I pull up the NCIS surveillance feed and cross-reference it against his known locations.
His apartment is dark. His vehicle is gone. The physical surveillance team reports a gap in coverage during the afternoon shift rotation, when Hartwell's expanded task force briefing pulled resources for reassignment. Garrick timed his exit to the window, which means he knew the coverage pattern or he got lucky. My money is on the former.
Rivera's number is dialing on my phone before I've finished reading the surveillance log. I can feel Griff still at my shoulder, his weight settled, his focus locked on the same data.
"He's running," I tell Rivera when she picks up. "Credentials wiped, devices scrubbed, apartment appears empty. He knows we're watching, and he's burned everything."
Rivera's voice is tight and controlled. "When?"
"Within the hour. The purge was systematic, and the surveillance gap lines up. He planned this."
"Which means the timeline just moved up," Griff says, loud enough for Rivera to hear. "If Garrick ran, the handler knows we're close. They won't wait for the exercise to go live. They'll trigger early or accelerate."
Rivera is quiet for a beat. "I'll wake Hartwell. Briefing first thing."
The call ends. The loft is silent except for the low whir of cooling fans and the weight of Griff still standing behind me. The joint exercise is less than two days out, and the man who was supposed to trigger the attack has vanished, which means either the attack dies with his disappearance or someone else picks up the detonator.
I know which one is more likely. Anyone who builds infrastructure this patient, this layered, this resilient doesn't hang an entire operation on a single point of failure.
Griff moves to the couch. He stretches out on his back with one arm behind his head and his boots still on, positioning himself between the front door and the island where I work, the same way he's positioned himself in every room we've shared since the B&B device. He's not going to bed while I'm awake. That stopped being about security protocol weeks ago.
"Get some sleep," I tell him.
"I'll sleep when you do."
"Then you won't sleep."
"I know."
His eyes close within minutes anyway, his breathing settling into the slow, steady rhythm that means his body overruled his intention. Even asleep, the line of his jaw is set, and one hand rests on his chest in a loose fist that could tighten in a second.
The monitors glow blue. The code scrolls. The conspiracy architecture I built this morning stares back at me from the center screen, clean and thorough and missing the one piece that matters: the handler's identity, the person at the top.
I'm going to find it. Not just because the mission requires it or because Hartwell ordered it or because Rivera's career depends on it. Because the man on the couch behind me bought a monitor arm without being asked and learned how I take my tea and stood on this balcony tonight telling me things that cost him. And somewhere between the shortbread on his counter and the rings I leave beside his coffee maker every morning, I stopped calculating the exit.
My fingers settle on the keys. Behind me, Griff breathes. The cursor blinks.
I start pulling the thread.
11
GRIFF
Hartwell's briefing runs until noon, and when it ends, nobody in the room looks rested. I've seen livelier faces on a post-blast assessment team.
The joint operation holds. Canceling it would scatter the timeline, delay the handler's activation trigger, and give Garrick's network weeks to regroup and rebuild. Keeping it live gives us a window. The malware is synced to the exercise, which means the attack has a clock, and a clock can be used against the person who set it. It's the same principle as a timed fuse: once you know the interval, you own the detonation.
I make the case in tactical terms because Hartwell responds to tactical terms and because the truth of it is simple enough that dressing it up would insult the room's intelligence. If the operation is bait, we control the trap. My EOD team sweeps critical junctions on base while Nox monitors the digital perimeter for activation signals. It's two fronts of the same war. The alternative is shutting down the exercise, losing visibility on the handler's timing, and spending the next month waiting for a threat that could fire from any direction without warning. Waiting is how people die. I've built a career around making sure nobody has to find that out firsthand.
Nox backs me from the far end of the table, her laptop open, the conspiracy architecture she'd been refining since Garrick's disappearance projected onto the briefing screen. She doesn't argue on my behalf because she doesn't argue on anyone's behalf. She lays out the data clean: clear lines, obvious connections, no wasted components.
The malware is keyed to operational triggers that only fire when the exercise goes live. If we cancel the exercise, the malware sits dormant, undetectable, waiting for the next opportunity. If we run it, she can force the malware to reveal itself, map the infected nodes, and kill it before it propagates.
"The infrastructure doesn't care about our timeline," she tells Hartwell. "It cares about its own. If we don't let it activate, I can't see it. And if I can't see it, I can't stop it."
Hartwell studies her for a long count. Then he nods once and tells us to prep.
Across the table, Holden catches my eye. The look he gives me is brief and pointed:you sure about this?I give him the fractional nod that's been our shorthand since BUD/S, the one that meansno, but I'm doing it anyway.He returns it. Thatcher just watches the exchange with the calm of a man who's already run the numbers and doesn't need the shorthand.
