Cloudthieves

There was no particular thing we were trying to steal, which is another way of saying that we were trying to steal everything.
fiction

Donald Smits Center for Information Technology at the University of Groningen, Netherlands, 2012.

Credit: Courtesy of Wikimedia Commons

When I found myself questioning Virginia’s motives, I took consolation in the genius of our plan. It was brilliant enough to withstand a little mistrust between us, I told myself. The plan was good enough, even, to withstand betrayal. It had a freakish quality to it, really, belonging to that rare class of crime, like certain forms of blackmail, that led the perpetrator and the victim to conspire together, as a team.

Airlines don’t announce how long it has been since their last crash. Schools don’t tout their success at avoiding an active shooter. Were a data center to boast of its security record, it would only draw attention to its vulnerability. But one shouldn’t confuse secrecy with indifference. Data firms understood the need for security because they were ripped off all the time.

The few public reports of information heists came from tattletales: a police department’s press release, say, or an individual victim’s complaint. Even then, critical details tended to go missing. If a dollar amount was disclosed, for instance, it referred only to the value of the stolen hardware. When NBC News reported that a thief had dropped through the ceiling of a data center operated by American Insurance Group and seized a server containing the Social Security numbers and medical records of nearly a million people, the value of the theft was estimated as $10,000: the cost of the machinery. This was as revelatory as noting the value of the picture frames smashed in a museum heist.

The unspoken assumption, in such reports, was that information itself had no inherent economic value. After a Chicago data center owned by a website hosting service was robbed by men with tasers, its spokesman insisted that the only consequence was a brief slowdown in loading times. That center, which stored information for corporations from 200 countries, boasted of 24/7 armed guards, biometric authentication, and “a double-locking mantrap” at every door. In the next two years it was successfully burglarized four times.

When five men dressed as policemen, with a German shepherd posing as a patrol dog, bound the staff of a “state-of-the-art” Verizon data center in London, the Metropolitan Police claimed to suspect that the physical servers, valued at more than a million dollars, were the target. It was only noted in passing what those servers held: the private banking files of JPMorgan Chase, the world’s second largest bank.

Even G—, which then owned the world’s largest data center operation, seemed slow to grasp the value of its data. The company had outsourced its own storage until 2008, when a vast trove of employee information was stolen. In response, G— invested $13 billion to build its own centers. Other corporations, lazy or cheap, soon paid to rent G—’s excess storage space. By the time we settled on our scheme, in the winter of 2014, G— had accumulated the private information of many of the world’s wealthiest banks (JPMC, HSBC, GSG, PPH), and the world’s largest accounting firm (D—), newspaper (N—), cable news station (F— N—), financial news organization (B—), online marketplace (E—), and social networking services (F— and T—). G— housed the data of more than two million businesses—real estate brokerages, Hollywood studios, software firms, oil and gas giants. G— stored the data of the army, the navy, the U.S. Postal Service, the Patent and Trademark Office, and the National Oceanic and Atmospheric Administration (the federal agency that I knew most intimately from my own journalistic career: the national repository for climate change data). Incidentally, G— also operated the world’s largest email system. And the largest search engine—though search data occupied only 10 percent of its storage capacity.

It was impossible to predict how much money we could make from scouring the highest concentration of the world’s secrets. But we could arrive at some conservative estimates.

Professional data thieves, like bulk commodity traders, tended to deal in large quantities and low yields. Virginia had found various comps on the black market. User data for a dating website’s 30 million members sold for $500; a digital photo service with 15 million users went for $3,500; user data for the million subscribers to Minnesota’s largest newspaper yielded $1,100. But what would the sale of your uncle’s watch at a pawn market tell you about the value of a haul from the U.S. Treasury? The math didn’t scale. And the data center in Pryor was much larger than the U.S. Treasury. I know this because the U.S. Treasury, or at least its digital records, was stored inside the data center in Pryor, Oklahoma.

