#KillAydaKhoury

By Lucretia Castillo

Who doxed Ayda Khoury?

Ayda Khoury, Anonymous hacktivist turned NSA officer, must save fellow spy, Ankara Chief of Station Alex Hart, whose doxed identity leads to his kidnapping by a high-profile terrorist.

Ayda's track-and-rescue operation is derailed when the Agency needs a scapegoat for a domestic spying scandal. Doxed by her former Anonymous comrades and facing a Congressional hearing, Ayda is approached by a mysterious intelligence contractor who offers her a chance to salvage her operation, if she:

Stages her own defection, delivers a cache of falsehood-seeded data to the famed terrorist, and get close enough to him to uncover Hart’s whereabouts. If she’s successful, Ayda will earn a full Congressional pardon and protection.

But in the world of cyber-espionage, everyone has a double agenda, and it appears Ayda's doxing and Hart’s kidnapping are connected. Ayda is unable to trust her former friends, and she’s forced to rely on unlikely allies for survival.

Assisted by an officer of an intelligence service she once worked against, a traumatized terrorist, and a little help from the internet hate machine, can Ayda save herself and Alex Hart? Or will their enemies' plan to scuttle the Iranian nuclear deal take the two of them down with it?

• Language: English
• Publisher: Lucretia Castillo
• Release date: Feb 15, 2018
• ISBN: 9780957103849

Lucretia Castillo

Lucretia writes techno-thriller stories about characters who survive the unthinkable and still manage to build themselves a life. Her first book on Smashwords is #KillAydaKhoury, a story about a doxed NSA agent who uses her newfound infamy to publicly defect to a state-sponsored terrorist organization. Hero and traitor both, Ayda works to rescue an American agent from their grasp and win herself the right to come home. Lucretia is a fan of Bob Baer, Charles Cumming, and of course John le Carré. She wants to buy a painting from Gabriel Allon and grow up to be Kelsey Piper.

Book preview

1

Ayda Khoury

Maryland City, Maryland

---

I should be in Vienna, getting the secure communications suite ready for the U.S.-Iran negotiations. Instead I’m in low-rent suburbia, waiting a few days longer to give a deposition at my little brother’s custody hearing, assuming he and Dad even show.

Or I could at least be at work at NSA Headquarters in Fort Meade, instead of at the computer in my tiny studio apartment, missing the next bus to the office because I’m trying to find location data leaked from my little brother’s Instagram account, or from the geographic-targeted ads that show up in a handful of his mobile games.

Mom and I know a couple of things. Samir and Dad are not at Dad’s new condo, and Samir hasn’t been to school in a couple of days, I assume because my dad’s afraid of custodial counter-kidnapping. Samir won’t answer any of my texts or emails, and if I ever get to see my brother again, I’m going to kill him for walking out of Mom’s house and getting willingly into Dad’s car.

Mom called me afterwards and just cried for an hour, and now she’s on speakerphone on my particle board computer desk, asking me, Why don’t you use that tracking thing you talked about at the conference?

Because it’s illegal, Mom. Mom wants me to use the International Mobile Subscriber Identity, a unique ID number associated with Samir’s phone, which I have to admit I wrote down when Dad bought it for him, to track the cell phone and find out where Dad took him.

Last year, she patiently sat through two rehearsals of my DEF CON talk, and laughed in all the right places, but I think she still doesn't understand how resource-intensive that process is. I'd need the NSA's equipment to do that, and I've seen plenty of people go down for using Agency resources for LOVEINT, spying on their boyfriends, their girlfriends, their exes.

Don’t give me that. You did what’s-it-called, Operation Payback like your father.

I do not want to hear about how I’m like him right now. She’s the one who was always telling me not to get involved in Dad’s Anonymous operations, but it was the only thing we had in common. She asked me, back when I first learned to DDoS, why I’d want to use what she called terrorist tactics, like anyone could compare denial of service to bombing a building. She said there were no good reasons to do evil, only the sin of relevance deceiving people into thinking there are.

Okay, how about ‘the office is full of Internal Affairs; I will get caught right now?’

