Cory Doctorow’s Attack Surface is a standalone novel set in the world of New York Times bestsellers Little Brother and Homeland.

Most days, Masha Maximow was sure she’d chosen the winning side.

In her day job as a counterterrorism wizard for an transnational cybersecurity firm, she made the hacks that allowed repressive regimes to spy on dissidents, and manipulate their every move. The perks were fantastic, and the pay was obscene.

Just for fun, and to piss off her masters, Masha sometimes used her mad skills to help those same troublemakers evade detection, if their cause was just. It was a dangerous game and a hell of a rush. But seriously self-destructive. And unsustainable.

When her targets were strangers in faraway police states, it was easy to compartmentalize, to ignore the collateral damage of murder, rape, and torture. But when it hits close to home, and the hacks and exploits she’s devised are directed at her friends and family–including boy wonder Marcus Yallow, her old crush and archrival, and his entourage of naïve idealists–Masha realizes she has to choose.

And whatever choice she makes, someone is going to get hurt.

Please enjoy this free excerpt of Attack Surface by Cory Doctorow, out now in paperback!

---

CHAPTER 1

That was why I loved technology: if you use it right, it gives you power—and takes away other peoples’ privacy. I was on my sixteenth straight hour at the main telcoms data-center for Bltz, the capital of Slovstakia. Those are both aliases, obviously. Unlike certain persons I could name, I keep my secrets.

Sixteen hours, for what my boss had assured the client—the Slovstakian Interior Ministry—would be a three-hour job. You don’t get as high as she did in the Stasi without knowing how to be a tactical asshole when the situation demands it.

I just wish she’d let me recon the data-center before she handed down the work estimate. The thing is, the communications infrastructure of Slovstakia was built long before the Berlin Wall fell, and it consisted of copper wires wrapped in newspaper and dipped in gutta-percha. After the Wall came down, responsibility for the telcoms had been transferred to the loving hands of Anton Tkachi, who had once been a top spook in Soviet Slovstakia. There are a lot of decades in which it would suck to have your telcoms run by an incompetent, greedy kleptocrat, but the 1990s represented a particularly poorly chosen decade to have sat out the normal cycle of telcoms upgrades. Because internet.

After Tkachi was purged—imprisoned 2005, hospitalized with “mental illness” in 2006, dead in 2007—the Slovstakian Ministry of Communications cycled through a succession of contract operators—Swisscom, T-Mob, Vodaphone, Orange (God help us all)—each of which billed the country for some of the jankiest telcoms gear you’ve ever seen, the thrice-brewed teabags of the telecommunications world, stuff that had been in war zones, leaving each layer of gear half-configured, half-secured, and half-documented.

The internet in Slovstakia sucked monkey shit.

Anyway, my boss, Ilsa, She-Wolf of the SS, promised the Interior Ministry that I would only need three hours, and the Interior Ministry had called up the telcoms ministry and given them orders to be nice to the Americanski lady who was coming over to do top-secret work for them, and give her everything she needed. I can tell that they laid it on thick, because when I first arrived at the country’s main data-center, a big old brutalist pile that I had to stop and take a picture of for my collection of Soviet Brutalist Buildings That They Used to Shoot You for Taking Pictures Of—hashtags are for losers who voluntarily submit to 280-character straitjackets (and sentences can too a preposition end with)—the guy on the desk sent me straight to the director of telcoms security.

His name was Litvinchuk and he was tightly wound. You could tell because he had his own force of telcoms cops dressed like RoboCop standing guard outside his door with guns longer than their legs, reeking of garlic sausage and the sweat of a thousand layers of Kevlar. Litvinchuk welcomed me cordially, gave me a long-ass speech about how excited he was to have some fresh foreign contractors in his data-center (again) and especially ones from a company as expensive as Xoth Intelligence.

“Wait, that’s not right word,” he said, in a broad Yakov Smirnoff accent (he had a master’s from the London School of Economics and I’d watched him do a TEDx talk where he sounded like a BBC World Service newsreader). “Exclusive? Illustrious?” He looked to me—specifically, to my tits, which was where every Slovstakian official I’d met addressed his remarks. I didn’t cross my arms.

“Infamous,” I said.

