The night after the big DDoS attacks began, the Packet Storm guys came by my place. By then there were three of them, not counting Lineman’s girlfriend. Packet Storm was definitely more than any one or two people could handle, so two more guys — Shawn and Johnny, friends of Lineman’s — drove out together from Chicago to take up some slack on the site. Johnny was a rail-thin dude with short dark hair and a slim baby face, while Todd was less tall, also with short dark hair bordering, and he’d probably have a baby face if he hadn’t been rocking a goatee. His eyes seemed the sharpest of the bunch somehow.

Jim wasn’t around at my place on that evening when they came by, though he’d already met the whole gang. He’d happened to have been in town on the day when the new guys were arriving, so I’d taken him around to meet everybody. Shawn and Johnny had already unloaded a good number of crates full of vinyl, so Jim and I watched as they moved smoothly between spinning disks through a beat-up old mixer and firing off commands to some process on a remote machine through an old green-screen terminal.

“Someone found us,” said Lineman, and Shawn turned the music down a notch, chuckling not at all quietly.

“Whatcha got?” Shawn asked, breaking open a new pack of cigarettes. They didn’t really drink or do drugs — they were only about twenty-one years old, all of them, but most of the group had lived fairly rough lives back in Chicago. They’d survived, of course, but they were mostly done with drugs and drinking. The bunch of them had just been giving jobs that paid what was at the time unreasonable sums of money, for doing nothing more than having people email them the latest hacker tools, vulnerabilities, and exploits, so that’s what they were all about.

Lineman was staring into a black-backed terminal, green winking cursor in the upper left. His fingers hovered half an inch over the keys.

“Hmm,” he said, as everybody crowded around. Then in a flurry, he hammered out a bunch of text that looked to me exactly like a login prompt. Something like:

CONNECTING…
adexa system 7.21
login:

“That’s just cruel,” Shawn muttered through an unlit cigarette, patting himself down for a lighter.

“What’s up?” I asked.

Lineman opened his mouth.

“It’s like netcat, but the other way around,” Johnny rushed in to say. “It’s a port listener. If someone tries connecting to you, it just accepts it, then anything you type gets echoed out across the wire.”

“That way,” Shawn added, pausing to exhale a gray cloud, “you can see how people might be trying to mess with you without having to expose a real service to them.” He shrugged. “It’s ghetto, but when you find a real person instead of a bot, it can be fun.”

Lineman’s girlfriend squealed. “He’s typing something!” she said.

“I see,” said Lineman.

The stranger typed

root

…then hit return. Lineman typed:

Password:

“Oh, this is gonna be beautiful,” Shawn said. “Look at him pause after the first two letters of his password showed up!”

“Why?” asked the girl.

“Because,” Lineman calmly said, “when you type your password for real, you—“

“—don’t actually see it,” she said. “I know.”

“Then why were you asking?” Johnny muttered. Shawn nodded idly and turned up the music. Jim and I took off after that, leaving Lineman staring into his terminal window, occasionally typing things back at whatever mouse he’d caught in his little trap.

A few weeks later, Yahoo and Amazon get knocked off the net by the first major DDoS attacks. A few evenings later there’s a knock on my door and the Packet Storm guys walked into my place.

“How’d it go?” I asked.

“It was awesome,” chuckled Todd.

Lineman nodded. “It was good.” They’d been interviewed for the local TV news about the attacks.

“Good publicity for Kroll,” Johnny added.

“Hey, hey,” said Shawn  “I saw a Seven-Eleven coming over here. You mind if we walk over and get some stuff?”

I didn’t mind. Two blocks away, I watched three young dudes load up on canned drinks of several shapes and sizes, a few packs of menthol cigarettes, a bag of chips, and a couple of bottles of juice, nearly half of which was gone or open before we’d walked through the darkness back to my place, a non-stop stream of chattering hacker consciousness filling the night as we went.

“And the greatest thing,” Shawn said, lighting another cigarette, “was the call we got after the show.”

“Unbelievable,” Johnny said.

“We’d met and talked to this guy earlier in the day about renting his place,” Shawn went on. “It’s a huge-ass mansion, perched on a cliff looking over the 280 freeway about halfway up to the city. Five bedrooms. We weren’t sure we were gonna get it, but he saw Lineman on TV being interviewed and called immediately to tell us we could have it. Incredible.”

It was. If it were possible for mad-genius hackers to have an ideal secret lair, that was the place. They’d spend less than a year there, though, before everything fell apart, but we’ll get there.

Shawn and Johnny opened another pair of these small, thin little cans of what looked like some kind of soda, slamming them back pretty quickly. I couldn’t read the label from there, but I’d never seen it before. “Can we?” Todd asked, holding a plastic bag full of the rest of the drinks and pointing toward my kitchen.

“Sure,” I said, having no idea what he was talking about. “Lineman,” I said, turning to him. “I got a question for you.”

“All right,” he said, focused clearly on me.

“So, I’m working on this scanner.”

“Radar.”

“Right.”

“It doesn’t sound like a good idea.”

“It’s what we’re working on.”

He shook his head. “You should work on something else.”

“This is what I have to work on. My problem is that I’ve been out of the game for a while. I’ve been reading a lot — I’m catching up on Packet Storm, there’s a lot of cool stuff there, of course — but I’m having a hard time with the big picture.”

“Uh, huh. And what picture is that?”

