I PULLED INTO THE MANHATTAN Harbor parking lot on the Kentucky side of the Ohio River. Only a few cars dotted the lot, so I got a choice parking spot near the iron stairs that led to the docks. The slips were full, but most boaters only took their boats out on the weekend. It was the calm before the beer-fueled storm. In twenty-four hours the harbor would be filled with men pissing off the side of their boats and women who, after a few beers, would be more willing to lose their tops than they first thought.
My rental was a forty-foot Playbuoy houseboat at the end of Dock B. It had seen its best days in the eighties. White paint flaking off in several places allowed the previous color, a pale blue, to poke through. As houseboats go, it was on the shorter side, but more than enough room for me. The first level had two small bedrooms, a salon with a foldout futon, television and workspace, full galley and a bathroom the size of a closet. The second level had the pilothouse and an open-air deck. It was the only live-in boat in the harbor, and a good deal at three hundred a month.
I headed to the sun deck on the second level, kicked open the deck chair on my boat, grabbed my laptop and went back after Silvio1053. Bishop didn’t have much to go on, and I was no closer to Silvio than when Fat Sam plunked the bulky envelope into my lap this morning. So far, all I had was that my guy knew what Fat Sam looked like. It’s possible they met in person, or perhaps Silvio1053 worked with someone else who knew him and had described Fat Sam. Maybe they chatted on a webcam or maybe he had Fat Sam and Bishop under surveillance. It wasn’t a lot to go on, so I tabled the personal connection and moved on.
PIs can access any number of databases to dig into someone’s life. For a few bucks I can pull criminal records, motor vehicle registrations, driving records, property reports, concealed-weapons permits, credit reports. They’re all a few keystrokes away. But running all those database searches requires basic information. Name, Social Security number and the like. I didn’t have any of that for Silvio. Yet.
My first approach was to work with the handle “Silvio1053.” I plugged it into Google and got twenty-seven pages of results. It looked like it’d be a long night, so I brewed a pot of coffee and got to work. Most of the results were in Italian, which was as helpful as a tinfoil condom, so I prioritized the English results. The top results included city council meeting minutes from Shreveport, Louisiana, a Volkswagen tribute page, a user posting yoga studio reviews in Los Angeles, and an eye doctor in New Jersey, among a slew of other nonsensical garbage. Nothing stood out, and I thought I was careening toward a dead end, but I poured another cup and kept sorting through the results.
I had to fight off sleep around page twenty-six. I’d finished the pot and was eager to cross page twenty-seven off my list before turning in for the night. That’s when I saw a post on an IT forum dated April 28, 2007, from someone using the handle “Silvio1053.” Something about “operating system development” and “business desktop deployment,” whatever that meant. The handle hyperlinked to a login page. I registered for my own forum account using a bogus name and once logged in, I clicked on Silvio’s handle again, though this time the hyperlink took me to a user profile page registered to “JBanks.” It was no slam-dunk, but the IT topics fit my preliminary profile. If Silvio hacked into Bishop’s system, he probably had IT experience. Maybe I’d inched a step closer. The find jump-started my central nervous system faster than the caffeine. I printed out JBanks’ forum post and drew a large question mark in the corner.
“Nice to meet you, JBanks,” I said. “Let’s see if we can find the rest of you.”
There’s a method to why people select their handles. The selection isn’t arbitrary. They mean something—something to them anyway. The IT forum was the only other site where I saw a possible connection to the Silvio1053 handle, and it’s possible that whoever used this handle to post to the forum in 2007 was the same person using it today. It could also be a colossal coincidence, but it’s all I had.
I Googled “JBanks” and almost fell out of my deck chair. I thought the results for Silvio1053 had been mind numbing, but at 627,000, the results for JBanks threatened my eyeballs and my weekend. I clenched my teeth and considered chucking my laptop into the Ohio River. Instead, I climbed down to the boat’s main level, fell onto my mattress and went to sleep.
THE NEXT MORNING, THE GOOGLE search results page greeted me like an ugly, drunken hookup from the night before. I brewed the first pot of the day, carried my laptop back to the sun deck and went to work. The morning sun glimmered across the river as the calm water lapped off the side of my boat.
The results for JBanks were too general to focus on. Banks is a common name, and I had Web pages from every corner of the country on everything from fly fishing to metalworking to sports marketing to advertising to movie reviews. I could spend Bishop’s thirty days just meandering through these results. Time to narrow.
I ran the search again, this time focusing on the terms “JBanks” and “IT” and got the results down to 81,000. Still not feasible. A morning breeze kicked the smell of someone’s breakfast onto the sun deck. Bacon and maybe toast. The same breeze grabbed my IT forum printout from yesterday and threatened to send it into the river, but I snatched it out of the air before it had a chance to escape. Studying the printout again, I decided to focus on the unique terms in the post. Running the JBanks search with “operating system development” returned 996 results and running it with “business desktop deployment” returned less than ten, including the original IT forum post. I weeded through those results, but there was nothing to go on.
My coffee pot gurgled through the open galley window, and I headed down and poured my first cup. Back at the laptop, I went through the “JBanks” and “operating system development” results. Most of the results on the first page originated from sites in the UK, so I ruled those out. It’s possible Bishop’s blackmailer was outside of the country, but since Bishop mentioned most of his business was inside the States, I wanted to focus on in-country first. The second page offered results for term-paper writers, college professors, nursing information and a few sites from Germany and Istanbul. Most of the other results pages blended together in a sea of miscellaneous scrap.
