Below is Sara’s second scene in Full Spectrum Cyberwar, after traveling to the U.K. to be closer to the action.

***

Sara was hungry.  She barely arrived home after work Friday when a military Humvee parked outside.  Two good-looking men, whom Sara thought could be models, in fatigues, exited, walked up to her door, and explained to her mom how they were taking her to the U.K. to work with Major Calvert.  Her mom called her dad, who just got off the phone with Calvert, then helped her pack.  Sara missed dinner.  

The two nice looking soldiers drove her to Lackland Air Force Base in San Antonio, where she boarded a small passenger jet for a flight to somewhere in Georgia, where she boarded yet another plane, described to her as a C-130 cargo jet, that flew her to RAF Fairford Airbase, somewhere northwest of London.  

It was now Saturday morning, and she was being driven by yet more very fine looking soldiers to what they called the Doughnut, a half hour more northwest in Cheltenham.  Sara had yet to eat.  She didn’t know the difference between jet lag and low blood sugar, but she was confident she could ride out the jet lag if she could get some food.  Sara also wondered if the military had some synthetic printer running off copies of these darling soldiers.

“Are we driving to breakfast?”  Her brain starved of glucose, Sara had already forgotten the two soldiers’ names.  She didn’t care which of the two boys sitting up front answered.

“We’ve already eaten breakfast ma’am, but I’ll inform the Major of your request.”

“Bless your heart.  Thank you.”

Ma’am.  These boys must have five years on me.  Lordy, they’re cute.  Sara had yet to express much interest in boys at school, but traveling with these military men kindled something inside her.  They must think I’m older?

The soldiers didn’t talk unless spoken to and Sara was too tired for words.  After driving through the English countryside for twenty minutes, on what she understood to be highway A417, much like a Travis County highway but without shoulders, they reached the city of Cheltenham.  They parked in front of a large building.  She gathered, more from the curve of the parking lot than from what she could see of the building itself, that it was round.  Assuming it had a courtyard, she got the doughnut moniker.

The soldiers bypassed the security turnstile and took her to a side office where they printed her out a badge with a photo worse than any she’d ever taken.  Any.  She tried to put it in her backpack, but they handed her a lanyard and instructed her to wear it around her neck.  They emphasized the importance of keeping the photo-side visible.

“Miss Thomas.  I heard you were in the building.  How was your flight?”

Sara raised her head after donning her lanyard to see Major Calvert standing in the doorway of the small office.

“Hello, sir.  Mr. Calvert.”

“You can call me Major, Miss Thomas.  It’s been a full year since we met at BlackHat.  It’s good to see you.”

“Thank you for the job, Major.  It’s been really awesome.”

One of the privates addressed Calvert.  “Sir, Miss Thomas expressed an interest in having breakfast on our drive from Fairford.”

“Well, of course, we can have breakfast.”  Calvert already ate but suspected more food might aid his own jet lag.  “When’s the last time you ate Miss Thomas?”

“Bless your heart, Major.  Not since lunch yesterday.  Military planes don’t have flight attendants.”

“No Miss Thomas, they don’t.  I’m so sorry about that.  Let’s address this right away.”  Calvert looked back at the private.  “Her badge ready to go?”

“Yessir, her authorizations you requested are active, sir”

“Fine, thank you Private.”  Calvert returned his attention toward Sara.  “Miss Thomas, we could eat in the doughnut cafeteria, but think about how that sounds while we walk outside.  I know a place where we can get you a proper English breakfast.”  Calvert had already worked four hours and would like a break from the building himself.

“Private, drive us to the Bayshill Inn on St Georges Place.  Take the A40 to Lansdown.”

“Yessir.  May I suggest the Princess Elizabeth Way to A4019?”

“No thank you, Private.  I’m going for sites over speed.  Let’s drive past the Ladies College.”

“Yessir.”

Ten minutes later, Sara found herself seated at an outdoor picnic table with the major somewhere in what she figured to be the town’s center.  She ordered a tuna and brie omelette with potatoes while the major ordered sausage and mash.  Not one to assume a young girl with such a diminutive size couldn’t have a healthy appetite, Calvert also ordered a fish and chip board as a starter, to be eaten if needed.  Sara didn’t begin to speak until the chip board arrived and she had a few bites.

“Wow, these are good.  Sitting outside here is nice.  It’d be too hot in the Hill Country, this late in the morning.”

“I know.  I mostly work in San Antonio.  Maximizing your time in the sun will help you with jet lag.  I’ve always had good results from eating too.”  Calvert grabbed his first bite after sensing Sara provided him an opening.

“I really want to thank you again Major for the summer job.  But I can’t imagine how I can help you.  I barely know anything.”

“Straight to business, Miss Thomas.  Okay.  First, you have experience in analyzing the system logs from wind turbines.  Second, in the ELK stack, which seemed to have worked nicely for your analysis yesterday.  And third, in querying a massive data lake of vulnerabilities and exploits that your firm maintains.  Any idea how they put that extraordinary database together in such a short time?”

“I can’t talk about that stuff, and honestly Major, I’m just learning how to use the ELK stack.  I mean it’s not terribly difficult.  It’s hardly something that takes ten thousand hours to become an expert.”

“There’s more, Miss Thomas.  My team is already engaged in other projects.  You’re additional headcount.  Your skills might seem niche to you, but they are perfectly suited to the task at hand, and you’ll require zero training time.  Time is at a premium just now.”

“Not that it isn’t really cool to be here sir, but why not have me query logs from Austin?”

