We spent the next couple of hours in relative quiet as we let the Cray work its magic. At 9:22 a.m., the whirring stopped, and Scott gave a nod. The job was done.
Scott retrieved the USB. ‘The Cray says it’s cracked it,’ he said, as he plugged the USB into the same desktop computer as last time. Next instant, it was clear the Cray had indeed come through – the computer found two documents on the USB. One entitled ‘Explanation;’ the other, ‘Proof.’
Scott opened ‘Explanation,’ and a document filled the screen. One paragraph:
Success! We have bypassed TOR and Public Key. First, we realized that computers running TOR created excess heat, which caused the computer’s internal clock to deviate, meaning we could identify which computers were running TOR. Next, we realized that – when a device is running TOR – each keystroke in fact also generates a unique amount of heat, and thus had a unique impact on the computer’s clock, meaning we could determine keystrokes before they were scrambled with Public Key. We have thus – because of its limited size – been able to monitor all traffic on TOR. The software currently exists only on a single external hard-drive. Given the nature of the software, we have not made any copies.
‘Remarkable,’ said Scott quietly.
Ellen and I looked at him probingly.
‘In English,’ said Scott. ‘When your computer’s connected to the internet, it’s possible for others to see what time your computer’s internal clock is showing. And by measuring the microscopic deviations in a computer’s clock – how it differs from the true time – it’s possible to determine if the user is running TOR. And also, if they are running TOR, what they’re typing.’
‘So,’ said Ellen, ‘they can see what you’re writing before the text is encrypted?’
‘Correct. But significantly, this explanation alone wouldn’t allow us to go off and do it. What’s still a mystery is how they’ve implemented this theory.
‘But if all this is true, it’s genius. In short, it’d mean they could see every computer running TOR, and what’s being typed on all of these devices.’
‘Well, let’s find out if it is,’ I prompted.
Scott closed ‘Explanation,’ and double clicked on ‘Proof.’
Again, a document filled the screen. But this one – according to the toolbar in the bottom left – was over fifty pages long. On the first page was a list of five names. First, a Californian Congressman in the House of Representatives. Second, the Consul General to the Chinese Consulate in San Francisco. Third, a notorious San-Diego-based hedge-fund manager. Fourth, a judge on the Californian Supreme Court. Fifth, the Assistant Chief of Operations at the LAPD. All five were hyperlinked.
My heart was pounding painfully. This was the real goddamn deal.
‘Click on the cop,’ I said, choosing one at random.
Scott did. It took us to a new page. At the top it read, Alistair Duncan. Assistant Chief of Operations, LAPD. Arms trading; Drug Dealing.
Underneath was the evidence. And there was a lot of it. The IP address of the computer he’d used – which had been geographically linked to Duncan’s home. Records of the Dark Net websites he’d visited. And most damning – as Scott continued to scroll down – reams of chat-logs, which revealed that Duncan had been selling firearms and drugs that the LAPD had seized and which made clear that Duncan was personally behind it. He had, on a number of occasions, obliquely disclosed his identity, as well as a number of other personal details, presumably because he was convinced the line of communication was secure.
‘This is absolutely explosive,’ said Scott after a few minutes.
I grunted agreement. ‘And I imagine this is why your brother reckoned we couldn’t trust the police.’ Ellen didn’t reply and I looked up from the screen.
She was looking over her shoulder at the computer across the room.
‘Ellen?’ I said.
‘Hold on,’ she said distractedly. ‘There’s something happening.’ I could see the blog on the opposite computer had refreshed, but couldn’t make out the text. She paced across the room, then uttered a sharp gasp. ‘My God. There’s a huge Free Tibet flash protest at the Chinese Consulate right here in San Fran; at 1450 Laguna Street. Thirty-three protestors have locked themselves into the east wing following a breach in security. But also, now that they’ve sealed the doors, the protestors have apparently formed a Sleeping Dragon.’
‘What the hell’s that?’ I asked.
‘When protestors chain themselves together, and run those chains through PVC pipes, so police can’t separate them with bolt-cutters.’
My mind was reeling. Revelations hitting on all sides.
‘So they’ve barricaded themselves in, and immobilized themselves?’
‘Right,’ said Ellen. ‘Sid, the blogger, says that apparently the last protestor, just before he joined the Sleeping Dragon, took photographs, and emailed them to the press.’
‘And does he mention the catalyst?’
