I encountered this protocol on a contract in Frankfurt a few years back, tracing a data exfiltration from a NATO signals facility. The handshake was identical: a specific initialization vector, a particular key exchange rhythm, the kind of structural signature that gets taught in state-sponsored cyber warfare programs and nowhere else. At the time, the attribution pointed toward a foreign intelligence service, and the contract endedwhen the relevant agencies took over and closed the civilian consultants out.
The handshake is the same. The origin signatures are wrong.
Every state-sponsored operation I've encountered leaves fingerprints in the routing infrastructure, IP blocks tied to identifiable geographic regions, timing that correlates to working hours in known time zones. This traffic doesn't match any of them. The routing is domestic. The transit nodes are American commercial infrastructure. The timing correlates to Eastern Standard Time, offset by irregular hours that suggest someone working around another schedule rather than operating from a dedicated facility overseas.
This isn't foreign espionage. Someone trained in state-level offensive cyber operations is running this campaign from inside the United States, and the distinction rewrites the threat profile entirely. Foreign actors are one kind of problem. Domestic actors with foreign-grade training are a different kind, with proximity and access that no outside operator could replicate.
I save the analysis, encrypt it, and reach for my phone. Griff's number sits above Rivera's in my recent calls, and I scroll past it without pausing, which is not the same as not noticing.
Rivera answers on the second ring. "Bradshaw."
"I need twenty minutes in a secure facility. I have findings on the relay device that change the scope of this investigation."
"My office. Give me fifteen minutes."
Rivera's office in the NCIS wing smells like stale coffee and paper files, and her desk carries the organized chaos of someone running more cases than any single agent should. I set my laptop on the edge and walk her through it: the burst transmissions, the state-level protocol, the domestic routing.
"You're telling me someone with foreign intelligence training is operating stateside," she says.
"I'm telling you someone trained in the same offensive cyber doctrine used by state-sponsored programs built the command-and-control architecture for this entire operation. The relay device, the malware payloads, the coordinated activation mechanism. It's all one hand." I pull up the transmission timeline and overlay it against the incident dates she shared with me weeks ago. Fallon McKay's research breach. The hospital supply chain compromise. The communications intrusion. "Your three incidents aren't parallel threats. They're phases. Sequential infrastructure mapping by a single coordinated operation with a domestic handler."
Rivera stares at the overlay for a long moment. The dates align. The escalation pattern is clean, each phase building on the intelligence gathered in the previous one.
"Daniel Rexford, the contractor who sold McKay’s coastal research to foreign buyers, is cooperating from prison," she says. "His debrief mentioned a recruitment approach that was 'professional, organized, ideological.' He described it as military in discipline but civilian in origin." She meets my gaze. "He also said the recruiter referenced Tidewater by name months before the McKay breach. They'd been watching the base long before they started compromising it."
The scope just expanded past a single hacker or even a small team. Someone planned a campaign against a joint expeditionary base with the patience and resources to execute it across months, and they recruited assets along the way. The relay device is infrastructure. The malware is weaponry. With the joint training exercise now days away, the trigger event this was all built toward is closing fast.
"I'll have a full technical brief ready for Hartwell by morning," I tell her. "But Rivera, this person has been watching me work. They've had visibility into my analysis through thecompromised camera feeds. They know I found the relay device. Which means the clock is running."
Rivera nods. Her expression says she already knew that and was waiting for me to confirm it.
The drive back to the loft takes longer than usual. The bridge traffic stacks up at shift change, and by the time the escort leaves me as I climb the stairs and disarm the security system, the sun has dropped behind the warehouses. The loft is empty. Griff's boots are still gone. His keys aren't on the hook. The kitchen counter is clean except for the mug I left this morning.
It wasn't that long ago that this was a stranger's loft, and now my brain is flagging his absence as a deviation from baseline rather than a return to normal.
I change into leggings and a clean sweater, make tea, and carry it to the balcony with the bottle of Jack Daniel's Reserve I found in his cabinet and have been rationing like a woman who understands the strategic value of good bourbon in a dry loft. The bay is pewter and pink in the fading light, the steel platform cold under my bare feet, and the whiskey tastes like warmth and smoke and the particular brand of recklessness I've been trying to talk myself out of for a week.
I'm on my second measure when the front door opens and closes. The deadbolt turns. The security system arms. His footsteps cross the main space, and there's a shift in the cadence tonight, a tension in the rhythm that I wouldn't have caught weeks ago but that registers now.
I have apparently memorized how this man walks through his own apartment, and the deviation from baseline is data I can't ignore.
The balcony door slides open.
"You found the bourbon," he says.
"You hid it behind protein powder. Tactically sound but ultimately futile." I don't turn around. "Rough day at the office?"
"Define rough."
"Anywhere past the point where you come home looking like you want to hit something instead of defuse it."
"That obvious?" He leans against the railing beside me, closer than usual. His jaw is tight and his hands aren't doing the loose, unhurried thing they normally do. His knuckles are white where they grip the railing.
"I'm a data analyst, Holland. I notice patterns. Your current pattern is agitated."
"My current pattern is thirsty." He takes the bourbon from my hand without asking, drinks, and doesn't give it back. "You going to tell me about your day, or are we doing the thing where we stare at the water and pretend we're fine?"
"I had a productive afternoon with your base's compromised infrastructure. You?"
