Blog

Before Robert Boback got into the field of cybersecurity, he was a practicing chiropractor in the town of Sewickley, Pennsylvania, twelve miles northwest of Pittsburgh. He was also selling used cars on eBay and flipping houses purchased at police auctions. The decision to branch out into computers came in 2003, after he watched a “60 Minutes” report by Lesley Stahl about pirated movies. For years, while digital piracy was devastating the music industry, Hollywood had largely been spared; limitations on bandwidth curtailed the online trade in movies. But this was changing, Stahl noted: “The people running America’s movie studios know that if they don’t do something, fast, they could be in the same boat as the record companies.”

Boback was thirty-two years old, with a Norman Rockwell haircut and a quick, smooth, entrepreneurial manner. Growing up amid the collapsing steel industry, he had dreamed of making it big, hanging posters of high-priced cars—a Lamborghini, a Porsche—on his bedroom wall and telling himself that they would one day be his. After high school, he trained to be a commercial pilot, imagining a secure, even glamorous, life style—but then the airline industry began laying off pilots, and he switched to chiropractic, inspired by a well-off practitioner his family knew.

Watching “60 Minutes,” Boback saw a remarkable new business angle. Here was a multibillion-dollar industry with a near-existential problem and no clear solution. He did not know it then, but, as he turned the opportunity over in his mind, he was setting in motion a sequence of events that would earn him millions of dollars, friendships with business élites, prime-time media attention, and respect in Congress. It would also place him at the center of one of the strangest stories in the brief history of cybersecurity; he would be mired in lawsuits, countersuits, and counter-countersuits, which would gather into a vortex of litigation so ominous that one friend compared it to the Bermuda Triangle. He would be accused of fraud, of extortion, and of manipulating the federal government into harming companies that did not do business with him. Congress would investigate him. So would the F.B.I.

But as Boback was watching “60 Minutes” all he saw was a horizon of possibility. Stahl pointed out that pirated music and movies were spreading primarily on peer-to-peer networks—an obscure precinct of the Internet that was sometimes called the Deep Web. The networks were made up of hundreds of thousands of decentralized connections, in which one computer was linked to no more than five others, and then through those five computers to many more, expanding exponentially like the branches of a large tree. These connections were invisible to search engines like Google. Even the software that allowed users to browse them had only a limited field of vision—glimpsing just random fragments of the tree at a time. Boback wondered if it was possible to design a system that could scan the whole tree at once, then block people from sharing files on it. Certainly, this capability would be worth a lot.

Boback had no idea how to build such a thing, but he knew someone who might: a patient of his, Sam Hopkins, whose girlfriend had persuaded him to pursue chiropractic treatment after a car crash. Hopkins was in his thirties, too. He was soft-spoken, with a childlike disposition, a wispy physique, and a goatee. He had grown up in inner-city Pittsburgh, in a home where money was scarce. As a boy, he had taught himself how to program on a Commodore 64 that was on display at Sears. Bored with school, he dropped out, and built an Internet-service provider, which was sold to a local telecom company. By the time of his car accident, he was designing high-speed computer networks for Marconi Communications.

When Hopkins came in for treatment, Boback explained his idea, and after some thought Hopkins said that it could be done. At that time, the most popular peer-to-peer software was a free application called LimeWire. When a user searched for a file—say, an MP3 of “Hey Ya!”—LimeWire sent a query to other users asking for it. If the file turned up, this meant that someone had designated it for sharing. The main peer-to-peer network limited the number of computers a person could search. But Hopkins told Boback that the limitation could be overcome with a system that scattered virtual users, or “nodes,” throughout the network—in effect emulating many, many copies of LimeWire running simultaneously. With enough nodes, the whole network could be seen.