The Agency is in full crisis mode after the Snowden leaks, as though the domestic spying program had surprised anyone but us. I joined the NSA to wreck blackhats and protect the good guys, not spy on my countrymen, but I did what I was told, and now the chief counsel is advising us all to keep our heads down, let the Director face the upcoming Congressional hearing on our behalf, and let it all blow over. Despite everything I said about the evil of the domestic program, right now I would love to use the Agency superpowers to find Samir. But I’m paying the custody lawyer bills, and I can’t afford to be fired like the rest of the LOVEINT-convicted skiddies.

Did you message him on X-Box Live?

Yes. Though I didn’t expect or get an answer. If he’s logged in at Dad’s, he’ll have the sense to expect Dad to see his messages.

There’s only silence from Samir’s app data, nothing to indicate he’s even logged in, in the last three days. Most likely Dad’s had the sense to take the phone away and stick it in a metal case. I cracked Google for the NSA, but Dad makes me look like a brand-new script kiddie. He’d definitely have remembered to get Samir’s phone out of the equation.

A little Anonymous methodology might help, though. I log onto the #AnonOps Internet Relay Chat channel to see if rootcrysis is online. I could PM him and ask if he’s gotten his Blackphone yet—I’m still on the waitlist—and figured out how to own it from the outside, like I know he’d do right away. Dad’s got a Blackphone, and likely hasn’t turned his own phone off, even if he took Samir’s.

No rootcrysis in the #AnonOps IRC. No Dad, either, unless one or both of them is here under a different pseudonym than their usuals. The #AnonOps chat is derailed this morning by an internal debate on what constitutes freedom of information versus reckless endangerment, and a link to Par:AnoIA, the Anonymous-flagged answer to WikiLeaks, shows why.

After all the Snowden leaks, the latest leak to rock Washington isn't even about us at NSA. Private e-mails from the CIA's Chief of Ankara Station in Turkey are posted on Par:AnoiA, full and unredacted. They give away one of his Turkish assets and the chief of station's own pseudonym, the intentionally unmemorable 'Alexander Hart'.

This is a false-flag, types a user named Cmd+Ctrl. We don’t get people killed.

I log off. I’ll try again later, I promise, I tell my mom. I’ve got to get to work.

2

Ayda Khoury

NSA Special Collections

Fort Meade, Maryland

---

My signals assurance team has gone to the Iranian nuclear negotiations in Vienna without me, and the State of Utah is threatening to retaliate for the domestic spying scandal by turning off the water at the data center and burning our servers to a crisp.

The office is full of Internal Affairs investigators and it’s witch-hunting season, but maybe that’s exactly what I need, if this leak turns out to be internal. There’s a certain surrealism to clocking in and investigating Anonymous, but we’re not supposed to be killers, and Hart's leaked agent is dead.

Monitoring of the Google complex—apologies to Snowden and Manning, I'm really guilty—tells me YouTube had an execution video up before they took it down ten minutes ago.

My counterpart at CIA’s end of Special Collections has messaged me to tell me Hart should be on a plane home from Ankara.

The phone rings and I put on my syrupy Ventrilo gaming-voice for CIA. I'm viralpanacea and I'll be your healer today. Ayda Khoury here.

You gave that talk about tracking people by cellular hardware identifiers? I feel like I should recognize the man's voice.

That's right.

I want you to find someone. Alex Hart never made his flight.

He wants me to try the cell phone tracking I talked about last year at DEF CON, the one my mom wants me to use for Samir. The kidnappers could have thrown Hart’s phone out, but they’ll expect the Chief of Station's contact list to be valuable if nothing else. Odds they kept it are pretty good.

They could have pulled out the battery. Please tell me Hart had a smartphone with a captive battery.

Who am I talking to?

Jasper. Global Investments.

Global Investments is a local pseudonym for CIA, and I recognize the pseudonym Jasper. He's not a hacker or cryptographer; he's everything wrong with CIA. An Iran-Contra arms-for-hostages negotiator whose verdicts came out not guilty--but made him infamous and confined him to a declared embassy desk for the rest of his career. I'm obligated by policy to call him by his CIA pseudonym, but everybody knows who he is. Jasper’s real name is Jack Kolda, a bureaucratic snake whose hostage negotiating history put him across the table from the current Iranian President, years ago when the President was just an up-and-comer political functionary. Now Jack Kolda's the appointed chief negotiator for Vienna.

