Friday, March 15, 2013 — Detroit, Michigan / Mountain View, California
The call is scheduled for 2 PM Pacific, which means 5 PM Eastern, which means Ethan spends the afternoon sitting with the particular anxiety of someone waiting for a thing to begin rather than actually doing it.
He cleans the apartment. He doesn't know why — no one will see it. He rearranges his desk. He reads, for the fourth time, the printout he made of Google's publicly documented security architecture. He eats a sandwich he doesn't taste.
At 4:55 he sits down at his desk, puts on a decent pair of headphones, tests the microphone, opens his notes document, and waits.
At 5:02, the call connects.
There are three of them on the other end: Christine Mao, whose voice is brisk and precise in the way of someone who has back-to-back meetings from 9 to 6 and has learned to be efficient with language. Marcus Bell, the team lead, who says hello in a tone that is politely non-committal — the tone of a man who has agreed to the call but has not agreed to be impressed. And a third voice, introduced as Joel Tanaka, legal, which Ethan takes as a good sign, not a bad one. Legal on the call means they're taking this seriously enough to be cautious.
Marcus speaks first after the introductions.
"Ethan, I'll be honest with you. We get a lot of these calls. Researchers, students, people who've found a single misconfigured DNS entry and want to sell it like it's a national secret. I've read the sample report you sent Christine, and it's thorough. But thorough formatting isn't the same as real capability. So what I want to understand, before anything else, is why you think you can find things our own teams can't."
It's a fair question. Ethan has prepared for it. Not a speech — a single honest answer.
"Because your teams are looking for what they know to look for," he says. "My system reasons about behavior. It builds a model of how a network should function and identifies deviations, including deviations that haven't been classified as vulnerabilities yet. It doesn't work from a CVE list. It works from first principles."
A pause.
"That's a fairly big claim," Marcus says.
"I know. I'd rather demonstrate than argue about it."
Another pause, and then Christine speaks. "The sample report showed an interesting output structure. The exploit chain narratives are unusual — most tools just flag and classify. Yours constructs a hypothetical attack path. Is that manual work or automated?"
"Automated. The system builds the chain from the scan data. It's not filling in a template — it's reasoning through the data and constructing the path from scratch each time."
"That's — " Christine pauses. He can hear the careful quality of the pause, the way someone's voice sounds when they are being privately more interested than they want to show. "That's not standard."
"No."
Joel Tanaka speaks for the first time. "For the authorization agreement — assuming we proceed — what scope are you proposing?"
"I'd suggest starting with a scoped external network assessment," Ethan says. "Public-facing infrastructure. Nothing internal, no social engineering, no physical access. Standard responsible disclosure terms — I report everything I find to your team first, you have 90 days to remediate before any public disclosure, and I won't retain copies of any customer data if I encounter it. I'd want the authorization in writing before I run a single scan."
A longer pause.
"That's a more conservative ask than I expected," Marcus says.
"I'm not trying to corner you. I'm trying to build a record."
Marcus makes a sound that might, charitably, be described as the beginnings of being impressed. "Give us a week."
The authorization agreement arrives nine days later. It is forty-seven pages long. Ethan reads every word of it — not performatively, but because he needs to understand what he's agreed to. Joel Tanaka's fingerprints are all over the indemnification clauses. The scope is clear: Google's public-facing web infrastructure, specifically their primary domain clusters, API endpoints, and CDN perimeter. No internal networks, no production databases, no employee systems. Sixty-day performance window.
He signs and returns it on a Tuesday afternoon.
He runs Sentinel-Prime that night.
The initial scan — just the perimeter mapping phase, before the deeper analysis begins — takes four hours. When Ethan wakes up the next morning and opens his laptop, the progress log is running in the terminal, and what it shows makes him sit up very straight.
By the end of the second day, the preliminary report is already flagging over four hundred items. Most are low-severity — misconfigurations, outdated header implementations, HTTP endpoints that should be HTTPS, deprecated TLS versions on secondary API clusters. The kind of things that exist in every large organization and that a competent team will remediate on their next quarterly patch cycle.
But the deeper heuristics are still running.
By day six, the number has climbed past nine hundred.
