Tuesday 11 November, 13:30
Geir had not left words. He had left a trail, the kind a careful man leaves following a smell through a building he has known for nineteen years.
They rebuilt his evening at his own desk, Viktor in Geir’s chair and Jonas standing because he would not sit in it. A photograph of a sister and two boys on a windy quay. A laminated card taped to the side of the monitor that said, in block capitals, PATCH NIGHT: CHECKLIST FIRST, OPINIONS AFTER.
The checklist for 14.2 lay printed beside the keyboard, and Geir had logged every tick in the release spreadsheet as he made it, from a little after six. At item twenty-three, at 21:17, the ticks stopped.
“He never stops in the middle,” Jonas said. “He’d finish the list with a temperature of forty.”
At 21:20 a remote session opened on FN-SRV03. It came from this desk, from this machine, from the chair Viktor was sitting in. And the account it used was svc_labsync.
Jonas read it twice. “That’s him? That’s Geir logging in as the robot?”
“He had the password,” Viktor said. “Or he thought he remembered it. So he tried it. Let’s just check.” He looked at the timestamp and saw the man doing it: the big hands on the keyboard, the glasses pushed up, the small cold surprise when the old key turned in the lock. “It worked.”
After that Geir had gone looking. Logon histories on the old server. Who had used svc_labsync, when, from where. The queries ran one after another for half an hour, each a little wider than the last. At 21:58 he had left his desk and badged into the server room, and the logs on FN-SRV03’s own console showed him there, at the physical box, reading its local event logs one screen at a time. At 22:30 he had opened a file from the old archive share.
They could not see what was inside it from here. They could see its name.
Integrasjonsspesifikasjon_LIS_v3_2016.docx
Jonas put his coffee down. “That’s from the archive. That’s ancient. Why would anybody read that at half ten at night?”
“Because something told him to.” Viktor wrote the filename on the back of his hand with Geir’s pen. “Hold on to it. I want to look at the loud thing first.”
The loud thing was on every screen in the operations room. It had taken down the home-care systems in Askøy, Øygarden and Alver, encrypted everything it could reach, and was asking, very politely, for forty thousand euros.
And the longer Viktor looked at it, the less he believed it.
“It’s sloppy,” he said. “Three municipalities out of two hundred customers. It goes for the home-care systems, a few thousand patients, and then it just sits there flashing. It doesn’t touch the platform. It doesn’t touch the money.” He leaned back in Geir’s chair. “It’s loud. It wants to be seen.”
“That’s bad, though? That’s worse?”
“It’s theatre.”
He did not say it hard. He said it as a man sets down a cup. Jonas heard it land. He had used the same word to the dead man across this desk the evening before, and his face went red from the collar up and stayed that way.
“A professional who wants your money is quiet,” Viktor said. “A professional who wants your data is quieter still. This is somebody setting off the fire alarm at the front of the building. And when somebody sets off the fire alarm at the front of the building, there’s one question worth asking.”
Jonas swallowed. “What’s going on at the back.”
“What’s going on at the back.” Viktor pulled the network map up again, the thicket, twenty-one years of it. “This ransomware hurts a few thousand people for a few days. It’s meant to be survivable, because it isn’t the point. While the whole company runs towards the alarm with buckets, the real thing walks out the back. And the back of this building is whatever touches all two hundred customers at once.” He looked up. “Which is what?”
Jonas did not answer at once. He was looking at the laminated card on the side of the monitor. PATCH NIGHT. Then at the clock in the corner of the screen. 13:58.
He went white.
“The release,” he said. “It ships to everyone.”