Page 19

CHAPTER NINETEEN

A lyssa needed caffeine, or at least conversation, but Callan remained silent beside her.

It was nearly two in the morning by the time they reached the expressway and headed out of the city.

He sat up and stretched his neck and shoulders.

She glanced at him in the darkness. “You all right?”

“I’m fine. Were you hurt?”

She touched her damp jeans and rubbed her tender knee where it’d hit when she fell. She’d probably have a bruise by morning. “Nothing to worry about.”

“I’m sorry that happened. I really thought we could escape without being caught.”

“What went wrong?”

“My guess, the backyard guard saw the open window and had someone check our room.” Callan took a breath. “I know it’s late, but the sooner Malcolm knows what Ghazi wants, the better.”

“He claimed to own a security company called SJSS Enterprises. He tasked me with searching for vulnerabilities, ostensibly because they’ve been hired to protect a well-known client they fear is being targeted.”

“But…?” Callan prompted.

“But he doesn’t own the company.” She moved to push her hair behind her ears and bumped into the T-shirt still wrapped around her head. Yanking it off, she said, “You could’ve told me.”

“But you look so cute.”

She threw it at him. “Anyway, if he did own SJSS, then he wouldn’t pay me to only find the vulnerabilities but to fix them. And he was very clear that he needed me to record my steps so he could recreate them. He’s looking for a?—”

“Zero-day exploit.”

So named because it would exploit what programmers called a zero-day vulnerability, a flaw in a software’s programming unknown to developers but discovered by criminals seeking to steal or corrupt files. A vulnerability that wouldn’t be found until there were zero days to fix it.

Smart business owners hired hackers to find those vulnerabilities and fix them. Alyssa took those jobs sometimes. If she’d been hired by the true owners of SJSS, her job would have been to repair any weaknesses she located. What Ghazi wanted was for her to show him a way in.

“Did you?”

“Find one?” She flicked a gaze to the man at her side. “I found two, but I didn’t pursue them. I didn’t make note of them.”

“In case he was recording your work.”

“I’m sure he was.” There were few cars on the road at this hour. She settled into the middle lane and set the cruise control. “Not just with a laptop camera, which I wasn’t supposed to know was on. I’m sure Charles was recording my every keystroke as well.”

“Do you think he can follow the breadcrumbs?”

“Maybe. Or someone else can.”

“Could you find them again? And if so?—?”

“Of course, and much faster than I did today. I figured Charles had no idea what I was doing, despite watching me all afternoon. I wasted a lot of time just poking around here and there.”

“So we just have to figure out what SJSS is?—”

“I know what it is.”

“You do? I figured you didn’t have any opportunity to look it up with him breathing down your neck all day.”

“It’s just a guess, but when Charles was explaining why he wanted me to dig into the code, he mentioned drones and how the company used them to provide overwatch. And then, right before Benson came at us?—”

“I heard it too. A drone. That’s how they found us.”

“Maybe they’re practicing controlling them or something. If I had to guess, I’d say SJSS manufactures drones, and I’d bet they manufacture them for the US military.”

“A defense contractor.”

“Exactly.”

“And you found not one but two exploits?” He sounded incredulous.

“Inexcusable. I don’t know who designed the software, but they should be fired.”

“And probably tried for treason.” By Callan’s serious tone, it wasn’t hyperbole.

“Meaning?”

“Why SJSS? How did Ghazi know the vulnerability was there?”

She considered the questions. “You’re saying you think someone left them there on purpose?”

“Seems logical. There are thousands of defense contractors. Sure, they don’t all manufacture drones, but I know more than one does. I think someone at SJSS left a couple of open doors. Maybe Ghazi paid the person to do it. Maybe he or she did it and then sold the information to the highest bidder. Either way, I’m betting someone made a big chunk of change.”

It would be easy, really. As long as the programmer didn’t tell the buyer where the vulnerabilities were, he could claim ignorance and incompetence, which were bad, but not go-to-prison-for-treason bad.

Whoever used those vulnerabilities would have to find them, and the finding of them would leave a trace, lending credence to the programmer’s claims.

Brilliant.

“The question is,” Callan said, “does SJSS design and build surveillance drones, or armed drones?”

“That’s above my pay grade.” But she had a guess.

She didn’t know much about weapons technology, but like anyone who watched the news, she’d seen the damage a drone strike could do.

Drones had been used to take out enemies for years. But always over there .

What would happen if those drones were deployed in the US? Against American citizens?

Nobody would be safe.