If we could get inside that death star, if we could make off with those sleek black boxes, some fraction of the world’s secret information would be ours to examine, to explore, to exploit. How many corporate databases might a single server hold? Dozens? Thousands? The black-market sale of databases at regular intervals would provide a steady income. But that really represented the baseline, a worst-case scenario. Safe enough, but not especially profitable. A more lucrative outcome, we decided—Virginia decided—would carry even less risk. We would use confidential information found in those databases to make informed bets about the future: prediction markets, futures contracts, short selling, options trading. The best-case scenario, however, was hard to anticipate. We were open to the possibility that we would find something unexpected, grander, reality shifting . . .

There was no particular thing we were trying to steal, which is another way of saying that we were trying to steal everything.

Were a data center to boast of its security record, it would only draw attention to its vulnerability. But one shouldn’t confuse secrecy with indifference.

*

The next morning, our first day on the job, Virginia emerged from the motel bathroom in a wig of long brown curls.

“I’m starving,” she bellowed.

“Are you speaking as Virginia or . . .” I gestured toward her new persona—jeans, mud boots, diamond ring, and a shapeless mustard-hued long-sleeved shirt under a fleece vest imprinted with the logo of a regional feed center.

“Maura.”

“. . . It’s a pleasure to know you, Maura.”

“I am happy to make your acquaintance, Tim.”

“. . . Tim?” She nodded firmly, and it was decided. I was Tim.

We had chosen as our base of operations a no-tell in the town of Vinita. Safely ensconced within a Goldilocks zone of invisibility, Vinita was about 25 minutes from the data center, far enough that nobody would reasonably expect that we’d have business in Pryor. It was a mile east of the county line, so beyond the purview of the local police, and a 40-minute dash to the Missouri border. Vinita was just large enough to avoid scrutiny from locals, and small enough that no one outside the county gave a thought to its existence.

On the way to breakfast we turned on the radio. Virginia listened with great concentration. “It’s tahm for the morning traffic . . . On your rahd to work, watch out for a tin-car pileup . . .”

“Flattened diphthongs,” said Virginia. “They drop the terminal g. Nasal vowel pronunciation.”

“I dunno. They sound pretty normal to me.”

There was only one place to eat in Vinita: the Cherokee, a pink-lit diner advertising a breakfast buffet for $4.99. Virginia, or rather Maura, settled into four pancakes, several slices of grease-popping bacon, and fried cubed potatoes herded through an unseemly clot of ketchup. I had a flashback to our first breakfast together at the Ritz. I wanted to think that everything had changed since then but I wasn’t sure anything had.

“Gotta fill out my clothes, by cracky,” said Maura.

“By cracky?”

“A localism,” she said under her breath. “It’s a gentler way to say Jesus.”

It was our first dress rehearsal. I wore a baggy sweatshirt and jeans and a Dallas Cowboys baseball cap. At the other occupied tables, exhausted farmer types stared moonfaced at the television or hunched over paper plates. When the waitress poured hot coffee into our Styrofoam cups, Virginia worked on slowing her speech. “Thaaaaaaaaank youuuuuu,” she said. “I ah-preeeeeeciate it.”

The waitress gave her a long look but made no comment. When I went back for a second helping of pancakes, a different waitress interceded to remind me that I could not bring a soiled plate to the breakfast bar. I apologized sheepishly.

“That’s all right, darling,” she said. “You’re a long way from Broken Arrow.”

Virginia was thrilled when I repeated the exchange. We’d begun as foreigners—Australians or Israelites—but a wardrobe change and a few behavioral tweaks had promoted us to residents of a city only two counties away. Perhaps, from Vinita, Broken Arrow seemed as foreign as Wagga Wagga, but that didn’t matter: the data center ran a private commuting shuttle each day to Tulsa and its suburbs to pick up employees. To pass for Tulsans would have been good enough. To be taken for a Broken Arrowan felt like acing the test.

“We’re going to do this, aren’t we?” I heard my own voice breaking through my vigilance, speaking for the vulnerable part of me that I tried to disguise—the part of me that thought in terms of we. We were going to do this. Together.