“I’m supposed to collect up all the vulnerabilities we need to scan for, and write them up, and understand how they get exploited and how to fix them. But for starters, I don’t even know how much there is. If you had to focus on the most important vulnerabilities, the most common and the most serious, how many would there be? How many things am I actually talking about?”

He thought about it.

“Less than three hundred,” Lineman said. “Right now? Two-hundred and sixty-three.” Todd and Johnny glanced at each other. “Maybe more like two-hundred and seventy. Seventy-seven. Something like that. It depends on what you think is serious. And every day there’s more.”

“But something like three hundred.”

“Around there.”

That, I thought, was do-able. In three months, I’d covered more than four-hundred cards for a single game. In three months, I’d written — re-written — a 256-page book and colored a third of its art.

In three months, I could do the vulnerability research we needed to fuel the scanner. I could do this — it wasn’t a lost cause. I wasn’t a lost cause.

The next morning, I’d open my fridge to find that Johnny and Shawn had left a couple of their little canned drinks behind. I picked one up and read the label: Red Bull, whatever that was.

I sipped it on the short drive into work. At first I thought it was disgusting, medicinal — but there was a sick sweetness in place of the terrible after-taste I was expecting. I got fairly wrapped up in trying to figure it out by the time I got into work. By the time I was sprinting up the stairs to my second-floor office, I figured I might just like it.

It’s no mystery how most soda and juice drinks are concoctions of artificial flavors, carefully tuned and balanced to taste like something that nature might produce — like orange, or grape, or banana, or pomegranate, even when very often they don’t really taste very much like any of those things, more the idea of them. But these advertised tastes give us a context in which we can slip these artificial flavors, making them more accessible than they might be otherwise.

Red Bull said, “Screw it, I’m not even going to try to fake it.” It tasted like nothing nature might produce. It tasted like a blue laser — or maybe it tasted like what you might get if you could touch your tongue to the Internet. It was a new thing. It felt like a sign of things to come.

So at the start of the second month of our new century, I was thinking about the future when I picked up a bit of an echo from the past. I walked straight back into the Packet Storm lab room, where the four of them had come to hole up. Lineman was there, staring serenely into a screen, typing madly. Todd was rocking back and forth in his chair, tapping an unlit cigarette against his knee. The music was cranked to full disco-ball. No one else was around.

“Hey,” I said. “How’s it going?”

“Not good,” said Shawn. “Not good.”

“What’s up?”

“Feds,” he said, looking over my shoulder with a gut-punched wince. “FBI’s gonna be here in like an hour. They called Phil, and he talked to us. We agreed to talk to them if they came by here.” He chuckled. “It’s not gonna go very well.”

“What makes you think that?”

Shawn frowned. “I used to get harassed by the cops back in Chicago. Now me, I’m a white kid, right? So I got it better than most. But I know the deal. Best case, it’s not good.” He checked Lineman’s progress over the other guy’s shoulder. “E-trade got hit today at 5 AM for like ninety minutes, when everyone’s usually trading stock and whatnot. So now it’s no longer joke time. Someone’s going down.”

I nodded. “I see,” I said, raising the empty can. “I was just gonna say thanks for introducing me to Red Bull.”

He tucked the cigarette behind his ear and saluted me. “You’re welcome,” he said.

That afternoon the FBI, when asked how many agents they’ve directed to stop the attacks, said, “As many as it takes.” It was no longer joke time, as we found out almost immediately.

We’d been hiring more and more people, mostly to keep up with the demand for our services while replacing those we’d lost to the interesting start-ups which continued to spring up all across Silicon Valley. Maybe six weeks before the DDoS attacks began, two people had suddenly appeared in an empty row of desks behind Rain Girl, a young man and a young woman with the clear faces and wide smiles of people who weren’t exactly bad but who it was easy to imagine could be up to no good.

“You know who the new kids are?” I asked Phil.

“Ah, well,” he said, “Brad’s traveling more and more — consulting for clients and doing more than his share of partying, you see, so he can’t be troubled with the daily care and feeding of Packet Storm. You got new exploits and vulnerability hints coming in every day, so someone’s gotta go through it all, figure out what’s what, and get it up on the site.”

“Is that good for you? Him not being around.”

Phil shrugged, slumping a bit in his chair. “I’m not bothered about him any more. He’s going to slip up on his own, I don’t have to be the one to give him a shove.”

“So they’re running Packet Storm now?”

“He is, the one kid, a young hacker Brad found in Chicago. A bit touched, that one.”

“What do you mean? You mean like ‘Rain Girl’ touched?”

Phil slumped more deeply into his chair and looked at me through steepled fingers.

“Why don’t you tell me,” he said.

“And the girl?”

“Dunno. She’s his girlfriend. Don’t think she does anything but keep him happy. He refused to come out unless we gave her a job as well, you see.” He scratched his neck.

“So we’re paying her a Silicon Valley salary to be his girlfriend. I think there’s a word for that.”

“Don’t go there, pally. She answers email, I guess — spends a lot of time typing, at least.” Phil sighed. “Talk to them. Make friends if you can. See what he’s got them doing. If it’s up-and-up, fine.”

“If not?”

He pushed his chair back from his desk, stretching. The conversation was ending.

“You tell me,” he said.

The happy couple spent most of their time hiding behind headphones and screens of laptops, madly clickity-clacking from when I arrived in the morning until I left every evening. The site was getting updated, it was starting to get attention.

