June 2013 — Ann Arbor, Michigan
Summer comes to Ann Arbor the way it always does — abruptly and without apology, the cold lifting overnight like a decision rather than a gradual change. The students are mostly gone, the campus quiet, the coffee shops populated by doctoral candidates and the occasional professor who has nowhere else to think.
Ethan works.
He works with the systematic focus of someone who has found, for the first time, that external pressures are no longer dictating his schedule. No commute. No meetings. No quarterly reviews. The shape of his days is entirely self-designed, which is a freedom that some people find paralyzing and that Ethan finds clarifying in a way that almost frightens him.
By mid-June, he has built the second tool — the Network Architecture Intelligence Suite deployed as a standalone application he calls Lattice internally. It is more sophisticated than Sentinel-Prime in its operational requirements; running a full Lattice analysis on a large-scale network perimeter requires significant compute time and a careful configuration that accounts for the specific architecture being mapped. But what it produces — a topological model of a network that shows not just what's there but how the pieces relate to each other, where the boundaries are weak, where lateral movement would be invisible to standard monitoring — is something that doesn't exist anywhere else in the world in 2013.
He also, during June, begins having meetings.
Patricia Holt has connected him with three other technology lawyers, one of whom specializes in government contracting. Vincent Darrow has introduced him to two other financial advisors and, at Ethan's specific request, to a forensic accountant named Grace Kim who will, going forward, maintain meticulous documentation of every transaction connected to Apex Systems. Ethan has made a policy decision: the company will be clean in a way that leaves nothing to interpretation. Every dollar sourced, every engagement documented, every disclosure filed on time and in full. Partly because it is the right way to operate. Partly because he has, somewhere in the back of his mind, a developing awareness that people are going to look at him.
He doesn't know yet about Conrad Ellis's legal pad.
But he has read enough history to know that money, when it appears in unexpected places, draws eyes.
The second engagement begins in June, not with a cold email this time but with a phone call from a number he doesn't recognize.
"Mr. Reyes." Male voice, precise, slightly clipped. "My name is Nathan Byers. I'm Director of Security Engineering at Microsoft. I got your name from someone at Google who is not authorized to have given it to me." A pause. "I'm calling anyway."
Ethan sits very still. "How can I help you, Nathan?"
"I want to know if what you did for Google is reproducible. And I want to know your terms."
The Microsoft engagement takes longer to authorize — their legal process is more elaborate, the scope negotiation more contentious. The company's security team is larger than Google's and therefore more structurally skeptical; there are more stakeholders whose territory the engagement touches, more people who need to sign off before a twenty-four-year-old in Ann Arbor is given authorized scanning rights against their production infrastructure.
It takes six weeks to finalize.
During those six weeks, Ethan acquires a third tool from Protocol Zero.
FORENSIC INTELLIGENCE FRAMEWORK v1.0
Digital Artifact Analysis and Attribution System
The FIF is different from Sentinel-Prime and Lattice in that its primary function is not offensive or structural — it is investigative. Where Sentinel-Prime finds vulnerabilities and Lattice maps topology, FIF analyzes the artifacts that digital activity leaves behind: log files, memory fragments, network traffic captures, metadata chains. It can reconstruct the history of activity on a system with a granularity that standard forensic tools can't approach, and its attribution module — the one that Ethan spends the most time studying after integration — builds probabilistic models of who performed specific actions based on behavioral signatures embedded in the artifact record.
COST: 1,200 CREDITS
He has 2,450 credits after the acquisition. He builds FIF over three weeks in July, working late into the nights, the Ann Arbor summer pressing against the windows.
The knowledge integration for FIF is, in some ways, the most disorienting so far. Sentinel-Prime's integration had felt like learning a language. Lattice's had felt like developing spatial perception. FIF's integration feels like developing a new kind of memory — not his own memories, but the capacity to read other systems' memories. He finds himself, after the integration settles, looking at ordinary log files with a different quality of attention. Every file has a history. Every action leaves a trace. Systems remember everything, even when their administrators believe they don't.
He thinks about this in ways that extend beyond cybersecurity.
He tries not to.