Threat Vector Read online

  The camera was connected via Bluetooth to his iPhone, and it was a quick and easy thing to review the last set of images. The camera had night-vision capability, so the faces, while not perfectly clear, were a hell of a lot better than they would have been if they were shot without a flash with a normal camera in this nighttime street.

  He scrolled through them. He saw the first two meatheads pass by; they had the requisite “Fuck off” expressions of gangsters who thought they owned the sidewalk on which they walked. Behind them was the third security man; he looked to be as much of a thug as the others, but Adam noticed the man’s left hand was low on the elbow of the punk rocker, leading him along as they walked up the street.

  The kid was odd, and it was not just his clothes. He held a handheld computer with both hands and thumbed it furiously. Whether he was playing a game or working on his thesis, Yao could not tell, but he was intense and completely unaware of his surroundings. It looked to Adam as if the kid would walk into moving traffic without the three men in front of him guiding him up the street.

  Adam looked at the young man’s face now, illuminated via night-vision enhancement. He scrolled back and forth between the two closest and most in-focus images on his phone. Back and forth.

  Back and forth.

  The American CIA man could not believe his eyes. He muttered to himself, “I know this asshole.”

  Yao stood quickly and headed off in the direction of the four men. As he passed his magnetic remote camera, he deftly reached up and pulled it off the magazine stand without breaking stride.

  Adam found the group ahead of him in the crowd, and he stayed a full city block behind them as they walked, but he managed to keep them in view for a few minutes, until they turned and went into the Kwong Wa Street post office.

  Normally the young CIA officer would not chance a close encounter, but adrenaline was racing through his body, and it encouraged him forward. He walked right into the post office. It was closed for the evening, but the P.O. boxes and mail slots were still accessible, as was a stamp machine.

  Adam walked right by the four men, he felt the eyes of the 14K goons on him as he passed, but he did not meet their gaze. Instead he pulled some HK dollars out of his pocket and bought stamps.

  As he waited for the stamps to be dispensed he glanced over his shoulder, taking a mental snapshot of what he saw. The punk rocker had unlocked a P.O. box on the wall and was going through the mail on a wooden table. Adam could not hope to read the box number from across the room, but on a second glance, this one as he exited the post office, he took another quick mental snapshot.

  He stepped back out into the street. He did not smile; he would not think of breaking his cover like that. But he was happy.

  He got it.

  The young man’s P.O. box was the largest of the three sizes along the southern wall, four from the left, two from the bottom.

  He walked deeper into the night, some eighty meters away from the building, and then he turned around.

  The four men left the post office and headed in the opposite direction, and then turned into an apartment building, the Kwong Fai Mansion.

  Yao looked up at the building. It was easily thirty stories high. There was no chance in hell he could tail anyone inside that building. He turned and headed back for his car, still somewhat in shock by tonight’s revelation.

  It wasn’t every day, after all, that Adam Yao stumbled upon a fugitive.

  The kid’s name was Zha Shu Hai, and Adam first heard of him more than a year earlier, when he was e-mailed a bulletin from the U.S. Marshals Service asking him to be on the lookout for an escaped felon who, both Marshals and FBI suspected, would be heading to China.

  Zha was an American citizen who’d been arrested in San Diego for trying to sell the Chicoms classified engineering secrets from his employer, General Atomics, the makers of unmanned aerial vehicles for the Air Force. He’d been caught red-handed with hundreds of gigabytes of design information about the secure networks on which communications and GPS information was sent, and he’d bragged to the Chinese embassy that he knew how to bring the system down by hacking into its sat link, and how to obtain deep persistent access into the Department of Defense’s secure network by building a RAT that could infect a government contractor’s network and then swim upstream. The Feds did not believe him, but they weren’t sure, so they offered him partial immunity if he told General Atomics everything he knew about the system’s vulnerabilities.

  Zha refused, and was sentenced to eight years in prison.

  After just one year in a minimum-security federal correctional facility, however, he walked away from a work-release program and disappeared.

