Page 17 of The 24th Hour

Bao said, “Well, they set off alarms in DC months ago. Myteam has been working up their methods, embedding moles, tracking this gang’s footsteps ever since. Their IP addresses are always in motion, hopping from one country to another. New threats, new names, but we recognize their patterns.”

Joe thought how the public perception of ransomware was a hairy guy in Russia making a digitally distorted phone call:Give me all your money or people will die.

He said, “Remember when cyber theft was buying and selling credit card numbers on message boards? Some years ago, an airline called me. Their network was frozen. Flights canceled. Even the elevators were dead. And there was a demand for twenty million in crypto, which they paid.”

Bao said, “That was huge. I remember it.”

“Now,” said Joe, “these digital terrorists don’t care about stealing data. They’re screwing up chemotherapy orders. Killing without leaving fingerprints. And still walking away with the dough.”

The two were silent as Joe took a right on Bush Street and headed east.

Bao said, “One of these businesses we’re tracking makes kids’ toys, goes by the name Skylark. You look at them, it’s a functioning, medium-sized company of seven hundred based in Amsterdam. They have a manufacturing floor. Marketing. Sales. And a floating crew of Americans and other foreign nationals, all tech geniuses, one of whom appears to be in or near Northern California with dark web access to the Dutch mother ship. This holdup at St. Vartan’s could be part of Skylark’s ransomware wing. The pattern fits.”

“What’s his job? Does he have a name?”

“All we know is that he’s the negotiator, likely American,may have lived in this area for years unnoticed. He has an IP address like a chameleon. We want that guy with his phone and computer. If he would just stand still.”

The traffic light turned red and Joe turned to Bao.

“More on that,” he said.

“After we meet with St. Vartan’s response team, their corporate officers, lawyers, and IT head, we’ll see how bad the situation is, what can be retrieved. We’ll plug in to home base and try to take these killers down before they turn St. Vartan’s network into local phone calls only.”

Joe was thinking of the hundreds of patients lying helpless and unaware in hospital beds. “Tell me the truth, Bao. What are our chances of stopping them?”

“I just don’t know. I really don’t, Joe. But we’re not alone in this. Our mother ship is bigger and smarter than theirs.”

CHAPTER 16

JOE SAID “HELLO” to the unsmiling woman who was waiting for him and Bao when the elevator doors slid open on St. Vartan’s top floor.

“I’m Christine, Mr. LaBreche’s PA. Please come with me.”

Christine’s expression was pained, and she walked as if she had broken glass in her shoes. She didn’t speak again, just took the lead, put her head down and struck out for the northern end of the corridor.

Joe and Bao followed Christine along the length of the executive floor. When they reached a glass-walled conference room at the far corner, Christine knocked on the door. A blue-suited man wearing a loosened tie around his collar got up from his chair at the head of the table, opened the door, and stepped back as the two-person FBI team entered the room.

“I’m Rob LaBreche, CEO,” he said. “The guy that gets hung for this disaster.”

He pulled the ends of his tie up under his jaw and, afterfake-hanging himself, shook hands with Bao and Joe and offered them seats at the table. LaBreche introduced the seated semicircle of corporate officers by name and function. Joe made a mental note of the heads of the legal and IT departments. Next, LaBreche introduced Sveinn Thordarson, a stocky man in his sixties and the head of Cyber Security Incorporated, a well-known anti-cyberattack firm. He wore a dress shirt and blue tie, no jacket, good quality trousers, and had a short, trimmed beard. Thordarson in turn introduced his partner, Peter Wooten, as an anti-ransomware genius in a young but growing industry, expanding around the world. Wooten was about forty, a wiry six feet tall, red-haired, wearing square, rimless eyeglasses, chinos, and a Hawaiian shirt.

In the all-suited assemblage, Thordarson and Wooten stood out, as did Joe in his khaki shirt and work boots.

LaBreche said to Bao, “You know what I’m praying? That somehow through the arcane tricks of their trade, Sveinn and Pete will quickly restore our system and wall off our permeable network without loss of life. That’s what I’ve been praying for over the last hour. And that you,” he said, indicating Bao and Joe, “will find this filth and nail them to the walls of a maximum-security cell for the rest of their lives.”

“Amen,” said Thomas Walters, the head of IT. “This is madness. Obviously, it’s evil to hold hospitals hostage, and more personally, we had an incident response plan in place. Within ten minutes of getting the threat, Thordarson and Wooten were on the phone.”

Thordarson said, “Why don’t I take it from here, Mr. Walters? First, nice to meet you both,” he said to Bao and Joe.“Director Wong, I believe we worked together on that Chem Con breach …?”

“Five years ago. In Santa Rosa,” she said. “Right you are. It was a squeaker.”

LaBreche tapped his watch. “Sveinn?”

Sveinn Thordarson said, “Let me give you the streamlined summary. The ransom demand was sent to the hospital’s top-tier mailboxes this morning. At 8:00 a.m., everyone at St. Vartan’s with an executive function or a stethoscope, say two hundred people, received it. Some messages were sent to St. Vartan’s email addresses. But at least half of our executives got the warning in their personal mailboxes. That was the panic button.

“Here’s a printout of the email,” he said, separating it from a pile of papers in front of him.

LaBreche had immediately forwarded the email to Steinmetz upon receipt. Joe and Bao had already seen the one-page printout that read, “Because you hired a low-rent response team, we’ve got the goods. We can take the entire hospital down below dead pool in five minutes: computers, medical equipment, refrigeration, everything but the flush toilets. Or you can find twenty million in crypto in the next forty-eight hours and deposit it into our wallet in outer space. See link below. Do that and most of your patients will survive. We’ll also educate your lame IT director and tell you how to protect yourself in the future. You’ll get a call from us at 1:00 p.m. today. Keep your lines open. All we want to hear from you is, ‘We sent the crypto.’”

---