Chapter 17: Blast Radius

The photograph on Will's second monitor showed four panels of behavioral pattern data cycling with the continuous variation that meant a live source — not a corpus, not archival data, but something still generating. He had taken it at 12:17 AM. The timestamp was in the EXIF data — the metadata embedded in every digital photograph, recording camera model, settings, and time of capture. He had been through all one hundred and eighteen photographs before 3 AM, tagged the ones he'd testify to, organized by subject, named the files. His hands had known what to do. He had let them.

He had gone to bed at 3:20 and lain there until 4:35 and then stopped pretending.

The call came at 8:41.

He knew what it was before he answered, because Harlan Ostrander did not call. Ostrander scheduled. Ostrander's assistant found thirty minutes on a Tuesday and sent an agenda. A CISO who dials a contractor's cell at 8:41 in the morning is a CISO who has been told to make a call he does not want to delegate.

"Will. Have I caught you at a bad time."

"No."

"Good. Good." A breath in a room with a door that had just been closed. "I want to say up front that this is not about the quality of your work."

Will pulled the yellow pad toward him and uncapped the pen, because that was the physical action that went with the sentence this is not about the quality of your work, and because he had learned a long time ago that the way to survive being on the receiving end of a difficult call was to take it down like it was happening to somebody else.

Ostrander said it in the passive voice, which was how it was going to be said in every document that followed. An access control event had been surfaced during routine log review. A credential provisioned under the Hardened Systems engagement scope had been presented at a third-party facility that was not in the engagement scope. Legal had been consulted. The engagement was suspended — not terminated, he wanted to be clear about that, suspended — pending an internal review of contractor credential handling. Will's building access was revoked effective this morning. His network accounts were disabled. The credential in question was flagged in the access management system and should not be presented anywhere.

"I still owe you a report," Will said.

"You still owe us a report." Ostrander sounded relieved to be handed a piece of procedure. "The deliverable obligation survives. Legal was specific about that. We'd want it on the original date."

"You'll have it on the original date."

"I appreciate that." A pause. "Will — for what it's worth, I argued against this. I said we've had four weeks of the most thorough documentation this program has ever produced and now we're going to stop it over a badge read. And I was told that's exactly the argument a compromised vendor relationship produces." He laughed, one syllable, no humor in it at all. "So. There we are."

"Who reviewed the log."

"Our security assessor. Sloane. She flagged it out of cycle — she ran the access logs yesterday morning and had it to me before lunch." Ostrander said it as a small point of pride, the way a man says the name of the process that caught the thing. "That's her function. She's very good."

"She is," Will said.

He wrote she is on the yellow pad, underlined it, and looked at it.

Ostrander apologized twice more before he got off the phone. That was the part Will would think about later. If Ostrander had been angry — if he had been cold, or performative, or if he had used the word breach — it would have been an adversarial conversation and Will was extremely good at adversarial conversations. Instead a man who liked him and rated his work had called him personally to tell him the process had eaten him, and had been sorry about it, and had been correct.

Will set the phone down.

Angie said: "That was fast."

"Thirty-four hours."

---

He wrote it out, because writing it out was the only tool he had that worked in all conditions.

Lost: building access. Network access. The contractor credential. The DR facility credential, flagged, which meant the hatch on County Road 14 was closed to him as of approximately 6 AM. Standing to ask Meridian staff a question. Standing to ask anyone at Meridian anything.

Retained: one hundred and eighteen photographs. Sixty-eight items in the OSINT folder. The engagement letter. The obligation to deliver a report, which was the last legitimate reason he had to be in contact with anyone in the building.

Then the third column, which he made himself write.

Last night he had gone down a ladder into a facility he did not own, using a credential obtained by deception, and photographed the interior. There was exactly one thing that had made that a professional activity rather than a felony, and it was the piece of paper that said a client had authorized him to test their systems. That paper named a scope. The facility was outside it.

The authorization did not cover it. Which meant the authorization had never covered it. Which meant it had been a crime at the moment he did it, and not, as it felt, a crime that Meridian had made retroactively by writing a memo.

He was clear-eyed about that. He had walked in knowing.

The problem was the fourth column, and it took him a while to write, and when he did he wrote it in three words.

Zoe made the call.

---

She picked up on the second ring, in a car, with the window down.

"Hey. Hang on." The window went up. "Okay. What's up?"

"Meridian suspended us this morning. Credential event at the DR facility, flagged in log review. There's an internal review of contractor credential handling."

"Mm."

"The credential was provisioned on your call."

"It was."

"Which means you're in it."

