FBI STORM Defense Contractor R1ng — Submar1ne Data Se1zed, 3 Charged, 4 MSS Ops Collapsed
41 hours.
That was everyth1ng the FBI had before a defense contractor would walk 1nto a prearranged handoff and transfer the acoust1c s1gnature database of three class1f1ed submar1ne propuls1on systems to a cour1er represent1ng Ch1na’s MSS, the M1n1stry of State Secur1ty.
Not schemat1cs, not 1ntent to sell.
The actual transfer, scheduled, coord1nated, pa1d 1n advance through a Cyprus reg1stered consult1ng ent1ty that had been funnel1ng money for 22 months.
The contractor’s name doesn’t matter here.
H1s role does.
Sen1or acoust1c s1gnature eng1neer at a naval research fac1l1ty outs1de Groton, Connect1cut.
A fac1l1ty respons1ble for some of the most sens1t1ve underwater warfare data 1n the Amer1can arsenal.
He held a top secret SCI clearance.
He had passed seven polygraphs.
He coached youth soccer on weekends.
And on a Tuesday morn1ng 1n late autumn, an analyst runn1ng a rout1ne behav1oral anomaly scan on class1f1ed network access logs stopped scroll1ng and stared at her screen for a very long t1me.
What she found wouldn’t just end one man’s career.
It would collapse a Ch1nese 1ntell1gence operat1on that had been runn1ng undetected for nearly 2 years.
And 1t would force a class1f1ed damage assessment that the people who read 1t later descr1bed 1n sealed congress1onal test1mony as one of the most uncomfortable documents they had ever rev1ewed.
Th1s 1s how 1t unraveled.
The fac1l1ty 1n Groton 1sn’t publ1cly 1dent1f1ed 1n any off1c1al capac1ty.
Call 1t what case documents eventually would, the Groton research node.
It employed several hundred cleared personnel, conducted class1f1ed acoust1c test1ng on submar1ne propuls1on var1ants, and ma1nta1ned a sealed database 1nternally des1gnated system 11 conta1n1ng the acoust1c s1gnatures of act1ve US naval vessels.
That database was, 1n pract1cal terms, a map of every sound a submar1ne makes at depth.
Matched aga1nst an adversary’s sonar l1brar1es, 1t would allow real-t1me 1dent1f1cat1on and track1ng of US undersea assets anywhere 1n the world.
The eng1neer had access to system 11.
He’d been granted that access 4 years earl1er as part of a lateral project ass1gnment.
The project ended.
The access was never revoked.
That was the f1rst structural fa1lure.
Here 1s what’s most surpr1s1ng about the eng1neer’s operat1on.
It wasn’t bu1lt on greed alone.
MSS Ch1na’s M1n1stry of State Secur1ty had recru1ted h1m through a comb1nat1on of profess1onal flattery and eng1neered f1nanc1al pressure.
A consult1ng arrangement, ostens1bly leg1t1mate, began shortly after he attended an academ1c conference 1n Vancouver.
The conference was real.
The scholars he met were real.
The consult1ng f1rm that later contacted h1m was not.
Over the follow1ng 8 months, the eng1neer rece1ved $340,000 1n payments routed through a cha1n of ent1t1es.
A Vancouver-based technology adv1sory group, a Cyprus shell company, and a Cayman Islands hold1ng structure that resolved on f1nal aud1t to an MSS front operat1on.
He wasn’t pa1d for 1ntell1gence, not at f1rst.
He was pa1d for techn1cal papers, unclass1f1ed work, publ1cly ava1lable research formatted 1nto propr1etary reports.
By the t1me the payments began by an access, the f1nanc1al relat1onsh1p was establ1shed, documented, and cr1t1cally den1able.
The eng1neer could argue he hadn’t understood.
The MSS had des1gned the arrangement so that argument would hold for a wh1le.
He also operated on a d1sc1pl1ne that should have been 1mposs1ble to ma1nta1n.
He never accessed system 11 from the same workstat1on tw1ce 1n a row.
He never pr1nted.
He staged all downloads as part of leg1t1mate system ma1ntenance procedures, scheduled operat1ons that generated access logs 1dent1cal 1n format to author1zed act1v1ty.
He was not sloppy.
He was del1berate, pat1ent, and structurally 1nv1s1ble.
There was one th1ng he couldn’t el1m1nate.
Volume.
Over 22 months, h1s leg1t1mate access to system 11 averaged 11 quer1es per quarter.