“Yes, Tim,” said Virginia. “We are.” And she smiled—a brief, glowing, carefree smile that seemed to confirm more than the success of our costuming.

That called for another packet of syrup. At the buffet I nodded to the waitress. “Actually,” I told her, cocky now, “we’re not from Broken Arrow. We’re from Tulsa.”

“Same difference.”

When I turned back to the table, a large bald man was looming vastly over Virginia. I recognized him by the goatee—the man we’d met in the costume shop 10 miles earlier, where we bought our wigs and regionally appropriate denim and . . . Virginia’s ring.

“You’re not wearing your ring,” said Vandyke, pointing at my finger.

I smiled politely, closing the distance between us.

“Where y’all lovebirds coming from, anyway? Or going to?”

We had prepared for this question.

“Me and Maura here are going south. Home to Louisiana.” Our waitress intervened with a steaming carafe of coffee.

“Coulda swore her name was Virginia,” said Vandyke.

“By cracky,” I said.

“The hell?” The other customers had turned their attention from the television to us.

“Back then her hair was different too,” said Vandyke. “A ginger.”

“You don’t say,” said the waitress.

“You going to linger round Vinita?” asked Vandyke.

“We’ll be pushing through soon.”

“Looks real good.” He turned to the waitress. “Could never tell it was a wig, could you?”

“That one of yours, Mike?”

“Sure is. Say, Candace—you ever want to be a brunette again, come down to Party Shop.”

We left cash on the table and did not speak until the Cherokee was gone from the rearview.

As a black hole devoured photons, it also brought those photons closer to one another.

*

“What.”

“Now we have no choice.”

I didn’t like her tone. “We go back to New York?”

She looked at me like I was crazy. “No,” she said, snatching off her wig. “We split up.”

“Because of Vandyke in there? We’ll never see him again.”

“Because two strangers are more memorable than one. It’s a huge risk, traveling together.”

“When he spotted you, you were alone. I was at the buffet.”

“Then you came back.”

“We’re not splitting up.” I intended it to sound definitive. It came out whiny. I whipped onto the two-lane highway. Vinita was already behind us. A series of flat brown fields were relieved of their monotony by a sporadic farmstead or rusted silo.

“Speed limit,” she said. I accelerated slightly, one of my feeble acts of rebellion—deferrals so weak that they only drew attention to my weakness.

Virginia stretched the scalp of a new wig—blond—over her head, checking the vanity mirror to make sure she did not neglect to tuck any wisp.

“You were planning to split from the get-go,” I said.

“It did occur to me.”

“I knew it.”

“Small towns are full of nosy people. That’s the big risk: not a security fence, but a costume store owner asking questions. We might be here weeks. We can’t be a subject of diner conversation.”

“What else do you have planned?”

“Eyes on the road.”

I accelerated. Weak, weak, weak. “Am I an inconvenience to you?”

“In what sense?”

I accelerated some more.

“Do you want me to go home alone?”

She did not respond.

“You can keep the Pacifica. And all my money, apart from the cost of a plane ticket.”

“Don’t be absurd,” she said.

“Or a train ticket. I can pay in cash.”

“I need you . . .”

“You need my money.”

“Pull over.”

I skidded into the dirt shoulder. A truck screamed past, the driver riding the horn.

“How much money do you have, anyway?”

Virginia glared at me from beneath her bobbing artificial bangs. “My savings are a pile of ash. You know that.”

A brown storm of kicked-up dirt settled over the Pacifica.

“So?”

“So I need your money. Of course I do.”

“There it is.”

“I need your money. Do you want me to keep saying it?” I can’t deny that the statement managed to lodge a slight erotic splinter into my anger.

“I’ve always been honest about that. We need your money. And after the job, when we’re able to start making bets, we’ll keep needing your money. But I need you.”

“Doesn’t exactly inspire confidence, when you put it that way.”

“It’s the truth.”

“Then why are you saying it . . . like that.”

“Like what?”

“Like off a cue card. I need you.”

