Rogue Code

13

Victor Bandeira climbed into his taxi helicopter, gave Sergio, the pilot, a nod, and then sat back in his comfortable seat. Almost at once, the blades whirred and the agile craft lifted from the helipad atop the towering building. Sergio was one of the old guard, a foot soldier and bodyguard he’d relied on for years. He’d had him trained to serve as his pilot, not wanting to rely on outsiders.

Bandeira adjusted his charcoal gray Armani suit and checked his watch. Though he adhered to the Latin custom of tardiness, especially when it was he who had called the meeting, he did not take it to extremes.

The city skyline was spiked with gleaming glass towers, symbols of the new Brazil and its regional economic dominance. After five centuries, the nation was at last assuming a significant place in the world. Brazil had always been the land of destiny, filled with promise and expectation but falling short time and again, sinking into a morass of corruption and failure.

There’d been frenzied eras of economic boom before, first made possible by sugar, later by coca, then by rubber. Each had brought enormous wealth into the country and made a handful of families very rich. But this boom-and-bust cycle, always dictated by circumstances outside the country, had never solidified into sustained growth or elevated Brazil to world power status.

Now all that was changing. Over recent decades, the government had instituted initiatives to give the economy greater balance, and with the development of a vast oil reserve just off the coast, a measure of sustained prosperity at last seemed possible. Bandeira was not a patriot, but all these changes meant opportunity, and if nothing else, he considered himself a man who knew opportunity when he saw it.

He took in the smog-shrouded skyline as the helicopter weaved its way among the towers. He counted a dozen other air taxis exactly like his own. At any time, there were as many as five hundred of them plying the busy skies over this city of twenty million. He looked through the brown blanket of smog beneath to the traffic-clogged streets even farther below. More than six million cars were crammed into those congested streets. He’d be two hours getting to his meeting down there. In the air, the trip took less than ten minutes. So it was that the rich and influential moved about São Paulo, flying above the masses like demigods.

But convenience and efficiency weren’t the only reasons for the sky taxis. The sky was safer than taking the streets. Kidnapping was a cottage industry in the largest and richest South American city. More than one acquaintance and countless others Bandeira knew by reputation, men who had taken great measures to ensure their safety, had been seized off the street and held for ransom. If the kidnappers misjudged and asked for too much, if the family or business moved too slowly, or sometimes just to make an early point, an ear of the victim was hacked off and mailed.

So common was the loss of an ear among the rich that more than one local surgeon specialized in its reconstruction, extracting naturally formed cartilage from within the victim’s body and from it creating a replacement. True, the new one was hard and unyielding but it looked like the real thing even on close examination. The daughter of one of his colleagues wore such an ear while two young men of his employ took another approach, proudly displaying the space where the ear had been shorn, testament that they’d been taken and survived the ordeal.

One of Bandeira’s rare failures had been in his effort to control the local kidnapping trade. In his view, it was out of hand, targeting those it should not, giving the city a reputation for violence and danger that was not good for business. Bandeira had long planned to bring kidnappings under the control of his gang, Nosso Lugar, “Our Place,” or NL as it was known. But the other gangs, quadrilhas, engaged in kidnapping were too disorganized, too impulsive to be brought in hand. They viewed Bandeira with the same distrust with which they saw the official authorities.

After several futile efforts, Bandeira had called a halt to his attempt — for now. He’d concluded that consolidating the gangs and bringing them under his control was possible only through a sustained violent effort. These thugs understood death. The consequence was that a significant number of them would have to be killed. The other approach was to kidnap members of their families, cut off a few ears, make demands. Only then would they begin to see the light.

Bandeira had discussed this approach over lunch with the regional police and military commanders, two men with whom he’d worked for decades. The three of them had talked it through at length, and they’d agreed it could be done. And they were prepared to let Bandeira do it, providing cover as needed. If one gang was preying on another, it was possible that the media would accept it as a positive outcome and for once divert attention from law enforcement’s own failure. But both men had cautioned that only a sustained campaign of terror and violence could succeed. In the end, the gangs would have to be brought to heel. These were vicious men who lived violent lives, so nothing less than absolute dominance would work. A half effort would only bring on a war of greater ferocity, which they did not want.

“What we need,” the city chief of police had said through his cigar smoke, “is a period of civil unrest. A time of street demonstrations, assassinations, vendettas, and murders to serve as cover for your operation. Who would know? And when all was over, you’d be in control.”

The general smiled. “This is Brazil. We all know such a time is inevitable. If I were you, I’d plan accordingly. You can count on us,” he’d said reassuringly.

So the plan was in place. The police and army fed information to NL every week, and one of Bandeira’s trusted captains kept the plan updated with names and addresses. When the time came, Bandeira’s organization would act. The consequence would be an end to random kidnappings and the return of greater safety to the streets. Targeted kidnappings would become the norm, quiet ones that would still be lucrative. The wealthy of the city could breathe a little easier, and foreign investment would not be so timid.

Bandeira contemplated the numerous ways he’d profit with a sense of satisfaction. The helicopter banked, righted, then began a gentle approach toward the round landing pad atop the gleaming Banco do Novo Brasil building. Bankers, Bandeira thought as he mentally reviewed that morning’s agenda, they should all be shot.

14

Now that Jeff and Frank had penetrated the NYSE engines and had free access to the core of the trading processes, they were in the final phase of their engagement. They continued employing the specialized tools that Jeff had devised over the years and which he guarded closely. They were the key to what he did and made his work not only less tedious but also more effective. The hardest part of the decision in hiring an outsider, even a friend like Frank, was granting access to these jewels.

He had other tools, which he made commonly available at his presentations in order to spread his brand and facilitate better computer security. They were accordingly closely identified with his name and that of his company.

At this point, the pair was mapping the extent of their success while also searching for other ways and paths to more deeply penetrate the system’s cyberdefenses. Having succeeded at their primary task, they took a more leisurely pace now, less intense. The pentest was essentially complete; what they did now was icing on the cake.

Jeff could simply have informed Stenton of their success, but he had a reputation for going a step further and typically did something harmless to the system that persuaded even the most dubious company executive that he’d accomplished what he said he had. He reviewed things he’d done in the past, wanting to pull something clever and distinctive from his bag of tricks. He decided to ask Frank for ideas.

Taking an early lunch, they’d stretched their legs and walked up to Chinatown. After selecting a restaurant at random, they sat in as quiet a corner as was possible in Manhattan at midmorning.

“You know,” Frank said, eyeing his pair of chopsticks dubiously, “we haven’t been spotted yet. At first I kept thinking an alarm’s going to go off, but instead we’ve got the run of the place. I understand why the antivirus programs don’t know we’re there, since we aren’t in their database, but their other automated security programs ought to be spotting our presence. They continuously monitor operation commands and functions. If any company in the world understands how to mine data looking for the smallest hint of something unusual, it would be the Exchange — at least that’s what I thought.”

“So far, we’ve only planted a bit of code, and that looks legitimate. All we’ve really done is take a look.” Jeff smiled. “And we’ve been clever.”

Frank split the chopsticks apart, then tested them in his right hand. “They don’t know we’re there, so we can set up all the offshore accounts we want and move money into them. Of course, it would leave a trail, since computers are keeping tabs on the money, but there’d be nothing to stop us. The trick is leaving nothing behind that points to us personally, then whipsawing the money around the world until it’s impossible to trace.”

“Do you really think that’s possible in this day and age? It seems to me that every digital transaction can be traced.”

“In theory, sure, but if you’re clever about it, create a host of dead ends to mask the money trails, then bury all of them in complexity, you can slow such a search to a crawl. In practice, you can make it never ending. It would take a dedicated team and time, but it can be done. We saw terror groups doing that with the money they raised and stole all the time when I was with the Company. We did sometimes catch it, but we knew what we found was just the tip of the iceberg. The Internet, Jeff, is as close to infinite as anything on Earth. You don’t have to block anyone trying to trace you, even if it were possible; using robo code, you just have to keep stretching the trail ad infinitum. It works out to the same thing.”

“Maybe. Better, though, if the Exchange never knew the money was taken in the first place.”

Frank pursed his lips. “Yes, but how do you do that?”

“Maybe take it directly from clients’ accounts, a bit here, a bit there, keeping in mind that a ‘bit’ in this case is a few hundred thousand, maybe a million at a time. Take a penny of every dollar out of transactions, for example. They might not even notice, and even if a client sees the loss, the Exchange doesn’t.”

“But if enough of them complain, the Exchange will get on it.”

“You conceal the loss within their trading patterns so it doesn’t look as if it’s an Exchange issue. You know bureaucrats, always looking to avoid problems if they can. If you aren’t greedy, all you’re doing is skimming a bit of the cream each time. It might raise a few eyebrows, but there’s no reason — in theory, at least — to cause any serious research. I think that’s the better way to do it. Then you can bury it with electronic false trails like you say. And it’s really only a variation of what the high-frequency traders are already doing, especially those hiding offshore.”

“Good thing we’re honest.” Frank jabbed at his rice with chopsticks. He finally put them down and picked up a fork. “You know,” he said, “I’m thinking about moving my nest egg out of stocks.”