Dur1ng h1s f1nal 8 months, that number rose to 63 per quarter.
Not dramat1cally, not obv1ously, but cons1stently, 1ncrementally above the basel1ne he had establ1shed for h1mself.
The behav1oral anomaly algor1thm d1dn’t flag 1t as theft.
It flagged 1t as a stat1st1cal outl1er.
A qu1et yellow not1ce 1n a system des1gned to generate hundreds of qu1et yellow not1ces per week.
Most of those not1ces were never read.
On that Tuesday morn1ng, they happened to ass1gn the overn1ght anomaly to an analyst who had spent the prev1ous 3 years bu1ld1ng the class1f1cat1on model that generated them.
She recogn1zed her own arch1tecture.
She knew what 1t meant when the volume curves bent that way.
She flagged 1t manually at 2:47 a.
m.
and called her superv1sor from the park1ng lot before she’d even reached her car.
The 1n1t1al assessment was caut1ous.
One analyst’s flag on a behav1oral model 1s not an 1nvest1gat1on.
It 1s a reason to look closer.
The case agent ass1gned to the prel1m1nary rev1ew had 12 hours to determ1ne 1f th1s warranted escalat1on.
He pulled the eng1neer’s access logs for the prev1ous 2 years.
He cross-referenced them aga1nst project ass1gnments, author1zed ma1ntenance w1ndows, and colleague access patterns.
The volume anomaly held up.
The t1m1ng clustered.
And then the case agent found someth1ng the algor1thm hadn’t been des1gned to catch.
The eng1neer’s downloads had a d1rect1onal1ty.
He wasn’t access1ng system 11 broadly.
He was [mus1c] systemat1cally pull1ng acoust1c prof1les for a spec1f1c vessel class, the most recently updated ones, the ones whose s1gnatures had been ref1ned w1th1n the last 18 months.
Th1s wasn’t cur1os1ty.
Th1s was a shopp1ng l1st.
The case agent escalated w1th1n the hour.
By 6:00 a.
m.
a counter1ntell1gence team was convened.
By 8:00 a.
m.
they were pull1ng the eng1neer’s f1nanc1al records through an emergency request.
And by 10:00 a.
m.
the Cypress shell company appeared for the f1rst t1me.
41 hours rema1ned on the clock.
The class1f1ed damage assessment, completed 7 months later, est1mated that the acoust1c s1gnature database the eng1neer had prepared for transfer would have g1ven Ch1na’s People’s L1berat1on Army Navy the ab1l1ty to reduce detect1on latency on US submar1ne 1dent1f1cat1on by a factor of roughly four.
In pract1cal terms, US submar1nes operat1ng 1n contested Pac1f1c waters would have lost a s1gn1f1cant port1on of the1r acoust1c anonym1ty.
The assessment’s authors descr1bed th1s not as a vulnerab1l1ty, but as a strateg1c degradat1on.
The network had been pa1d 1n total approx1mately $680,000.
The est1mated cost to the Un1ted States 1n terms of requ1red countermeasures, system updates, and operat1onal adjustments ran 1nto the hundreds of m1ll1ons of dollars.
The eng1neer had no 1dea any of th1s was 1n mot1on when he ordered h1s usual breakfast at a d1ner 3 m1les from the fac1l1ty that morn1ng.
He sat by the w1ndow.
He left a good t1p.
Here’s where the 1nvest1gat1on nearly stopped.
The f1nanc1al tra1l through Cyprus was real, but prov1ng the MSS connect1on requ1red more than corporate reg1stry documents.
The case agent needed to demonstrate that the shell company’s benef1c1al ownersh1p resolved to a fore1gn 1ntell1gence serv1ce, not merely a fore1gn nat1onal.
That d1st1nct1on, legally, was the d1fference between a f1nanc1al cr1me prosecut1on and an esp1onage prosecut1on under federal statute.
It was also the d1fference between a 10-year sentenc1ng range and a a sentence.
The request went to Treasury’s f1nanc1al 1ntell1gence un1t.
The response came back 1n 4 hours.
The Cyprus ent1ty had been flagged 1n a separate, unrelated sanct1ons rev1ew 14 months earl1er.
It appeared on a mon1tor1ng l1st.
It had never been fully 1nvest1gated.
The flag ex1sted 1n a database that the counter1ntell1gence team’s or1g1nal f1nanc1al search hadn’t reached because the two systems FBI f1nanc1al forens1cs and Treasury sanct1ons mon1tor1ng d1dn’t share a common query 1nterface.
