Chapter 12
NOX
Griff is already dressed and armed by the time I find my sweater on the bedroom floor.
I watch him check his sidearm, clip his radio, and pull his tactical vest from the hook beside the front door with the fluid efficiency of someone who has rehearsed this sequence so many times that his body performs it independent of whatever else is happening in his head.
Five minutes ago, my cheek was on his chest and his arm was around my waist and neither of us was thinking about Garrick.
"Get dressed. Comm building." His voice is already somewhere else, running tactical calculations behind the two words he gives me.
He waits while I dress, standing by the front door with his hand on the deadbolt and his eyes on the stairwell camera feed, because Griff Holland does not leave me alone in a building when a man with a forged badge is running around loose, doing who knows what.
I find my shoes, grab my laptop bag, and he walks me to the truck with one hand on the small of my back and the other resting on his sidearm.
The base, when we get there, is awake in the wrong way, lights burning in buildings that should be closed, vehicles moving along routes that don't match the normal overnight patterns. The lockdown has changed Tidewater's rhythm, and the installation feels like a held breath.
He pulls up to the comm building entrance and kills the engine long enough to scan the lot, the entrance, the shadows along the building's east side.
Then he kisses me once, hard and fast, his hand gripping the back of my neck in a hold that communicates everything his words are too clipped to carry.
"Stay here until I call."
"Yes, because I was planning to wander the base looking for a man with a forged badge and a grudge."
His jaw tightens, but the corner of his mouth gives a fraction. "Smartass."
"It's in my job description."
He watches me badge through the entrance before he pulls away, and I feel the weight of his attention through the glass doors until the truck rounds the corner and the taillights disappear.
The comm building lobby is bright and empty, and the silence that settles once he's gone has started to feel like absence rather than peace.
My station is where I left it. The monitors are in standby, the containment protocol logs are still showing clean, and the topology map is stable. I settle into the chair, pull my knees up, and bring the screens to life.
The tea from last night is cold in its mug, and the brown ring where it spilled has dried into a stain I should clean but won't because there are more pressing things to do than housekeeping, such as preventing a military installation from going digitally blind during a live exercise.
The counterstrike takes shape over the next several hours.
The concept is straightforward: build a kill switch for the kill switch.
Garrick's malware is designed to cascade through Tidewater's communication systems when the exercise pushes them to operational load.
What I'm building needs to sit dormant inside the same architecture, monitoring the same triggers, and the instant the malware fires, intercept the activation signal, isolate the infected nodes, and deploy a clean protocol that restores each system before the blackout can propagate.
It's a mirror of what Garrick built, designed to see the same things he sees and move faster.
The concept is straightforward. The execution is the hardest thing I've ever coded.
The malware isn't a single payload. It's a distributed framework spread across dozens of network nodes, each one holding a fragment of the attack code that only assembles when the activation signal passes through.
My interception has to anticipate the assembly sequence, predict which nodes fire in which order, and deploy targeted countermeasures to each one in the milliseconds between activation and execution.
If I miss a node, the cascade continues through the gap. If I mistime the interception, it fires too early and the malware reroutes around it.
Most of the nodes behave predictably. They follow the same design patterns, the same activation logic, the same structural habits I've been cataloging for weeks.
But three of them sit wrong. Their response signatures carry latency that doesn't match pure software execution, a fractional delay in the handshake cycle that suggests something between the digital trigger and the activation is introducing a variable my models can't account for.
I flag them, tag the anomaly in my working notes, and move on to the nodes I can solve. The outliers will keep.
I've been building toward this since the first night in the comm building, when the code on my screen was a stranger's handwriting and I was reading it letter by letter trying to learn the grammar.
Now I know the grammar better than the person who wrote it.
I know his variable naming conventions, his conditional logic preferences, his structural habits.
The malware isn't a stranger anymore. It's a dialect I've learned to speak, and what I'm building speaks it back.
The monitors glow blue. The code scrolls. My fingers find the rhythm that means the work is good, the rapid-fire bursts punctuated by pauses where I read and test and adjust. The building is silent around me except for the occasional sounds of the overnight watch.
Griff checks in by text, short updates that tell me where he is and what he's found:
Eastern perimeter clear. Moving to power hub. Sullivan's team covering the waterfront.
Each message is clipped, and I read the subtext underneath like a secondary encryption layer.
He's checking on me. The perimeter reports are real, but the frequency has nothing to do with protocol and everything to do with the fact that he left my bed an hour ago and is currently hunting someone who wants me dead.
I text back once:
Counterstrike barely past a third. Stop texting me. I'm busy.
His reply comes within seconds:
Noted. Filing complaint.
My mouth twitches. I go back to the code.
The message arrives sometime around eight, or close to it. I've stopped tracking the clock because the clock is irrelevant when the code is moving.
It comes through the compromised network, routed through the command-and-control infrastructure that Garrick's handler has been using for months. My monitoring framework flags the incoming packet automatically, red and pulsing in the corner of my screen, and I divert my attention to examine it.
The message is addressed to my workstation by its network identifier, not the generic identifier assigned to the comm building terminal but the specific one I configured when I set up my monitoring framework.
The one that only exists because I created it, which means whoever sent this has been inside my infrastructure, watching my tools, reading my configurations.
The text is short.
Ms. Bradshaw. Your work is impressive, but your position is exposed. The converted warehouse on the waterfront belongs to Lt. Holland. So do you, apparently. The next device will not be a warning. Step back, or step into the blast radius. Your choice.
My hands go still on the keyboard.
The loft address isn't new. We knew Garrick's handler had it from the intercepted message that sent Griff driving across base at three in the morning. I processed that threat, adjusted the security posture, and kept working. The address is old intelligence.
What isn't old is the rest of it.
The intercepted message referenced "the analyst" by role. This one uses my name. The intercepted message traveled between Garrick and his handler, a communication I overheard. This one is addressed to my workstation, a communication aimed at me.
The line about belonging to Lt. Holland is the part that turns my stomach.
That's not information you pull from motor pool records or contractor access logs.
That's information you get from watching closely, long enough to see what changed between the woman who arrived at Tidewater alone and the woman who leaves the comm building every night in a truck that isn't hers.
They've been inside my monitoring framework.
The workstation identifier I'm staring at is custom, buried in infrastructure I built myself.
Finding it means someone mapped my tools, read my configurations, and studied my architecture with enough patience to understand not just what I built but how I think.
The threat to my safety is a problem I've solved before. The threat to my infrastructure is a different category, because if they can see my tools, they can see the counterstrike, and if they can see the counterstrike, they can build around it.
I should tell Griff. The calculus is clear: withholding threat intelligence from the person responsible for physical security is a liability.
Rivera would say the same thing. Hartwell would order it.
The last time a message referenced the loft, I picked up the phone and called him before the adrenaline finished hitting my bloodstream, because that was intercepted intelligence, a communication between Garrick and his handler that required a tactical response.
This message is different. This message is addressed to me.
Telling Griff about it wouldn't be a security briefing. It would be a confession.
My fingers move to my phone, and they stop.
The counterstrike is barely started. The exercise launches tomorrow morning.
If I tell Griff, Griff tells Hartwell, and Hartwell pulls me from the comm building and assigns a security detail that turns my workstation into a fishbowl.
Everything I've built stops where it is, and when the exercise goes live, the malware fires into an undefended infrastructure.