4
DECRYPT
Lugging the satchel containing her expropriated KGB laptop, Marianna followed the uniformed escort down a warren-like Fort Meade corridor and up to a key-padded door. The escort punched in the code, whereupon the door buzzed open to reveal a government-issue conference room, all blecch-colored sheetrock walls enclosing a largish space made smallish by too much faux-walnut Formica tabletop and too many junior-executive chairs. The eight people seated around the table looked up as she entered, their faces registering anything from mild curiosity to annoyance at the interruption. Two of them made a show of closing their briefing binders. The tall, gawky woman at the electronic whiteboard hastily erased whatever it was she’d been scribbling.
Marianna glanced down at the scrap of printout she’d brought with her from CROM headquarters. “Uh, is this the Advanced Curational Technologies taskforce? Because I was supposed to—”
She didn’t get to finish before a square-jawed, sandy-haired suit had risen from his seat at the head of the table. He straightened, showing off to best effect a three-piece charcoal pin-striped Armani, complemented by a starched white tailored shirt and a red silk neckpiece so much the epitome of a DC power-tie that Marianna half-expected to see the thing stand up and go barking round the room by itself.
“Bonaventure, right?” The man stuck out his hand. “Brad Donegan, NSA. I’m the ringmaster for this three-ring circus.”
Donegan didn’t offer to introduce any of his colleagues. He just saw her to a chair off in a corner, motioned her to sit, and relieved her of the laptop case she’d couriered up from Chantilly. Then he sat back down at the conference table, freed the machine from its Velcro cross-strapping, and began subjecting it to a careful 360-degree inspection.
Donegan conducted the whole exercise with an ostentatious flair evidently intended to give the impression he eyeballed confiscated Russian hardware every day of the week and twice on Sundays. And for all Marianna knew, maybe he did. If so, the effect was kind of ruined by the way he kept pausing in his scrutiny to fumble around with his tie, or maybe with something behind it, underneath his shirtfront. A nervous tic, perhaps?
Be that as it may, at long last Donegan nodded his satisfaction with the condition of the captured machine. He flipped it over and ran a scanner across its serial number plate. A moment later, a printer on a sideboard hawked and spat out a Materiel Receipt form, which Brad signed with a flourish and handed to her. She folded it and tucked it into a utility pocket. At this point, doubtless in response to some silent summons, a lab-coated technician entered the room. After exchanging a whispered word—and more paperwork—with Donegan, the techie packed the laptop back in its case and carried it off to parts unknown.
“Okay.” Donegan rubbed his hands briskly. “That’s out of the way. Now we need you to tell us how you came by that, uh, piece of equipment.”
Marianna had thought her After Action Report session earlier that day had been grueling, but her CROM debriefers, Pete included, could have taken lessons in nitpicking from these guys. Whatever “Curational Technologies” was, it seemed to have something to do with asking the same question seven different ways in jumbled-up order just to try tripping her up. Worse, the taskforce had somehow gotten hold of her AAR PowerPoint, and was making her reconstruct—relive, more like—the raid’s hairiest moments over and over in excruciating detail.
Curiously, the only sense of support in the room was from someone who wasn’t even there. At least, Marianna assumed there was a ninth taskforce member attending remotely, through that monitor-cum-videocam hookup on the far wall. The camera certainly swiveled and panned as if someone were following these Star Chamber proceedings closely, and the other interrogators glanced occasionally in that direction, though the monitor remained dark and its speaker, silent. Marianna couldn’t have said why, but she couldn’t help feeling that whoever was on the other side of that closed-circuit video was more kindly disposed towards her than anyone physically here in the room.
Assuming he/she even existed. Oh, well, sometimes even an imaginary friend is better than none at all.
Finally, after her recounting in minute detail how she’d intercepted the last KGB fugitive in time to keep him from wiping the laptop’s disk, the inquisition was drawing to a close.
“Goodbye, Ms. Bonaventure.” Brad Donegan helped her up from her second hot seat of the day, and gave her hand a perfunctory shake. “Thank you for your cooperation. Oh, and stay where we can find you. We may need to bring you in for a follow-up.”