Hi Jasper. I keep the sweet Vent voice on. No one wants to make enemies in Langley with the investigation going on. What kind of phone did Hart have? And was he on Turkcell, Avea, or something weird? I need his phone number, and if you guys ever had the IMSI, it would help. I remember who I'm talking to. That's the International Mobile Subscriber Identity.

I'll find out. He hangs up.

My phone buzzes. An email address I don't recognize, and not a one-use like my friends might use. Subject line: It's Samir, he took my phone.

Thank God. He’s talking to me after all. Right there is why I sold out for a solid government paycheck, more money than our parents, and math problems so big they've got their own gravity. And I don't even get to go to Vienna.

If I ever see my little brother again I'm going to kill him.

I email back: Where are you?

He writes: Library. He let me come to school. He thinks I'm on his side.

I don't actually have any verification it's him. If Dad were setting me up, he would have texted me from Samir's phone, wouldn't he? That would tempt me to call back for voice recognition; he wouldn’t do that. He would have used Samir's normal email, wouldn't he? No way he doesn't have the password to it.

I write back: Are you on mine?

It's a dangerous thing to ask. If it's our dad spoofing Samir, he'd have ammunition to say Mom and I were plotting against him.

See, it's not custodial kidnapping, Samir consented. And he went to school and everything. Even if it was a couple of days later.

So if it’s really Samir, I could have evidence he's an unwilling kidnap victim, no matter what he says in court. A hostage will say anything they're told. I would know.

The desk phone rings.

Please tell me it was an Android or something, I say.

I need you to come up here. Not Kolda. NSA legal office.

Sorry, can't yet. I've got the Ankara leak.

It's important.

Is it about the custody hearing? I asked the Agency's chief counsel for legal advice for my mom after her last lawyer ignored the abuse and advised her to settle for a mutual restraining order and joint custody. Mark Laurent the chief counsel recommended us a family lawyer, a classmate of his from Yale, who's still fighting for us. I know Laurent’s friend is lowering his rates for us. Even so, it's where all my money and Mom’s goes, and I owe Laurent too many favors I haven't figured out how to pay back.

No— he starts.

God, don't scare me like that. I've got to go. I'm really sorry.

My phone shows no notifications, only my lock screen image of an Iranian protester holding a sign denouncing former President Ahmadinejad’s idea of interal economic relief. The sign says DOWN WITH POTATOES, featuring the word the press always translates DEATH, as in DEATH TO AMERICA.

I refresh my email app. Silence. Samir got caught using the school library computer for email, or the period ended and he had to go to class.

The office line rings.

Samsung Rugby 4, on Turkcell, says Kolda. He gives me a phone number. Station didn't record the IMSI.

A flip phone. Figures Hart would be a good spy; no smartphone for him means no application layer data for me from location-based services. No wifi requests either, so no tracking by the BSSID.

The methods from my DEF CON talk aren't going to work here.

I have to give a briefing in two hours, says Kolda, Tell me something I can use.

Kolda isn't CIA's Special Collections liaison and doesn't really have the authority to order me to drop everything and look for CIA's missing officer, but I'm going to pretend I didn't know that, if it means I get to save somebody for a change.

I can use a paging request exploit on Turkcell's GSM network to at least find the phone, whether it's still with him or it's been handed off by the kidnappers, but to do that, I need one like it. We have all kinds of cutting edge equipment in this place, but what I can't just check out from the depths of Stores is a flip phone from the 20th century.

I put Kolda on hold and send an office email round Special Collections:

Friend of Jasper's at the Other Government Agency is missing, pls send help + Samsung Rugby 4.

It doesn't matter what I think of Jasper, it matters what they think of Jasper. This town—the borderless power exchange called Washington—runs on what we call wasta at home and quid pro quo in the white Washington political complex.

