caught that one a beat later and put it right. If you are going to flirt with something at this hour, you should at least get its name right. *BND. You. Come here.*

A foreign service's public face was thin. A handful of pages, a contact form, the kind of thing that never turned up in a search — half by arrangement with the people who ran the indexes, half through somebody who owed somebody. Finding one of those pages from the outside was its own piece of work. The scene had a name for the people who did it that way, and it was not a kind one. Dorks. Guys who could not get into a mailbox but could write a search string that turned up a printer with a login page and a manual nobody had opened since 2006. Some of them were genuinely good at the one thing they were good at. Most of them thought that one thing was the whole job.

Coin knew how to dork. He was not going to pretend it was beneath him. He had used it, and it worked. Tonight he did not need it, because the address was sitting in his clipboard, which was the least impressive fact about this operation and the one he would have the hardest time explaining later.

He opened his kit.

The scanner had a name. He called it Redcoat, after a line of men in red coats stepping out across an open field in step with each other, walking toward something they could not see, and getting taken apart for it. His Redcoat did not get taken apart. His Redcoat came back with a map.

Naming it was maybe forty percent of the reason he wrote his own tools instead of downloading other people's, and the other sixty percent was that downloading other people's was insane. The boards were full of tools. Half did not run, a third phoned home, and every one of them had been written by somebody with a floor to sleep on and a reason to want something back from whoever ran it. Nobody good gave their kit away. There was one guy everyone still pointed at, years back, who put a tool out and never asked for anything, and the scene had been passing that story around ever since, the way you pass around a coin you are not sure is real. One guy. That was the whole list, as far as Coin knew.

He sent Redcoat out.

Then he stood up, walked to the far end of the floor for water, and drank it standing at the glass, looking down at the river and the bridge and the city's worth of light on the other side, giving himself the little speech about how he was not going to fall asleep at the wrong minute, because at the wrong minute this whole thing turned into an amount of money that got up and walked away from him.

Back at the desk, the pane was filling.

No anomaly. No anomaly. No vulnerability. No weak credentials. No anomaly.

Forty lines of nothing, and the back of his neck went hot.

There it is. Redcoats in the open field.

The big services did not leave the front door unlocked. He had known that going in, and had told himself he knew it going in, and it still landed wrong — standing at the bottom of a wall he had already bragged about, with the man behind him saying nothing about it at all.

Then a line in the pane stopped making sense, and he sat forward.

The certificate chain on BND's transport layer was signed by Vaart Trust. Rotterdam.

He knew that name. He knew the inside of that name. Vaart was small and it was cheap, and it had spent years handing certificates to anybody who could fill in a form and pay — which would have been fine, except that a certificate is a claim that somebody checked. That is the whole point of the thing. Somebody in a room looked at your paperwork, there is a signature at the bottom of the page, and civilization continues.

He had forged Vaart's certificates a dozen times. Once you had done the math on their issuance flow, the internal layout of the thing was basically lying on the sidewalk, and he would have bet his checking account that he understood that layout better than whoever had drawn it.

Knowing the lock, though, did not get him through the door.

The forgery was not the hard part. The hard part was that everything between his client and that server got written down somewhere — the handshake, the exchange, the transfer, his whole little dance across their floor. To walk out clean, he had to destroy the forgery in the same movement as using it, and *the same movement* was not a figure of speech. A service with continuous backup is not a thing you outrun. Burn the certificate a second late and the second is already in a snapshot, and a snapshot is a door that never closes.

Two things in the same instant. Access, and erasure.

What he needed was one mechanism that did both — came in and cleaned up as it came, out of some small, stupid, boring hole nobody had ever bothered to write down.

He went back to the pane and started looking for it.

He found a data stream instead.

It came up in the monitor as a shape Redcoat had no category for: thin, deliberate traffic running at the server from an address registered in France, in no particular hurry. The box it came off was a relay, and a good one, and Coin had not put it there.

He sat back about an inch.

Somebody was running it right now, in front of him, and had not bothered to hide.

Wade had not dimmed his screen or turned it or waited for Coin to look somewhere else. He just went. Coin could see the whole thing, because Redcoat was not a piece of junk off a board, and because the man who owned that screen had decided at some point tonight that being watched was acceptable.

A short Python script went out at the BND server. The server began reading it.

While it was reading, Wade handed it a certificate. His own. Self-signed — an ID card drawn up at the door with a marker and a laminator.

The server took it.

And for a fraction of a second, a machine that had been told all its life not to open the door to strangers opened the window it keeps for trading data with other machines.

Coin's eyes moved. He understood what he was watching while he was watching it, which had not happened to him in a while.