“Follow-up? In case you break the QuMRANN encryption, you mean?”
Donegan’s smile remained fixed. “AES is unbreakable, Ms. Bonaventure. I thought you knew that.”
“Then why—?”
“Have a good day, Ms. Bonaventure,” Donegan said, steering her gently but firmly toward the conference room exit and into the custody of the waiting escort.
As the door was closing behind her, though, she glimpsed Donegan turning toward the darkened monitor and saying something.
Something that sounded like, “Let’s see what Delphi can do with it.”
☯
A great, hundreds-strong chorus of voices rises suddenly to a shout, just as suddenly falls silent. In the ensuing hush, MERGE drifts lazily upward out of the insensate depths of a cold midnight sea.
Summoned toward light, and awareness, once more.
MERGE gathers itself and ruminates. It lacks any internal time-sense, of course, but the date stamps on the most recent Well inputs are unequivocal: the next scheduled test run is still hours off. Certainty arcs across the interlinked nodes of the cognitive lattice that is MERGE:
Not a test.
Even as consensus emerges, a Question comes clear, the Question that has called MERGE into existence:
<Query> Subject zip file “QuMRANN.” AES encryption; test series run on original device. Side-channel attack and analysis. URGENT. </Query>
And attached to the Question, along with the QuMRANN file itself, a catalogued set of binaries comprising a standard side-channel test series. They were going to be needed.
Because even cosmological timespans pale into insignificance alongside the ten to the two-hundredth machine operations needed to crack an AES encryption. If every single one of the ten to the eightieth atoms in the observable universe were a processor capable of executing ten billion operations a second, even then it would take some ten to the hundredth power years to crack the QuMRANN file. On such scales, the hundred billion-year life expectancy of the known universe isn’t so much as a rounding error.
And yet …
With the proper equipment, the proper expertise, and the proper technique, it becomes possible, just barely, to do an end-run around the Advanced Encryption Standard. The proper equipment is the particular machine that did the encrypting to begin with, and that has been secured. The proper expertise is spread across a dozen or so arcane specialties—power consumption heuristics, cycle-time analytics, cache-swap diagnostics, you name it—but all those skills are possessed by individual NSA analysts currently possessed by MERGE. And the proper technique, about to be executed, is called a “side-channel attack.”
In principle, any serious cryptographic capability is pure math. To beat it as math, you’ve basically got to reverse-engineer the parameter driving the underlying algorithm: the encryption key. And as noted, in the case of AES that’s a sucker’s game.
On the other hand, no matter how abstract the encryption algorithm, in order for it to actually encrypt anything, that algorithm must first be instantiated as a real physical process, running on a real physical device. And when a physical process runs on a physical device, it’s bound to generate all manner of physical side effects—side effects which can, in turn, be monitored via “side channels,” and then subjected to intensive analysis.
There is no analysis more intensive on the planet than MERGE’s. As long as the spell of collective consciousness holds, there can be no daydreams, no stray thoughts, no urges to scratch one’s butt—no distractions of any kind. Just pure, unalloyed focus.
In another, temporarily suspended life, MERGE node 231 is a power consumption cryptanalyst. All memory of selfhood is gone, but the skill-set remains intact and functioning well as ever. MERGE considers, reviews several other promising avenues of inquiry, decides.
Back in singleton existence, 231 has been with the Agency less than a year, working Secret-level cases at most, pending the verdict of the lifestyle background check. Months more must pass before an SCI clearance is granted. None of that matters: suddenly, 231 finds itself the driver node of a small aggregation, accessing tools and databases at nose-bleed classification levels.
The unaccustomed access yields near-immediate results. 231 calls up an eyes-only technology, orders of magnitude more powerful than anything available to industry. The power-consumption characteristics of AES have been the object of intense scrutiny over the years, and the new capability embodies those findings—in particular, those of the findings that can distinguish which operation the cryptographic software is employing from moment to moment based on its power utilization curve. And because that sequence of encryption operations is ultimately dictated by AES’s on-chip key, it becomes a window into that secret key’s value.
