Chapter 21
Chapter Twenty-One
REEVE
Saturday. Six forty-seven AM.
I run the monitoring check at the same time every morning because routine catches anomalies, and anomalies get people killed. Not excitement, not urgency, not the heightened attention that comes when you know something is wrong.
The ordinary Saturday morning check, the same sequence I’ve run every day since Mira arrived, cross-referencing access logs against expected activity and flagging anything that falls outside the pattern.
I’m on my second cup of coffee when I find it.
Mira’s medical file was accessed at eleven fourteen PM last night from an IP address that isn’t Doc’s system and isn’t the compound’s network. I look at the address for a moment, and then I open the trace window and start working backward through the registration chain.
The IP resolves to a server registered to a logistics company in Tacoma. No apparent healthcare connection. No connection to Doc’s referral network, to the regional hospital system, to any medical entity I have on file for Mira’s care.
I check the registration date. The server was registered eight months ago and has no other activity in any database I can access.
I put the logistics company aside and open her appointment schedule.
A high-risk pregnancy evaluation has been added for Monday morning at a facility in Cascade County, two counties over.
The appointment wasn’t in the schedule on Thursday when I ran the afternoon check.
It appeared sometime between Thursday evening and eleven fourteen PM last night, which is when the outside IP accessed her file.
I pull the facility’s credentials through the state medical board database.
Licensed, accredited, legitimate on every surface I can see. A small specialty clinic that handles high-risk obstetric cases referred from the regional hospital network. Real doctors. Real equipment. Real patients, presumably, who arrive for real appointments and receive real care.
I go back to the shell company monitoring I’ve been running since week one.
It takes me eleven minutes to find it.
Wire transfer on Thursday afternoon from an entity registered in Delaware with no operational history beyond six months.
Two layers of corporate structure separate that entity from a holding company in Nevada, and two more layers separate the Nevada company from a financial services firm in Zurich that appears on three other documents in the file I’ve been building on Viktor’s network since Mira arrived.
The wire went to an account registered to the name of the Cascade County clinic’s administrative director.
I sit back in my chair.
The amount isn’t large. That’s the detail that lands hardest, actually.
It isn’t a number that suggests desperation or extravagance.
It’s a number that suggests a man who has done this before and knows exactly what institutional access costs in a mid-sized regional medical system.
Not too much, not too little. Enough to make the administrator’s calculation simple without making the transaction look irregular from the outside.
I open the transfer paperwork for Monday’s appointment.
The ambulance is pre-authorized. Private medical transport, a company called Patient Transfer Solutions, registered in Oregon, no flags on any database I have access to. The authorization paperwork is dated last Tuesday, which is three days before the appointment was added to Mira’s schedule.
I read that twice.
The transport was authorized before the appointment existed.
Someone built the legal infrastructure for this transfer, the ambulance, the authorization, and the medical necessity documentation before they scheduled the transfer itself.
The appointment in Mira’s file is the last piece of a structure that was fully assembled before she knew the structure existed.
Monday morning, a legitimate ambulance from a licensed medical transport company was planning to arrive at the regional hospital with pre-authorized transfer paperwork signed by a doctor whose credentials would check out and countersigned by an administrator who had accepted a wire transfer from a shell company connected to Viktor Sokolov’s financial network.
The ambulance would take her to a facility two counties over.
She would not arrive at that facility.
I pick up my phone and call the regional hospital’s administrative line.
It’s early enough that I get a duty administrator rather than the main office, which is better.
I identify myself as the medical coordinator for a private patient, use the language I’ve learned from watching Doc operate within the system for two weeks, and request the immediate cancellation of a Monday appointment for a patient currently under the full-time care of a private physician.
Club doctor handles all care. All external referrals require prior authorization from the primary physician.
The appointment was scheduled without that authorization and needs to be removed.
The duty administrator is compliant and efficient, and the appointment is canceled in four minutes.
I hang up, open a separate browser, and navigate to the state medical board’s anonymous complaint portal.
I file a detailed report about the Cascade County administrator’s unauthorized access to a patient’s medical records and the privacy violations associated with scheduling procedures without physician authorization.
I include the IP access timestamp, the appointment addition timeline, and enough specific detail that the complaint will require a formal investigation to close.
