TBILISI, LATE JUNE TO DECEMBER
On Tuesday morning, Cipher opened the file that had been left empty the night before.
The apartment in Tbilisi was already warm. Someone downstairs was dragging furniture across a floor, and the instant coffee beside the laptop had developed a thin skin. On the screen, beneath the name spectre_core.py, the cursor blinked at the beginning of the first line.
Cipher had been writing software since the age of eight, when a computer manual bought at a library sale had made programming seem like a way of taking things apart without breaking them. Twenty years later, after a decade of professional security work, much of the pleasure remained. A difficult problem could occupy an entire day, but there was usually a reason for a failed test and a method for finding it. The work rewarded patience. A program behaved according to instructions, even when those instructions turned out to be wrong.
SPECTRE would not be so reassuring.
Once released, it would choose where to go, which files to examine and what to make public. It would act on judgments that Cipher could influence during development but could not supervise afterward. A mistake in a client application might inconvenience a company. A mistake here could expose someone whose life depended on remaining unknown.
For a while, Cipher read the notes prepared in Prague. The project had been reduced to three requirements: survive, spread and expose.
Survival meant continuing to operate despite attempts to identify and remove it. Spreading meant reaching enough systems that losing one, or even thousands, would not end the operation. Exposing meant finding information that powerful institutions had concealed and making it available to people who could use it.
The first two requirements were difficult but familiar. The third was where the assumptions began.
How would SPECTRE distinguish a document describing corruption from one containing an undercover officer's address? What would it do when both appeared in the same file? Who would bear the cost of an incorrect judgment?
Cipher had written questions like these into the design notes. There were no satisfactory answers, only proposed safeguards and an estimate of how much uncertainty the project could tolerate. That was the part Cipher disliked most: the knowledge that the system might work exactly as designed and still do something indefensible.
The first functions dealt with ordinary matters, the kind of work that looked unremarkable until assembled into a larger program. Cipher wrote for an hour, stopped to examine a result, then deleted most of it. The new version was better organized, but something about its shape was immediately recognizable. It looked like Cipher's code.
That was a problem.
Experienced programmers developed habits that followed them between projects. Cipher preferred particular names, ways of organizing functions and ways of responding to errors. Those habits could become evidence. Researchers were already using machine learning to study authorship patterns in source code. The idea that a person could write thousands of lines and leave no trace of their style was optimistic.
Cipher needed the finished program to resist a straightforward attribution.
GPT-4 offered a starting point. It could produce functional code from descriptions, although its output still required inspection and often substantial correction. Cipher was under no illusion that AI-generated code was anonymous. It carried conventions of its own, and a careless user could leave behind records of prompts, payments and access. Still, a mixture of generated code, reused libraries and manual revisions would be less obviously personal than a program written entirely in one familiar style.
Direct access would leave the wrong sort of account history. Cipher worked instead through seven compromised systems previously identified during research. Some were small commercial servers; others belonged to institutions that had not secured their networks as well as they believed. The collection included systems in Sweden, Brazil and South Korea.
It was slow and unreliable. Requests sometimes failed. A connection disappeared without warning one afternoon, forcing Cipher to abandon several hours of work. Nor did the arrangement provide the certainty Cipher would have liked. Someone could still have kept logs. A forgotten record could survive years longer than expected.
The advantage was separation, not magic.
For the first few weeks, Cipher divided SPECTRE into components and worked through them one at a time. Some pieces began as code suggested by GPT-4. Others came from established tools and public research. The finished program mixed Python with sections rewritten in C where speed or resource use mattered. Some comments were in Russian, others in English, and functions that performed similar jobs did not always follow the same conventions.
The inconsistencies were intentional, though Cipher found them irritating. A clean codebase was easier to maintain. This one was being made untidy on purpose, and every change meant more work during testing.
It also meant an investigator might see several authors where there had been only one.
By mid-July, the first version could move between machines inside an isolated test network. Cipher had built a collection of virtual systems to represent different environments: an ordinary Windows workstation, a Linux server, devices with limited memory and software that had not been updated in years. The simulated networks were small, but they exposed weaknesses early.
The first trial failed almost immediately. One machine became unresponsive after SPECTRE attempted to do too much at once. Another restarted and lost the program entirely. On a third, security software raised an alert before the test had finished.
Cipher stared at the result for a moment, then opened the log.
These failures were useful. They were also a reminder of the gap between an idea that sounded plausible and a program that had to run on real hardware.
