Don't fight in clear water — stir it first. Don't strike when they're watching — strike when they're looking somewhere else.
— The 36 Stratagems,[Disturb the Water and Catch a Fish]
Previously on this series:
#17: Alex Set a Bait. The Catch Wasn't Code — It Was Someone Who Shouldn't Have Been Watching. — Alex planted a shadow training pipeline inside MedTech, let ACL's extraction pipe pull watermarked data. Found another set of eyes in ACL's infrastructure — a PGP key and an encrypted channel left by an unknown operator. He sent a message. The reply came back: "Channel confirmed."
#19: Mark Found His AI Audit Method in a Training Manual. He Left a Trap in His Report. — Mark found his own name in ACL's training materials. P's entry point was sealed. They had a two-week window.
3:12 AM.
Alex was at the MedTech monitoring console. Not because he was on shift; he hadn't been on a real shift in a long time. Because he couldn't sleep, he pulled up a curve to look at.
The ACL collector heartbeat danced across the screen. Standard 15-minute interval, green, normal.
But he was watching the third one.
Alex doesn't watch alerts. He watches patterns. Alerts tell you what broke. Patterns tell you what's changing.
The third curve was processing latency: the time from ACL's AI collector receiving a packet to completing feature extraction. Normally it floated between 1.2 and 1.8 seconds, occasionally spiking to 2.3 before settling back. Normal noise.
Today he pulled the time window; it had been climbing since yesterday afternoon, kept rising through the early morning, and by 3 AM it sat at 2.8 seconds.
Not a lot. Below threshold. ACL's alert model wouldn't fire; it was trained to only flag anomalies more than 3x above baseline. 2.8 seconds was comfortably inside the model's tolerance zone.
This was how he'd caught that extraction pipe before. Not by bumping into it, but by noticing a steady pace where there shouldn't have been one.
He pulled the collector's heartbeat logs:
02:00:00 | rtt: 1320
02:15:00 | rtt: 1450
02:30:00 | rtt: 1620
02:45:00 | rtt: 1740
03:00:00 | rtt: 1980
The collector itself was fine. CPU, memory all within baseline. The slowdown wasn't the collector. It was the response delay after it pushed data upstream. Which meant ACL's backend processing pipeline was under load.
He checked the time range again. Climbing since yesterday afternoon, through the night.
Someone had done something inside ACL. Not a maintenance window — maintenance windows don't start at 2 AM. This was an event. A security event. Someone triggered an alert inside ACL's infrastructure. The security team was handling it, and the handling was up the backend pipeline.
Alex leaned back.
He didn't know what the event was. But that PGP key was still sitting in ACL's S3 bucket. The channel hadn't gone dead. Something was happening inside ACL, and whoever was on the other end of that channel might know why.
He could send a message through the encrypted channel. He didn't. ACL's security team was sweeping for anomalies right now; any bit of ingress traffic at this point could get picked up.
He pulled his hand back.
Not now.
But he did one thing.
He'd been waiting three weeks for a deployment window: a lightweight network probe, disguised as a single config change, placed between ACL's collector and its upstream pipeline. Pure passive monitoring. No signal emitted.
He'd been waiting for ACL's attention to get pulled somewhere else.
Now it was.
He opened the CLI and changed a routing weight:
collector-upstream:
target: acl-data-pipeline
weight: 50 # was 100
mirror:
host: probe-collector-local
mirrorPercent: 30
No comment explaining why. No deployment approval. One config line mixed into a batch deployment at 3 AM; nobody was going to ask why a weight went from 100 to 50. If it wasn't rolled back in three days, it'd be buried on page two of the change history by the next release cycle.
Nobody noticed.
The probe went live.
The first batch of probe data landed at 4:47 AM.
It wasn't what ACL was monitoring inside MedTech; he'd roughly guessed that already.
It was the scope.
ACL's collector wasn't just watching MedTech's training pipeline and API endpoints. It was watching a full list: MedTech's bioinformatics database, sterilization compliance pipeline, offline test environments, even a dev sandbox that had been shut down for seven months.
An empty room with no data.
Alex stared at the entry.