That Christmas holiday, Hopkins locked himself in a room to program, and in a couple of weeks built a rough prototype. Even though it could maintain only a small number of nodes, data flowed through it in a torrent. The system could track the search terms that thousands of users were entering—offering unique insight into what was in demand, half clandestinely, on the Deep Web. The terms filled the screen so rapidly that Hopkins had to program a “decelerator” to slow them down. Watching the words race by, the two men began to suspect that they had genuinely struck it big.

By the end of the year, Boback and Hopkins were sitting in the well-appointed offices of a Pittsburgh law firm that specialized in intellectual property. The attorneys were optimistic. Rather than charge billable hours, they offered to work for ten per cent of the proceeds when the system sold. One said that the deal could be worth fifty million dollars. With the firm’s help, Boback and Hopkins formed a corporation. Hopkins came up with its name, Tiversa, a portmanteau of “time” and “universe.” It was also an anagram of veritas: Latin for “truth,” but scrambled.

Boback is a storyteller. Words pour out of him in cascades that, depending on the listener, can register as beguiling, slick, questionable, or bullshit. One colleague described him as “very confident, sometimes bordering on cocky.” Another told me, “He was a master manipulator. Watching him was like watching van Gogh use oils.”

As Boback began marketing his system, he landed a big meeting with lawyers representing the Recording Industry Association of America, but the lawyers said they already had a strategy to combat file sharing: sue the problem into oblivion. Undeterred, he and Hopkins flew to Los Angeles, where they met with Darcy Antonellis, the head of anti-piracy efforts at Warner Bros. The studio was gearing up to release a summer blockbuster, “Troy,” an epic in the mold of “Ben Hur,” rumored to have cost almost two hundred million dollars. A screener had already leaked, and, during the meeting, Boback strove to convey how much money Warner Bros. was losing: in his hotel room beforehand, Hopkins had added to the software a digital counter that appeared to track downloads of “Troy,” tabulating a fifteen-dollar loss with each one. Boback explained that the system, which he was calling Media Spy, could be designed to jam the activity. Antonellis listened patiently, and then said that it seemed too good to be true. She meant it literally. Such an intrusion would require Warner Bros. to block people from posting files at the point of their computers, which she suspected was legally impossible.

After the meeting, Boback’s lawyer mentioned that a partner in his firm knew Orrin Hatch, the chairman of the Senate Judiciary Committee, who had spoken out against pirated music and movies. Perhaps, if Hatch gave his imprimatur to the system, the concern about its legality could be overcome. That May, Boback and Hopkins drove to Washington with another lawyer in the firm, to meet with Hatch in a conference room in the Hart Senate Office Building. They brought a laptop and made their pitch, as Hatch listened with polite interest. While wrapping up, they explained that their system could track not only music and movies (the vast bulk of the content on peer-to-peer networks) but anything else that people were sharing: documents, spreadsheets, PowerPoint decks. Some of those items appeared to have national-security implications, so Hopkins had created a second user interface for the software, called Patriot Spy. Boback shared a few examples of what the system had found, including files belonging to a person in Australia who had jihadi literature and bomb-making manuals.

“Stop what you’re doing,” Hatch said. He led his guests to his office, seated them in faux-leather chairs, and commanded an assistant, “Get me George Tenet.” Within a few minutes, the director of the C.I.A. was on speakerphone, and Hatch was telling him that, if the agency did not have the capability he had just witnessed, then it should. Boback and his colleagues looked at one another in disbelief. By the end of the call, Tenet had invited them to visit the C.I.A.’s headquarters, in Langley, Virginia, first thing the next morning.

Unprepared to spend the night, Boback and the others bought clean underwear and toothbrushes, then tried to find a hotel in D.C. They were laughed out of a downtown Marriott, and eventually landed in a tumbledown joint on the city’s outskirts. Still, they were giddy. If the C.I.A. wanted to buy their system, then Hollywood could wait.