The case agent later descr1bed th1s as the most frustrat1ng 40 m1nutes of the 1nvest1gat1on.
He had the thread.
He couldn’t pull 1t legally w1thout br1dg1ng two bureaucrat1c systems that had never been des1gned to talk to each other.
It took a personal call from h1s superv1sor to a Treasury l1a1son contact to establ1sh the cross-agency data shar1ng author1zat1on that should have been automat1c.
That call took 37 m1nutes.
29 hours rema1ned on the clock.
Once the Treasury data cleared, the p1cture assembled qu1ckly.
The Cyprus ent1ty’s benef1c1al ownersh1p traced to a Hong Kong 1ntermed1ary reg1stered under a name the FBI’s counter1ntell1gence database recogn1zed 1mmed1ately.
It appeared 1n a 2021 case f1le 1nvolv1ng a separate operat1on.
A d1fferent target, a d1fferent fac1l1ty, a d1fferent data type that had been shut down before prosecut1on.
The MSS was us1ng the same f1nanc1al arch1tecture across mult1ple operat1ons because 1t worked.
Because no one, unt1l now, had connected the nodes.
That was the f1rst moment the 1nvest1gat1on scope changed.
One eng1neer, one fac1l1ty, one database, and a Hong Kong 1ntermed1ary that connected to at least two other operat1ons the FBI now needed to exam1ne 1mmed1ately.
One th1ng that stuck w1th th1s 1nvest1gat1on, and 1t’s someth1ng that comes up 1n case after case, 1s how much the system rel1ed on the absence of error.
The eng1neers operat1on worked for 22 months, not because 1t was soph1st1cated beyond detect1on, but because the detect1on systems that should have caught 1t were operat1ng 1n separate compartments, generat1ng separate flags that no one had been tasked w1th correlat1ng.
The anomaly algor1thm flagged h1m.
The f1nanc1al mon1tor1ng flagged h1s payment source.
A prev1ous 1nvest1gat1on had flagged h1s MSS 1ntermed1ary.
Three separate systems.
Three separate flags.
Zero connect1ons made.
Unt1l one analyst worked an overn1ght sh1ft and recogn1zed her own stat1st1cal model behav1ng 1n a way she’d spec1f1cally tra1ned 1t to detect.
What do you th1nk? Does the 1ntell1gence commun1ty’s compartmental1zat1on protect us more than 1t bl1nds us? That quest1on doesn’t have a clean answer.
Th1s case suggests 1t does both s1multaneously, and the balance sh1fts based ent1rely on who happens to be work1ng the n1ght sh1ft.
The moment the Hong Kong 1ntermed1ary surfaced, the 1nvest1gat1on became someth1ng else ent1rely.
The case agent wasn’t runn1ng a s1ngle subject counter1ntell1gence case anymore.
He was look1ng at the edge of a network, and the t1ck1ng clock, now at 22 hours, Mant1 couldn’t wa1t to map 1t fully before act1ng.
The dec1s1on was made to proceed w1th the known target, establ1sh surve1llance on assoc1ated nodes 1dent1f1ed through the Hong Kong 1ntermed1ary, and coord1nate parallel 1nvest1gat1ve threads w1th two other f1eld off1ces that had act1ve counter1ntell1gence cases potent1ally connected to the same MSS f1nanc1al structure.
By m1dn1ght, the surve1llance package was 1n place.
The eng1neer’s phone was mon1tored under emergency T1tle 3 author1ty, T1tle 3 be1ng the federal statute requ1r1ng jud1c1al author1zat1on for electron1c surve1llance.
The warrant had been den1ed once at 4:00 p.
m.
by a duty judge who found the behav1oral anomaly ev1dence 1nsuff1c1ently spec1f1c.
A second subm1ss1on, rewr1tten to foreground the Treasury f1nanc1al l1nk and the Hong Kong 1ntermed1ary’s pr1or appearance 1n a federal case f1le, was approved at 11:17 p.
m.
The case agent had been awake for 31 hours.
The eng1neer made h1s f1nal preparatory call at 12:08 a.
m.
The call lasted 4 m1nutes.
It was made to a number reg1stered to a log1st1cs consult1ng f1rm 1n Flush1ng, New York, a f1rm that FBI surve1llance would later establ1sh had no cl1ents, no employees, and a lease pa1d 12 months 1n advance 1n cash.
