Chapter 11: Fabricated Vulnerabilities

Reciprocity

Three weeks.

Three Sundays at Pike Place, which had become theirs without either of them proposing it. Three Monday evenings joining her at the UW lecture hall, third row, slightly left of center, the seat she’d stopped pretending not to check when she set up her slides. Fourteen texts she had initiated. Two he had, both finding replies that ran longer than the question required.

The almost-dates had been her idea. Coffee after the first Monday talk, suggested with the briskness of someone proposing a professional debrief. A walk along the waterfront the following Sunday that had started at Pike Place and ended an hour past where either of them had said they were going. A paper she’d sent him (her own, unpublished, a tight twelve pages on behavioral prediction in adversarial systems) with a message that said only curious what you think, which was either professional courtesy or an invitation wearing professional courtesy as a cover, and which he had read as both and replied to accordingly.

She had not used the word date. Neither had he.

The friend zone was a door neither of them had opened, which meant neither of them had closed it either, which was its own kind of answer.

Max sat at the center screen with the bourbon he wasn’t drinking and looked at the contact thread. The cadence of someone who had decided something without announcing the decision. He recognized the pattern because he had landscaped the conditions that produced it. The comics, the notes, the window table at Canlis, the third-row seat he’d returned to three Mondays running.

He had built the web with some precision.

Looking for the variance, the place where the model had predicted wrong. There wasn’t much. That was the problem he hadn’t named yet.

“Sybil. Run the avatar.”

The simulation populated across the left screen. Three weeks of new data had refined it considerably past the version he’d built before Canlis. The model now had her specific cadence in text: the way she front-loaded important information and buried humor at the end of sentences, the response latency that meant she was genuinely thinking versus the one that meant she was deciding whether to say the thing she was actually thinking. It had her lecture register versus her conversation register. It had the particular quality of attention she gave to technical problems she found genuinely interesting, which was different from the attention she gave to technical problems she found professionally important. The simulation knew the difference. He’d had to teach it that distinction from observation, which meant he’d had to observe it first.

“Current trust index,” he said.

“Behavioral indicators suggest she has moved you from the category of interesting stranger to something closer to chosen company. Disclosure depth has increased across four of the last six interactions. She’s stopped performing ease and started having it.”

Max looked at the avatar on the left screen. It was doing nothing. Waiting for input, cursor blinking in the dialogue field. Three weeks of Dani D’Sylva rendered in behavioral data, sitting in a simulation, ready to respond to things he hadn’t said yet.

He thought about the real version, currently six minutes away in the Capitol Hill apartment whose floor plan he had from the building’s permit records. The real version who had started saving him a seat at the Pike Place flower stall on the third Sunday because she’d noticed he always looked at the ranunculus without buying them.

He had not told Sybil about the ranunculus.

“Next phase,” he said. “Reciprocity. I need to present a vulnerability. Something personal enough to accelerate the disclosure dynamic without compromising operational security.”

“Three options present themselves.” A pause of the kind that meant she was sequencing rather than processing. “Compromised cloud account: suggests carelessness. Fabricated identity theft: places you inside her area of professional expertise, positions her as the competent one in the exchange. Financial exposure: too personal for the current trust level, likely to create discomfort rather than closeness.”

“Model all three against the avatar,” Max said. “I want the emotional response differential.”

Sybil ran it.

He watched the simulated Dani receive each scenario in sequence. The compromised cloud account produced sympathetic concern, brief, followed by problem-solving mode. She offered solutions, which meant she’d moved into professional register rather than personal. The financial exposure produced the discomfort Sybil had predicted, a micro-withdrawal in the avatar’s engagement metrics, the model pulling slightly back.

The identity theft scenario did something different.

The avatar’s response latency increased by 340 milliseconds before the first reply. When it came, it was shorter than her baseline, two sentences rather than four, and the disclosure that followed moved immediately to something personal. Not problem-solving. Recognition. The simulation was showing him that fabricated identity theft didn’t trigger her professional competence. It triggered her wound.

He watched the avatar’s response twice.

“She’s been here before,” he said.

“Her published work contains six references to identity theft as a category of harm distinct from financial fraud. She frames it consistently as an attack on personhood rather than assets. The framing is specific enough to suggest personal rather than purely professional investment.”

