Tuesday, March 26, 2013 — Detroit, Michigan
The seventy-two hours become five days.
Ethan doesn't call. He doesn't follow up. He goes to the public library on Wednesday and uses their printer to run off copies of his resume, more out of habit than intention. He applies for two freelance contracts — network monitoring work, the kind that pays $18 an hour and asks for a cover letter. He makes his bed every morning. He buys groceries with what's left of his checking account and cooks rice and beans on a Tuesday night while NPR plays in the background, something about the sequester, something about the new Pope, the world doing what the world does.
On Thursday his phone rings. Unknown California number.
"Ethan." Dr. Sarah Okafor's voice. No preamble. "I need you to come back to Mountain View. Thursday next week, if you can manage it."
"I can manage it."
"Bring nothing except yourself. Everything you need will be here."
She hangs up before he can ask what everything you need means. He stands in his kitchen for a moment, holding the phone against his chest, listening to the rice boil over.
The meeting is in a different building this time — not the security wing but something closer to the center of campus, the kind of building where the carpet is slightly better and the coffee machines are newer. Ethan is met at the door not by Christine Mao but by a man in a navy suit who introduces himself only as Jeff, from legal, and who walks quickly and says very little.
The conference room has eight people in it.
Ethan recognizes Dr. Okafor and Marcus Bell. The others are introduced in a rapid sequence: two more lawyers, a woman named Diana Chu from Finance, a man named Robert Westing who is identified as VP of Infrastructure, and, at the head of the table, a person Ethan needs a moment to place before he does — Alan Mercer, Google's Chief Information Security Officer.
Ethan has read three of Mercer's published papers on distributed systems security. He shakes the man's hand and keeps his expression exactly level.
"Sit down, Ethan," Mercer says. His voice is unhurried, the voice of someone who has decided, in advance of this meeting, what tone it will have. "I want to start by saying something directly. We've had three separate internal teams spend the past five days reviewing your findings. Every critical vulnerability you identified has been verified. The OAuth timing issues are real. The API gateway logic flaws are real. The TLS configuration problems in the secondary CDN clusters — real. And several of the medium-severity findings flagged things that our own teams had discussed as theoretical concerns and placed on a future roadmap." He pauses. "They weren't theoretical."
Ethan nods.
"The question," Mercer continues, "is what the appropriate response looks like. And I want to be transparent with you about the internal conversation we've had, because I think you deserve that." He glances at Diana Chu, who opens a folder. "Our standard bug bounty program has a ceiling. You know what it is. The findings you've brought in exceed any framework we've used before, both in volume and in the severity class of the critical items. The OAuth vulnerabilities, specifically — our security modeling team estimates that a sophisticated state-level actor exploiting that chain in sequence could potentially have accessed OAuth tokens for a significant subset of our user base. We're talking about a scope that, if it had been exploited rather than disclosed, would have been — "
"Catastrophic," Marcus Bell says quietly, from the far end of the table.
Mercer looks at him, then back at Ethan. "That's the word."
The room is quiet for a moment. Outside the window, someone is riding a bicycle across the courtyard. The normalcy of it is almost funny.
"We want to compensate you appropriately," Mercer says. "Diana."
Diana Chu slides a single sheet of paper across the table to Ethan. Face down.
He turns it over.
The number is $85,000,000.
It is followed, in smaller print, by terms: full NDA on the specific vulnerabilities and methodology, a non-exclusive consulting agreement for any follow-up questions during remediation, a 90-day verification period during which Ethan agrees not to disclose the findings publicly.
Ethan looks at the number for a long time.
Eighty-five million dollars.
He thinks about the electrical tape on his power adapter. He thinks about the form email from CyberBridge. He thinks about $198.
He keeps his face still.
"I have one condition," he says.
Every lawyer in the room tenses slightly.
"The remediation credit — the consulting agreement. I want it structured as active involvement, not just availability. I want a seat at the table during your patch planning for these specific findings. Not permanently. Just through remediation."
Mercer looks at him. A long look.
"Why?"
"Because I want to understand how a company at your scale implements fixes at this level. I learn from it. That's worth more to me than any adjustment to the dollar figure."
Another pause. Mercer glances at Dr. Okafor, who gives a fractional nod.
"That's an unusual ask," Mercer says.
"I'm told that's a pattern with me."
Something that might be a smile crosses Mercer's face. It doesn't stay long. "We can accommodate that. Jeff will work it into the agreement language."
Jeff, from legal, writes something down without being asked.
Ethan looks at the paper one more time. Then he slides it back across the table.
"I'd like my own counsel to review before I sign. I can have a response to you within a week."
Diana Chu blinks. It is, Ethan suspects, not what she expected from a twenty-four-year-old from Detroit with visibly worn shoes.
"Of course," Mercer says.
They shake hands. Ethan is walked back to the lobby by Jeff from legal. On the ride to the airport he sits in the back of the Lyft with his hands folded in his lap and watches Silicon Valley pass outside the window — the low buildings, the wide streets, the particular quality of California light that makes everything look like it's been gently overexposed.
He calls his mother from the gate.
She picks up on the second ring. "Ethan? Baby, it's late — "
"Mom." He pauses. He doesn't know how to say it except plainly. "I think things are going to change."