“I don’t expect you to be overly familiar with international data privacy laws Miss Thomas, but trust me, Europe invented them.  I had Jen, I believe she’s your lead, transfer an instance of your AWS data lake to an offnet data center here in the U.K.  In addition to playing by the rules, it affords us a measure of security should we lose trans Atlantic Internet connectivity to North America.”

“Seriously?”

“It’s a definite possibility.  Should cyberwar break out, we’d be remiss not to have contingencies for that.  A classic defensive tactic we call compartmentalizing systems.”  

Calvert had underestimated potential strikes in the past.  He was running this exercise by consulting a physical playbook every four hours in a stand up meeting with his NATO counterparts.  Not unlike facilitating an incident management and response plan after a breach.

“Can you tell me what an offnet data center is, sir?”

“Back at the Doughnut, you’ll be assigned to a work bay with two workstations.  One is connected to the Internet.  You’ll need that to download log files from several dozen wind farms where we’ve already established user access for you.  You’ll transfer files to a USB drive which you’ll use to load the files into your second workstation.  That computer is not connected to the Internet.  Hence the term, offnet.  It’s connected to a military network where your new data lake has been instantiated.  Jen worked through the night with my team here to rebuild your data lake and toolsets.  She didn’t have it finished until you arrived.  You think you’re tired.”

The seriousness of this adventure began to dawn on Sara.  She wasn’t intimidated but rather so excited, she mentally directed any self-doubt to take a back seat to her enthusiasm.  She stole the last fish slider when Calvert wasn’t looking and scooped up the remaining tartar sauce.

“Oh, I think that’s our food coming.  Phew, I started thinking this place was slow.”

Technically, I introduced Sara near the end of book one, similar to how I introduced the major character of book three near the end of book two.  I’m consistent like that.  This is Sara’s introduction in the second chapter of Full Spectrum Cyberwar.

***

SARA Thomas was a serious-minded sixteen-year-old.  With two years of high school behind her, her petite 5’1”, 95-pound frame led people to guess she was only headed into 8^th grade.  She got her share of double takes during night classes for the college level calculus she attended Tuesday and Thursday nights at Austin Community College.  Most boys considered her pretty, but she didn’t know that.  She wasn’t so dorky as to wear over-sized glasses, her specs were hip wireframes, but she’d yet to start thinking about boys.  Sara’s focus was elsewhere.

This was her second month working at Response Software, in their modern office complex off Loop 360, overlooking Lake Austin.  She got the job after meeting a Captain Calvert of the U.S. Cyber Command, the previous summer while attending a Black Hat conference in Las Vegas with her father. Captain Calvert, now a major, stayed in touch with her father, and Calvert’s wife K.C., who worked for the cybersecurity forensics firm, offered Sara the job in May.

She expected today to be like all the others.  Jen, her team lead and official mentor as the only other female on-site, tended to sit down with her around 10 am on Wednesday mornings to teach her a new software tool.  Software that Jen referred to as being part of their forensics toolkit or stack, which implied a set of tools that all work together.  

Sara was in her cube before 8 am, reading her email.  She had one marked urgent from Justin Peters, whom she understood to be pretty high up in the firm, one of the partners.  Sara had never received an email before with the urgent flag set.  She read it first.

Sara,

Jen tells me you’re up to speed on the ELK stack.  That’s awesome.  I need you to query these 45 days worth of server logs six ways from Sunday and let me know if you find any interesting patterns.  If you have time, download this server image too and compare it against the standard image we already have.  I need your findings by EoD.

JP

Sara googled “six ways from Sunday.”  Oh, he wants an exhaustive search.  Fun.  Next, Sara googled “EoD.”  My end of day or his?

Sara detached the archived file from the email, saved it to her hard drive, then decompressed it to find a trove of over a thousand log files from thirty-three separate servers.  She added these logs to the data lake she had been building as part of her internship.  That data store was comprised of massive storage in the Amazon cloud offering termed AWS S3 for Amazon Web Services Simple Storage Service.  

She began to study the files by scrolling through their file names.  It was apparent there were thirty-three different servers, as their hostnames contained unique numbers, each with forty-five logs, and that each log captured data over a twenty-four hour period.  Fourteen hundred and eighty-five server logs.  

She opened up all the logs at once using her ELK stack to color code each unique data point over the entire forty-five days.  Her program determined the normal range of readings based on statistical analysis, and illustrated meaningful deviations from the norm with the colors.  Color patterns emerged across most of the data points, for each server, on each day, until the final hour.  Maybe that’s normal and the final day’s readings are anomalous because Justin didn’t get a full day?

Sara drilled down into the data points by clicking on them.  The logs contained readings that she didn’t understand.  She did understand each row of data was timestamped every thirty seconds.  And she caught visually, by the color-coded representation, that the readings were entirely identical across each of the thirty-three servers, until the final hour of the last day.  Her guess was that the data points flagged by her pattern-matching software should probably be more random, like the final hour readings.  

She googled wind farms and stumbled upon some information from the Department of Energy that explained the readings to her.  “rev/s” referenced the rotation of the turbine in revolutions per second.  “m/s” was a meters per second reading of the wind speed.  There were other readings for power output and pitch.  Every color-coded reading was identical, until the final hour, as if all thirty-three servers were running the same control program.  Sara wasn’t deep enough in her knowledge of this tech to know to what extent these systems were machine controlled, but clearly, windspeed came from nature and would have to be random.  

She spent more of her time reading online details of how wind farms operated than reviewing the logs themselves.  The ELK stack did all the log analysis for her within a few minutes.  The real effort was in understanding the significance of her findings.  She also had time to download the server image from a link included in Justin’s email, and run the compare.  Sara emailed her findings back to Justin before her 10 am meeting with Jen.