Chapter 32 : The Digital Shadow
Nathan's Apartment, Queens — January 19, 2014, 6:00 AM
Five days after the Bethesda Fountain alliance, Nathan's morning run was interrupted by the system's passive security function doing something it had never done before.
He was at mile three — the stretch along Flushing Meadows where the path curved past the tennis courts and the Korean jogger raised his two-finger peace sign as they crossed — when PSM's passive detection flagged an anomaly. Not a person following him, not a vehicle tracking his route. Something subtler.
[PSM Passive Alert: Behavioral pattern deviation detected. Third-party awareness indicators elevated. Assessment: Subject's digital footprint may be compromised. Recommend: Device security audit.]
Nathan slowed to a walk. The alert was vague — PSM at its current level lacked the precision to identify specific threats, operating instead on pattern recognition that detected when something in his operational environment had shifted. Like a smoke detector that couldn't tell you which room was burning but could tell you something was on fire.
Digital footprint compromised. Someone accessing my data. My articles, my email, my search history — or my devices directly.
He finished the run at a walk. Back at the apartment, he showered, made coffee, and sat down at the MacBook Air with the specific discipline of a man who needed to examine his own tools for betrayal.
The audit took three hours. Nathan wasn't a cybersecurity expert — his journalism background included basic digital hygiene, source protection protocols, and enough technical knowledge to use encrypted email and VPN services. But the system's PSM alert had given him a direction, and direction was enough to start pulling threads.
Thread one: his email. Nathan used three accounts — a professional Gmail for editor correspondence, a ProtonMail for sensitive source communication, and a throwaway for anonymous tips. He checked login records on the Gmail. Three IP addresses he recognized (his apartment, the Bleecker Street coffee shop, the library on Jamaica Avenue). One he didn't.
The unfamiliar IP resolved to a server in Virginia. Not Langley — Nathan wasn't paranoid enough to leap to CIA — but the Virginia corridor where federal government contractors clustered like barnacles on the hull of the surveillance state.
Thread two: his laptop. The MacBook Air he'd bought refurbished in August, the one he used for all his research and writing and source communication. Nathan ran the basic malware scan he'd installed. Clean. But clean didn't mean safe — sophisticated intrusion tools operated below the level that commercial antivirus detected, the digital equivalent of a wiretap that didn't click.
He needed better tools. The kind that required either a cybersecurity background he didn't have or money he didn't want to spend. Nathan chose a third option: Kevin.
"Hypothetically speaking," Nathan said, calling during Kevin's lunch break, "if someone wanted to check whether their personal devices had been compromised by a sophisticated actor — not a script kiddie, not malware from a bad download, but professional-grade intrusion — how would they go about it?"
Kevin was quiet for three seconds. "Hypothetically, you'd want to look at network traffic logs. Specifically, outbound connections your device makes when you're not actively using it. Professional spyware phones home — sends data to a command server at regular intervals. The intervals are designed to look like routine system updates, but if you monitor traffic patterns at, say, 3 AM when you're asleep, you might notice packets going places they shouldn't."
"And how would someone monitor that?"
"Wireshark. Free download. Captures all network traffic. Set it running overnight, review the logs in the morning. Look for outbound connections to IP addresses you don't recognize, especially in the 2-4 AM window. That's when most surveillance software is configured to transmit."
"Kevin, I owe you a drink."
"You owe me several. And Nathan? If you find something — don't remove it. Removing spyware alerts the operator that you've detected them. You want to know who's watching before you let them know you know."
Don't remove it. Let them watch. Control what they see.
Nathan downloaded Wireshark. Set it running at midnight. Went to bed with the specific restlessness of a man who'd asked his computer to tell him whether someone was reading his mind and had to wait eight hours for the answer.
The answer arrived at 6:15 AM on January 20.
Between 2:00 and 4:00 AM, Nathan's MacBook Air had made seventeen outbound connections to three IP addresses he'd never visited. All three resolved to servers in the Virginia corridor. The data packets were small — consistent with surveillance software transmitting browsing history, keystrokes, and document metadata rather than full file transfers. The transmission pattern was clean, regular, professional. Not malware. Not a hack. An operation.
Someone is reading everything I type. Every article draft. Every email. Every search query. They know which sources I've contacted, which stories I'm researching, which addresses I've visited online.
They know about the Reddington file.
Nathan closed the laptop. Sat in the kitchen. The orange cat was on the counter — it had been showing up more frequently since the cold deepened, apparently having decided that Nathan's apartment was a satellite office for its broader territorial operations.
"Someone's watching me," Nathan told the cat.
