Puppet Master Read online

  “We all do,” said Sharpe. “But the freeze had nothing to do with what happened to Agent Givens.”

  “No,” agreed Jenkins. “Not at all.”

  “So, getting back to your situation here, your case,” said Sharpe. “Maybe it’s not a skimmer.”

  “How else do they get the data off the ATMs?” asked Jenkins.

  “Maybe the ATMs are a red herring. It’s just a coincidence that there are transactions being made there with those accounts.”

  “I think it’s way too much coincidence to rule them out.”

  Chelsea had spent much of the night studying ATM systems and bank security. Even before she started, she knew security on the terminals was a joke. The machines’ security features, with four-digit passwords and early DES encryption might have been state of the art when first introduced in the late 1960s, but they were now child’s play to crack. Card skimmers could be built and programmed by preteens handy with a screwdriver and willing to spend a few hours searching on the Internet.

  “Track the code from the banks,” suggested Massina. “There must be a clue there.”

  “We’ve been working on that,” said Jenkins, “but we’ve run into a number of technical problems and, frankly, a lack of cooperation from the banks and the processing houses in between.”

  “Mr. Sharpe and his people will help you,” said Massina. “In the meantime, we’ll give you hardened laptops. No more worries about spilled anything. You’ll use our equipment for your surveillance.”

  “Nobody is spilling coffee again,” said Jenkins. “There will be no coffee in the van. Period.”

  “I just don’t see this as a skimmer operation,” said Sharpe. “None have been found at any of the banks. And nobody takes cash from them. You should look in a different direction.”

  “I have a theory,” said Chelsea. “I can’t prove it yet, but maybe the coding is on the card.”

  She suggested—this time solely in layman’s terms—that the automated teller machines were being infected by a virus. There wasn’t enough “room” on the card’s magnetic strip for an actual virus, though; what she proposed was a little more clever. The card directed the machine to go to a bank account where the virus was actually stored; it downloaded instructions to the ATM, then erased itself after a certain period of time.

  “Clever, but in that case, all of the machines would have accessed the same account before they were attacked,” suggested Jenkins. “And that sort of pattern would have jumped out at us.”

  “Not if they kept switching those accounts,” said Chelsea. “Or if they did use the same account, they could set it up so that it would only activate after a certain period of time or transactions.”

  “We’ll have to look deeper at the pattern,” conceded Jenkins.

  “Then let’s get it done,” said Massina, standing to signal that the meeting was over.

  14

  Boston—time unspecified

  Johnny Givens ran for all he was worth. He ran and he ran and he ran. His lungs banged at the side of his chest, but still he ran.

  The night was deep black, so dark that the landscape had no features. He was in a field or a city or even the woods, it was impossible to tell; he saw only blackness.

  Then ahead, on the horizon, a bar of light.

  He ran toward it. It gradually grew as he approached, rising up at a slow pace. It was as if a curtain were being lifted, black giving way to pure white.

  Run! Run!

  15

  Boston—two days later, midmorning

  Chelsea stared out the window as her Uber driver pulled up across the street from a small, one-story mall on Arsenal Street. It was the address Jenkins had given her for the FBI task force’s technical crew; it looked like the back side of a 1950s gas station; she’d been expecting something a little more governmental.

  “We’re here?”

  “This is the place,” said the driver, reaching for the screen on the iPhone perched on the dashboard holder.

  “Thanks,” said Chelsea. She got out of the car and rechecked the address against her phone’s GPS. It wouldn’t have been the first time Uber delivered her to the wrong address.

  But the address was right.

  She was fifteen minutes early, and rather than going into the building, she began walking down the block, deciding to stretch her legs before going in.

  A small wave of paranoia hit her after a block. The neighborhood looked fine, working class but not particularly sketchy.

  And yet . . .

  She pushed her large bag tight against her ribs, lengthening her stride. Her father began talking to her, warning her to be careful.

  More specifically: Keep your eyes about you, ballerina girl.

  Ballerina girl. He was the only one in the world who could say that to her and get away with it.

  Ballerina. Few people would call her that, since even fewer knew that side of her, that ancient ambition. Perhaps another dancer might spot the graceful way she moved, or catch a glimpse of her as she stretched. But there was no chance of a relevé or a saut de basque in the street, let alone something more interesting and taxing.

  The street, her father’s voice told her. Concentrate on the street, ballerina girl. Watch yourself! Eyes about you!

  Chelsea crossed the street to a residential section, passing a row of older houses separated from each other by narrow yards and driveways that looked as if they’d been shoehorned into place. Most of the houses had been divided into two and three apartments; every second one seemed to have something associated with young children—carriages or toys, a bicycle propped haphazardly against a fence.

  Crossing to Beacon Street, she realized her decision to take a walk was silly. Yes, she was early, but what if this was the wrong place? How long would it take to find the right one?

  Meanwhile, she couldn’t shake the paranoia. Apprehension felt like a foggy cloud of steam, clinging to her clothes, accumulating with every step. She suddenly became very aware of her skin color and guessed it was out of place here.

  It was absurd paranoia, she knew. And yet, there it was, like a snake slithering up the side of her collar.

