Chapter 12: Phish Out Of Water

Puck Drop

The noise was the first thing.

Max had been in loud environments before, server rooms, trading floors, the specific acoustic chaos of a protest being managed from three blocks away, but Climate Pledge Arena at puck drop was something different. It wasn’t loud so much as pressurized, the sound arriving from every surface simultaneously, the crowd a single organism doing something it had been waiting all week to do.

He followed Dani and Jesse down to their seats with the careful attention of someone mapping unfamiliar terrain.

Dani had dressed for it. The vintage Bruins cap sat slightly crooked above the scarf she’d tied three times in the parking garage, her father’s number still visible on the brim where the embroidery had worn soft with handling. She moved through the crowd the way she moved through Pike Place, like someone who knew where the current was going before it arrived.

Jesse materialized on her other side with two beers and the expression of a man who had positioned himself deliberately.

“First NHL game?” Jesse asked Max, not unkindly.

“First hockey game of any kind,” Max said.

Jesse looked at Dani. Dani looked at Jesse. Something passed between them that Max filed without decoding.

“You’re in for it,” Jesse said, and handed him a beer.

The players were already on the ice warming up, their speed something Max hadn’t anticipated from the footage he’d reviewed the previous evening. In person the scale was different, the rink smaller than it appeared on screen, the players larger, the contact more abrupt. He watched the puck with the concentration of someone trying to parse a new system’s logic and finding the variables were moving faster than the parsing.

Then the PA system detonated above them.

“Welcome, Kraken fans, it’s time to REEE-LEASE THE KRAKEN!”

The arena didn’t cheer so much as detonate. Max winced at the wall of sound, his beer hovering halfway to his mouth.

Dani was already on her feet.

She leaned close enough that he could smell her shampoo over the arena’s particular combination of ice and hot food. “Okay,” she said, her voice pitched to carry without shouting, “ignore the puck for now. Watch the left winger. Number nineteen. Watch where he goes when the play breaks down.”

Max watched number nineteen.

“There,” Dani said, when the line changed. “See how he positioned himself before the D-man committed? He read two moves ahead.”

“He anticipated the decision before it was made,” Max said.

“Exactly.” She looked at him with the expression she wore when a student said something better than she’d planned to say herself. “Now you’re watching hockey.”

The referee’s whistle split the air. The crowd erupted around a call Max hadn’t seen and couldn’t reconstruct from the aftermath. Dani’s arms went up.

Jesse crossed his arms and scoffed. “Bad call if you ask me. That’s some great acting.”

Dani leaned toward Max with a conspiratorial glint, pitching her voice just loud enough for Jesse to catch it. “Don’t listen to him. He’s just a sore loser.”

“Hey!” Jesse threw his hands up in mock protest. “I’ll have you know I’m a loyal Kraken fan and a little defensive when we’re getting screwed by the refs.”

“Tripping,” Dani announced to Max, with the authority of a judge handing down a verdict. “Two minutes in the box.”

“What’s the box?” Max asked.

She turned to him fully. “You sit in a small enclosed space while the other team has a man advantage and your team tries to survive it and the entire arena watches you think about what you’ve done.”

Max considered this. “That’s surprisingly honest as a concept.”

Dani laughed. Jesse glanced over at the sound of it, the assessment in his expression quick and not quite concealed.

The slap of a hockey stick and then the goal horn detonated, a physical event more than a sound, the arena becoming briefly uninhabitable with noise and motion. The jumbotron erupted, a grunge clip pulsing through the speakers as the crowd jammed around them. Jesse was out of his seat with both arms raised.

“SCORE!”

Everyone was standing. Everyone except Dani, who remained seated with her arms crossed and the particular composure of someone whose loyalty had been tested and found intact.

“Pipe down,” she said.

Jesse dropped back into his seat, still grinning. “Talk about a sore loser now, you Original Six snob.”

“I’m not a sore loser,” Dani said. “I’m a Bruins fan at a Kraken game. There’s a distinction.”

“The distinction being?” Max asked.

“I want everyone to have a nice time,” she said pleasantly, “and I want the Bruins to win.”

Jesse looked at Max with the expression of someone sharing evidence. Max found himself smiling before he noticed he was doing it.

The third period settled into its rhythm and Max stopped trying to follow the officiating and started watching the crowd instead, which was a more familiar kind of analysis. The specific way people revealed themselves when they forgot they were being observed. The man three rows ahead who argued every call with the authority of someone who had never been right. The couple to their left who had stopped watching the game entirely and were talking the way people talked when they had recently decided something about each other.