“Why’s that?”

“I don’t like a lot of what I’ve seen, but it’s these high-frequency traders that really get me.”

“What about them?”

“I don’t care if a company finds a way to buy and sell faster. Paying for close physical access isn’t fair, but those with money always have an edge like that. The problem with high-frequency traders is their manipulation of the financial system. And because they’re allowed to hide what they do, no one really knows the extent of the manipulation.”

“I didn’t know you were such an expert.”

“I’m not, but I’m getting there. Actually, I’m reading a book about it. It’s really eye opening.”

“You’re obviously not working hard enough if you have time to read a book.”

“It’s part of research. A vital part, from what I’m seeing.”

The problem, Jeff and Frank had realized from the beginning, was that understanding in detail how the Exchange worked was extraordinarily complicated. The professionals making their fortunes from Wall Street employed their own jargon, in part to convey ideas effectively but also to safeguard their propriety access to the lucrative trading system. Once stripped of the needless complexity, the system wasn’t that incomprehensible.

“Buy low, sell high” was still the lifeblood of trading. Computers and their role in the international market had caused that basic rule to become more complicated than ever, but it remained the essence of the Exchange. When someone wanted to sell, they offered the stock at a specific price. When someone wanted to buy, they listed the price they were willing to pay. Between them was a difference. When one party moved, the transaction took place, not physically off to the side of the trading pit as had occurred at one time, but with nearly unimaginable speed.

Algorithms zipped through the Exchange’s computers, searching for deals within the parameters the programmers had established. When a trade that fulfilled the parameters was found, it was made faster than the blink of an eye, with no human interaction.

The essence of this had always been to stand at the front of the line because there were always more buyers for deals at the right price than there were sellers. The logic was simple enough: More buyers at the listed price drove the price up. The stock available at a desirable price was gone before all the buyers were satisfied. Since getting to the front of the line was essential, the Exchange had a rule — the first to offer to buy was placed ahead of those to follow.

As there was more than one exchange in the world, stocks could be offered for sale or to buy at different prices at the same time. But like water seeking its own level, given time, every stock had but one price. The opportunity came when a delay existed in settling on that common price. In a process known as arbitrage, computers networked around the world reported differences in prices, and algos exploited discrepancies the instant they were discovered. HFTs made money if the difference was an increase in price, and most of them made money by short selling — that is, making money if the price fell. The difference was exploitable either way.

Those opportunities had always existed, but now with computers, they were hunted down as never before, and the chain of transactions took place at unbelievable speeds. This was the red meat for high-frequency traders and as a consequence accounted for a substantial majority of all trading activity, a percentage that grew with each passing month.

HFTs designed and unleashed more sophisticated programs than other trading systems. They paid for proximity to the Exchange’s hub engines to get themselves to the head of the line, beating out more remote competitors. They also possessed a comprehensive understanding of the market’s microstructure. No other traders understood exactly how the trading engines worked, precisely how trades were executed, how orders were prioritized — but HTFs did.

“I don’t know,” Frank said as they finished their meal. “It just seems to me that the stock market doesn’t work any longer, not in any logical way. It’s so complex and fragmented, no one’s got a clear understanding of how it functions. It doesn’t even seem to be about providing a marketplace where people can buy and sell securities. There’s all this other stuff going on all the time. It’s all smoke and mirrors, altered reality, like a video game. What’s scary is that I don’t think anyone understands all the new rules or the full extent and implications of this permissiveness. There used to be just a few kinds of trades and only a couple of places to make them. Now there are more than one hundred types of trades, and if you add the variations, it’s well over that. And there are plenty of places where you can execute them. It’s all intentionally complicated, if you ask me.”

“It’s computers,” Jeff said. “They’re a curse and blessing. They make high-frequency trading possible. And the billions of dollars they’re taking all comes out of the pockets of pension funds, 401(k)s, and regular investors.”

“It’s worse than you think. As far as I’m concerned, these HFTs simply manipulate the market, like I said. Consider this: In an old-fashioned traditional physical trade, a man with a bag of money might stand behind the buyer, demonstrating his interest in buying even more stock if it became available. He never needed to actually bid on the stock to influence the price; simply existing was enough. His presence alone tended to drive up the price. It worked the other way as well.

“These HFTs have perfected a system in which they can appear to be that guy with the big bag of money ready to buy, but without ever actually executing an order. The consequence is that the sale or buy price moves, and once it moves in its favor, the HFT programs execute in a millisecond and make a profit. All the while, no one knows if the guy with the big bag of money even exists. In most cases, the HFT never owns the stock it is offering to sell. If things don’t move the way they want — if the difference they spotted disappears before their order is filled — they just cancel it. As a consequence, over half the volume of orders processed by the Exchange are canceled. It’s nothing less than tampering. They aren’t making a legitimate offer to buy, or sell. They are trying to move the price to a point where they can make money. And nothing stands still. The HFTs are constantly inventing new, profitable ways to exploit financial transactions, novel ways only the sophistication — and speed — of their servers make possible.

“Listen to this,” Frank continued. “In May 2010, the financial markets plunged into free fall with no warning. In just minutes, the Dow plummeted almost one thousand points, something like nine percent of its value. It was the biggest single-day drop in history. Nearly one trillion dollars disappeared into digital vapor.”

“If you say so. I must have read about it.”

“We all did, and if you’re like me, it didn’t mean a thing at the time. Some shares fell in value to a single penny, if you can imagine, only to rebound to, say, thirty-five dollars within seconds. And in high-frequency trading, ‘seconds’ is a very long time. It worked both ways. Apple, for one, briefly traded at a hundred thousand dollars a share — can you believe it? — up from around two hundred fifty. It wasn’t alone. Then, within minutes, the stock market righted itself and recovered its losses.

“Trades were taking place so fast, a delay of thirty-six seconds crept into the system. Now, that’s a lifetime in this world. What it meant was that what the computers, even the real traders, were seeing was half a minute away from reality, so they were acting based on dated data. It was like 1929 all over again. They bought and sold, thinking the price was going one way, when actually, it was moving the opposite direction.

“The collapse was so extreme, so profound, it was like watching a pedestrian being struck by a speeding car. Then, as you tried to deal with the horror of what you’ve just witnessed, the victim stood up, brushed himself off, and walked away as if nothing had happened.

“Traders were shocked at what they’d experienced. Everyone wondered if it would start again. But it didn’t. They decided it was an anomaly, so they went back to business as usual right after. The SEC, Wall Street Journal, hedge funds, all looked for an explanation without success. All they did was give it a name — Flash Crash.

“Now, nothing like this could happen before computers, and that’s the point. Traders seeing such fluctuations in prices remotely approaching these would have used common sense and not participated. They’d stand down. But the computers applied the logic of their algos and reacted instantaneously, without consideration of the consequences or logic of the situation. Stop and think about this for a minute. If a thirty-five-dollar stock fell to, say, two cents, would you sell? Would you even be taking part in what is clearly a bizarre phenomenon? Of course not. You have common sense, you know something is very wrong. But the computers don’t think; they act. They sell at two cents, they buy at two cents, if there’s money to be made. Reality has nothing to do with their world.

“There was a lot of unease, even though the market recovered. They’d seen the pedestrian walk away, but it gave them no comfort. Everybody was really nervous, and the lack of an explanation only made it worse. There was the suspicion, the near certain belief, that high-frequency trading was behind it all. About a half year later, the Security Exchange Commission’s report was finally released. Just one enormous trade had gone terribly wrong, it said. That’s it. And get this, the financial markets weren’t prepared for it! That vulnerability, the SEC said, was because of the aggressive selling by HFTs whose computers had responded automatically to the market’s illogical behavior, exactly as traders had suspected. You get a few HFT algos responding to each other’s movements, and things spiral out of control before anyone realizes what’s going on. It’s not humans trading with each other; it’s computers. Cross-market arbitrageurs, looking to score a quick profit, piled on and drove prices down something like three percent.

“What the HFTs did was issue nonexecutable orders in batches. These were intended to detect early trends or to test latency. Critics claim their purpose was also to clog the exchanges, to create noise, to outmaneuver competitors. Pretty cynical.

“Now, stay with me here. You have responsible high-frequency traders. Their algos are set to pull out when they see erratic behavior. But you also have irresponsible high-frequency traders who are not so smart. So what happened was the smart HFTs left the trading field to the dumb ones. That’s why you had such crazy trading decisions.

“Here’s the big part, in my opinion. All this was caused by a trade of just over four billion dollars on a day in which the volume was two hundred billion. Think about it. What would a larger trade do if it went awry? Four billion’s a lot, but even more is not out of reach. What if the algos causing the disaster failed to correct themselves? What if the exaggerated prices remained fixed for more than a few seconds? And remember, these guys have all been forewarned now. They aren’t likely to be so patient next time. The Exchange keeps telling everyone they’ve put a stop to these computer issues, but there’s no confidence any longer in the integrity of the system. The same thing happened on the Shanghai Composite not much later. It collapsed six percent in just two minutes.