And on day nine, Sentinel-Prime's zero-day detection module — the behavioral analysis layer, the one that doesn't look for known patterns but reasons about anomaly — begins returning results that are different in quality from everything before them. These are not misconfigurations. These are not outdated libraries. These are structural vulnerabilities. Logic flaws baked into the architecture at a level where patching a single file won't fix them. Several of them are in Google's OAuth implementation — subtle timing discrepancies that, if exploited in sequence, could allow token forgery under specific conditions. Two more are in the API gateway layer, related to the way the system handles malformed request headers at scale.
These are the findings that keep Ethan awake.
By the end of the authorized window, the final report is 1,847 pages.
1,512 total vulnerabilities identified.
54 classified as critical.
He doesn't email it. He requests a meeting.
Christine Mao responds within an hour. In-person preferred. Can you come to Mountain View?
He looks at his bank account. $198.
He puts the flight on a credit card.
The Google campus, in person, is not what movies make it look like. It is not a utopia. It is a collection of purposeful, well-maintained buildings filled with people who are extremely good at what they do and who are, consequently, almost constitutionally resistant to being told they've missed something. Ethan understands this before he arrives. He has thought carefully about how to walk into a room full of the best security engineers in the world and present them with 1,847 pages of findings without it reading as an accusation.
Marcus Bell meets him at the security desk and shakes his hand. He is taller than his voice suggested. His expression is professionally neutral. Christine is behind him, and beside her is a woman Ethan doesn't recognize — mid-fifties, silver hair pulled back, the specific air of authority that doesn't announce itself.
"Ethan, this is Dr. Sarah Okafor," Christine says. "VP of Security Engineering."
Ethan shakes her hand. Her grip is firm and brief. She looks at him the way you look at something that has arrived in an unexpected shape.
They walk to a conference room. There is water on the table. The window looks out onto a courtyard where three engineers are having lunch, apparently debating something with great intensity.
Ethan opens his laptop. He loads the report.
"I want to say something before we begin," he says, "because I think it matters. Every finding in this report comes with a remediation path. I didn't come here with a list of problems. I came here with a map."
Dr. Okafor looks at him. Something in her expression shifts by a very small degree.
"Show me the critical findings," she says.
He shows her.
The meeting lasts four hours. Marcus Bell, who begins with professional skepticism, is quiet by the second hour — the specific quiet of a person recalibrating. Christine takes notes with the focused intensity of someone who has stopped trying to find holes in the analysis and started thinking about how to brief her team. Dr. Okafor asks questions that are precise and deep, and each time Ethan answers, the answer satisfies her and raises a harder question, until they reach a point, somewhere in the third hour, where the questions themselves become collaborative — she is no longer testing him, she is thinking alongside him.
At the end of the fourth hour, she sits back in her chair.
She looks at him for a long moment.
"How old are you?" she asks.
"Twenty-four."
She nods, as if this confirms something she suspected. "The OAuth findings alone would be worth a significant reward. The API gateway vulnerabilities — Marcus, what's your assessment?"
Marcus is looking at his own screen, where he has been cross-referencing the report against their internal architecture documents. He doesn't look up immediately. When he does, he says one word:
"Unprecedented."
Dr. Okafor stands. She extends her hand across the table.
"Give us seventy-two hours," she says. "We need to verify internally and loop in leadership. But Ethan — I want to be straightforward with you." She holds the handshake a beat longer than a formality. "What you've brought into this room is not what we expected. And we expected quite a lot."
Ethan nods. He keeps his expression measured.
He catches his flight back to Detroit that evening. He sits in the window seat, watching the city lights of Mountain View shrink and disappear as the plane climbs into the dark, and he thinks about the way Dr. Okafor said unprecedented — not as a compliment, not quite. More like a reclassification. The word you use when something has moved from one category to another and the old labels no longer fit.
His phone buzzes as the plane levels off. A text from an unknown number.
This is Sarah Okafor. I'm sending you a formal follow-up tomorrow, but I wanted to say this tonight: our legal and executive teams are already reviewing the findings. The conversation about compensation will happen at the highest level. Be ready.
He sets the phone down on the tray table.
Outside the window, thirty thousand feet below, the country lies dark and indifferent and enormous.
He is $198 and a credit card debt away from nothing.
He falls asleep before they cross the Ohio border, and he doesn't dream of anything at all.
End of Chapter Three
PROTOCOL ZERO — SYSTEM LOG
Host: Reyes, Ethan Marcus
Acquisitions to date: 1 (Sentinel-Prime v1.0)
Credits: 0
Status: Pending first major deployment outcome
Note: The system is watching.