In the morning, they pulled up at the front gate of Langley and explained that they had an appointment with the head of the Directorate of Science and Technology. They were sent to the Original Headquarters Building, but Boback made a wrong turn and the car was soon surrounded by security personnel, their weapons drawn. A guard warned them to leave immediately. “Do you understand?” he screamed. Boback, unsure whether the guard meant the road they were on or the entire property, rolled down the window. “No,” he said. “Can you explain it to us?” The other passengers were terrified, but Boback was unfazed. As he turned the car around, he said, “We got to get in here. It’s the meeting of a lifetime! ”

Inside, the head of the Directorate of Science and Technology was joined by an official representing In-Q-Tel, a corporation that the C.I.A. had set up to fund new technologies. (The “Q” refers to the technician in James Bond films.) A follow-up call from one of the participants led to more trips to D.C., and suddenly Boback and Hopkins were journeying through the shadow world of the post-9/11 national-security establishment.

There were visits with the F.B.I. and the military. They returned to Langley, to meet with another enthusiastic official, who introduced himself only as Bad Bob. The agency also instructed them to go to a Starbucks in Reston, Virginia, from which a C.I.A. officer would convey them to a secret facility. The officer drove them for several minutes before arriving at a large building, where they gave a presentation in a packed room. One audience member asked if they were prepared to sell, and, as they headed back to the car, the officer pressed them to name a price. Hopkins said, “I’m thinking two billion dollars,” which prompted laughter, and some advice: sell your technology to a large contractor, like Raytheon; don’t deal with the government yourself.

On the drive back to the Starbucks, Boback asked what prevented the C.I.A. from simply stealing their technology. The officer told them, “If you weren’t an American citizen, I would have already stolen it—and, oh, you have a connection to Senator Hatch.” The offhand comment sent a jolt of paranoia through Boback and Hopkins, who began to refer to their laptop as “the football”—the White House term for the briefcase that allows the President to access the nuclear codes. They decided to secure the software. At the time, Hopkins lived on thirty-eight acres that he had converted into a makeshift wildlife sanctuary. He burned the code to a DVD, and then walked out and buried it.

The more that intelligence operatives expressed an interest in the technology, the more Boback sought to prove its value. He and Hopkins renamed the system EagleVision X1—a reference to the “X1” markings on some classified files. When Boback saw an apparent spike in searches containing “Chechnya” and “jihad,” he let Bad Bob know. When he saw a file suggesting that an attack might be imminent in Egypt, he told a congressman.

EagleVision X1 had been designed to comb the peer-to-peer networks using search terms that Hopkins set for it. But, as Boback tried to market the software, Hopkins worked to improve the system, so that if it had a hit on a search term then it would automatically pull down everything else that was being shared on that computer. New material flooded in. EagleVision X1 found a document in China belonging to the F-35 Joint Strike Fighter program. It also pinpointed a man, about an hour from President George W. Bush’s Texas ranch, who was sharing files about sniper rifles and photos of the President’s daughter. Boback notified the Secret Service, and early the next morning agents turned up at Boback’s home.

At first, Boback assumed that anyone who willingly shared this kind of information must be engaged in some kind of illicit trade. But, as Tiversa’s system vacuumed up more examples, he learned that there was a surprisingly benign reason. LimeWire and its competitors were confusingly designed, causing people hunting for music to open up their hard drives—inadvertently designating sensitive files for sharing on peer-to-peer. In pursuit of a free MP3, jihadis and federal contractors, soldiers and diplomats, executives and celebrities were doxxing themselves. Because the people who used LimeWire were looking almost exclusively for music, this mass exposure had gone largely unnoticed.

Despite Boback’s hustle—or perhaps because of it—he struggled to sell EagleVision X1 to the C.I.A. With the chance of a big payout receding, Boback thought that perhaps the technology would be easier to sell if he built a business around it. So, in 2005, he met with a Pittsburgh financier, who agreed to invest seed money to elevate Tiversa from some lines of code into a startup. The investor recommended that Tiversa focus on corporate clients; they could bring in agencies like the C.I.A. later.