  Everyone in the States knew Zha would try to slip back to China. Adam had been working in Shanghai at the time, and he’d received the BOLO, or “Be on the lookout” notice, from the Marshals Service because there was a reasonable expectation that some high-tech firm in Shanghai would employ Zha if he did make it to the mainland.

  Adam had all but forgotten about it, especially after he moved from the mainland to Hong Kong.

  Until tonight. It was clear Zha had done much to change his appearance; the booking photo on the BOLO showed a nondescript young Chinese man, not a spiky-haired flamboyant punk rocker, but Adam Yao recognized him nonetheless.

  As Adam climbed into his car, he wondered about this strange relationship. Why the hell would Zha be here, in the protection of the Triads? Much like his discovery that Mr. Han had a relationship with the local street thugs, Zha was, if everything the Feds said about his abilities as a top-level black-hat hacker were to be believed, seriously out of the 14K’s league.

  Yao had no idea what this meant, but he knew he’d be placing all of his other work on hold in order to find out.

  One other thing was certain, though. He would not be shooting an e-mail to the U.S. Marshals Service or the FBI.

  Adam Yao was a NOC; he wasn’t exactly a team player. He knew that a call to the Marshals Service would bring marshals and embassy staff here to the post office on Kwong Wa Street and the Mong Kok Computer Centre, and he also knew good and well that Zha and the 14K would see all the white guys with earpieces, they would leave the area, and that would be that.

  And there was another reason Adam decided to sit on this news for now.

  The obvious breach at CIA.

  In the past few months several CIA initiatives had been thwarted by the MSS. Well-placed agents in the government were arrested, dissidents in contact with Langley were imprisoned or executed, electronic operations against the PRC were discovered and shut down.

  At first it appeared to be just bad luck, but as time went on, many were sure the Chinese had someone working in Beijing Station.

  Adam, the one-man band, had always played his cards close to his vest. It came with being a NOC. But now he really was operating out on his own. He sent Langley as little cable traffic as possible and had no communication whatsoever with either Beijing Station or the CIA field officers at the U.S. consulate in Hong Kong.

  No, Adam would sit on his discovery of Zha Shu Hai, and he would find out on his own what this guy was doing here.

  He just wished he had a little help. Being a one-man band made for long hours and frustrating setbacks.

  That said, it was a hell of a lot better than getting burned.

  TWENTY-SIX

  It might come as a surprise to many of the patrons of the Indian Springs Casino on Nevada’s Route 95 to know that America’s most distant and most secret wars are fought from a cluster of single-wide trailers a little more than a half-mile from the blackjack tables.

  In the Mojave Desert northwest of Las Vegas, the runways, taxiways, hangars, and other structures of Creech Air Force Base serve as home to the 432nd Air Expeditionary Wing, the only wing dedicated to unmanned aircraft. From here, with
in sight of the Indian Springs Casino, pilots and sensor operators fly drones over denied territory in Afghanistan, Pakistan, and Africa.

  Drone pilots don’t climb into a cockpit for takeoff; instead they enter their ground-control station, a thirty-foot-by-eight-foot trailer in a parking lot on the grounds at Creech. Detractors, often “real” pilots, refer to the 432nd as the Chair Force, but even though the men and women of Creech are some 7,500 miles from the battle space over which their aircraft fly, with their state-of-the-art computers, cameras, and satellite control systems they are as connected to the action as any fighter pilot looking out a canopy.

  Major Bryce Reynolds was the pilot of Cyclops 04, and Captain Calvin Pratt served as the aircraft’s sensor operator. While Reynolds and Pratt sat comfortably at the far end of their ground-control station, their drone, an MQ-9 Reaper, flew just inside the Pakistani border, twenty thousand feet over Baluchistan.

  A few feet behind the pilot and sensor-operator seats in the GCS was master control, a lieutenant colonel overseeing the Reaper’s mission, coordinating with units in the Afghanistan theater, the UAV’s physical base at Bagram in Afghanistan, and intelligence operatives monitoring the flight in both hemispheres.

