Stagehand: S1 Episode 3
Ali Hassan was a low-level operative in Hezbollah, but we had it on solid authority that he knew where three high-level leaders of the terrorist organization were hiding. Keith arrived fifty-seven hours into Hassan’s interrogation and by the looks of it, the guys that came before him had used every enhanced technique in the book.
I untied him from the stress position he was held in, and Keith handed him a water bottle. When he was too weak to hold it, Keith slowly poured it into his mouth until the detainee’s thirst was quenched.
Keith got him dressed, fed him, and then, like all great interrogators, he asked good simple questions, then shut up, and listened. Over the next nine hours, Ali told Keith about his life: how he was recruited into Hezbollah at fourteen after his village was destroyed; how he was trained in weapons, explosives, and communications; and eventually, who gave him his orders. At which point, Keith looked at him…
“Where are they, Ali?”
Keith knew Ali was gonna break. In fact, he knew it the second Ali got comfortable talking. The truth about interrogation is that it’s nothing like you see on TV. In reality, people tend to talk when you’re not being a dick.
Keith stares across the kitchen table at twenty-three-year-old Angela Freidman. It’s Friday night and we’re in her studio apartment in San Jose. I listen as Keith explains to the scared young woman why we’re here and what we need to know. He’s calm, clear, and collected, but anybody looking into his eyes would know he’s not fucking around.
Angela Freidman immediately breaks into tears when she realizes that the man she’d been spying on for her internet buddies was missing. She quickly revealed that she spoke to Carl Timmons one night in the hotel bar. He’d had one too many and, in an effort to impress her, he let it slip that Lincoln Palmer was one of his clients. Angela was an active member of several activist organizations that don’t believe billionaires should exist and used this information to get closer to a particularly radical activist that she’d “been crushing on.”
“I just thought they were gonna scare him or something! Or like, get some dirt on Lincoln Palmer. I didn’t think they’d actually kidnap him! They’re vegans!!”
There’s only one rule when we enter that building: anyone with a gun dies.
Angela cries some more. I hand Keith the phone, and he shows her the video Lincoln Palmer received from her crush. I can tell by her reaction she had nothing to do with Carl’s actual abduction. Seeing Carl tied up, stripped, and wearing a plastic pig-nose did not sit well with her.
Keith pauses the video. “They didn’t egg his car, Angela. I’m going to ask you one more time, who are they and where can we find them?”
By the time we get back in our car, another unmarked black sedan, Frenchie’s already got our ring leader’s address in the GPS. As we pull away from Angela’s apartment, I get a call from Lincoln Palmer. I put it on speaker mode.
“Have you found him?”
“Not yet, sir.”
I update him with the basics, but men like him only care about the bottom line, and the bottom line was we hand’t found Carl Timmons yet. Lincoln Palmer tells me that he’s informed senior leaders at Illuminating Strategies of Carl’s abduction and that all parties agree that it’s in his best interest to exclude local law enforcement and the press for the time being. Luckily, Carl didn’t have a large social circle or a family that might question his whereabouts. He has a mother with dementia that he sees about once a year and his colleagues at work were told he was on leave. Nevertheless, time was precious.
“I don’t need to tell you that I have many competitors that would enjoy exploiting this security lapse.”
Keith rolls his eyes in the backseat. I respond, “you don’t, sir.”
Palmer continues, “And I don’t need to tell you that it’s difficult to keep things private these days.”
“You don’t, sir.”
“Good. Again, we just want Carl’s safe return…by any means necessary.”
I hang up.
“What a caring guy,” Frenchie chuckles at Lincoln Palmer’s apparent concern for Carl’s safety.
I can’t help but smirk at Frenchie’s sarcastic dig, because we both know that by Carl’s safe return, Lincoln Palmer retrieves his data. In the billionaire community, Lincoln Palmer is a ‘Twenty-Four’ which means he’s worth, you guessed it… twenty-four billion dollars. Unlike the lowly single or double-digit members of this community, Lincoln is among the highest tier of his class. Presumably, this is why the kidnappers sent him the video instead of sending it directly to Illuminating Strategies. But what the kidnappers don’t know about a man like Lincoln Palmer, is that he got that his Twenty-Four rating by ruthlessly protecting his assets above all else. Carl Timmons is now, Lincoln Palmer’s asset, and when he says he wants him back by “all means necessary,” I know exactly what that means.
I assume the two other bodies next to him are his friends… were his friends.
The only thing billionaires and Marines have in common is a specific and necessary ability to disassociate from their humanity. The only difference is that billionaires do it for the money, Marines do it for the mission.
Ali Hassan had to lead our team to the third floor of an apartment building across the green line in Beirut, a street that cuts through the city. On one side sat Hezbollah territory and on the other side was modern-day Lebanon (which was awesome). Our team of nine had been surveilling the apartment building from a rented house down the street; counting the guards, trying to get an eye on the three Hezbollah leaders, and tracking their movements.
The first two floors were occupied by families, children, innocent civilians being used as a human shield for the terrorists on the third floor. We were nine extremely efficient killers, but our mission was to make sure the terrorists died, not to ensure that the innocent lived.
There’s only one rule when we enter that building: anyone with a gun dies.