“The SEC report said that the regs that were supposed to prevent the Flash Crash didn’t. And that the Exchange was still vulnerable to large and immediate transactions. Those involved in the financial markets decided that the Exchange understood a little of what had taken place but not why. They figured it could happen again, and it did.”

“When?”

“Facebook and the disastrous BATS IPOs. Now the Facebook IPO was handled by NASDAQ while BATS did its own, but the lessons cut across the industry. Both of them had significant trading anomalies. What’s going on is that there’s a lot of unease and distrust in the worldwide financial community. The big guys have made plans against the day the next Flash Crash happens. The dark side is that if the immediate rebound fails to materialize, it would then be every man for himself. That’s an eventuality these new algos have already been programmed for. The market won’t have more than a few minutes to right itself before it’s everyone acting in his own interest and to hell with the market. No one can predict the extent of the potential financial abyss.”

“You’re saying Thunderdome?” Jeff asked.

“Why not?” Frank said. “The worldwide financial system is so connected, and becoming even more so, why not? It’s all run by computers, and even after such events, there were no significant security changes.” Frank looked around the room. “Everyone’s too busy making money,” he mused.

“Not everyone. Plenty are losing it. So what’s your plan? Bury gold in the backyard?” Jeff asked.

“That’s just it. What do you do? The point is not to stay in the stock market, but if you stay in currency, with the way it’s being devalued, you lose worth. So you buy property, right? Well, good luck with that. We’ve all seen how that goes. Getting the money out of the country and into a basket of currencies might work if there weren’t so many regulations working against it, and at my level, it’s not worth the effort. The point of all this is the average guy is getting screwed.”

“So what else is new?” Jeff asked.

15

Following his meeting that morning, Victor Bandeira took the helicopter for the short ride to his residence in exclusive Macatuba. The small helicopter swept over the manicured estates below, banked left, slowed, then eased onto the helipad marked by two concentric circles and an X. The craft touched gently down and the pilot immediately killed the engine, then set the rotor brake. A minute later, Bandeira stepped out and walked briskly toward the main house, carrying a thin briefcase.

His son, Pedro, was waiting at the entrance, as the two of them were to have their midday meal here at Bandeira’s estate. Afterwards, the young man would join his mother at her home across the city before returning to Rio. It was his twenty-fifth birthday.

Set on nearly twenty-five acres with a main house of some nine thousand square feet, the estate was a necessary extravagance, as far as Bandeira was concerned. To be perceived as rich was as important as to be rich. In many circles, this display was unnecessary, as Bandeira’s position was well known, but he did important business, especially with foreigners, who needed to see his wealth on display.

The furniture in every room was specially built for the house. There were eight bedrooms, office space, a huge family room, and a dining room nearly as large. There was a four-season porch and terrace, a spring-fed pool, a game room he never used but his son enjoyed, as well as extensive grounds with fully mature trees and an orchard. There was also a guest and a maid’s house, even an acre of native forest that served as a bird sanctuary. Through it and the grounds wound a creek. Altogether, it was enough to impress even the heads of state.

Pedro Miguel Ademar Bandeira-Carvalho was a handsome young man with sleek black hair and a slim body. He possessed a slightly bookish demeanor enhanced by the rimless glasses he wore. He was dressed casually, and on the streets of São Paulo, he would be taken for exactly what he was — an IT professional, given to long nights writing code.

By design, there were no visible signs of security. The estate had the latest in technology, but Bandeira relied primarily on a devoted team of bodyguards, whom he treated and paid well. They were discreetly located about the grounds, nearly all out of sight.

The operatives were under the direction of Jorge César. Tall, slender, mustached, and nearly always dressed in an austere black suit, he was utterly devoted to the elder Bandeira. The two had attended school together. Afterwards, César joined the police. When Bandeira assumed control of the cartel, César left law enforcement and became his full-time chief of security. A quiet man by nature, he blended easily into the background, always alert, in regular contact with his security team.

Father and son embraced, Pedro kissing his father lightly on both cheeks. Bandeira set his briefcase down, then took his place at the head of the long dining table. Pedro sat to his immediate right. Except for the servant who brought each dish, they dined alone.

“Here,” Bandeira said, removing a nearly square wrapped box from his suit pocket. “For your birthday, my son.”

Pedro accepted the gift with a smile, then unwrapped it as Bandeira watched his face keenly. When the young man opened the box to see the dazzling wristwatch inside, he grinned broadly. It was the latest Louis Moinet. “It’s too expensive. Something more modest would have been enough. Really.”

Bandeira pushed the box and wrapping aside. “I saw you looking at mine one day. I thought you might like one just like it. There’s an engraving.”

Pedro lifted the watch and tilted it so he could read the inscription: Para o meu filho, Pedro, de seu pai amoroso. “To my son, Pedro, from his loving father.” He slipped the watch on, his grin never easing. Bandeira sat back, satisfied. He’d read the boy’s interest correctly.

“Now, let us enjoy our meal.”

They ate while discussing Pedro’s work in Rio, Bandeira nodding in approval, asking an occasional question but not as he might at a meeting. This was a festive event, a time he’d looked forward to for several weeks. Anyway, he was well briefed on what his son did, in every aspect of his life.

When they’d exhausted the mundane topics, Bandeira asked, “Is Carnaval ready?”

Pedro nodded lightly, his mouth full of food. When he finished chewing, he said, “Nearly. I think we’ll hit the benchmark.”

“I’m thinking about upping the take with it.”

“We’ve been on this for months now, pai, and we’re only a few days out from the IPO. Changes at this date could create unintended problems if we don’t have enough time to run a full range of tests.”

“I understand. But you have a good team. And … I have pressing needs. You understand.”

The pair waited as espresso was served with a dessert.

“We can try,” Pedro said, “but I’m worried there isn’t enough time.” Bandeira nodded without comment. The men took a bite, and then, to change the subject, Pedro said, “You know, you always said that someday you’d tell me more about your life. There is a great deal I know nothing about.”

Bandeira looked at him. “You would find it boring, I’m sure.”

“I never met my grandparents.”

Bandeira thought. “My parents? I suppose you are right. You’re a man now. Actually, except for the family story, you surely know it all as it is.” He leaned back and lifted a cigar from the table where the server had placed it with dessert. As he clipped the tip and lighted it, he said, “Where to begin? It was … so very long ago.”

Victorio Manuel da Silva-Bandeira had been born in the favelas of Rio de Janeiro. As he told the story now, he slowly lapsed into his childhood accent, the patois of the poor and disenfranchised of Rio. He did it without thinking and realized it had occurred only when he saw the sober expression on his son’s face. To speak the truth, Bandeira thought, I must speak in the language of truth.

His father, Miguel, had come from the north, he said, seeking opportunity in Brazil’s premier city. He’d found a job as an automobile mechanic, worked hard, married late, and had just two children, Victor and a younger daughter, Maria.

“My mother, your grandmother,” Bandeira said, “ran a cart that served meals on the street. You know the kind. You see them in every poor area of Brazil. Maria and I helped her from the time we were toddlers, but my father had greater aspirations for me and insisted I attend school when I was of age. He said I was smart.”

Bandeira was just as smart as his parents had thought, and he excelled in school. They encouraged him and at some sacrifice found a way to pay for his clothes and tuition. When Bandeira was a teenager, his intellect and personable manner were recognized, and under a new government initiative, he received a scholarship to an elite boarding school. The program was designed to identify bright youth and give them advantages that would ultimately contribute to Brazil’s emergence as a world economic power.

“Life was not easy on my parents,” Bandeira said. “A new gang took control of the street where my mother set up her cart each day, and they demanded so high a payment, it was nearly impossible for her to earn any money. When my father met with the chefe and respectfully explained the situation, he was savagely beaten.” Bandeira stopped at the memory, at the rage he’d known when he first saw his father’s wounds. “Unable to go to work, he lost his job, and for a time my family’s situation was very bad. I wanted to drop out of school to work, but he forbade it.”

“What happened?” Pedro asked.

“My mother agreed to sell more than food from her cart. She had no choice in the matter, frankly. It was either sell the small, folded-paper packets or go hungry. When my father was healthy again, he returned to the chefe, knowing another beating might well result. He explained that his wife could not openly deal in drugs. It would drive away her regular customers and inevitably lead either to her arrest by police or death at the hands of a rival gang. He suggested instead that she serve as a lookout and from time to time as a transfer point for wholesale packages. She’d serve a better role for them this way.

“The leader apparently admired his courage, or saw the logic, because he agreed. My father found work with another garage and life went on. For a time. You will find this hard to believe, but I was one of the first at school to show a real interest in computers. I was fascinated by them, even wrote a bit of code. Don’t ask. I don’t have it any longer, and I’d never show it to you if I did. Because of my interest in computers and because of my background, I had many problems at school at first. Most of the students were from well-to-do families, and it was impossible to hide my own poverty. I worked hard on my diction, but it was several years before I rid myself of my accent. I was taunted and teased until I beat one of the older and much bigger tormentors. I threatened to do the same to any student who told on me. Thereafter, I was left alone.” Bandeira paused to reflect. “In the end, it was my ability as an athlete that led to my acceptance.”

“So you were good at futebol?”