  Though this evening’s flight was designated reconnaissance and not a hunter/killer mission, the Reaper’s wings carried a full weapons loadout, four Hellfire missiles and two five-hundred-pound laser-guided bombs. Reconnaissance flights often came upon targets of opportunity, and Cyclops 04 was ready to wreak destruction, should the need arise.

  Reynolds and Pratt were three hours into their six-hour mission, monitoring ground traffic on Pakistan’s National Highway N-50 near Muslim Bagh, when the flight’s master controller voice came over their headsets.

  “Pilot, MC. Proceed to the next waypoint.”

  “MC, pilot, roger,” Reynolds said, and he tilted the joystick to the left to give Cyclops 04 twenty degrees of bank, then looked down to take a sip of his coffee. When he glanced back up he expected to see his monitor displaying the downward-looking infrared camera indicating a bank to the west.

  But the monitor showed the vehicle was continuing its straight path.

  He looked at the attitude indicator to check this, and saw the wings were level. He knew he did not have the autopilot engaged, but he checked again.

  No.

  Major Reynolds pushed the stick a little harder, but none of the relevant displays responded.

  He tried banking to the right now, but still there was no response from the bird.

  “MC, pilot. I’ve got a dead stick here. Not getting any positive reaction. I think we’ve got a lost link.”

  “MC copies, understood Cyclops 04 has gone stupid.” Gone stupid was a term UAV pilots used to indicate the platform was no longer responding to operator commands. It happened sometimes, but it was a rare enough occurrence to warrant immediate attention from the base’s technicians.

  Sensor operator Captain Pratt, seated on Reynolds’s right, said, “Sensor confirms. I’m not getting any response from the UAV.”

  “Roger,” said master control. “Wait one. We’ll troubleshoot.”

  While Reynolds watched his aircraft fly due north, the heading he had given the Reaper several minutes earlier, he hoped to hear the MC report back that they had identified some glitch in the software or the sat link. In the meantime, there was nothing he could do but watch the screens in front of him, as uninhabited rocky hills passed by twenty thousand feet under his drone.

  The Reaper software contained an important fail-safe that the pilot in the GCS expected to see initiated in the next few moments if the technicians were unable to get the UAV back online. Once Cyclops 04 went a certain amount of time with a broken link to the GCS, it would execute an autopilot landing sequence that would send the vehicle to a predetermined rally point and put it safely on the ground.

  After a few more minutes of flying untethered to the GCS and unsuccessful attempts by technicians to find what was going on with the Linux-based software, Reynolds saw the attitude indicator move. The starboard wing lifted above the artificial horizon, and the port wing dropped below it.

  But the emergency autopilot landing fail-safe had not kicked in. The drone was making a course correction.

  Major Reynolds let go of the joystick completely to confirm he was not affecting the Reaper accidentally. The wings continued to tilt; all camera displays showed the vehicle was turning to the east.

  The UAV was banking at twenty-five degrees.

  Captain Pratt, the sensor operator, asked softly, “Bryce, is that you?”

  “Uh . . . negative. That is not my input. Pilot, MC, Cyclops 04 just altered course.” As he finished his transmission he saw the wings level out. “Now it’s holding level at zero-two-five degrees. Altitude and speed unchanged.”

  “Uh . . . repeat last?”

  “Pilot, MC. Cyclops flight is doing its own thing here.”

  A moment after this, Major Reynolds saw that the speed of Cyclops 04 was ticking up quickly.

  “Pilot, MC. Ground speed just went up to one-forty, one-fifty . . . one-sixty-five knots.”

  While a nonresponsive aircraft that had temporarily “gone stupid” was not unheard of, a UAV executing its own turns and increasing speed without controller input was something never seen before by the operators in the GCS or any of the technicians in communication with them.