He was doing it again. Reading the room as data.

He stopped.

Beside him Dani had her elbows on her knees and her chin in her hands, watching the ice with the total absorption of someone who had been doing this since childhood. Her father’s cap slightly crooked. A strand of hair that had escaped the ponytail and that she hadn’t noticed.

She asked him something about his dad, quietly, in the lull between plays. He said something about the Bruins not being a South African institution. She laughed and he felt the warmth of it land in his chest in a way he didn’t catalog.

Later he couldn’t remember exactly what was said. He remembered the cap. He remembered the strand of hair.

The buzzer ended it, Kraken by one, and the crowd moved toward the exits in the unhurried way of people who had gotten what they came for. Jesse materialized beside them, his earlier assessment of Max apparently resolved into something more neutral, his conversation easy and unguarded in a way it hadn’t been at Northlake.

They walked back through the lot together, the three of them, Dani in the middle. Max listened to Jesse explaining something about the penalty kill with the patience of someone whose opinion on the penalty kill had not been requested, and Dani occasionally correcting details with the precision of someone who had memorized the rulebook in 2011.

At the garage entrance Jesse stopped.

“Good game,” he said, looking at Max with the directness of someone offering something specific rather than a pleasantry.

“Good company,” Max said.

Jesse nodded once. Not approval exactly. Acknowledgment. He looked at Dani for a moment in the way people looked at someone they’d known long enough to say things without saying them, and then he was gone into the garage.

They walked to her car in the particular quiet that follows a loud place. The city was cold and clear above the structure, the Space Needle lit against a sky that had gone the specific dark blue of Seattle at 22:00.

At the Mini Cooper she turned to him. The Bruins cap still slightly crooked.

He leaned down and kissed her cheek, the warmth of her skin against the cold air. She was still for a moment, then she looked up at him and the surprise in her expression settled into something else.

“Goodnight, Max,” she said.

“Goodnight.”

He watched the Mini Cooper move through the garage and disappear down the ramp. He stood with his hands in his coat pockets in the specific silence of a structure that had just emptied.

The operation was progressing. Trust indexes holding. The fabricated vulnerability had landed as modeled. He had what he came for.

The Weight of War

He found it at 01:47.

He hadn’t been looking for it. He’d been running a routine scan of Microsoft’s network perimeter, Sybil cycling through the overnight intel, when the news aggregator flagged it with the tag he’d set months ago and never expected to see activated.

Taiwan. Military. Ambush.

The headline was three lines. The image below it was pixelated, the kind of compression that meant the original had been restricted before anyone thought to save it cleanly. Twisted metal in a road he didn’t recognize. Smoke. A figure being moved, hands secured, face turned away from the camera.

He read the article twice.

The ambush had been precise. That was the word the defense correspondent used, and it landed differently for Max than it would for most readers. Precise meant the unit’s movements had been known in advance. Precise meant the strike timing corresponded to a window of maximum vulnerability. Precise meant someone had built an attack package from the behavioral and positional data of the soldiers involved, their families’ communications, the emotional pressure points that made decision-making slow and prediction easy.

He had built that package. Four months ago. Delivered it to the Shadow Network whose flag he had not asked about, because not asking was part of the service.

“Sybil.”

“Sir.”

“Save this as the after-action on the Taiwan engagement. Tag: Spiderweb.”

A pause of three seconds, which was longer than required.

“I can confirm from open-source aggregation: the ambush occurred at 0340 local time, consistent with the vulnerability window identified in the package delivered in January. Casualty figures are not yet confirmed in public reporting. One service member is listed as missing.”

Max looked at the screen.

He wondered if PFC Torres was the MIA. Sarah’s voicemails had been the background noise of an operation he’d been running simultaneously, the sound of a family being dismantled by the same data infrastructure that was paying his rent. He had listened to enough of them to understand the shape of what was happening. He had not listened to all of them.

Lily would be four now.

“Sybil. Sarah Torres. Current status.”

“Sarah Torres is currently the subject of a coordinated disinformation campaign across four platforms. Multiple accounts impersonating government agencies have accused her of spreading false information regarding her husband’s deployment status. Her primary social media accounts have been flagged for review. Two of her three email addresses have been compromised. She has not posted publicly in two months.”

Max was quiet.

“Her support network has contracted significantly,” Sybil continued. “The disinformation campaign has been effective at isolating her from the community groups she previously relied on.”

He knew exactly what that looked like from the inside. He had built campaigns with the same architecture. The impersonation accounts, the credibility erosion, the slow contraction of the circle of people who would still take your call. He knew which firm had run this one from the signature. He had recommended them to Pavel eighteen months ago.

