Project Blackcomb

Project Blackcomb

Sasha MacPherson

Smashwords Edition

Copyright 2011 by Sasha MacPherson

ISBN: 978-0-9880954-0-3 (epub version)

This ebook is licensed for your personal enjoyment only. It may not be re-sold or given away to other people. If you would like to share this book with another person, please purchase an additional copy for each reader. If you’re reading this book and did not purchase it, or it was not purchased for your use only, then please purchase your own copy. Thank you for respecting the hard work of this author.

Chapter 1

To Peter Williams, the cryptic symbols and obscure commands on the computer screen were the beautiful digital language of Information Technology, which people like him used to rule over the silicon circuits that kept the world go round in the 21st century. The general public hardly shared Peter’s affection for what most humans would consider meaningless gibberish, about as alien to them as if they would try to decipher Egyptian hieroglyphs. They would never be able to understand how anyone could find talking to machines to be so fascinating, and as a result generally referred to people like Peter as geeks.

Computers were as much Peter’s passion as they were his occupation. In his official capacity, Peter was an assistant professor for software engineering at a small but reputable Seattle university. If a casual onlooker had peeked into his living room at this very moment, it might have appeared to them as if Peter was just clocking some late overtime hours at home, building on his department’s latest development project. But hacking into other people’s computer systems without their consent was quite certainly not a part of his job description.

Peter took a sip of apple juice while he watched one of his automated scripts probing a remote internet server's defences, trying to detect any weaknesses that would enable him to break into the system. He assumed that it wouldn’t take too much longer until he would find some vulnerability in the server’s software he could exploit to gain access. Peter's program was performing a port scan - methodically probing the server for publically accessible software running on it - such as web or mail services - which could be connected to over the internet. Like most private PCs these days, the server was protected by a firewall, preventing any direct access from the outside to most of the software running on it. But internet services, by definition, can’t be fully protected by a firewall, since the very point of them is to allow people to use them over the internet.

And what can be accessed from the outside can be hacked from the outside.

Peter's port scanner was an elaborate piece of software, he wrote for the very purpose of hacking into other people’s computers. The program worked slower than it actually could have, but it was able to better conceal its activity this way, making it very difficult for the target system or its administrators to detect that it was being attacked. It also automatically compiled a list of any accessible server software it was detecting on the target machine, including the version number. Peter could later use this information to find a weakness in the software. There was no such thing as perfectly secure software. He just had to know what he dealt with first.

In his entire decade-long career as a hacker, Peter had never encountered any computer he wasn’t eventually able to hack into. And this particular one was not exactly protected by military-grade security in the first place. It hosted the webpage of Brian S. Richardson, a local congressman who was currently holding the all-time record for the lowest approval ratings a politician ever had in Seattle. The man had been connected to a continuous streak of major scandals starting with the very day he got elected, including illegal campaign funding, taking barely concealed bribes from large corporations in exchange for political favours, and allegedly having sex with a seventeen year old girl during a wild party in his house. But despite the public outrage about Richardson’s idea of interpreting a political office, he still refused to step down, ignoring the vast majority of his constituents who wanted to see him take his hat. Richardson embodied practically everything Peter despised in politicians, and he couldn’t say that he was holding much love for any of them in the first place.

Hacking Richardson’s website was a form of protest to Peter, to oppose a person ignoring the most basic principles of democracy – ruling against the will of the majority, and abusing his power for his own agenda instead of serving the people he was supposed to represent.

Peter was well aware that what he was doing was illegal and could earn him a hefty fine, perhaps even jail time. But as far as he was concerned, the law was protecting the wrong person in this instance, so he couldn’t say that he overly cared about transgressing it.

Peter and his friends had been hackers since he was fourteen, which in his case covered exactly half of his lifetime. Neither of them had ever been caught. Usually, they did it for pure sports and not to steal any data or cause damage. Instead, they would adhere to what was considered good conduct among hackers and advise the administrators of the systems they hacked into about their security vulnerabilities so they could fix them.

This time it would be different, as Peter had not the slightest intention to help Richardson to improve the security of his website.

