CHAPTER ONE
Bethesda, MD
Friday, 7:00 a.m.
VALERIE SANCHEZ SUMMONED HER MOST dazzling smile and prepared to lie through her teeth. She unzipped her long wool coat as she approached the Westgate Defense Systems security desk before the early crowd of employees arrived.
“Hi, there. It’s my boyfriend Brian’s thirtieth birthday today, and I’d like to decorate his cubicle before he arrives.” She tugged the bouquet of Star Wars–themed helium balloons she had picked up that morning, making the shiny Darth Vader and R2D2 bounce.
The security guard, his badge pinned proudly to his chest, glanced around the empty lobby and swallowed. “I’d like to help you, ma’am, but I can’t let in anyone without an employee ID or visitor’s pass. Your boyfriend would have to vouch for you.”
“That would kind of give away the surprise, wouldn’t it?” she asked, her grin cheeky. “But, I understand.” Resting her free elbow on the counter, she leaned forward enough to give the man a glimpse of her already ample, plumped-to-the-max cleavage.
When his eyes strayed to the shiny little charm sewn to the front of her bra, she asked, “What if you escorted me?”
He snapped to attention, raising his eyes to meet her gaze, and cleared his throat. “I can’t leave my post. Not until the other guy shows up.” He checked his oversized sport watch. “And even then, you’d need someone to sign you in.”
Based on her previous surveillance, she was ninety-nine percent positive the other guard wouldn’t arrive for at least ten more minutes. Her partner Jay had pegged this one as more vulnerable and figured if she could get him alone, he’d be more susceptible to her “wiles.”
“I could be your guest,” she said, pushing the red-framed prop glasses onto the bridge of her nose.
His eyes widened. “But I don’t know you.”
“Well, let’s change that.” She held out her hand and smiled. “I’m Vanessa Rios.”
His face reddened all the way up to the roots of his receding brown hair. For a full five seconds, he didn’t respond. Then he grasped her hand in his own thick, clammy one. “John Watkins.”
She resisted the instinct to slide her palm against his. If she laid on the sex appeal too thick, he’d question her devotion to Brian, the programmer whose computer had access to the entire network at Westgate. A man she’d never met.
“Nice to meet you, John. I work in human resources at Farmington International. That’s where I met Brian before he got the job here. We’ve been dating for about two years.” She raised her eyes in thought. “Let’s see, what else? I’m a Libra, my friends call me Van even though I hate it, I have a sister, two cats, and a small apartment in Georgetown. I love living in D.C., but hate the traffic, and someday I want to do something important that changes the world for the better.”
He was giving her a funny look, but she was pretty sure she had him. “Or would it be easier if I just showed you some ID?”
A small part of her almost hoped he wouldn’t give in. As much as she wanted her pretext to work, this guy would be in big trouble if she succeeded. And he seemed nice.
Then again, if he wasn’t doing his job properly…
John chuckled and shook his head. “If you can wait until my partner shows, I’ll take you up.”
She glanced at her watch. “Unfortunately, I can’t. I have to leave for work in the next five minutes or I’m going to be late.” Frowning, she asked, “You know what? When your other half gets here, can you put this stuff on Brian’s desk for me? I was going to really do it up”—she placed a sack of streamers, banners, and party favors on the desk—“but the balloons will have to do. Oh! And don’t forget the cupcakes.”
Popping the lid on the Tupperware full of chocolate cupcakes with colorful confetti candy on top, she pulled out two and leaned over the counter to set them on John’s workspace. “One for each of you.”
The guard laughed outright and shook his head. “You’re something else, Van.” He glanced around the empty lobby, chewed on his lip, and stewed for several seconds before nodding. “All right, surrender your ID and I’ll give you five minutes.”
“Oh, my God, thank you.” She flashed him a smile as she laid her jacket and scarf over a nearby chair. Then she traded the fake license for a clip-on visitor’s badge, grabbed the party supplies, and turned for the elevators. “I’ll be quick.”
“I’ll be watching.” He pointed to the TV monitors.
Heart pounding, Valerie had to keep herself from running across the gleaming white marble. Not that she could have run in her heels anyway. She didn’t have enough practice wearing them, and they were pinching her toes. A minute later, she emerged onto the third floor and made her way along a row of blue cloth cubicles. Based on the map Jay had found God-knew-where, Brian’s desk was the fourth one on the right.
The entire space was eerily hushed, with no sound but the faint hum of fluorescent light bulbs and the whoosh of warm air coming from vents overhead.
She glanced up at the camera stationed on the ceiling behind Brian’s cubicle and waved. Then she clipped the balloons to the desk, casually positioning them to block the camera’s view of the computer. Draping streamers with one hand, she leaned over the keyboard, giving the guard a shot of her ass. She let her dress ride up as she used her other hand to snap a tiny gadget into a slot on the back of the computer.
Quickly, she finished decorating the small workspace and hightailed it to the lobby. “Thanks so much. I really appreciate this, John,” she said, smiling as she returned the badge for the license and donned her winter armor.
“Brian’s a lucky guy,” he murmured as she walked toward the tall glass-encased exit.