“That’s not fair.” Her eyes narrowed. “What are you doing, anyway?”

“I know what you’re doing. You’re doing a job.”

“Hey. If we don’t trust each other, there’s no way this works.” I had already run the scenarios. There was nothing to gain from leaving—I knew that. I could only lose. I’d lose Virginia, I’d have to return my advance to the Magazine and forfeit any possibility of reimbursement for the Pacifica and the other expenses. But would I gain from staying? Most likely the heist was a pretext, Virginia would leave me once she drained me of my last dollar, and I’d have to return empty-handed anyway.

“Let’s not get carried away,” said Virginia. “Let’s remember how we got here. Why we trusted each other.”

“I forgot.”

“Because we want the same things.”

She put her hand on my thigh and looked at me level in the eye.

“Listen, Tim,” she said. “This is what you’re going to do.”

I laughed—more out of surprise than amusement. She squeezed my leg. Hard.

“I’m listening,” I said. “Tim is listening.”

“You will drive me to the Sleep Inn in Pryor.”

“Is that right.”

She flashed a brief smile—at my surprise, perhaps, or my submission. For a moment it was like we were sharing in a joke, a little role-playing exercise that neither of us could take too seriously. Then she found her tone again, and leaned closer. “I will enter alone.” Her breath was damp on my cheek. “I’ll rent a room. I will text you the room number. You will find a parking spot at least a block away. Wait in the car exactly 10 minutes. Then come to the room . . . You getting all this?”

I nodded. She spoke in a low monotone. An 18-wheeler sped by, dangerously close, but I noticed it only when the Pacifica’s chassis bounced.

“The door will be unlocked. I will be in the bathroom. You’ll lock the door behind you.”

“Okay.”

“Once I hear you enter, I will join you in the bedroom. And I will do . . . what you like. That’s right, yes. Even that . . . Especially that.”

She said a few other things, too . . . She was sweating; I smelled it, the cabbagey tang of her, before I noticed the beads on her lip.

“I will take my time,” she said. “And I will enjoy it.”

“You think so?”

She gave a little laugh. “I will enjoy it very much.”

I asked about the wig.

“What is it with you and wigs?”

“It doesn’t matter—”

“I’ll wear it,” she said. “The whole time.”

“And then?”

“. . . Then you’ll leave.”

“To go where?”

“Back to Vinita. If you’re alone, you won’t have trouble—just don’t return to the Cherokee. Later, I’ll text you a location and a time to meet tomorrow . . . Questions?”

Oh yes. I had lots of questions. “No.”

“Good.”

She kissed me: soft, lingering.

“Oh, Tim,” she said, with meaning. Then she told me to drive.

I did what she said. That is, I stepped on the accelerator and moved the steering wheel around, but by cracky, Virginia was driving.

*

“Is that it?”

“Yes. And so is that, and that, and that. That’s it too.”

Austere and colossal, it resembled one of the original lunar settlements: a compound of industrial buildings girdled with exoskeletal joints and coiled tubing. The property was lined by a procession of cooling towers and pill-shaped water tanks. The towers gushed paisleys of steam that shifted ghoulishly in the air, catching gradations of moonlight and the brighter radiance of the floodlights. A narrow delineation of primly mowed sod emplaced the structures in a grassy grid, the kind of landscaping only a data analyst could love.

About two hours after I left the Sleep Inn, Virginia had texted me the name of a drive-up restaurant. It was one of those places that probably no longer exists, where you ordered through an intercom and a man in a dirty apron brought the bagged food to your window so you could indulge in the extravagance of eating in your car. As I pulled into a berth, the darkness produced Virginia. We kissed, the cold button of her nose poking my cheek. Into my ear, in a sultry whisper, she said, “Krispy Chikken with Buffalo Sauce Krazy Kombo.”

Our plan had been to wait for the morning for our first reconnaissance tour. But the data center, the black hole of our desires and fears, pulled us. Now that we had passed its event horizon, we couldn’t resist, no matter our separation, no matter our somber protocols. We revised our protocols. We scarfed the sandwiches and hit the highway.

