In late 1997 the story lines at NDS Operational Security were starting to tangle up. In 1996 NDS chief executive Abe Peled had faced a piracy problem that could kill his business. He had made the decision to set up his own security unit to fight the pirates who hacked and then sold their own versions of the NDS smartcards used by BSkyB and the big US satellite broadcaster DirecTV. These pirate smartcards meant anyone could watch the BSkyB and programs for free
He had hired Reuven Hasak, the former deputy head of Israel's internal security agency, Shin Beit, to run it. Hasak had hired Adams as European Security chief, and a former US Army intelligence officer, John Norris, for North America. They had arrested a string of pirates and hired some of Europe's best hackers, including Oliver Kömmerling in Germany, whose NDS codename was Alex.
At some point the mission had changed. Hasak and Peled had set up a Black Hat team in Haifa, which had been trained by Kömmerling to reverse engineer, or hack, NDS smartcards in the sophisticated lab he had helped them set up in Haifa. The theory was that Oliver and the Back Hat team would help show up weaknesses in the NDS cards. But by late 1997 the target for the Black Hat team had changed.
The decision had been made to reverse-engineer the smartcards of their competitors. But even with Oliver's help, doing this would not be simple. The first problem was to get hold of samples of the cards—blank ones from the manufacturer first of all, to practise on; then actual cards issued by the pay-television companies.
Adams emailed Oliver Kömmerling early on Tuesday, October 21 1997: 'Give me urgently a description of all the chips we want as samples.' Oliver replied with the specs on the Wednesday afternoon, October 22. What they needed was the card used by Canal Plus for its Seca card, plus the card then being used by Nagra. This was all very mundane, except that organising the wherewithal to hack NDS's competitors was unfolding right at the same time as NDS had decided to send Oliver on a mission. At the same time as he was orchestrating one of the biggest reverse-engineering events in history, Oliver was going undercover in Toronto.
It was called Operation Duck. It was Ray Adams' idea and, given the timing, it was perhaps the silliest thing that NDS had done to date. As with so much that would happen in the Murdoch empire over the next decade, it only made sense if those involved believed they would never be called to account.
The smartcards that NDS made for the huge US broadcaster DirecTV had been widely pirated. NDS agents would pose as pirates themselves in an attempt to find a major Canadian pirate ring. The problem that no one foresaw was that NDS never told DirecTV about its undercover operation, and DirecTV believed that Oliver was still a pirate.
Oliver (or Alex as he was known at NDS) and Vicky flew business class from Frankfurt to Heathrow and then to Toronto, arriving on Tuesday evening, October 21. They were joined in Toronto by John Luyando, a wheeler dealer in piracy circles who had worked with Oliver in the past. His NDS codename was Jellyfish and NDS's US security chief, John Norris, had a great scorn for him. The prize that Kömmerling was offering to pirates in Canada was a hack for DirecTV's P2 card. He had called one pirate dealer, Ron Ereiser, about it but Ron already had his hack, thanks to his Bulgarians, Plamen Donev and Vesco.
Back in August Oliver had spoken on the phone for almost an hour with Marty Mullin, a big piracy dealer in eastern Canada. Mullin would later testify that Oliver offered him a hack for EchoStar (the other big US satellite broadcaster), but Oliver denies this.
The goal of Operation Duck was for Oliver to program some DirecTV cards for local dealers and use this as a stepping stone to get to Mullin, who was one of the two biggest piracy dealers in North America. Mullin had his own hack for P2 cards and NDS dearly wanted to know who Mullin's hacker was.
By October 25 Oliver had been in Toronto four days and had programmed a swag of pirate cards, using a program he had ripped off another pirate hack. And he had been paid a lot of money. That evening, he met with two piracy dealers in a car and programmed a few cards for them with his portable programmer box, to demonstrate that it worked.
The following night Oliver received a call from a friend in London, a partner in his old piracy ring, who was sleeping with a woman who worked for Federal Express. 'He told me, these guys [from the previous night] sent a parcel to Larry Rissler,' Oliver recalls.
