Chapter 105: Eleven of Thirteen
[Gardner Analytics covered glass conference room Wednesday February 11, 2016 10:15 AM]
The covered glass room had three whiteboards and no windows. Sarah had requested it specifically. "No view, no interruptions, no leaving," she'd said that morning, and then had left twice for coffee.
Priya had taped the exfil timeline across the largest board in fifteen minute increments. Thirteen events. Thirteen colored tabs. The tape was her red marker she used it when she wanted you to count something.
"The first pull," she said. "December ninth, two forty AM UTC. Pied Piper's integration channel logged an active session from two oh eight to two fourteen."
She moved down the board.
"Second pull. January fourteenth. Twenty three thirty seven UTC. Active session, sixteen thirty two to twenty six forty one."
Ethan watched the pattern build. Each event. Each window. The partnership's shared credential log was clean Jared's protocol required named human authentication on every pull, which meant every access had a timestamp and a name attached to it.
Eleven of thirteen aligned. The colored tabs stacked in columns so neat they looked architectural.
"Event three." Priya's finger stopped. "December twelfth, oh four forty one UTC. No partnership session within forty minutes."
The room was quiet. The pastrami smell from below was faint Wednesday mid morning, Manny running the slow shift.
"Event seven. January twentieth, twenty two fifteen UTC. No partnership session within thirty five minutes."
Two tabs, out of column. Priya had circled both in red.
"Eleven align," Priya said. She turned from the board. "Two do not. I would like to understand the two."
Daniel Oyelaran leaned forward. He had the incident response brief in front of him his own work, annotated, a document so competent that Monica had minuted it as a model for future responses.
"Clock skew," he said. "Both pulls originate from a process running on a virtualized instance. VM clock drift is a known artifact in containerized environments, especially under load. A forty minute offset on a busy node is within the expected variance band."
He delivered it warm, direct, complete, exactly like always. The explanation was technically sound. Ethan checked it against the architecture in his head and it held. Container clock drift was real. It was documented. It was exactly the kind of noise a genuine investigation produced.
"Marcus can confirm the drift range from the infrastructure logs," Daniel added. "But the explanation is consistent with the pattern."
Priya looked at Ethan. Not at Daniel. At Ethan.
"Where does your confidence about the route come from?"
The room held. Sarah was at the far end of the table, red marker uncapped, not writing anything. She'd already said her piece before the meeting a channel you are afraid to close is not a channel you control. Now she was just watching.
"Deployment constraints," Ethan said. "The integration channel is the only external path with persistent credentials and no rate limiting on the data layer. Every other route rotates keys every seventy two hours."
That was true. It was also not what she'd asked.
Priya held his gaze for two seconds. Then she removed her glasses, folded them, and set them on the table next to her mug the one that said I survived peer review. She wrote something in her notebook.
She did not ask a follow up question.
[CONTINUED same room 10:55 AM]
Ethan walked the timeline himself. Priya cross referenced the two anomaly windows against the infrastructure logs Marcus had sent over at nine that morning.
The clock skew explanation was clean. Both misaligned pulls occurred on nodes running above eighty percent utilization during known compute intensive periods the December ninth curation batch and the January twentieth pre training warmup. VM clock drift under load was not just plausible. It was the kind of thing that happened every day and that nobody noticed until someone built a forensic timeline.
He should test it. He should ask Marcus to pull the NTP offset logs for both nodes, confirm the drift range, and close the gap between the pull timestamp and the nearest partnership session. That was the correct process. That was rigor.
"Rotate the credentials and monitor for two weeks," he said instead. "If the exfil route is the partnership channel, rotating the keys closes it. If it's not, we'll see the pulls migrate to a new vector."
It was a sound operational recommendation. It was also a way to stop looking at the two anomalies. The eleven were so clean, and the two were so neatly explained, and the explanation had been handed to him by the most competent person in the room.
Oyelaran nodded. "I'll draft the rotation procedure. We can have it executed by end of day."
"Good."
Sarah capped her red marker. She had not used it once.
[Gardner Analytics Ethan's office 5:50 PM]
The disclosure was four paragraphs. Ethan wrote it himself because the language mattered.
During routine security review, Gardner Analytics identified unauthorized access to proprietary training methodology. Forensic analysis indicates the access was routed through the Pied Piper integration channel. The incident remains under investigation. We are implementing credential rotation and enhanced monitoring as interim controls.
Every sentence was true. The access had occurred. The forensic analysis did indicate the route. The incident was under investigation. The controls were real.
No sentence said what the document was designed to make a recipient believe that the partnership had been the source. That was the recipient's inference. The document merely arranged the facts in an order that produced it.
Monica would have caught the shape of it. She was at a Sequoia finance session across town. Sarah would have caught it too, but Sarah had left at four thirty without commenting on the draft, which was its own comment.
He signed it. He sent it to Rebecca Zhou's counsel at Sequoia, with a copy to Andrew Lau.
At 6:40 PM, his inbox chimed.
The subject line was: Re: IP Security Incident Disclosure Notification Protocol Query (11 Items).
Jared Dunn had written seven numbered questions. Each was cheerful. Each was meticulously organized. Each was exactly the kind of thing a man who had designed a bilateral escalation protocol would ask when that protocol was triggered for the first time.
Item 1: The mutual disclosure protocol from partnership formation (Appendix C, Section 4.2) requires that any IP security incident disclosed to either party's investors also go to both companies' operational leads. Has Pied Piper's counsel been notified?
Item 4: The protocol specifies a 24 hour notification window from investor disclosure to partner notification. Given that the Sequoia disclosure was sent at 5:50 PM PT today, the window closes at 5:50 PM PT Thursday. Do you want me to handle the Pied Piper notification, or will you be doing that directly?
Item 7: For clarity does the protocol distinguish incidents where the partner is the affected party from incidents where the partner is merely referenced? Was this intentional in the drafting, or should we consider an amendment?
Item 11: I have prepared a draft notification to Pied Piper's counsel and can send it at your word. Please advise on timing. I am available this evening if that helps.
Ethan read the email twice.
Jared had done exactly what Jared did he had built a process so thorough that it functioned whether or not anyone wanted it to. The protocol he had written at the partnership formation required that Pied Piper be notified of any incident disclosed to investors. The notification would describe the route. Richard would read it. Richard would learn that his company's integration channel had been named in a security disclosure to Sequoia.
He could call Richard first. He could frame it. He could explain the nuance that the route was under investigation, not confirmed, that the disclosure was preliminary.
He could do the thing he had been postponing for five days, which was picking up the phone.
The covered glass room was dark across the floor. He could see it through his office door the lights off, the timeline still taped to the board. Eleven aligned tabs, and two red circles he had chosen to stop examining.
He closed the laptop. He did not answer the email.
The Honda started on the second try.