He closed the news aggregator.

The Microsoft scan continued on the secondary screen, Sybil’s progress indicators cycling through their sequence. The operation was running. It didn’t stop because he was sitting here at 01:54 reading about a woman in two months of silence.

His phone buzzed on the desk.

Pavel.

Deliver. The timeline has moved.

Max looked at the message for a long time. Two words and a period, which was Pavel at his most controlled, which meant Pavel was not controlled at all underneath it.

He set the phone face down.

He hadn’t pulled the trigger. He never pulled the trigger. He built the architecture, delivered the package, collected the fee, and the thing that happened after was the thing that happened after, which was not the same as the thing he had done. He had understood this distinction for years. It had been sufficient.

He looked at the dark screen where the headline had been.

The warm weight of the evening had been there an hour ago, the arena’s noise, the Bruins cap slightly crooked, the cheek kiss in the cold of the parking structure. He had stood there an extra minute before walking to his own car.

He had not told Sybil about number nineteen.

He turned back to the Microsoft scan and told himself to work, and did, and the distinction held the way it always held, which was well enough, and not entirely.

Countermeasures

The loft was quiet. The city below was doing what cities did at 2 in the morning, not sleeping exactly, redistributing.

Max pulled up the Microsoft network topology Sybil had been mapping across the past three weeks and looked at it the way he looked at everything: for the variance, the place where the model had predicted wrong.

“Current penetration status,” he said.

“Perimeter access is holding at four ingress points. The Edge Compute cluster remains the most viable internal vector. Detection risk on current access pattern is low but increasing with scan frequency. Recommend extending intervals between active probes.”

“Noted. Hold scan frequency. Pull the social graph on Jesse Silvers.”

Sybil populated the secondary screen. LinkedIn profile, employment history, GitHub repositories, conference presentations, three years of commit logs on Microsoft’s internal developer network that she’d accessed through a misconfigured API endpoint two weeks ago. Cloud Security Engineer, seven years at Microsoft, two internal security architecture patents.

Max read through the commit logs.

Jesse was good. Not in the way Dani was good. Dani thought in frameworks, in the structural logic of how systems failed. Jesse thought in implementations, in the specific and unglamorous work of making defenses hold under real conditions. The logs showed someone who had fixed the same class of misconfiguration twelve times across three years, each fix more elegant than the last.

He was also, Max noted, currently stuck.

The last three weeks of Jesse’s commit activity showed a recurring problem with a firewall configuration in Microsoft’s cloud infrastructure, the same misconfiguration approached from four different angles, none of them resolving it cleanly. The branch had been open for sixteen days. Dani’s name was in two of the commit comments.

Max looked at the problem for eleven minutes.

He knew the solution. He had built a script to automate exactly this class of detection eighteen months ago, repurposed from a tool he’d originally developed to exploit the same vulnerability in a target network. The script was clean, well-documented, portable. It would take Jesse and Dani approximately forty minutes to implement with guidance.

He opened his GitHub repository and looked at the script.

“Sir.” Sybil’s voice shifted to the register she used when something required immediate attention. “Alert. Unusual activity detected on the network. Multiple failed authentication attempts originating from a source proximate to your current IP address. Microsoft’s threat detection has flagged the pattern.”

Max went still.

“Timestamp on the flag.”

“Seventeen minutes ago. The flag is currently sitting in a security queue. No analyst has reviewed it yet.”

Seventeen minutes. He had been reading Jesse’s commit logs while Microsoft’s system was already building a case file.

He moved quickly and without waste, closing the active probes, cycling the VPN through two additional nodes, dropping the scan frequency to a level that would read as routine background traffic. Not disappearing. Adjusting. Disappearing created its own signature.

“Probability of flag escalation to analyst review,” he said.

“At current queue depth and analyst coverage, approximately forty percent chance of human review within the next six hours. Recommend a seventy-two hour pause on active scanning.”

“Agreed. Stand by on all active probes.”

He sat back.

Microsoft had a detection system that was catching patterns he’d considered within acceptable noise thresholds. That was new information and it changed the operation’s calculus. He needed to move faster and more carefully simultaneously, which was the operational equivalent of being told to run quietly.

He looked at Jesse’s commit logs still open on the secondary screen. The firewall misconfiguration. Sixteen days open. Dani’s name in the comments.

He knew where they’d be tomorrow. Dani’s patterns had been consistent for three weeks, when a problem followed her out of the office it followed her to Monorail Espresso on Capitol Hill, the corner table near the window, usually by early afternoon.

