I debated calling Lisa the next morning to tell her what I had learned about the extra error messages from First Chicago. I hesitated though, partly because I was worried that she might be under heavy surveillance, even to the point of wire-tapping her phone, and partly because I didn't want to be too pushy. She had agreed to give me a chance to sort things out but she also was understandably edgy. Better to give her time to settle down.
I didn't need to worry about the second reason, and the first was out of my control before I realized --- she called me.
She told me that I wasn't the only one that had approached her about the EFT debacle. While I had been browsing through my EFT files the night before, she had another uninvited visitor at her apartment. Somebody by the name of Rudy Levinski had stopped by and introduced himself as an employee of First Chicago Trust. Like me he seemed to know her story and was anxious to solve the mystery. Like me, he needed her help but did not want to involve the police.
I didn't like the sound of this but refrained from saying so to Lisa. To condemn this man would be tantamount to condemning myself, since there was little difference in our stories. I wondered what his involvement might be. Maybe he was a whistle-blower anxious to expose illegal activity at First Chicago. But if that were the case wouldn't he go straight to the police, rather than avoid them?
``Do you know him?'' Lisa asked.
``Nope. Never heard of him. Did he explain his objectives?''
``Only that he wanted to help me... the same as you.''
I wondered what she must think, with good samaritans coming out of the woodwork. I also wondered what the police must think, for if they did indeed have her building under surveillance then the sight of people parading in and out must seem peculiar.
``Look,'' I said, ``I don't know what this guy is up to. He might really be a First Chicago employee as he claims to be, but he might not be. I can't tell you what to do, but I would appreciate it if you do not take him up on his offer.''
``Well I have given it some thought and I think it would be best if you take him up on his offer.''
Huh?
She continued on without skipping a beat, ``I can put you in touch with him. The two of you can sort out the mess or fend each other off, or whatever. Me, I am going to distance myself from both of you. The way I see it, both of you are petty hackers at the least and major criminals at the worst.''
``Wait a minute ---''
``No you wait a minute,'' she snapped. ``I'm not done. Talk to Mr. Levinski and figure out what's going on. I won't report either one of you to the authorities right away. But if one or the other of you can't make some headway in the next couple of days then I'm going to the cops. Got it?''
Her words were crisp and she had delivered this last message seemingly without stopping for a breath. She had made up her mind; there was no room for negotiation. Plus, I had no chips with which to bargain. Reluctantly, I accepted her proposition and she gave me Mr. Levinski's phone number.
After hanging up the phone I considered what Lisa had said. I did not have much choice but to call Mr. Levinski. Ms. Cryer had deftly taken control of the entire situation. As the only person in contact with all of the players, she enjoyed a unique position and she was calling the shots.
I hesitated but called the number Lisa had given me. Mr. Levinski answered on the second ring. His European accent was noticeable immediately. He sounded as if he was probably in his 30's. I introduced myself as a friend of Ms. Cryer's. I said that she had asked me to contact him on her behalf. He sounded nervous and seemed anxious to end the conversation quickly (I had called him at work). He was, however, ready to talk to me and we arranged to meet down at the lake-front that evening at 6:00.
That afternoon I took the bus to the Aquarium and walked north along Lake Michigan to the fountain where we had agreed to meet. It was a pleasant evening. The forecast had warned of rain later in the night but there was no signs of it. The water was bright blue. Stunning. There were boats sprinkled over the surface, some small and some large. I passed by a couple of fishermen sitting at the edge of the water. As I neared the spot where Mr. Levinski and I had agreed to meet I slowed down and studied the pedestrians. Rudy Levinski had described himself over the phone as a dark-haired man in his late 30's wearing a grey suit and yellow tie. I didn't see anybody that fit that description. I looked at my watch --- it was 6:15. I was fifteen minutes late. Could he have left already? I walked over closer to the street. There were many people, some appeared to be waiting for a rendez-vous, but nobody fit the description I had been given. Then, suddenly I saw him. He was walking up to me at a rapid clip, having seen me before I saw him. He was slightly plump. He was short and wore glasses. The frames of his glasses were thick black plastic and seemed too wide for his face. This, combined with the strength of the prescription, made his glasses quite prominent. His forehead glistened with sweat. He looked very uncomfortable as he extended his hand and introduced himself. He motioned toward the lake and we strolled to the water's edge as we talked.
He claimed to be working in the Electronic Commerce department of First Chicago Trust. The Electronic Commerce department is mainly EFT work, he said. His title was that of Security Technician. His job was to operate the EFT system and take part in incident response actions, meaning that he was responsible for detecting and repairing any problems caused by hackers. Needless to say his entire group was right in the thick of things and feeling a lot of heat.
I listened carefully and tried to guess what he knew of my involvement. I could not detect any animosity or bitterness in his demeanor and concluded that Lisa had not told him about my experiments. Good. I would keep it that way, at least for the time being.