I don’t include the wire transfer. That goes somewhere else, later, through a channel that won’t connect back to this compound.
I send the complaint and close the browser.
Fourteen minutes, start to finish, from finding the IP access to canceling the appointment and filing the complaint. I pick up my phone and call Cade.
He picks up on the second ring. “Yeah.”
“Security office,” I say. “Now.”
He doesn’t ask questions. Eight minutes later, he’s at the door.
I walk him through it sequentially. The IP access, the appointment, the facility, the administrator, the wire transfer, and the transport authorization dated three days before the appointment was authorized.
I put the documents on the screen as I go, and I let him read each one in full before I move to the next, because Cade reads the way I read, completely and without rushing, and he makes better decisions when he’s had the full picture rather than a summary of it.
When I finish, he sits in the second chair and looks at the screen.
The silence runs for almost a minute.
“Monday morning,” he says.
“If I had run the check an hour later. If I’d skipped it because it’s Saturday. If I’d flagged the IP access and left the appointment for later.” I look at the screen. “She would have been in that ambulance before anyone on this compound knew the appointment existed.”
Cade looks at the transfer authorization. The date in the top right corner, last Tuesday, three days before the appointment was added.
“He built it while we were running the counterstrike,” he says.
“Yes. The wire transfer went out Thursday afternoon, which is the same day our counterstrike executed. He was absorbing the counterstrike’s impact and building this simultaneously.
” I pause. “He didn’t react to the counterstrike.
He had this already running. The counterstrike hit him, and he didn’t adjust his timeline. He just kept going.”
Cade is quiet.
“He doesn’t need to come through the gate,” I say.
“That’s the thing I need you to understand fully.
The physical perimeter we’ve built is real, and it’s effective against direct approaches.
But Viktor isn’t making direct approaches.
He needs one person inside a system that Mira has a legitimate reason to interact with.
A medical administrator. A doctor outside Doc’s network.
A social worker, an insurance case manager, a hospital intake coordinator.
Any institutional contact point is a potential purchase. ”
“Then she doesn’t have institutional contact points,” Cade says.
“That’s the only viable response,” I agree.
“Doc handles everything that can be handled internally. Any external referral requires my personal verification of every person involved before the appointment is scheduled, not before she attends it. Before it exists.” I pull up the monitoring protocol I’ve been drafting since I found the IP address.
“I’m expanding the monitoring to cover all medical databases that hold her records.
Daily checks, not weekly. Any access from an unverified IP gets flagged immediately, and the appointment or record change gets reversed before anyone has time to act on it. ”
Cade reads the protocol. “Do it,” he says.
He stands up and looks at the screen one more time. The transfer authorization with its Tuesday date. The appointment that no longer exists in anyone’s system. The administrator whose morning is about to become significantly more complicated.
“She needs to know,” he says.
“Yes,” I say. “She does.”
He leaves, and I sit in the security office with the screen in front of me and the morning coming through the narrow window above the desk, the compound starting its Saturday, boots on gravel, the workshop doors going up, and someone’s voice carrying across the yard.
I close the laptop and go to find Mira.
She’s in her apartment, sitting at the table with a mug and a book she isn’t reading, and she looks up when I knock.
I come in, and I sit across from her, and I tell her everything, the same way I told Cade, sequentially and completely, because she deserves the full picture more than she deserves to be managed.
She listens without interrupting.
When I finish, she’s quiet for a moment.
“The administrator,” she says. “How much?”
I tell her the number.
She looks at the table. Something moves through her face, too fast and too controlled to name, and then she looks back up. “You ran the check this morning,” she says. “The same check you run every morning.”
“Yes.”
“And that’s the only reason I’m sitting here.”
I hold her eyes. “Yes.”
She’s quiet for another moment. Then she says, “Thank you,” in a voice that is completely level, and she’s not performing gratitude but simply stating a fact about what something cost and what it was worth.
I nod once and stand up and go to the door.
“Reeve,” she says.
I stop.
“He’s going to try again,” she says. “Through a different system, with a different contact, with paperwork that looks different from this one. He doesn’t stop when a method fails. He files the failure and builds a better version.”
“I know,” I say.
“So do I,” she says. “That’s why I’m telling you. Not because you need the information. Because I need you to know that I know.”
I look at her for a moment.
Then I leave.