I had my own problems, of course. I had caught up enough on the technical side that I understood exactly how far behind I was. It wasn’t simply a problem of knowledge and understanding, it was a problem of habit. Those last few years in Austin, I’d let myself develop some terrible habits, mostly around not doing much work at all. The only way to get productive was to begin producing, and the only way to produce was to develop the habit of sitting your ass down every day and doing it.

One Sunday, with nothing else to do — Jim was off on one of his multi-week trips around the world, and the Bay Area’s rainy season had well and truly settled in; the days were short and my mood was dark — I went into the office to see if maybe I could get something done that I could feel good about, in hopes of starting the week with fresh momentum. To my slight surprise, I hadn’t been there an hour when I heard the office front door click open. I clocked the tops of the heads of the Packet Storm couple walking up the corridor that’d bring them past my office.

Slowly, the guy said, “Hey.”

“Hey,” I said. Beside him, the girl smiled with tightly pursed lips. He stared at me for moment, mouth opening and pulling air in as if he had something to say, then he turned on his heel and strode briskly on to the back corner of the office. The girl waved at me, then quickly followed.

I turned back to my screen, completely unable to remember what I’d been doing. I stared at my screen for nearly a minute before thinking I could probably use something to drink. Off to the kitchen, near the back corner of our office.

When I passed the open door that had been serving as a kind of lab, stacked high with racks of computing equipment and unlabeled cardboard boxes, the guy was standing on a chair, trying to attach something to the ceiling. The girl, sitting primly in a rolling office chair, looked over at me through the wide eyes of someone who wasn’t sure how the current scene would play out. Clearly, in her mind, it could go any number of ways.

I found that interesting.

“Hey,” I said, leaning against the frame of the door to the lab.

“Hello,” the guy said distantly, finishing what he was fiddling with, which was mounting a small disco ball to the ceiling. Then he hopped down off the chair and stood before me, arms pressed to his side.

“Hello,” he said again, as if for real this time.

“Hi,” I said, extending my hand. “My name’s Derek.”

“Mmm, hmm,” he said, shaking my hand and then going back to staring at me. The girl put on her headphones and swiveled around to face her screen — one of the top ten non-verbal cues that someone no longer wants to talk to you, in case you didn’t know.

“You guys are working on Packet Storm?” I asked.

He nodded, seeming to breathe more quickly. He was tall and thinner than most, wispy blonde hair like a cloud that followed him around. He looked toward me, but through me.

“I’m working on Radar,” I said. That was what we were calling our scanner.

“I know,” he said.

“I don’t think our bosses get along,” I said.

He barked a laugh, looking down and away from me. “I think you could say that.”

“Hmm,” I said. “That bad?”

He shrugged, still looking away. “He doesn’t know anything,” the guy said. “He says he does, but he doesn’t, not really.”

“What got you into computers?” I asked.

He took another good breath. “Oh,” he said slowly, “I like to play with things.” He shrugged again. “You know. Explore things.”

I nodded. Okay, I thought, let’s roll the dice. I opened my mouth and I said something I hadn’t told anyone in a long time.

I hit the snooze button on my internal alarm, figuring I needed to give him a chance, but it was too late. That week was like an extended nightmare. Matt was cool and funny when we were alone. When other people were around, though, he would either ignore me or make me the butt of some joke or other. I’d look surprised, and he’d say he was only kidding.

Leaving work on the second day, I asked him what was wrong. He said nothing was wrong, that I was taking things the wrong way.

On the third day, on the way back to my apartment, I asked him what his problem was.

“There’s no problem,” he said. “Here’s the problem, though: You need to stop doing what you’re doing.”

“I’m not doing anything.”

“Stop doing what you’re trying to do. You’re trying to make a product when you don’t know anything about what your customers need. You gotta talk to people, to end-users and experts, you find out what they want and how they want it, then you design.”

“I don’t know if you remember, but I am an expert.”

“You are not.”

“Look, I know you were always hot about pirating software and all back in the day, but I was always more serious in hacking circles than you were.”

“You were not.”

“No, I was. I—”

“You might think you know a lot, but you’re not the customer. You’re not going to pay money for the service. You shouldn’t do shit until you find those people and find out what they need.”

And the worst part of it was, all other things being equal, he was right. But other things were far from equal.

“Sure,” I said. “But it’s super clear what we’re making here, and it should be super dumb to use or it’s not going to be successful. Besides, we have this meeting Phil’s been planning for next Wednesday. We need to show some basic version of what we intend to do if we’re going to win the chance to make something.”

Softly, he said, “That is the bullshit you tell yourself that keeps you from being successful. You already have the chance. Just follow my lead. Everything is going to be all right.”

“It doesn’t feel like you’re helping me. It feels like—”

“You brought me out here because I know how this shit works, and you don’t. I’m going to make it work, and you’re going to be happy. You have to trust me on this. It’s going to be okay.”

But by the end of the week, the other people on my team began turning to him when talk came up about the Web site, not to me. When I brought up the work I’d done before, he’d wave it away, laughing.

As we wrapped up work on Friday, Mary swung by to wish Matt a good weekend. She didn’t say anything to me. I saw Phil leaving, and he wouldn’t meet my gaze.

I put on some music and watched Matt eat the pizza I’d ordered for us while he crowed about how we were on top of the world, and wow, if only the people we used to know back in the day could see us.

For the weekend he wanted to meet up with some friends in the city, and he urged me to go with him, which is to say he wanted me to drive him. After watching him chat and laugh with his friends for about an hour, my mind began to drift, playing back our conversations. I couldn’t shake the suspicion that he was lying to me, but I’d known him half my life; I was finely attuned to when he was lying.