Ellen shook her head, then typed something into the browser. ‘Right, I’m on CNN.’ She paused a moment. ‘Okay, got it. A high powered Chinese dignitary was set to be visiting the Consulate this afternoon – Minxin Gu, a State Councilor. Notorious for his harsh stance on human rights, particularly Tibetan rights. That’s what they’re protesting.’
Ellen paused again. ‘In fact, this suggests that the Consul General, Hao Ting, is insisting the visit will go ahead anyway; that Gu will just be hosted in the Consulate’s west wing, and it’ll be business as usual. Ting’s meeting Gu at San Fran Airport in forty-five minutes.’
‘But surely this is the Consul’s doing,’ said Scott emphatically, pointing at his screen. ‘Yuelin has put the squeeze on Ting, and he’s behind this.’
I looked at the screen, and read the page he now had up: Hao Ting. Consul General to the Chinese Consulate in San Francisco. Production, Distribution of Child Pornography. And all at once, everything clicked.
‘Of course,’ I said. ‘Of course Hao’s implicated. Clearly he facilitated the security flaw that allowed these protestors to stage this lock-in, while undoubtedly making it look unintentional. But there’s more. This is where the nationalists have been planning to stage their accidental-looking fire. If, in the room above the space being occupied, they’ve put something innocuous yet flammable – say, drums of cooking oil – it’d only take a spark, triggered by an external detonator, and made to look like an electrical fault, to get things started. Within five minutes, there’d probably be enough heat to burn the protestors alive; after three more, enough fire to cave the roof. And I imagine nobody outside would even realize anything was amiss for at least two minutes.
‘But the real genius is staging it at the Consulate. Under the Vienna Convention, the Consulate enjoys extraterritorial status, meaning nobody can enter without Chinese permission – even if there’s a fire. So there’s nothing US authorities will be able to do to stop a fast-acting fire, since they ain’t gonna to get permission in the three minutes between spotting the fire and it turning lethal. What’s more, this status prevents us tipping off the authorities before the fire gets underway; because a rescue team also won’t be allowed to enter without permission. And in fact, asking for permission would almost certainly tell Yuelin her plan’s been compromised, and probably cause her to trigger the fire early.’
‘So we’re on our own,’ said Scott darkly.
‘But it’s also the symbolism,’ said Ellen. She was leaning against the table, looking pale as a sheet. ‘Yuelin’s father was killed at a Chinese embassy in an attack she believes was intentional but made to look accidental. So to kill her enemies in America, in the Chinese consulate, in an attack made to look accidental – it’s poetic justice.’
We were silent a beat; then I said:
‘But why delay the fire? If I had to guess, I’d say she’s waiting for Minxin to arrive. That way, nobody would ever suspect it was intentional, since a high-ranker was inside. Yet given the size of a Consulate, he’d be in zero danger on the opposite side of the building.’
‘It’s more complicated than that,’ said Ellen, who was once again interacting with the computer she was standing by. ‘Just searched Minxin, and found a family tree: he is, in fact, Yuelin’s second cousin.’
This revelation made me wince. ‘There’s no way he can know what Yuelin’s doing.’ I shook my head. ‘It’s got to be part of her cover. After all, if her cousin was in the building, she’d be the last person anyone’d point the finger at.’
I strode to Ellen’s side. ‘Let’s see the CNN page.’
Ellen clicked the page, hit refresh. Suddenly, interpolated among the text were two photos. One: the protestors in the building. Two: the police presence that’d formed outside.
I studied the first one carefully, forcing myself to look at the faces of these innocent youngsters in the line of fire. Their earnest, eager faces. Sitting ducks.
I then looked at Ellen. She was tough-as-nails, but she was shaking like a leaf. I understood what she was feeling: the terror of abject powerlessness.
Only, we weren’t powerless. We could act.
I put an arm around Ellen. An arm that said: you’re not alone, we can do this. Then I let her go and said authoritatively:
‘Right, we’re not gonna just lay down and die. We’re gonna take action. Ellen, you said Hao’s picking Minxin up in forty-five minutes. Well, since we can’t get inside the Consulate, I say we ambush these fuckers and take them hostage. There’ll probably be increased security at the Terminal, but I doubt they’ll lay on a police escort; so I reckon we can get them while they’re en route from the airport. And then we barter with Yuelin for the detonator, using either the short-wave radio frequency we found in Vegas, or the frequency Hao’s been communicating with her on. She’ll be less interested in recovering Hao, because though a confession from him could compromise her deniability, she’d have to presume we’d recorded a confession before returning him. But her cousin – he may give us some leverage. Okay?’