Peter took another glance at the screen, where a progress bar showed him that his script was halfway done scanning the server and would take only a few more minutes to complete. It was still enough time to get a coffee, and he couldn’t do much other than waiting for the script to finish its task anyway. He peeked over the rim of his screen to the other side of the room, where his friend was hammering away at another keyboard at a speed that would have made most professional secretaries blush in shame.

Hey, Eric! Want a coffee, too? Peter said.

The keyboard staccato stopped as Eric turned around to face Peter.

Hell, yeah. I could really do with a healthy dose of caffeine right now. I had my last coffee over an hour ago!

Peter chuckled. Eric was a true caffeine addict who rarely could be seen anywhere without a steaming cup of the bitter brew in his hand. Both young men both rose from their chairs and trotted into the kitchen, where Peter switched on his brand new automatic espresso maker.

Any luck with our friend Richardson’s site? Eric asked, while he kept staring at the coffee machine as if a stern gaze could make it warm up any faster.

"It won’t take too much longer, I think. I refuse to believe the port scan won’t come up with something. When did that happen the last time anyway? What about you? Finished preparing the stuff to upload?"

You bet! I compiled every little piece of dirt I could possibly find about this guy on the ‘net. And it’s quite the collection. It filled the better part of a CD.

Richardson will love it when he will discover tomorrow morning that his own website is hosting all bad news and scandals ever published about him.

The coffee machine had just finished brewing when Peter’s cell phone rang. Peter picked it up and signalled Eric to check the status of his port scanning tool. At the other end of the line, Peter recognized a familiar voice. Nathan was the third and final member of their group, and Peter had already been wondering why he was late for today’s hacking session. But when he heard his reason he instantly forgave him. Nathan’s new girlfriend had insisted on them getting a proper dinner before coming over, and Peter knew that Jessica had not much love for geek-food, as she called the guys' favourite meal for such occasions - which consisted of coke, delivery pizza and a large bag of chips. Nathan told him that they wouldn’t arrive with any sort of appetite remaining, but offered to stop at a take-out on their way and bring the pizza for them to save time, which a starving Peter gladly accepted.

Still smiling, Peter hung up and returned to the living room - which resembled an electronics store much rather than a family home – and found Eric smiling at Peter’s screen while he typed a few instructions into a command shell.

Got something? Peter asked.

Yup. The port scan has found an outdated version of a remote administration tool running on Richardson’s server. That thing has more security holes than Imelda Marcos had shoes. The admin didn’t bother to update this software in two years.

Peter snorted. That amateur.

I have already looked up a known exploit for the software and wrote a little script to apply it. Here, watch this! Eric said cheerfully, as he appended a few final lines of code to his program and then pressed the Enter key. The script started and sent a few carefully crafted requests to Richardson’s server - which made it execute a program embedded in Eric’s script. A program it was never supposed to execute, and that would compromise its own security.

The result would have looked non-spectacular to anyone not working in IT, but both Eric and Peter cheered in excitement as a new window opened on Peter’s screen, displaying nothing but a white blinking cursor on black background.

It was a remote command prompt from Richardson’s server, awaiting their orders.

Bingo, we’re in. Eric said, earning an appreciative pat on the shoulder from Peter. Can you get me the CD from the other desk, so I can upload the material to his site? There are also two printouts of less than favourable photos I found online, which we could use to replace our friend’s portrait with for some additional giggles. Just tell me which one you like better.

Peter walked over to Eric’s workstation and picked up the requested items. He gave the CD to Eric, who inserted it into the drive and instructed the computer to send the files to Richardson’s computer. While the data was being transferred, Peter looked at the two pictures Eric had selected. One was a famous portrait of Adolf Hitler. The other one was a professionally done collage featuring an ugly gorilla sitting on a pile of money, a cigar dangling from his mouth.

Hmm, the Nazi guy is a bit over the top, if you ask me. Richardson is a piece of shit, sure, but he doesn’t really compare to the worst mass murderer in history. Let’s go with Mr. Monkey here. He’s perfect.

Sure thing, Eric said cheerfully, then opened the web server’s configuration files and edited the link that currently embedded a suit and tie portrait of a smiling Richardson into his website’s front page. When Eric pressed his browser’s refresh button, he was now being greeted by the money-hoarding primate instead, with the fitting caption ‘Working hard for what matters. Vote Richardson’.