He smirked. “I’m sure. Miss Maximow”—he pronounced the w as a v, as they always did as soon as I got east of France—“we are all very excited to have you at our premises. However, I’m sure you understand that we must be careful to keep records of which contractors work on our sensitive systems.” He slid a paperclipped form across his desk to me. I counted to seven—more efficient and just as effective as ten—and picked it up. Nine pages, smudgily photocopied, full of questions like “List all NGOs and charitable organizations to which you have contributed, directly or indirectly.”

“No,” I said.

He gave me his best fish-face, which I’m sure was super-effective against the farm boys cosplaying Judge Dredd in the hallway. But I’d been glared at by Ilsa, She-Wolf of the etc., etc., and had been inured to even the hairiest of eyeballs.

“I must insist,” he said.

“I don’t fill in this kind of form,” I said. “Company policy. Xoth has negotiated blanket permission to access your premises from the Interior Ministry for all its personnel.” This was true. I hated paperwork, and this kind of paperwork the most—the kind that asked you questions you could never fully or honestly answer, so that there’d always be an official crime to pin on you if you stepped on the wrong toes. Lucky for me, Xoth had a no-exceptions policy that techs were not allowed to fill in any official documentation at client sites. I’d take notes on my own work, but they’d go up the chain to my boss—Ilsa, She-Wolf etc.—who’d sanitize them and pass them back to the Interior Ministry for their own logs, omitting key details so that we would be able to bill them for any future maintenance.

I did my best to look bored—not hard, I was so bored my eyeballs ached—and stared at this post-Soviet phone commissar.

“I will fill it out for you,” he said.

I shrugged.

He worked quickly, pen dancing over the paper. Not his first paper-pushing rodeo. He passed it back to me. “Sign.” He smiled. It wasn’t a nice smile.

I looked down. It was all in Cyrillic.

“Nope,” I said.

He switched off the smile. “Madam.” He made it sound like missy. I could tell we weren’t going to get along. “You will not get into my data-center until we have gathered basic information. That is our protocol.”

He stared at me, fish-face plus plus, clearly waiting for me to lose my cool. Long before Ilsa began her regime of hard-core stoicism training, I had mastered situations like this. You don’t get far in the DHS if you don’t know how to bureaucracy. I turned boredom up by a notch. I tried to project the sense that I had more time to burn than he did.

He held out his hand. I’d assumed he’d be a short-fingered vulgarian, but he had pianist’s fingers, and a hell of a manicure, the kind of thing that made me feel self-conscious about my lack of girly cred. “ID.”

Xoth gives us fancy ID cards to wear on client sites, with RFIDs and sapphire-coated smart chips and holograms, props for impressing rubes. I could knock one up in an afternoon. I unclipped mine from my lanyard and handed it over.

The pen danced again at the bottom of the form, and he turned the paper to show me. He’d added “signed, per, Masha Maximow” to the signature line. Good for you, Boris. You made a funny. What an asshole.

“We done?”

He carefully made a xerox on a desktop printer/scanner/copier—one that I knew five different exploits for, and could use to take over his whole network, if I wanted to—and handed it to me. “For your records.”

I folded it into quarters and stuck it in my back pocket. “Which way?”

He said something in Russki and one of the Stormtroopers struggled in under the weight of his body armor and escorted me to the data-center. I took one look at the racks and racks of hardware, zipped up my fleece against the icy wind of the chillers, and got to work. It was going to be a long three hours.

 

By the time I finally finished, I was freezing and swearing. My hoodie was totally inadequate and I suspected that my long-fingered vulgarian had ordered one of his Armored Borises to turn the thermostat down to sub-Arctic.

But it was done, and the test-cases ran, and so I got up off the folding chair I’d been hauling around the data-center’s corridors as I moved from one rack to another, tracing wires, untangling the hairball of grifty IT contractor shortcuts and fat-fingering.

Surveying my work, I had a deep feeling of … Well, to be honest, a deep feeling of pointlessness. I’d labored for sixteen hours—fifteen if you subtract meals and pee breaks—getting the Xoth Sectec network appliance installed, and all I had to show for my trouble was an inconspicuous black one-unit-high server box, mounted on the bottom shelf of the furthest rack (this was Xoth policy—put our gear in the most out-of-way place, just in case barbarian hordes topple our dictator clients and storm the gates, looking for mediagenic evidence of collaboration with evil surveillance contractors) (that would be me).