“Did you doubt it? I had more reason than most to work hard. It was important to me, more important than to players with greater ability.” Bandeira talked about the school, the teachers, the course of study, the girls who attended their own school down the street. “They were like angels for us to worship from afar.

“When I was sixteen years old, everything changed. The situation on the street corner occupied by your grandmother had continued for three years with no real trouble. The family had a bit of savings. My parents did not tell me what my mother was up to, but Maria did. There was nothing I could do about it, and what other choice was there? Other girls I’d known growing up now worked as prostitutes; most of the boys I’d played with as a child were either drug dealers or thieves, or both — if they weren’t dead or in prison. A few had taken honest jobs, but they lived no better than anyone else.

“A new gang wanted the territory. To make their point, they killed a number of the lookouts, including my mother and Maria. She was just fourteen. They’d simply been gunned down at the start of the violence.”

Bandeira stopped. His face became soft as he said, “You’d have liked your aunt. She was delicate. When you smile, it reminds me very much of her. It breaks my heart sometimes.” He sighed. “They gave me a week off from school to attend the funerals and mourn. I told my father that I was not going back, and he slapped me for the first time. ‘You will go back, Victorio,’ he said. ‘You will succeed. Why do you think your mother worked on those streets? For what? Some beans and rice in her belly? It was for you, for you. You were her hope. We need no drug dealers in this family, no thieves. You were, you are, our salvation. Study, work hard, succeed.’ That is what he said to me.

“So I went back to school and worked even harder. Three months later, my father was killed crossing a busy street. I never knew if it was an accident or if he’d said the wrong thing to the wrong man. That is when my life took a change I could not imagine. A few weeks later, I was invited to spend the Easter vacation with the family of my best school friend, Luís. He was a little wild and didn’t study, but he wasn’t a snob like the others. They lived here in São Paulo, and for the first time, I experienced up close the world of the rich.” Bandeira gestured lightly with his cigar. “This world.”

Ademar Carvalho, Luís’s father, he said, was the leader of a local crime cartel. Though uncultured, he’d become very rich and had sought the appearance of legitimacy later in life. He lived in an exclusive gated community near the Pinheiros district of São Paulo. Carvalho was a hearty, robust man who doted on his youngest son. For two years, he’d been hearing about Bandeira — the tough from the favelas, star futebol striker — and then he learned of the deaths of his parents.

“‘My home is yours,’ he told me. ‘You must enjoy yourself while you are with us.’ That was more easily said than done. The boarding school had always seemed luxurious to me, with its peaceful central garden and clean solid rooms, the buildings on tree-shaded and safe streets. We students were well taken care of, and I’d always found the food abundant, even sumptuous. But this was a different matter. Afterwards, Luís had to persuade me time and again to join him until finally I became more comfortable with the servants and the Carvalhos’ extended family.

“Ademar Carvalho had steadily worked his way up through the ranks of Nosso Lugar, emerging as leader some ten years before. His was not the largest such organization in the city, but it was well established within its area, selling the usual, running numbers, and providing women to the back-alley brothels.”

Carvalho had been impressed with the young Bandeira. He knew the boy’s background and systematically set about recruiting him. The most recurring difficulty Carvalho had was not rival gangs or the authorities; it was finding hardworking, loyal young men. Eighteen months after that first visit, when Bandeira graduated, Carvalho suggested he work with him a bit before deciding on his future.

By this time, Bandeira was ready. He’d paid attention, even asked a few discreet questions at school, read newspapers, gone to the library for more research, and understood just who Luís’s father was. His own father, he’d decided, had been wrong. And because of that error, the street and gangs had taken his pai, his mother, and his sister away. There was no place for honest people in the world, definitely not in Brazil. Carvalho was showing him the way, and Bandeira intended to follow.

“And I’ve never changed my mind in that regard, Pedro. I have pursued the correct course for my life.”

He’d worked a year in São Paulo, never on the inside of the operation but never left on his own on the deadly streets. He ran errands, delivered messages, supervised lower-level operations when the usual manager wasn’t available. He was forbidden to possess drugs or a weapon himself. He was scrupulously kept away from all violence. The chefe had bigger plans for him.

As a reward for his good behavior, Bandeira was given access to the better brothels, enjoying them almost daily, and was provided with enough money to dress properly and to move in the more respectable circles when he wasn’t working. After the year was up, Carvalho had taken him to lunch at his exclusive club.

“‘I want you to attend the university,’ he said to me. ‘Luís refuses. I hope you will try to persuade him to join you.’ In fact, by this time I rarely saw Luís. After school, he’d joined Nosso Lugar with a vengeance. He ignored every effort made to keep him away from the areas I was also forbidden. Rumor had it, he’d already killed two men, and he was never without a gun. Fast women, fast cars, cocaine were his stock-in-trade. I told his father I would try but—” Bandeira shrugged. “—he understood. ‘There is much we do that is very addictive for the wrong kind. You can never be sure how men will react when given some power and exposed to what is out there. Luís breaks my heart. Do your best,’ he told me.”

It was agreed that Bandeira would take a degree in finance and business. Carvalho would pay for everything. When it was time, he would join the NL in junior management and begin his career. It went well for Bandeira, though Luís was dead within a year. Thereafter, Carvalho drew him even closer to him and his family, finally suggesting the marriage to his daughter, Esmeralda.

Lunch with Pedro had gone well, Bandeira thought as he set off for the city. Rather than be shocked by the story his father had told, by the harsh accent of his youth, his son had been intrigued, perhaps even impressed. No, it went better than he had feared. Relief swept over Bandeira, and only then did he realize how much he’d worried about telling him the story.

The young man seemed to have completely recovered from his anger at his parents’ divorce six years before. Bandeira scowled at the thought. His former wife, Esmeralda, had not been suitable for his new station in life, not that it was her fault. They’d married young, and it was a good match at the time. Unfortunately, her approach to the bedroom had been traditional. Despite the reputation of Brazilian women as lovers, wives of the old school viewed sex as a service. Their attitude drove men to other women, but that was the way it had always been.

For the first years, Bandeira’s only real disappointment was that they’d had just a single child, a son, at least. But in time, with his greater success as he’d moved in better and better circles, the uncultured and ever heftier Esmeralda became an embarrassment. Then she’d fixated on his many lovers and, to his surprise, began making demands. After that, he brought the charade to an end. These were modern times. There was no reason for him to be shackled to someone unsuitable, certainly not after the death of his father-in-law.

Still, the divorce had angered Pedro, and for a long year he’d refused to have anything to do with his father. That had hurt, hurt far more than Bandeira would ever admit. A Brazilian’s son was as much a part of the father as he was his own person. The wound had gone deep, and Bandeira feared the estrangement would be lasting.

He’d placed his son in charge of the Rio team, responsible for an operation ideally suited for Pedro’s attention to detail and technical background. Casas de Férias, “Vacation Homes,” it was called. All Pedro had to do was keep on top of things and lead. And so far, the boy had done just that. He’d taken to his work with zeal, and Bandeira decided that his son might yet become a true man, a man capable of taking over the cartel when Bandeira’s time was done. Not that that would happen anytime soon. He had years to go yet.

Curiously, it was Esmeralda who’d made this possible. Once she became his ex-wife, their relationship had suddenly improved, to his great surprise. She’d taken to dressing in the traditional black of a Brazilian widow, and he understood that within her circle of intimates, she spoke of him in the past tense, as if he were dead. At first he’d been shocked, and he’d confided in Carlos Lopes de Almeida one night over drinks.

“She is traditional, Victor, that is all,” Almeida said. “She cannot accept divorce. It is not in her makeup. She has been married, she has a son, and now she has no husband, so she must be a widow. It is no more complicated than that.”

Victor realized at once that he was right. As a consequence, he saw Esmeralda only alone, never around her friends, so she could maintain her façade — not that he had occasion to see her that often. Still, her name had been on many corporate documents, and it was necessary from time to time to obtain her signature. It was on such an occasion that she’d raised the subject of their son.

“I have spoken with Pedro,” she said as they sat in her garden some months after the divorce. As a youth, Esmeralda had closely resembled the Mexican actress Katy Jurado. That had been no small measure of her appeal, he’d come to realize. Now, forty pounds and twenty-six years later, the resemblance was impossible to find. She did carry herself with dignity, but that was an affectation of her putative widowhood.

“I have told him that the past is the past,” she said, “that you are his father, and he must not treat you as he has.” She paused.

“Obrigado,” he said. Thank you.

Esmeralda inclined her head. “He has promised and I believe him. Call him. He will see you.”

That was the moment Bandeira wondered at the prudence of his divorce. Other times such as this flashed in his memory, times when she’d shown wisdom and a greater understanding of life than he often possessed. She’d never condemned his career and he rarely spoke of it in her presence, but there had been occasions when she’d known of his troubles and each time given considered advice, advice he followed. Maybe he’d been wrong to shut her out of his affairs so completely all those years; maybe he’d been wrong to divorce her when he should have embraced her fully as a trusted confidante.

But it was too late for that. “Obrigado,” he repeated.