Then I had a calming realization. He hadn’t been lying to me: things really were going to be okay — for him. The crucial difference was that he didn’t care about me, beyond how I could help him.

My oldest friend had become a sociopath.

I stood up. “I’m gotta go,” I said. “You can stay, though.”

“Stay here?” he said, glancing at his friends. “How do I get back, motherfucker?”

“Take the train. The train’s awesome.”

“Oh, the train,” he said, nodding quickly. “That’s right! Well, yeah. Why wouldn’t I take the train? It’s awesome.”

I agreed. He stayed the night in the city, calling me the next morning.

“Hey, come get me,” he said.

“Take the train,” I said.

“Yeah, but who’s going to pick me up at the train, asshole?”

“You can walk to my place from the station. It’s a couple blocks.”

“It’s a quarter of a goddam mile, first, plus I picked up some sweet luggage from this antique place we went to, total old-school, huge-ass wonderful shit.”

“So take a taxi.”

“I don’t have any cash, you know that. Fucking come pick me up.”

I agreed to pick him up. I got there early. A few minutes before he was supposed to arrive, he called.

“Where are you?” he asked.

“At the station.”

“Well, you’re not at the same station as me. I had to get off the train early because the one I got on wasn’t stopping at your station. So get here. Jeez.”

He hadn’t been kidding, the luggage was not small. I had to put the top down for the taller piece to fit, and he had to hold the other one between his legs. He cursed at me the whole way home, and all evening.

“You have no fucking idea what you are fucking doing,” he said. “You just have to follow my lead and do exactly what I say. That’s all you have to fucking do.”

I stayed calm.

“You’re like that girl in Colorado. She is the most frustrating person in the world to talk to. She’s all like, ‘You always say things that hurt my feelings,’ and I’m like, ‘You don’t understand. I am just saying things. This is how I say things. It’s up to you how you choose to take it.'”

“But that’s like punching someone and saying, ‘Oh, that’s how I hug people, by punching them, so when I punch you, just think, ‘Mmm, he just hugged me, that’s awesome, I love hugs.'”

“Exactly,” he said. “You control how you choose to take things.”

“You mock up your own reactive mind,” I said, which was what the sign had said that was carried by poor Keith, the Scientologist protester, on my first day of work in Silicon Valley.

Matt thought about it. “Yes,” he said. “Yes. I should say that to her next time she pulls that bullshit on me.” He grinned. “That’s genius, actually.”

If I hadn’t already made up my mind, that would’ve pushed me over the edge.

In Neal Stephenson’s model of Silicon Valley as Lord of the Rings, if the corporate folk were Humans — doing the social thing, waging war against other corporate folk — and the engineers were Dwarves — working diligently when not bickering, sniffing out veins of gold in the hard rock through which we dug — then the third group of us, the consultants, were Elves.

They were Elves for several reasons. They were the one making the actual money, of course, so everyone seemed to defer to their opinion. But they were the ones who brought something like real magic to the table. The security consultants seemed to have gone places and done things beyond the ken of the average person. It would turn out that nearly everyone in the office had some terrible story in their past, some strange thing which had led them where we all were then, practicing information security for outrageously well-funded customers all over the world. But the consultants were on a different level. Unlike the other people around the office, I ended up being close to only a few of them, over the years. Most of them didn’t end up staying very long, especially after what would happened to us shortly. Still, the air of mystery behind their smiles made me wish I’d known a few of them better.

One guy had been twice been named employee of the month at the NSA. One guy could look at a sheaf of print-outs listing patterns of encrypted data and tell you how your encryption was weak. I’m not kidding. This other guy looked like an impoverished wood-paneling salesman nearing retirement, but one day in the kitchen when someone absentmindedly set his coffee halfway off the edge of the counter, he caught the falling cup without looking directly at it — with total grace, as though he’d been expecting it — and placed it securely on the countertop without drawing any attention. The cup’s owner didn’t even register that anything had happened. Quickly scanning the room, he caught me staring. My mouth was probably open. He grinned like a little boy who’d been caught playing a trick on a friend.

One day I came into the kitchen to find three guys sitting solemnly, nodding to one another. They were all Lear jet pilots, it turned out, and news had hit that morning about a disturbing situation. A Lear jet had deviated from its established flight path, following a straight trajectory in radio silence over an uninhabited area rather than angling off toward its metropolitan destination.

“Safest jets in the sky,” one of the men said quietly.

“Long as you don’t run out of air,” said another.

“You know they didn’t run out of air,” said the first.

“Of course,” the third agreed, smiling distantly. “And that’ll turn out to have been the vulnerability: you’ve got sensors checking for high levels of bad air, but not for low levels of good air.”

“It just went down,” I interrupted. “I heard it on the way into work.”

The first consultant nodded. “Over a forest,” he said. “I heard, too. They flew alongside it and saw the windows were all fogged up. If it’d been headed toward an uninhabited area, they’d have shot it out of the sky.”

“Slow cabin leak,” the second one said. “Takes away the oxygen, hypoxia robs you of your ability to think, everybody drops off to sleep.”

“I really hope everyone just fell asleep,” said the third, tugging a corner of his mustache.

“On auto-pilot,” said the first, “that bird’ll fly true ’till it runs out of fuel.”

Quietly, the third man said, “Could’ve happened to anyone.”

They nodded as one.