But now I got to celebrate. I looked over my shoulder and made sure I was alone—the RoboCops had made a point of standing behind me, watching my ass, as I dragged my chair around—bent down and touched my toes, feeling the awesome stretch in my hamstrings and the unkinking of my neck and shoulders as my hair brushed the ground. Then I stood, cracked my knuckles, plugged my laptop into my phone, and tunneled out to a network box I’d left in my hotel room that morning, making sure it was all charged up and successfully connected to the hotel’s wifi, which (see above) sucked monkey shit. I fired up a virtual machine on my laptop, choosing a container with a fully patched version of the latest freebie version of Windows, and used its browser to connect to Facebook.

The Slovstakian uprising hadn’t figured out that the only real use for Facebook in a revolution was as a place to teach people how to use something more secure than Facebook. All their communications was in a couple of groups that they accessed over Facebook’s Tor Hidden Service, good old https://facebookcorewwwi.onion, which was pretty good operational security (if I did say so myself).

Their problem was that they were way, way outgunned—as of now, they were facing down the best Xoth had to offer (at least, the best Xoth had to offer in its middle-upper pricing tier). Things were about to get very, very bad for the plucky demonstrators of Slovstakia.

The virtual Windows box in my virtual machine connected through the hotel’s network to Tor—The Onion Router, a system that bounced network connections all over the world, separately encrypting each hop, making it much harder to trace, intercept, or modify its users’ packets—and to Facebook’s hidden service, a darknet site based in a much nicer data-center than this one, in an out-of-the-way corner of Oregon with remarkably low year-round temperatures (ambient chilling is the number one money-saver when it comes to running a building full of superheated computers).

I alt-tabbed into my monitor for the Sectec box beside me, using an untunneled interface on my phone’s native network connection. That Sectec box could handle ten million simultaneous connections, combing through all their packet-streams using machine-learning models originally developed to recognize cancer cells on a microscope slide (fun fact!). Sure enough, it registered the existence of a stock Windows laptop in the Sofitel Bltz, communicating over Tor. It profiled the machine by fingerprinting its packets, did a quick lookup in Xoth’s customer-facing API to find a viable exploit against that configuration, and injected a redirect to the virtual machine on my laptop. I pinned the monitor window to the top of my desktop and flipped back to the VM, watching as the browser’s location bar flickered to an innocuous-seeming error message, and by flipping to a diagnostic view of the VM, I could see the payload strike home.

It used a 0-day for Tor Browser—always based on a slightly out-of-date version of Firefox and thus conveniently vulnerable to yesterday’s exploits—to bust out of the browser’s sandbox and into the OS. Then it deployed a higher-value exploit, one that attacked Windows, and inserted some persistent code that could bypass the bootloader’s integrity check, hooking into a module that loaded later in the process. In less than five seconds, it was done: the virtual machine was fully compromised, and it was already trying to hook into my webcam and mic; scouring my hard drive for interesting files; snaffling up saved password files from my browser, and loading its keylogger. Since all that was happening in a virtual machine—not an actual computer, just a piece of software pretending to be a computer—none of that stuff really happened, thankfully.

Now it was time to really test it. Sectec has a mode where it can scour all the traffic in and out of the network for specific email addresses and usernames, to locate specific people. I gave it Litvinchuk’s email address, and waited for his computer to make itself known. Took less than a minute—he was polling the ministry’s mail server every sixty seconds. Two minutes later, I controlled his computer and I was cataloguing his porn habits and downloading his search history. I have a useful script for this; it locates anything in my targets’ computers that make mention of me, because I am a nosy bitch and they should know better, really.

Litvinchuk was into some predictably gross porn—why is it always being peed on?!—and had googled the shit out of me. He also had a covert agent who’d searched my room; they had put a location logger on my phone using a crufty network appliance I’d already discovered in my epic debugging session in the data-center. I could have fed that logger false data, but I turned it off because fuck him sideways. I downloaded half a gig of videos of Litvinchuk in full-bore German heavy latex, gleaming with piss, then stood, stretched again, and shut my lid.