Rissler was a former FBI agent who headed the Office of Signal Integrity—the operational security division—of DirecTV, and he had been hunting Oliver for some time. One of the dealers Oliver had met was a Rissler informant and he had despatched a re-programmed smartcard by FedEx to his boss. The parcel would be with Rissler early the next morning—if it wasn't already there.
Oliver hit the alarm button. He booked out of his hotel with Vicky and Luyando and took a cab ride in the middle of the night twenty miles to the US border, crossed it and booked into a motel on the other side, along the southern Lake Ontario shore. But this was the wrong move because, while piracy might not be illegal in Canada, in the United States you did jail time for it. Forty-five minutes later, Ray Adams called. He said they had to get out.
In Los Angeles, Larry Rissler had already picked up that Oliver was heading into the US. He had entered Oliver's name in the US Customs database, flagged him with a Search and Detain order. For Rissler, Oliver was a glittering prize. For years he had been Enemy Number One for DirecTV, the man who consistently hacked and broke their cards for the pirates. He had no idea that Oliver was working for NDS, or that NDS would not tell him about something like this.
Now it was only a matter of time before Oliver was picked up. But here, in his moment of triumph, Rissler made a mistake. He made a courtesy call to John Norris, to let him know what was happening. It would have been hard not to show a little satisfaction that DirecTV had beaten NDS to the punch.
Norris said it was wonderful news. He didn't tell Rissler that Oliver worked for NDS, or that this was an NDS undercover operation. He just put down the phone and sent an urgent message to Adams, who then got on the phone. 'Adams phoned and told me to go—go quickly,' Oliver said. 'So I had to wake up Luyando, and tell him, “Come, we have to leave.”'
Then the three of them – Oliver/Alex, Luyando/Jellyfish and Vicky - left everything behind in the motel room—computer equipment, money orders, clothes—as they headed south and east, away from the border. They booked into another motel, only to panic when they saw police cars go by. They were back on the road, looking for a new place to hide.
'We did that twice. In the third motel we paid cash.'
Oliver was continually on the phone to Adams. He hadn't even touched the smartcards, he said, so there were no fingerprints. He hadn't personally programmed the card, even if it was his decoder the Canadians used to do it. And even if there was a print or a DNA trace of some kind, there was no continuity of evidence to say it was the card that Alex's decoder had programmed.
Adams was continually emailing Hasak in Jerusalem. It wasn't even a criminal offence to re-program cards in Canada, he said. A good lawyer should get him off. Adams argued with the desperate eloquence that graces a man who is fighting not just for his agent, but for his own job. This was a tricky situation that required managing, he said magisterially. Of course it seemed completely clear that this whole mess was the fault not of Adams, but of his colleague John Norris, who had alerted them to the airports alert that Rissler had put out.
'I am well ware of these provisions and know better than anyone their strengths and weakness,' Adams emailed furiously. 'A stop and detain alert is really a pathetic provision. It means that we have no evidence against this person ONLY suspicion so please stop him and if he has anything with him detain him and let us know.'
The arguments went back and forth as they struggled with the logistics of getting Alex out of North America. It would have to be from an airport with low security, and not a direct flight to Germany. From Jerusalem, Hasak hosed Adams and Norris down when the infighting grew too ugly. In Norris's view, this operation to make contact with pirates had been Adams' bright idea, riding roughshod over the North American operations. Now the blame was all Adams'. Norris had always been contemptuous of Rissler at DirecTV. 'He's a nice idiot,' Norris had told Oliver before the operation. When he was really snitty, Norris called Rissler a speechwriter. But the worm had turned.
'The only possible evidence that could ever have existed to connect Alex to the card was what was on his PC,' Adams later wrote to Hasak, reviewing the episode. Adams had Oliver/Alex reformat the drive and then disassemble the laptop into two parts, each of which was posted by two different courier companies to two different addresses in Germany. But Oliver still had to walk through those airport gates.