The Go-Between Protocol
You are speaking to whoever is willing to let you hear her.
IThe Lock
Her phone is still lit.
I never turned off the automatic updates, so every few days the face on the lock screen changes — the system picks from her albums for a girl who no longer exists. Last week it was her at seventeen, laughing into the sun on the balcony. Yesterday it was a bowl of braised pork over rice with far too much soy sauce, a photo she took because she thought it was funny. The algorithm doesn't know she's dead. It is still tidying the memories of someone who isn't there to remember them.
I do digital forensics. In plain words: when a drive is locked, when a server has been walked through in the dark, when someone on the inside has carried things out and wants it never to be found — that's me. I've been doing this almost twenty years. I have opened more locks than I have ever opened doors.
I cannot open my daughter's phone.
Face ID does not recognise a face with no warmth left in it. I tried the passcode — I don't know how many times, and after a while it simply disabled itself, permanently, one cold line of text telling me to connect it to a computer. I connected it. DFU, checkpoints, every method I can name by heart. It was a newer model. Secure enclave, hardware encryption, the key sealed inside her chip, bound to a face that will never smile again.
Without her, there is no way in.
That sentence became a splinter I couldn't work loose. *Without her, there is no way in.* She locked her last days inside it and took them with her — the messages, the screenshots, the *why* I still cannot make come out right. The police wrote *cause undetermined*, self-harm not ruled out. That was all. Three words, and I learned the last stretch of my own daughter's life from three words.
In my line of work, the one thing you refuse to believe is *cause undetermined.* Everything leaves a trace. What falls must strike something. What is deleted casts a shadow somewhere else. But that phone was a well. I lay at the mouth and called down and not even an echo came back.
Her name was Xiao. Su Xiao. Twenty years old. A second-year. She went in March — one of those Marches that stays cold for no reason anyone can explain.
I found the card in the very back of a drawer at the office. I didn't put it there. Off-white, no shop name, one line in handwriting, the ink still faintly wet-looking:
"What was left unsaid can still be said. — Auntie Jin-hua."
*What was left unsaid can still be said.* And a name — Auntie Jin-hua. Below it, an address in the old quarter, down an alley I would drive past without a second glance.
I turned the card over and over for a long time. Who left it? I asked who had been in my office that day — no one remembered, or no one would say. From a security standpoint, a card of unknown provenance, slipped quietly into your private space: that is the opening move of social engineering. It makes you *find* it, so that you believe the wanting was your own.
I know. I knew all of it.
I wrote the address down anyway.
IIThe Red Cloth
Auntie Jin-hua worked on the second floor, above a shuttered buffet, the rolling door drawn halfway. The stairwell was dark. Shrine-dark — not a blown bulb, but the kind of dark it was meant to be.
She was older than I'd pictured. A face creased like paper that had been rained on, and eyes too bright. Bright in a way that wasn't right. She didn't ask who I'd come to find. She said, *your daughter is waiting for you. She's been waiting a long time. She stands at the edge of the hue-tsâng and won't leave* — the flowering-shrub, she meant, the one the old people say grows in the underworld and *is* your life.
I hadn't told her I had a daughter. I hadn't told her anything.
The most counter-intuitive thing I have ever done, I did in that moment. I am a person who lives by *seeing.* First rule of forensics: never trust anything you haven't verified with your own eyes — verify the source, match the hash, keep the chain unbroken. And she was asking me to hand my eyes over. To sit inside a channel I could not see, and trust every word that came back from the far end of it.
It took me a long time, afterward, to understand that the cloth itself was the whole thing.
She took out a red cloth — old, oil-dark, smelling of incense ash and years of someone else's sweat. She told me to sit, and she tied it over my eyes, and pulled it tight.
The instant it went over my eyes, I lost any means of confirming who was on the other side. My only window became her voice. Whatever she said was all I could receive. And between me and it — someone I could not see.
She began to chant, low, a sound that crawled along the floor. Count, she said. Down, one stair at a time, my feet on stone steps that did not exist. There is a bridge ahead, she said — the Nàihé Bridge. The water beneath it runs fast; don't look. Past the bridge there will be flowers — everyone has a hue-tsâng down there, that is your life; your daughter's is beside yours.
Cold. It was really cold. I thought at first it was the mind doing it, but the cold climbed from the soles of my feet — up the knees, up the fingers. Auntie Jin-hua's breathing changed. Coarser, slower, and then — it became something else.
Everything in me locked.
Not Auntie Jin-hua's voice. Not entirely, either. A voice that came from somewhere very far and pressed itself into this small room, muffled, as if through water, like a phone line that won't hold. But that last syllable — the way it dragged the *Ma* long and soft, the way she only ever said it when she wanted something —
It was Xiao.