  For the next several minutes the pilot, the sensor operator, and the MC worked quickly and professionally but with a growing level of concern. They cycled through programs on multiple screens, clearing out autopilot commands and waypoint coordinates and loitering information, all trying to clear some glitch command that had caused their armed aircraft to stray off course.

  Their monitors showed the infrared image on the ground as the UAV proceeded to the east. None of their attempts to retake control had worked.

  “Pilot, MC. Tell me we’ve got someone working on this?”

  “Roger that. We’ve . . . we’re trying to reestablish link. We’ve established comms with General Atomics, and they are troubleshooting.”

  The UAV made several more speed and course corrections as it neared the border with Afghanistan.

  Sensor Operator Cal Pratt was the first man at Creech AFB to say aloud what everyone aware of the situation was thinking. “This isn’t a software glitch. Somebody’s hacked the PSL.” The primary satellite link was the satellite umbilical cord that sent messages from Creech to the Reaper. It was—theoretically, at least—impossible to disrupt and take over, but there was no other explanation anyone on the ground could come up with for what was happening to the UAV 7,500 miles away.

  The GPS readout indicated that Cyclops 04 crossed the border into Afghanistan at 2:33 local time.

  Reynolds plotted the current course. “Pilot. At present heading and speed, in fourteen minutes Cyclops 04 will arrive over a populated area. It will pass two klicks east of Qalat, Afghanistan.”

  “MC copies.”

  “Sensor copies.”

  After a few more seconds: “MC. We are in contact with intelligence assets at Kandahar . . . They advise there is a forward operating base two kilometers east of Qalat. FOB Everett. U.S. and ANA forces on the ground there.”

  “We’ll be passing directly overhead.”

  It was quiet in the GCS for several seconds. Then Captain Pratt said, “Surely to God . . .” He paused, not even wanting to say the rest aloud. But he did say it. “Surely to God it can’t launch ordnance.”

  “No,” answered back Reynolds, but he did not sound so sure. “Pilot, MC. Do we want to . . . uh . . . ascertain whether or not we have any air assets in the area that can, uh, shoot down the UAV?”

  There was no response.

  “Pilot, MC, did you copy my last? It is clearly in someone else’s hands and we d
o not know their intentions.”

  “Copy, pilot. We are getting in contact with Bagram.”

  Reynolds looked to Pratt. Shook his head. Bagram Air Force Base was too far away from Cyclops 04 to be of any use.

  Within moments there was more activity in the GCS, the images on several displays changed, and the onboard cameras began switching through color mode to infrared/black-hot mode and then to infrared/white-hot mode. The display cycled through all settings multiple times but not at a constant speed. Finally it settled on infrared/white-hot.

  Reynolds looked over at Pratt. “That’s a human hand making those inputs.”

  “No doubt about it,” confirmed the sensor operator.

  “MC, pilot. Bagram advises there is a flight of F-16s inbound. ETA thirty-six minutes.”

  “Shit,” said Pratt, but he wasn’t transmitting. “We don’t have thirty-six minutes.”

  “Not even close,” confirmed Reynolds.

  The camera lens display on the primary control console began adjusting, finally zooming in on a distant hilltop, upon which several square structures lay in a circular pattern.

  “MC. That’s going to be Everett.”

  A green square appeared on the primary control console around the largest building on the hilltop.

  “It’s locked up,” Pratt said. “Somebody has access to all capabilities of Cyclops.” He feverishly tried to break the target lock with keyboard controls, but there was no response from the vehicle.

  Everyone in the GCS knew that their drone was targeting the American base. And everyone knew what would come next.

  “Do we have somebody who can get in contact with this FOB? Warn them that they are about to receive fire?”

  The MC came over their headsets. “Kandahar is on it, but there is going to be a lag.” He followed that with, “Anything that’s about to happen is going to happen before we can get a message to them.”

  “Christ Almighty,” said Reynolds. “Fuck!” He jammed his joystick hard to the left and right, and then forward and back. There was no reaction on the screen. He was nothing more than a spectator to this looming disaster.