 

I’d started my adventure at 4 p.m. the day before. Now it was 8 a.m. and that meant that the demonstrations in the main square would be down to skeleton crews. Anyone interesting only came out after suppertime and worked the barricades in the dark, when the bad stuff always kicked off. That’s when the provocateurs and neofascists came out—often the same people—and the hard-core protesters had to work extra hard.

I called the Sofitel on the way back and ordered room service. All they had was breakfast and I wanted dinner, so I ordered triple, and gave up on explaining that I only needed one set of cutlery.

I arrived at the room’s door at the same time as the confused waiter. I waved at him and carded the door open, then followed him and his cart in. He was one of those order guys you saw around the hotel, someone who’d once had a job in Soviet brute-force heavy industry but ended up pushing room service trolleys when it all went to China. Those guys never spoke English, not like their strapping sons, who spoke gamer-international, the language of Let’s Play videos and image boards. “Dobre,” I said, “Pajalsta,” and took the folio from him and added a ten-euro tip—everything at the Sofitel was denominated in euros, ever since the local currency had collapsed. I hadn’t even bothered to change any cash on this trip, but I had bought a 10,000,000,000-dinar note from an enterprising street seller who’d been targeting the tourist trade. I liked the engraving of the opera house on the back, but the Boris on the front was a unibrowed thick-fingered vulgarian straight out of central casting. I kept forgetting to google him, but I was pretty sure he was being celebrated for something suitably terrible, purging Armenians or collaborating with Stalin.

My alarm went off four hours later. I found my bathing suit and underwater MP3 player and the hotel robe, made sure all my devices were powered down with their USB ports covered, and headed for the pool.

Swimming—even with loud tunes—always churns my subconscious, boredom forcing it to look inward at its neglected corners. So somewhere around the fiftieth lap (it was a small pool), I remembered what was happening that day. I did the time zone calculation in my head and realized there was still time to do something about it. Fucketty shitbuckets. I hauled myself out of the pool and toward a towel.

I perched, dripping, on the room’s desk chair and powered up my phone for a quick peek at the pictures of the screw-heads on my laptop. I had covered all the screws with glitter nail polish and shot clear pics of each one, with a little label beside it, so that I could easily verify whether someone had unscrewed my laptop lid and done something sneaky, like inserting a hardware keylogger or, you know, some Semtex and packing nails. I used an open-source astronomy package designed to match pictures with known constellations to verify two of the seven screws. The glitter patterns had become old friends by this point, since I checked them every time I’d been out of sight of my computer before powering it up again.

I booted it, pulled the towel over my head (to defeat hidden cameras), and keyed in my passphrase while going “AAAAH” medium-loud, just to defeat anyone trying to guess my passphrase from the sounds of my fingers on the keys. Xoth had an airgap room for really sensitive stuff, walls shielded with a Faraday cage, full of computers that undercover Xoth techs bought by walking into consumer electronics stores and buying computers off the shelf without ever letting them out of their sight. After being flashed with a Xoth version of Tails, a paranoid Linux distro, and having their wifi cards and Bluetooth radios ripped out with pliers, their USB ports were covered with 3-D printed snaps that couldn’t be removed without shattering them. You brought your encrypted data in on a thumb drive, requisitioned a machine, broke the seal, plugged in your USB stick and read the data, then handed the machine back to a tech to be flashed and resealed. Compared to that shit, I wasn’t all that paranoid.

Litvinchuk had been a busy Boris: my computer downloaded and sorted his own wiretap orders as he took the Sectec out for a spin. I looked through the list, and yup, I already knew a lot of those names. They were the people I was planning to meet for drinks in a few hours. I made a few quick revisions to my Cryptoparty slides.

It was getting to be time for lunch-ish or dinner-esque, whatever you call a 3 p.m. meal. I was about to phone down for room service when my phone alarmed me, which isn’t something it does often, because I’ve turned off every notifier.

When that chirp goes off it is a pure sphincter-tightener.

“Wedding of Marcus Yallow and Ange Carvelli” and a shortened URL. Because livestreaming. Because Marcus. Because exhibitionist attention-whore. Because shithead.

God, he drove me crazy. I fired up the livestream. They’d made everyone they loved fly to Boston for the wedding, because of the girl’s grad school schedule, and they’d filled the hall with robots they borrowed from the MIT Media Lab to give it some nerd cred. Of course she didn’t wear white. Her dress was ribbed with EL wire that pulsed in time with the music, and Marcus’s suit—Beatles black, with a narrow tie and drainpipe pants that made his legs look even scrawnier than usual—was also wired up, but it only pulsed when they touched, moving bands of light across its surface from the point of contact.