``I had hoped to speak directly to Ms. Cryer,'' said Levinski. ``I may have some information that would be useful to her. As an employee of the bank I am aware of some aspects of this case which may still be a mystery to the authorities. However, forgive me, I must be careful who I approach on this matter. Ms. Cryer appears to me to be an innocent victim. I too am a victim of sorts. If she and I can pool our information we may be able to extricate ourselves from this matter.''
His English was far better than his accent would lead one to expect. He spoke slowly and crisply, carefully enunciating every word. His hands remained clasped behind his back and he stared out across the water as he spoke. He made eye contact only occasionally. The perspiration on his brow was heavier now. He spoke so coolly and calmly yet looked so hot and uncomfortable.
``We can help each other, she and I. By trading information...'' he stopped, saying nothing for a while. We stood in silence. When he did speak again, it was with the same slow and deliberate delivery.
``Working through a liaison tends to make communication less efficient. In a delicate matter such as this --- and I assure you this is delicate --- it is perhaps better to meet face-to-face. No?''
OK, I got the picture. He saw me as a representative for Lisa and he wanted to talk to the real thing. I was an obstruction. I didn't respond immediately. I slowly panned the surrounding area judging all the passers-by. Nobody appeared the least bit interested in us and nobody was within ear-shot.
Could I trust him? Did I have a choice? Lisa had already decided that he and I would have to work together or alone, but not with her. So far I had been unable to make much headway on my own. If he really was a bank employee and really was directly involved with EFT's and security, then he would be a valuable ally. But could I count on him as an ally? He might turn me in to the authorities the moment he learned what I had done. He had hoped to talk to a woman he viewed as an innocent victim not a person who had helped facilitate the thefts.
``I'm not merely a liaison,'' I began. He turned slightly in my direction but said nothing. His expression was politely inquisitive. A small smile formed on his lips and he raised one eyebrow.
``I too approached Lisa Cryer with an offer to trade information,'' I said. ``She suggested that I meet with you because you and I both have information to trade.'' I was reluctant to say more. It is one thing to admit illegal activity to a private citizen such as Lisa and quite another to confess to a bank investigator.
``I see,'' Levinski said softly. He now turned and faced me squarely. He appeared to study me for the first time now. He asked who I worked for. When I explained my employment situation, it seemed to please him and put him at ease. He unclasped his hands and put one in his pocket. He wiped his forehead with the other. We then danced around the matter of trading information, both of us reluctant to divulge even the nature of our secrets without first receiving at least an inkling of the other's secrets.
I wondered what he knew about the inner machinations of his bank. From the beginning the behavior of First Chicago had been suspicious to me. I recalled the strange reactions of First Chicago executives in the phone conversations I had tapped. How could they seriously have suspected Lisa Cryer of wrong-doing when it was First Chicago that rejected all of the messages in the first place?
It became clear that whatever information Rudy Levinski had --- information that he was unwilling to give to the FBI --- was not going to be forthcoming until I told him more about myself. But I sure as hell wasn't going to tell him that I had conducted illegal wire-taps and impersonated a US bank. I tried a different approach.
``Lisa denies two of the EFT's that were processed by your bank on July 12th,'' I told him. ``And I believe her. The trouble is, the MAC's for the false EFT's appear to have checked out OK. Can you confirm that?''
``Yes. I know of the two EFT's to which you refer. The MAC's were proper. They were calculated using the same cryptographic key as all of the other MAC's in that batch. Either the subject knew the key or he was able to create a perfect forgery. I assure that the latter is extremely unlikely. There are no known feasible attacks on the encryption used.''
This I knew, of course. DES is a strong encryption algorithm. It is somewhat dated at this point, but provided one uses long keys it remains strong to this day. It is arguably the best symmetric-key algorithm today. It has withstood three decades of intense cryptanalysis.
Rudy seemed to be opening up a bit. He still looked tense and nervous, but his last answer had been somewhat informative. He would not have known my background in cryptology and was probably making a legitemate effort to cooperate. I tried asking another question.
``Every EFT in the original transmission from Bendix was rejected by First Chicago. What was the reason for that?''
Mr. Levinski raised a hand between us and smiled gently. ``I answered your question. Now it is my turn to ask you a question. How did you know that the illegal EFT's were included in the same transmission as the others?'' Then, after a slight pause he added, ``and how did you know that First Chicago rejected each and every EFT in the original transmission?''
``That is two questions,'' I pointed out, ``but since the same answer covers both, I'll answer them both. I was eavesdropping on the transmission between Bendix and First Chicago on July 11th. I did not alter the transmissions at all,'' I added hastily. ``I observed the traffic but let all messages pass back and forth unobstructed and unaltered.''
He nodded his head slowly and showed no surprise. I was suddenly very anxious to absolve myself.
``I had no malicious intent. I am a security professional and was merely observing the traffic to determine the protocol used for funds transfer. The published standards are vague about error-handling. In fact, I was pleased to see the error messages from First Chicago because they were instances of error messages that I wanted to see.''
I realized then that he might think that my interest in error messages drove me to take steps to cause errors (which is true) and that I intentionally garbled the messages from St. Louis to Chicago (which is untrue). I hastened to reassure him.
