Tuesday 11 November, 15:50
Kristin insisted on being in the room. She stood behind Jonas’s chair with her arms folded and her reading glasses pushed into her hair, and Jonas explained how a release was made to the woman who had signed for the server it was made on.
“So the code’s in the repo, right, everyone’s code, and the build box pulls it, and then there’s a script that—”
“I know what a build is, Jonas. Skip to the part where it’s bad.”
“I don’t know where the bad part is yet.” He breathed out. “The script’s the recipe. It pulls our code and then other people’s. Libraries. Hundreds. Logging, dates, PDF stuff. Nobody writes that, you just—”
“Trust it.”
“Yeah.”
“Show me what’s changed in the recipe,” Viktor said from the window. “Last month. Anything.”
It was Jonas who found it, and when he found it he made a sound Viktor had heard before, from good people at the moment the floor tilts under them.
Eleven lines. Eleven lines added to the build script, three weeks earlier. Neat, competent, commented. Beside them a little note in the house style:
# perf: swap logging lib for patched build
“What does that do?” said Kristin.
“It tells the build, when you put 14.2 together, don’t use our normal logging library. Use this one instead. From over here.” Jonas pointed at a package source that was not theirs. “Nobody’d look twice at that note. Nobody reviews the build box. Review’s upstream, on the code. This was never in the code.”
“Who wrote it?”
Jonas clicked on the change. The metadata came up in a grey box.
author: jlie <[email protected]>
date: Sun 19 Oct 2025 03:12:44 +0200
Kristin unfolded her arms.
“That’s not me.” Jonas pushed his chair back as if the screen were hot. “That’s not— I was asleep. Three in the morning on a Sunday, I was asleep, I’m always asleep, ask anyone. Ask my—” He stopped, because there was nobody to ask, and everybody in the room knew it.
Dahl had been in the doorway for some time with her phone at her ear, and Viktor could hear Rød’s voice in it, small and metallic and clear. She had not gone into the corridor this time. That, he understood, was deliberate.
“…his name on the code, three cards, a row with the dead man the same evening, and a lie about coming back. I want him at Allehelgens gate this afternoon, Dahl. And I want the civilian with a review file out of that building before somebody photographs him in it.”
“Give me ten minutes,” Dahl said, and lowered the phone without ending the call. She looked at Viktor. “You’ve got ten minutes.”
“I need four.” He put his hand on the back of Jonas’s chair. “Anyone can type a name into a commit. Git writes down what you tell it.” He leaned past Jonas. “Where did the change come from? Not who it says. Where.”
Jonas’s hands were shaking, so he typed slowly. The change had never come through the repository at all. It had been written straight onto the build box, into the working copy of the script, and committed there. The build box kept its own security log, and nobody had read that in a year either.
19.10.2025 03:11:58 Logon svc_labsync from FN-SRV03
“And Jonas’s laptop?” said Viktor.
The VPN logs took longer. Jonas’s machine had disconnected at 23:51 on the Saturday and not been seen again until 10:02 on Sunday morning, from his flat.
“Off the network,” Viktor said. “Three hours before.” He straightened. “Somebody sat on the build server at twelve minutes past three on a Sunday morning, logged in as the robot from the lab box, and signed Jonas’s name to it because Jonas’s name is the one you’d believe.”
Dahl lifted the phone. “Did you get that, politimester?” She listened. “No. He stays. He’s the reason we’ve got it.” A longer pause, and something in the line of her mouth tightened by a millimetre. “Understood.”
She put the phone in her pocket. Nobody asked her what had been understood.
“The library,” Viktor said.
Jonas opened it. At a glance it was the real thing. The name was LogFIow.Core where theirs was LogFlow.Core, with a capital I standing in for a small l, and on this screen in this font they were the same letter. Inside, it did everything the real one did, and one thing more. Buried halfway down, wrapped in enough ordinary code to look like nothing, was a small and patient instruction: once installed on a customer’s system, wait. Wait a good while. Then open a way in, and tell an address on the internet that it was open.
“A back door,” Jonas said. “In the logging. In the one thing nobody ever looks at.” His voice had gone thin. “If we’d shipped tonight—”
“Every system you have,” Viktor said. “Every surgery, every kommune, from Kirkenes to Lindesnes, all at once, all trusting you. That’s the crime. The ransomware was the fire alarm. This is the robbery.”
Kristin had sat down on the edge of the desk without seeming to notice she had done it.
“It’s held,” she said. “Since seven this morning. Nothing’s gone.” It was a sentence she would need to say to a lot of people. “Two hundred customers expect it tonight at nine. Ingrid’s had forty calls already.”
“Tell them it isn’t,” said Viktor. “Tell them it’s postponed. Thursday.”
“Thursday at nine,” Kristin said. “Because of the incident.”
“Because of the incident. Nothing else. Not a word about the build. Not a word about libraries.” He looked at Jonas. “Not on Slack. Not to anyone’s cousin.”
Jonas nodded without looking up.
“Who else knows this release was held?” he said. “Think hard. Because somewhere out there is a person expecting two hundred doors to open tonight. And when they don’t, he is going to want to know why.”