Morning light pours through the floor-to-ceiling windows and turns the entire loft gold. The exposed brick glows warm. The bay is a flat sheet of silver beyond the glass, and the whole space looks like something from a design magazine, the kind that would caption it "industrial minimalism" and fail to mention that it's actually just a man who owns nothing personal and hasn't hung a single photograph on his walls.
Griff stands at the stove in a grey t-shirt and sweatpants, barefoot, moving between the skillet and the coffee maker with the easy coordination of someone who does this every morning. His hair is damp. He hasn't shaved. The muscles in his forearm shift when he reaches for a plate, and I look away before I catalog anything else because I have already noticed too many things about this man and the list is becoming a liability.
"Morning," he says without turning around. "Coffee's ready. Black, no sugar."
He knows how I take my coffee. He has known how I take my coffee for weeks, which means every time he appeared in my workspace with a cup during those security sweeps, the order wasn't a guess. It was data he'd collected and stored and deployed at precisely the moment it would be most effective, and the strategic patience of that bothers me more than the bomb did.
The mug is on the island next to my monitors, which he has apparently wiped down while I slept. The shortbread is still there. The coffee is perfect.
"Is that George Strait?" I ask, because I need to say something antagonistic before the domesticity of this scene swallows me whole.
"Waylon Jennings."
"I can't tell the difference, and I'd like to keep it that way. Could you turn it off?"
"I could." He slides scrambled eggs onto a plate next to the bacon, adds toast, and sets the whole thing on the island across from my monitors. "But I won't. My kitchen, my music."
"Your kitchen is currently my office, and your music is interfering with my ability to process complex network architectures."
"Then eat your breakfast and go work in your room." He pours his own coffee and leans against the counter, watching me with the calm, unhurried attention that makes me want to throw things. "Food's getting cold, Nox."
I eat the breakfast because I'm hungry and because refusing would be petty and transparent, and I am neither of those things. The eggs are perfectly scrambled. The bacon is crisp without being burnt. The toast has actual butter on it, the kind that comes in a block, not a tub. I eat all of it while pretending to read code on my center monitor, and I don't compliment anyof it because giving Griff positive reinforcement for feeding me would create a pattern I can't afford.
He watches me eat and says nothing, and his silence is worse than any comment he could make because it means he already knows.
The comm building, later that morning, is a relief. Four walls, fluorescent lights, the familiar hum of servers and the chemical smell of recycled air. Griff drives me in so Hartwell's security escort isn’t needed, and he walks me to the door of my workspace and sweeps the room before he leaves, checking things I've already checked, and I let him because arguing about it would take longer than letting him finish.
When the door closes behind him, I pull up everything I've been running overnight and start sorting through the results.
The malware is worse than I thought. What I found earlier was the surface layer, the communication system compromise that triggered the investigation. But the overnight traces have uncovered something underneath it, and the thread that cracked it open was the command-and-control channel. Every piece of malware needs to phone home somewhere, needs to receive instructions from whoever deployed it. The communication logic bomb I flagged in my initial report had a listener buried in its activation code, a channel waiting for a trigger signal from a controller I hadn't yet located. Last night, I found the controller. And once I had that, I could see everything it was connected to.
I already knew the base camera feeds were compromised. I found that during the hospital investigation, when I told Gwen the hacker had been monitoring security footage to track patrol patterns and shift changes.
What I didn't know, and what the command channel reveals, is that the camera access has been rebuilt and expanded since then. The feeds aren't just being passively monitored anymore. They're being mirrored in real time to an external server, withrecording capability and what looks like automated motion-tracking on specific entry points. Someone took the access they had during the hospital operation and turned it into a permanent surveillance infrastructure.
The base access control system has a backdoor that would allow an authorized user's credentials to be cloned and deployed without triggering a duplicate-entry alert.
And the automated logistics tracking, the system that reconciles equipment manifests against physical inventory, has been modified to suppress discrepancy flags. The system would tell you everything is accounted for even if it isn't. I recognize the technique. It's a more sophisticated version of what the hacker used during the hospital supply chain operation, the intercept layer that doctored reconciliation reports so Gwen's equipment counts never matched reality.
Each component is connected to the same controller. One signal, and Tidewater goes dark: cameras blind, access controls bypassed, logistics reporting unreliable, communications severed. A total blackout of every digital system the base depends on to function.
I run the implications three different ways before I call anyone. The engineering is meticulous, and what makes it terrifying is the pattern. This isn't new infrastructure built from scratch. It's the previous compromises, the ones from Fallon McKay's research theft and Gwen's hospital investigation, rebuilt and integrated into a single coordinated system.
Rivera told me about the three-attack pattern weeks ago. Three separate incidents, three different systems. What I'm looking at now is the answer to the question she was really asking: what if they weren't separate?
Someone took everything they learned from the first two operations and wove it into a unified architecture. The camera access from the hospital case. The network penetrationtechniques from the McKay case. The communication system logic bomb I found when I arrived. Each one refined, expanded, and connected through a command structure that can activate them all simultaneously.
I know who builds systems like this because I've worked alongside them. Military cyber operations personnel, the people who design offensive network warfare tools for the Department of Defense. The command architecture follows doctrine, not just the methodology but the specific structural patterns, the way the controller validates its connections, the failover redundancy built into the trigger mechanism. The architect either graduated from one of those programs or studied under someone who did, and they built this with the specific intention of turning Tidewater's own infrastructure into a weapon against itself.
I start building a profile. The code has habits the way handwriting has habits: specific preferences in variable naming conventions, favorite encryption libraries, a particular way of structuring conditional logic that tells me about the programmer's training background. I document every quirk and save the profile to an encrypted file because this is the kind of evidence that makes cases.
By the time Rivera and Hartwell arrive for the briefing, I have enough to present. Griff is with them, which I expected, and he takes a position against the wall near the door where he can see both the room and the corridor simultaneously. He's in uniform and whatever the shift from the barefoot man in a grey t-shirt cooking eggs to the lieutenant in fatigues with his sidearm on his hip is doing to my pulse is something I refuse to examine too closely.
I present the findings without softening them. The monitors show the full scope of the compromise, each system highlighted in red, the connections between them mapped in a web thatcovers most of the screen. The controller sits at the center like a spider.
"This is what I found overnight," I tell them. "The communication breach we've been investigating is one layer of a much larger intrusion. I found the command-and-control channel that links it to compromises across multiple systems, including the camera surveillance access that was used during the hospital investigation and the base access controls. Each component has been redesigned and connected to activate simultaneously on a single trigger signal."
Hartwell's face goes still. Rivera leans forward.
