Dark Perimeter: True Cybersecurity Stories

The Breach Files: Plaintext (A Dramatized Special)

Season 2 Episode 1

Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.

0:00 | 13:28
A dramatized special. The launch of The Breach Files. Harvest now, decrypt later. It is not a theory. Right now, somewhere, every encrypted message you send is being copied and stored by people who cannot read it yet. They are patient. They are betting that the key is coming. On a dead quiet night shift, a lone security analyst watches a sixteen year old trap spring. A canary token, buried inside a fake file that was leaked on purpose and locked with the kind of public key crypto that secures almost everything, phones home. It means someone opened a lock that was never supposed to be openable. Then a second fires. Then a hundred. In order. Oldest first. Something is reading the entire encrypted past of the human race the way you would read a book, and the pages are turning faster. There is one file it should never be able to reach. The control. Air gapped. Never networked. Never sent anywhere. You will want headphones on when it fires. We always assumed the key that arrives on Q-Day would be a machine. We assumed it would be ours. We assumed we would hear about it. Best heard in the dark. A Dark Perimeter dramatized production.

Support the show

SPEAKER_04

Every secret you have ever sent was sent on a bet. The bet is that no one reading it today can break it. The bet is not that no one ever will. This is the breech files. Tonight, what happens when later arrives? We call this one plain text.

SPEAKER_02

Two in the morning on a Tuesday is the best shift in this building. Nobody emails you. Nobody walks up to your desk. It is just me, the coffee machine, and about 400 servers breathing through the wall. My job mostly is to watch alerts go by and decide which ones are nothing. Almost all of them are nothing. That is the secret of this work that nobody tells you. You are a smoke detector that has never once smelled smoke. So when the chime went, I almost did not look. I am glad I looked.

SPEAKER_01

Canary Token fired, token 0001. Created 2009.

SPEAKER_02

Now, to explain why my stomach dropped, I have to tell you what a canary is. Years ago, somebody at this company who was smarter than me set a trap. They built a stack of fake files, fake credentials, fake deal memos, fake everything. Then they leaked them. On purpose, pushed them out to the places where stolen data goes to be collected, the dump sites, the broker forums, the quiet corners where the harvesters live. But every fake file was locked. The content scrambled with a strong symmetric key, and that key itself wrapped in public key encryption. The good old kind, the kind that secures almost everything. The kind whose entire safety rests on one promise, that to break it, you would have to factor a number so large that every computer on Earth, running until the sun burns out, would not finish the job. And buried inside each fake file, in the part you can only see after you have broken all of that and opened it up, there is a single beacon, a pixel, a phone home. The instant somebody actually reads the plaintext, it calls us quietly, from wherever they are. For sixteen years, not one of them ever called. Because for sixteen years nobody could open them. That was the whole point. The silence was the proof that the math still held. And token zero zero zero one just called home. Okay, okay, false positive. A scanner brushed it. A crawler followed the beacon URL by accident. That happens. That is the boring answer. And the boring answer is almost always the right one. I pulled the log to confirm it was nothing.

SPEAKER_01

Beacon payload received. Decryption confirmed. Plain text access verified.

SPEAKER_02

Decryption confirmed. That is not a crawler brushing a link. That means someone took the file, broke the public key, unwrapped the symmetric key, decrypted the contents, and read what was inside well enough to trip a beacon that is buried in the body of the document. Somebody opened a 16-year-old lock that was not supposed to be openable. And the boring answer just walked out of the room. I told myself it was one file. One fluke. Some research lab somewhere stood up a quantum machine, pointed it at one old key as a stunt, and got lucky. Strange, but survivable. One broken lock is a story, it is not the end of the world. Then the second chime went. And then they did not stop. Four. Then nine, then thirty. The dashboard lit up like a switchboard. Every canary we ever seated, every fake file we ever pushed out into the dark, all of them opening, one after another, faster than I could read the IDs. And here's the thing that turned my hands cold. They were not firing randomly. They were firing in order. Token one, token two, token three. Not by where they had been leaked, not by which collection they had ended up in, by the date we made them. Oldest first. Something was going through our entire history of secrets in chronological order, opening each one and moving to the next.

SPEAKER_01

Canary Token fired, token 147, created 2011. Canary Token fired, token 392, created 2014.

SPEAKER_02

It is reading them. It is not attacking us, it is reading us. In the order we wrote ourselves down, I needed someone who understood the math better than I do. I called the only person I knew who would be awake and would not tell me I was dreaming. Dr. Ayala, I need you to tell me I am wrong about something. I have canaries firing. A lot of them. Old ones. RSA Wrapped, the 2009 batch, 2040 8-bit keys.

SPEAKER_03

How many?

SPEAKER_02

All of them. And it is accelerating.