The script was already inside. The window was how it got inside. The script was also the cleanup: it took high privilege on the way through, then erased the session behind it, killed the forged certificate, and cut the alarm off mid-sentence. Footprints, handshake, evidence — all of it gone in the same heartbeat that made it exist.

Under a second. He would have bet money it was under a second.

None of that should have worked. It worked because Wade had known, to the second, when the window would open, and had bet the whole operation on being right about it, and because the alarm had come within a hair of going off and he had gotten there first.

Coin's heart was going hard, which annoyed him, because there was nothing to be scared of and nothing to be excited about, and both of those were lies.

At the corner of Wade's mouth, something went up and stayed up.

Then the man opened a port on the box he now owned, and went back to typing, and left it open behind him like a door.

Come in.

Coin came in.

You unbelievable son of a b***h. You're actually unbelievable. Why am I here?

He did not say it. He put it in the drawer with the rest, because the honest answer was that he did know how to forge a Vaart certificate, and had known the whole path for a year. What he had never had was an entry. And what he would never in a thousand years of practicing have had was the nerve to put a forged ID in front of a live intelligence server and take the alarm risk on a window that lasted less than a heartbeat. Wade had simply been willing. The man had walked out into the open and come back with the flag.

All right. His turn.

The perimeter was his now, and this was the part he was genuinely good at.

BND kept a honeycomb around the outside of the good stuff. Dozens of cells, each one dressed like the server you had been hoping for: an admin panel with a username field, a login box, a backup directory sitting open the way a wallet sits open on a bar. A bad night in there costs you everything. Touch the wrong folder and a page goes out to somebody's phone, and a building in Germany starts making calls.

So he went around them. Not through — around, the way you walk around a dog you do not know, giving it room and not looking at it.

Then the firewall. Then the machines themselves: old, patched, and nowhere near as patched as an agency that fusses over its certificates has any right to be. He talked to them. That was the honest description. Forty lines of pure salesmanship, and a server that had no business lifting its skirt for anybody lifted it for him.

What nobody off the boards knew about the Wizard was that his reputation was for precision and his method was filth.

He was careful. Being careful, in his experience, meant you could not afford to be proud, and so the holes he loved were the ones nobody else would touch: the misconfigured print service running on a database server, the dead interface that still trusted anything on the local subnet, the vendor's remote-support account that had lived through two reorganizations and a bankruptcy. Weird holes. Ugly holes. The kind that make another guy shrug and go find a real vulnerability.

The kind nobody sees coming, because nobody looks. He did not do it often. When he did it, he did not announce it, and the boards had built a legend out of the fact that they almost never got anything from him.

A legend.

He was aware, in the low honest drawer where he kept things, that he liked that word more than he was willing to admit to anybody, himself included. He would take it out and look at it later.

Right now he could not use it.

Because he was on a machine in the same local network as the man behind him. Same subnet. Same building. Which meant every tool in his kit that mattered was a tool that would show up in somebody's view of this floor, if there was anything on this floor watching — and there is always something watching a floor like this one. That is the business model.

So he did not scan the LAN. He did not reach for his own holes, or his own scripts, or anything in his kit worth having. He used what was on the boards this month, the stuff the average competent guy had already read, plus two small personal touches so that it was not literally copy-paste, and then he did the job.

This was humiliating.

The man behind him had forged and wiped a certificate in the time it takes to blink, and Coin was running a tutorial out of a thread from 2011.

There goes the legend. Out the window, from a building with cameras in the ceilings.

At 2:30 a.m. the last partition outside the core database came open.

After that it stopped being work and turned into a haul.

He copied the trees. He renamed things so that somebody in a meeting next week would not be able to explain them. He left something small and rude in the scheduling service and made sure the scheduling service still ran. He left a door in a maintenance account — wide, quiet, no lock on it — and stood a moment looking at it, and told himself he would come back through it when he had slept and nobody was sitting behind him.

And running under all of it, the voice that did the talking while his hands were busy:

I steal. I copy. I move. I rename. I put a present in your scheduling service and I leave a door open behind me and I do not say one word about it to him.

One of these nights I am coming back, and I am going to keep at you until you beg for me in your own log.

And if I cannot make a machine beg, I am not a man.

He looked at that for a second.

I am not a hacker either. I am not the Wizard. I am a guy with a paper due at nine who cannot get into a database.

Somewhere in there he noticed that the anger was not about the Germans.

BND had never done anything to him. BND had done nothing at all, except be the thing on the screen while a man with fingertips like a scalpel sat eleven feet behind him and did in one second what Coin would have needed a week and a better idea to do.

They could carry it. BND had a budget, and a building, and somewhere inside it a man whose whole job was about to become tonight.

He put his hands back on the keyboard.