I enjoyed my little windows into the lives of the consultants, because they got to do the most interesting things. Rather, they had to do the terribly tedious bits that you wouldn’t have to pump up too much to turn into a gripping scene in an action film. It was still pretty tedious work, and maybe even because of the tedium, sometimes the consultants asked for help from engineering. So it was worth getting to know them, to let them know what you knew in case it ever occurred to them that they might be able to use someone like you.

Most of the consultants, and nearly everyone in engineering, were ten or more years older than I was. It was an interesting change from my previous office experiences, where people older than me had been the exception. The older people had a patience I admired. They also taught me to be tight-lipped about any sort of details that might expose what anyone was actually doing there, beyond general labels like “consulting” and “research”. The culture of the quiet secret was something I embraced with a tremendous sense of relief. Being free from the burden of worrying about what I should and shouldn’t tell people was a real gift, and it’s a sense I’ve kept with me, even today, at least about some of my own stories.

Other people’s stories, I can probably tell — at least a few of them.

Some board members of a Silicon Valley came to us with a peculiar problem. They had soft evidence which had led them to believe that their CIO and his director of Information Tech had become corrupt, and were taking terrible advantage of their power and authority. It wasn’t made clear to me how, only that they believed hard evidence was available on some old backup tapes. They’d tried a few different ways to get the tapes out of them without pushing too hard, but nothing worked. They came to us for another solution. They could offer the key to the tiny IT room where the backup tapes were kept, and one of them could arrange to a back door to be left unlocked for one night. That was all they could offer.

Impoverished wood-paneling salesman guy took the gig, and enlisted the help of one of the guys I worked with on the scanner project, Chris, who’d worked with that kind of backup mechanism before.

After entering the office through the back door — they parked a few blocks away and walked over, so that they wouldn’t attract attention by leaving a car parked behind the building all night, which was how long it’d take to copy the tapes — they walked quickly to the IT office and let themselves in. Once they’d locked the door behind them, impoverished-looking guy pulled out a handheld video recorder and made three sweeps of the room: one at eye height, one at waist height and one at knee height. The office of your average tech support guy might look trashed out, but those people are super sensitive to any minor changes in their environment. After spending all night copying the tapes, they played back the tape and made sure to tuck every pencil, every cable, every crumpled-up piece of trash exactly as it had been when they got there. Then they locked the back door behind them and turned the tapes over to our guys back in the office. That’s all I know.

One afternoon, late in October, three of the consultants were sitting around a table. Oh good lord, I thought, not another jet disaster. But no, these guys weren’t pilots. They were straight-up network security guys.

“My wife would never let me go,” one guy said.

“I have kids,” said another.

The third guy put his head in his hands. “Unbelievable,” he said.

I asked Mary what was up.

She shrugged. “Client has a problem,” she said.

“Yeah?”

“Something like a quarter-million dollars is going missing from their cash-machine network every month. They want it to stop.”

“What? Who?”

“South of here.”

“A South American ATM network is losing a quarter of a million dollars a month—”

“I didn’t say South America.”

“A Mexican—”

“I didn’t say Mexico.”

I thought. “L.A.?”

“South of the border. Look, forget about it. You’re not going.”

“I—what? You need someone to go to South Am—” I saw the look on her face. “—south of the border and catch the bank robbers?”

“No,” she said. “The customer doesn’t care who’s doing it. They only want it to stop.”

“So it’s South America.”

She waved the thought aside. “They’ve offered to have armed bodyguards pick the consultant up at the airport and escort him from the hotel to the bank every day. It sounds reasonably safe. I don’t see what the problem is.”

The problem, I realized right then, was that it was a very real situation. I’d been jumping out of bed every morning so I could dance my way ten minutes to a cushy geek job, and here were some guys who might get killed simply for recommending that a server get a security update. I don’t care who it is, if you take away a quarter of a million dollars a month from someone, they’re going to notice, and they’re going to want to know who you are.

“Huh,” I said to Mary, and I left it there. I shouldn’t have said anything in the office, and I sure as hell wasn’t going to blog about it at the time. Here it is fifteen years later, and I still had to think about whether I should tell this story. So that was when I began respecting the office culture. You simply don’t say anything you don’t have to say.

Quieting my chatty inner voice was easier than I thought. As a result, I spoke less, as well — at work, at least. In the meantime, a good number of other things had been going on, not entirely work related.

“How long does it take to download a file?” Jim asked.

“It depends on your bandwith,” I said. “Faster pipe, faster download.”

Jim and Doug shared a smile. For years, going as far back as our time together at Illuminati Online back in Austin, they had been consipring over great ways to use technology. At various times, Doug had come to me asking for help putting together logos for a bank based on a digital currency and a point-to-point encrypted phone system that he and Jim had dreamed up. With cable modems and other higher-speed Internet connections spreading out across not just America but the rest of the world, and the dot-com madness nearing what we’d later know to be its peak, it was the right time for well-heeled geeks to make an inventive move.

Like Doug, Jim McCoy had moved to California from Austin for a virtual-reality start-up called Electric Communities. After more rounds of funding than anyone thought possible — good money repeatedly being thrown after bad — E.C. had finally collapsed, the fantasy of cyberspace vanishing in the face of reality. People did not want to walk through 3-D virtual storefronts, they wanted to search Web pages like the Sears catalogs that had ruled most of the Twentieth Century. Happily, E.C. closed down well before the financial market went bust, in time for most of its decent people to leap into various other ventures.