“If I may suggest,” she continued tentatively, “you should find a place for him in your organization. A place of significance, though I understand you must craft him carefully; he is still young and untested. But he has ability, he is willing, and … he is your son.”

“I will do that.” And so he had. Vacation Homes had gone well, better than he expected, but his computer expert, Abílio Ramos, had much to do with that. Ramos had brought his wide-ranging Internet gambling enterprises under control, and Bandeira had enormous faith in his ability. Still, there was no question that Pedro had found his place. One of the reasons for their lunch had been to give Bandeira still another opportunity to consider the young man’s future. How long should he remain where he was? Where should he be moved next? Was it time?

When a longtime friend asked if Bandeira planned to change the name of the Esmeralda, he had shaken his head, saying it was bad luck to alter the name of a boat. The friend had accepted that, but Bandeira concealed the real reason.

Gratitude. Esmeralda had given him back his son.

16

That morning, Jeff had employed one of his Linux tools to perform a thorough inventory of the UTP system. After lunch, Jeff and Frank returned to their temporary office and logged on to the command and control, or C2, server to check the status of the automated scans of the UTP servers they’d left running. Jeff sat up straight. “Look at this. Rotorooter says there’s a file hidden with a rootkit.”

Rotorooter, as he had named it, was one of the programs Jeff routinely ran whenever he gained access to a system. It was designed to look for signs of rootkits, which were programs that hid files or other programs from the standard administrative and diagnostic applications a systems administrator would run.

“There shouldn’t be anything hidden in this system, not where we are,” Frank said. “Are you sure Rotorooter isn’t giving you an FP?” Wonderful as Jeff’s tools were, they did provide false positives from time to time.

“No, not entirely, but I don’t think there’s any reason it would.” Jeff showed Frank the Rotorooter’s output, and for the next hour, the men worked in conjunction, finally establishing that there was no problem with the tool, that a concealed file existed within the UTP, a place where none should. One odd turn occurred when Frank determined that embedded in it was the NYSE Euronext digital authenticating signature. With that knowledge they made several attempts to access the file employing standard system commands, all without success.

“Maybe it’s something left from the original coding,” Frank suggested, “something inadvertently squirreled away.”

“That’s possible, I suppose, but why a rootkit? Could Stenton have planted it as a test to see if we’d find it?”

“You mean as part of the pentest?”

“Maybe.” Jeff paused, racking his brain for explanations. “Or what if it’s some final security cloak to protect the trading software from an attacker who gets this far? Of course, the scans haven’t found anything else hidden, and if this is a security measure, there should be others, wouldn’t you think?”

“It could be the most security-sensitive file in the entire system, that’s why it’s been singled out for special treatment.”

There was another long pause; then Jeff said with a low voice, “Or maybe it’s malware.” This was the most logical explanation, as rootkits were a tool of hackers.

“But it’s got the Exchange’s code signing signature.”

“So why’s it hiding itself?” Jeff countered. “Besides, the stuff we planted has the same signature. Whoever put it here could have used the same trick we did.”

“Or it’s someone in-house. That’s more likely. It would make affixing the signature really easy.”

Just then, the door to their office opened. “Ready for a break?”

Jeff looked up. Richard Iyers was standing there with a warm smile. His office was not far away. From the first, he’d taken Jeff and Frank under his wing, showing them about the building, answering questions but never intruding on their work. He had said he understood what they were doing was confidential. He’d even made his gym available, but neither had had the time to take him up on his offer.

“Not now. We’re just back from lunch, and we’ve got a lot more to do yet today.”

“All work, no play. Maybe tomorrow,” Iyers said as he stepped away, careful to close the door behind him.

17

The long meeting broke, and the mid-level managers who’d attended filed out while top management lingered, as was often the case these days. Scattered before them were the electric-blue covers of the revised IPO prospectus just released by their principal underwriter, Morgan Stanley.

Brian Cameron, CEO and cofounder of Toptical, looked down at his iPhone as if he had no interest in continuing the meeting. Samantha Mason, known as Sam, sat opposite him across the expanse of the conference table. In the hallway, staff went about their business paying no attention to them behind the clear glass wall. The topic was the same as always these last months.

Money.

Molly Riskin had launched into her favorite topic with her usual animation, hands slashing the air, her brow moving up and down as she argued against the pending IPO. Chubby, with bitten nails, she was one of the company’s first employees and had worked with Brian at his previous start-up, Enerva. She was senior VP of Toptical Sales and Marketing.

Gordon Chan, CFO, was to her left, while Adam Stallings sat opposite her. Dark, hard to work with on occasion, and a software engineer, Brian had moved Adam into management, a decision Sam thought was a mistake. He lacked the temperament, though she understood Brian’s recurring dilemma. He needed people he knew in positions of responsibility, and he required people who understood the system. What it meant was that Toptical was being managed essentially by self-taught executives while the crucial software was being largely written by newcomers. That didn’t bother Sam all that much, considering what the so-called professionals were doing to companies that had been household names during her childhood. As for the code, that was another story altogether.

The money talk was ironic in Sam’s view as Toptical had all started out as nothing more than fun and games. She couldn’t believe how fast a late-night brainstorming session had become tangible, how quickly Toptical itself had become a household name. She’d heard stories of the success of other “overnight” companies, many of them companies the general public didn’t know, but this! Now they were a week away from becoming rich. Very rich.

“The IPO is set, Molly,” Gordon said. He was a handsome man, fit with a finely featured face and near constant smile. “We heard you on this last year, and you’ve made your position clear many times since then. The decision is made. We can’t cancel at this late date. You need to move on.”

“Of course we can cancel,” she said emphatically. “It’s happened before. I’m not saying it will be easy and not cost us some money, but we’ve got it. If we stay as we are, then we remain in control, we can keep Toptical what we want it to be. Once we go public, we lose control. Doesn’t anyone else see that?”

Brian glanced up. “The decision is final, Molly.” He looked back down.

Molly stared at him as if he’d just walked into the room, blinking rapidly. “Okay, then consider this. The stock is overpriced.” This was a theme she’d repeated for the last month. “We’re set to go the way of Facebook.”

“Nothing wrong with that,” Gordon answered with a smirk. “Zuckerberg made out like a bandit.”

“Sure, and so did a lot of those at the top,” Molly continued, “along with the early backers and underwriters, but look what people think of them. They came across as greedy. I don’t know about you, but that’s not how I want to be seen. That’s not why I work here. That’s not who we are.”

Sam eyed Brian evenly. He was fixed on his iPhone, which lay on the blue-bound prospectus in front of him, occasionally punching at it. She’d been living with Brian four years earlier, when they’d been bitten with the bug. She and Brian had seen the inherent weakness of Facebook and of the other social networking sites, anticipated how quickly users would become disenchanted as marketers leveraged them, and they stopped being fun. They’d constructed Toptical with all that in mind, more for the challenge of it than for anything else. They’d thrown into the hopper everything they wanted in a social networking site, and a real company had quickly emerged from that.

What they devised was a one-stop shop, enabling businesses and users to establish accounts that integrated user groups, topics, family and friend groups, affiliations, video, and much more. It was far more comprehensive than Facebook because it had topics that served as discussion areas, a place to post videos, pictures, and articles, buy media content, play interactive games, obtain notices of discounts and coupons, and much more. It was of particular use to business customers because it integrated their various public faces, but let them connect to their personal identities, keeping the activities and membership of each side linked, but still separate. From an investor point of view it had a built-in monetization process, underdeveloped as yet, but demonstrated the potential for a dramatic upside. The buzz surrounding the IPO was everywhere.

Inevitably, the concept wasn’t so original now as it had been then. Now it seemed every major Internet player wanted in on the action. But they’d been first, they were by far the biggest, and they had the brand.

“Who cares what people think about us?” Gordon said, looking around the table for confirmation. No one reacted.

“We should,” Molly insisted. “Right now, we’re cool, like Facebook used to be. If we stop being seen as cool, it will hurt us. It will affect how successful the company is down the road. We need to think about that.”

“That’s crap,” Brian said, glancing up from the table. “You brought up Facebook yourself, and it’s doing just fine. What counts is the quality of our product. Anyway, the time is right for this. We need to take adv—”

“We’ve got maybe a two-year lead on the others,” Adam said. “That’s more than a lifetime in this industry. I think Molly’s got a point. I’d like us to keep control without having to consider investors, the SEC, all of that, but I agree that this may be our only shot at real money. I get that, so I’m on-board for the IPO. What I don’t like is Morgan Stanley releasing more shares. I think we’re oversubscribed, and it’s going to dilute our share value.”

“They told me demand requires it,” Gordon said a bit defensively.

“And what if their principal clients don’t come in as strong as they claim?” Molly asked. “What if demand isn’t as high as they tell us it is? We’ve got trouble that’s what. The stock could go into free fall.”

“The company’s valued at a hundred billion dollars today,” Brian said, now fully engaged. “That leaves a lot of room for market adjustments.”

“That’s hype,” Molly said. “It’s thirty billion tops, Brian, like the prospectus says. The other figure is for PR.”