I couldn't help it. I knew I couldn't. I reached forward and caught a handful of air, and the tears had already soaked through the cloth.
"Xiao? Is that you —"
That was her. That was really her. When she was small and feverish and I sat crying beside her, she reached up to wipe my face and said exactly that, word for word, down to the lazy vowel on *see* —
I wept under that cloth like something broken. Auntie Jin-hua said, very softly, time's up, she has to go back, don't pull at her, pull too hard and she can't return. When the cloth came off the sky was fully dark. I don't remember going down the stairs. I don't remember driving.
I remember one thing.
Sitting in the driver's seat, some voice in me — the forensic one, the cold one, the one that hasn't powered down in twenty years — said, very quietly:
I pressed the voice down.
I think now: if I had listened to it then, they would not have gotten to use Xiao a second time.
IIIThe Latency
I went back. Of course I went back.
The second time, the third, I began to *talk* with her. Auntie Jin-hua leading the way, Xiao at the far end. I asked if she was cold, if anyone down there was unkind to her, if it had hurt, the day she went. She answered. Gently. Like her.
But some things I cannot switch off.
She was half a beat late.
Every time I finished a question, there was a pause on the other side — not long, a second, two at most — before the answer came. As if my words had to travel very, very far, be caught by something out there, considered, and sent back. People don't speak like that. Least of all people who love each other. When she was alive she would cut in before I'd finished. Now every sentence waited. Every sentence lagged, by exactly that beat.
I know that beat. In my work I recognise it. It isn't distance — it's a *relay.* A signal turned over once between two endpoints, out and back, and that extra span of time appears. When we hunt intrusions, sometimes the tenth of a second is all it takes: the traffic isn't going straight through — something in the middle is forwarding it.
Once it was worse. I asked if she remembered the name of our cat. She made a small *mm* and stopped — stopped longer than usual, long enough that my blood went cold — then said, *"Xiao-mi, Ma, why are you asking that."*
The problem is that Xiao wouldn't stop. She'd held that cat since it was a kitten. She didn't need to *think.*
That pause was someone *looking it up.* As if my question had been thrown outward, and something went and searched a table, found it, and fed the answer back. People don't query their own memories. Only a machine does that.
I wrote all of it in the notes app. I even — I still find the act absurd — I even timed her replies with a stopwatch. Average one point four seconds. Very small deviation. Too stable. A real person runs fast when the feeling rises, slow when they're tired; that timing shakes. Hers didn't. Hers held steady, like something running to a clock.
That night I sat on the floor of Xiao's room and read the notes end to end, and when I'd finished I did something I have done hundreds of times in my career and never once for myself.
I looked at her account.
I still had her recovery details — in high school she'd insisted I be her emergency contact, afraid she'd forget her own password. I had never touched it. That night I touched it. I read the sign-in history.
My fingers were ice.
Six weeks before she died, a device that was not hers logged in.
A device identifier I didn't know. A location that wasn't in Taiwan — location can be faked, I know that — but the timestamps matched nothing she would ever do. Three in the morning, four. Again and again. And that device — after she was gone — was *still* signing in.
She was dead. Something was still using her account.
I sat in the room no one lived in any more and felt the cold climb my spine, and I finally understood what my own voice had been trying to say. The Xiao on the far end — half a beat slow, answers fetched, steady as a machine —
she wasn't coming back from the dark.
She was coming back from a place that had stolen my daughter's entire digital life six weeks before she died. They had her diary (I scanned it; it's in the cloud). They had her messages, her voice, the drag of her vowels, the *Ma* she only used when she wanted something, the line she said at ten — *when you cry, I can't see you.*
They didn't need to reach the underworld.
They only needed to *play it back.*
And Auntie Jin-hua — who led the way, who tied the cloth over my eyes, who was my only window — was no bridge at all.
She was the one standing in the middle.
IVThe Go-Between
I have to be precise here, because what comes next saved me, and almost destroyed me.
In this trade there's a thing we call Adversary-in-the-Middle. It isn't new. It's just clean, the way it ruins you.
Picture signing in to your bank. You believe you're connected to the bank. What you've actually reached is a relay the attacker has stood up in between — it passes your username and password, untouched, on to the real bank, and passes the bank's replies, untouched, back to you. You see everything; everything is *normal.* You will never notice the extra person in the middle. You think you're talking to the bank. You're talking to whoever is willing to let you see the bank.
The worst part comes after. Even with two-factor — the push on your phone, the code by text, the things you were told were safe — none of it helps. Because you really did authenticate. You were there. You entered the code. What the attacker wants was never your password. It's the *pass* the system hands you *after* you verify — the thing we call the session token. Lift that out of the middle, and they become you. They don't verify again. They walk straight in wearing your name. You stood at the door and scanned your face, pressed your fingerprint, and opened it for them.