Boback rented office space in a Pittsburgh suburb, and took on his first full-time employee, a Wharton graduate, who started trying to bring order to his vision. The two clashed. In 2005, no one at Tiversa was taking a salary, and, to stay afloat, Boback spent much of his time at his chiropractic practice. (In addition to seeing patients, he had to fight to keep his license: the Pennsylvania Board of Chiropractic briefly suspended it, because he was unable to prove that he had completed an education requirement.) When Boback was in the office, his freewheeling style was often at odds with normal business practice. He admitted to me that, early on, Tiversa installed phony computer towers—plastic shells with blue lights “that literally did nothing”—to give visitors the impression that his software required more powerful hardware than it did. Sometimes he inflated the number of his employees, by having friends occupy desks in the office. Tiversa’s early literature referred to its Pennsylvania office as its “World Headquarters.” (The company had no other facilities.) “We had no credibility in the space,” Boback told me. “We wanted to make it look as good as we could.”

In 2006, a more significant investor signed on: Adams Capital Management, named for its founder Joel Adams, a Pittsburgh venture capitalist. Several years earlier, Adams had put his money into a scrappy startup that marketed laser technology, and later it sold for more than a billion dollars—a “unicorn,” in investor parlance.

Adams Capital invested more than four million in Tiversa, and helped secure an all-star board of advisers. Maynard Webb, the former eBay executive and chairman of Yahoo!, joined, and he brought on other executives from Silicon Valley. Howard Schmidt became an adviser, and soon afterward was appointed the cybersecurity czar for the Obama Administration. General Wesley Clark, the former Supreme Allied Commander of NATO, came on, and developed a good rapport with Boback, who sold his practice to devote himself to Tiversa full time.

Tiversa’s prominent supporters quickly helped Boback assemble an impressive client list: Capital One, Lehman Brothers, Goldman Sachs, American Express. The companies were paying for a monthly monitoring service, in which Tiversa scanned for breached corporate information, or the personal data of top executives. By this time, EagleVision X1 could access more than a million users, and its capabilities were expanding. Because peer-to-peer networks were constantly in flux, as people turned their computers on and off, Hopkins had designed a stable repository for the system, which became known as the Data Store. EagleVision X1, programmed with search terms that were set for clients (for instance, “Lloyd Blankfein,” for Goldman Sachs), would scour the networks, then deposit what it found in the Data Store. Each file was labelled to indicate when it was downloaded and what I.P. address it came from, so that its behavior could be tracked—if it remained in the same location, or if it was being shared, or if it suddenly vanished.

As the company matured, Boback created an “ops room,” where Tiversa analysts probed the Data Store for files related to clients. Over time, the room evolved to resemble a set from “The Bourne Identity”—a darkened space with electric-blue lighting, a window that could be triggered to go opaque, and a retinal scanner at the entrance. Tiversa’s analysts took special care to see if any files appeared to be “spreading”—passing from user to user, out of the company’s control.

American Express had the largest contract, paying a monthly fee of about seventy-five thousand dollars. Once the money began to flow, Adams Capital valued Tiversa at seventy million dollars. Along with the revenue, the company began to gain attention. In 2007, the House Committee on Oversight and Government Reform scheduled a hearing on inadvertent file sharing; it invited Boback to testify, and he asked Wesley Clark to join him.

To prepare, Clark asked if there were classified documents on the Deep Web. Boback pulled up two hundred marked “SECRET,” including information about lifesaving technology to neutralize radio-controlled bombs. Clark notified an intelligence official in the White House, who noted, with alarm, “They’re in full color!” A week before the hearing, Boback contacted Clark to report that Tiversa had located records pertaining to the Defense Department’s network for handling classified material. They were on the home computer of a contractor who was using LimeWire.

