Stagehand: Episode 3
Ali Hassan was a low-level operative in Hezbollah, but we had it on solid authority that he knew where three high-level leaders of the terrorist organization were hiding. Keith arrived fifty-seven hours into Hassan’s interrogation and by the looks of it, the guys that came before him had used every enhanced technique in the book.
I untied him from the stress position he was held in, and Keith handed him a water bottle. When he was too weak to hold it, Keith slowly poured it into his mouth until the detainee’s thirst was quenched.
Keith got him dressed, fed him, and then, like all great interrogators, he asked good simple questions, then shut up, and listened. Over the next nine hours, Ali told Keith about his life: how he was recruited into Hezbollah at fourteen after his village was destroyed; how he was trained in weapons, explosives, and communications; and eventually, who gave him his orders. At which point, Keith looked at him…
“Where are they, Ali?”
Keith knew Ali was gonna break. In fact, he knew it the second Ali got comfortable talking. The truth about interrogation is that it’s nothing like you see on TV. In reality, people tend to talk when you’re not being a dick.
Keith stares across the kitchen table at twenty-three-year-old Angela Freidman. It’s Friday night and we’re in her studio apartment in San Jose. I listen as Keith explains to the scared young woman why we’re here and what we need to know. He’s calm, clear, and collected, but anybody looking into his eyes would know he’s not fucking around.
Angela Freidman immediately breaks into tears when she realizes that the man she’d been spying on for her internet buddies was missing. She quickly revealed that she spoke to Carl Timmons one night in the hotel bar. He’d had one too many and, in an effort to impress her, he let it slip that Lincoln Palmer was one of his clients. Angela was an active member of several activist organizations that don’t believe billionaires should exist and used this information to get closer to a particularly radical activist that she’d “been crushing on.”
“I just thought they were gonna scare him or something! Or like, get some dirt on Lincoln Palmer. I didn’t think they’d actually kidnap him! They’re vegans!!”
There’s only one rule when we enter that building: anyone with a gun dies.
Angela cries some more. I hand Keith the phone, and he shows her the video Lincoln Palmer received from her crush. I can tell by her reaction she had nothing to do with Carl’s actual abduction. Seeing Carl tied up, stripped, and wearing a plastic pig-nose did not sit well with her.
Keith pauses the video. “They didn’t egg his car, Angela. I’m going to ask you one more time, who are they and where can we find them?”
By the time we get back in our car, another unmarked black sedan, Frenchie’s already got our ring leader’s address in the GPS. As we pull away from Angela’s apartment, I get a call from Lincoln Palmer. I put it on speaker mode.
“Have you found him?”
“Not yet, sir.”
I update him with the basics, but men like him only care about the bottom line, and the bottom line was we hand’t found Carl Timmons yet. Lincoln Palmer tells me that he’s informed senior leaders at Illuminating Strategies of Carl’s abduction and that all parties agree that it’s in his best interest to exclude local law enforcement and the press for the time being. Luckily, Carl didn’t have a large social circle or a family that might question his whereabouts. He has a mother with dementia that he sees about once a year and his colleagues at work were told he was on leave. Nevertheless, time was precious.
“I don’t need to tell you that I have many competitors that would enjoy exploiting this security lapse.”
Keith rolls his eyes in the backseat. I respond, “you don’t, sir.”
Palmer continues, “And I don’t need to tell you that it’s difficult to keep things private these days.”
“You don’t, sir.”
“Good. Again, we just want Carl’s safe return…by any means necessary.”
I hang up.
“What a caring guy,” Frenchie chuckles at Lincoln Palmer’s apparent concern for Carl’s safety.
I can’t help but smirk at Frenchie’s sarcastic dig, because we both know that by Carl’s safe return, Lincoln Palmer retrieves his data. In the billionaire community, Lincoln Palmer is a ‘Twenty-Four’ which means he’s worth, you guessed it… twenty-four billion dollars. Unlike the lowly single or double-digit members of this community, Lincoln is among the highest tier of his class. Presumably, this is why the kidnappers sent him the video instead of sending it directly to Illuminating Strategies. But what the kidnappers don’t know about a man like Lincoln Palmer, is that he got that his Twenty-Four rating by ruthlessly protecting his assets above all else. Carl Timmons is now, Lincoln Palmer’s asset, and when he says he wants him back by “all means necessary,” I know exactly what that means.
I assume the two other bodies next to him are his friends… were his friends.
The only thing billionaires and Marines have in common is a specific and necessary ability to disassociate from their humanity. The only difference is that billionaires do it for the money, Marines do it for the mission.
Ali Hassan had to lead our team to the third floor of an apartment building across the green line in Beirut, a street that cuts through the city. On one side sat Hezbollah territory and on the other side was modern-day Lebanon (which was awesome). Our team of nine had been surveilling the apartment building from a rented house down the street; counting the guards, trying to get an eye on the three Hezbollah leaders, and tracking their movements.
The first two floors were occupied by families, children, innocent civilians being used as a human shield for the terrorists on the third floor. We were nine extremely efficient killers, but our mission was to make sure the terrorists died, not to ensure that the innocent lived.
There’s only one rule when we enter that building: anyone with a gun dies.