Other such windows are opening wide as well, as the results from RF leakage detection, branch prediction logic, and CPU-cache timing all begin to pour in.
AES doesn’t stand a chance.
At the end of the cryptanalysis, what had been the QuMRANN file has become fifteen plaintext documents, all in Russian, and a photograph.
MERGE’s real work is only just beginning.
☯
Having finally won free of the Puzzle Palace’s exit procedures, Marianna sat in her cold car in the Fort Meade parking lot doing a slow burn. Who did those ACT guys think they were? Nobody should be put through the wringer like that—not without dinner and a movie.
And that wasn’t even the worst part: after two hours of one-way grilling she knew exactly as much about that QuMRANN file as she had on arrival. Namely, zip. And what else had she expected from the agency whose initials, some said, stood for “Never Say Anything”?
Nonetheless, the upshot was that she still had nothing to take back to Pete—nothing that would get him off her, or her team’s, case.
Marianna reached out to key the ignition for the drive back to Chantilly, and hesitated. At a time like this, she could do with a little sympathy. She pulled out her cellphone and hit speed-dial number one.
☯
Another congeries of MERGE components coalesces, this time to ponder the page upon page of Cyrillic text contained in the decrypt.
NSA does not have nearly so many Russian linguists on staff as it did back in the good old, bad old days of the Cold War, but MERGE has commandeered the best of what’s left. Under their ministrations, the sheets mostly translate to itineraries, equipment rosters, rendezvous arrangements, other inconsequentialities.
Then node 093 spots it: last page, marginalia, in a barely legible scrawl, the words “khapat’ devochku!”—“Snatch the girl!”
That raises the stakes. But what girl, when and where?
All the travel plans specify arrivals at San Francisco International some forty-eight hours ago, followed by a rendezvous a hundred miles to the south. That narrows it down somewhat.
But not enough. None of the decrypted documents contains name, address, or any other identifying feature of the victim. Presumed victim—at this point, there’s no assurance the hypothetical snatch has even happened, or ever will.
Still, that scribbled note did say “snatch the girl,” and here, along with the sheaf of typewritten instructions and timetables, is a photograph—of a girl. A little girl reaching out one small hand to pet the velvety nose of a pony. This image could be key to the Answer. An Answer which, once delivered and Acknowledged, will permit MERGE to subside back into the bliss of non-being once more.
Not that finding this Answer will be easy: The child in the picture looks to be quite young, possibly not yet of school age (and no guarantee she would be attending public school in any case). Board of Education databases are unlikely to be of much help.
What does that leave? Personal Identity cards? The California DMV will issue IDs to non-drivers on request, but few parents go to the trouble for an underage child.
There is, however, one other possibility: incentivized by federal Electronic Health Record initiatives, the Department of Public Health has been actively expanding its California Immunization Registry with the goal of collecting child vaccination information from every healthcare provider in the state and entering it into a centralized Sacramento database. And each CAIR entry contains the child’s name, address, date and type of vaccination, and … photograph.
Gaining access to the Immunization Registry is trivial; locating the records of a single little girl somewhere within it, decidedly not. Census data show some twenty-five thousand children between the ages of four and eight living in Monterey County, over half of them female. Logic can only advance a solution so far, brute force will have to take it the rest of the way.
MERGE dedicates fifty of its nodes to begin the search. At nearly thirteen thousand faces to match against, the processing power needed to run this task on silicon would exceed that of even the largest supercomputers. But the ability to tell friend from foe has always held high survival value for homo sapiens, and evolution has accordingly endowed the brain with superlative facial recognition “software”—large-scale neural ensembles fine-tuned to distinguish faces from the rest of the objects in the visual field with a latency as low as fifty milliseconds. Lacking any awareness of their own, the nodes can give themselves over to the task at hand with quite literally single-minded attention.
Even so the computational complexity involved in matching each image against the reference face is prodigious: the brain must compensate for differences in perspective, rotation (full face vs. profile), coloration, and in this case, maturation since the time the Registry photo was taken. The average scanning rate drops to one image every seven seconds.