At the congressional hearing, Clark brought up the tranche of records, calling it “sort of a hacker’s dream,” though no one, of course, had hacked them; they were just sitting there in public view. He also emphasized that potential victims often had trouble understanding the issue. EagleVision X1 had found a contractor’s threat assessment of American cities—a catalogue of weak points that an enemy might attack. “We immediately contacted the contractor, and the city,” he said. “They denied the problem. They don’t understand what has been leaked.”

Seated beside Clark, Boback gave an expansive list of what a motivated searcher might find: “Federal and state identification, including passports, driver’s licenses, Social Security cards, dispute letters with banks, credit-card companies, insurance companies, copies of credit reports.” The documents, he alleged, had been harvested in Pakistan, Africa, and Eastern Europe, from foreigners who were “grabbing this information.” Only a few years earlier, he was fixing lumbar problems and selling cars on eBay. Now he was explaining to the country’s top lawmakers, “This is the new threat to information security.”

At about the time that Boback and Hopkins realized that governments and businesses were hemorrhaging information on the Deep Web, so had another man, living thousands of miles away. Richard Wallace grew up in rural Idaho, among family members who struggled with addiction. His mother’s life was consumed by pills, and two siblings would eventually die from overdoses. In a chaotic home, he developed the habit of helping people around him. After high school, he moved to Spokane, to train as a firefighter. There, he met Amy Speelmon, an R.O.T.C. student at Gonzaga University, and they were soon married. After 9/11, Amy deployed to a garrison in Germany. Wallace put firefighting on hold and joined her.

In Germany, Wallace strove to find his place. He was too independent-minded, too odd, to thrive as a military employee. But he was inclined to serve, and when his skills were acknowledged—particularly by people with authority—he was eager to please. Wallace volunteered to oversee the personal effects of soldiers killed in Iraq and Afghanistan. It was grim work that no one else was enthusiastic about doing, and he was commended for it.

To relax, Wallace often turned to his computer. Before moving, he and Amy had been watching “The Sopranos,” and at the garrison he began to hunt for pirated episodes. Exploring the Deep Web, he found that many members of the armed forces had downloaded peer-to-peer file-sharing programs, and were inadvertently exposing files: records of troop movements, accounts of I.E.D. attacks, and intelligence summaries. He helped the military identify which computers were leaking.

In 2004, the Wallaces relocated to western Illinois, where Amy worked as an R.O.T.C. instructor. Rick stayed home with their children (they eventually had five), and farmed, a little. He also kept his head in his computer. He had exploited a loophole in LimeWire that allowed him to crawl across the network, a solitary digital explorer. He sent the military more tips, and began to warn civilians about breached files, too. A neighbor suggested that he channel his expertise into a business, but entrepreneurship wasn’t in his nature; he was a volunteer. When Hurricane Katrina hit Louisiana, he drove down to assist FEMA and spent weeks helping to sort out the wreckage.

Wallace never asked for payment from the people he warned, and, perhaps as a result, they were often suspicious of his motives. To give his efforts legitimacy, he created a Web site, seewhatyoushare.com, where he blogged about his work. He sent some items to Matt Drudge and Michelle Malkin, conservative pundits he admired, and he says that they responded gratefully. Eventually, he caught the attention of Thomas Sydnor II, a former Senate staffer who had sat in on Boback’s meeting with Hatch. Sydnor had gone on to work at the Patent and Trademark Office, but he remained interested in inadvertent file sharing, and began checking in with Wallace, whom he considered one of the few people who understood the dangers.

Peer-to-peer networks were awash in child pornography, and Wallace had been issuing warnings on his Web site. Sydnor told him to stop trying to track such images, because possessing them is a crime, no matter what the reason. Sensing that Wallace could use a more structured outlet for his work, he mentioned him to Boback. Annoyed, Boback told Hopkins, “He is ruining our credibility by just being out there winging it with these calls.” The two men considered hiring Wallace, merely to eliminate competition, but on reflection wondered whether he might also have something productive to add. Tiversa had only one full-time analyst, and though he had conventional skills—he had worked at Microsoft—he lacked deep experience with peer-to-peer networks. Boback flew Wallace in for an interview, and was struck by his offbeat manner, but he reasoned that this was common in cybersecurity. Two weeks before the congressional hearing, Wallace moved his family to Pennsylvania and started work, racing to dig up material that Boback could use in his testimony.