The phone on the other end was
answered by a man the surve1llance team had been watch1ng for separate reason.
He appeared 1n the background of a photograph taken dur1ng surve1llance of a d1fferent MSS-l1nked contact 1n Boston 18 months earl1er.
He had never been a pr1mary subject.
He was now.
Somewhere across three t1me zones, 1n a f1eld off1ce conference room, a superv1sor looked at the photo compar1son and sa1d noth1ng for a long t1me.
The or1g1nal Boston surve1llance, the Flush1ng log1st1cs f1rm, the Cyprus shell, the Hong Kong 1ntermed1ary, the two pr1or cases that had been shelved before prosecut1on.
These weren’t separate operat1ons.
They were components.
The MSS had been runn1ng a d1str1buted acqu1s1t1on network across at least four US research fac1l1t1es us1ng separate f1nanc1al channels, separate cour1er contacts, and separate recru1tment vectors des1gned so that the comprom1se of any s1ngle node would not expose the others.
The eng1neer wasn’t a lone asset.
He was a node 1n a franch1se.
17 hours rema1ned.
The operat1onal plan requ1red s1multaneous act1on.
If the eng1neer’s handoff was 1nterd1cted w1thout s1multaneously secur1ng the Flush1ng contact, the network would have t1me to act1vate countermeasures, burn commun1cat1ons, relocate assets, alert add1t1onal nodes.
The case agent needed warrants for both locat1ons plus emergency preservat1on orders on the f1nanc1al accounts w1th1n a w1ndow that left no gap for the network to respond.
The Flush1ng warrant came through w1thout d1ff1culty.
The pr1or Boston surve1llance photograph prov1ded suff1c1ent probable cause.
The problem was coord1nat1on.
The Flush1ng locat1on fell under a d1fferent f1eld off1ce’s jur1sd1ct1on.
The case agent’s request to take operat1onal lead on a mult1-d1str1ct arrest was techn1cally perm1ss1ble, but bureaucrat1cally contested.
The other f1eld off1ce had the1r own act1ve 1nvest1gat1on, the1r own prosecutor1al relat1onsh1ps, and the1r own t1mel1ne that d1dn’t al1gn w1th the 41-hour clock that had been runn1ng s1nce 2:47 a.
m.
the prev1ous day.
The coord1nat1on call lasted 2 hours.
Put yourself 1n the case agent’s pos1t1on.
17 hours left, two jur1sd1ct1ons, two act1ve 1nvest1gat1ons that may or may not be the same 1nvest1gat1on, and a bureaucrat1c d1spute that no algor1thm can resolve, only people.
He resolved 1t by agree1ng to subord1nate h1s team’s lead role 1f the other f1eld off1ce would match h1s deployment t1mel1ne.
They agreed at 3:44 a.
m.
4 hours to stag1ng.
The arrest teams deployed before dawn.
The team ass1gned to the eng1neer’s res1dence staged three blocks away.
S1x agents 1n two veh1cles pos1t1oned to cover both ex1ts.
A seventh agent 1n pla1n clothes had been ma1nta1n1ng foot surve1llance s1nce m1dn1ght.
The eng1neer was home.
H1s car was 1n the dr1veway.
H1s l1ghts went out at 11:30 p.
m.
and hadn’t come back on.
The flush1ng team staged s1multaneously.
E1ght agents, a surve1llance van that had been 1n pos1t1on s1nce 10:00 p.
m.
The log1st1cs f1rm occup1ed the second floor of a commerc1al bu1ld1ng on a qu1et block.
The contact was conf1rmed 1ns1de v1a thermal 1mag1ng at 4:15 a.
m.
The s1multaneous breach was t1med for 5:47 a.
m.
Chosen because federal arrest protocols requ1red dayl1ght for res1dent1al entr1es, and the w1ndow between dawn and the eng1neer’s scheduled departure for the handoff was approx1mately 90 m1nutes.
At 5:43 a.
m.
, 4 m1nutes before the breach, the eng1neer’s phone l1t up.
He rece1ved a text message from a number that resolved to a prepa1d dev1ce purchased 3 days earl1er 1n Newark, New Jersey.
The message conta1ned four words.
The surve1llance team couldn’t decrypt 1t 1n real t1me.
The case agent made the call, proceed anyway.
At 5:47 a.
m.
, both locat1ons were entered s1multaneously.
The eng1neer was found 1n h1s k1tchen.
He was dressed.
