and filled out all the requirements that Toni had sent him for comple-
tion of the pen test.
He pulled down payroll and bank records, employee information
files, telephone and cell phone billing records, and even some internet
browsing histories. He got passwords to every machine in the network
as well. He wrote his report and handed everything over to Toni who
would handle billing with Sun State and sent it over to her. She reported
back the next day with the good news—the clients were pleased but also
dutifully alarmed at what he’d found and had paid the full fee right
away. Toni transferred Ollie’s payment to his account along with a little
10% bonus she said was, “for doing such a bang-up great job.” He told
her how much fun he’d had and when she asked said he’d be happy to
do some more consulting for her anytime.
The two of them continued to e-mail, and after proving his abilities
to her, his own self-confidence grew, and the back and forth got more
and more flirtatious between them. A few weeks later he was bored,
bored, bored after a long boring day at work, and decided to poke
around Sun State again and see if they’d gone ahead and patched any
of the security flaws he’d found. He was annoyed but not actually too
surprised to see that they hadn’t done a thing. As he was just scanning
through, no real intention of snooping, honest, he noticed some e-mail
threads shooting around inside the company about some sort of finan-
cial crisis. Maybe they were too distracted by their bigger problems to
worry about security? Driven by curiosity, he looked a little closer. The
company had been swamped in a chaotic flurry of seemingly unrelated
troubles. Orders not getting placed for raw materials, bills not getting
paid, employee payroll information being leaked.
Oh shit, he thought. Oh shit, oh shit, oh shit. It was starting to dawn
on him then, what had actually happened. He read some more e-mails,
especially from the company owners. There was no mention in any of
them of the penetration testing, but lots of complaints about recent
problems, including computer related ones. He pulled up the com-
pany’s internal directory and got Steven’s direct office and cell phone
numbers. Ollie dialed and hung up three times before he made himself
call Steven’s office. He heard the voice mail message and it didn’t sound
anything like the man he’d talked to. He called the cell phone and
got the real Steven on the phone and confirmed it—this, rough, old,
accented voice did not belong to the person who’d given him the OK to
118
Geek Mafia: Black Hat Blues
run his pen test. He hung up. Not a pen test, but a hack. He’d hacked
the company under false pretenses.
He should have thought his next move through, but he was angry
and even scared. He could lose his job if anyone found out what he’d
done. Hell, he could go to jail. He touch-typed a 60 word per min-
ute angry screed directed at Toni, railing against her for sucking him
into this madness under false pretenses. He demanded explanations
and apologies and assurances. He threatened retribution and hinted at
going to the cops. He fired it off, waited five minutes, and then called
her phone number. It went right to voice mail and he hung up, calling
again every fifteen minutes for the rest of the day. He started running
IP traces on the e-mails she’d sent him, but they were either spoofed or
dead-ended into anonymizers. The mail server for her personal e-mail
account yielded no clues, nor did he get anywhere tracing the phone
numbers. Nothing led anywhere. He couldn’t find her. The only fact he
knew for sure was that he’d hacked the Sun State Construction network
and sent all the proof anyone would need to convict him of that crime
to a strange, seductive woman who called herself Toni.
Ollie called in sick the next two days and suffered through three
sleepless nights waiting for some sort of resolution, some sort of con-
sequences for his action, but none came. He even tried to get the bank
to trace where his payment had come from, but it had simply been a
cash deposit into his bank account from an ATM in Miami. So yeah,
he knew Toni or someone—who had he really talked to on the phone
if not Steven?—had been in Miami a few weeks ago. That did him zero
good. Even when he went back to work, his heart wasn’t in it. He kept
looking over his shoulder, expecting them to fire him or revoke his
security clearance or something. One sleep-deprived Saturday night
he pulled out all his hard drives and drilled holes through them before
driving them out to the dump himself early Monday morning. He put
the money they’d paid him in a separate savings account and let it sit
there in case he ever got a chance to pay it back. Eventually he started to
calm down, but the anger and resentment at being used so poorly never
went away, never even receded very far from the front of his thoughts.
He told himself that this must be what it’s like to be shell-shocked or
have Post Traumatic Stress Disorder, and it sucked.
When he’d seen Toni walking through the Shmoocon lobby it all
came flooding back, but faced with an actual opportunity to take
revenge on his tormentors, he was frozen with fear and doubt. What
if he tried and failed to get his revenge? What could she do to him in
return? Doubts, doubts, doubts. But there were other people here who
Rick Dakan
119
could do something, people in a position of some authority and influ-
ences. Warning them might be enough.
“Can I help you?” asked Heidi, smiling but looking a little wary.
“There’s some sort of emergency?”
It all came out in a torrent, one word tumbling over the next. He
ended up just telling her everything.
Back in her nerd un-chic persona, Chloe headed upstairs and then
caught an elevator back down. She found Bee loitering by the
entrance to the hotel’s fine dining restaurant, pretending to peruse the
menu. Chloe walked on by and headed out the door and down the
sloping driveway to the street below, trusting that Bee was following
her. She turned into a drugstore and started reading greeting cards. Bee
arrived two minutes later and started looking at cards as well.
“Sandee’s been spotted,” Bee said.
“What? By who?”
“That failed recruit ended up showing up here anyway.”
“Oliver. I thought we checked on that.”
“We did, as best we could, but he hasn’t been online in his normal
haunts. He posted that he probably wasn’t coming.”
Chloe sighed and picked up another card. She wanted to be outraged
and tell someone that she’d told them so, but the truth was she hadn’t.