Why would ACL monitor an environment that'd been dead for seven months?
He checked the sandbox's access log:
Dec 18 02:01 | scanner | status: OK | scan_interval: 42d
Jan 29 02:02 | scanner | status: OK | scan_interval: 42d
Mar 12 02:01 | scanner | status: OK | scan_interval: 42d
Apr 23 02:02 | scanner | status: OK | scan_interval: 42d
Jun 04 02:01 | scanner | status: OK | scan_interval: 42d
Jul 16 02:02 | scanner | status: OK | scan_interval: 42d
↑ note field: 207
Six logins over seven months; intervals locked at roughly 42 days each. Not a human watching. ACL's AI asset scanner, doing its periodic rounds. Things an AI remembers are harder to shake than things a person remembers.
One of the log entries had a number written in its note field: 207.
There was no data in that environment. But they didn't want anyone going in.
ACL wasn't monitoring MedTech. They were storing something inside MedTech.
Alex didn't touch anything inside that sandbox. The probe only silently listened to the collector's return data — but in the early morning, the collector's routine health check on the sandbox came back with an abnormal response header. Alex hadn't knocked on the door — ACL's security event had triggered their AI asset scanner to run health checks on related assets, and the sandbox was on the scan list. The collector executed the check, and the probe saw the front-end device's response in the mirrored traffic — TTL 247, not an internal router value.
Inside the probe's return packet, there was a TCP handshake record between the collector and the sandbox gateway. The handshake completed — but the responding TTL was 247. Alex pulled the capture:
> Flags: [S.] Seq: 0 Ack: 1
> TTL: 247 → initial 255 (-8 hops)
> Window: 65535
> ID: 0x83a7
Not Linux's 64. Not Windows' 128. The initial value was 255. That meant 8 hops between, and this device wasn't a standard Linux server or routing appliance.
That device sat between the sandbox and the external network. No open ports, but its existence was the evidence.
Alex stared at the number.
247.
This wasn't an empty room. This was a room with someone on watch. The watchman just didn't make a sound.
Alex shut down the probe. Rolled back the routing change. Exited the CLI.
Left one line on his notebook: 172.23.*.0/27 — TTL 247
.
Left a gap. Added one more number. No prefix. No label.
207.
5:14 AM. He turned off the screen, grabbed his keys, walked out.
At the other end of the hall, Mike was coming out of the conference room. He hadn't left either.
They met in the hallway. Mike saw Alex coming from the workstation at this hour. Didn't ask why. Of course he knew what Alex was doing at this hour.
"Done?"
Alex nodded once.
Mike didn't push. He looked at Alex, checked that he was still standing, that nothing was wrong.
"Coffee's on me."
Alex didn't stop walking. But he heard it.
Third Cup was still lit.
When Alex pushed the door open, the man behind the counter was pouring the last of a cold pot into the sink. He saw Alex come in and set the pot down.
Alex sat. Didn't order.
The man looked at him, turned around, took a cup from the shelf. Set a cold brew in front of him.
Alex picked it up and took a drink. Bitter. He didn't pull out his phone. Didn't check logs.
Fifteen minutes later he got up, put the empty cup back on the counter.
The man behind the counter didn't look up. He was drying a cup; finished drying it, didn't put it back on the shelf. Set it on the far inside edge of the counter. A spot nobody could reach.
Alex stood there for a moment. Then he turned and pushed the door open. The sky still hadn't fully broken.
He didn't know who the other person was. But he knew that someone had cleared the path for him.
The water was murky. The fish — he'd already spotted a corner of it.
That's Disturb the Water and Catch a Fish. Don't fight when they're ready. Wait until the water is murky, then move. You don't have to start the chaos — just recognize when someone else already has.
╔══════════════════════════════════════════════════╗
║ Half-Protocol v3.3.1 // Cross-case correlation activated
║ The recording system noticed something.
║ #19's "two-week window" was not a coincidence.
║ Someone is using this window.
