Intentional Acts Page 3

  “Because of the data breach?”

  “Yes.”

  Sasha studied the CEO. Tears had filled her eyes while she’d told the story about her daughter’s friend, but now her blue eyes were steely and determined.

  “We’ll make it right, Gella. Tell me how it happened.”

  “Right. So last week, we received the request from the NCTC—”

  “Hang on. What’s the NCTC?”

  “The National Counterterrorism Center? Something like that. They’re located outside D.C., in Northern Virginia.”

  Sasha scrawled on her notepad: Ask LC re: NCTC. After all, what good was having a G-man for a husband if a girl couldn’t pick his brain from time to time?

  “Okay. And the request came from this NCTC directly?”

  Gella wrinkled her forehead. “No. Actually it came from a contractor.” She walked to her desk and flipped through a tidy stack of papers. “It was an outfit called Sentinel Solution Systems. Also with a Virginia address.”

  Sasha noted the name. “Go on.”

  “We obviously declined to provide the information they requested.”

  “And what exactly did they ask for? Naya mentioned a list of names.”

  “Yeah, they sent us a list of, oh, about fifty names. They wanted us to query our database and see if there were any matches between their list and our donors or our recipients. Obviously, we refused.”

  “Fifty names. And they specifically asked you to query both subsets?” Sasha mused.

  “Well, no. I’m not sure they know how, or even that, we segregate our data. They asked for ‘all customer files.’ I’m sure it was a boilerplate request. I mean, we don’t consider any members of our tribe to be ‘customers.’”

  “Sure. I’ll need copies of all the correspondence.”

  “Of course.” She pressed a button on her phone.

  “Yes?” A breathy voice came through the speaker instantly.

  “Elizabelle, Ms. McCandless-Connelly is going to need a copy of everything in the data breach file.”

  “Got it,” Elizabelle promised.

  “Thanks.” Gella released the intercom button. “There’s not much in the file. And, to be completely honest, I’m not sure how helpful you’ll find any of it.”

  “It’s all helpful. Trust me.” Even after fifteen years of legal practice, Sasha remained amazed at how the outcome of a case could turn on the most seemingly trivial piece of information.

  “I’ll take your word for it.” Gella returned to her chair across from Sasha. “In any case, we sent our response to Sentinel Solution Systems via email on Friday afternoon, and we put a hard copy in the mail. Monday morning, at eight o’clock sharp, Asher Morgan, our senior programmer, called in and quit over the phone.”

  “He didn’t even come in and clean out his … wherever your people keep their personal stuff?” It occurred to Sasha that the rows of standing desks Devon had led her past had all lacked drawers.

  “We don’t keep personal effects in our communal spaces, but every team member has a lock box. And apparently, Asher cleared out his lock box over the weekend. The keyless entry system recorded him logging in Sunday evening, shortly after six p.m. He left just before ten o’clock. No one else was in the space during that stretch of time.”

  “And the data went up on the … um … paste site over the weekend?”

  “To the best of our knowledge, yes. Elizabelle was our junior programmer—now she’s our only programmer. She’s the one who found the breach. She’ll be able to explain the technical stuff better than I can.”

  Gella stood again and headed for the door. Sasha tossed her legal pad back into her bag and trailed behind her.

  Elizabelle didn’t work in the pen with the charity sherpas. She had a private office not much smaller than Gella’s, although it was more Swedish modular furniture, less dark wood. It also had been, until quite recently, a semi-private office.

  A second work station was set up in the far corner of the room. Here, too, Sasha noted there were no desk drawers. Just wide work spaces filled with computer equipment. Elizabelle looked up from one of the oversized monitors when Gella and Sasha came around the Asian screen that functioned as an ad hoc door.

  “Hi, there.” She popped a thumb drive out of a USB port and stood up. “I’m Elizabelle. You must be Ms. McCandless-Connelly. Here are your files. They’re all PDFs.” She pressed the drive into Sasha’s palm in lieu of shaking hands.