Tiversa’s office culture, Wallace quickly discovered, was anything but formal. Early on, Boback had instituted a rule: new hires were bestowed a sword representing their character. Tiversa’s chief technology officer was given a samurai’s katana. Another employee got Gandalf’s sword, from “The Lord of the Rings.” Boback planned outings to a shooting range and sometimes came in with a pistol. Once, he displayed his gun to an executive who had challenged him. As the executive later recalled, Boback “sat at a desk in front of me and reached into his sock holster and pulled out a revolver and showed me its features.”

Wallace quickly adapted to the unconstrained atmosphere. Hired as an analyst, he helped comb the Data Store for client information, but he also commandeered an independent DSL line to run manual searches in his old way. He was often able to find files that EagleVision X1 could not, and the company’s software developers began studying his methods to improve the system’s code.

Soon after the congressional hearing, Wallace made a discovery that captivated Boback’s imagination: someone was sharing suspicious financial documents, along with images of gold bars and passports. The I.P. address belonged to a lawyer in California, who was touting investments that could return forty per cent a week. Boback, who suspected that the investments were a fraud, had the files printed; then he and Wallace, like detectives, spread the pages out on a table to study them. They spent weeks on the project, hoping to somehow earn money from the discovery.

Ultimately, there was no way to gain from it, but for Wallace the episode demonstrated the value of his idiosyncratic skills. For Boback, the puzzle was thrilling. He was an avid gambler. Often, he would stride past Wallace’s desk and summon him to leave, saying, “Waldo, you’re with me.” Wallace typically didn’t know where they were headed, but often the destination involved bets. An employee who worked closely with Boback later told the F.B.I. that she thought he was a gambling addict. (Boback denies this.)

A strange intimacy grew between the two men. There were flurries of texts at all hours, games of Halo past midnight. To others, they seemed to inhabit an atmosphere of semi-continuous scheming. The office had a window overlooking a parking lot near a Red Roof Inn. Wallace noticed a woman who often turned up to wait for a man—another puzzle that became the topic of speculation, jokes, even a mock stakeout.

At times, Boback had conflicts with peers. As a former Tiversa employee told me, “The Bob that he presents to people he just meets—that Bob is very charming, very likable, very engaging. Then, there is the person behind the mask, who is a little bit paranoid, angry, untrustworthy, greedy, generally not a nice person. If you got on his bad side, you stayed on his bad side.” Wallace began supporting Boback in conflicts. After an employee argued with him, colleagues say, Wallace designed a simulated F.B.I. arrest report, indicating that he had groped someone on a flight, and circulated it within the company. (Wallace denies this.) “Rick became Bob’s puppet,” another former employee told me. “Bob completely controlled him.”

Boback also clashed with Hopkins’s wife; she had helped start the company, but then became openly distrustful of Boback. Wallace found a clip of a porn actress who resembled her and joked with Boback about adding her name and phone number and sharing it on peer-to-peer.

Wallace says that he and Boback also purchased a G.P.S. tracker to surveil her. “We snuck over to her car, stuck it on, and watched her go to a place in Indiana,” he recalls. “She had a boyfriend there. So then Bob pulled Sam into the office, and goes, ‘Well, I hired this private investigator to see what’s going on. I just wanted to let you know.’ Of course, Sam reacts terribly, goes home, has a big fight. Sure enough, they get a divorce. Bob takes credit for it.”