Think his supporters will even notice the difference? Eric said, making Peter choke on his espresso in laughter.

Anyway, Eric continued, the files are uploaded. I will just insert a link to the material to his front page, so the public can read up on the true Richardson now.

Eric’s fingers flew over the keyboard once more, until he finally exclaimed Done and done.

Nice job, Peter complimented.

Let me just check out what else is stored on his server. Perhaps we get lucky and find some more dirt on him there.

Don’t let me keep you.

Peter kept watching the screen over Eric’s shoulder, as his friend listed the server’s directory and the active processes running on it.

Now that’s strange, Eric said.

What is it?

Eric pointed at one of the list entries on the screen. There is another web server running on this machine. It’s completely independent from the one hosting Richardson’s website. And the firewall is blocking all outside access to it. You have to be logged on to his box using a valid local user account to see the webpage it serves.

That's strange. What's the point of hosting a website if nobody can see it online? Maybe it’s for testing purposes? Not that I would ever use a productive system for running unfinished software.

No sane admin would. Not even a sloppy one who never updates his software, like the guy running Richardson's box. Let me just change the firewall settings. It’s not like we wouldn’t have administrator privileges on his machine, Eric said, chuckling.

One minute later he had told Richardson’s firewall to allow them access to the second webpage. Eric keyed the URL into his browser and pressed the 'Enter' key.

A split second later the new website was being displayed in their web-browser.

When Peter saw it, his coffee mug slipped out of his fingers and dropped to the ground.

Chapter 2

Woah, Eric said, staring at the screen with wide open eyes.

In the upper left corner of the displayed webpage, a logo of a brown-winged eagle holding a key in its claws was placed next to the website’s title: ‘United States of America - National Security Agency: Project Blackcomb’. From the upper right corner, the Eye of Providence stared at Peter and Eric from the top of its pyramid. Other than the title, there was no descriptive text on the page that could have educated a visitor about its purpose. The website was obviously not designed to cater to random surfers. The only content other than the title and logos were a handful of white-coloured form fields designed to enter a person’s name and full address, and a ‘Start Search’ button on the bottom of the page.

You think it’s real or fake? Eric quietly asked.

Peter shrugged. If that’s really the bloody NSA, as in the guys employing more computer security experts than the rest of the nation combined – why would they put a non-public website on a second-rate congressman’s computer and then not even password protect it? That’s definitely not something any person with the slightest clue about security would ever do, no?

Well...only one way to find out what this thing actually does, Eric said, pointing at the address fields on the screen. Who should I try this with?

I dunno... The president? Peter said with a trace of sarcasm in his voice.

But Eric just shrugged and typed the name and well-known address of the current president of the United States into the online form and pressed the 'Search' button.

Peter could think of a few things there were likely to happen now. Either the website wouldn’t do anything at all and reveal itself as some programmer’s lunch-break joke. Or - if it was a real NSA website - it would deny them access and ask for a password.

But neither of this happened.

The view changed as the browser had finished loading the data sent by the website in response to Eric’s query. On top of the site appeared the president’s full name, a photo of him that - judging by its looks - could have been taken from his driver’s licence and his address data. Below followed information about his marital status, date of birth, driver licence and passport number – and a line reading ‘Overall security assessment: Threat level A (Very low or no risk)’.

On the lower part of the page appeared a long list of web-links organized by dozens of sections, starting with ‘Criminal records’, ‘Financial transactions’ and ‘Educational and work history’ and ending with ‘Known social interactions’, ‘Recent Internet activity’, ‘Known recreational activities’ and ‘Health records’.

What the... Peter exclaimed in disbelief.

Eric pointed at the screen. "Do you think that’s real? And that link is pointing to the actual criminal records of the effing president?"

Not waiting for an answer, Eric clicked on the link.

The current president of United States had of course no serious conviction - as people who did were generally unlikely to ever become president – but the public was aware of a smaller transgression he had committed as a teenager, when he got picked up by the cops for having a few drinks at an age when he wasn’t legally allowed to.