The cat blinked.
"Very helpful."
[PSM Assessment Confirmed: Device compromise — professional grade. Origin: Federal contractor infrastructure (Virginia corridor). Duration: Unknown (minimum weeks). Data exposure: Significant. Recommended action: Do not remove. Establish clean operational channel.]
Nathan spent the morning in a state of controlled alarm that his RES 7 managed but didn't eliminate. The temptation was to panic — to rip out the hard drive, to call Kevin, to confront whatever agency had decided that a freelance journalist's laptop was worth surveilling. He resisted. Panic was reaction. Strategy was action.
Step one: new device. Clean. Purchased with cash. Never connected to home network.
He took the subway to a pawn shop in the Bronx — not Manhattan, where his face was increasingly recognized, and not Brooklyn, where his bolt hole required anonymity. The Bronx pawn shop sold him a used ThinkPad for $280 cash. No ID required. No receipt requested. The transaction had the specific anonymity of commerce conducted between people who didn't want paper trails.
Step two: establish clean network. The new laptop connects only through public Wi-Fi at locations I've never used before. Never the apartment. Never the coffee shops I frequent.
Step three: the compromised MacBook becomes a stage. I control what it sees. It sees what I want them to see.
The concept was simple but the execution was delicate. Nathan couldn't suddenly change his browsing patterns — the watchers would notice. Instead, he had to maintain his normal digital behavior on the compromised device while shifting all sensitive work to the clean one. Research on the MacBook. Real analysis on the ThinkPad. Two parallel digital lives, like his two apartments and his two names, the specific compartmentalization of a man whose survival depended on the separation of truths.
He spent the afternoon at the Bushwick bolt hole — the first time he'd used it since the siege — setting up the ThinkPad. The studio's isolation was its virtue: no internet connection, no digital trail, a dead zone where the clean laptop could exist without touching the architecture of Nathan Cross's surveilled life. He'd bring it to public libraries and unfamiliar cafés for internet access, rotating locations to prevent pattern detection.
The setup took four hours. By 5 PM, Nathan had two operational devices and a headache that throbbed behind his eyes with the specific persistence of stress manifesting as pain.
[+25 XP (counter-surveillance implementation). XP: 225/500.]
He locked the bolt hole. Rode the L train back to Queens. At the apartment, the compromised MacBook sat on the desk like a spy wearing a friend's face — familiar, functional, fundamentally dishonest.
Nathan opened it. Browsed his usual sites. Checked his professional email. Drafted a half-finished article about financial regulation reform that he had no intention of publishing but that would give the watchers something plausible to read.
Who are you? FBI, because Cooper flagged me after the press conference? Another agency, because my Reddington coverage touched classified nerves? Or something else — the same someone who sent the gray jacket in SoHo and the anonymous Swiss emails?
The answer mattered. FBI surveillance was manageable — federal agencies surveilling journalists was legally problematic and administratively cautious, which meant the operation would be limited in scope and vulnerable to exposure. Private or intelligence-community surveillance was different: fewer rules, more resources, higher stakes.
His phone buzzed. Meera.
"Tuesday. Same place. 2 PM."
Nathan looked at the message. Then at the compromised laptop. Then back at the message.
She's texting me on a phone that might also be compromised. If the people watching me are watching her too—
He typed back on the compromised phone: See you then.
Then he pulled out burner phone #2 — the sensitive-calls device he'd maintained since the security upgrades — and composed a text to a number Meera had given him at Bethesda Fountain. The number she'd called her "clean line."
Use your clean line for anything about our arrangement. My main phone may be compromised. Tell you more Tuesday.
The reply came in forty seconds, on the burner: Understood.
One word. The specific economy of a woman who'd been trained to treat communication as a vulnerability and brevity as a weapon. Nathan pocketed both phones. Fed the cat. Made dinner — pasta with jarred sauce, the specific bachelor meal of a man whose culinary ambitions ended at boiling water.
The watchers were watching. Nathan was watching back. And somewhere between the compromised MacBook and the clean ThinkPad, between the Queens apartment and the Bushwick bolt hole, between the journalist the world saw and the transmigrator the world couldn't, the game had added a new dimension.
Someone powerful enough to deploy federal-grade spyware on a freelance journalist's laptop thinks you're worth watching. That's terrifying. That's also — in a way you can't explain to anyone, ever — a compliment.
Want more? The story continues on Patreon!
If you can't wait for the weekly release, you can grab +10, +15, or +20 chapters ahead of time on my Patreon page. Your support helps me keep this System running!
Read ahead here: [ patreon.com/system_enjoyer ]