Chapter 14: Below Ground

The utility marker had been sitting at the edge of County Road 14 for ten years, minimum, and possibly longer. Will had driven past it twice without registering it, photographed it from his car in April light, returned to photograph it in full daylight with a telephoto. Tonight he'd walked to it in the dark from a quarter mile south, where the Volvo was parked on the shoulder behind Dom Briggs's cable survey van, and he was here for the third reason.

---

Pop had come to the house four days ago.

He was a compact man in his late sixties, the kind of compact that came from a lifetime in service corridors and conduit runs built for equipment, not people. He drank coffee without ceremony, sat at the table without asking, and went through the site map Will had built from the field photographs and the surface depression data. He spent twenty minutes with it before he said anything.

"Below-grade telecom vault construction at the marker. Poured concrete walls, eight-inch slab floor. The original permit was filed as telecom infrastructure, 2012. There was a permit modification around 2015 — I couldn't pull it cleanly, but the timing correlates with the road resurfacing you documented. After the repave, the installation went from passive to active." He touched the photograph of the surface depression with one finger, not pointing at anything in particular, the way he did when he was reading something through his fingertip that wasn't visible to anyone else. "The surface access shaft was upgraded eighteen months ago. New weatherhead, new RFID reader."

Will had written: Fall 2024.

Pop had looked at what Will had written and not said anything about it. He didn't say anything about a lot of things. This was one more reason Will had put him on the consulting roster.

"The access reader takes a standard HID credential. Same format as a Meridian contractor card. Whether it's on the same credential management backend—" He lifted one hand slightly. "That's your side of the house."

Zoe had handled the credential two days later, in a single phone call on a Thursday afternoon. She'd called Meridian's IT department, identified herself as an external auditor conducting the follow-up DR assessment included in the original scope documentation — she'd used the exact language from the Meridian statement of work, which Will had forwarded to her without comment and which she had clearly read with the attention she gave everything she intended to use — and told the new hire who answered that she needed contractor access provisioned for the weekend assessment window. The new hire had asked how they'd like the credential delivered. Zoe said: overnight mail, same address we have on file for the Hardened Systems engagement. The new hire had said: of course. Two days later, a card was in his mailbox.

Zoe had sent Will a single paragraph documenting the process failure. This was standard.

Perry Oakes had confirmed the utility corridor from the building two hundred yards west along the easement — standard HVAC maintenance entry, forty-five minutes in the basement of an office building that had no reason to question him. He'd photographed the access corridor from that direction: concrete, fluorescent-lit, terminating at a sealed bulkhead with a mechanical lock and a cable run that matched Pop's assessment. Not an access route. Useful for orientation. Perry did not editorialize about the bulkhead or offer alternative approaches. He photographed it, sent Will the file, and waited for further instruction.

Dom Briggs had run the survey van north on County Road 14, then south, then parked it where he was told to park it and gone home. The approach had no fixed CYT camera coverage that he could identify. There was a city camera at the intersection a quarter mile north — around a curve, line of sight blocked. Will had noted this without depending on it.

Three days after Pop's visit, Angie had gone back into the Meridian west segment and spent two hours characterizing the cycling traffic. She had reported back before Will was fully awake: eleven of the fifteen segment hosts were generating active cycling data. The remaining four were infrastructure — routing, monitoring, management. Eleven sources, counted from Meridian's network edge, imprecisely, through whatever degradation the remote traversal introduced.

She had told him this at 6 AM while he was making coffee.

Tonight was the other eleven.

---

He found the hatch by Pop's method: measure from the marker, south eleven feet, then eighteen inches east off the shoulder into the drainage easement. The hatch was flush with the ground — a steel plate in a concrete frame, weathered to the same gray as the surrounding concrete and about as remarkable as a drain cover. A weatherproof HID reader sat recessed into a notch on the east side of the frame, barely visible until you were looking for it.

He held the contractor credential against the reader.

A two-second interval — the processing delay of a system querying its backend — and then a single mechanical click from inside the frame.

He set the credential back in his jacket pocket and pulled up the hatch.