Doug had co-founded a company called C2Net. At the time, the U.S. government wouldn’t let American companies export products offering strong encryption, which we now take for granted as what makes Internet commerce possible. You can imagine how the U.S. government might want to limit foreign countries from encrypting their network traffic. To get around the export problem, Doug hired a bunch of coders in the U.K. and, using a leaked version of the protected crypto algorythm, became the first American company to offer a Web server with strong crypto to the rest of the world.

Jim had gone off to a twenty-person start-up called RocketMail, which offered what at the time was a new thing: email, but on the Web. Crazy, I know, though one of the high-growth portal sites, Yahoo!, decided it was crazy-like-a-fox and bought RocketMail, rebranding it Yahoo! Mail and offering it alongside their other services as one more way to keep people in their Web browser, looking at other Yahoo! pages, specifically. This made Yahoo! seem much more well-rounded, suddenly competing with services like America Online (or AOL, as they’d eventually call themselves) as a one-stop Internet experience.

Yahoo! stock had swelled alongside all the other so-called dot-coms, making geeky Jim McCoy, of the thick, wire-rimmed glasses and ratty ponytail, quite wealthy. It only took one eye-surgery and a haircut — along with the confidence that comes from knowing you’re not just a bad ass, you’ve also got millions of dollars to back you up — to make Jim look at a glance like the cool guy I’d always known him to be.

C2Net, on the other hand, had stalled out somewhere along the way. Other companies followed Doug’s strategy of coding crypto outside the U.S., eventually causing the export ban to be lifted. While that was a great achievement, the company’s commercial success remained elusive. Doug and his co-founder, Sameer Parekh, both took jobs with Kroll-O’Gara to do security consulting while their company worked out its next steps.

It’s great when someone you like becomes wildly successful. It’s even better when two people you like, who are also good friends, both become wildly successful. However, it’s slightly awkward-making when only one of them profits wildly from great success. Jim had lost none of the exciting energy that had driven him for so long, while Doug’s cool confidence seemed to vibrate with an anxiety that only seemed to calm when the two old friends would look at each other and smile. Clearly, they had a plan.

“It doesn’t matter how big a pipe you’ve got,” said Doug. “I mean, it does — it matters a lot — but what matters a lot more, a lot more often, is how big a pipe the server has.”

“Imagine if a server has one big file,” Jim said, gesturing with his hands. “If a thousand people want that file—”

“If only a thousand people want it,” Doug added.

“—then the server needs a thousand times as much bandwidth as the people at home.”

“In technical terms,” Doug said, “that’s a gigantic ass-load of network pipe.”

“So,” said Jim. “Imagine I’m a server, and Doug has already started downloading a file, and then you reach out to me because you want the file, too. But because I’m also trickling the file out in little chunks to a thousand other people at the same time, you can’t pull it down as fast as you would otherwise. What if there was some way you could ask Doug to send you the parts of the file that he had already downloaded, while you focused on getting new parts from the server?”

“You’d get the file a bit faster,” I said, “though presuming Doug is some random home user, his upload bandwidth is going to be pretty shitty.”

Doug nodded. “This is true,” he said. “But what if the server to put you in touch with everyone who’d ever downloaded that file—”

“At least,” Jim said, “everyone who was online right then—”

“—and who still had pieces of the file that you didn’t have,” Doug added, “then you can max out a home Internet connection, even a fast one.”

“You could even encourage people to stay online, sharing little bits of files with other people, hugely magnifying any server’s download power,” Jim said.

“How?” I asked.

“With a crypto-currency,” Doug said, “or at least something that can’t trivially be counterfeited, which downloaders can give to file-sharers, essentially ‘buying’ preferential treatment and better service. Then the file-sharers can re-use the digital coins with other sharers, making their own downloads even faster.”

“We call it mojo,” Jim said. “You want me to share something with you, so you share some of your mojo with me. I spend mojo to get something from someone else.”

“Or you don’t spend mojo, so your download takes longer but still not as long as if your download was throttled by a single server’s pipe.” Doug and Jim smiled again. “The plan is for us to seed the system with a bunch of mojo, and to reward sharers with extra mojo even if downloaders aren’t paying for what they’re keeping online.”

“And if users want more mojo?” I asked.

“They buy it from us,” Doug said.

“Imagine you have two dials,” said Jim. “You want something faster, you turn the mojo knob and pay for the service. You want more mojo, you dial up the storage knob and let the service store more little bits of files for sharing. We give people mojo to host files, even if they’re not being actively downloaded, to persist files in the system. The next morning you wake up to find you’ve earned mojo.”

“Or you buy more mojo from us,” Doug added.

I felt like I was missing something. “So you’re talking to different companies about making deals to share their content?”

Again, Jim and Doug glanced at each other, but this time they seemed to be trying hard not to smile.

“Not per se,” Doug said, breaking into a grin. “The beautiful thing is that this doesn’t require the content people to do anything.”

“How so?”

Jim shrugged. “Once a file’s been uploaded into the system, split up into however many tiny little pieces across however many computers, it doesn’t need a main server to host the file at all. All you need is someone to track who’s offering which file.”

Doug raised his hand. “That’s also us.”

Jim continued. “If you want a file, you ask us who’s got some pieces of it, and we put you in touch with your peers. Then it’s a peer-to-peer conversation after that. We don’t even know what content you’re talking about, all we’re doing is putting you in touch with other people who have data you think you want.” He shrugged with cherubic innocence. “And if you spend mojo, everything goes faster.”

My mind thrummed from shock. Somewhere, what remained of the fourteen-year-old software pirate I had once been began to laugh. For the first time I could remember, I had a hard time speaking.