Frenchie knocks on the door of Nathaniel Parker’s apartment building. He doesn’t seem to be home, which is weird because it’s 3:30 am, and even internet punks have to sleep. By the third knock, French takes out his picklock (a far cry from the AR-15s he’s used to), and the three of us let ourselves into the home of Carl Timmons’ kidnapper. It’s sparse. There’s a few posters taped to the wall, a bong on the kitchen table, and an elaborate computer set up across the living-room against the wall. Frenchie walks over to the computers and gives John a call. While they try to gain access to Nathaniel’s hard drive, Keith and I scour the place.
As the civilians on the first and second floor rushed out of the building, I made my way up the staircase, Frenchie was covering me from behind, and there was a silence I didn’t trust. We got to the third floor, I looked to Frenchie, got the clear and —
I threw the flash grenade. There was a big flash of white light and then we moved swiftly into the room where we believed the bad guys were staying. To add to the sensory overload, bullets started flying from the other end of the room. I spotted the target, put one in the head, and two in the chest, then kept going. I’d keep shooting until my mission was complete, or until I caught a bullet.
“I’m in,” Frenchie says from across the room. He takes directives from John on how to transfer the contents of Nathaniel’s hard drive. Back at Stagehand, John’s been collecting every piece of data that exists on Nathaniel Jackson and his co-conspirators. Now that we have his hard drive, John will know more about Nathaniel than he knows about himself.
But sometimes all the electronic data in the world doesn’t tell you as much about a person as their trash. Keith emerges from the bathroom with a receipt he pulled out of the garbage bin.
“Think that kidnapping video could’ve been taped in a storage unit?”
Frenchie stays back at Nathaniel’s apartment in case he returns, while Keith and I go to the storage unit. We walk down a long row of large bins until we get to storage unit 481. By the look of the place, this could definitely be where they’re keeping Carl. Keith pulls out his gun, and I pull out the key we found in Nathaniel’s kitchen drawer that opens the padlock. I lift the heavy metal door open.
This is definitely where the Carl Timmons video was taped, but he isn’t here.
Keith lowers his gun once we recognize Nathaniel Parker lying dead on the floor. I assume the two other bodies next to him are his friends… were his friends. Each of them have been shot. Once in the head, two in the chest.
Keith and I left the scene like we found it: the two kidnappers dead on the floor, their shotgun up against the wall, and the rope used to tie up Carl Timmons sprawled out on the floor. We tipped off local law enforcement and were gone before they arrived, leaving no...
The APT era is here. Attacks are becoming more common and the level of damage increasing in severity. As CISOs, we must prepare for the APT era. We must commit to changing our attitude and not adopting only advanced technological tools. The current awareness is not...
If a company deals with even one third-party vendor, then vendor risk management should be at the forefront of the CISO's mind. What is vendor risk management? Vendor risk management (VRM) is the process a company takes to verify that their suppliers and providers...
An increasing complexity of technologies, as well as an increasing number of failures and attacks followed by an increasing dependency on business goals is changing the way we run Security Operations Centers. I previously discussed the concept of a Fusion Center as an...
Until recently, cyber awareness metrics have been treated by many as a tick-box exercise driven by regulations. The regulator requires x number of hours of cyber awareness training per employee per year, and once that is done, the organisation ticks a box and waits...
The cyber risks we face today are more than we faced previously but also fundamentally different in several respects. Our adversaries are more adept and their tools and tactics more protean in capability. In light of these increasing challenges, our cyber defenses...
In our final installment, we are going to discuss how you roll all the concepts previously covered into a plan of action. The difference between the success and failure of a data classification program is a lack of action. I have reviewed over 10 programs in my...
Previously, we discussed the requirements of a mature data classification program. In this post, we are going to review the administrative mechanics of such a program. Data classification, you’ll recall, usually includes a three- or four-layer system akin to the...
Supply chain attacks aren’t new. In fact, The National Institute of Standards and Technology (NIST) published their initial report on supply chain risk back in 2015. One of the most well-known supply chain attacks happened shortly after in 2017. NotPetya corrupted...
Carl Timmons: CISO of Illuminating Solutions, a data analytics firm, forty-seven years old, never been married. Last Thursday, Carl arrived in San Jose on business. He was picked up by a company car and driven to The Manifeld Hotel. He was last seen leaving the hotel...
Let’s say you need to apply a critical patch across the organization, and the patch requires a reboot. While forcing a reboot to apply a critical patch is important, it creates business disruption that ripples out to your customers. Sooner or later, someone in the...
I just came off a big Zoom call with traditional bankers where they discussed changes in client behaviors, and the impact which new technologies bring, that fundamentally challenge today’s traditional European banking models. At the end of 2019, Boston...
Know Your Board If you’re a CISO, your Board generally knows who you are and what you do. But do you know who they are? No Board is monolithic. Each Board member brings unique value to the Board. Each is selected for what they add to the Board’s perspective, vision,...
Data classification can help secure your data for compliance and company policy. But where should you even begin in the classification process? To start, let’s go through the main data classification types. The four main classifications for data are: restricted...
Since the advent of space exploration in the 1960s, every child understands that the success of the space mission is dependent not only on the astronauts, but also on the engineers in the mission operation center. All complex missions or operations are high risk and...