I rescue Kolda from the hold music while I wait for an answer. I need somebody at Ankara Station to talk to me, and listen for a paging request I'm going to send.

Kolda worked Ankara Station once. It's case study stuff now, common knowledge. The arms-for-hostages hearings forced him into a long run as a declared desk spy. That's Washington justice. Not even a commuted sentence.

Waiting. Waiting for Samir and waiting for a flip phone. Who were you, Alex Hart? The files I can access tell me he had diplomatic cover. My joint Special Collections resources with CIA tell me Hart’s real name is Raoul Felice, but he's got a Facebook page under the pseudonym, a profile of a whole diplomatic corps life under a fake name, and a daughter who let him friend her on Facebook. He’s got photos taken with friends in Ankara under the name Hart. He mentions a wife but he's got too much class to use her name online. This profile's friends must all be diplomatic corps. They don't use her name when they post either.

Mark Laurent the chief counsel emails me: When you get a chance, come up to my office.

Am I in trouble? Whatever Laurent wants, it's the kind of thing he can't or won't talk about over company email. I mentally go over the list of what that could mean while I head down into the depths of Stores to fill out carbon copy paperwork to borrow a modem. All the latest toys at our fingertips and what I really need now is a dialup modem. The guy working the desk looks at me funny, like he knows something I don't, and I catch myself second-guessing my whole method even though I haven't mentioned the details to him.

Is Laurent making me testify at someone's LOVEINT hearing?

I'd do it. Stalkers get jail time.

What if he found out I was—am—Anonymous?

When I get back to my desk this hipster girl, the type to carry a flip phone, is leaning on the back of my chair, waiting for me. Her badge color says cryptography and her perfect makeup says new enough to be trying to impress. She holds out a Rugby 4 to me, then retracts her hand.

For Alex Hart? she asks.

Yeah, okay. I can't blame her for wanting to know or wanting to feel like a hero. I nod.

She hands me the phone. No firmware changes, no taking it apart. It’s not from Stores; it’s mine.

She should know better. Hardware that’s been in other hands is good as rekt.

Nope. No changes. Thanks— Her badge says Brooke Kinman. Brooke. I'll remember. I give her a facsimile of a confident smile. Washington wasta. Two years ago I was her, or at least I would have been if I were skinny and blonde.

She hovers and waits with me until Ankara Station calls me back. With a phone like Felice's, and ATDT commands issued to my dialup modem, I measure the time delay between call initiation to this phone from a public switch telephone line and the moment it actually rings. Dad was an old-school phone phreaker. It's the kind of thing he would have done—destructive thought pattern. Stop. Run script.

I'm looking for the paging channel request on the PCCH, the broadcast downlink channel all cell phones listen for, to the handset. Mean delay 8.8 seconds, median 7.0 seconds, standard deviation 4.5. 5 seconds ensures the paging signal has consistently been sent. It can't be long enough for the handset to ring or his kidnappers will know what I'm doing.

I'm sending it, I tell my counterpart at Ankara Station. Tell me what you get.

I send the command to Hart's phone and count. 5...6...disconnect. Paging signal sent.

I see it, says the male voice on the other side of the world, I've got a shortlist of IMSIs for you; do it again.

And again.

There it is. Now we have an IMSI for Felice's phone and we can track the hardware instead of the number. We know what tower his phone is listening to, and I can hear the officer on the other end summon someone and pass the information along.

Twenty plus hours after his kidnapping, what are the odds it's still with him?

Okay next trick, I say. Just in case Ankara Station can't get to him fast enough or they leave the phone on but ditch it somewhere. Who's with him?

We can see who's on the same base station transceiver as him, but that only gets us a long list.

Kolda, impatient, calls back on the other line. I recognize the prefix as a White House line. What have you got for me?

I've got a list to work with—

The President is under pressure to give a statement. Give me more than that, even if he can't say it on television. This one's a career maker, Khoury.

Cold-hearted bureaucratic bastard. We've got IMSIs; I'll see if any of them are people we've collected from before, but I can't promise you—

"I'll spin it. Call me, he snaps. Even if I'm still in the briefing."