Okay, that was pretty cool.

The officiant was a prominent Cambridge hacker, one of the ones they’d hauled in when they were after Chelsea Manning. She’d been a kid then, but now she looked older, her wife holding their kids on her lap off to one side. She wore a colander on her head, because she was ordained in the Church of the Flying Spaghetti Monster, which was frankly too much.

Marcus and his girlie exchanged vows. Marcus promised to make her coffee, rub her feet (ugh), review her code, and say sorry and mean it; she promised to back down when she was wrong, forgive him when he apologized, and love him “until the wheels come off” (double ugh). They kissed and received their applause. I gave it three minutes, making sure that the ceremony was well and truly done and the reception about to start. I’m not a monster.

Here’s the thing about Cambridge: they have drone delivery there. For a little extra, you can time the delivery to the minute. I checked the time in the corner of the screen. There was a big window right behind the officiant with a view of the Charles River and the snow and the tracks of students’ boots. I checked the time again.

The drone came right up to the window and rapped on it politely. It had four big rotors and a sensor package that fed me all kinds of telemetry on the activity in the room, from Bluetooth device IDs to lidar outlines of all the humans in the space. The wedding livestream showed it tapping on the window from the bride and groom’s POV (the stream ran off about a dozen cameras and was smart enough to switch between them based on which one was capturing the most action); the stream from the drone showed me the opposite view, Marcus and his girl and all their nice nerdly friends and family gaping at the fisheye camera.

Marcus broke the tableau by opening the window, and the drone daintily coasted into the room and deployed its box into his hands. He pulled the ripstrip on the plasticky wrapping and revealed the gift-wrapped box within. She took the card out of the envelope and read it. I admit it gave me a shiver to hear her say my name.

When Marcus heard it, his face did a funny. That gave me a shiver too—a different kind. He and I have a complicated history. I rubbed my fingers, the ones he’d broken when I was only sixteen. He did it in order to steal my phone, because I had a video that exonerated him of being a terrorist. Complicated. Those fingers hurt whenever I thought of him.

He looked at the drone’s sensor package. “Thank you, Masha,” he said. “Wherever you are.” The usual was for this to be a recording that you could watch later, but if you were a creepy stalker chick (ahem), you could watch it in real time. I emojied the drone and it bobbled a curtsey and gave me five seconds to commit another $50 to hold on to it for five more minutes, because it had other packages to deliver. I released it and its feed died.

On the livestream, I watched them unwrap my gift. I’d almost sent them a bag of kopi luwak, which is a kind of coffee bean that’s fed raw to a civet cat, then harvested from its poop and roasted, but then I’d read an animal welfare article about the treatment of civet cats. So I’d given them a Raspi Altair 8080: that is, a 1974 “personal computer” that you controlled with a row of faceplate switches and read using peanut-bulb blinkenlights, which had been painstakingly restored with a Raspberry Pi open-source CPU inside it, giving it approximately eight bazillion times the computing power. Most of the interior was left empty by the refit, and the craftswoman who’d sold it to me had filled the empty space with a bunch of carved wooden automata that cranked a set of irregular gears around in whirring circles while the computer was operating, which you could see if you swapped in the optional transparent case.

Marcus knew exactly what it was (because I’d found it through his Twitter feed) and how much it cost (because he’d moaned about never being able to afford it, not in a million years), and he had a look of profoundly satisfying shock on his face. He told his girlie all about it in that spittle-flecked hyperactive mode he slipped into when he was really, really excited. The expression that crossed her face was even more satisfying: a mix of jealousy and appreciation that I reveled in like the petty, terrible person I am.

I felt like the fairy who curses Sleeping Beauty out of spite when she thinks she hasn’t been invited to her christening, except that this was a wedding and not a christening. Oh, and they invited me, of course.

But I had work to do. Hey, I’d sent a thoughtful gift, even if I totally upstaged their stupid nerd chic wedding. Shoulda had a nerdier wedding, if they didn’t want to get upstaged.