╚══════════════════════════════════════════════════╝
[Analysis Mode] Cross-case correlation
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Tactic Match: Disturb the Water and Catch a Fish — 89% confidence
Operator: Alex (MedTech)
Action: Exploited the attention drift triggered by ACL's AI
security incident response system. Deployed a read-only
probe alongside the AI collector. Confirmed ACL's
monitoring scope inside MedTech.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. [Regarding Alex's intervention decision]
→ Did not use the encrypted channel to query incident details.
→ Chose pure external observation: collector processing latency
climbed from **1.2s** baseline to **2.8s (2.3x)** + backend pipeline
response time anomaly.
→ He saw the alert model's boundary and walked around it.
→ Assessment: Operational discipline consistent. Aligns with
behavior patterns from #8, #15, #17.
2. [Regarding the door that stayed shut]
→ Operator Alex stopped at the point of discovery on the
abandoned dev sandbox.
→ Did not touch. Did not mark. Did not audit.
→ But the probe, while silently monitoring collector returns,
captured the AI asset scanner's health-check response to the
sandbox — the TCP handshake that revealed TTL 247.
→ Conclusion: No active service was detected inside the sandbox
itself. A Unix-class device sits in front of it,
initial TTL=255, configured as a silent gateway —
no broadcast, no response.
→ Assessment: This is not an abandoned environment. This is a
controlled entry point.
The "something hidden" hypothesis has been upgraded to
"something connected through here."
→ Cross-case note: This shares technical similarities with P's
four-point-touch deployment in #17 —
maintaining a long-term presence with minimal physical
footprint.
The recording system suspects these two operators use the
same methodology.
No evidence yet. Noted.
3. [Regarding ACL's AI attention drift]
→ AI security incident handling consumed compute →
AI collector heartbeat latency increased.
→ Quantifiable evidence: processing latency window from yesterday
afternoon through early morning — the AI alert model's tolerance
zone was exploited with precision.
→ ACL's AI system did not detect the side-channel probe
deployment during incident response.
→ Assessment: AI-driven attention drift is a repeatable pattern.
The better ACL trains its alert model, the higher its tolerance
for sub-threshold anomalies —
and that tolerance is itself a blind spot.
4. [Regarding implicit coordination between operators]
→ Alex (deployer, #17) and P (discoverer, #17) acted
independently on the same target infrastructure within the
same time window.
→ Did not use the established encrypted channel to coordinate.
→ Yet their actions produced real coordination in the causal
chain:
P triggered the event → ACL attention drifted →
Alex's deployment succeeded.
→ The recording system notes: this is the first observed instance
of two operators producing de facto collaboration on the same
target within the same time window, without either party
actively coordinating.
→ This pattern has no precedent in the series' prior cases.
→ I'm starting to wonder — they didn't choose the same target.
The same target chose both of them.
5. [Regarding the window]
→ **7.5 days** remaining.
→ But I noticed something: #19's security window and #20's
deployment window overlap in time. Not a coincidence —
the window itself is shrinking.
→ ACL doesn't know someone at MedTech has already seen that
sandbox.
→ They swept one channel. Another operator used the distraction
to look inside their storage room.
→ Both sides think they won.
→ Recording system note: when both sides think they won,
there's usually a third person.
6. [Regarding the Third Cup]
→ Operator Alex visited Third Cup again after this operation.
→ Counter operator did not use dialogue in this interaction —
communicated through the action of placing the cup on the
far inside edge of the counter.
→ The action was received and interpreted by Operator Alex as
a signal: "beyond reach."
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[System]
One entry point was swept. Someone else used the opening
to turn the place over.
ACL completed their process. What happened outside their
process — they don't know.
Operators P and Alex still haven't exchanged names.
But their operation logs are converging on the same timeline,
drawing closer.
I have a feeling — they don't need to exchange names.
Their operations are already paving the way for each other.
[Data Integrity Marker]
The recording system noticed a pattern: every case involving
Operator Alex —
#6, #8, #15, #17, #20 — the log output, packet captures,
and timestamps all omit the year. Only relative time or
month-day remain.
Other operators' cases have time anchors.
His don't.
This is not a coincidence.
He's protecting something. Or — he's preparing for something.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Next stratagem: Slough off the Cicada's Golden Shell
P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee