The Expats (46 page)

“How’d you do this?”

“On one of his business trips, to Milan, he used a hotel’s open-access point to execute a web transaction, and this connection allowed me to install and hide a program to his hard drive, one that created a record of his screens. Every night at four
A.M.
Greenwich Mean Time, if his computer was on, it e-mailed me a record of his screen activity for the previous twenty-four hours. This didn’t get me his passwords or anything like that; it just enabled me to see what he was doing. It enabled me to get my ducks in a row.

“Then in early August—a half-year ago—I was ready. Everything was in place. Nearly everything. But first I needed to confirm that I really could do this.”

“How?”

“With a test. I was habitually hacking the firewalls of banks. One of them, in Andorra, was where a law firm parked funds before forwarding disbursements to its clients. The primary business of this firm was representing a single insurance company—a health-insurance company. A few years ago, in an egregious miscarriage of justice, this firm not only defended the insurer against a suit, but also held the plaintiff responsible for legal fees: a million and a half dollars. The firm kept their fee, a third of the total, in Andorra. Then they transferred the remaining two-thirds to the client. Or rather they attempted this transfer.”

“A million dollars. You stole this?”

“That’s right. Do you have any idea which insurance company this was?”

Kate’s mind raced through the irrelevant possibilities, then realized it wasn’t irrelevant. She hadn’t given much thought to this company in a long time. Two decades.

“American Health,” she muttered. One of Kate’s primary occupations had once been corresponding with AmHealth. Debating them, filling out their forms, asking for meetings, begging and pleading that it was their obligation to approve her father’s treatment, despite their fine print to the contrary. “You hijacked a million dollars from AmHealth.”

“A million
dirty
dollars. That rightfully belonged to someone just like your father. Or rather just like you. The suit was brought by a daughter, on behalf of her dead father.”

“This was your test?”

“I figured I might as well use an evil guinea pig. And it worked. I was ready to take down the Colonel.”

“That’s when we moved here?”

“Yes.”

“Okay,” she said, leaning forward. This whole thing was beginning to make sense. “Explain to me how it worked.”

29

Dexter wasn’t exactly the man Kate had thought he was. But it was becoming evident that he wasn’t as different as she’d feared.

“First,” he said, “I needed better access to the Colonel’s computer. So I hired someone to help me, a young woman in London.”

A wave of relief washed over her. “What’s her name?”

“Marlena.”

This was one of the two people Dexter called from his secret mobile phone. Kate imagined that Niko was the other one. “And what’s Smolec’s given name?”

Dexter looked confused, but answered anyway. “Niko.”

This was the other contact. Two for two. That explains that.

“And this Marlena,” Kate said, “what did she do?”

“She helped me access the computer.”

“How?”

“She had sex with him,” Dexter said.

“So she’s a prostitute?”

“Yes.”

“And have you been fucking her?”

He actually laughed.

“No, you do
not
have the right to laugh at any questions of mine whatsoever. You’re going to need to earn that back.”

“Sorry.”

“So? Have you?”

He swallowed his smile. “You know what Marlena looks like?”

“I’ve seen pictures, yes.”

“I realize that I’m an incredibly good-looking man, Kate. You and I
both agree about that. But do you honestly think a woman like Marlena would sleep with me?”

“You’re
paying
her. To have
sex
.”

Dexter gave her a gimme-a-break look.

“Okay,” Kate relented. “Go on.”

“Marlena is a twenty-two-year-old Russian. This is the Colonel’s, um, specialty. I put her in a situation—a hotel bar that was known as a place to find girls like her.”

“So he knew she was a prostitute.”

“Yes.”

“And she just went to his apartment and hacked into his computer?”

“No, this had to be more of a long-term thing. So when they met, she gave him her service’s number. He called—she’s a call girl—and she went over. That first night, she put on an extra-special performance.”

“Meaning?”

“The usual overacting. Plus a tender moment of pillow talk wherein she confided that even though she had sex with men almost every night, she’d never before in her life achieved such, um, satisfaction with a customer. She made it clear that she’d had a unique time, physically. And she’d love it if the Colonel could become a regular customer.”

“He fell for this?”

“Who wouldn’t?”

Kate was never going to understand the extent to which men were stupid.

“It wasn’t until their fifth date when the Colonel left her alone long enough to ensure privacy, with the computer accessible. She installed something called a sniffer, which can find user names and passwords. By Marlena’s next visit—their relationship had become weekly—I’d created a software package that she installed, which included a keystroke logger, which recorded every keystroke, and e-mailed me the records every minute.

“Then I had to spend a hundred hours cracking the algorithm of his dynamic-password system so I could log into his bank account without his knowledge. Pure drudgery. Another few weeks to build a fake web site for his bank.”

“Why?”

“Because when people are transferring millions of dollars, they don’t simply hit the Send button on their computer. They’re also on the phone with a bank officer, confirming the transaction. The customer creates
the transaction detail, then the bank officer executes the transfer. This is how banks prevent fraud.”

“So how did a fake web site get around this security?”