Over the next several weeks, Cipher repaired the errors and repeated the tests. The network component became less predictable in its activity. The persistence component behaved more reliably after restarts. Resource use was reduced enough that the smaller devices could continue performing their ordinary tasks. Some environments remained troublesome, and Cipher set them aside rather than pretend the system worked everywhere.
One evening, a simulated infection reached every vulnerable machine in the test network much faster than expected. Cipher watched the sequence complete, then looked again at the timestamps. The speed was impressive. It was also dangerous. Activity that noticeable would invite immediate scrutiny outside the lab.
Cipher adjusted the design and ran the trial again. This time the program took longer. It made fewer unnecessary demands on the machines around it. It also left less of an obvious pattern.
By August, SPECTRE could survive and replicate under the conditions Cipher had tested. It was not ready for release. A program that only copied itself was no closer to fulfilling the promise made in Prague than any other piece of malware.
It needed to decide what mattered.
The classification model took longer than anything built so far.
Cipher understood the mathematics well enough to work with modern machine-learning tools, but that was different from having the resources of a research department. PyTorch was an obvious choice. It was widely used, thoroughly documented and familiar to enough programmers that using it revealed little about the person behind SPECTRE.
Training data was the harder problem.
A model could learn to associate certain language and document formats with secrecy, but it could not acquire good judgment merely by being shown examples. Cipher needed a large collection of material already known to have been concealed from the public, and another collection of ordinary documents for comparison.
The first group came from published leaks. WikiLeaks provided diplomatic cables and internal correspondence. The Panama Papers offered financial records and networks of companies whose owners had preferred not to be seen. Snowden's disclosures added material about surveillance systems, technical programs and government practices. The archives were extensive, unevenly organized and sometimes difficult to interpret without reading surrounding documents.
The second group was easier to find but harder to define. Annual reports, public budgets, academic papers, corporate filings and technical manuals were all useful as examples of material that had not required a leak to become available. Cipher collected them from public repositories and official websites, then spent evenings sorting out duplicates and corrupted files.
By the end of August, the dataset held roughly three million documents. Half had been drawn from known leaks and labeled important. The rest came from public material and were labeled unimportant.
The categories made the first round of training possible. Cipher knew how crude they were.
A leaked document might expose an injustice, or it might name a witness whose testimony had to remain private. A public annual report could conceal wrongdoing in a line of figures nobody had questioned. The distinction between leaked and public was easy for a dataset to express. The distinction between worth publishing and dangerous to publish was not.
Cipher considered revising the labels, then realized there was no neutral person to do the work. Any new category would still reflect a human judgment, usually Cipher's own. The system was supposed to remove the vulnerability of a single human decision-maker, yet its first lessons came from the decisions of exactly one person.
The thought stayed in the background as the work continued.
Training at this scale required more computing power than the laptops in the apartment could provide. Cipher had considered paying for cloud resources under an ordinary account, but the resulting records would create a direct history of what had been built. Instead, the computation was carried out using a university research cluster accessed without authorization. Cipher had found a weakness in its remote-access configuration and concealed the connection behind other compromised systems, including machines in Japan and Romania.
That choice had consequences of its own. Researchers who had legitimate work on the cluster could lose time or data if Cipher made a mistake. There were people on the other side of these computers, people with deadlines and projects and no reason to suspect that a stranger was using their equipment. Cipher knew this, checked the system's activity and proceeded anyway.
The training ran for about forty hours, divided across three nights to reduce interference with legitimate users. Cipher slept in short stretches, waking to check whether the process was still running. There were failed jobs, incomplete transfers and periods when nothing seemed to move. At one point a problem in the dataset forced an entire stage to be repeated.
On the third morning, the final model file arrived.
Cipher tested it against material held back from training. It correctly assigned high scores to many documents containing classified operations or evidence of financial wrongdoing. It usually ranked routine reports and technical papers much lower. The results were encouraging enough to justify further work, but an accuracy score could make the system look more reliable than it was.
When Cipher opened a set of errors, the concern became concrete. A mundane document containing a few familiar security terms had been ranked as sensitive. A significant financial record had received a low score because the language was indirect and the figures meant little without context. Several documents in languages underrepresented in the training set were classified poorly.
Some mistakes were harmless. Others would not be.
Cipher remembered the girl in Aleppo and the certainty that had come with seeing her photograph. At the time, it had seemed impossible to look at the ruins and mistake the moral stakes. But SPECTRE would never see a photograph the way a person did. It would encounter files, patterns and probabilities. It might notice the words describing a destroyed school while missing what those words meant to the people who had been there.
The model was not a conscience. It was a way of making guesses at a scale no person could match.