  “Thanks. Elizabelle’s a pretty name.”

  The programmer twisted her long red hair into a knot on the top of her head then adjusted her thick, black-framed glasses. “Yeah. My parents couldn’t agree. One mom wanted Isabelle. My other mom wanted Elizabeth. After a four-day standoff, during which they either called me ‘it’ or ‘the baby,’ they compromised.”

  Sasha laughed, disarmed by the woman’s frank friendliness.

  Gella beamed at Elizabelle. “Elizabelle’s a gem. She was the fifth programmer we hired to help Asher. And the only one to survive more than a month.”

  “Wow. How long did you work with him?”

  “Five hundred and thirty-seven days. But who’s counting?” She quirked her mouth into the barest hint of a smile.

  “That bad, huh?”

  Gella coughed. “Asher was very talented. But, unfortunately, he knew it. To say he was prickly would be an insult to porcupines.”

  “Not to mention cacti,” Elizabelle cracked.

  “He sounds like a real sweetheart. Has anyone called for a reference?”

  “Nope. And I don’t expect anyone will. Elizabelle is connected with him on some IT professional network. He updated his profile on Monday afternoon to list Sentinel Solution Systems as his employer.”

  “Then he promptly un-peered me and blocked me.” Elizabelle snorted.

  “Wait. He went to work for the contractor who requested the data?”

  “Evidently.”

  “That’s nervy.”

  “That’s Asher,” Gella explained.

  Sasha scrunched up her forehead. “I’m confused. If he was going to join the company, why leak the data publicly? Why not just put it on a drive and take it with him?”

  Elizabelle was nodding. “You’d have to know Asher for it to make sense. He was so chapped when Gella announced that the company wouldn’t be complying with the information request. Like, pretty much everything irritated him, but that news had him incensed.”

  “He thought DoGiveThrive should’ve just handed over user data that it promised it would keep private?”

  The programmer blew out a long breath. “Yeah. So, Asher was an odd duck. He called himself a libertarian, but he was pretty hardcore about national security. He took one look at the list of names from Sentinel Solution Systems and announced that they were trying to track down terrorists.”

  “Based on the names?” Sasha asked careful to keep her tone neutral.

  “Right.”

  “Is there a list of the requested names on this drive?”

  “Yep.”

  “Good. Oh, wait. I have another question. Even though the company decided not to comply with the request, did you and Asher run the names anyway? Just to satisfy your curiosity?”

  Elizabelle pressed her lips into a thin line and shifted her gaze to a point over Sasha’s shoulder.

  So, that’s a yes. But she needed to hear it from the client.

  “Listen, anything you tell me is confidential. It really doesn’t matter how bad the facts are, as long as you disclose them. The only way anything you say could hurt the company is if you aren’t completely honest. I need to know.”

  Elizabelle chewed on a ragged cuticle.

  “She’s right. Whatever it is, just tell us,” Gella urged. “And don’t bite your nails.”

  “Okay, look. I didn’t run the names. And I didn’t know that Asher did, but he must’ve done it on Friday. I came back from my lunchtime yoga class and he jumped about a mile when I walked into the room. He start
ed screaming at me about sneaking up on him. He tossed his takeout coffee on the floor and said I’d startled him. But … I think he made the mess just to distract me. Because while I was running around looking for a mop, he turned off his display.”

  “Can’t you look at his, I don’t know, keystroke log or something and know for sure?” Sasha asked.

  “If it was one of the sherpas or one of you two, sure. But Asher knew what he was doing. He wiped everything from the system—I mean, every trace of his activity in the past week is gone. Poof. Like it never happened.”

  That would make establishing his liability hard. Maybe impossible. Sasha swore under her breath.

  “Why don’t you tell Sasha about the paste?” Gella said.