Brian smiled mischievously. “It’s still a lot of bil—”

“And where’s the money coming from?” Adam said, interrupting again. “Isn’t that the big issue here? It’s not my side of the business, but the underwriters are concerned.” He tapped the blue folder in front of him. “They dress it up, but it’s there. It’s why they released this at the last minute. They’re covering their asses.”

“Google, Microsoft, Twitter, even Facebook, they’re breathing down our necks wanting to buy us out, and they’ve got deep pockets,” Molly said. “The money they’d spend acquiring us would be a loss leader for them. They don’t need to make money with us. We do.”

“It’s not just them,” Adam added. “Right this minute, in some garage, there’s another Brian and Sam working on an idea to take us out.”

“What do you think, Sam?” Molly asked, looking at her eagerly.

Sam shrugged. “You all know what I think. I’ve said it often enough, and I was outvoted. You were one of those votes, Molly, if you recall. We should position ourselves for a takeover rather than risk an IPO. I agree with canceling next week. This prospectus gives us plenty of reason. Our subscribers will think we’re rock stars. Our future is brighter if we’re taken under the wing of a major player. We can cut our own deal, which leaves us running the show. We still get rich, but we get to keep control.”

“She’s got a point,” Adam said. “Those two at Google want us so bad they upped their offer just last week. They’ll cover any costs of canceling the offering. I ran the numbers for myself over the weekend. I’ll do about as good with them as with an optimistic reading of the IPO. I could go with Sam on this, especially after reading this update.”

“There’s no risk,” Gordon said, his eyes still fixed on Sam.

“Right. No risk,” she said. “As for the IPO I agree the stock’s overpriced. I don’t claim to understand what our underwriters are telling us, but they’ve got us valued at one hundred times last year’s profits. I think that’s at least double where we ought to be. It concerns me.” She tapped the folder. “This revised prospectus is a warning, Brian.” She looked across the table at her former lover. This company had destroyed their personal relationship, and over this last year, he’d largely stopped listening to her. “What if Morgan Stanley’s major clients back off like Molly says? I think this report is telling them to do just that. What’s going to happen is that the public who love us and come in on launch day are probably going to take a bath, and Molly’s right there too; it will hurt us. And we’re vulnerable right now.”

“We’ll be rich,” Gordon said slowly, as if speaking to children. He hadn’t been there at the beginning. He’d come later. Brian had never told her why he’d hired him, but Gordon had joined a running company, and so he had a different perspective. He’d located this building for them for one. A former synagogue, it had been in a sad state of disrepair and never brought up to speed. Because of the poor heating and an inconvenient layout, everybody hated working in it, but he’d told Brian it was some kind of deal they had to take. It had an attractive appearance and impressed the second round of investors who were impressed by cool. It served as a persuasive forum from which he smooth-talked private investors, even handled some of the media duties. He was a natural.

And Sam trusted him about as far as she could throw him.

“Our early investors want their payday,” Gordon said. “We need to get that. They’re tired of us, tired of HDTVs in the work spaces, tired of our frat boy mentality, the lack of a dress code or even basic professional behavior.” He’d argued against all of that since coming on board, Sam had to give him that. “They want a professional management team.”

Brian made a face but didn’t speak.

“The IPO’s being manipulated, Brian,” Molly argued, leaning forward aggressively across the table. “Wall Street doesn’t care about Toptical, about our vision, how it changes lives, what it means to the world. All that matters to them is how much money the launch makes. And there are jackals out there who will sell us short at the first hiccup next week. We need to back out, now.”

“I’ve got confidence in our underwriters,” Brian said. “I’m not pretending I understand all the ins and outs. That’s Gordon’s area, but he tells me the price is about right. This isn’t science, Molly. No one knows the real value of the company.” With that last comment he shot a look at Sam.

Sam could still see what had drawn her to him: his smooth style, his steadiness under pressure, but for the last year, ever since the IPO date had been picked, she had this feeling that he was out of his depth, and knew it.

“Molly,” Gordon said, “you’re going to be very rich even if the underwriters are wrong. The initial shares being offered largely come from this table, and projections are that they’ll be snatched up. It really doesn’t matter to us personally what happens downstream. By ten o’clock Wednesday morning, we’ll be more concerned about the tax bite than the price of the stock.”

“That’s something else we need to consider,” Adam said. “Founders and early backers typically represent about ten percent of the stock first sold to the public. We’re over forty percent, not as bad as Facebook was, but bad enough. It makes it look like we don’t have any faith in Toptical and want to get our money while we still can.”

No one spoke; then Brian said, “We’re always one bad move away from insolvency. I think you all need to remember that.”

“Thank you, Jeff Bezos,” Molly said. “I’m not in this just to make money. Toptical means something. It changes lives.”

“It’s social networking,” Gordon said, spreading his hands before him. “That’s all. And what do you propose we do, Adam?”

Adam shook his head. “I don’t know. Be careful I guess. Maybe do what Sam suggests. It’s a lot safer.”

Brian leaned back. “Look at it this way: We’re top dog right now, and I plan to make sure we stay there.” His eyes turned to Sam’s face, as if acknowledging her role. “But the big boys are right behind us, not to mention the kids in the garage. We have no way of knowing if we can stay in front. We need to make it now. All this—” He gestured toward their building as if they owned it, as if everyone at this table loved it. “—could be gone in months if the public turns somewhere else. Frankly, I wouldn’t want to be in Facebook’s shoes right now.”

“And what’s this about changing lives?” Gordon said sarcastically. “Toptical takes people out of their boring existence. If they had real lives, they wouldn’t be using a computer as their primary way to connect with other people.”

Sam grimaced. “What if it goes wrong?” she asked. Brian looked at her sharply. “What if these wonderful underwriters are stacking the deck so they do okay no matter what? What if the IPO is a disaster?”

“That can’t happen,” Brian said evenly.

“It happened to BATS, and it was their area of expertise. Nobody made any money there. All they got was a black eye they’ll never recover from. It can happen to us. Don’t kid yourself.”

Sam noticed from the corner of her eye that they’d drawn a crowd. She hadn’t realized how loud they’d become. Several employees were gawking openly at them. Seeing her look they hurried off. Life in a fishbowl, she thought savagely.

“Let’s settle down and focus on what we should really be concerned about,” Adam said. “All that pricing stuff is out of our control. It’s all in place now. It’s the technology that really concerns me. I talked to someone with IT at the Exchange. They’re using a new program for us. I don’t like being a test subject.”

“I know about that,” Brian said. “It’s a special program just for IPOs. They don’t want any of the problems BATS had — or Facebook, for that matter.” NASDAQ had courted Facebook to handle their lucrative IPO; then their software delayed selling for half an hour on launch day. It had sent a shiver through the market. There was no telling how much money it ended up costing the company because of lost confidence.

“Adam’s got a point,” Sam said. “We all know the track record of untested code when it goes public the first time.”

“It’ll be fine, they learned from their mistakes,” Gordon said.

“What the hell do you know about it?” Molly snapped. “Stop pretending you know everything. You’re the finance officer!”

They continued for another ten minutes and in the end, settled nothing. As everyone filed out Sam held Molly back. When they were alone, Sam said, “I know you’re concerned. I appreciate the passion, but this thing is set now, Molly. I’ve had to come to terms with it, and so should you. We’re just along for the ride at this point.”

“I know. I know.” Molly was close to tears. “It’ll just break my heart if it goes bad. Toptical means everything to me.”

18

Bandeira’s office was located on the forty-third floor of the Edifício República, and he never failed to take in the expansive view at least once each workday. The towering skyscrapers, the choked streets below, even the ever-present pollution all represented wealth and power. They reminded him of just how far he’d risen. And as often happened at such moments, his thoughts turned to the past.

Though Victor Bandeira’s rise within the NL had been greatly facilitated by his marriage to Esmeralda, Carvalho’s unexpected death from a presumed heart attack just three years later placed him in a precarious position. Bandeira had not by that time been designated as the heir apparent — though that, it turned out, was what saved his life. He’d not been seen as a threat among those who vied for leadership.

Still, there’d been changes. For one, Bandeira had been removed from his safe sinecure and assigned responsibility for a street gang. The new chefe told everyone except Bandeira that the young man was soft, that he’d been coddled by Carvalho. To his surprise, Bandeira found he took pleasure in working the streets, taking part in the action, overseeing the executions or doing them himself. He understood finally the addiction of the streets, the allure of power, the sense of invulnerability that came with guns and violence.

But Bandeira was not a foolish man, and he knew that there was nothing in the streets in the end for him but death or prison. So when the opportunity came, after he’d proved his manhood to the chefe’s satisfaction, he was moved into finance, a safe cubbyhole where he was content to bide his time.

His movement up the ranks thereafter had been slow but steady. He’d been careful to remain on favorable terms with every potential leader and made no enemies. It had not been easy, but he’d managed to walk the tightrope. Only when he was finally in upper management, a mere rung or two away from the prize, had he acted. It had taken two deaths, one staged as an automobile accident, the other as a botched surgical procedure, but two years earlier, he’d emerged as the undisputed leader of Nosso Lugar. He’d moved quickly thereafter to clean out upper management of any potential rival. He’d not mentioned any of this to his son.