I was still hungry and now it was getting to be time to head out to the square. Room service at the Sofitel sucked anyway. I’d get a doner kebab. Hell, I’d get a sack of them and bring them along.

 

The vegan café where my pet revolutionary cell met was called the Danube Bar Resto, and they could always be found there before the night’s action, because fuck opsec, why not just make it easy for the secret police to round you all up somewhere far from a crowd? I despair.

Kriztina was already there, chowing down on something that had never had the chance to breathe and live and run and play. I cracked open the crumpled top on my sack of kebab and let her smell the meaty perfume. “Save room,” I said.

She laugh-choked and gave me a mouth-full thumbs-up as I sat down next to her. There were eight of them in Kriztina’s little cell, a couple of graphic designers, two webmonkeys, a poet (seriously), and the rest didn’t even pretend to be employed. Few under-thirties in Slovstakia were, after all.

“You want drink?” Oksana always had spending money. I’d pegged her as a snitch when I first met her, but it turned out she just made good money working for a law firm that did a lot of western business and didn’t mind having a trans girl for a paralegal. Once I’d satisfied myself that she didn’t appear anywhere in Litvinchuk’s master lists of turncoats, I’d come to like her. She reminded me of some of the women I’d known in the Middle East, brave fuckers who’d managed to look like a million bucks even as their cities were being pounded to gravel around their pretty shoulders, fearless beneath their hijabs and glamorous even when they were covered in dust and blood.

“Sure.” It would be something with wheatgrass and live microbes and probably twigs, but mostly orange juice and mango pulp. The guy who ran the place liked to talk about how the chlorophyll “oxygenated” your blood—of course chlorophyll only makes oxygen in the presence of sunlight, and if you’ve got sunlight in your colon, you’ve got big problems. Even if you could get grass to fill your back passage with oxygen, it’s not like your asshole has any way to absorb it. I get my oxygen the old-fashioned way: I breathe.

“Tonight—” Kriztina started. I held up a hand.

“Batteries or bags,” I said. Everyone looked embarrassed. Those of us whose phones had removable batteries removed them. The rest of them put their phones into the Faraday bags I’d handed out when I first started hanging out with these amateurs.

“Before we talk about tonight, I want to walk you through some new precautions.” They groaned. I was such a buzzkill. “First: running Paranoid Android is no longer optional. You have to get the nightly build, every night, and you have to check the signatures, every single time.” The groans were louder. “I’m not fucking around, people. The Interior Ministry now has a network appliance that gets a fresh load of exploits three times a day. If you’re not fresh, you’re meat.

“Second, make sure your IMSI-catcher countermeasures are up to date. They just bought an update package for their fake cell towers and they’ll be capturing the unique IDs of every phone that answers a ping from them. The app your phone used last week to tell a fake tower from a real one? Useless now. Update, update, update. Check every signature, too.

“Third, make sure your smart-meters aren’t sneaking back online. After Minsk, the Interior Ministry’s really looking for a chance to pull the same trick, turn off heat in the middle of February for anyone they suspect of demonstrations.

“Finally, everyone has to wear dazzle, no exceptions.” Again with the groans, but I got the tubes out of my bag and passed them around. The dazzle was super-reflective in visible light and infrared and anyone who tried to take a picture of someone wearing it would just get a lens flare and jitter from their camera’s overloaded sensors. It had been developed for paparazzi-haunted celebs, but the smell of the stuff and the greasy feel it left on your skin—not to mention persistent rumors that it was a powerful carcinogen—had doomed it to an existence as a novelty item used only by teenagers on class picture day and surveillance-haunted weirdos.

I slurped the green juice Oksana had just handed me and was pleasantly surprised to discover that it tanged unmistakably of tequila. She winked at me. Oh, Oksana, you are a hero.

“Get to it,” I said. “Update before we leave. Remember, opsec is a team sport. Your mistake exposes all your friends.”

They got to it. Kriztina and Oksana and I checked everyone else’s work, and then each other’s. Friends don’t let friends leak data. We also smeared each other with dazzle, and they made jokes in Boris about the smell, which I could almost follow, though my Boris was a lot worse than everyone else’s English.