Boback now tends to claim that any bad behavior at Tiversa was caused by Wallace going rogue. He told me that he ordered the G.P.S. device because he suspected that members of his sales team were defrauding Tiversa. “They were charging mileage on everything, and I was, like, come on, you’re getting paid a commission!” he said. “So I was, like, I’m going to get a G.P.S. I want to see how far these people are driving. I ordered it, got it. Wallace saw the G.P.S. sitting there, and then, without any knowledge of mine, when Sam was going through his divorce, Wallace put it on her vehicle. Now, I did know that he put it on that vehicle—after—because he had told me, and I was, like, ‘You shouldn’t be doing this, get it off.’ Which he did.”

Within a year at Tiversa, Wallace had taken on a new title, director of special operations. He continued to work as an analyst, but also spent hours on the DSL line searching for government files, or for documents with criminal implications. This work had no immediate business value, but Boback hoped that it could serve as a proof of concept, to help secure a federal contract.

Most people in the office knew little about how Wallace spent his time, but he was quietly achieving something remarkable. He passed on tips to the C.I.A., the Secret Service, the Treasury Department, the military, and the F.B.I.’s Pittsburgh field office, which began sending a special agent to Tiversa almost weekly to coördinate with him on child-pornography research. Wallace also sent the Bureau evidence of online identity theft: I.P. addresses that seemed to be harvesting Social Security numbers or credit-card information.

Sometimes, frustrated by the slow pace of federal law enforcement, Wallace fed his tips directly to police departments. In 2013, the Law Enforcement Executive Development Association, a national training organization, presented him with an award for assisting in hundreds of cases. (The F.B.I. recognized his efforts, too, in a ceremony conducted by Robert Mueller, near the end of his term as director.) Steven Pickett, who worked a dozen cases with Wallace as a deputy sheriff in Mississippi, told me, “He is a real unsung hero from another world.”

Wallace’s research opened doors into law enforcement for Boback, but it became clear that the men had different ideas about it. Once, Wallace discovered child pornography on a computer at a Catholic seminary, and told the F.B.I. Boback, he says, saw a business opportunity, and called the seminary’s director to pitch Tiversa. (Boback disputed this, saying, “I reached out and told him the problem, and he immediately said, ‘Oh, my gosh, we are going to address it immediately.’ There was never a ‘Here’s how much it’s going to cost.’ No contract discussed!”) The director notified the F.B.I., too, and Wallace soon got a call from the special agent he worked with in Pittsburgh, angrily warning him that Tiversa should never pull a stunt like that again.

III. FUD

IV. MARINE ONE

In the summer of 2008, Boback got an unexpected break, when an intermediary connected Tiversa with LifeLock, the identity-theft-protection service. The match was logical. Tiversa had patented technology but limited sales. LifeLock was adept at marketing but had no intellectual property.

Boback flew to LifeLock’s headquarters, in Arizona, and the executives he met were so enthusiastic that they called in the C.E.O., Todd Davis. Boback’s pitch, Davis told me, had “great sizzle.” Soon, a trial arrangement was negotiated. LifeLock turned over private information belonging to thirty thousand clients, so that Boback’s team could demonstrate how Tiversa would protect them. Wallace later told the F.B.I. that, on Boback’s instructions, he created about a hundred cases of false spread for those clients—manufacturing threats for people who had apparently experienced no data breaches whatsoever. According to Wallace, Boback used the LifeLock information to fill out passport applications and other official documents, which were uploaded to the Data Store, to give the impression that criminals had been circling Davis’s customers. (Boback denies doing this.)

In January, 2009, Davis flew Boback to a desert resort in Phoenix, where he indicated over a long breakfast that he was ready to work together more closely. Boback returned home energized, and in the coming months he urged Davis to buy Tiversa. He proposed a price of more than a hundred million dollars, and then worked to demonstrate his company’s value. “Every time we talked to him, he mentioned this unbelievable discovery that they had made,” Davis recalled. “He was basically saving the world every few weeks.”