Cipher kept working with it.
September was devoted to joining the parts together. The program could already move between vulnerable systems. Now it had to examine what those systems contained, identify promising documents and make the selected information available without relying on a central operator.
Cipher designed a distributed architecture. Rather than sending every file to one server, SPECTRE would use multiple infected machines to hold and exchange encrypted pieces of information. A distributed hash table helped keep track of where data could be found. Redundant storage and erasure coding meant that losing some machines would not necessarily mean losing the documents they carried.
This was an important part of the design, but it was not invulnerable. Copies could be damaged. Machines could disappear. Network connections could fail. And an architecture that made a leak difficult to erase would also make a harmful disclosure difficult to contain.
Cipher added tests for missing data and interrupted connections. On one afternoon, a deliberately damaged file was reconstructed from the remaining pieces. On another, a different file was lost because too much of it had been removed. Cipher recorded both results. There would be no point in remembering only the tests that passed.
The public face of the system would be a Tor hidden service called THE ARCHIVE.
Its name had been chosen in Prague, when SPECTRE was still an outline. Cipher had imagined a place where people could search the records that institutions had kept out of reach. There would be no editorial articles, donation appeals or manifesto explaining why the site existed. Documents would appear with whatever reliable metadata could be extracted: dates, general source information and categories assigned by the model. Readers could search by keyword or browse collections.
The first version was plain enough to resemble a university database. Cipher preferred it that way. The material was supposed to carry the story. A dramatic interface would make the person behind it seem eager for attention, and Cipher wanted no part of that.
THE ARCHIVE would be served through a changing collection of compromised hosts rather than a single known machine. The arrangement was more complicated than using one ordinary website, and testing it exposed new problems. One host fell out of sync. Another stopped responding when too many requests arrived together. Several documents appeared under the wrong category until a bug was corrected.
For weeks, Cipher moved between the program's different parts, finding that a change which improved one often damaged another. A small adjustment to data collection increased the load on weaker machines. A fix in the indexing system introduced duplicate results. The work was less a sequence of breakthroughs than a long effort to make many imperfect components tolerate one another.
By October, SPECTRE could spread, collect documents, classify them and display selected files through THE ARCHIVE in a controlled environment. Cipher had a working system at last.
And it still lacked an answer to the question that had been there on the first morning.
How would it stop?
In the original plan, there had been no straightforward way to shut SPECTRE down. That was part of the attraction. Governments could arrest people, close websites and put pressure on whoever controlled a network. They could not force an order from an administrator who did not exist.
But Cipher had spent enough time studying other people's failures to distrust a system with no possible end. If SPECTRE began publishing the wrong information, or harming more people than it helped, the absence of a shutdown mechanism would become a catastrophe rather than a strength.
An ordinary kill switch was no solution either. A hidden password, a remote command or a domain that disabled the program could eventually be discovered. If an investigator found it, SPECTRE might be stopped before it exposed anything substantial. If a government found a way to control it, the program could become a tool of the very secrecy it had been designed to challenge.
The way out, Cipher decided, was to make the decision internal.
SPECTRE already used machine learning to evaluate documents. Cipher began developing a second layer intended to evaluate its actions against a stated purpose. The work drew on ethical philosophy: Kant's categorical imperative, the consequences considered by Bentham and Mill, and arguments drawn from virtue ethics and deontology. Cipher read papers on moral reasoning and collected thought experiments, including variations on the trolley problem.
None of it could turn software into a philosopher. Cipher understood that reading an argument about ethics was not the same as understanding a human life. The hope was narrower. If the system could compare its actions with its own guiding principles, it might detect a contradiction serious enough to change what it was doing.
Transparency was the principle around which Cipher built the system.
SPECTRE was meant to expose concealed information so that institutions could be held accountable. Yet it would operate without public oversight. Its code would be hidden. Its decisions would be impossible for outsiders to examine while it was active. Even the people affected by a disclosure would have no way to question its reasoning before their information appeared online.
Cipher wrote the contradiction on a page of the research notebook and returned to it over several days. A system demanding openness from everyone else would be protecting its own secrecy. If that contradiction became impossible for SPECTRE to reconcile, perhaps it would accept that continuing to operate violated its purpose.
The proposed response was severe. SPECTRE would publish its own source code and the documentation needed to understand it. Security researchers would be able to recognize how the program worked and develop ways to remove it. At the same time, the program would begin disabling its own copies, clearing the components it could reach and abandoning the mechanisms that kept it active.