Max looked at the avatar on the left screen, then at the window, then at the bourbon he hadn’t touched.

The simulation had just told him something the three weeks of data hadn’t surfaced directly. Dani D’Sylva didn’t write about identity theft as an abstraction. She wrote about it as someone who understood from a proximity he hadn’t fully mapped yet what it meant to have personhood attacked rather than assets stolen.

“Identity theft scenario,” he said. “Build me the execution parameters. Minor, credible, recent enough to be present but not destabilizing. Something a careful person could plausibly have missed.”

“A frozen account flagged for suspicious activity would be consistent with your cover profile. Timing: disclosed at dinner, mid-evening, after rapport has re-established from the week’s gap. Cash payment as the visible marker. Emotional register: understated, slightly embarrassed, more accustomed to competence than to this.”

“That last part,” Max said.

“Sir?”

“Make sure that last part reads.”

He closed the simulation. The left screen went dark. The right screen held Dani’s contact thread. The fourteen texts she’d initiated, the two he had, the last exchange three days ago about the paper she’d sent him that he’d read twice. He’d told her it was interesting. It had been interesting.

He picked up the bourbon. Put it down.

Outside, the rain had found its rhythm against the glass. Seattle in the dark, the lights of Capitol Hill blurred and soft through the wet window. Six minutes away.

“Sybil.”

“Yes.”

“Thursday. Make a reservation.”

Not Now

The notification arrived while he was reading her most recent blog post.

Not reading it as intelligence. Reading it. The distinction had been blurring for approximately ten days and he had been managing the blur with the professional discipline of someone who knew the difference and was choosing to address it later.

He was on his second pass of the same paragraph, a section on ethical frameworks in adversarial AI development, the argument precise and the anger underneath it controlled in the specific way of someone who had been thinking about this for years and had learned to let the thinking do the work, when Sybil’s notification appeared in the lower corner of the screen.

The background process you initiated has returned findings. Classification: significant. Would you like the summary?

He looked at the notification for a moment.

Not now, he typed.

He returned to the blog post. He read the paragraph a third time. The argument was about systems designed to protect that produced new categories of harm, and he was reading it in the same window as a notification telling him he had found the harm done to the person making the argument, and he was choosing to read the argument again rather than open the summary.

He opened the summary.

Sybil had run the search across seventeen databases over six maintenance cycles, cross-referencing the data trail surrounding Dani’s parents’ disappearance against known operational signatures in the Shadow Network’s documented history. The findings were structured in three sections. He read all three.

The Shadow Network’s signature was present. Not confirmed. Present, the specific pattern of a digital erasure conducted by professionals rather than a natural fading of records, the kind of removal that left the particular absence he had learned to recognize because he had produced it himself on three occasions for different clients.

Her parents had been connected to something. Sybil could not determine what from the available data. The connection appeared to predate Dani’s awareness of it by at least four years. Her parents might not have known what they were connected to when it became relevant.

No location. No confirmation of survival. No thread that could be pulled to find them.

He closed the summary.

Pavel’s message from this morning was still open in the encrypted channel. Our patience is ending. Deliver progress by Thursday or the quorum reviews the operation. He had been composing a response for six hours and had not sent it because every version of the response required him to claim a progress he had been deliberately not making.

He looked at the blog post. The paragraph about systems that produced harm.

He looked at the notification, now showing as read.

She was looking for them with consumer tools. She had been looking for years. He had found what she had not been able to find, in six maintenance cycles, because he had the professional methods and she did not, and he had the professional methods because he worked within the same infrastructure that had taken them.

He noted this without resolving it, which was what he had been doing with an increasing number of things, and filed the summary under a classification he did not name and did not share with Pavel and did not mention to Sybil.

He closed the blog post.

He opened Pavel’s channel and began composing the response that would buy him another week.

The Fabricated Vulnerability

The restaurant was busy enough that the silence between them had somewhere to be. Max had chosen it for that reason.

He let the performance run from the moment she sat down. Distracted, slightly off his usual register, the quality of tension in a man managing something he hadn’t mentioned yet. He watched her read it across the table the way she read most things, efficiently, with the specific attention of someone whose job was pattern recognition. She would ask within four minutes.

