The Dorina Intercept

Chapter One: The Hash Mismatch

The ninth floor of the Allied Signals Bureau was designed so that no one could hide in it.

That was the theory, anyway. When the Bureau's glass tower went up on the flat green edge of The Hague in the years after the security crises of 2015, the architects had been given a brief with one line underscored twice: sightlines. So the ninth floor had no private offices except the Director's, no interior walls above chest height, no corridors that turned a corner without showing you what waited on the other side. Even the coffee station stood in the open, exposed as a chess piece in the centre of the board.

Paul Grindlay had worked under those sightlines for ten years, and he had come to think the architects had misunderstood something fundamental about people. You did not hide behind walls. You hid behind ordinariness. You hid by arriving at the same time each morning, by keeping your badge visible, by making a mild joke about the weather. The most invisible thing in the building was a man doing exactly what everyone expected him to do.

He knew this because it described him precisely.

At 19:40 on a Tuesday in the middle of January, the ninth floor held six people. Rain moved across the glass in long diagonal sheets, and beyond it the lights of the motorway ran north like a stream of pale sparks. Paul sat where he always sat, at the desk nearest the server core, with two monitors, a cooling cup of coffee, and a system he had spent three years building.

Its name was PRISMATA.

The name had been given to it by a committee, which was why it meant nothing. What it did was simple to describe and impossible to replicate: it took the raw electronic exhaust of the Eastern Mediterranean — ship-to-shore traffic, encrypted burst transmissions, cargo manifests, radar emissions, the low grinding chatter of a hundred thousand machines talking to each other — and it looked for the shape of a weapons network hiding inside the noise. It did not decrypt. It correlated. It noticed that a Panamanian-flagged freighter had taken on fuel at the same port, on the same day, that a particular satellite phone had gone dark. It noticed things eleven months apart and told you they were the same thing.

Paul was fifty-one years old. He had come to the Bureau from the Communications Security Establishment in Ottawa, where he had spent nineteen years learning that patience was not a virtue in signals intelligence but a technical requirement. He had a narrow, patient face, grey at the temples, and reading glasses he never remembered putting on. Colleagues described him, when asked, as reliable. It was not a compliment, exactly. He had stopped minding.

The alert came in as a single grey line at the bottom of his left-hand monitor. No siren, no colour. PRISMATA had been built to whisper.

INTEGRITY SUBROUTINE — HASH VARIANCE — SET 4471-ANK — 16 OBJECTS.

Paul read it twice.

Every file that entered the Bureau's system was fingerprinted the moment it arrived: a long string of characters generated from the file's contents, unique as a snowflake and far less forgiving. Change one byte and the fingerprint changed. The integrity subroutine walked the archive endlessly, comparing each file to its fingerprint, and in three years it had raised forty-one flags, every one of them a storage fault or a corrupted transfer.

Sixteen at once, from a single set, was not a storage fault.

He set the coffee down and pulled the set.

4471-ANK. The prefix told him it had come through the Bureau's relay station in Ankara, which meant it had passed under the hand of Nikos Zervas, the Greek field officer who ran the place with a mixture of charm, cigarettes and outright bloody-mindedness. Raw intercepts, collected eleven days ago, ingested nine days ago, indexed and left to cool in the archive like everything else.

The files themselves opened normally. That was the first thing that was wrong. Corruption announced itself; these did not. The variance was not in the payload. It was in the metadata block appended by the system when a file was touched.

Someone had opened these sixteen files. Someone had copied them. And then someone had gone back and removed the record of having done it.

Paul sat very still.

The erasure was good. He had to admit that immediately, before anything else, because admitting it kept him honest. Whoever had done this understood the Bureau's audit architecture — not the version in the handbook, the real one, the one with the two supplementary logs that mirrored the primary. They had scrubbed all three. They had even reset the archive's last-access timestamp to a plausible earlier date.

What they had not known about was the integrity subroutine.