  Chelsea circled around, heading back toward the building. Though it was already midmorning, traffic was light. Drivers sped along the street. The rush of wind as they passed gave another prod to her paranoia, but this time more understandable.

  Chelsea stopped directly across from the building, watching both ways and waiting until there were no cars in sight. Then she sprinted across, careful to lift her toes when she reached the curb on the other side.

  Her legs stiffened with the exertion.

  God, I’m so out of shape. I have to get back to running at least.

  Not even the glass door to the building indicated it was leased by the government, let alone belonged to the FBI. The press-on letters, slightly askew, announced “BI Labs.”

  Well maybe that means Bureau of Investigation.

  Clever.

  Chelsea took hold of the large metal door handle and pulled. The door moved an inch or so, then clanged loudly as the dead bolt hit its stop. Chelsea belatedly noticed a placard near the handle.

  Enter at back.

  Oh.

  Feeling a little sheepish, Chelsea walked around the side and made her way down a dilapidated driveway. Two strips of concrete flanked a center island of mud, gravel, and weeds punctuated by the occasional sparkle of broken glass. The back lot was hardly more hospitable; discarded wooden pallets were piled on one end, opposite a row of chained garbage cans and some very rusted metal drums. A solid metal door stood almost in the exact center of the structure, flanked by two barred windows whose glass had been replaced by plywood. The wood was so old the outer layer had peeled and warped. A few graffiti scrawls on the gray blocks looked nearly as old.

  A doorbell jutted from the concrete blocks next to the door, protruding on a pair of red wires. Chelsea pressed it.

  Nothing seemed to happen. She kno
cked on the door, but that seemed even more futile. She rang the bell again, then took a step back, scanning the yard. Convinced that she had gotten the address wrong, she was taking out her phone to call Jenkins when the back door popped open.

  A short man with a walrus moustache stuck his hand out to her.

  “Ms. Goodman, right?” he said.

  “Yes.”

  “Dryfus. Chief, tech section. Agent Jenkins is inside.”

  “I wasn’t sure I had the right place.”

  “We like to fly under the radar,” said Dryfus. “That, and the government is cheap.”

  He laughed, then led the way through a hallway that connected to the front, where another steel door had been erected just inside the vestibule, in effect cutting off the FBI suite from the front. A computer station showed video covering both exterior doors and the sides of the building; Dryfus had checked the feed before letting her in. Opposite the station was the entrance to an empty room about twenty by thirty; they walked through it to a second room a little bigger than the first. This was the team room, populated with metal desks and stiff-backed chairs. It had the feel of a start-up company—pizza boxes and half-full paper coffee cups were the main decorations—but the computers, all Dells, were primitive, and not just by Chelsea’s standards. Equipment cases and bags were piled against the wall, along with coils of wire.

  Dryfus introduced Jorge Flores, the tech working at one of the stations. Flores showed Chelsea the list of accounts that had been hit over the course of the past six weeks. It was an impressively long list, filling several computer screens. But it was also incomplete—a number of banks were balking at cooperating with the investigation.

  “But you’re the FBI,” said Chelsea. “Can’t you just order them to help?”

  “If we could do that, we might have solved the case by now,” said Dryfus. “But they seem to think we’re part of the problem.”

  “As long as the case is limited to ATM machines,” interrupted Jenkins, who’d come into the room while Chelsea was looking at the computer, “they’ll treat it more as a nuisance than a major problem. It’s a cost of doing business for them. Besides, they blame it on the customers or the processing houses. Anyone else but themselves.”

  “A hacker with this kind of access,” said Chelsea, “could break into the entire bank, couldn’t they?”

  “Maybe yes, maybe not,” said Dryfus. “They may not be able to do more than issue commands for transfers on accounts they have credentials for.”

  “They’re smart,” interrupted Jenkins. “Go too big, and they’ll be hard to ignore. This way, they keep getting dribs and drabs, and over the long haul it all adds up.”

  “Or maybe this is just the first phase,” said Dryfus. “Maybe they’re planning to do more.”

  “We’ve studied the ATM machines and the way traffic is sent,” she told them, reaching into her bag for a small USB flash drive, neatly packaged in a clear plastic case. “We have written a small app that will monitor the system and tell you when the data stream is larger than should be expected. It will pinpoint the location of the machine in the network. You can then follow the suspect.”

  “You’re assuming there’s no delay mechanism,” said Dryfus. “They may insert it, and then nothing happens.”

  “Possibly. But the simplest way would be to send the commands immediately, and then delay. The information has to be kept somewhere, and the machines don’t have enough memory. So if we do this and it doesn’t work, then you’ll know it’s the processing agents in the middle who are compromised.”

  “We don’t think that’s true,” said Jenkins.

  “Then, good. It needs to be installed in the network.”

  “We can work on that,” said Jenkins. “But it’s going to take a while. Not everybody is going to cooperate.”

  Dryfus shook his head. “I can tell you right now, most won’t. They don’t want us messing with their networks, screwed up as they are.”