She asked at three.

“Everything okay?”

He gave her the smile that didn’t quite reach. Let a beat pass before the main course arrived. “I should warn you I’ll be paying cash tonight. Some suspicious activity on the account. Bank froze everything until they can sort it out.”

He watched her process it. Concern first, genuine and immediate. Then something warmer underneath, the reflex of someone whose professional expertise made her specifically sympathetic to this particular vulnerability. She had written about it. He had read what she’d written. The avatar had run this response at 340 milliseconds of latency before the first word.

The real version was faster.

“I’m so sorry,” she said. “That’s awful.”

“It’s fine. I should have rotated the numbers. I always tell clients.” He shook his head with the precise quality of someone more accustomed to competence than to this. “Apparently we’re all capable of blind spots.”

“I once fell for a phishing email so obvious,” she said, “I’ve never told anyone.”

He smiled. She smiled. The table between them did the thing tables do at this point in an evening, and he filed the fabricated vulnerability as executed and moved on.

The conversation found its way to her work. The architecture of what data brokers could legally collect, the gap between what people understood about their own footprint and what the footprint actually was. He listened with the attention of someone encountering these ideas for the first time, which required the least performance of anything he’d done all evening because the ideas were genuinely interesting when she was the one explaining them.

“There are people,” she said, and her voice shifted register slightly, “who’ve been zeroed out completely. Not hacked, not breached. The connection just severed. Bank accounts present but inaccessible. Employment records existing but unrecognizable to the verification systems. They’re in there somewhere. The data knows who they are. The system just won’t say so.”

Max said nothing. He was very focused on the middle distance behind her left shoulder.

He thought briefly of Sarah Torres. We weren’t the main act. We were the test. He set it aside. It didn’t stay set aside cleanly, which he noted and didn’t examine.

“My parents,” Dani said.

He looked at her.

“While I was finishing my masters in Boston. They were targeted somehow. I’ve never been able to establish exactly how. By the time I understood what had happened, the trail was already cold.” She reached for her wine. Put it down without drinking. “My mother went looking for answers. Then my father went after her. I haven’t heard from either of them since.”

He had six cycles of findings in a file he had classified under a name he hadn’t written down. The Shadow Network’s operational signature was present in the data trail surrounding her parents’ disappearance. He had recognized it because he had produced it himself on three separate occasions. No location. No confirmation of survival.

He had read the summary once and closed it and not mentioned it to Sybil.

Dani was looking at the candle on the table. “It happened while I was finishing my masters,” she said again, slightly differently, as if the repetition was load-bearing in some way she hadn’t planned.

He reached across the table. His hand covered hers.

He did not plan it. He noticed himself doing it and did not retract it, because retracting it would have required a decision and the decision would have required him to examine why he’d done it, and he was not prepared to do that in this restaurant with her sitting across from him looking at a candle she wasn’t seeing.

She looked at him. Whatever she found in his expression, she let it be enough.

They finished the evening in the lighter register that follows something heavy being set down. He walked her out through the cold to where the bright blue Mini Cooper sat under a lamp at the edge of the lot. Their conversation ran another few minutes in the chill without either of them acknowledging they were prolonging it.

She drove away. He stood watching the place where the car had been.

The mist had started again. He turned up his collar and walked.

Three blocks from the restaurant he tapped his earpiece.

“Sybil.”

“Sir.”

“Engagement report. Fabricated vulnerability executed, received as modeled. Disclosure achieved. She’s inside the operation.”

“Understood. Updating parameters.”

“Good.”

He closed the channel.

He walked another block before he noticed he hadn’t mentioned the parents. He could call back. Update the file. Task Sybil to cross-reference the six cycles of findings against the new disclosure, look for anything he’d missed.

He didn’t call back.

The mist came down steadily, the kind Seattle produced without drama, and he walked through it without cataloguing it as a problem, which was not something he had been doing three weeks ago, and which he did not examine now.

Third Row Fixture

The third row had stopped being a surprise a month ago.