  Elizabelle leaned across her desk and tapped her mouse to wake up her computer. “So, after Gella told me Asher quit I started to poke around. Well, first I did a happy dance. Then I started poking around in his files. That’s when I learned that he’d covered his tracks. The only reason he’d do that was if he had something to hide. I mean, he was a jerk but he wasn’t a petty jerk. He wasn’t the type to change everybody’s passwords on the way out the door or anything. And to answer your question about why he didn’t just put the stuff on a drive and take it with him, I think he wanted to do it publicly, through a pastebin, for what do you lawyers call it—plausible deniability?”

  Sasha nodded glumly. “So now, if Sentinel Solution Systems just happens to come into possession of the leaked data they can say they happened upon it on the Internet.”

  “Bingo.”

  “So this site, it’s a hacker thing?”

  “Not really. Pastebin or text storage sites are super common. They’re hosting sites that people like me use to review code with other programmers. You copy the source code and paste it into the site as straight text. Then peers can either inspect the code or troubleshoot it or whatever through an IRC—sorry, that’s an Internet Relay Chat. The whole process is kind of antiquated, to tell you the truth. I mean, it’s older than I am.”

  Sasha was pretty sure she had shoes that were older than Elizabelle. Elizabelle’s fingers flew over the keyboard, and she pulled up a website. She squinted at the white background. It had a distinctly 1990s feel. Clunky, plain, and uninspired. No theme, no video, not even a header picture. Sasha half expected to hear the ‘you’ve got mail’ ding she remembered from her middle school years when her parents would check their email on the family PC.

  “So this is it—the text storage site?”

  “Yes.” She clicked a hyperlink on the right side of the page and a snippet of gibberish appeared in a box in the center of the page.

  “So, it’s for coders? Not hackers?”

  “Well, the sites originated as places to share code. But anonymous posters—leakers, whistleblowers, anyone who has a reason to hide their identity—have been using pastebin sites for years to post information. Sometimes that information includes sensitive data, and, yes, sometimes it’s been obtained by methods that you would probably call ‘hacking.’ But you have to understand the ethos in the programmer community. Hacking doesn’t have a strictly negative connotation. There’s white hat hacking to reveal vulnerabilities so they can be fixed. There’s disseminating information to counter government propaganda. And there’s black hat hacking, too, of course.”

  Elizabelle paused and looked over her shoulder as if to confirm Sasha and Gella were following her train of thought. They both nodded.

  She continued, “There are also all sorts of random postings. Posts range from recipes to creative writing to detailed rants about conspiracy theories. You could stumble across just about anything, really.”

  She clicked through several hyperlinks and the text in the central box changed from a snippet of code to a poem to a string of digits to what appeared to be a manifesto. All the entries were titled ‘Untitled.’

  “And you found the data Asher leaked here on this site?” Gella asked.

  “Yeah. Once I realized he’d messed with our local servers and the remote backups, I got curious. So, I clicked through a hot mess of links from Sunday night until I found this.” She closed out of the browser and opened an image on her desktop.

  Gella inhaled sharply.

  “Don’t worry. I took a screenshot and then immediately messaged the developer who runs the site and had it taken down within minutes.”

  “Good work. And quick thinking.” The programmer’s fast response would go a long way toward minimizing DoGiveThrive’s exposure.

  She ducked her head and shrugged off Sasha’s praise. “Thanks. I know the guy—I met him at a conference last year. But, he did say it was up for about ten hours.”

  Gella turned to Sasha with worried eyes. “That’s bad, right?”

  “It’s going to depend on how many views it had. And how many downloads or copies were made. And by whom. Will your friend be able to tell us that, Elizabelle?”

  “Will he be able to? Sure. Will he? I can’t say for sure. This crowd embraces the idea that information wants to be freely available. Like, taking down the data was one thing. Ratting out everyone who looked at it … that may be further than he’s willing to go, you know?”

  Sasha did know. But it was not the answer she’d hoped for. “Okay. Gella and I will craft a legal strategy to get that information from the hosting site through the courts, if necessary. But in the meantime, could you approach him as a friend? Explain why this breach is so bad from the company’s perspective, try to persuade him?”