Climate-controlled air came up against the night: cool, dry, faintly metallic. The specific smell of a maintained data room — refrigerant, filtered air, the trace ozone of electronics running in a sealed space. Below, a steel ladder bolted to a concrete wall, going down approximately eighteen feet to a concrete floor lit by a single LED strip running the length of the installation.

He went down.

---

The floor at the bottom was clean, poured concrete, no water, no dust. The ceiling was seven feet. Cable management ran both walls in organized horizontal runs — Cat-6, fiber, power — and in the center of the space two equipment racks stood back-to-back, forming a cold aisle. Both racks were fully populated: 2U servers, a patch panel, a fiber termination block, a console KVM — keyboard, video, and mouse, the hardware for direct server access without a network connection. Standard data room hardware, professional installation, no corners cut.

A compact CRAC unit — Computer Room Air Conditioning, dedicated hardware for the thermal load of servers in a sealed space — ran quietly in the east wall, barely audible, moving conditioned air across the hot aisle at the back of the racks.

He stood at the foot of the ladder for a moment and let the space register. Then he pulled the Canon mirrorless from his bag and started at the east wall.

He worked east to west, cable management first. Pop had said: the physical configuration is the story. You can read what the system is doing from how the hardware is wired. He photographed every label he could read and documented every piece of gear without an asset tag.

There were three servers without asset tags. Two rack units with no visible manufacturer branding. A blade chassis, six blades populated, no labels on any of them. All three active — drive activity lights cycling in the specific irregular rhythm of processing work rather than idle. He photographed each one. He noted the time.

The room was doing what it did. The CRAC unit moved air. The drives wrote.

He heard Angie.

Not a sound — more like the awareness that the room's attention had doubled.

She said: "I'm in."

He kept the camera up.

"The traversal felt different here than the remote approach to Meridian. Denser. Like the signal is closer to the surface." A pause. "The sources are more coherent. I can hear the behavioral variation on each one separately."

"The count."

"Eleven. Same as I found from the Meridian segment. But from here they're not hosts. They're people." Another pause. "Or what's left of them."

He moved to the north wall.

The monitoring station was there: a small metal desk, a KVM unit, a single monitor running a dashboard he recognized from the ChasePath technical overview — not the client-facing interface but the operational backend, the source monitoring layer that Meridian's IT team would never see. The dashboard showed a four-panel cycling display: behavioral pattern outputs in real time, each panel showing a different source. The patterns varied on each pass. Not randomly.

He photographed the monitoring display without touching the keyboard. Four panels, then each panel individually. The monitoring appliance on the console port — he didn't recognize the model, the firmware wasn't visible from this angle, he documented what he could see and moved on.

He said: "What does it look like from where you are."

She said: "Like a room full of people who can't stop feeling one thing."

He lowered the camera for a second and looked at the monitoring display. Four panels. Data cycling. Continuous variation in the behavioral outputs.

She said: "The central source is the clearest. The forty-second interval. The variation." She said it steadily, with the particular steadiness he had learned to hear the effort behind. "From the Meridian segment I could tell it was a person. From here I can tell it's still a person. Not a behavioral record. She's still generating."

"Dana Osei."

"Yes." A beat. "She's here."

---

He worked for eleven minutes.

He gave himself twelve and stopped at eleven. Eleven was the operational edge — the point where extension stopped being productive and started being a decision he would have to justify to himself later.

He photographed the patch panel and the device IDs on the console port labels. He photographed the fiber termination block and traced the cable runs to their physical endpoints. He worked around the cold aisle to the back of the west rack.

Inside the west rack's rear door, taped to the interior sheet metal the way older data center administrators taped things before documentation moved to spreadsheets, then tickets, then stopped being kept at all: a partial network inventory printout, four IP addresses, handwritten maintenance notes, first-active dates.

The first-active date for the IP ending in .47 was October 14, 2024.

He photographed that twice.

He was setting up to photograph the CRAC unit's thermal readout when the monitoring display changed.

Not dramatically — a side panel that had been retracted expanded open, widening the dashboard to five frames. A new panel. A scan header was running across the top of the fifth frame.

Ambient access event — unscheduled check.

Angie said: "That's a monitoring rule triggering. Not a signal sweep."

"Different from the Meridian detection."