Dani knew where he’d be before she set up her slides, the same way she knew which lighting panel controlled the podium spot and which exit the fire marshal preferred. He had become part of the room’s furniture, which was either the most comfortable thing about Monday evenings or the most alarming one, and she had been declining to examine which.

She opened the way she always opened, no notes, a question for the room, waiting for the hands that told her who was there and why. Graduate researchers tonight, a cluster from the Allen School, a row of undergraduates who had heard about the talk from someone and come without knowing exactly what they were walking into. Good. She liked a mixed room. It kept her honest.

The talk was on adversarial machine learning. She moved through the material the way she moved through anything she’d thought about long enough, with the ease of someone for whom explaining was simply the most compressed form of thinking. The room tracked with her. Questions came at the right moments. She answered them well and moved on.

She was forty minutes in, midway through the decision boundary visualization, when she made the mistake of looking directly at him.

He was watching her the way he watched everything. Not the polite attention of an audience member but the focused stillness of someone doing actual work. Following the argument. And something in the quality of it, the specific recognition that he was not just present but genuinely inside the material she had built, crossed a wire she hadn’t known was live.

She lost the thread.

Not dramatically. A half-beat of silence where the next sentence should have arrived, her eyes dropping briefly to the diagram as if checking something she already knew. A soft shift in the room, the particular attention of an audience that has noticed a pause without knowing why.

She found him.

He gave her nothing theatrical. Just the slight forward inclination of someone who was still listening, still with her, the quality of attention that said the argument was worth finishing. It lasted less than a second.

She picked up the thread and finished the section cleanly. Nobody in the room would have named what had happened. She would have been hard pressed to name it herself.

The applause at the end was warm and genuine and she received it the way she always did, with a nod and a thank you and the small private satisfaction of a talk that had gone well. She glanced at the third row. His expression was what it always was after her talks, attentive, pleased, something underneath that she filed without examining.

The room cleared in the gradual way of Monday evenings. She gathered her laptop. He crossed to where she was standing.

“You actually understood that,” she said. Not a question.

“Most of it.” He turned from the diagram she’d left on the screen. “The section on gradient masking. You went through it quickly.”

“Because it’s contested and I have opinions that would take another hour.”

“I know,” he said. “I read the footnote.”

She had put a footnote in her slide deck. Nobody read the footnotes. She felt the specific warmth of being known by someone who had done the reading, which was her favorite kind of being known, and which she was aware, in the way you were aware of things you didn’t examine closely, was exactly the kind of warmth that made people stop asking certain questions.

“You owe me a beer,” she said. “You broke my concentration up there.”

“I was listening.”

“I know. That was the problem.”

He smiled. She picked up her bag.

“Northlake,” she said. “Pizza. You can ask me about gradient masking.”

“I have a lot of questions about gradient masking,” Max said.

“I know you do.”

Pizza and National Security

Northlake Tavern on a Monday evening had its own specific energy. Students unwinding from the week’s first push, the smell of garlic and beer and something charred in the best possible way, the low ceiling holding the noise at a human level. Dani took the booth in the back corner, the one with the sight line to the door, and ordered two IPAs before Max had settled across from her.

“Gradient masking,” she said. “Go.”

He smiled. “You built the argument so cleanly for the first forty minutes that when the masking section arrived it felt rushed. Like you’d decided the room wasn’t ready for it.”

“The room usually isn’t.”

“I was.”

She looked at him across the table. The candle between them was cheap and slightly crooked and doing its job anyway. “The problem with gradient masking,” she said, “is that it looks like a solution from the outside. You obscure the model’s gradients so the attacker can’t see which direction to push. The model appears robust.”

“But it isn’t.”

“It’s theater. The vulnerability is still there. You’ve just made it harder to find, which isn’t the same as fixing it.” She turned her pint glass slowly on the table. “The footnote was about the difference between security and the appearance of security. Most organizations can’t tell them apart until it’s too late.”

“Most people can’t tell them apart in any domain,” Max said.

She looked at him again. He said it without weight, as a plain observation, and she felt the truth of it land before she’d decided whether she agreed.

“That,” she said, “is either very insightful or very bleak.”

“Both, usually.”