He opened his laptop bag and checked that the GitHub repository was accessible offline.

The script was clean. The solution was real. The help would be genuine, which was the most effective kind.

He closed the secondary screen.

“Sybil.”

“Sir.”

“Schedule a reminder. Monorail Espresso. Wednesday, noon.”

The Accidental Collaboration

Monorail Espresso on a Wednesday afternoon had the specific energy of people who had been fighting the same problem since Monday and were running out of patience for it. Every table occupied by someone staring at a screen with the expression of a person who had stopped seeing what was on it.

Max came through the door at 12:14, which was two minutes later than he’d planned, and spotted them before he’d finished scanning the room. Dani with her elbows on the table and her hair pushed back in the way she wore it when she’d been working for hours. Jesse beside her, his commit history open on the shared screen, his expression the particular one of someone who had been right about a problem and wrong about the solution simultaneously.

The firewall misconfiguration. Sixteen days. Still open.

He let two seconds pass before he let his expression register them.

“Dani. Jesse.”

Dani’s head came up. “Hi hon—” She stopped. A half-beat. “Max. Hi. What are you doing here?”

Jesse looked at her. Said nothing. The look was sufficient.

“Caffeine,” Max said, holding up the cup he’d ordered at the counter on his way in. “Saw you through the window. Didn’t want to interrupt.” He let the hesitation land before he added, “Everything all right? You both look like the problem is winning.”

“The problem is winning,” Jesse said, without particular warmth.

Dani waved Max over. “Fresh eyes. Come look at this. We’ve been staring at it so long we’ve stopped seeing it.”

He sat, angling the screen toward himself. The misconfiguration was exactly where he’d expected it to be. He looked at it for thirty seconds longer than necessary, making the right expressions at the right moments, the slight frown of someone encountering something familiar from an unexpected angle, the recognition arriving not as a performance but as a calibrated version of a genuine response, which was the hardest kind to fake and the most effective.

“This is a firewall misconfiguration,” he said. “I ran into something similar on a federal contract eighteen months ago. Took us four days to find it and about forty minutes to fix it once we had.”

Jesse leaned forward. “What was the fix?”

Max opened his laptop. The GitHub repository was already loaded, he’d checked the offline access the night before. He pulled up the script and turned the screen toward them.

“I built this to automate detection on that contract. It maps the ingress points and flags the configuration variance automatically. Should run clean against your infrastructure if you can point it at the right endpoint.”

Jesse read the code. Max watched him read it, the way his eyes moved, the slight acceleration when he hit the section that addressed the specific problem, the moment he recognized not just that it worked but why it worked.

“Where did you develop this?” Jesse asked.

“Federal contract, like I said. The client had a network architect who’d made the same assumption yours did about the default trust settings. Once you see it you can’t unsee it.”

Jesse looked at the screen for another moment. Then at Max. The provisional trust from the Kraken game was doing its work. Jesse had a basis for believing Max was the person he appeared to be, and the script was genuinely good, and the combination of those two things was difficult to argue with even for someone whose instincts were telling him to try.

“This is exactly what we needed,” Jesse said. Not warmly. Accurately.

They spent fifty minutes working through the implementation. Max answered questions in the register of someone who’d solved the problem before and remembered the specific wrong turns, which was true in the narrow sense that mattered. Dani’s shoulder was against his as they leaned over the shared screen, the contact easy and habitual in a way that had developed over the past three weeks without either of them making a decision about it.

Jesse noticed. He didn’t say anything.

When the fix ran clean Dani sat back with the exhale of someone who had been holding tension for sixteen days.

“I can’t believe we finally cracked it.” She looked at Max. “You’re a lifesaver. I’m going to use this in Monday’s talk. The students have been asking about exactly this class of problem.”

The script he’d built from a tool he’d originally used to exploit the same vulnerability. Presented to Microsoft’s Monday night security talk. Circulating through the professional community with Dani’s name on the recommendation.

“Happy to help,” Max said.

He stood, gathered his cup, said his goodbyes. Outside the air was cold and specific, the particular smell of Seattle at midday in winter. He walked half a block before his phone buzzed.

Pavel. One word.

Faster.

Max read it and kept walking. The operation was advancing. Jesse’s provisional trust was now operational trust, which was a different and more useful thing. Dani was about to incorporate his work into her professional platform. The script was inside the perimeter.

He put the phone away.

The warmth of fifty minutes at that table was still present somewhere in his chest in a way he didn’t catalog, which was becoming a more frequent condition, which he also didn’t catalog.