``I had nothing to do with the garbled messages. It was just coincidence that I was able to observe the error-handling for corrupt data transmissions. I did nothing to obstruct the communication line.''
Mr. Levinski gave me an understanding smile and nodded his head slightly before turning back toward the lake and staring out over the water. It was my turn to ask him a question.
``I do not understand why each and every EFT in the transmission was scrambled. One or two might be explained by a hardware fault, but such a regular rate of errors is baffling to me. What might be the reason for that?'' I asked.
He shrugged his shoulders without looking away from the water. His hands were clasped behind his back again. ``A bad connection perhaps,'' he offered. ``It happens on occasion. It could have been any number of things. Maybe there was a lightening storm somewhere between St. Louis and Chicago. Who knows.''
None of these explanations sat well with me. Modern modems and modern phone lines have very low error rates. Modems have built-in error correction. On top of that, the banks were using TCP/IP as the communications protocol. TCP/IP includes error correction codes too. The TCP/IP headers apparently got through intact, so why not the payloads? Moreover, any bit-errors that did occur should be confined to a single EFT. Strange.
Thick clouds had rolled in and obscured the sun, which was lower on the horizon now. There were hints of rain. Lake Michigan had turned from blue to grey, and the water was now choppy.
When Mr. Levinski spoke again, it was with the same calculated phrasing and meticulous enunciation. ``Were you targeting Bendix or First Chicago, Mr. Raymond? That is to say, were these EFT's of interest to you because they originated from the St. Louis bank, or because they were bound for my bank?''
I explained that I chose the banks I did based upon convenience, and not for any other reason. It so happens that it was First Chicago that I was watching, not Bendix. Partly to change the subject, and partly to counter the edge of accusation in his question, I decided to press the hardware failure issue.
``It seems strange to me, Mr. Levinski, that a hardware error or electrical storm would cause each and every EFT to be rejected. Bit errors should be somewhat confined, as each EFT is independent of the others --- to say nothing of the error correction codes that are employed at various layers in the network protocol stack.''
His response surprised me. Moments earlier he had shrugged off the errors as a minor nuisance. Now he became quite defensive.
``Have you worked in EFT operations, Mr. Raymond? No, you have not. As a member of the EFT operations staff at a large US banking institution I can assure you that errors of this sort are not unusual. We get them at First Chicago. Other banks get them too. Our error rate is not out of line with the rates at other banks.''
It was at that moment that I concluded that, for whatever reason, First Chicago had chosen to reject all of those EFT's. Rudy's initial response to this matter had been to downplay the entire issue. Now, when pressed on the matter, this articulate and intelligent man was reduced to claiming superior knowledge without being able to provide a plausible explanation for the phenomenon. I found this disturbing; there was something that he was not telling me. Apparently that was not the subject that he wanted to discuss with Lisa. The mystery of the rejected EFT's would plague me still longer. What reason would a bank have to reject all EFT traffic? And why disguise the reason? This last question was easy to answer: because the real reason was less than honorable. Next question: what could that real reason be? Is there a financial advantage to be had in stalling on funds transfers?
My thoughts were interrupted by Mr. Levinski's next question. ``Did you keep a record of all of the EFT's you observed that day Mr. Raymond?'' he asked. ``Do you still have them on tape or on disk?''
I tried my best to suppress the sudden wave of panic that swept over me. Would my disks be confiscated if I admitted having the files? Was there anything on them that could embroil me still deeper? I did not know for sure, but I certainly did not want to find out.
Or would Mr. Levinski actually want me to destroy evidence? I still knew very little about this strange man at my side asking me carefully guarded yet pointed questions.
Reacting to my tense silence, Mr. Levinski elaborated. ``I wish to determine if the improper transfers were inserted upstream or downstream of your tap, Mr. Raymond. My bank has a log of all the messages received, but I am not privy to the corresponding logs at Bendix of St. Louis. Furthermore, if the improper transfers were inserted into the data stream after the messages left Bendix, it would be interesting to know if those messages appear in your logs.''
OK. This was a very reasonable request, and an interesting avenue to pursue. I told him that I was unsure of the extent of the data I had, but that I would investigate this question and report back to him. After that he asked a couple more minor questions, but it became clear that he had accomplished his goal for this meeting. He wanted to establish the flow of messages into his bank; he hoped to determine the source of each message. It was becoming clear that at least some of the messages did not originate from the purported source. Little more was said and the meeting concluded shortly afterwards. We agreed to remain in touch and went our separate ways. I stood by the water and watched him as he walked away. The darkness over the water was caused by the storm clouds that were rolling in from the west and was deceptive. It was still only about 7:00. Once the rain began to fall, the humidity would certainly drop, but for the time being it remained uncomfortably hot. I was especially aware of the muggy heat as I watched Mr. Levinski walk away --- he seemed so affected by the humidity. After he was swallowed up by the darkness I turned and walked briskly to the bus-stop so as not to be caught in the rain.