“Motherfucking any file, you’re talking about,” I managed to get out. “Any file, from anywhere, but it wouldn’t be stored anywhere, it would be everywhere. And you wouldn’t know who had downloaded it, so no one could go after you for serving it.”

Jim smiled, nodding. “It would be hard to prove that anyone ever had the whole file. All we could say is that these people were thought to have some pieces of a file matching a certain fingerprint at one point in time. If you can’t bust a search engine for serving up a link to something, then it’s not illegal to connect the people who have data with the people who want data. The people who have it don’t even need to know what they have. All they know is that they’ve carved out part of their hard drive as part of Mojo Nation.”

“Mojo Nation,” I said. “I like it.”

“The speed is important,” Doug said idly, “when you imagine that a compact disc full of music is, like, 600 or 650 megabytes, so at 48K per second—”

“If you’re lucky,” Jim added.

“—that’s, like, three and a half hours. If you can max out a DSL line, you’re talking less than 15 minutes.”

“No, you’re not,” I said quietly, and both of their eyes snapped wide open. Quickly, I added, “At my last job, after they laid off everyone around me, I took over a couple of computers that no one was using any longer and passed the days copying all the CDs I owned — then about a hundred CDs that sat in a big, fat disc changer in our break room, then stacks and stacks of CDs that I’d borrowed from friends — to the hard drives of one machine or another and then converting the music to MP3. It took at least an hour per disc just to copy the data to the hard drive, then it could take a couple of hours to convert the audio with reasonable compression, so I’d usually spend the day copying CDs onto the machines and then kick off the conversion before heading home. Once it was digital, though, you’re only talking 65 megabytes per CD.”

“What?!” they both said at the same time.

“There’s no way you’re going to get an order of magnitude savings,” Doug began, then he paused, thinking.

I shook my head. “It’s more that most CDs are only about 45-minutes long. But yes, I swear, you’re talking something like 65 or maybe 80 megs for a lot of albums, with perfectly reasonable compression.”

Jim grinned. “So that’s half an hour to drive to a music store, buy a CD, and drive home, but a minute and a half to download it.”

Doug began making notes. “We’ll do the math,” he said with a tone of doubt, then he paused again. “Do you know how many megabytes a video ends up being?”

“Uh…no.” Suddenly, somehow, I felt like an idiot. It was the obvious next question. The truth was that I’d never had a computer powerful enough to do much with video. But I should’ve at least thought about it. Leave it to Doug to stay a step ahead.

“I don’t know what your schedule looks like,” Jim said, “but we’ll need a logo at some point.”

“Done,” I said, drunk from shock but clear on what I could easily do.

Walking back to Doug’s place in the cool evening air, I looked up at the stars. “It’s beautiful out here,” I said, fanning my arms out along my sides.

“It is indeed,” he said.

“I can’t believe I’m here. I can’t believe what you’ve come up with. That is genuinely the craziest thing I have ever heard in my entire life.”

“Well, thanks,” said Doug. But the further we got from downtown Mountain View, and the further we wound through the neat rows of clean, suburban homes, the more his shoulders slouched forward and the more slowly he walked.

“Ah,” he said once we rounded the final bend toward his house. “I see my girlfriend is not home yet. I was hoping you’d finally get to meet her.”

“Cool,” I said. “I’m looking forward to it; I’m sure she’s awesome.”

Doug laughed. He’d been married when I’d known him in Austin, though clearly he wasn’t married any longer.

“Whatever happened with Amanda?”

“Oh,” he said, “you know.” He told me the story. It wasn’t that different in principle from other stories I’d heard before, people being people anywhere you go, with the upshot that Doug being Doug, and rarely being without a girlfriend, he came out of the story with a girlfriend.

“What’s she up to this evening?” I asked.

“Oh, she’s probably finishing up at school. She’s getting her MBA from the Haas School of Business.” He checked my face. “It’s a famous business school,” he added.

“I figured,” I said. We walked up his front lawn.

“No, I mean it’s a really big deal.” Doug sighed. “I also applied, but they didn’t accept me.”

“Oh. I’m sorry, that sucks.”

“Well,” he said, shrugging, fumbling with a keyring. “The only thing I asked her is not to talk about it all the time. I told her I could take hearing about it for no more than fifteen minutes every day, and that’s it.” He made a cutting motion in the air. When we walked in, he stood gripping a chair-back for several moments before that unnamed frenetic energy of Silicon Valley swelled again, and he looked up. “Something to drink?” he asked.

“Water, please,” I said.

“You’ll meet her soon enough, I’m sure,” he said. He shrugged, handing a glass. “She’ll be home soon. I just hope she doesn’t ask me to do her homework again. The instructor evidently asked them to put together, like, a basic spreadsheet, and she couldn’t do it.” He chuckled. “She just didn’t know how. I was like, ‘You’re going to business school, and you don’t know how to use Excel,’ and she said, ‘I thought you were going to help me,’ and I was like, ‘I can’t do all your homework for you. You’re the one who got into business school, knock yourself out.’”

“Jesus,” I said. “Oh, hey — I wanted to say: thanks again for letting me stay with you.”

“It’s no trouble,” he said. Then his face softened. “Thanks for hanging out. It’s fun.”

“It is,” I said. “And that is a crazy, fucking brilliant idea you have there. I want to hear more about it.”

“Indeed,” he said, bowing slightly.