Over the years, Bandeira had studied the organization’s cash flow and slowly became convinced that it should move away from activities that made them the target of other cartels. They weren’t big enough to take them on. As chefe, he kept with the tried and true. NL still sold drugs within its territory and trafficked in prostitutes; these were the standards of their business, but he was careful not to expand. He ordered that they stop dealing in guns as he wanted to see fewer weapons on the streets and whenever he spoke with the other chefes, he made the point with them. Their men would always have the weapons they needed but it made no sense to be selling firearms to uncontrollable gangsters. He saw no sign that he was convincing anyone, but he kept at it.

Bandeira also cut back on the protection money NL took from small businesses. It no longer constituted a major source of income, and he knew from his own experience how counterproductive it was. He wanted thriving shops and stands in his area and his agents were able to use the loyalty of the merchants in other ways, as lookouts, to stash illicit items for a few hours or days, or to provide places of refuge when needed. In Bandeira’s view it had all worked out for the better.

While working in finance, even before becoming chefe, he’d become convinced that the future of real money was in computers and the Internet. He’d followed closely the growth of cyber-crime and even before he’d become head man he’d set up operations. As a consequence, NL was a major world player in Internet gambling, running the three largest such operations.

He’d moved aggressively against his competition in the early days. He’d sent men to infiltrate other operations and sabotaged their sites at every opportunity. He’d used denial-of-service attacks against rival gambling Web sites and to that end had a team of bright young men led by Abílio Ramos setting up botnets constantly, botnets that sat idle for long periods until his other teams put them to good use.

A botnet was a collection of computers connected to the Internet, thousands of them, in which the cyberdefenses had been breached, and they’d been placed under the control of an outside party, unknown to whoever owned or operated each computer. The computers were co-opted when someone using them executed a bit of malicious software. They may have been lured into making a download, or been penetrated by a vulnerability in their Web browser, or even tricked into running a Trojan horse program, which likely came through an e-mail attachment, often from a known source. Such infected computers were used to recruit other computers. Once within the computer, the malware placed the computer under the control of the botnet’s operator, known as the “herder.”

Typically the herder directed the botnet group to his own ends. Among these were denial-of-service attacks, and just the threat of one allowed the herder to blackmail the potential target. Introducing spyware was not uncommon and allowed the herder to collect the user’s passwords, credit card numbers, and banking information all of which would be used to loot his financial accounts. The planted malware might be something so simple as placing ads on the computer without the owner’s consent or employing the computer to distribute spam.

The reality was that the herder had at his disposal a vast network of computers he could put to most any use he desired, all without the knowledge of the individual computer owner or operator or both. The NL’s vast network had proved highly effective against others but in analyzing the uses to which they were put, Bandeira had determined that such vast networks remained largely untapped as future sources of illicit income.

Marvelous as computers were, though, he was still forced to deal with error-prone people. There was no getting away from it. He’d seen it time and again. Carefully designed systems stumbled because some idiot wrote sloppy code.

Just then, an aide entered quietly, waiting to be acknowledged. “Yes?” Bandeira asked, turning from the window.

“Your son wishes to speak with you. He says it is urgent.”

Casas de Férias, Vacation Homes, the operation managed by Pedro, had been slow developing and had been fully operational for only the last year. But careful planning and Ramos’s hard work had paid off. It was Bandeira’s special pride, and he had high expectations for its long-term success. He’d invested a bundle to make it happen.

The rewards flowed over the wires, bounced around the world, sometimes even into his own bank. This particular cyberoperation was about to turn into a cash cow, one he saw no reason he couldn’t keep milking for decades. The only negative he could see was that the millions they were making were small time. Billions of dollars were out there for the taking, it was just up to Ramos to figure out how. Someone, somewhere, was going to manage to steal from the NYSE without detection, why not NL?

“Padre,” Pedro said. “I’m sorry to report we have a serious problem. It’s just come up.”

“Tell me.”

Pedro laid out what was taking place in New York. He was worked up and Bandeira cautioned him to slow down twice, but he got it all out in the end. “So we’ve been detected?” Bandeira asked.

“That is what I’m told, though they don’t yet seem to know precisely what we are doing.”

“Tell me again about the killing.”

“This American was instructed to fix the problem he’d caused with sloppy code. His response was to kill the IT manager who stumbled on it.”

“That’s amazing. He did this on his own?”

“Yes. I’m shocked. I never thought things would go this far. This is a cyberoperation.”

Bandeira paused to consider the implications. “Has the body been found?”

“This happened in Chicago. Many killings happen there every week. The manager hasn’t been reported missing as yet.”

Bandeira suppressed his anger. There was no doubt what he’d do with the American if the man lived in Brazil. To kill without authorization unless in self-defense was absolutely forbidden in his organization. Even now, Bandeira considered dispatching César or one of his special operatives to take care of this. “How crucial is this man in New York?” he asked.

“Vital. He has access to functions we would not have otherwise. As part of his responsibility he is one of those who places code directly into the trading engines.”

A weak link Bandeira realized. Could anything have been done about it before now? Shouldn’t he have known this man was capable of such independence? And that he was a killer? Ramos should have known.

“Is this the same man who used a stealth program to hide key code?”

“Yes, the same.”

“He’s reckless and not just with computers. I made it very clear this was to be a cautious, low-key operation. I have planned to run it, or variations of it, for years. That’s why I’ve committed so many resources to it.”

“I understand. But … I didn’t recruit the man. That was Abílio.”

“Can he be controlled?”

“I … I really don’t know. I don’t know if any of us could have anticipated something like this. It is all so unexpected.”

“All right. I understand. What should we do?” This was not the first time Bandeira had asked his son directly for advice. Whenever possible, he followed it or some version of it. He knew he must build up the young man’s confidence and confirm his judgment.

“I’m concerned. I think we’re running out of time. We’ve taken ninety-four million so far, but we were expecting much more. “

“You see no chance this can be kept quiet?”

“I talked with my team here before calling you. As you know the code this man planted is concealed but the fact that it is concealed has been discovered. Abílio doesn’t know for certain, but suspects they are tracing our program.”

“Merda.” Bandeira closed his eyes. Right now, he wanted to have his hands around someone’s throat. He’d talk to César. This fool in New York was a dead man. He didn’t care how long it took. He drew a deep breath, then released it slowly. “What else do I need to know?”

“That is all I can tell you. Maybe we need to shut down and revisit our options.”

Out of the question, Bandeira thought. “I mentioned upping the take on Carnaval next week. You had reservations and so I did not proceed but everything has now changed.” He paused to think, and then, as always happened in the face of adversity, a solution came to him. “Pedro, here’s what I want you to do. You must trust me in this.”

19

This was a rush job, but Marc Campos reminded himself not to be careless because of that. He had enough time to do it right. If he botched this, he’d make the situation worse than it was, and that was the last thing he wanted. Iyers had already made one major coding error, and Campos didn’t want to repeat it.

Recruiting him, Campos realized, had been a mistake. He’d thought Iyers a gifted code writer disenchanted with Wall Street, and he was right. The cynicism in his manner and voice when Iyers agreed to join him had been honest indicators of how he truly felt. But obviously there was much more to him than that. The man was louco.

In English, he was crazy, psycho. All of them fit. Traveling to Chicago and murdering an IT manager was so out of bounds, so extreme, Campos was still stunned that he’d done it. He’d not even wanted to tell Pedro but knew he had to. So far no one had asked him how such a thing could happen, but he knew he had to have an answer.

Iyers might be nuts — now, there was another word — but when he put his mind to it, he knew how to write code. The remarkable success of Vacation Homes was testament to Iyers’s aptitude. He was skilled in the use of the paths through to the deployment server so that their malware blended in, gluing the Brazilian code into the trading engine.

Once Iyers had agreed to work for him, Campos sent to Rio the trading engine source code and software architecture design documents he’d provided. From Rio, Campos received code drops and after reviewing them transferred them to Iyers for insertion.

Campos wondered if something was going on with the man that he should know about, but then dismissed the thought from his mind. Of necessity this project would all be over soon and the damage was done.

Now he’d been instructed to immediately launch Carnaval, in consideration for months. He would set Iyers loose on it; he had to. There was a great deal to do and not much time. Now, more than before, he needed Carnaval to be a great success. His instructions were to make it a hit and for that he required Iyers.

What really angered Campos was the need to bring Vacation Homes, his pet project, to an abrupt close. Yes, the potential payoff from Carnaval was substantial, but he had devoted nearly five years to Vacation Homes, and while it was true that even in the relative short year it was operational, he’d become a rich man, the project had barely scraped its potential. He was convinced they could skim a billion dollars without being detected, and in fact had honestly believed they could take ten times that given enough time, and without Carnaval.

Now this American fool had brought it all to an end. Campos had no doubt what would happen to Iyers once his access and skill were no longer needed. The man had figured out that Campos had a boss. What he didn’t imagine was how ruthless the chefe was prepared to be. His boss had put great stock in Vacation Homes, and in Carnaval, and would not be happy that a preventable coding error had ended it all before its time. Iyers had been cautioned about how code was to be revised. He’d understood but instead took a shortcut.