He walked back toward the loft.

Trust, But Verify

Monday had the specific flatness of a morning after a weekend that had been too good.

Dani sat at her desk with her coffee going cold beside her, her fingers resting on the handwritten notes from the comics section. She’d moved them from her bag to her desk without making a decision about it, which was its own kind of decision. The handwriting was compressed and slanted, the observations about the city’s grid still specific enough to read like someone who had paid more attention than a recent arrival had any reason to pay.

She turned her monitor on. Looked at her inbox. Looked at the notes.

Opened her inbox.

“You have that look,” Jesse said, from her cubicle entrance.

He had two coffees, which meant he’d known before he got to the kitchen that he was going to be having this conversation. She took the one he offered and felt obscurely caught.

“What look,” she said. Not a question.

“The one where you’re staring at your screen and not reading anything on it.” He settled against the cubicle wall with the ease of someone who had been doing this for years. “How was the weekend.”

She tried to be neutral about the smile and didn’t manage it. “Good. Really good. Saturday we met at Ghost Alley Espresso, have you been? Back corner, exposed brick, the kind of place you’d never find unless someone who knew showed you.”

“Someone who knew,” Jesse repeated, with the specific flatness he deployed when he was deciding whether to say a thing.

“And then Sunday, the Ballard Locks. The salmon were running.” She paused. “He’d never seen it before. The look on his face when the first one came through the fish ladder.”

Jesse was quiet for a moment. He looked at the notes on her desk without making it a point of comment, which was its own kind of comment.

“For what it’s worth,” Jesse said, “I liked him. At the game. At Monorail. That’s actually the part that’s bothering me.”

“Dani.” He set his coffee down. “Have you ever heard of pig butchering?”

She looked at him. “That’s a very specific left turn.”

“It’s a scam. Growing one, targeted mostly at people on dating platforms and professional networks.” He crossed his arms, his voice staying level and careful in the way it got when he was trying not to sound like he was accusing her of anything. “Con artists build a relationship. Take their time with it. Emotional investment first, romantic attention, the feeling that this person sees you in a way other people haven’t. And then eventually they start asking. Money, access, favors. Whatever the mark has that they came for. They call it fattening the pig before the slaughter.”

Dani felt the coffee go slightly colder in her hand.

“Jesse.”

“He showed up at your coffee shop. He’s been at every Monday talk for three weeks.”

“Six,” Dani corrected him.

“He turned up at Monorail when you and I were stuck on the firewall configuration. He just happened to have a solution.” Jesse’s voice was still careful, still level. “He’s charming and he’s smart and he knows exactly what you find interesting and he’s always in the right place.”

“Because I’ve been telling him where I’ll be,” Dani said. “Because I invited him.”

“I know.”

“He’s not asking me for anything, Jesse.”

“Not yet.”

The words landed quietly. Dani put her coffee down.

“I’m a cybersecurity professional,” she said, and heard the defensiveness in it, and pushed through. “I know what social engineering looks like. I’ve given talks on it. I’ve written papers on it. If something were wrong I would see it.”

Jesse looked at her for a moment with the expression he wore when he had done math she hadn’t done and wasn’t sure whether to show her the workings.

“I know you would,” he said. “Usually.”

“What does that mean.”

“It means you haven’t looked at him the way you look at a problem.” He picked his coffee back up. “You’ve looked at him the way you look at something you’ve already decided you want.”

The cubicle was quiet. Down the hall someone was on a call, their voice a patient murmur she couldn’t make out.

She thought about the handwriting in the comics. Too specific for someone who’d just arrived. She’d noticed. She’d filed it under charm and moved on.

“He’s different,” she said.

Jesse nodded slowly. Not agreement. The nod of someone accepting that the conversation had gone as far as it was going to go today.

“I know you can take care of yourself,” he said. “I’m not saying you can’t. I’m saying these guys are professionals. The whole point is that they don’t look like what they are.” He straightened. “Just, ask yourself how he knew you’d be at Monorail that day.”

He picked up his coffee and left. She listened to his footsteps down the corridor until she couldn’t hear them anymore.

She looked at the notes.

Ghost Alley. The fish ladder. The look on his face when the first salmon came through. She’d watched him watch it and felt something that she hadn’t felt in a long time and had been careful, since Boston, not to go looking for.

She turned back to her monitor.

Trust, but verify.

The professional principle, the one she taught students, the one she’d published. Apply it to all systems. Apply it especially to the ones that seemed to be working perfectly.

She looked at the notes one more time.

She left them where they were.