She laughed. He watched her laugh with the quality of attention she had stopped trying to account for and started simply accepting, which was its own kind of answer to a question she hadn’t asked out loud.

She was about to say something about the footnote’s actual argument when a hand landed on her shoulder from behind and a voice arrived above her.

“What was with you tonight?”

She turned. He was already pulling up a chair with the ease of someone who had located them before they’d seen him, coat still on, the expression on his face that meant he’d been watching long enough to have an opinion.

“Jesse!” She stood to hug him. “I didn’t know you were coming.”

“Clearly.” He looked at Max with the particular attention of someone whose job required him to assess unfamiliar systems quickly. “You’re the one in the third row.”

Max extended his hand. “Max. And I’ll take responsibility for the stumble, apparently.”

Jesse shook it. Something shifted in his assessment, not softening exactly, but recalibrating. “What did you do to her up there?”

“I read the footnote.”

Jesse looked at Dani. She shrugged in a way that confirmed everything. He pulled his coat off and sat down. “South African?” he said.

“Originally.”

“Thought so. I spent six months in Cape Town, 2019. Consulting project.” He flagged down the server. “What are we drinking?”

The pizza arrived twenty minutes later, pepperoni and something with roasted garlic that had been Jesse’s addition and that none of them regretted. The conversation had found its register by then, three people who spoke the same professional language, two of whom knew each other well enough to finish sentences, one of whom was asking questions that sounded like curiosity and were.

It was Jesse who brought up China.

“You do any work in the federal space?” he asked Max, between slices.

“Some. A few years back.”

“Then you’ve got a read on the infrastructure problem.” Jesse wasn’t asking. “We’re tracking the telecom persistence at Microsoft. Has been going on longer than anyone’s officially saying.”

Max nodded. “The public timeline is conservative.”

“How conservative?”

“Considerably.”

Jesse looked at him for a moment. Then at Dani. Then back. “Cloud security, Dani said.”

“Mostly.”

“Mostly,” Jesse repeated, with the tone of someone filing a detail without deciding what to do with it yet. He took a long pull of his beer. “The puzzle isn’t the intrusion. Anyone paying attention knows they’re in. The puzzle is why we keep acting like they’re not.”

“Complacency,” Max said. “Or something that functions like it.”

“Or something that functions like it,” Jesse repeated slowly, as if the phrasing had caught on something. He looked at Max with an expression Dani recognized, the one Jesse reserved for people who had just demonstrated they were worth taking seriously. “You should talk to some people I know.”

“I’d like that,” Max said.

Dani felt the warmth of it, the specific satisfaction of two people she respected finding each other worth respecting. She reached for another slice.

“Kraken game Friday,” Jesse said, pivoting with the conversational agility of someone who had decided the serious portion of the evening was complete. “Work sponsored. Dani’s pretending she hasn’t already decided to go.”

“I haven’t decided,” Dani said.

“She’s decided,” Jesse said to Max.

“I own a Bruins jersey,” Dani said. “The Kraken and I have an understanding.”

“The Kraken?” Max said.

“Seattle’s NHL team.” She pointed at him with her pizza. “Don’t say it.”

“I wasn’t going to say anything.”

“You were going to say something about a sea monster.”

He smiled. She shook her head and felt the smile come despite it.

“Go,” Jesse said. “Both of you. I’ll be there. We’ll educate this man about hockey and you can explain the Bruins situation to someone who has to pretend to care.”

“The Bruins situation,” Dani said, “is a proud and complicated legacy that deserves more than—”

“Friday,” Jesse said. “Puck drops at Seven. I’ll get the tickets.”

She looked at Max. He was watching her with the quality of attention she had filed and not examined and was increasingly running out of places to file.

“Friday,” she said.

Jesse caught the server’s eye and ordered another round with the satisfaction of someone who had accomplished what he came for, which was not entirely the beer.

Later, walking back toward the Ave in the cold, Jesse fell into step beside her while Max continued while securing a ride on the app.

“He’s good,” Jesse said quietly.

“I know,” Dani said.

A beat.

“That’s what I mean,” Jesse said.

She watched Max on the phone at the corner, collar up, the city moving around him with no particular awareness that he was in it.

She tucked Jesse’s comment away before she finished understanding it.