  “We thought of that,” said Chelsea. She reached into the bag and took out another case, this one blue. Inside was a flash drive with a different program. “This program can do the same thing if it’s inserted into an ATM machine. Even better, it can examine all the coding instantly. So you’ll be able to see if a program is being parked inside the ATM.”

  “Hmmm,” said Jenkins.

  “Again, getting them to cooperate is going to be tough,” said Dryfus.

  “That’s why we did this.” Chelsea removed the last item from her bag. It looked like a paper-thin tongue depressor made of copper, with a gummy black plastic lip.

  “What is this?” asked Jenkins, holding it between his fingers.

  “Wow, a high-tech card skimmer, right?” said Dryfus.

  “That’s right.” Chelsea was pleased that the tech expert could figure it out, even if it was only an educated guess. Maybe there was hope for the FBI yet. “All the electronics are imprinted in the tongue and the chip that’s molded into the faceplate. It goes right inside the card reader. You’ll never know it’s there. We made a tool to insert it as well.”

  “I’m not sure I’m understanding,” said Jenkins. “This is a skimmer?”

  “It’s more a monitor,” said Chelsea. “It will communicate with another program and just send an alert. The network itself is never broken into.”

  “Still—”

  “We’d need permission from the ATM owners, even if it’s just a monitor,” said Flores.

  “I’m going to have to think about it,” said Jenkins. “I may have to run it by the top floor.”

  “That’ll be a ‘no’ real quick,” said Flores. “Even before you go to the banks.”

  Jenkins glanced at his watch. “I have a conference in a few minutes. Please excuse me.”

  Jenkins knew it was a lame excuse, but he needed to think.

  Boy, did he want a cigarette. It had been two years since he’d smoked—the night of the operation that saved his daughter’s life, as a matter of fact—but he still felt the urge at moments like this.

  Too often, lately.

  He entered his office and shut the door behind him. The space was barely the size of an entry-level worker’s cubicle, yet somehow it managed to look massive to him. The bare walls, the empty bookcase, and, most important, the clean desktop.

  Who ever heard of a clear desktop during an open investigation?

  Jenkins wheeled the desk chair out against the wall and sat down. The sole window in the room was a casement job, the sort installed in a basement, as if the builders really didn’t want to let light in here.

  The banks that owned the ATM machines would cooperate, but only after each was harangued personally. And by that time, these guys would be on to a different city. Or maybe even a different country.

  What if the device was inserted by Chelsea? How would something like that play in court?

  It wouldn’t. No way. The defense would argue that it was akin to a search without a warrant.

  Assuming they found out.

  Even if she did it? And then did the monitoring and alerted the FBI to a crime?

  Maybe she’d be guilty of trespassing—but who would prosecute her?

  Not the bank whose money was saved. And not the FBI.

  “You could make some good money with this,” said Dryfus, turning the skimmer over in his hand. “The right place in Russia will pay over a million. And in Bitcoin. You won’t have to worry about carrying it around.”

  “Is that where you think these guys are from?” Chelsea asked.

  “Hard to say. They could be from anywhere. Czech Republic, Romania, Bosnia’s pretty big with banking scams like this. Most of them are more primitive.”

  “You’ve worked on a lot of cases like this?”

  “A few. This is the most interesting, though. Most are just tracking down people with skimmers. That’s what we thought this was at first.”

  “It makes it more interesting,” said Flores. “But frustrating at the same time.”<
br />
  “So you think you’ll get permission to use this?” asked Chelsea, taking back the skimmer she’d invented.

  “Oh, it’s not about permission,” said Dryfus. He glanced over his shoulder. “Jenks is deciding how far to push the envelope.”

  “What do you mean?”

  “We go through channels, it’ll be years before we get the OK. Getting permission from the Bureau is hard enough. The banks . . .”

  “So what then?”

  “Jenks will think of something.”

  “Let me ask you a question,” said Flores, standing up and stretching his legs. “How cooperative was the bank with your boss? Did they give him his money back?”

  “No,” said Chelsea. “They said they would and then they welched.”

  “I’m going to guess what actually happened,” said Flores. “The local branch was very cooperative. Then somebody above them reversed it. Because there’s no obvious sign of fraud. That’s why he got involved. And it’s not about money, right? It’s justice. Or revenge, however you want to slice it.”

  “The same way it is for Jenks,” said Dryfus.

  “He was ripped off, too?” asked Chelsea.

  “No. His brother,” said Flores. “He didn’t tell you?”

  “No.”

  “His brother was killed while investigating a similar case a year ago,” said Dryfus. “He’s convinced it’s related.”

  “Oh.”

  “I don’t think it was,” added Dryfus. “The pattern is different. And there we found skimmers. But he’s in it until the end now. Once he’s on to something, he doesn’t quit.”

  Jenkins was still feeling the urge to smoke as he walked back into the team room. He decided that was OK, though; get through the afternoon without smoking, and he wouldn’t be bothered like this for several weeks at least. It was like being vaccinated.

  “I have an idea,” he told Chelsea. “Your personnel will have to install the devices and then do the monitoring. Then tip us off. We can be all together, but you’d be the one at the monitor. You or whoever. So we’d be getting the information from you. As a concerned citizen.”