Yessir. I get the feeling if I don't deliver it'll be time to polish my resume. For government contractors I DDoSed when I was a kid. No one else would touch a guilty domestic spy with a 40-cubit pole.

I set the database looking for the new list of IMSIs and finally head for the legal office, with marching orders from Brooke to tell her what I find. I owe her that much.

Laurent probably wants to talk about how this leak happened. We're all going to be polygraphed again to satisfy IA we're not the leak, like they did to find out who shared their passwords with Snowden. I've survived all the polygraph tests and IA questioning, even the ones that asked me about Anonymous. Growing up with my father taught me to lie.

Sit down and shut the door. Laurent takes off his glasses, rubs the bridge of his nose for a second before putting them back. The NSA would like you to testify at the congressional hearing, on the subject of domestic surveillance and friendly spying.

Anon just outed an officer in Ankara— He wants to talk about the Snowden leaks? Now?

This is a criminal investigation, but it's an investigative hearing, not a trial. You have the right to an attorney, but I wouldn't—

Isn't that you?

I'll be attending, he says, but my role is to represent the NSA, not you.

What do I do, call the ACLU? They'll burn me at the stake for working for the NSA. I don't have the money for this. When I got this job I felt rich. I socked away money for the divorce lawyer, I put down a deposit on an apartment for Mom and cosigned the lease. The savings are almost gone, and Dad still sends me emails accusing me of talking Mom into filing for divorce and threatening to get me fired from NSA for spying on him. I'm not even guilty of that. I should have been. I might have caught Samir.

If I were you I wouldn't seek legal representation. These things blow over; You'll be allowed to come back to work eventually...

He'd better just mean I'll have to take time off for the hearing, and he's asking me to give away my rights but you don't talk back to authority, especially authority that's done something for you, so I keep my mouth shut.

These hearings are common. It will go better for you afterward if it doesn't look like you thought you had to defend yourself from the Agency.

Why'd they pick me?

I'm going to guess it was the office email that said 'I cracked Google, exclamation point, exclamation point, one, exclamation point.'

You read my mail?

Don't you read mine?

No, actually. Add him to the list of people I should have been spying on if I'm going down for this. Was it even illegal? Why didn't you tell anyone it was illegal?

It was completely legal. We're covered by the FISA Amendments Act and Twelve Triple Three.

Then what are they doing?

Truth be told? Trying to find a scapegoat ahead of the primaries. Nothing's going to come of it; it's just political jockeying. You'll be put on temporary administrative leave. Your access to privileged information will be temporarily revoked; it will be restored when this is over.

What about Alex Hart?

Ankara Station will go after Alex Hart.

Sometimes I think the biggest crime in government is giving a damn.

I have an IMSI search running downstairs. Hart's kidnappers—

Special Collections will deal with it.

I'm at least sharing the search results with Kolda.

Laurent opens the door. The interview's over. Physical security is waiting in the hall to escort me off the premises.

They take my badge and march me past wide-eyed technicians who wonder if they’re next. Security drives me all the way to the Visitor Control Center and they're not discreet and everyone thinks I did something wrong and they're right and all I did was what I was told to do, sat in Milgram's room and pushed the button, like all those people rootcrysis and I would have mocked mercilessly for having no will and no spine.

I don't even get to find out if the IMSI search found anything.

How did Kolda survive his Congressional hearing? It was a long time ago, closed and under pseudonym, but it was famous, entry on Wikipedia famous, and he even got to be chief of Ankara Station before it made the complete circuit of Washington and leaked out into the press that Jack Kolda was Jasper was COBALT and the Agency decided he was unsafe, rewarded or punished him with a desk in Langley. I don't think I'm supposed to talk about the investigation, so I don't call. He's probably giving the briefing anyway.

I walk to the stop for the 202 and ride all the way to the Red Line train station to make the two hour trek into Langley. I used to wear my NSA badge on the bus lest somebody look at me like I was a terrorist casing Fort Meade. I'm glad I don't have it now, or someone will realize I'm the NSA Eye of Sauron who spied on them, because they might be terrorists or because we were ordered to or because it was awesome to be able to stand in front of the deputy directors for Special Collections and tell them how I cracked Google and found a way to track IMSIs. They even sent me to DEF CON when NSA was allowed back again.