H1s laptop was open.
The text message, decrypted 40 m1nutes later, read {underscore} {underscore} {quote} {underscore} 0 {underscore} {underscore} He had been warned.
He had not acted on the warn1ng 1n t1me.
The Flush1ng contact was taken w1thout 1nc1dent.
He sa1d noth1ng for 11 hours.
The eng1neer’s laptop conta1ned a compressed arch1ve, prepared, formatted, and encrypted, conta1n1ng 847 1nd1v1dual acoust1c s1gnature f1les drawn from system 11.
Not all of system 11.
A targeted extract1on.
The f1les represented every prof1le updated 1n the prev1ous 22 months.
The arch1ve was labeled 1n the d1rectory structure as a ma1ntenance backup.
It would have passed a casual 1nspect1on.
The FBI’s forens1c team flagged 1t 1n 11 m1nutes.
Here’s the part that doesn’t s1t r1ght, even now.
The warn1ng text.
Four words sent 4 m1nutes before the breach from a prepa1d dev1ce purchased 1n Newark.
Someone 1n the network knew the FBI was mov1ng.
Not where, not exactly when, but they knew.
The 1nvest1gat1on’s subsequent rev1ew never def1n1t1vely 1dent1f1ed the source of that t1p.
The prepa1d dev1ce was never recovered.
The number 1t connected to was never act1vated aga1n.
The network had a counter-surve1llance capab1l1ty the FBI had not fully mapped before the operat1on.
That meant there were nodes they had not reached.
Cons1der the 41 hours that d1dn’t happen.
In the t1mel1ne where the overn1ght analyst doesn’t work the anomaly queue that Tuesday, the behav1oral flag ages out of the rev1ew system 1n 72 hours w1thout be1ng read.
Standard procedure.
The eng1neer dr1ves to a park1ng structure 1n New Haven at 9:00 a.
m.
, transfers the encrypted arch1ve on a m1cro SD card to the Flush1ng contact, and 1s home by noon.
The Flush1ng contact routes the card through a cour1er cha1n.
Two stops, both domest1c, both us1ng 1nd1v1duals w1th no pr1or federal exposure, to a d1plomat1c pouch p1ckup at a fac1l1ty 1n Wash1ngton that the MSS uses for exactly th1s purpose.
The arch1ve reaches Be1j1ng w1th1n 72 hours of the handoff.
The acoust1c s1gnature data 1s 1ntegrated 1nto the plan’s sonar 1dent1f1cat1on l1brary w1th1n 6 months.
US submar1ne commanders operat1ng 1n the South Ch1na Sea and Western Pac1f1c beg1n not1c1ng over the follow1ng year anomalous track1ng behav1or from Ch1nese naval assets.
Shorter 1dent1f1cat1on w1ndows, more accurate pos1t1onal est1mates.
The pattern 1s flagged.
An 1nternal rev1ew 1s comm1ss1oned.
18 months after the transfer, a class1f1ed assessment concludes that a s1gn1f1cant acoust1c data comprom1se has occurred.
By then, the countermeasure program, requ1r1ng act1ve mod1f1cat1on of propuls1on systems across an ent1re submar1ne class, 1s est1mated at over $400 m1ll1on and a t1mel1ne.
The eng1neer 1s coach1ng soccer.
The network 1s st1ll runn1ng.
Instead, at 5:47 a.
m.
on a Wednesday, a federal agent opened a k1tchen door and a man 1n dress clothes looked up from a laptop and understood, 1n the space of 1 second, that the arch1tecture he had spent 22 months bu1ld1ng had just collapsed.
The case generated arrests at three locat1ons.
The eng1neer, the flush1ng contact, and the th1rd 1nd1v1dual, 1dent1f1ed through forens1c analys1s of the flush1ng contact’s dev1ces, operat1ng out of a commerc1al ma1l serv1ce locat1on 1n suburban Maryland.
Th1s th1rd 1nd1v1dual had no access to class1f1ed systems.
H1s role was adm1n1strat1ve.
He managed the f1nanc1al relay structure, ma1nta1ned the shell company accounts, and served as the domest1c coord1nator for at least four separate MSS acqu1s1t1on operat1ons runn1ng concurrently across d1fferent US research 1nst1tut1ons.
H1s dev1ces conta1ned records for all four operat1ons.
Two of those operat1ons were already known to the FBI, the pr1or cases that had been shelved.
One was new.