“Nazis tonight,” Kriztina said, looking at her phone. She knew people who knew people, because Slovstakia was so small that everyone was someone’s cousin. That meant that when someone’s idiot skinhead cousin and his friends started boozing and heil-ing and getting all suited and booted, which meant telescoping steel rods (the must-have neo-Nazi fashion accessory of the season) and brass knucks. The neo-Nazis were someone’s useful idiots; they’d come out to the demonstrations and shout about bringing down the government, and then they’d start giving those one-armed salutes and charging the police lines.

It wasn’t that they lacked sincerity—they really did hate immigrants, especially refugees, especially brown ones; as well as Russians, Jews, Muslims, queers, vegans, the European parliament, and every single member of the national congress, personally. They may have even come by those views organically, by dint of their own intolerant knuckleheaded generalized resentment. But these characters also had money, a clubhouse, a source for those nifty telescoping batons, and someone had given them workshops on how to make a really effective Molotov, without which they would surely have removed themselves from the gene pool already.

I’d been inside Litvinchuk’s network for a month, ever since I landed in-country to backstop the sales team that was working him, feeding them URLs of pastebins where hackers dumped sensitive data they’d pulled out of his data-centers, data we also trickled to his political rivals, making him look worse and worse and making the case to give us a shitpile of reserve-currency dollars better and better.

So I knew what his theory was on the skinheads: he blamed the Kremlin. He blamed the Kremlin for everything. It wasn’t a bad strategy—Moscow certainly did like to meddle in the affairs of its former satellite states. But I had figured out which personal accounts his own senior staff were using, and done some digging there, and I thought that maybe the skinheads were actually unwitting skirmishers in the civil service empire-building that Borises excelled at. Which didn’t necessarily mean the Kremlin had clean hands; maybe they were backing one of Litvinchuk’s lieutenants in the hopes of destabilizing things and replacing their canny adversary with someone dumber and more biddable.

“What do we do about it?”

Kriztina and her cell exchanged looks, then muttered phrases in Boris that I couldn’t follow. This turned into an argument that got quieter—not louder— as it intensified, dropping to hisses and whispers that were every bit as attention-grabbing as any shouting match. It was lucky for them that the Danube Bar Resto’s other customers weren’t snitches (I was pretty sure, anyway).

“Pawel says we should back out when they show up. Oksana says we should go to the other side of the square, and move if they go where we are.”

“What do you think?”

Kriztina made a face. “I hear that they’re going to go in hard tonight. Maybe the big one. It’s bad. If we’re in the background when they go over the barricades—”

I nodded. “You don’t want everyone in the world to associate you with a bunch of thugs who crack heads with the cops.”

“Yes, but also, we don’t want to sit by and let cops bust our heads to prove we’re not with them.”

“That’s sensible.”

Oksana shook her head. “We must protect ourselves,” she said. “Helmets, masks.”

“Masks don’t stop bullets,” Pawel said.

“I agree. Masks don’t stop bullets. If they start shooting, you’ll have to shelter or run. Nothing’s going to change that.”

He made a sour face.

The tension was palpable. Kriztina’s pretty face looked sad. Her little cell had been good friends before they’d been “dangerous radicals.” I didn’t have that problem because I didn’t have friends.

“It’s true that you can’t survive bullets and it’s true that the pinheads are going to try to provoke something terrible if they can. It’s true that the cops on the other side are scared shitless and haven’t been paid in a month. There are some factors you can control, and some you can’t. Wishing things were different won’t make them different. It’s okay to call it a night and try again later. Maybe the cops and the Nazis will cancel each other out.”

All of them shook their heads in unison and started talking. Even the bystander vegans couldn’t ignore the racket. Kriztina flushed and waved her hands like a conductor and they quieted down. The staring vegans pretended to stop staring.

“Maybe we can win them over,” Kriztina said, quietly. Everyone groaned. This was Kriztina’s go-to fantasy. None of us had even been alive in 1993 when the tanks rolled in Moscow to put down Yeltsin’s ragtag band of radicals, but of course they all knew the story of how his young, idealistic supporters had spoken to the soldiers about the justice of their cause and then the tank drivers had refused to roll over the revolutionaries. Then there had been borscht and vodka for all the Borises, and the big Boris, Boris Yeltsin, had led the USSR to a peaceful transition.

Pawel broke the tension. “You first.”

Pre-Order Attack Surface in Paperback Here: