Chapter 2
NOX
The breach is beautiful.
I hate that my first thought is admiration, but there it is.
Whoever built this intrusion architecture understood Tidewater's communication protocols at a structural level, not just the ports and pathways but the logic underneath, how the systems were designed to talk to each other and the assumptions baked into that design.
They found the assumptions. Then they exploited every single one of them.
I found it during what was supposed to be a routine audit pass.
It was an outbound data transfer on a port that shouldn't have been active, using credentials that shouldn't have existed, moving files that shouldn't have been accessible to anything outside of base command.
I locked down what I could, traced what I couldn't, and called Hartwell before the transfer finished resolving.
Now my screens have multiplied. The standard three-monitor setup is five, two additional laptops flanking my workstation like sentries, each running a different trace while I map the intrusion's footprint across Tidewater's network.
Code scrolls on the center screen, access logs populate the left, and packet capture data fills the right.
The two laptops handle the overflow, routing tables and DNS records that tell me where the stolen data went after it left the building.
Hartwell stands behind me. Rivera is beside him, arms folded, watching the screens with the focused intensity of someone who understands about a third of what she's seeing and is too smart to pretend otherwise.
I respect that. The ones who nod along like they understand are the ones who waste my time with stupid questions later.
Somewhere behind us, Griff Holland is running a physical sweep of the building.
I can hear him moving through the adjacent spaces, the soft beep of his tablet as he logs each checkpoint against a timeline I sent to his device.
Even through the wall, his presence snags at something in my peripheral awareness that should be dormant during a breach investigation.
I catch the rhythm of his footsteps, the measured pauses, the occasional low murmur into his radio.
He takes up auditory space the same way he takes up physical space, steadily and without apology, and I'm irritated at my own inability to tune him out.
"The training schedules were accessed through a compromised service account," I tell Hartwell and Rivera, my attention fixed on the center monitor.
"Whoever did this didn't brute-force their way in.
They had legitimate credentials, or close enough to fool the authentication layer.
The account belongs to a systems administrator who left Tidewater months ago. "
"That account should have been deactivated," Rivera says.
"It should have been. It wasn't." I pull up the access history and project it onto the wall screen so they can see for themselves.
"The account was dormant for months after his departure.
Then, weeks ago, someone reactivated it from an external IP address routed through a commercial VPN.
They've been using it intermittently since, short sessions, always during off-peak hours, never long enough to trigger the automated monitoring thresholds. "
"Weeks." Hartwell's voice carries the kind of anger that military officers compress into a calm they can't afford to break. "Someone has had access to our classified systems for weeks and nobody flagged it."
"Nobody was looking." I switch to the packet capture data. "But this is the part that should concern you more than the training schedules."
I've been saving this because dropping it without context would cause the wrong kind of panic, and Hartwell needs to understand the scope before he reacts.
"The data theft was the distraction. While they were pulling training schedules through the front door, they were also installing something through the back.
" I bring up the code fragment I isolated earlier, several hundred lines of dormant malware nested inside a routine communication protocol update.
"This is a logic bomb. It's embedded in the base's primary communication relay, and it's designed to sit dormant until it receives a specific trigger signal. "
Rivera leans forward. "What does it do when triggered?"
"Everything. Simultaneously." I highlight the execution pathways, tracing the branching logic with my cursor.
"Radio communications, encrypted data channels, base-wide alert systems, even the backup frequencies.
When this fires, every communication system on Tidewater goes dark.
Every single one. You won't be able to talk to each other, talk to command, or talk to the outside world. "
The silence in the room has a different texture now. Hartwell's jaw has gone rigid.
"Someone was building a kill switch for your digital infrastructure," I say. "And they've already installed it. All they need is to push the button."
"Can you remove it?" Hartwell asks.
"I can. But not tonight, and not without understanding the full scope of what else they may have planted.
" I close the code window and turn to face him.
"Commander, I've been auditing your systems for weeks.
The anomalies I flagged in my preliminary reports, the ones your IT department dismissed as legacy issues, those weren't bugs.
They were breadcrumbs. Whoever built this has been inside your network for months, possibly longer, and they've been very, very careful. "
"How careful?"
"Careful enough that your own analysts never noticed.
Careful enough to route everything through dead accounts and deprecated protocols that nobody monitors because everyone assumes they're inactive.
" I hold his gaze. "This isn't a hacker.
This is someone who understands how military networks are built, maintained, and neglected.
Someone with training, resources, and patience. "
Hartwell exchanges a look with Rivera. Whatever passes between them carries the weight of a conversation they've already been having.
"Secure what you can tonight," Hartwell says.
"Full briefing at oh-eight-hundred tomorrow.
I want a complete threat assessment, including recommendations for countermeasures.
" He pauses at the door. "And Ms. Bradshaw, effective immediately, your contract scope has expanded.
You're no longer conducting an audit. You're running a counterintelligence investigation on the cyber side.
Whatever resources you need, you have them. "
"I'll need them," I say. "And Commander? My contract was scoped for a security audit, not a counterintelligence operation. If the mission changes, the terms change. I'll have revised numbers to you by morning."
Hartwell's mouth tightens, but he nods. He knows what I'm worth. More importantly, he knows he can't afford to find out what happens if I walk.
They leave. The door closes, and the room settles back into the hum of equipment and the glow of monitors.
Without Hartwell and Rivera filling the space, Holland's proximity in the adjacent room sharpens.
I can hear his footsteps pausing, the scratch of a stylus on a tablet screen.
I've worked in secure facilities alongside dozens of military personnel and not one of them has ever occupied the next room in a way that interfered with my concentration.
I don't like it. I don't like any part of what it implies.
I spend another hour mapping the malware's architecture before my eyes start losing focus and my coffee starts tasting like burnt copper.
The drive to my B&B takes a quarter hour, most of it on empty roads that wind along the waterfront toward the cluster of Victorian houses near the old harbor district.
The Kellaway is the kind of place that caters to tourists and visiting academics, not defense contractors.
It's three stories of restored gingerbread trim and wraparound porches, owned by a retired couple who leave a plate of shortbread outside my door every evening and have learned not to ask questions about the hours I keep.
I chose it for the reliable wifi, the private entrance to my second-floor room, and the conspicuous absence of anyone in uniform.
After a full day inside Tidewater's fences, I need a space that doesn't smell like jet fuel and protocol.
Hartwell's security officer had opinions about my working off base.
I had opinions about his opinions, and my contract reflects the outcome.
I maintain a secure terminal in my room with encrypted VPN access to Tidewater's network, hardware firewall, and endpoint protection that I built myself because I don't trust anyone else's.
The brass knows I work from here. They don't love it, but my contract stipulates operational autonomy on the condition that I maintain security protocols equivalent to or exceeding on-base standards. I exceed them. I always exceed them.
My room looks the way it always looks, with the four-poster bed buried under laptops, a tablet, a stack of external hard drives, and the remnants of the room service.
I clear a path to the center of the mattress, strip off the layered cardigan and the boots, and settle cross-legged against the headboard with my primary laptop balanced on a pillow.
This is the part nobody sees. The hotel rooms and borrowed offices and temporary spaces where I do the real thinking, surrounded by plates I keep forgetting to set outside the door and equipment I should organize but won't because the mess is a system that makes sense to me even if it looks like chaos to everyone else.