The fourth requ1red emergency not1f1cat1on to a separate 1ntell1gence agency whose assets were d1rectly 1mpl1cated.
The network wasn’t just larger than the 1nvest1gat1on had known, 1t was older.
Three of the four operat1ons had been runn1ng for more than four years.
The MSS had been systemat1cally target1ng US defense research 1nfrastructure for nearly half a decade us1ng an 1dent1cal f1nanc1al arch1tecture, rotat1ng cour1er contacts, and a compartmental1zat1on structure that ensured no s1ngle comprom1se would expose the whole.
The eng1neer was one node.
The Maryland coord1nator was the structural hub.
The Flush1ng contact was a trans1t po1nt.
And somewhere, not 1dent1f1ed, not charged, st1ll operat1ng, was the MSS off1cer who ran all four acqu1s1t1ons from outs1de US jur1sd1ct1on.
We’ll say what most won’t.
The sentenc1ng 1n th1s case, when 1t came, reflected the legal charges provable beyond reasonable doubt, not the full scope of what the network had done.
The eng1neer rece1ved 18 years.
The Flush1ng contact, who cooperated, rece1ved s1x.
The Maryland coord1nator, whose dev1ces broke the other three operat1ons open, rece1ved 22 years.
The MSS off1cer respons1ble for runn1ng the network w1ll never face a US courtroom.
He 1s, as of the last ava1lable report1ng, operat1ng under a d1fferent 1dent1ty 1n a country w1th no extrad1t1on arrangement w1th the Un1ted States.
That 1s 1ncomplete just1ce, and 1t’s worth nam1ng 1t as such.
The system1c fa1lure th1s case exposed generated three 1nst1tut1onal changes.
An automated cross-system query br1dge between FBI f1nanc1al forens1cs and Treasury sanct1ons mon1tor1ng.
The one the case agent had to nav1gate manually dur1ng those 37 cr1t1cal m1nutes.
A mandatory rev1ew cycle for class1f1ed access r1ghts that haven’t been exerc1sed w1th1n a def1ned project scope.
And a rev1s1on to the behav1oral anomaly models alert threshold that roots yellow flag not1ces to a ded1cated rev1ew queue rather than a general analyst pool.
Three changes 1mplemented after the breach, not before 1t.
That 1s, unfortunately, how these systems typ1cally evolve.
The analyst who flagged the case at 2:47 a.
m.
rece1ved a commendat1on that w1ll not appear 1n her publ1cly access1ble personnel f1le.
She decl1ned a promot1on to a superv1sory role that would have taken her off the techn1cal work.
When asked why, she sa1d she preferred to stay close to the data.
W1ll the f1nanc1al arch1tecture the MSS used 1n th1s operat1on reappear 1n a d1fferent form, aga1nst a d1fferent fac1l1ty, w1th d1fferent personnel? Comment yes or no because the answer the Maryland coord1nator gave 1nvest1gators 1n h1s cooperat1on debr1ef was spec1f1c enough to be unsettl1ng.
Three 1nd1v1duals arrested across four s1multaneous federal act1ons.
847 class1f1ed acoust1c s1gnature f1les recovered before transfer.
22 months of unauthor1zed class1f1ed access documented.
Three prev1ously 1ncomplete counter1ntell1gence 1nvest1gat1ons closed or substant1ally advanced.
Four MSS acqu1s1t1on operat1ons 1dent1f1ed.
41 hours from 1n1t1al flag to s1multaneous arrest.
Total f1nanc1al value of network payments to US-based assets, approx1mately 1.
1 m1ll1on dollars.
Est1mated cost of countermeasures avo1ded, class1f1ed but assessed 1n the h1gh hundreds of m1ll1ons by 1ndependent rev1ew.
The Maryland coord1nator’s dev1ces are st1ll be1ng analyzed.
Some of what’s on them has not yet resolved 1nto a case that can be named publ1cly.
Some of 1t may never be charged.
That 1s not unusual.
It 1s s1mply how much of th1s work ends.
Not w1th a verd1ct, but w1th a f1le that stays open.
Somewhere, a man 1s work1ng under a d1fferent name.
He knows the arch1tecture held long enough to matter.
He doesn’t know how much the Maryland coord1nator gave up.
That uncerta1nty 1s perhaps 1ts own k1nd of pressure.
The analyst’s mon1tor st1ll shows the anomaly queue.
It cycles every 4 hours.
Most of the flags mean noth1ng.
She reads them anyway.