I polished off my second cup of coffee when I clicked on page eight. The third result was an article published two months ago in PenTesting magazine, titled “Top Five Password Coding Vulnerabilities and How to Avoid Them.” The article’s author ... Justin Banks. I clicked on the About Us section of the site. PenTesting magazine was a publication for white-hat hackers, individuals who made their living testing website vulnerabilities. I assumed Justin Banks was a staff writer for the magazine, but he wasn’t. The short bio at the end of the article listed him as an IT security consultant from WhiteHat Security Solutions in Columbus, Ohio, a consultancy company about one hundred miles north from where I sat. Now we’re getting somewhere.
The proximity fit. If Banks lived in Mexico or overseas, he’d have no reason to have met Bishop or Fat Sam, but someone in Columbus, Ohio, seemed like a good possibility. He’s less than two hours away, so it’s not out of the question that he’d crossed paths with Fat Sam before. This was the best lead I had, but I didn’t want to discount the remaining results, so I printed out the magazine article, along with Banks’ bio, and kept crawling through the online search results. After another three hours, I hadn’t found anything else to lead me in another direction, so I decided to focus on the consultant in Columbus.
I called Bishop to probe deeper.
“Put your thinking cap on,” I said. “Does the name Justin Banks ring any bells?”
“Justin Banks ...” repeated Bishop. “Not that I recall. You think he might be Silvio?”
“Maybe. I’ve been looking into him. He lives in Columbus. Works in the IT security industry.”
“You got a company name?” said Bishop.
I grabbed the printout. “WhiteHat Security Solutions. That sound familiar?”
Bishop was silent for a moment. “I met with someone from Columbus years ago, but that company doesn’t sound familiar.” He was silent again. “No, it’s another company, a Blue Horizon or something. Something with the name ‘Horizon’ in it.”
“How long ago we talking?”
“About three years ago. I talked to a consultant about encryption software. I met with him twice. Here in Cincinnati.”
“Would Sam have been with you?” I said.
“Not sure. Might have been. It was a while ago. What makes you think this is our guy?”
“A few things point to him. No need to go into details yet.” I resisted the urge to tell Bishop it was the only solid lead I had.
“Okay, so what’s next?” he said.
“I’m going to dig a little deeper. I’ll call you with any updates.”
I hung up the phone and read Banks’ bio again. He was a strong possibility. Definitely had the skill set, and the idea of an ethical hacker going rogue and hacking for extra cash made a believable scenario, especially when it paid fifty grand a month.
Bishop mentioned working with a company named Blue Horizon before setting up shop online. An online search revealed a Blue Horizon Consulting in Westerville, a suburb of Columbus. The company’s Web page indicated it specialized in information technology security and testing. Getting closer.
I ran another search, looking for any connection between Justin Banks and Blue Horizon, but didn’t turn up anything. That didn’t mean there wasn’t a connection, only there wasn’t any evidence of one online. If I could confirm that Justin Banks worked for Blue Horizon during the time frame Bishop indicated, I’d have enough evidence to warrant a trip to Columbus for some serious digging. No reason to waste time and gas otherwise.
I pulled up another list of similar companies in the area and found SBC Partners, a company that also specialized in e-business consulting. I started on another cup of coffee, dialed the main number for Blue Horizon and asked to be connected to their human resources department.
“This is Kyle Murphy. How can I help you?”
“Hello, Kyle,” I said. “This is John Wyatt with SBC Partners. We recently interviewed Justin Banks for a position, and his resume indicates he worked for Blue Horizon. I just wanted to confirm that was accurate.”
“Hang on a second and let me pull up that name in the system,” he said. “The name again?”
“Justin Banks.” I could hear the plastic clicks on Kyle’s keyboard.
“Looks like he worked here as a senior e-commerce security adviser for three and a half years. Before my time.”
“Wonderful,” I said. “Can you confirm his employment dates?”
“Sure,” more clicks. “He was here from August of ‘08 to January 2012.”
“Perfect, that’s all I need,” I said. “Thanks, Kyle. Have a great afternoon.”
“You too.”
Justin Banks had the technical expertise as a penetration tester to crack Bishop’s site. He lived close enough to have met with Bishop and potentially Fat Sam in person, and he worked for the same company that Bishop worked with when he architected the Dark Brokerage. My gut told me that Banks figured out Bishop was into something illegal and kept tabs on him. When he found out what Bishop created, he saw an opportunity to fleece him out of some cash.
Most people don’t realize they’re immortal online. All those photos and website posts never go away. They just get buried deeper and deeper in cyberspace until someone like me comes along and stirs up the layers.
Justin Banks was a strong lead. Whoever our guy was, he’d gone to a lot of trouble to be invisible. And now a simple goddamn Google search might do him in. Had it not been for that PenTesting magazine article, I’d still be beating my head against the keyboard, but now I’ve got a solid lead. It’s like a tiny piece of bone sticking out of the dirt. You grab a brush and start removing bits and pieces of dirt, and sooner or later you’ve uncovered an intact T-rex skeleton in the Arizona desert. Or in this case, Westerville, Ohio.
Finding the connection gave me a PI hard-on, but Bishop planned to shove a handgun down Silvio1053’s throat when he found him, and while I was okay with sending a criminal low-life off to slaughter, I wasn’t okay turning over an innocent man. I had to be right about Banks. That meant a trip up I-71 to Columbus.
Comments (0)
See all