Roy came in at four in the morning because the couch at home was no better than the one in the break room and at least the office had coffee.
The squad room was dark except for the area where they were working on the banks, where a night-duty agent named Pruett was asleep in his chair. Roy made the coffee and sat down at Odom’s desk, which faced his, because his own had a stack of bank referrals on it he didn’t want to look at yet.
He had a memo in his bottom drawer from a week ago Friday. He’d written it after the thing in Greeley, two pages, and sent it up, and nobody had read it. He got it out and reread it. It said the signature problem on the wires wasn’t going to stay on the wires. He’d been right and it had done him, and no one else, any good.
At twenty past four a field report out of Cleveland was emailed to the infrastructure group and cc: to three hundred people because the agent who wrote it didn’t know where to send it. A hospital IT director had called the Cleveland office at one in the morning local to report that forty of their infusion pumps had “installed an unauthorized firmware update” and he didn’t know how, because the devices had been refusing updates for two weeks. He wanted to know if it was foreign.
Roy knew what it was. He didn’t want to know what it was, and he knew. And he was pissed that no one had listened to him. And no one was still listening to him.
The kid with the beard had sat across a table from him on Monday and said it in words Roy could repeat. Somebody can make the new key. Then they can sign anything with it, and everything that checks will say it is real. Roy had written 77,000/hr in his notebook and not understood then, but he now got it. Somebody had made a key the pumps believed, and signed something, and the pumps had believed it.
“Fuck,” he said, to the dark room.
He got out his notebook and wrote the date and Cleveland — pumps — installed update that shouldn’t exist and under it same as the wires. worse. nobody bounces a pump and a pump can kill a person.
He picked up the phone and called the Cleveland office and got a duty agent. He asked to talk to the agent who had written the report, but the agent wasn’t in the office anymore. He asked whether anybody had told the hospital to take the devices off the network. The duty agent said he’d find out. Roy knew what that meant and hung up in disgust.
Odom came in at five with a grocery bag of her kids’ snacks because the vending machine had been empty for a week.
“You slept here,” she said.
“I came in at four.”
“That’s worse.” She looked at his screen. “What’s Cleveland.”
“Pumps. Hospital pumps took an update last night that wasn’t real.” He turned the screen so she could see it. “It’s the thing the kid told me about. They forged the key for a medical company and signed something and pushed it, and the pumps believed it because it was signed right.”
“Can they turn it off?”
“No. It’s in the pump. The pump thinks it’s the real one.”
“So what do they do.”
“Unplug them. Take them off whatever they’re plugged into and do the job by hand until somebody drives out with the real thing.” He heard himself and stopped. “Shit, they can’t unplug a pump. There’s often a person in a hospital bed on the other end of it.”
Odom put the snacks down and sat.
“So?” she said. It wasn’t a question.
“I’m going to call people,” Roy said.
He called the number Eleanor Voss had given him on Tuesday. He got a young man who said Dr. Voss was in a closed session and had been since before three her time. Roy said it was about hospitals and was urgent. The young man’s voice changed as he apologized and he said he would get her a note. Roy said tell her the medical ones are waking up, she’ll know what it means. The young man said he would and Roy believed him more than he’d believed the Cleveland duty agent.
He called the Pittsburgh field office because the third report, at five-forty, was from there.
The Pittsburgh ASAC was a woman named Diane Karr who was already awake. A regional hospital had called in. She had the same question everyone had, which was whether it was an attack, and Roy told her it was, and that it wasn’t aimed, which was worse, and that the only thing that helped was getting the devices off patients.
“I can’t order a hospital to do anything,” Karr said.
“I know. CISA’s got an advisory. There’s a woman named Pell. Push it to the hospital’s people and tell them the pumps are lying. Not down. Lying. Reading the right number and giving the wrong one.” He was repeating a sentence he didn’t remember being told and must have been. “Tell them to count the bag by hand.”
“You sound like you’ve seen this.”
“I haven’t seen anything,” Roy said. “I just know the guy who knows.”
The report from Pittsburgh updated while he was on the phone with her. He read it off his screen as it changed. A patient on a cardiac floor. A heparin drip. The pump had run all night showing the right rate. He stopped reading it out loud to Karr halfway through.
“Agent Pittman?”
“I’m here.”
“Is that your case?”
Roy looked at the line on the screen. It was a line in a field report, with a time on it and a hospital he would never see. It was really about a person, now in cardiac arrest, because the pump had lied. There was nothing he could do about the person from here.
“Not yet,” he said.
He wrote Pittsburgh — 4W — pt on heparin — pump ran all night in the notebook and put a time next to it.
At six-fifteen his cell rang and it was a 970 number and he almost didn’t answer it. It was the CEO of the credit union in Greeley. The checks had cleared, all four hundred of them, and the wires were moving again this morning, and she had wanted him to know, and to say thank you, because he’d taken her calls when nobody else would.
“That’s good,” Roy said. “That’s real good. You did a good job.”
He meant it. It was the old problem, the one you fixed by signing four hundred checks by hand. The problem that didn’t kill people. He told her to go home and sleep and she laughed and said she might.
Meyer came in at seven and stopped at Odom’s desk, where Roy was.
“Why are you at her desk.”
“Mine’s covered in referrals.”
“You’re on the banks.”
“The banks are fine this morning,” Roy said. “Greeley cleared. It’s the hospitals now.”
“Hospitals aren’t ours.”
“The forged firmware is. It’s the same thing that did the wires. Same key problem the walk-in came in about Monday.” Roy turned in the chair. “I’ve got Cleveland, Pittsburgh, and two more since six. Pumps and monitors. There’s a woman at CISA who needs everything we’re getting, routed to her, this morning, not up the chain.”
Meyer looked at the screen for a second.
“Write it up,” Meyer said. “Send it to me. I’ll move it.”
“I wrote one up Friday. Nobody read it.”
“Then write it again,” Meyer said, and went to his office.
Roy opened the drawer and looked at the two-page memo from a week ago and didn’t take it out. He got a fresh sheet instead, because the old one had been about wires and this one was about pumps, and he started again at the top, in blue, because that was the pen in his hand. He wrote it the way the kid had said it to him, so he could say it to somebody who could stop it.
The reports kept coming across while he wrote. He didn’t count them. He’d learned in the last two weeks that counting them did nothing.