I thought I would get to go again this year and take another shot at the black badge. Stop. Destructive. I will go, because the hearings will be over by then, and I'll get to say something nice about using a paging channel request to save Alex Hart, because he'll be alive.

Who else can check IMSIs for me? North Ridge Consulting. The private intelligence contractors are all still reeling from the publicity damage Ed Snowden did by existing, but North Ridge has an NSA liaison, Joseph Hodges. The line rings and rings and a woman's voice picks up. This is Farah.

Where's Hodges?

Raked over the coals for the leak.

Suspended?

Crisis meeting with everybody else.

Why not you? Who are you?

Haven't had access long enough.

What are you doing in Hodges' office?

Unpacking. Who's this?

Ayda Khoury, NSA.

Ayda Khoury, you're thoroughly burned here. Toxic.

I don't believe you. I don't believe everyone in Washington knew this was coming but me, or that it happened this fast. What's his new extension?

She gives me an extension number. If you like him, think about whether you want to compromise him by calling for help while you're under investigation.

What if she's right? Kolda wouldn't have given me Alex Hart if she was right, unless maybe NSA got the idea from North Ridge. Unless NSA asked North Ridge who could be exposed as guilty even though Ed Snowden tried not to give names. Who they could throw under the bus for the primary. Or Hodges or somebody had something to gain because, like Kolda said, this is a career maker.

Hey, I ask her, Is North Ridge chasing down the Alex Hart thing?

I'm afraid I can't discuss that with you. There's a snap in her voice I recognize, the same tightness when Mom tried not to say Dad had punished her for something I'd done.

Like Alex Hart is already dead and there's nothing to do but keep it from the world.

Just teasing, honey. Nothing serious.

Jasper and I have got IMSIs— I tell her.

Global Investments Jasper?

Yeah. I feel weird suddenly, having this conversation on the Metro. Even though I haven't said anything that's actually secret, just hearing her talk about the CIA on my cell phone gives me the creeps. Secrecy mythology.

Her outlook does a 180. What do you need?

I want to tell her, but how do I trust someone sitting in Hodges' office, with new access, too eager to help me?

I need to know who I'm talking to.

Ask Jasper. If you can help us find Alex Hart you'll be invincible. Tell him to call Silver at North Ridge. Tell him it's Farah these days. She politely disconnects.

3

Jack Kolda

George Washington Memorial Parkway

Langley, Virginia

---

At least we could say we had a shortlist, at the President’s press conference, but it doesn’t get us any closer. Ayda never came through and I can’t pry the list out of NSA until I get back to Langley.

The piercing Bluetooth ring interrupts the country music on the car radio and I thumb the answer button.

You know anybody with the cryptonym SILVER at North Ridge Consulting? asks Ayda.

No, not at North Ridge Consulting. Ten years after Ankara, almost thirty years after Beirut, but I remember Silver. That’s a linguistic in-joke, not a cryptonym.

Can’t recall.

Says her name is Farah. This is a verification call; I wanted to make sure someone got the IMSI list—

Give it to her. Silver was with Hart and I for the Iranian Hostage Crisis when we saved eighty-eight civilians after the embassy takeover, and she was with us for the Beirut Hostage Crisis when we tried and failed to save Chief of Station Buckley. She would fight for Hart, no question.

I don’t have access; I need to talk to you.

What is Fort Meade doing? Come up to my office.

They revoked my clearance.

Damn. Damn. Damn. Why?

She hesitates, deciding what she can say and keep my trust, which she never had. Chief counsel says it’s nothing.

Mark Laurent is a professional liar. Who’s conducting the investigation?

The House Intelligence Committee, I think.

Not Internal Affairs. Not counterintelligence. Though if she were a real double agent I think I’d have a fair shot. I’m not a bad case officer.

Where are you now? I ask.

Headed for Langley. Still kind of far.