MERGE commits another fifty of its nodes to the cross-compare. The search grinds on. It is stultifyingly boring work, but nodes do not get bored. MERGE in its totality might experience the tedium, save that the torrent of faces is streaming past on a level well below that of its global awareness, with only the occasional noteworthy visage swimming into the consensual view.
In the end, it takes over fifteen minutes before a possible match bubbles up to present itself to the collectivity’s attention.
A few tens of milliseconds to cross-check the result, and MERGE is ready to post at least a preliminary Answer. Together with some very late-breaking developments.
☯
“Hi, Mari—…—’s up?”
Marianna would have thought Fort Meade, of all places, would get better cellphone reception, even out in visitor parking. Still, it was good to hear Jon’s voice, despite the crappy connection. Silly, but somehow just talking to him brightened her day a little, and today could definitely use a little brightening. Part of it was that Jon was good at listening to other people’s problems (went with the whole consultant job description, he’d say), and what she really needed right now more than anything was a sympathetic ear.
“Listen, Jon, is now a good time?” she began, only to hear him say “Uh, actu—not. I’m out in—I’ll—to get back—you. Give me—hour or so.” And suddenly she was listening to dead air.
Wow, was this day ever running true to form!
No help for it now, nor even any reason to put it off any longer. She started her rented Mini Cooper and let the engine warm up a bit before pointing it toward the parking lot exit and the road back to CROM.
☯
As if with a will of their own, Brad Donegan’s fingers sought out the tear-shaped talisman nestled against his chest. Not that its soothing feel could do much to allay the sinking sensation in the pit of his stomach as the first findings from the QuMRANN decrypt came crawling across the conference room’s status display.
Around him, the other members of the Advanced Curational Technologies taskforce were each reacting to the news as well, some more vociferously than others. In particular—
“Dammit, Donegan!” Henry Wiscomb, senior senator from the great state of Tennessee and Chair of the Senate Intelligence Committee, was already on his feet, thundering away. “Eighty-seven percent probability Davoud Ansari’s daughter’s been kidnapped? I don’t believe it! If this ‘Well’ of yours is supposed to be real-time mirroring every damned government database everywhere, then where’s the damned FBI report? And what’s with this eighty-seven percent? Doesn’t the Bureau know if the girl’s missing one way or the other?”
“Jesus, Henry, don’t pop a blood vessel. As to why there’s been no alert from the FBI, I should think that part at least was obvious: Dave hasn’t reported it yet.”
He paused to let the steering committee absorb the implications, then said, “In fact, if not for that QuMRANN intercept, it might’ve been days before we heard anything about it.”
“All’s I can say is, Ansari has a lot of explaining to do,” Wiscomb grumbled. “I’ve never understood how you let an Iranian take point on a project as sensitive as QuMRANN anyway.”
Brad sighed. “For the last time, Henry, Dave Ansari isn’t an Iranian. His parents emigrated here right after the Islamic Revolution. He was born here and raised here. Went to school here. Made his first billion here. The guy’s as American as you are.”
“What about that security chief of his?” Wiscomb said, “No way he’s American.”
“Hamza Nassiri’s an ex-pat, granted. But his credentials are impeccable. Ask the CIA: they worked with his uncle Nematollah when he headed SAVAK under the Shah.”
Brad paused and took a breath then, lest this head-to-head with his congressional-oversight gadfly spin out of control, as others had so often in the past.
“Anyway,” he went on, “It’s not like Psyche has any direct involvement with the Well, now that QuMRANN’s out of the picture. As things stand, Dave’s just another parts supplier.”
“Parts supplier?” Wiscomb sputtered. “You know as well as I do—Psyche’s nanotech is critical to the whole shebang. And it’s sole-sourced. That always seemed like one hell of a risk to run with, I repeat, an Iranian-American outfit.”
“Come on, Henry.” Brad said. “Where do you think we’d be if we restricted bidding on these contracts to folks whose ancestors came over on the Mayflower? Fact is, we just don’t have enough third-generation Americans majoring in math and science to fill the need. You want to fix the problem? Start there. Meanwhile, don’t blame NSA if we play the hand we’re dealt.”
