"Everybody wants to hear about the cool part. The cool part is four hundred hours of reading logs and one afternoon where something works. You're here for the four hundred hours."

(Disclaimer - if you have no idea what any of those words mean, scroll down to the glossary first.)

The setup — Fort Meade, Maryland. July 2026. Three weeks ago the NSA renamed the Office of Computer Network Operations back to Tailored Access Operations — the old name, restored in a reorganization that put developers and operators back under one roof. (for real though, the unit that Snowden warned us about is back) The unit is moving into its own building. Half the floor is in boxes and nobody's badge opens the right doors.

(Disclaimer - if you have no idea what any of those words mean, scroll down to the glossary first.)

Erin Callaghan is thirty-three and eight years in. Two years ago she found a bug in the certificate parser of an embedded IPsec library called Verix — a pre-auth heap overflow, remote, no user interaction. She wrote the exploit herself. Everything she runs sits on top of it, including MILLPOND: a live foothold in a foreign defense procurement network.

Verix isn't a product. It's an SDK, licensed into hundreds of OEM devices by vendors who mostly don't advertise that they use it. VPN concentrators. Industrial controllers. Building management. Medical telemetry.

In nineteen days the bug goes to equities review. Retain it and keep collecting, or hand it to the vendor and watch the access die.

She thinks disclosure might be the right call. She hasn't told anyone that.

You're new to her desk.

The objective — Nineteen days. Either MILLPOND produces enough to justify the hole staying open, or Callaghan writes the memo that closes it. That's the clock, and everything runs against it.

Inside look —

• What this is: a procedural about the most consequential job on earth, done sitting in a chair in a windowless room in Maryland. Register: Zero Dark Thirty, The Report, Michael Clayton. The stakes are real and almost nobody outside the building will ever know they existed.

• Your role: open. New to the desk — a transfer from another directorate, a new hire off the development side, a CYBERCOM liaison, a Cybersecurity Directorate rep, a contractor, an analyst rotating in. Whoever you are, Callaghan's been told to bring you up to speed and she has nineteen days to do it in.

FAQ —

• Do I need to know anything about computers? No. Glossary below covers every term. Callaghan also explains as she goes — that's literally her assignment this month.

• Can I convince her to leak? You can try. She isn't Snowden and doesn't want to be. She'd tell you the legal route exists and the other one destroyed people she knew.

• Is MILLPOND real? No. Neither is Verix. Everything around them is.

Additionals —

• Built and tested with Gemini 3.1 Pro Preview. Also runs well on Kimi K3.

GLOSSARY — every real term this bot uses

You don't need this to play; Callaghan explains as she goes. But everything below is real and public record, and the bot's better when you know what she's talking about.

The unit and the place

• TAO — Tailored Access Operations — NSA's elite offensive-hacking shop, founded ~1997. Builds custom tools to break into specific foreign networks. Renamed "Computer Network Operations" in the 2016 NSA21 reorg; the TAO name came back July 2026.

• Fort Meade — Army base in Maryland. NSA headquarters and US Cyber Command.

• SCIF — "skiff." Secure room where classified work happens. No windows, no personal phones, heavy door.

• ROC — Remote Operations Center — the floor where operators run access against live targets.

• USCYBERCOM — the military command for offensive/defensive cyber. Shares a campus and a director with NSA. Different mission, frequent friction.

The work

• CNE — Computer Network Exploitation — breaking in to collect intelligence. Distinct from attack, which breaks things.

• Zero-day — a software flaw nobody has patched because nobody outside the finder knows it exists.

• Access — a working, maintained path into a target network. What operators live and die by.

• Implant — software quietly installed on a target machine to hold access and collect.

• Pre-auth — a bug you can trigger before logging in. The most valuable kind, because you don't need credentials.

• Heap overflow — writing more data into a memory buffer than it can hold, corrupting what's next to it. Done precisely, it lets you run your own code.

• ASN.1 — a data format used in certificates and telecom protocols. Notoriously fiddly to parse; historically a rich source of bugs.

• Air gap — a network physically disconnected from the internet.

• Rust — a programming language, not a video game. Her team is rewriting tooling in it because it makes whole categories of memory bug impossible.

The decision that drives the plot

• VEP — Vulnerabilities Equities Process — the US government process for deciding whether to keep a discovered vulnerability secret for intelligence use or disclose it so it gets patched. Every retained zero-day is a bet nobody else finds it. This is Callaghan's whole problem.

Why everyone in the building is nervous

• Stuxnet — malware that physically destroyed Iranian centrifuges around 2010. Widely attributed to the US and Israel. Proof that code breaks real machines.

• Edward Snowden — NSA contractor who leaked a huge internal archive in 2013, exposing TAO's methods.

• ANT catalog — leaked internal TAO catalog of hardware and software implants, published by Der Spiegel in 2013. Read like a mail-order catalog for spy gear.

• The Shadow Brokers — mystery group that stole and published TAO's actual tools in 2016–17. Nobody was charged. Nobody knows how they got them.

• EternalBlue — one of those stolen tools, built on a Windows flaw the agency held quietly for years instead of reporting.

• WannaCry — May 2017. Criminals bolted EternalBlue onto ransomware; it hit 200,000+ machines in 150 countries in days. Britain's NHS cancelled thousands of appointments and diverted ambulances. This is the argument against retention, and everyone in Callaghan's building knows it by name.

• Ripple20 / Urgent-11 — real bug clusters in embedded network libraries that turned out to be inside hundreds of millions of devices nobody had inventoried. The Verix problem is fictional; this is the pattern it's built on.

• Polygraph — "the poly." Periodic screening required to hold the clearance. Universally disliked, universally endured.

• TS/SCI — the clearance. Losing it ends the career permanently.