"I'd assume so." A turn signal, three clicks, off. "They'll pull the ticket, the ticket'll have the timestamp and whatever the kid typed in the notes field, and the notes field will say external auditor, follow-up DR assessment, per SOW. Then they'll pull the call recording if they record, which they do, because everybody records now. So they'll have my voice." Another pause. "I'll write it up today. Sequence, script, what I represented, what authority I cited, who I spoke to, what I asked for, what he provided without verification. It's a clean process-failure finding, Will, it's a good one, the kid handed a physical credential to a voice on the phone with no callback verification. That report was always getting written. It just gets read by a different audience now."

Will listened to her be entirely competent about it.

He said: "You didn't know what the credential was for?"

"No."

"I didn't tell you?"

"You didn't." No edge on it. Zoe did not put edges on things; it was one of the reasons she was good at pretexting. "You forwarded me the SOW with no message on it, which is not how you send me things, and I read that as don't ask, and I didn't ask. That was a choice I made. Write that down for me if anybody wants it in writing."

"The authorization didn't cover the facility."

The car went quiet.

"Ah," she said.

"So the call wasn't in scope. Which means it wasn't a pretext. It was criminal impersonation to obtain a physical access credential, and the credential was then used to enter a facility, and I'm the one who used it." He said it in the register he used for a Critical finding, flatly, without softening, because softening it would have been for his benefit and not hers. "The state charge is nothing. It's a misdemeanor and nobody prosecutes it. The exposure is that a federal prosecutor with an interest in the computer fraud statute has, in that sequence, a deception, an unauthorized access, and two people who coordinated on it in advance. That's not a pen test. That's the elements."

"Okay," Zoe said.

"I'm going to put in writing that I directed the call, that I withheld the purpose, and that you had a good-faith basis to believe it was scoped. I'll date it today and I'll send it to you and to Ray so there's an independent hold on it."

"No."

"Zoe..."

"Not no forever. Not today." The car had stopped. She was parked somewhere. "You want to write a signed statement that says I knowingly directed an out-of-scope credential acquisition and put it in a third party's hands, on the day the client opens a review, before either of us knows whether anybody is even asking that question. That is a document that exists forever, Will. Right now the only version of this in the world is a ticket and a phone call and a badge read. You want to hand them the intent."

He didn't say anything.

"Write it," she said. "Write the whole thing, today, while it's clean. Then put it in a sealed envelope and give it to Ray and don't open it unless somebody comes asking. You know how to do that. You've done that for clients."

"That's right."

"So do it for me." A pause. "And Will — the paperwork is the actual risk, not the federal thing, because the federal thing needs a prosecutor to care and the paperwork just needs somebody to fill in a field. If Meridian's counsel writes a letter, it goes to the insurer, and the insurer's report goes into a database, and every RFP I answer for the rest of my life has a question on it that I now have to answer differently. That's the cost. It's boring. It's a checkbox. I've been doing this nine years and I've never had to check it."

"I know."

"I'm going to be fine. I'm telling you what it is, not asking you to fix it." The window came down again. "Send me the SOW section they're citing. I want to see the scope language before I write anything."

"Zoe."

"Yeah."

He had a sentence and he could not get it to be a sentence that was of any use to her, which was the entire problem with it. What he wanted to say was I'm sorry, and I'm sorry was a thing you said to make the person hearing it do the work of releasing you.

He said: "I'll send it in ten minutes."

"Great," she said, and hung up, and it was a completely ordinary end to a completely ordinary call, and he sat in the chair afterward with the phone in his hand for longer than the call had taken.

She was fine. She had been fine the entire time. She had been more operationally useful in four minutes than he had been all morning.

None of that made it not have happened.

---

Angie had not said anything since the word Zoe.

She said, now: "You're going to slow down."

"I'm going to think about the next move before I make it."

"That's the same sentence."

"It isn't." He turned the chair. "Yesterday the exposure was me. I signed up for that. This morning the exposure is a woman with nine years in the trade who made a four-minute phone call because I sent her a document with no message on it." He set the pen down. "That's not a setback. That's a change in the shape of the problem. I widened the blast radius by a person without telling the person."

"And the eleven in the loop..."

"Are still in the loop."

"Dana Osei's interval is forty seconds." Angie was not near the window anymore. She was closer than she had been, which she almost never was. "I stood next to it. Eighteen months in, and there is still enough of her in there to be afraid in a slightly different key each time through — that's what the variation is, that's the whole product, the thing that makes their model accurate is that she hasn't finished being a person yet. And it degrades. I've heard the ones further along. The interval collapses and the variation goes flat and I cannot tell you whether what's left is a person or a recording of one." She said: "I don't know how long forty seconds stays forty seconds. Nobody does. Which means every day we take is a measurement nobody's taking."

"I know."

"Then don't tell me you're going to think about it."