The whole world would hear more about the idea, in a lightly reduced different form, though they’d call it Bit Torrent, and it would in fact transform how files were shared — legally or otherwise — on the Internet. But we’ll get there. In the meantime, I had my own work to do.

There was this company — big company, well-known company at the time — that sold music online — selling music on physical media; in 1999’s August, Napster, the first major online music sharing service, wouldn’t attract the ire of the music industry for nearly four more months. This company was pretty big at the time, though I don’t even know if they’re around any more. Probably they were bought by somebody at some point.

Anyway, they’d received an email from someone who called himself a freelance information security consultant, about how they had this terrible information security problem. As evidence that there really was a problem, and that he knew what it was, he sent along a file listing tens of thousands of credit card numbers belonging to their customers. For a mere $100,000, wired to a foreign bank account number, he would tell them how to fix their security problem.

Naturally, they were unhappy people, throwing around words like “extortion”. So they had some connection which brought them to us, and we sent out a consultant to see how quickly they could figure out and close the breach.

Our consultant flew to their city that evening on the red-eye, arriving early enough in the morning to have to wait in their lobby while enough people dragged themselves in to work that he could finally gain access to the server room.

He was sort of expecting a bunch of machines, running such a large site. The operation was not a small one at that point. And they did have a bunch of machines holding things like album cover images and track listings and the like, though they only had one Web server that processed purchases. The pages that a user needs to see in order to complete a purchase are pretty lightweight and straightforward, so one beefy machine was able to do it for the whole site.

“And where’s the database?” our consultant asked. It was on the machine, he was told. On that same machine. Our consultant thought, “That’ll be problem — this machine has to be reachable from the public Internet, and the database probably has a port open, and they probably have a shit password on the database, if any, so this guy was probably able to connect straight into the database from wherever he is and trick its gag reflex into vomiting up everything it’s got.” But even though that was in his head, what asked was, “What’s all that beeping?” Because ever since they’d come into the server room, the computer had been beeping in an irregular pattern that did not sound like what you’d want from the machine that made your company millions of dollars every month.

The escorting employee beamed. “Oh,” he or she said, “that’s how we know we’re making money!”

I’m told that the consultant we’d sent did not say, “You’re kidding me,” out loud.

The employee went on. “Our CEO wanted us to have a connection to every sale, so we could understand that what we were doing was affecting people’s lives right then, exactly that second. So every time a sale goes through, he wanted the machine to beep.” I’m told he or she sighed. “Unfortunately, the only way we can know for sure that an order was completed in real-time is to verify with both the Web server and the database. So we needed the database and Web server on the same machine.”

“And the Web server connects to the database over a network port, right?” our consultant asked.

“Of course,” the employee said. “Normally the database would be on a separate box, but we put them on the same machine so we could make a ‘ding’ when an order went through. The Web server connects back to database, sitting on the same machine.”

“So you’ve got one machine, with Web ports and database ports open, sitting on the public Internet.”

The employee nodded. “Our firewall is supposed to be blocking that, though.”

I’m sure our consultant nodded patiently. The firewall, of course, was not. I heard that our guy was out of there after only a couple of hours, though we ended up charging them for a full day. We saved them 95% off of the hacker’s extortion racket, though, and I expect they were glad to pay it.

“So what happened?” I asked my boss.

“Fixed their firewall rules, I think,” said Phil.

“No,” I said, “I mean about all the credit cards that got stolen.”

He shrugged. “They’re already gone, right? And the breach is closed, right? So I don’t think they care.”

“But those card’ll just get sold to the Russian mafia—”

“Uzbekistani, I think,” my boss corrected.

“Whatever. They really don’t care?”

“They care that they took care of the exposure. That’s all they’re required to do.” It varies from state to state in the U.S., but in 1999 the reality was that the Internet had grown up pretty fast. If you hadn’t been paying attention to information security for the last fifteen years, you could be convinced that these problems never could have been predicted.

My eyes drifted to a middle distance, as they usually do when I convince myself that I’m thinking about something in many different ways at the same time. Whether or not I truly am, I have no idea. But sometimes, interesting things come out of these moments.

I said, “So, hackers are war-dialing common ports across a bunch of servers on the Internet — common database ports, for example. And when their script gets a response, it gets logged. Then the hacker comes home from work —”

“Or school.”

“—or school, and they check the list of Internet-accessible databases that their computer found for them during the day. Then they start making money.”

My boss leaned forward. “What we’re wondering,” he said, “is how we get people to scan themselves. Think about it: if you were the CEO or the CIO of a company, and every month you got a report that told you what your network looked like from the outside, maybe you’d feel great. Maybe you’d be interested in paying some small amount for a monthly or weekly scan of your perimeter to make sure some new admin hasn’t opened you up to something horrible since the last time you checked.”

“Because how else would you know?” I said, fully gripped by nausea.

“How else?” Phil asked. “That’s what we’re going to do: we’re going to build a scanner that can check any location on the Internet for known vulnerabilities, assemble a report and tell them how to fix things, if possible.”

I thought about it. “We’re going to create a database of all known vulnerabilities to Internet-facing server software, with nice text describing what they are and how the exploit works, if known, and how to fix it, if there is a fix. And we’re going to scan a bunch of sites constantly, to help them stay secure.”

“That’s the plan.”

The nerve that this touched in me at that moment was old, and went deep.

“We’ll be finding and tracking the open ports on hosts all across the Internet,” I said. “We’ll be uncovering what the Internet truly looks like, its real shape.”

He thought for a moment. “That’s one way to look at it.”

“I’m in,” I said.