  Elizabelle flashed a bright smile. “I’ll give it a shot.”

  “Good. Don’t put anything in writing to him. But after you talk, jot down some notes to memorialize your conversation.”

  She nodded her understanding.

  “Do you need anything else from Elizabelle? She’s pretty busy right now,” Gella pointed out.

  “Just one more question. I’m looking at this screenshot and it appears your users’ names and zip codes were revealed. Is that all Asher leaked?”

  “Is that all?” Gella was aghast.

  Sasha raised both hands to slow her down before she got whipped up. “I know your business model promises anonymity. But from a crisis management perspective, things could be much, much worse. He could have posted full addresses, telephone numbers, passwords. Or social security numbers, credit card numbers. I mean, he didn’t even match the names to the projects they funded or benefited from, did he?”

  She understood why DoGiveThrive was spiraling into a panic, but the truth was this breach really didn’t lend itself to real liability. Actual, provable damages stemming from the leak seemed out of the question.

  Gella exhaled. “Yes, I suppose that’s all true. But this still feels like a terrible violation.”

  “It is. And we’re going to harness that emotion you’re feeling when we communicate the breach to your tribe. But, for instance, I would normally suggest you offer free credit monitoring for the affected users. In this case, there’s no way a name and a zip code is going to expose anyone to credit fraud or identity fraud. Trust me, this is not as awful as it seems.”

  Both women instantly brightened. Gella rolled her neck. The tension in the room dissipated. Sasha gave herself a moment to revel in the rare feeling of delivering good news to a client without a corresponding giant legal bill.

  What she couldn’t have known, though, was she was wrong. Dead wrong.

  5

  Leo realized he’d been staring blankly at the painting hanging on the dining room wall above Sasha’s head. He blinked and gave his head a little shake.

  “Sorry, were you saying something?”

  She narrowed her eyes and studied his face. “What’s wrong with you?”

  He sucked in a breath. He had to pull himself together. His wife was many things, but chief among them, was perceptive as hell. She was impossible to surprise, impossible to evade, and, to top it off, she was tenacious. If she suspected something was troubling him and, worse, that he was h
iding it from her, she’d be after him like she was Mocha and he was a hambone.

  He spared a glance at their lazy retriever snoozing in the kitchen with the cat curled around his tail. Scratch that. Mocha was too well-fed and pampered to pursue food the way Sasha would pursue information.

  “Earth to Connelly.”

  He shook his head again. She’d use her lawyer lie-detecting superpowers to tell if he made something up. Better to go with a kernel of the truth and then dance away from the topic.

  “Sorry. I’m just a little distracted. Hank and I met with the boss today.”

  She paused, her wine glass halfway to her lips. “Ingrid Velder’s in town? I thought she only visited you and Hank once a month.”

  “Usually, she does.”

  Worry sparked in her green eyes. “What’s going on? Why is she here?”

  He took a drink before answering. “She didn’t stay. She was in town two hours, tops. It’s crazy that the department pays to maintain an office for her here, when you think about it.”

  “Connelly …” Her voice held a warning.

  “What?”

  “We have a rare adults-only dinner. No twins. No forks to pick up off the floor. No need to scrape potatoes off the table when we’re done. We’re eating in the dining room, for crying out loud. Do you think I want to squander this brief miracle on a conversation about the government’s wasteful use of our tax dollars? Spoiler: no, I do not. The whole reason I even let Maisy take Finn and Fiona to the arts and movement festival was so we could reconnect. You know, have an actual conversation. Remember those?”

  He chuckled. “It’s hazy, but I think I have a distant memory. I seem to recall finding it enjoyable.”

  Her bow lips curved into a smile. “Good. So, let’s talk. Lord knows Maisy’s going to bring them home sticky, stuffed with treats, and overstimulated.”

  “From an arts and movement festival for preschoolers?”

  “It’s Maisy,” she countered.

  He laughed again. It felt almost genuine this time. “Point taken.”