Get off in McLean, go to Fort Marcy Park. Make yourself comfortable. I’ll call you back. Know anyone who still has access?

Brooke Kinman, she says. Don’t repeat that; I’m apparently all kinds of toxic.

I won’t.

Back in Langley with a secure line, I call Fort Meade. Pressure Brooke Kinman until she’ll do me a favor. She’s too young for the hostage negotiation to mean anything, for her it’s all about getting in good with the lead Vienna negotiator. She gives me the IMSI list and she’s mine for good, compromised. Mishandling of classified data.

I call North Ridge on the central line, not the extension. Jasper at Global Investments for Farah, call back. Washington picked up this cursory verification habit after the Masked Avenger radio show fiasco. We’re too well-known, or at least I am, and North Ridge is a popular target at the moment for pranksters and hacktivists.

For an interminable minute it doesn’t ring, and then another, and I wonder if the whole thing is that kind of sick joke.

The phone rings.

Hey COBALT. She lays the Midwestern accent on thick. She sounds American.

It takes me a second to find a voice. Hey Silver. Her last name was Lujayn—Silver—when I knew her as a middle man in the Beirut hostage crisis. What used to be my cryptonym back then has long been declassified, and she started using it in the rare unofficial drops at CIA stations we both passed through.

You got a list for me? she asks.

I take her instructions, send her the list. You moved to the States. She left the Mossad.

I can hear the smile in her voice. When are you going to join me in the afterlife?

Seven months. Halliwell. An oil giant with its own intelligence consulting firm and private military contractor. It feels like working for another national service.

Are you sure? They’re still starstruck with the blue passport; I can request hires with impunity.

I’d do anything for her but work for her. I’m going to tell your director you said that. Why didn’t you call before? How long has she been here?

I did. They gave me the ‘no officer by that name’ treatment, and I wasn’t about to position myself as a defector just to talk to you. Thank your girl at the other agency.

This year’s scapegoat, you mean. I’m meeting with her in a minute. Call me back about the mobile identifiers? I don’t want to hang up, but I don’t know how to talk to her while another Beirut Station survivor is captive in Ankara.

I’ll see what I can find and meet you in Langley. We’ll find him, Jasper.

We’re already trying to handle each other.

4

Jack Kolda

Fort Marcy Park

McLean, Virginia

---

Not one.

NSA surprises me by cooperating. They call back before Silver can, and they share information like they might care if Alex lives or dies, but not one of the IMSIs Ayda's search passed on to us was anyone for whom we had records.

New threats. Inexperienced captors are one of the worst things that can happen to a hostage. They're terrified, they don't know what they're doing, they're cruel for no reason.

I meet Ayda Khoury at Fort Marcy Park. She’s exactly what I expected, a short Lebanese computer jockey hiding her figure under baggy black cargo jeans and a T-shirt declaring NO PASSWORD IS SAFE. She follows me like a lost child as we hike over the old earthworks. I stop in a clearing with a picnic table and she climbs up and sits on it with her feet on the bench. I sit below her on the bench; there's no playing posturing games with a humiliated child.

She toys with her phone so she doesn't have to look at me. They're investigating the domestic program. They want me to testify.

As an expert or a defendant?

A defendant, she says miserably. They're breaking up my operations team for the Ankara fiasco over Congressional hearing roulette. Did they let you have a lawyer?

The first time, I tell her. Back then they expected it.

The first time?

These things have gotten common; they're not news anymore. Now the press will make it look suspicious, like you have something to hide.

What do I say?

The transcripts of the older ones are public record, go have a look. Read mine. Read Ollie North's. Read General Alexander's even if it's terribly redacted, and see what he admitted to when he defended your agency.

When Silver and Hart and Ollie and I traded arms for hostages with Hassan and his Hezbollah proxies, I thought it was all about the hostages. I was young like Ayda, and I didn't understand the escalation that would follow, the hostage-taking industry, the exchange rate of 383 Palestinians to the Israeli that Silver got saddled with because the Israelis then and always traded. Or the hearings.