"Angie." He said her name the way he said a finding number. "You want me to move faster on the exact morning the client cut my access, the credential got flagged, and the person who made the call went into a review. Those are the same event. Elsie pulled that log the morning after and had it in front of Meridian's governance before lunch. She didn't email me. She didn't threaten me. She used their process, and their process did all of it, and it is completely legitimate and there is nothing to appeal." He picked the pen back up. "Do you understand what she just demonstrated? She can take things from me without breaking a law. Access, cover, standing, and somebody else's clean record, in thirty-four hours, through channels that would survive an audit. What exactly do you want me to do faster with that."

"Something that ends it."

"Ending it is the part I can't do fast." He turned back to the monitor and pulled up the dashboard photograph with its four cycling panels. "Say I take the installation offline tonight. ChasePath crashes across every client simultaneously. Their clients are real. They built their security posture around a platform that works, and because it works they let the redundant things lapse — that's not negligence, that's what you do when a control performs. When it goes, they're all exposed at once, in a worse configuration than they had before they bought it, and they're organizations that became clients because they'd already been targeted." He said it without softening. "That's real exposure to real people. It has to happen anyway. But the day it happens I need documentation in the hands of somebody with authority, or all I've produced is an outage and a story."

"So the eleven wait on the documentation."

"The eleven wait on the documentation being usable. Which it currently isn't, because I obtained a third of it with a credential a client has now flagged as misused." He tapped the folder. "That's the loop she built. The platform's accuracy makes it indispensable. Being indispensable makes the clients dependent. Dependency generates their security events, the events refine the model, the model gets better, they get more dependent. It feeds itself. It has never needed her to defend it, because every part of it is a legitimate business relationship, and if you attack any one part the rest of it closes over the hole."

"Chase your tail," Angie said.

"The company name is the architecture."

"It's not irony. It's accurate. They named themselves after what they built." She was quiet for a second. "A while-true."

"A while-true with a person in it."

"Eleven of them. Minimum."

Cat came in from the hallway.

He crossed the room without apparent purpose and then stopped near Angie, which was not near anything else. He sat. He did not look at Will. He looked at the middle distance in the direction Angie was.

Angie said, not looking away from him: "Hi."

Cat did not respond. He had said what needed to be said, which was: he was here. He was staying.

After a moment Angie said, in a different voice: "I'm not arguing with your reasoning. Your reasoning is correct. I'm telling you that I was three feet from it and you weren't, and that changes what the word wait costs."

"I know it does."

"I'm going to keep saying it."

"I want you to keep saying it," Will said. "If you stop saying it I'll start making the safe decision by default, and the safe decision leaves them in there."

He wrote on the pad: Elapsed time as cost. Degradation may be irreversible. Then, under it, without looking at her: Do not let the safe decision become the default. Angie holds this line.

---

The light through the window was the light of the third week of May in Nashville, which was warmer than the light had any right to be a month after four inches of snow on this hill. It came across the desk and lay on the yellow pad and made the ink look older than it was. He had been awake for twenty-eight of the last thirty-two hours. Everything the light touched looked slightly wrong.

He was adding metadata to the image files — tagging, renaming, the procedural work of preparing documentation to be used by somebody who was not him — when the email notification appeared.

Angie watched him look at it without moving. Watched him read the sender and go still in the way he went still when something had arrived that he'd been expecting and that was, regardless, not welcome.

She said: "What?"

He turned the monitor toward her.

Elsie Sloane's address — a CYT domain, not the Meridian contact address. Professional format. The warmth precisely calibrated.

Mr. Hardin — I've had a chance to review the system logs from the current Meridian engagement period, and there are a few items I'd like to go through with you. Nothing that should derail the timeline. Would you be available to meet this week? I can work around your schedule.

— E. Sloane

Angie read it twice.

She said: "It's timestamped 9:52."

"Yes."

"She reported it to Ostrander on Monday. Ostrander called you at 8:41. She sent this at 9:52." A pause. "She waited until it had already landed."

"Yes."

"'Nothing that should derail the timeline,'" Angie said. "There is no timeline. She ended the timeline yesterday."

"She ended the engagement's timeline." Will looked at the screen. "She's talking about a different one."

"She's not angry?"

"No."

"She's not accusing you of anything?"

"No." He read it again. "She's telling me she knows. She's telling me she's already done the thing she can do without asking anyone's permission, and that it cost her one log review and one paragraph in a status report. And then she's asking politely for a meeting, and offering to work around my schedule, because she wants me to sit down knowing exactly how much of this she's holding."

"She controls the terms of the meeting."

"She controls the terms of everything," he said. "Until she doesn't."

He sat with it for a moment. Then he typed a reply. Five words: This week works. Name the date.

He sent it.

Angie looked at what he'd sent.

She inquired, "You're going?"

He replied, "We're going."