If he only knew. She gave the guard a little wave and forced herself to stroll nonchalantly into the cold.
Two hours after her little show for the Westgate guard, Valerie popped a few Skittles in her mouth and checked the time. Not-really-birthday-boy Brian was late logging into his computer. If she and Jay could crack Westgate, maybe her boss would finally let her work in the field with one of the covert ops teams.
The terrorist hunters—mostly buff, stoic, former military guys oozing swagger—often took along a computer specialist to monitor and control the target’s computer systems and perimeter alarms, allowing Aggressor International’s “wet work” guys to sneak up on the terrorists. Valerie had volunteered, but Duncan Hollowell had shut her down.
Something about fraternization. Because the big, strong, soldier types always went for the quiet nerdy girl, right?
She snorted.
Valerie wanted to kick terrorist butt too, even if her methods didn’t involve guns. She was one of Aggressor’s best white hat hackers. Duncan had no good reason for denying her beyond the fact that she didn’t have the literal balls.
Even the military had gotten over it.
Sexist.
On the desktop, her cell phone buzzed. Kevin Xu’s name lit up the display.
She sat up and swallowed her mouthful of fruity candy. Kev had been head of IT at Aggressor until a few months ago, and they’d kept in touch after he passed the bar and became a technical patent attorney at Bidwell, Muñoz & Christie, a law firm in Crystal City.
“Can I come back?” he asked after they went through the standard greetings, almost sounding serious.
She laughed. “What happened?”
“Our system administrator is a joke. We got hacked last night, and he easily could have prevented it.”
“How’d they get in?”
“SQL injection. We were running an out-of-date version of the mail server that had a known exploit.” He sighed. “Jesus, there’s so much potential for damage. To our clients, our cases, and God knows what else. Bidwell seems extra nervous.”
Kevin was right. The admin should have found the problem on his own, and the timing was even more unlucky considering Valerie had found that exact vulnerability in their systems a few weeks ago, along with several others.
“Why do people bother to hire Aggressor if they aren’t going to do anything with the info we give them?” she asked on a sigh.
There was a long pause. “What do you mean?”
She frowned. “BMC hired us to do a pen test. Duncan sent the results and recommendations last month.”
“Huh. I didn’t hear anything about it,” he said with irritation. “Then again, I’m not a partner, so I’m not privy to everything.”
“I’m also guessing the admin didn’t want to let the entire firm know how incompetent he was. Even more so considering he failed to patch the holes.”
“You want a job?” Kevin asked. “I’m thinking we’ll have an opening soon.”
“Ha, not in a million years.”
They chatted for a few more minutes, and then she got back to work on Westgate. But she couldn’t help wondering how many of the clients she hacked didn’t follow her recommendations to protect themselves. It wasn’t often she got a glimpse beyond sending the report.
The thought popped up again at home that evening when she was hanging out in a chat room where white hat hackers—probably some black hats too, who were sometimes the same people—and network administrators discussed tools, let each other know about vulnerabilities and how to fix them, and talked about the computer security industry.
A post from P1ut0 caught her eye. She shifted on her comfy couch, its worn microfiber catching at her sweatpants, while Santigold played through her headphones.
Her apartment wasn’t huge, or especially new. The kitchen was the size of a hamster cage, and the living room sofa had to double as her office, but for one person it was fine.
“Did you see that Parker + Fuchs got p0wned?” P1ut0 asked, talking about the giant personal products corporation based in Cleveland.
P + F was another Aggressor client from more than a year ago. They’d actually been pretty full of holes. A simple scan had identified several known, easy-to-fix issues within their system.
But even if they’d taken her advice, that didn’t mean new vulnerabilities hadn’t cropped up. Something as simple as a software or hardware update might bring defects that black hats could use to force their way in. Once someone identified the bug, any company using the affected system became an easy target until it was patched.
P1ut0 continued, “Someone there failed to notice that the print routers were set to admin/admin. Check your devices, people! That’s just plain lazy.”
Valerie jolted. The print routers had most definitely been on her report. The company had left the administrative username and password set to the defaults of “admin,” a common mistake, especially with peripheral devices like routers.
“When was the P + F attack?” she typed, using her primary chat room handle SPYDRCH1C4. It was an angry teen’s break from the screen name her papá had bestowed on her as a kid: CrackerJill. He was proud of her for being a girl in a world largely populated by boys and men. And, sadly, proud of their villainy. While hackers attack for the fun and challenge—or to protect their clients—crackers are malicious.
She and Papá had been crackers. And both of her dads had paid the price.
“Last week,” P1ut0 replied.
She sagged back into the soft cushions and stared at the popcorn ceiling, its dark and light gradations reminiscent of M.C. Escher’s most abstract artworks. Would P + F really have ignored her recommendations? Maybe they’d purchased new print routers and set them up in the same, dumb fashion as before, but that would be the height of idiocy.
A little chill went through her. Had any of Aggressor’s other clients been hacked after she ran a pen test—a penetration test—on them?
Three hours later, she’d managed to confirm five more attacks on former clients through various sources. And forgotten to eat dinner.
“Shit.” Heedless of the time, she dialed her boss. “Sorry to bother you at home, Duncan, but we have a problem.”