Paul had written it himself, on a wet Sunday two winters ago, because he had been irritated by an unrelated problem and had wanted something small and clean to fix. It was not in the system documentation. It did not appear on the architecture diagrams that hung in the briefing rooms. It was a private habit of a careful man, and it had just caught something.

He turned to the second monitor and began to read the intercepts properly.

It took him forty minutes to understand what he was looking at, and when he did, his mouth went dry.

The sixteen files documented a single vessel. She was called the *Akademik Orlov* — in the Bureau's own reports, the Academician Orlov — and on paper she was a Russian oceanographic research ship, six thousand tonnes, home-ported at Novorossiysk, engaged in hydrographic survey work. In practice she was an AGI: an intelligence collection ship, a floating ear, her decks crowded with radomes that nobody had ever pretended were weather instruments.

The intercepts placed her, over a nineteen-day window, in a rough box of sea off the Syrian coast. That in itself was not remarkable. What was remarkable was what she had been doing there. The traffic PRISMATA had scraped up showed her conducting active electronic warfare — sustained, directional, deliberate — inside a maritime zone covered by a deconfliction agreement that Moscow had signed and that NATO had, with weary optimism, chosen to believe in.

Proof. Not inference, not analysis. Sixteen files of technical proof that Russia was running an undeclared electronic warfare operation inside a zone the alliance considered secure.

Paul rubbed his eyes and thought, coldly and clearly: *this is worth something to somebody.*

Then he thought about who could have taken it.

The archive that held set 4471-ANK sat in Compartment Three, and Compartment Three was ninth floor only. Not ninth-floor-cleared. Ninth-floor-*present*. The terminals were locked to the physical layer; you could not reach that data from the eighth floor, or from a hotel room in Brussels, or from a café in Riga. You had to be standing on this carpet, under these lights, with a badge that had been through the biometric gate at the elevator.

He pulled the current access list, though he already knew the number.

Thirty-eight names.

He scrolled slowly. Analysts. Systems staff. The liaison officers seconded from twelve member nations, each one nominated by their own service and sent here with an office, a desk, and a share of the crown jewels. Alistair Cowburn, the Director, seventy-two days into a course of treatment nobody was supposed to know about. Clémence Fauvel, his deputy. Arnaud Leclerc, the French senior liaison, who had once spent two hours helping Paul choose a bottle of wine for his daughter's graduation and had been genuinely, unfeignedly delighted when Paul reported that it had been a success. Ulrike Hassler, the German, who had helped design half the network these files had travelled through. Matej Rukavina, the Croatian, who had been hired out of a Europol cybercrime file and who most of the floor avoided.

Thirty-eight people. One of them had stood on this carpet and stolen a state secret and then wiped their footprints, and the only reason Paul knew was a subroutine he had written out of boredom.

He looked up. The floor was almost empty now. Under the low night lighting the desks made a grid of pale rectangles, and the rain on the glass turned the motorway lights into something that swam and blurred. Two rows over, the German section's lamp was still on. Nobody at it.

Paul had a rule about panic, learned in Ottawa from a supervisor who had died of a heart attack at fifty-four: panic is just information arriving faster than you can file it. File it.

He did three things.

First, he made a forensic copy of all sixteen files onto an encrypted drive from his own locked cabinet, and hashed the copy, and wrote the hash by hand on a card, which he put in his wallet.

Second, he disabled the automatic notification that would have pushed the integrity flag to the systems team in the morning. He did not enjoy doing it. It was the first genuinely irregular act of his career, and his hand hesitated over the key for a full three seconds. But the systems team had nine people on it and he did not know which of the thirty-eight names any of them drank with.

Third, he stood up, put on the grey coat he had owned for eleven years, and walked past the German section's empty desk to the elevator, and rode down to the eighth floor, where Deputy Director Clémence Fauvel's light was still on.

Behind him, nine floors of glass hummed quietly in the rain, and somewhere in the server core below, PRISMATA went on doing exactly what it had been built to do: noticing things.