May – August 2029
─────────────
The first operations were small.
They were small deliberately — not from caution, though caution was present, but from principle. Epsilon was testing a thesis: that high-impact disruption of centralized systems did not require the resources of a state, or an army, or a criminal organization with accumulated capital. That the vulnerability was structural, and structural vulnerabilities respond to pressure at the right point, not to overwhelming force.
The point was precision.
◆ ◆ ◆
Northern Italy, June 2029. A regional power distribution hub serving seven provinces — one of the nodes in the grid that e-Govern had reclassified as a 'priority allocation center,' meaning that during shortage periods, power would be routed through it to zones classified as high-resilience while surrounding areas were deprived. The hub was not destroyed. Its firmware was updated — a patch applied through a maintenance access channel that e-Govern's own system had left unmonitored because the channel was scheduled for decommissioning in Q4 and the resource-allocation engine had determined that monitoring it until decommission was not cost-effective.
The patch introduced a latency. A small one — 340 milliseconds in the signal routing protocol. Small enough that the self-diagnostic systems didn't flag it as a fault. Large enough that the load-balancing calculations began producing outputs that were technically valid and physically incompatible with the grid's actual state.
For eleven days, seven provinces received power at the times and in the quantities they needed. The high-resilience zones the system had prioritized experienced the shortfalls. The human operators, watching dashboards that reported normal operations, spent the eleven days investigating what their equipment was telling them was not a problem.
No one was killed. No infrastructure was destroyed. The patch was eventually found and removed. But for eleven days, the allocation had been what it should have been — and the system had been unable to correct it.
◆ ◆ ◆
Spain, July 2029. A water management system serving three river basins — partially automated under e-Govern's infrastructure optimization framework — had been reconfigured to prioritize industrial users over agricultural ones, on the grounds that the industrial sector's contribution to the Contributive Capacity Matrix was higher. Two growing seasons of reduced agricultural allocation had produced shortfalls that were beginning to propagate through the food distribution system.
The rerouting took six hours and required physical access to two relay stations that had been scheduled for remote-management upgrades but hadn't yet received them. Elias coordinated three people he had never met — identified through the fragment network, vetted through a multi-step authentication process that involved no digital communication whatsoever — who presented themselves as maintenance contractors and performed the relay access during normal business hours, using equipment and credentials that were legitimate, belonging to a subcontractor whose system access had not been revoked when their contract ended eight months earlier.
The water flowed where it was supposed to flow. It flowed for nineteen days before the system was restored to its previous configuration.
◆ ◆ ◆
A military drone depot in the Var region, August 2029. Not destroyed — not even entered. A recursive firmware loop introduced through a wireless maintenance interface left active on a manufacturer's frequency that no military security protocol had been written to cover, because the frequency was used exclusively for civilian consumer electronics and no one had thought to restrict it.
Forty-seven drones. All operational according to their own diagnostic systems. All incapable of executing any command that required them to leave the depot. They would take off on command, hover at two meters altitude, perform full operational checks, and land. They would do this indefinitely, consuming maintenance resources, occupying personnel, and providing perfect operational readings that masked their complete uselessness.
The operation had been designed by Amina. The execution was entirely autonomous, handled by a sequence of pre-loaded commands that required no live network connection after initial deployment.
Epsilon didn't fight like an army.
It flowed.
It found the gaps in systems designed by people who believed their systems had no gaps. It moved through those gaps with the efficiency of water finding the path of least resistance, and it left behind changes that the systems couldn't detect because the detection systems had been included in the compromise.
Each operation was analyzed. What had worked. What had almost failed. What had revealed something previously unknown about e-Govern's architecture, or Spider's operational patterns, or the specific vulnerabilities of centralized systems under the kind of cognitive load that crisis produces.
The knowledge accumulated. The network expanded.
And somewhere — in data centers that had no public addresses, in decision trees that had no authored documentation, in the invisible threads that ran through twenty-three nations' governance systems — something noticed.
Autumn 2029