There's a star on the wall for our own chief of station William Buckley, because we won, but we won too late, despite everything we could do, despite the arms, the anti-Sandinistas, the Congressional hearing that accused us of arms dealing, taking bribes, misappropriating funds, and misleading the American people.

It's an asset recruitment, I tell her, You get yourself a friendly congressperson, and you spend the whole affair convincing that one, before the hearing and on the floor. Not Harris or Georges, they're unpopular; that's why they were punished with the Intelligence Committee. No one who might have approved this thing; they're next and they're going to be covering their own rear ends. You're an intelligence officer, go read voting records. Find someone you can convince it's in their interest to give the NSA a show trial for the press and a good outcome.

She nods, quiet for a moment, considering, then looks up from her phone. Did any of the IMSIs match up?

NSA's got gold here and they're throwing it away. An agent who's on your side when you're not on hers is a rare commodity. You know I can't answer that.

My phone vibrates in my pocket and I steal a glance. North Ridge.

Hi Silver.

North Ridge didn't have the number. I called a friend. She wants me to know she called home for me. I'm already thinking of what I can give her to pay this one back. That hardware belongs to Sacha El-Shafei, she says. Your chief of station is with Hezbollah.

In Turkey?

El-Shafei, the Intercessor, is a cunya, a nom de guerre. He's got an Interpol red notice. He's the new Imad Mugniyeh. For the bus bombing in Bulgaria, an oil-drilling facility rocketed from Syria, the assassination of Iranian Green Movement protest leaders, he gets credit.

Hezbollah has a long history of killing Americans, from the Marine Barracks bombing to the Lebanese Hostage Crisis, the one that became Iran-Contra.

But they'd have terrible support in Sunni Turkey.

You still with her? asks Silver.

Yes.

Where?

Fort Marcy Park. This is going to destroy the Vienna negotiations if it can't be dealt with quietly. I was meant to leave for Austria tomorrow. I can come back to the office.

No, she should hear this. Old code between us for running an approach. Recruitment isn't just for enemy countries; it's how anyone gets anything done in the Homeland-infested alphabet soup of Washington. They're her identifiers. She reiterates Ayda's potential value for emphasis. She's afraid I don't remember this game.

Silver expects me to be COBALT from Beirut. I'm not him anymore, but I can fake it for long enough to run an operation. I liked him.

You want us to wait for you?

Let's go to that place you always said you'd take me.

If she were ever in the States. There's a lot of things we said we'd do if she were ever in the States. Hart would have gotten a kick out of us all being on the same side again.

5

Ayda Khoury

Fort Marcy Park

McLean, Virginia

---

Jack Kolda is lighter on his feet than I am, making me almost jog to keep up along the trail through Fort Marcy Park until we come to a stop on a little footbridge. I don't know what I expected from the reputation, but he doesn't look like a spy. He's this middle-aged white guy with a belly that laps gently over his belt, living a serious paramilitary fantasy from the haircut to the boots. He's got one of the famous blue badges with a number and no name stuffed in his pocket where he knows I can see it.

There's almost no one in the park. It's still too early for the workday commuters to have made it here, but I don't feel unsafe with him. I lean on the handrail and look into the little dry creek and feel like a Cold War spy in Berlin or Vienna, on a walk in the park with my case officer from the embassy.

You and Farah used to come here and make out or something? There's no plaque on this bridge, and there's plenty like it in the park.

No. He gives me a tiny morning-after smile that's supposed to mean yes, but it's too easy an answer, tries too hard to confirm my story rather than tell the truth. I break out the GPS app and the Washington tour guide sites, trying to find this place on the map. I won't be able to do this when the Blackphone I ordered finally comes in, but I couldn't resist the crypto on that thing, even if I had to trade a few convenient apps.

Why is she okay with telling me? I ask, zooming in and finding nothing.

She thinks she owes you for the identifiers.

Not good enough for sharing classified information.

Let her tell you.

This place is nowhere. It's not in the visitor center website or any of the trolley tour guides.

A woman breezes into view along the trail, about Kolda's age, a darker bronze than me, with ash-brown hair that spills in crimped waves over her shoulders, chemically lightened and highlighted like an ad for