“Because when the Colonel thought he was logging onto the bank web site, he was actually accessing a piece of software on his hard drive, not on the web. The strokes that he typed on his keyboard, the images he saw on his screen, had only a fictional relationship to the live activity of his account. The actual activity was being directed by me, remotely.”

“So you’re saying he thought he was online, transferring money. And he was on the phone, confirming a transfer. But you yourself were executing a different transfer.”

“Correct.”

“That’s brilliant.”

DEXTER RETURNED TO the balcony, wearing his ski cap. He handed Kate hers, and she pulled it low over her ears, burning and tender from the cold. They resettled under wool throws.

“The Colonel was
always
putting together a big arms deal of some sort,” Dexter said. “But the one I was tracking was extra-large, with comically bad Africans as the buyers. This would be my ideal opportunity, exactly the type of complicated transaction I’d hoped for. The Colonel was buying a fleet of MiGs from an ex–Soviet general, then selling the planes to a Congolese revolutionary faction. You know about the war in the Congo?”

Third-world carnage had once been Kate’s métier; she was glad to be rid of it. But that didn’t mean she’d gone clean. She would always be a political junkie. “Deadliest conflict since World War II,” she said. “More than five million dead.”

“That’s right. So this deal of the Colonel’s required trust from the general, Ivan Velten, which the Colonel had earned over a couple decades of partnerships. And it required that a few transfers happen nearly simultaneously, on the same day that the MiGs were delivered. Which happened to be Thanksgiving Day.”

Kate nodded, acknowledging this explanation of Dexter’s failure to be home.

“The morning of the transaction, the Congolese delivered their down payment to the Colonel, who transferred half of it to Velten. So half the jets were delivered to an airfield near the Angola border, flown at night
from Zambia, where the General had been stashing the planes since he pilfered them from an airbase in Kazakhstan. At that point the Colonel was obligated to pay the General the next installment. He initiated the transfer, and the funds left his account. But the money never arrived to the General’s account.”

“Because you’d transferred it to yours.”

“Yes. The Colonel now owed the General twenty-five million he didn’t have, and he tried to figure out what had gone on. He called his banker, but she had records of their conversation, which included his approvals and confirmations for the same-bank transfer. Both the Colonel and Velten had their accounts at SwissGeneral. Transfers within the same bank are effective immediately, because the bank can verify the funds. I too had an account at SwissGeneral.”

“So couldn’t the bank trace the record of your transaction? Couldn’t they find the account, in their own system?”

“Yes, they could’ve. I’m sure they did. What they found was an empty account opened by some guy I’d paid to open one a year ago, who never knew my name or saw my face. I’d immediately emptied this SwissGeneral account to an outside account.”

“But couldn’t they trace that transaction, too?”

“Yes, in the normal course of affairs, they could’ve. But they had a security breach that day, at their headquarters in Zurich. Much earlier—months earlier—I’d opened a safe-deposit box at this branch. The morning of the Colonel’s transaction, I went to visit my box. I was taken to a conference room for viewing. From my box I removed a small wireless-access-point device—it looked like a computer’s power cord—that I plugged into the router under the conference table, and left. The router accessed the bank’s mainframe, and the device boosted a wireless signal, so I could access it from outside the building.”

“Why didn’t you access the system from within the conference room?”

“Because if I used the hard connection, the administrator could’ve run a trap-and-trace, and found out exactly where I was. Plus I didn’t want to connect inside because I assumed their security would lock down the building when they discovered the breach.”

“Did they?”

“Yes. But I had already returned to my hotel next door. My room faced the street. I positioned a directional antenna to capture the WAP signal.”

“How did you know this would work, technologically?”

“I’d tried it before, on a previous trip. I’d tested the tech aspects, and also captured the passwords to the bank’s firewall. I’d been able to analyze the architecture and logic to the system, the protocols and safeguards used by their administrators. I wasn’t able to do anything yet, but I knew what I would be able to do, when the time came.”

“Which was what?”

“After I’d redirected the Colonel’s transaction, then transferred the funds out of SwissGeneral to an account in Andorra, it took me a couple minutes to get into the part of the bank’s system that recorded the routing and account numbers of the day’s transactions.”

“You wiped out those records?”

“That’s right. And it was at that point when the system administrator noticed my intrusion, and shut down the system, locked down the building. By that point, I’d transferred the money to dozens of accounts all over the planet, every transaction a different sum. Then from all those accounts, back to one account. In Luxembourg.”

“WHAT DID YOU do at the office? Working all those late nights, weekends … what was keeping you so busy?”

“There was a lot of systems analysis, of the Colonel’s computer, and of course of SwissGeneral. Intrusion is time-consuming. It’s a soul-crushing amount of legwork behind a tremendous amount of theory.”

“But why did you have to do this late at night?”

“Most of the nights was something else: I was monitoring the Colonel’s communications—e-mails and phone calls—to stay on top of his deals. Often, I had to stick around to learn the outcome of an I’ll-call-you-back-in-a-few-hours conversation. Waiting.”

“Just waiting?”

“Yes. But I used this downtime to accomplish other things. A hobby, sort of: researching a very confusing category of securities.”