Ellen’s mouth was gaping. ‘Could that work?’
‘We’ve got to try it. And we need to act fast, because the notion Yuelin’s waiting for Minxin to arrive is speculation, and shit could hit the fan any second.’
‘We can’t do this, Saul, we can’t!’ Scott was leaning forward in his seat, and looked at me with exhausted eyes. He was crumbling under the pressure, and I knew he’d have to take a back-seat.
‘Listen Scott: Ellen and I are gonna do this – and I’m gonna get Vann to head to the Consulate to keep an eye on things there. All I need from you is a discreet location to hold Hao while we make the swap.’
Scott pinched the bridge of his nose. After a long moment, he said:
‘169 Stillman Street. A small two-story building – storage downstairs, office up – on a road barely anyone goes down. It’s definitely empty: it was, till very recently, used by SAIC, but they just vacated. It’s just west of South Park, directly opposite the I-80; but since the Interstate’s elevated, it’s effectively facing a concrete block. And there’s a roll-up door that’d let you drive straight in.’
‘Perfect,’ I said. ‘While we head to the airport, you head there and hold the fort. And take the USB, too.’
Scott took a deep breath. ‘Okay,’ he said with a resolute nod. I was relieved. With the odds so stacked against me, I needed Scott to keep a level head.
‘And another thing: in those chat logs, does Hao ever disclose a cell number? I saw that Duncan did at one point.’
Scott turned to the document and ran a search. A second later: ‘There’s a cell number here, though god knows if it’s for a cell he carries with him regularly.’
I hummed. ‘It may potentially be useful to contact Hao directly during this operation, so probably worth storing that number. Can I use your phone? Mine’s been compromised.’
Scott nodded, then took out an iPhone, saved the number to its memory, and handed it over. ‘It’s under “Hao.”’
I nodded. Then I took a walkie-talkie out my pocket – already pre-set to our friendly frequency – and pushed the button.
‘Vann?’
He answered immediately. ‘Let me guess: you called it quits, and went for breakfast?’
I smiled inwardly. Trap Vann in a room with a lion and he’d still not lose his cool.
‘Not quite, Vann. The situation’s gone from bad to worse.’
‘Shoot,’ he said. In the next thirty seconds, I told him the whole shebang.
‘So you want me to head down there, and call at the first sign of trouble?’ he said.
‘Right. But also – try and figure out a point of entry into the building. The authorities won’t enter the building in an event of a fire, so you may be their only hope.’
Vann blew into the phone. ‘Heading there now: on Manek’s bike.’ A pause. ‘Knock ’em dead, Saul.’
After I’d pocketed the walkie-talkie, I commandeered Ellen’s computer, and got up a satellite view of the main-road leading from San Fran International into town – Bayshore Freeway. Soon enough, I found what I was looking for: a large multi-story car-park, maybe a mile from the airport, whose upper-stories gave a clear view of Bayshore. Immediately, I hatched a plan. I would head to the car-park, and discreetly prepare a spot to take aim at the road with the VSS. At the same time, Ellen would head to the airport, linger in the taxi-pickup area, and get a visual on the car. Then, using the walkie-talkies on our friendly frequency, she’d relay the details, so that when they fell into my line of fire, I could shoot out their tires.
Bayshore was as well suited to our plan as we could hope for. It had a speed limit of thirty-five mph, and was often slower due to traffic – and this was vital, since if you shoot a car’s tires over thirty, the driver’s likely to lose control. But while this all seemed in our favor, we knew there was still a hell of a lot that could go wrong. On one hand, there was no guarantee there’d be traffic, in which case, there was no guarantee they’d stick to thirty-five. On the other, there could be too much traffic, in which case, there was no guarantee I’d get a clear shot.
But provided everything went to plan, and I did manage to force the car to pull over, then one of two things would happen. Either the phone-number I had for Hao would work, and I’d be able to explain to him that he and Wu had to get out their car and get into Ellen’s, which will have pulled up behind theirs. Or, if I was unable to contact Hao, Ellen would need to approach their car on foot, and explain the situation herself…
Again, there was a lot that could go wrong, not least because this was a huge ask for an untrained civilian. But Scott wasn’t up to it. And there simply wasn’t time to sub in Vann.
We agreed that Ellen and I would use Scott’s car and Vann’s rental respectively, while Scott would head to Stillman on foot, and pick up a DVD Camcorder en route, so he could record a potential confession from Hao. Then we shut down the computers and left.