Eric was now staring at the detailed record of the incident, including the exact date and the names of the police officers involved. It was as detailed as anyone would expect an official criminal record to be.

This can’t be, Peter said, raising an eyebrow. Stuff like that is supposed to be classified. But this looks like it could come straight from a police database.

Eric clicked the browser’s ‘Back’ button and then called ‘Finanical transactions’.

One by one, a list of larger and smaller bank transactions popped up on the screen, starting with yesterday’s purchase of an exquisite bouquet of flowers, paid for with a credit card. There were more than five hundred pages worth of individual transactions, dating back as far as fifteen years into the past. The largest individual sum Peter could see on the first page was a $10,000 dollar money transfer to a college in Switzerland.

His wife’s birthday was yesterday. I have seen it being mentioned in the news. I would guess that’s what the flowers were for. And one of his daughters is studying in Switzerland, Peter said, shaking his head in disbelief. This stuff is as real as it gets.

So, what is this thing? A celebrity database of some sort? Eric said.

Peter shook his head. I don’t think so. Why would the NSA be interested in that? Suddenly having an idea, he reached for a Seattle phonebook on the shelf and opened it at a random page. Then he closed his eyes and blindly placed his index finger in the middle of the opened page.

Try this person, he told Eric, handing the opened phonebook to his friend, his finger still clinging to the name he had just randomly picked. Anna Hewitt. 2285 Elk Street. I don’t think she’s a celebrity. That neighbourhood is not exactly the best area in town.

Eric nodded and entered the woman's address. A few seconds later Eric and Peter learned that Ms Hewitt was twenty-six years old, single, held a bachelor degree in psychology, spent a lot of money on cat food, and already was slammed with four speeding tickets in this year alone, including a one month suspension of her driver’s licence.

Wow, look at her photo, she’s quite a hottie. Think I should call her? It seems I’ve got her phone number, after all, Eric joked, earning himself a playful punch into the ribs from Peter.

"She’s got a ‘C’ in ‘Overall security assessment’, though...I’d be curious what she did to deserve this? Reckless driving?" Eric wondered.

That line seems to be a link. Just click on it, Peter suggested.

Eric did so, and a popup window explained that the system had automatically assigned Anna Hewitt a ‘Threat Level C (Limited risk)’ because she had ordered a number of books written by known left-wing authors, regularly visited anti-capitalist websites, and face recognition software had identified her on police video material taken during an anti-G8 demonstration.

Woah, wait a second, Eric said. Whatever it is this thing is actually meant to do...but it considers people a ‘risk’ because they are left-wingers? What sort of bullshit is this?

Peter pondered a few seconds. I think I am starting to get an idea what it does. And I am not sure I like it.

Care to indulge me? Eric said.

Have you read 1984?

Eric shrugged. Is there anyone who didn't?

I think you’re looking at a 21st century version of it.

What? You mean...this thing is designed to spy on us?

Peter nodded. I bet that you could enter any address in the entire U.S. and this database would come up with a record just like this one, for every single person in this country.

Who the heck would ever do that? It would take hundreds of data typists just to feed all this data to it. There are more than 300 million people in the U.S.

I don’t think that’s how they do it, Peter said, pointing at the screen. Look here...these financial transactions seem to come directly from banks and credit card companies. The maintainers of that database must have tapped into the various bank systems, or even been granted access to them. And here, the list of her friends...that’s obviously taken from Facebook and other social networking sites. Again, that probably happened automatically, by tapping into their computers. Health and criminal records are from government and private insurance company databases. And so on. I’d guess this thing is a crawler, automatically assembling personal information from all sorts of public and private sources, and then putting them together like a jigsaw puzzle to get a complete record on a person. It’s like Google, only that it doesn’t gather information on websites, but on people.

Big Brother on steroids... Eric said. But what is this thing actually for? What do they want to accomplish with it?

"I am not completely sure yet, but I have a hunch. Try google ‘Project Blackcomb’. That seems to be the name of that thing, after all."

Eric did as asked. Google returned a couple of ten thousand results, most of them about a Canadian ski resort.

"Oh well, that’s a bit