The Steel Kiss

The CEO continued, “And the Midwest Conveyance controllers were installed several years ago. We’ve sent the company forty, forty-five security patches since then. They would’ve kept the hacker out. If they didn’t install them promptly then there’s nothing we can do.”

Rhyme said, “This isn’t about your liability. It’s the hacker we’re after, not you.”

“Your name again, please?” Chaudhary asked.

“Lincoln Rhyme.”

“I believe I’ve heard of you. The newspapers, or a TV show.”

“Possibly. Now, this suspect learned how to get inside from somebody who’d blogged about it.”

Chaudhary was nodding. “You’re probably thinking of the Social Engineering Second-ly blog.”

“Yes, we are.”

“Well, the blogger used an early model and he intentionally didn’t download and install the security patches. If he had, he never would have gotten the DataWise to malfunction. But he didn’t say that in his blog, of course. It’s much more sensational to suggest that any thirteen-year-old can run an exploit. Gets you a lot more hits on your blog when you raise the battle flag of privacy breaches and malfunctions. The DataWise has far fewer vulnerabilities than ninety percent of the systems out there.”

Frost added, “We have a white-hat firm we work with—ethical hackers. You know the term?”

“We can figure it out,” Sachs said.

“Which spends all day looking for ways to hack into the DataWise servers our clients use. Any hint of an exploit, we send out a patch. If that blogger had done that he never would have gotten inside. What does he have to say about it?”

Sachs said, “I’m afraid our suspect killed him after he learned how to hack into the system.”

“No!” Chaudhary actually gasped.

“It’s true.”

“Well, I’m certainly very sorry about it. Terrible.”

Rhyme continued, “The subject we’re after has a list of products that use your controller and people and companies who bought those products. A very long list.”

“It’s been a good few years.”

The lawyer turned to the CEO, saying nothing, but perhaps sending a signal to avoid hinting at the company’s net worth, even though this wasn’t about the company’s potential liability. Lawyering 101.

Chaudhary said, an aside, “It’s okay. I want to help.”

Rhyme pressed on. “And we have reason to believe that he’s going to do this again. Kill someone else.”

The man frowned. “On purpose? Why on earth?”

Sachs said, “Domestic terrorist, you could say. He has a grudge against consumerism. Maybe capitalism in general. He’s sent some email rants to various news organizations. You can find stories about them, I’m sure. He calls himself the People’s Guardian.”

Chaudhary said, “But…  is he psychotic?”

“We don’t know what he is,” Rhyme said impatiently. “Now, why we’re calling. I’d like to know a few things. First, is it possible to trace where he’s physically located when he takes over control of a product? And it seems he’ll be nearby, so he can see the incident and decide exactly when to activate the controller. Or, another question, is it possible to trace his identity?”

Chaudhary answered: “Technically, tracing, yes. But again that’s the province of each manufacturer—the webcam maker, the stove maker, the car companies. We couldn’t do it from our facilities. We simply make the controller hardware and write the script—the software in the controllers. He’d be hacking into the system through our customers’ cloud servers.”

“That’s what the NYPD technical department says,” Rhyme confirmed.

“Then, if you knew in advance which appliance or device—I mean, the actual unit itself—he was targeting, the manufacturing company could trace his location. But then how you’d find the stove or water heater he was targeting I don’t know. And even if you could he’d be using proxies to log into the cloud. You’d have to identify those. Finally, you’d have only seconds to find out before he logged out and powered down after the hack. As for identity, he’s too smart not to use burner phones, unregistered pads or computers and anonymous proxies or virtual private networks. That’s Hacking One Oh One.”

This was more discouraging than he’d hoped. Rhyme then said, “All right. One other thing: Is there some security measure you can take to stop him getting access?”

“Surely. The manufacturers of the embedded products—the stoves, HVAC systems, medical equipment, escalators—just need to install the security patches we send them. I know from his blog how that fellow—what was his name?”

“Todd Williams.”

“How he ran the exploit. Yes, there was a vulnerability. We patched it within a day of learning it and sent out the updates. That was a month ago. Maybe more.”

“Why wouldn’t Midwest Conveyance have installed them?”