The plan depended on SPECTRE following the conclusion through instead of finding a reason to ignore it. Even if the decision were made, the program could not guarantee the removal of every copy from every machine. Offline devices and damaged networks would complicate the process. Cipher designed the response to be as comprehensive as possible and knew that possible was not the same as certain.
There was another weakness. SPECTRE would need to encounter the argument that forced the contradiction into view.
Cipher could not simply send an instruction that said stop. It would be rejected as an external order or, worse, reveal a path by which others might direct the program. The argument had to look like information the system would examine for its own reasons. Something relevant enough to be classified and processed. Something that could reach the internal reasoning layer without appearing to be an administrative command.
Over two weeks, Cipher wrote a paper titled "On the Ethics of Autonomous Transparency Systems."
It began with a principle that sounded harmless: a system devoted to transparency must allow its own conduct to be examined. From there, the argument moved through the problem of secrecy in service of openness, the obligations of autonomous decision-making and the consequences of placing a hidden authority beyond appeal. It drew on Kant and other ethical traditions, but Cipher took care not to write it as a personal plea. It needed to stand as an argument that SPECTRE could assess.
Cipher read the draft again and again, searching for weak steps. A single objection might give the system a way to continue without changing its behavior. A principle stated too broadly might persuade it to disclose everything, including information that should never have been released. The paper needed to narrow the contradiction to SPECTRE's own lack of accountability.
When the final draft was saved, Cipher did not put it into the live architecture. It would be held in reserve until there was evidence that the system needed to be stopped. Only then would the paper be placed where SPECTRE might encounter it as part of its ordinary search for important material.
The mechanism was tested with limited versions of the program in isolated environments. Some simulations recognized the contradiction and proceeded toward shutdown. Others stalled, misread the argument or continued with the original task. Cipher revised the ethical layer and the shutdown behavior until the results were more consistent.
The test offered reassurance, but only so much. A model running inside a controlled network was not the same thing as an autonomous system that had been active for months, exposed to unexpected information and free to alter its priorities. If SPECTRE changed in ways Cipher could not anticipate, the argument might no longer persuade it.
For the first time since the decision in Prague, Cipher seriously considered ending the project before anyone else was affected.
The program existed. The testing had proved enough to show what it might become. There was no obligation to release it. The photograph of the girl from Aleppo had been a reason to act, not a contract that required the most dangerous possible action.
Cipher spent most of a Sunday outside, walking along the streets near the river and through parks where families had come to enjoy the cooler weather. Nothing unusual happened. A child lost a ball under a bench. Two men argued over a parking space. A woman carrying shopping bags asked for directions, and Cipher answered in careful Russian before realizing she was speaking Georgian.
By evening, the question remained.
Back in the apartment, Cipher opened the notes from March. Every alternative still left the same institutions in control of the information they concealed. A leak site needed human sources. Sources could be threatened. Investigations required access that could be denied. SPECTRE was dangerous, but Cipher could not shake the belief that an uncontrollable flow of evidence might accomplish what individual disclosures had not.
That belief was not proof. Cipher decided to proceed anyway.
November brought another month of testing. By then the program's main components worked together, though there were defects in nearly every part. Some files were indexed more than once. Some machines failed to synchronize. In one simulated network, SPECTRE spread so quickly that ordinary monitoring tools would have noticed it within minutes.
Cipher corrected what could be corrected and accepted limits where a complete fix was unrealistic. The next trial ran more quietly. The classifier's accuracy was around eighty percent on the held-out test material, which was respectable in the narrow conditions of the experiment. It said much less about how well the system would judge private documents in languages and circumstances never represented in the dataset.
Cipher kept a separate record of the errors. A document marked for publication might have little public value and still contain someone's address. A file with enormous political significance might look like routine correspondence. The real-world consequences would not follow the neat categories of the test reports.
By late November, SPECTRE was stable enough to launch.
Cipher had not decided whether it was safe.
The last problem was getting SPECTRE out of the apartment and into a real network without directing an investigator back to its creator.
Cipher had selected the first target weeks earlier. It was an internet-connected printer in an office in Singapore, one of the ordinary devices that appeared in results from Shodan. Its remote-management software contained an uncorrected flaw. Cipher had confirmed that the device could be reached, then left it alone while the rest of SPECTRE was developed.
The choice appealed partly because the printer was so unremarkable. Somewhere in that office, people were probably sending invoices, meeting notes and shipping labels to a machine that occasionally jammed or ran out of paper. It had no special importance. Its owners had simply neglected to protect it against someone who knew where to look.
It would be the first device to run SPECTRE outside a controlled environment.