Frenchie knocks on the door of Nathaniel Parker’s apartment building. He doesn’t seem to be home, which is weird because it’s 3:30 am, and even internet punks have to sleep. By the third knock, French takes out his picklock (a far cry from the AR-15s he’s used to), and the three of us let ourselves into the home of Carl Timmons’ kidnapper. It’s sparse. There’s a few posters taped to the wall, a bong on the kitchen table, and an elaborate computer set up across the living-room against the wall. Frenchie walks over to the computers and gives John a call. While they try to gain access to Nathaniel’s hard drive, Keith and I scour the place.
As the civilians on the first and second floor rushed out of the building, I made my way up the staircase, Frenchie was covering me from behind, and there was a silence I didn’t trust. We got to the third floor, I looked to Frenchie, got the clear and —
I threw the flash grenade. There was a big flash of white light and then we moved swiftly into the room where we believed the bad guys were staying. To add to the sensory overload, bullets started flying from the other end of the room. I spotted the target, put one in the head, and two in the chest, then kept going. I’d keep shooting until my mission was complete, or until I caught a bullet.
“I’m in,” Frenchie says from across the room. He takes directives from John on how to transfer the contents of Nathaniel’s hard drive. Back at Stagehand, John’s been collecting every piece of data that exists on Nathaniel Jackson and his co-conspirators. Now that we have his hard drive, John will know more about Nathaniel than he knows about himself.
But sometimes all the electronic data in the world doesn’t tell you as much about a person as their trash. Keith emerges from the bathroom with a receipt he pulled out of the garbage bin.
“Think that kidnapping video could’ve been taped in a storage unit?”
Frenchie stays back at Nathaniel’s apartment in case he returns, while Keith and I go to the storage unit. We walk down a long row of large bins until we get to storage unit 481. By the look of the place, this could definitely be where they’re keeping Carl. Keith pulls out his gun, and I pull out the key we found in Nathaniel’s kitchen drawer that opens the padlock. I lift the heavy metal door open.
This is definitely where the Carl Timmons video was taped, but he isn’t here.
Keith lowers his gun once we recognize Nathaniel Parker lying dead on the floor. I assume the two other bodies next to him are his friends… were his friends. Each of them have been shot. Once in the head, two in the chest.
Carl Timmons was given 24 hours to decide what he wanted to do. This was a tactic. Twenty four hours to sit alone and think about all the money he could want and the price he’d pay for it. And 24 hours to also contemplate what Andre Savin might do to him before...
Andre Savin and Lincoln Palmer had met on several occasions and had the type of relationship you’d expect between two men of their standings on the billionaire scale. Contemptuous but also understanding. They were both driven by the same desire—access to...
Belfast, New York - 1889 They called him The Boston Strong Boy—arguably the first real boxing star and one of the highest paid athletes of his time. He’d always been good at school. He attended Boston College where his parents thought he might pursue...
About three minutes into planning this post, I had one of those “god, I am old” moments. Here is why I had the moment. I have worked in cybersecurity since 1994. My first job was at a big 3 working for the U.S. government through one of the world’s...
Account takeover fraud may sound like a familiar term in cybersecurity, yet its prevention methods in the e-commerce domain are still nuanced. Retailers are historically concerned with payment fraud systems related to chargebacks. This happens when a customer makes a...
Kuwait, 1990 I’m launched out of a submarine a few miles off the coast of Kuwait City. When I swim to shore, I quickly change into my dry land clothes—a full burka. I was a six-foot-one Marine posing as a good Muslim woman. The catch, beneath the modest...
Most CISOs divide their approach to cyber defense into three pillars: people, technology, and processes. These pillars define a cybersecurity program’s defensive architecture and arsenal, available assets, and policies and procedures that together inform...
The cyber security marketplace is hot. Ask any candidate for a cybersecurity role. Better yet, ask any supplier to CISOs. The supplier audience is especially vast, and it’s continuing to grow. Just three years ago, there were estimated to be less than 2,000...
Automated measuring of control effectiveness is a very good idea conceptually. When you can combine control gaps with relevant threat information, you get a very good picture about the actual technical cyber risks your business faces. If done correctly, it provides...
Keith and I left the scene like we found it: the two kidnappers dead on the floor, their shotgun up against the wall, and the rope used to tie up Carl Timmons sprawled out on the floor. We tipped off local law enforcement and were gone before they arrived, leaving no...
An increasing complexity of technologies, as well as an increasing number of failures and attacks followed by an increasing dependency on business goals is changing the way we run Security Operations Centers. I previously discussed the concept of a Fusion Center as an...
Until recently, cyber awareness metrics have been treated by many as a tick-box exercise driven by regulations. The regulator requires x number of hours of cyber awareness training per employee per year, and once that is done, the organisation ticks a box and waits...
The cyber risks we face today are more than we faced previously but also fundamentally different in several respects. Our adversaries are more adept and their tools and tactics more protean in capability. In light of these increasing challenges, our cyber defenses...
In our final installment, we are going to discuss how you roll all the concepts previously covered into a plan of action. The difference between the success and failure of a data classification program is a lack of action. I have reviewed over 10 programs in my...
Previously, we discussed the requirements of a mature data classification program. In this post, we are going to review the administrative mechanics of such a program. Data classification, you’ll recall, usually includes a three- or four-layer system akin to the...