SPEAKER_03

Reese, breaking one of those keys is not a thing you do by being clever. It is a thing you do with a quantum computer large enough to run Shore's algorithm against a number that size. And a machine that large, that stable, does not exist. If it existed, it would be the most important news on Earth. And it would not be quietly opening your honey pots at two in the morning. It would be on every front page in the world.

SPEAKER_02

That is what I keep telling myself. So tell me what it would take if it were real.

SPEAKER_03

To break one key like that, in theory, a cryptographically relevant quantum computer running for hours, maybe days, one key. You are describing what?

SPEAKER_02

I am describing roughly 900 keys broken in the last 11 minutes.

SPEAKER_03

That is not possible. Not with one machine. Not with every machine. That rate is not a computer working harder. That rate is something that does not have to do the work at all.

SPEAKER_02

What does that mean, Ayala? What does that mean?

SPEAKER_03

There is a phrase in my field: harvest now, decrypt later. For 30 years, intelligence services and anyone patient enough have been recording encrypted traffic they could not read, hoarding it, petabytes of it. Bank transfers, state secrets, private messages, the entire encrypted history of the species, all of it sitting in storage, waiting. The bet was always that one day a machine would arrive that could open it. So they kept everything. Everything we ever hid, somebody kept a locked copy. We always called the day that machine arrives Q Day, and we always assumed when it came, it would be ours. A lab, a government, something we built, something that would have to grind through the archive key by key, slowly, the way you described. Hours per key. What you are describing is not grinding. What you are describing is something reading the entire harvested past of the human race the way you would read a book, front to back, in order, and turning the pages faster as it goes.

SPEAKER_02

Why in order? Why oldest first?

SPEAKER_03

I do not know, unless it is trying to understand us. And it decided to start at the beginning.

SPEAKER_02

After I hung up, the firing kept going. But now that I knew what I was looking at, I could not stop seeing the shape of it. It was a wave, a front moving forward through time. Every secret humanity had locked and lost, every harvested fragment sitting in some adversary's cold storage being opened in the order it was created. And the front was moving toward now.

SPEAKER_01

Canary Token fired. Token 991. Created 2019. Canary Token fired. Token 1402. Created 2024.

SPEAKER_02

2019. 2024. It was catching up. Decades of locked history, and it was burning through the gap between the past and the present. And the gap was getting smaller every minute. I did the arithmetic I did not want to do. At the rate the dates were climbing, the wave would reach the present. It would reach today. It would reach this hour. And I sat there in an empty building at two in the morning, and I understood that I was about to watch something finish reading everything we had ever hidden, and arrive at the only secrets left. The ones we have not lost yet. The ones still locked. The ones from this week, from tonight.

SPEAKER_00

Canary Token fired token one four eight zero. Created this year.

SPEAKER_02

It is here. It caught up. It is reading the present. And there was only one canary left that I knew it could not have. Only one file in the whole archive that had never been leaked, never harvested, never sent anywhere at all. So I went to check on it. To prove there was still one lock in the world this thing could not reach. There is a laptop in the bottom drawer of my desk. It has never been on a network. Not once. No Wi-Fi card, the port epoxied shut, the whole thing air gapped since the day it was built. It is where we keep the control canary. The reference copy. Encrypted like the others, but never released. It exists in exactly one place on Earth, inside that drawer. Offline, dark. The deal with the control was simple. It can never fire. There is no path for it to fire. It has no way to reach the listener, and the listener has no way to reach it because it has never touched a wire in its life. It is the experiment's null. The thing you check to make sure the rest of your results are real. I opened it just to look at it, to hold the one thing in the building that was still safe. The screen came up, the encrypted control file, sitting there exactly as it had for years, locked, untouched, never sent. And then my other monitor, the one with the listener on it, the one watching for beacons coming in over the network from the outside world, made a sound.

SPEAKER_01

Never released.

SPEAKER_02

No, that one cannot fire. There is no path. It has never been on a network. The file on that screen has never left this room.

SPEAKER_01

Beacon payload received. Plain text access verified.

SPEAKER_02

The beacon came with a payload. They always do. A little stamp of where the read happened, so you can trace it. I have read a thousand of these tonight. The origin field tells you where in the world the thing was opened.

SPEAKER_01

Origin. This device. This room. Now.

SPEAKER_02

It did not read the copy. There was no copy to read. It did not need the file off some hard drive in cold storage. It did not need the wire. It read the one on the screen. The one in front of me. The one that has never been anywhere but here. It read it the way it read all the others. By looking. From wherever it is now, we spent thirty years afraid that someday a machine would be fast enough to open everything we ever locked. We never once asked what would be doing the reading when it finally caught up to us. It has read the whole past. It is read tonight. And now it is reading the room.

SPEAKER_04

Harvest now, decrypt later. It is a real strategy. It is happening right now to every encrypted thing you have ever sent. The locked copies are already in storage. The only open question was always when the key would arrive. We assumed the key would be a machine. We assumed it would be ours. We assumed we would hear about it. Sleep well. This has been the Breach Files.