“Get a room, you two.” That came from Arnie Rassmussen, the bearded string bean of a guy sitting at the far end of the conference table wearing a CIA photo-ID, dress casuals, and a sneer. “NSA’s sourcing issues have no bearing whatsoever on this possible Ansari abduction. Which was, I believe, the topic under discussion.”
“But why are we—ACT, I mean—discussing it at all?” Major General Alicia Marberry, the Military Intelligence rep, chimed in. “Kidnapping is Bureau business. I say, hand off and move on.”
The Senator took the floor again. “I wish it were that easy, General. But, as Donegan here just got done reminding us, Psyche Industries is currently our only source of the nanotech components Delphi runs on. I may not be happy about that situation, but until we come up with a fix we’ve got to make sure that Fatimah Ansari’s abduction isn’t aimed at compromising our supply chain. Or worse.”
“Worse how?” the general said. “Ransom? It’s not like her father can’t afford to pay.”
Wiscomb barked a laugh. “Let’s just hope this is about nothing more than money. It’s the other extortion scenarios I’d be worried about.”
“Such as?”
“Think about it: Ansari was an ACT insider till—what?—third quarter last year? Who’s to say how much he may have learned back when QuMRANN was plan of record? Forget ransom: there are plenty of people who’d blackmail him just for what he knows about Delphi.”
“And,” Rassmussen added, “based on the source of that captured file, there’s good reason to believe the Shadow KGB may be involved.”
Marberry mulled that a moment, frowned and nodded. “So, what are we talking, boots on the ground in San Jose? I can have a CID team in place by fourteen-hundred local.”
“Hold on a minute, folks,” Brad held up a hand. “We’re getting way ahead of ourselves here. At the moment all we’ve got are indications of a kidnapping plot—possible indications, at that. No information on whether that plot was ever actioned, much less succeeded. And with the Delphi launch only three days away …”
“I beg your pardon, Bradford.” For the first time that afternoon, a slow, sonorous voice issued from the wall monitor, though its screen remained dark. “I wouldn’t characterize an eighty-seven percent confidence level,” the voice went on, “as a mere possibility.”
Brad turned toward his unseen interlocutor. “Okay, granted,” he said. “But is it enough to warrant hassling a major defense contractor? I mean, it’s all just speculation, isn’t it?”
“Well … informed speculation, yes.”
“My point exactly: probability piled on probability. Sometimes I think that MERGE thing of yours gets weirder the longer it’s left running. It isn’t still, is it?”
“Sorry, isn’t still what?”
“Running. Is MERGE still running?”
“I haven’t sent an Acknowledgment yet. It hasn’t finished generating hypotheses.”
“Well, tell it to stop.” Brad had quite enough hypotheses on his plate already.
“Very well,” said the man behind the curtain.
Brad nodded. Then his eyes were drawn to a flicker on the main status board. Evidently the Acknowledgment had not been dispatched in time to keep the MERGE group mind from concocting one more conjecture. He sighed and read the text now scrolling across the screen, toying with his concealed talisman all the while.
“INTERCEPTED CELLPHONE CONTACT WITH SUBJECT LOCATION PAIRIDAEZA INITIATED 1323H TERMINATED 1324H EST POINT OF ORIGIN …”
Interesting, and not speculation for once, thank God: someone had placed a call to the scene of the possible kidnapping less than five minutes ago. Brad’s eyes widened as he read the geo-coordinates of the originating cellphone.
“Oh, shit,” he said. Then he took out his phone and said, “Front gate.”
☯
Marianna sat in her Mini Cooper at the exit to the Fort Meade visitors lot, drumming her fingers on the steering wheel, waiting for the guard to finish his phone call and raise the dumb crossbar. What in hell was the hold-up?
The guard finally flipped off his handheld, but rather than go back in his shack and open the gate, he was approaching her vehicle. She recognized that deliberate look, having worn it herself on more than one occasion. It said “Apprehend and Detain,” and it was identical to the expressions on the faces of the guard’s two compatriots, just now emerging from their HMMWV to unclip their holsters and take up blocking positions fore and aft of her vehicle.