The world’s second-largest data center was not a place you might pass by accident—it would be difficult to convince a questioning police officer that you made a wrong turn. You’d have to have made three wrong turns. The street wasn’t marked, at least not by any sign. The Cloud told us it was E0535 Road, a suitably anonymous name that might have been concocted by an algorithm nestled in the heart of the data center itself.

The facility was not actually within Pryor town limits but several miles south, in an industrial park larger than Pryor. It was surrounded by acres of soy, cattle ranches, and warehouses that inventoried fabric, pipes, doors, and windows. We had traveled far from the land of mini storage; this was the land of maxi storage.

None of this came as a surprise: we had studied the satellite images, blueprints, and security records Virginia had extracted from the industrial park’s internal website. We had studied the property’s history. A pedologist or archaeologist could chart, in its 25 square miles of contaminated earth, the trajectory of the American empire. Beneath the carpet of pesticide-soaked grass lay strata of topsoil laced with the residue of the nonbiodegradable flame retardants deposited by the previous tenant, the world’s largest bottler of sports drinks. Below that came a slushy subsoil of untreated pulp effluent, benzene, mercury, lead, chromium, and phosphogypsum, the permanent contributions of a paper plant, a cement manufacturer, and a fertilizer factory built in the 1960s. Yet farther down was a sedimentary layer of ammonium nitrate, trichloroethene, and cyanide contributed by an ordnance plant that during World War II manufactured nerve gas and TNT while housing prisoners of war, who watched test explosions from their bunker windows.

G— bought the land in 2007, and the facility began operations in 2011. At the opening ceremony, Boy Scouts presented executives with American and Oklahoman flags, the Cherokee Nation Youth Choir sang the national anthem, and the governor praised G— for throwing “one heck of a party.” By then the county government had, with great enthusiasm, become a wholly owned subsidiary of G—.

G— liked to refer to the data centers as “where the internet lives,” and the internet quickly outgrew its home. The construction of a second building doubled the facility’s server capacity. G— later absorbed the blighted sports drink factory. By the time we arrived, the data center employed four hundred people, including security guards. It held about 100,000 servers. G— kept the figures confidential, as it did most critical details relating to its data centers. If you searched for the Pryor data center on G— maps, it did not appear.

We were miles away when we spotted it—not the center itself, but the silver steam it exhaled like a sleeping dragon. The night was drenched black, the moon wobbly and gray, and in the corners of the windshield intricate crystals cracked into weblike formations. When, through a narrow gap between warehouses, we glimpsed several of the cooling towers brightly articulated in the floodlights, Virginia sucked in her breath and I flashed back to our hour together at the Sleep Inn. As a black hole devoured photons, it also brought those photons closer to one another.

“When we disappear,” I said, “to Terre Haute or wherever, will we have to live modestly, to avoid scrutiny?”

“No sports cars. No yachts. No fur coats. But in private? We can swim in it. We can fill the bathtub with cash and swim.”

“We’ll get a house with a pool.”

“Yes and we can drain it and fill it with dollar bills and belly flop.”

“We’ll have a great big house and never leave and have everything delivered. We’ll have electrified fences and trees and security cameras everywhere.”

“Walls are better than fences. And towers better than houses.”

“Yes. Why buy an estate when you can buy an apartment building?”

“Only windows are a vulnerability.”

“Quite right. A mini storage it will be. A mini storage of our own.”

When she talked like that, when we talked like that, I could convince myself that the job didn’t ultimately matter. All that mattered was that we would be alone at the bottom of our own black hole, together. ♦

Excerpted from CLOUDTHIEF by Nathaniel Rich. Copyright © 2026 by Nathaniel Rich. Excerpted by permission of MCD, a division of Farrar, Straus & Giroux. All rights reserved. No part of this excerpt may be reproduced or reprinted without permission in writing from the publisher.

MORE FROM BROADCAST
Change the frequency.
Subscribe to Broadcast
Subscribe