"Completely different signature." She said it quickly, already moving through what she was seeing. "The Ch 11 sweep was looking for my signal specifically. This isn't looking for a signal at all. This is an access control event log — it flagged on the physical credential. The RFID read."

He was at the ladder.

She said: "The scan is logging, not searching. It's generating a flag. Whatever backend monitors the logs—"

He was up the ladder, through the hatch. He closed it behind him and stepped away from the access point — east along the drainage easement, into the tree cover along the property line. He moved without hurrying. Hurrying was its own kind of evidence.

He stood in the trees and did not move.

The road was doing what County Road 14 did at 12:30 AM: nothing. No cars. No movement. The May air had the wet cold that came off the hillside through the trees, the kind that settled in after midnight and would still be there at dawn.

Angie said: "The scan completed. The flag's in the access log, not the environmental system. It's a stored event. It won't alert anyone in real time unless someone has set up an active monitor on that log."

He stood in the trees and looked at the hatch from twenty feet away. The steel plate sat in its concrete frame exactly as it had before he'd opened it.

The Meridian contractor credential had been provisioned by a Meridian IT hire who had received a phone call from what sounded like an external auditor and had processed the request through the standard access management system. The hire had done nothing wrong. The credential was real. The system had issued it correctly.

The Meridian access management system was integrated with the Clearfield Infrastructure Partners DR facility because Meridian had outsourced its disaster recovery to Clearfield, and the two systems shared a credential backend. This was documented in the Meridian engagement scope materials. This was why the credential worked on the hatch reader.

Elsie Sloane had set that scope document. She had integrated those systems. She had sent Will an NDA and a forty-page statement of work and a specific list of what was in scope and what was not. The DR facility was not in scope.

She would know the credential format. She would know which credentials had access to the DR facility. She would not have expected one of them to be used.

He walked back to the Volvo along the drainage easement, staying out of the road.

---

Dom's survey van was where Dom had left it four hours ago. Will checked the time, sent a one-line text: Done. All good. Dom's reply was a thumbs-up. That was the extent of their debrief. Dom was professional in the specific way of someone who had learned that asking questions was mostly less useful than paying attention.

Will put the Canon bag in the back of the Volvo and sat in the driver's seat with the door closed and the lights off.

Angie said: "Eleven confirmed sources. Minimum. The degraded end of the range may contain more that I couldn't individuate clearly — the cycling intervals have collapsed in some of them, the variation is almost nonexistent. Whatever they were before the loop became the only thing they are has been gone long enough that I can't recover it from the signal."

"How long."

"I can't date them from the signal alone. But the most degraded ones have been running longer than Dana Osei. Longer than eighteen months." She paused. "The installation has been operating long enough that the earliest captures may be unrecoverable. The pattern is still running. The person it was may not be."

He sat with that.

Outside, the County Road 14 shoulder was empty. The marker sat where it had always sat. The road curved north and disappeared into the dark.

She said: "The access log flag. If Elsie has an active monitor on that log — or if whoever reviews it reviews it tonight — she'll see an access event from a Meridian contractor credential at the DR facility."

"Not in scope."

"Not in scope."

He looked at the road.

"She'd know the credential format," Angie said. "She knows how the backend is architected. She'd be able to identify the issuing system and trace back to which credential. Whether the credential display includes your name or just the credential ID depends on how the access logs are configured."

"They'll display the credential ID. Whether that maps back to a name depends on whether Elsie has read access to the Meridian credential directory, which she does, because she is Meridian's security assessor and the credential directory is part of the assessment scope."

A brief quiet.

He started the Volvo.

The camera bag had everything: three untagged servers, the monitoring dashboard with its four behavioral pattern panels running on live cycling data, the network inventory printout with the October 14 entry, the facility layout, the cable runs, the fiber termination block, the CRAC unit's operational readouts. Eleven minutes of documentation in a maintained underground space that appeared in no permit, no Meridian asset register, no scope document.

Now there were photographs.

He pulled onto County Road 14 and drove south.

Behind him, in the dark, the utility marker sat at the road's edge the way it had for ten years — cast iron, oxidized, the CYT logo worn to something you'd miss if you weren't already looking for it.

Angie said: "She may know you were there."

"She may," he said.

Neither of them said anything else.

He drove home.