Just like the others, she assumed that the odds of Oliver both being
there and recognizing Sandee were negligible. She was still smarting
about how badly they’d misread Oliver and the likelihood of recruiting
him into the Crew. “What happened?”
“He came to Heidi Potter and told her the whole story.”
“You’re kidding me. Everything?”
“I think so. I’m getting this second hand through c1sman, which I
guess makes it third hand. Oliver went to Heidi and she listened and
thought he was probably a little nutty, except he’s got an OK rep in the
Rick Dakan
121
community and so she took him seriously enough to want to be safe
rather than sorry. She told Bruce and then they pulled in some of the
other Shmoo Group people and talked to them about it in the NOC,
and c1sman was one of the people that got called in. Well, he was
already in there and they let him stay.”
“And they believe him?”
“It sounds like they don’t believe it all, but they’re curious.”
“Curious is bad,” said Chloe. The last thing they wanted was all these
hackers getting curious about them.
“So they have a description and they’re pretty sure she’s staying in
the hotel. The word is that she’s some sort of black hat recruiter who’s
looking for people to suborn into a life of crime. People are supposed
to keep an eye out for her in the con areas and Heidi asked some of the
Shmoo Group to do some subtle poking around.”
“Well, that’s not the end of the world, I guess. They think Sandee’s a
she, so we can solve that problem easily. And they don’t have any idea
what we’re really up to. But still, we’re going to have to get him out of
the hotel for good.”
“If they get real curious they might go to the security tapes,” Bee said.
“Heidi said she wasn’t going to go to hotel security unless something
actually happened in the part of the hotel Shmoocon was responsible
for, and obviously nothing like that has happened.”
“Except us piggy-backing on their network to hack into Clover’s
network.”
“But c1sman’s in charge of that.”
“Not so in charge that he could keep one of the others from poking
around because they’re curious. And just because Heidi’s not going to
security doesn’t mean one of the other Shmoos won’t go poking around
in the security tapes on their own.”
“You’re saying we have to leave.”
“Oh, there’s no question we have to leave,” said Chloe. “The question
is, do we have to do something else besides just leave.”
“How do we explain c1sman leaving early? And if he leaves then we
lose our person on the inside,” said Bee. Chloe agreed with the point,
but suspected that Bee just didn’t want to leave the con yet or freak out
c1sman too much by doing a full scale emergency bug out. There was
only half a day of convention on Sunday anyway, so c1sman sticking it
out might not be such a bad idea, and keeping Bee on top of him only
made sense. “You and c1s can hole up in his room while the rest of us
skedadle. The only thing is we need to make sure they don’t somehow
connect you two to our room in case they ever connect Sandee to us.”
122
Geek Mafia: Black Hat Blues
“So what’s the plan?”
“I need to talk to Paul and then get to some hardcore misdirecting.”
The key to making this work was to find the right person. She’d man-
aged to get c1sman on a cryptophone while he was in a private place and
debriefed him on exactly which of the curious investigators to focus her
attention on. C1sman was freaked out and scared of all of them, and
wasn’t very helpful at first, but eventually she got what she needed from
him—someone smart (that part was easy, they were all smart) with a
good rep in the community who was willing to take matters into his
own hands to do a little investigating and if he was the type who could
be distracted by a pair of tits, all the better.
He was a big guy, well over six feet, and barrel-chested with a heavy,
solid gut. A formidable presence but a friendly face, and he smiled down
at her and said, “Yes, how can I help you?” when she asked if he was
part of the security for the convention. He twisted and turned his broad
back to her to show the word “SECURITY” stenciled on the back by
way of presenting his credentials.
Chloe gave him an embarrassed, shy smile and said, “Something
weird’s been happening to me and I thought maybe I should tell some-
body about it.”
“I’m definitely somebody. What’s up?”
“Well here’s the deal, and I know it sounds weird or whatever, but
I’ve been talking to this lady who I think might be an undercover fed.”
Although they didn’t formally play the game at Shmoocon, Chloe knew
that at other conventions “Spot the Fed” was a serious contest with
prizes and special t-shirts if you successfully spotted the undercover
federal agent in their midst. She was betting that the security guy’s
curiosity would be roused sufficiently to want to look into it, if only
because he could then share in the bragging rights for having uncovered
the undercover.
“Oh yeah? Interesting, interesting. What makes you think this lady is
a fed?” He looked around to see if the person Chloe was talking about
might be nearby.
“Well, she seemed all cool and whatever at first, you know just kind
of curious. I thought maybe she was a reporter or something. I guess
she could be a reporter, but I don’t really get that kinda vibe off her, you
know? Plus she’s like wicked smart on hacking stuff. Knows things and
technical terms and stuff the way reporters just really don’t, you know?”
Rick Dakan
123
“OK, sure. But you think she’s a fed why?”
“Well I was out last night with some friends from the con at this bar in
Adams Morgan, right, and she was there. A bunch of people were there
from the con. And I had some drinks and whatever and I think maybe
I got all too talky and stuff. Maybe, you know, bragged a little.”
“Gotcha,” he said, nodding and smiling. “Don’t tell me anything I
shouldn’t know, right?”
“Exactly, yeah, sure. Right, but the thing is, I kinda did tell her some
stuff. I didn’t, like, actually admit to anything specific, right? But we
both knew what I was talking about. And she kept asking more ques-
tions and stuff, and buying drinks and I kept talking. Then she starts