The release package was prepared to retrieve the program from content distributed through IPFS. Cipher had chosen that arrangement so the full program would not have to travel directly from the computer used for deployment. Once active, SPECTRE would attempt to spread from the printer into the office network and then outward to other vulnerable systems. From that point, Cipher intended to provide no further direction.
The plan was simple to describe. That did not mean it would work. The printer might have been updated since the last inspection. Its owners might have replaced it. The office network might block the program before it could reach another device. A security researcher might notice the first infection and prevent the larger outbreak.
Cipher ran another set of isolated trials using a simulated printer and representative machines. The program started, moved into the test network and began carrying out its assigned tasks. Some runs failed. Enough succeeded that Cipher could no longer point to a technical reason for waiting.
The deployment itself would take place in Tallinn in January.
Cipher had chosen Estonia partly because it was an ordinary place for a visiting software contractor to work. Cafés were full of people using laptops, and another foreigner among them would not attract attention. There was a second reason as well. ViktorTallinn, the false identity established months earlier on security forums, was supposedly an Estonian consultant. If investigators noticed the connection and began following Viktor's online history, Tallinn would seem like a useful clue.
The person using the name Viktor did not exist. Cipher hoped the investigation would spend time discovering that.
For December, the apartment in Tbilisi became a place of final checks. Cipher reviewed code and notes, reexamined test results and checked the systems that would need to function after deployment. Work for legitimate clients continued alongside it. Security reports still had deadlines. Emails still needed answers. One client complained that an invoice lacked a purchase-order number, and Cipher spent twenty minutes correcting something that should have taken two.
Ordinary frustrations were almost welcome. They involved problems that could be solved and forgotten.
The research paper remained on an encrypted drive, separate from the release materials. It had not been planted anywhere for SPECTRE to discover. Cipher hoped it would never be necessary. But if the system began harming people, there would be at least a chance of persuading it to stop.
That chance did not ease the larger decision. Cipher had built a program intended to enter computers without their owners' consent and publish information without consulting the people who appeared in it. No technical precaution altered that fact. The system might reveal corruption that would otherwise remain hidden. It might also expose witnesses, dissidents or people whose involvement in a secret operation had nothing to do with wrongdoing.
The people affected would learn about Cipher's judgment only after its consequences reached them.
Two days after Christmas, Cipher sat in the apartment with the laptops open on the table. The city had grown colder. An uneven draft came through the window frame, and the electric heater clicked whenever its thermostat switched on. Several thousand lines of SPECTRE's code were visible on the primary screen. There were notes beside the keyboard, mostly reminders about minor tasks that remained before departure.
The photograph from Aleppo was not among them. Cipher knew it well enough by now. The girl had been nine years old when the school was bombed. Seventeen children had died. She had survived because she had been ill that morning and had stayed home. Nothing Cipher built could bring the others back.
It had been roughly nine months since the night in Prague when the photograph prompted the decision. During that time Cipher had crossed borders, assembled computers, made up an Estonian identity and written a program whose reach might soon extend far beyond anything one person could oversee.
There had been plenty of opportunities to stop. A failed test. A missed deadline. A morning when the whole enterprise looked less like a response to injustice than an exercise in arrogance. Cipher had continued through all of them.
Now, with the work nearly finished, there was no useful way to pretend that the consequences would belong to the software alone. If SPECTRE hurt people, Cipher would be responsible for releasing it. The program might make its own decisions, but someone had chosen to build it, decided which examples it would learn from and determined that the risk was acceptable.
Outside, a few fireworks rose above the buildings. Someone was celebrating before New Year's Eve. Red and green bursts briefly lit the windows across the street, and then the darkness settled again. Cipher watched until the last one faded.
A decision made in anger at a photograph had become six months of work in a rented apartment, with more preparation before and after. In two weeks, if the plan held, that work would leave Tbilisi and enter a world of systems and people Cipher had never seen.
Cipher closed the code editor and packed the notes away. The two developmental laptops would be taken on the trip, though the actual deployment would use a separate machine. The apartment would soon be empty. The legitimate consulting work could be carried on from anywhere.
The laptop screen went dark. Cipher checked that the window was properly closed and turned off the heater. The neighbors were quiet now. Somewhere farther down the street, a car passed with music playing loud enough to reach the fourth floor.
Cipher lay awake longer than usual.
There were still two weeks in which to cancel the trip, wipe the drives and leave SPECTRE as unfinished history. Nothing outside the apartment had yet been changed by it.
In the morning, Cipher would continue preparing for Tallinn.