And that hadn’t been Iyers’s only misstep. When they’d first set up accounts to funnel the money out he’d carelessly stolen an identity that too closely resembled his own. He argued that it had been necessary as it was increasingly difficult to set up financial accounts with false identities. Campos had put a stop to his involvement in managing target accounts and now had it all done out of Rio.

As if all that weren’t enough, Campos didn’t like his hand being forced this way. When Pedro had first suggested Carnaval, it was Campos who’d opposed it. It was too risky he’d argued. It was crafted to exploit an IPO, and they could be very unpredictable. Such a launch might prove too chaotic. Now, on receiving instructions to initiate it immediately, he was convinced more than ever that Carnaval was a step too far. Putting it into place in a rush, aiming for so much, would doom it to failure, he believed. If it unraveled in the worst possible way, he might be caught before he left the country.

Looking up, Campos could see through one of the open office doors around the perimeter to the windows. The nearby taller buildings gleamed in the sunlight, catching rays like a mirror. He’d enjoyed these years in New York City. He regretted he’d not had time to see more of America. Well, he could always come back if he really wanted. But it would be good to be home again.

His mind turned to what he needed to do in the next week. He didn’t want to risk staying here much longer. Once Vacation Homes was shut down and especially after Carnaval was finished there’d be hell. Investigators would be swarming everywhere. They could look all they wanted. Marco Campos would vanish. The money would be gone as well.

From his work computer, Campos accessed the Internet using a server and student identity from New York State University, one of a group from the thousands of log-ins that the NL botnets had harvested to which he’d been given access for just these occasions. Students were always hacking each other’s identities as pranks or to get back at people for perceived social networking slights. He’d found in the past that a major university was an effective mask for what he was about to do.

He spent a few minutes in research, found two sites that looked right, and was satisfied when he visited the second, which he knew was the most popular. Data Retriever Solutions, or DRS, could have been anywhere from what Campos observed on their Web page. Likely it was physically located somewhere in the United States but its site was set up offshore, and when Campos checked, he saw it was registered to a corporation in Panama — about what he expected.

He’d already established a PayPal account and placed money into it from a throwaway prepaid credit card. Now he entered onto DRS as much information as he had on Jeff Aiken, including his business and residence address. Within seconds, he had his social security number, names of his parents and grandparents, schools he’d attended, his date of birth, which gave him his zodiac sign, even the name of two pets he’d had as a child.

Interesting, Campos thought, wondering where DRS had come by that information. Once he’d written it down, he returned to the first site and did it all again, this time using more of the information he’d just obtained. Nothing new there. Now he went back to DRS and repeated the process for Red Zoya.

A few minutes later, satisfied, he logged out. He walked down the hallway to the elevators, punched the button for the ground floor, then fingered the disposable cell phone he’d picked up for cash earlier that day. Sometimes, he thought, stepping into the elevator as he smiled at a coworker, technology just made all this too easy.

In the warming sunlight of the fall day Campos sat on a cement bench as he placed the call. Once he had a human voice at the other end, he fumbled the sheets of paper out.

“Yes, I’d like to set up a brokerage account.”

20

Jeff had now turned his full attention to reverse engineering the hidden file. He and Frank had discussed this the night before, and though they accomplished what they’d been hired to do and could write their report, neither was satisfied with not knowing what this file did. Successfully reverse engineering it would tell them that. The downside was that not every reverse engineering effort went smoothly or quickly. So while Frank worked on the report and summary of findings, which included their recommendations for enhancing the cybersecurity for NYSE Euronext, Jeff worked on the mysterious software.

Reverse engineering meant taking a bit of software apart starting with the finished product and working backwards. This entailed going from implementation to the development cycle of the code, that is, to the time when it was first written. It was much like disassembling a toaster to see what made it work, except that in the software world, it was a process of examination only and did not involve modifying any of the code. The process wasn’t always successful, though with Jeff, it usually was.

Because the file was concealed by a rootkit, he suspected whoever created it didn’t want it to be reverse engineered, so he expected obstacles. It might take more time than he could reasonably justify to Stenton, which was one reason he’d hesitated, but he just couldn’t resist at least making the effort.

Jeff used a debugger to watch the file execute step by step. Whoever had written the code had, as he suspected, employed anti-debugging mechanisms, common in malware, which were intended to slow down and potentially discourage anyone from reverse engineering the file. Jeff was familiar with nearly all the known ones used, so though it slowed his work, it did not stop him. A software environment was simply too easily manipulated for code obfuscation to serve as a lasting barrier.

After several hours, Frank asked, “How’s it going?”

“I don’t know yet. I’m pretty sure it’s malware and has got something to do with trading. If so, it’s extremely sophisticated. But I still can’t clearly see what it’s meant to do, so I’m not positive.”

“You’ll figure it out, you always do.”

“Not always. I did find a string of numbers inside, but they aren’t related to anything, and they don’t fit any obvious pattern, at least not to me.”

“You sure they aren’t money figures?”

“I’m not sure of anything, but my guess is they’re identifying something.”

“Enjoy.”

“You know, the Exchange is lucky they hired us for this pentest. We’ve uncovered more than they feared was going on. We’re giving them more value for this test than they could ever have imagined.”

“I’m sure Stenton will be grateful when it comes time to pay up,” Frank said with a sly smile.

21

Marc Campos was back in his cubicle and had accessed his computer but that was for show. He had no intention of taking the next step from his own workstation. That’s why this part had to be done now, as the place was winding down. A number of workers were taking a break before returning to finish projects due the next day. During the lunch hour and at times such as this, when workers often left their station, planning to return shortly, they didn’t always lock their screen. Idle computers required users to log back in after fifteen minutes. He didn’t have much time.

Still, this was risky, and he hated its necessity. So far he’d never taken such a significant risk. No, he thought bitterly, Iyers had done that for him.

Standing in his cubicle, Campos scanned the floor. Almost everyone was away from their desk. He rose, then slowly strolled down the hallway until he found an empty cubicle with no one occupying either side. He checked but the screen was locked.

He resumed his stroll and soon popped into another empty cubicle. The computer was unlocked. He sat down.

“Can I help you?”

Campos looked up. “Oh, hi, Rose.”

Rose Aquilar was a bit short and growing stout, originally from the Philippines, she already worked at the Exchange when Campos came on board. “Are you lost?”

Campos stood up. “I’m sorry. I was on my way out and realized I’d forgotten to check on something. I saw you were still logged in. I hope you don’t mind.”

Rose stared at Campos, as if considering her response. “I guess not but I don’t like sharing my computer. Your station’s not that far away.”

Campos stepped into the hallway. “I’m really sorry. My mind was somewhere else. I apologize. It won’t happen again.”

“All right, then.” Rose sat, logged off, stood pointedly, then said, “I’ll see you tomorrow.”

Campos went into the men’s room to give her time to leave the office. He stepped into one of the stalls, his hands shaking violently. That was close. What if she said something? Then he thought a second. Of course she’d say something. She was the office gossip. He should never have risked her station.

After five minutes, he went back out. Rose was nowhere in sight. He walked about the large space, ignoring the stations, confirming that Rose was really gone. He couldn’t risk her catching him at someone else’s computer but this couldn’t wait. Once he’d satisfied himself, he selected a station in the far corner. The user was still logged in but the timer was about to expire.

Campos rapidly downloaded a file from an internal site containing a collection of UTP diagnostic tools, this one with a backdoor he’d embedded that enabled it to execute commands from his own system — in essence, it was a disguised bot. Now he had access to this and other accounts on the network with no trace to his own location or computer. Campos programmed the backdoor so he could monitor the user’s connection to the jump server.

That done, Campos left the cubicle and waited for others to leave. He found four computers logged off for the day but located two other connected computers and did the same thing. The sooner someone accessed the secure zone through the jump server, the sooner he’d be finished.

He went back outside, bought a kosher hot dog from a cart, then ate standing up, savoring the moment. When he was finished, he returned to his cubicle and his own computer. One of the users he hacked was in the process of accessing the jump server as Campos had anticipated. Break time was over, time to get back to work. He piggybacked into the secure zone, leaving no trace of himself.

Now Campos meticulously searched for signs of Red Zoya and the specialized tools Jeff and Frank used in their work. He smiled slightly as he did. Satisfied at what he saw he planted in a version of Iyers’s trade manipulation malware very similar to the one used for Vacation Homes. Once that was in place, he dropped in the program he’d configured to blatantly manipulate trades, making no attempt at concealment. He set it up so the money skimmed from trades was moved into the brokerage account that he’d established earlier for Jeff. As an automated security measure the malware was programmed to delete part of itself and in so doing it extracted one of Jeff’s free cybersecurity tools, exposing it to view. This behavior Campos knew would trigger the antivirus program when it performed its next routine scan.

From this moment on, Vacation Homes would look as if it was Jeff Aiken’s pride and joy. Gotta love computers, Campos thought as he backed out of the secure zone. Now it was up to the Exchange’s IT sleuths and the software they had implanted, which hunted for just this sort of thing.

With this done Campos went in search of Iyers to discuss Carnaval. Everything had to move like clockwork from this point on.