Wes Garrick is a former Navy cryptologic warfare officer. He served at Tidewater as part of the cyber operations unit until a separation a few years back with an honorable discharge and no flags in his service record. He's currently employed as a civilian defense contractor with Meridian Systems, which holds an active infrastructure maintenance contract on base. He has active credentials and active access, a threat sitting in plain sight on a DoD payroll.
Rivera puts his photo on the screen. He's average build, clean-shaven, with a regulation haircut growing out into something civilian and a face that doesn't snag attention on a military installation. He looks like half the contractors walking through the front gate every morning, and that's what makes him dangerous. This is the person behind the stolen equipment from my training cage and the device on Nox's landing, and the ordinariness of him lands cold in my stomach because threats that look like threats are manageable. The ones that look likeeveryone else are the ones who get close enough to do real damage.
I've been staring at this man for months without knowing it. Every contractor I've nodded to in the corridor, every face that blended into the daily flow of a joint base running at operational tempo, and one of them was mapping my shop, stealing my equipment, and building bombs with my training materials. I smiled at the bastard on his way through the gate.
Nox has been building the coder profile since the breach, cataloging every habit and preference buried in the malware architecture with the same patience I'd give to a suspect circuit. Last night she narrowed the final match. Rivera's team ran it against personnel records from the military cyber warfare development program. The way Nox explained it, the malware carried habits the way solder work carries habits: signature patterns in how the code was built, specific tools and techniques that pointed to a narrow subset of operators who trained on that platform. Garrick's name surfaced because his access dates aligned with the relay device installation window and his contractor credentials gave him physical access to the infrastructure corridors where the device was planted.
"He's been walking through the front gate for months," Hartwell says, and the controlled anger in his voice is the kind that gets people reassigned or court-martialed.
"Longer than that." Rivera pulls up Garrick's access log on the conference room screen. "His contractor badge has been active since Meridian won the maintenance contract. He's had legitimate reasons to be on base, in restricted areas, near sensitive infrastructure. Nobody questioned it because nobody had reason to."
I'm leaning against the wall near the door, arms crossed, one boot flat against the concrete. The posture puts me between the exit and the briefing table, which is habit, and it puts Garrick'sface at eye level on the screen, which is the point. "Until now," I say from the wall.
"Until now." Rivera closes the file. "We want surveillance first. If Garrick is part of a larger network, arresting him tips off whoever he's reporting to. NCIS will put a team on him. Monitor his movements, his communications, his contacts on and off base. When we move, we move on the whole structure, not just the one name we can see."
So it's surveillance for now. Patient, disciplined, methodical surveillance while the man who built a bomb for Nox's doorstep keeps swiping his badge and walking through my base. Rivera's right, and I hate that she's right, because every instinct I've got is saying put him in a room and take him apart until we know who sent him.
Hartwell agrees. The plan is clean: watch Garrick, build the case, identify the cell, and time the takedown to neutralize the infrastructure attack before the joint training exercise. Rivera will coordinate with her team. Nox will continue monitoring the compromised systems from the comm building. My job stays the same: keep the physical side secure and keep Nox alive.
That second part is becoming less of an assignment and more of a fixation, but Hartwell doesn't need to know that.
The briefing ends, and I drive to the EOD shop with Garrick's face sitting behind my eyes like a component I haven't finished analyzing.
Rowe is already at the bay when I arrive, prepping for the afternoon's routine training drill. The bay is a long concrete building with overhead doors that open onto the range, and the interior smells like every EOD workspace I've ever worked in: solvent, metal, and the faint chemical tang of practice charges stored in the magazine lockers along the back wall. My tools are organized on the bench in the order I use them. The trainingdevices sit in the locked cage by the range door, inventoried and logged.
I've been running inventory checks on that cage every morning since the B&B device. Nobody asked me to. The analysis I did on Nox's IED showed a construction methodology that matched our curriculum at Eglin down to the wire routing and the solder technique. After that, I started counting. I went through every detonator, every battery, every practice charge, every component with a serial number.
The first full count turned up discrepancies. Practice detonators had been logged as expended during training exercises where I hadn't used that quantity. Battery packs had been written off as depleted that should still have been on the shelf. Someone had been pulling components from my supply chain and burying the trail in routine expenditure logs. My own materials had been used to build the device that targeted the woman sleeping in my guest room. The counting became non-negotiable after that.
Rowe thinks I've lost my mind. He hasn't said it, but the way he watches me count practice charges every morning carries a specific patience that translates roughly tomy CO has developed a new compulsion and I'm choosing not to comment.
This morning, something is wrong.
I'm standing at the training cage with the inventory clipboard, checking the practice IEDs we use for diagnostic training, when I see it. There should be eight training devices in the second rack. There are eight, but one of them is very slightly out of position.
I don't touch it. My hands stop moving and my brain takes over, running the assessment before my body has time to react. The device has the correct casing, the correct markings, the correct dimensions. But the weight distribution is wrong when I lift the rack's edge to slide out the adjacent unit, and wrongweight in a training device means wrong internals, and wrong internals in a building full of practice charges means someone replaced a dummy with a live component.
"Rowe." My voice comes out level. "Step back from the bench. Don't touch anything."
He reads my tone and moves without questioning it.
I set the clipboard down and pull my flashlight. From two feet away, without touching the device, I can see the modification. The practice casing has been opened and resealed, the paint line at the seam fractionally thicker where new adhesive was applied over the original factory seal. Inside this casing, behind the inert filler that's supposed to be there, is something that will respond very differently to the electrical charge we run through the training circuit during drill sessions.
"We need to clear the building," I tell Rowe. "Call Hartwell's office. Tell them we have a live device in the EOD training bay, planted inside our equipment. Nobody comes in until I've rendered it safe."
Rowe makes the call while I evacuate the two other techs who were working in the back section. The bay empties in under a minute, standard procedure. Nobody panics, nobody runs, everybody moves with purpose because this is what we train for, even if nobody trains to find a bomb in their own workspace.
I work the device alone. The X-ray confirms what my eyes and hands already told me: someone removed the inert training fill and replaced it with a functional charge wired to detonate when the training circuit delivers its electrical impulse. During a routine drill, one of my techs would have connected this device to the test circuit and sent the current. The charge would have detonated in a closed bay with personnel at arm's length.
The B&B device was a warning. It had a pressure-release trigger, a minimal charge, and placement designed to wound and intimidate. This one is a kill shot, concealed inside our ownequipment, timed to our own schedule, built to look like one of ours until the moment it isn't.
Rowe stays on comms outside the bay doors. The building is empty, the concrete walls holding whatever happens next.
The world narrows. Everything outside the device falls away: the bay, the base, Garrick's face on Rivera's screen, the way Nox looked this morning behind her laptop with her glasses sliding down her nose and her hair still wet from the shower. All of it drops below the threshold of relevance until there is nothing except my hands and the casing and the wires inside it.
I open the modified seam with a scalpel, controlling the pressure so the blade cuts adhesive without contacting anything beneath. The casing separates into two halves. Inside, the functional charge sits where the inert fill should be, wired to the training circuit connector through a detonator soldered with clean, precise joints. It's the same technique as the B&B device, the same hand.
I photograph the internals for the evidence record. Then I isolate the power source, cutting the battery leads first because the detonator needs current to fire and without current everything else goes inert. The blades close, the lead separates, and the circuit goes dead.