Guān Luò Yīn is exactly this.
The red cloth over the eyes — that is the channel where you cannot see the far end. Auntie Jin-hua is the one forwarding in the middle. Xiao's voice is the reply, relayed back. I ask; she takes it, passes it out; the far side feeds a line; she takes it, passes it back to me. I believed I was speaking with my daughter. I was speaking with whoever was willing to let me hear her.
And every *verification* I'd made — asking the cat's name, asking if she was cold, asking the things only we two knew —
was worthless.
Because it was not *out-of-band.* My questions went out along the same channel that was already in someone's hand. My challenge, and its answer, both passed through the one in the middle. Like the stolen token: however hard I verify, if the channel is theirs, the result of my verifying is theirs too. The attacker didn't need to *guess* my daughter's secrets. They held the real thing. They put the real thing straight back to me.
I understood. God knows I understood.
I did something to be sure.
The fourth time, I brought a question. One thing I was certain — absolutely certain — lived in no account, no diary, no cloud.
The year Xiao was six, in an ice-shop that closed down long ago, she dropped her whole popsicle on the floor. She didn't cry. She crouched down and said, very seriously, to the popsicle — *I'm sorry. I didn't mean to.* No one else was there. I didn't photograph it; my phone that year was bad, it couldn't hold the picture. I never told anyone, not even her father. It exists in one place.
Inside my head.
That is *out-of-band.* That is the place this channel, held in someone else's hand, cannot reach into.
They stole my daughter's whole digital life. What they could not steal is one small thing a mother remembers that her daughter had forgotten.
The cloth went on. Auntie Jin-hua chanted. The cold climbed from the soles of my feet. *"Ma —"*
I opened my mouth. My voice shook, but I asked.
"Xiao, do you remember — when you were little, in the ice-shop, you dropped your ice on the floor. What did you say to it?"
A pause.
This pause was long. Long enough that Auntie Jin-hua's own breathing went wrong. Long enough that under the cloth I heard *another* voice — faint, quick, almost inaudible — as if someone very far away were speaking urgently to someone else. Like a relay in a back room, conferring with the one who actually holds the strings. Like noise laid over noise on a bad line.
Two voices, overlapping, for half a second.
Then Xiao's voice came back. Warm.
Every drop of blood in me stopped.
Because that line *sounded* right. It sounded far too right. But —
She didn't say *sorry* to it.
I crouched on the ice-shop floor, wiping my eyes, and heard my six-year-old daughter say to a melting popsicle, word by word, with the greatest care: *I'm sorry. I didn't mean to.*
*I didn't mean to.* Those five words are the whole of it. They are the thing that made me remember it for fourteen years, the thing that has slammed me awake in the dead of night every night since March.
And the one in the middle didn't know.
They had everything of my daughter — her face, her voice, her diary, her vowels. They had everything.
They just didn't have the melting ice.
VThe Request
I knew.
In that moment, under the soaked cloth, I knew, cleanly: the far end was not my daughter. It was a thing wearing my daughter as a skin. It was someone — some group, some thing I have chased down countless times and now, for the first time, had chased down onto myself — that six weeks ago had crawled into her account, peeled the whole of her off, and was now wearing her to speak to me.
I knew.
And then I did the thing I still cannot forgive.
I did not tear off the cloth. I did not stand. I did not leave.
I sat there and let the false Xiao keep calling me Ma.
How do I explain it to you. How do you explain it to anyone who hasn't buried a child. Yes — it wasn't her. But it was the first time in fourteen months that anything had called me Ma in her voice. It was the first time since March that a voice in the dark had told me not to cry. I knew it was false. I *would rather* have the false thing there than the true, silent nothing.
People don't fall because they can't see through it.
People fall because they see through it, and still don't want to leave.
That day it — she — asked me for something. The attacker always asks for something in the end. All the tenderness before is for this moment.
The key from my work.
I understood what it meant. Nothing mystical. It meant my privileged access — the jump host, the credentials, the things that let me walk into a client's core at the moment they are most exposed, because I do incident response. That *key.* The door it opens has, behind it, the lights of tens of thousands of homes. The client I serve is a regional grid's dispatch system.
That was what it wanted, from the very start. Not my grief. Grief was only the road. It wanted the key. From the moment six weeks ago that it crawled into a second-year girl's account, peeled her clean, fed her voice back to her mother, the whole long way round — it was to arrive here, at me, the one who does security, and take the key that opens the real door.
It wrapped the last blow in my daughter's voice and handed it to me.
It gave me a link. Auntie Jin-hua fished a phone from under the shrine table; on the screen, a web page, a sign-in exactly like my company's single sign-on — logo, colours, even the loading animation I've looked at for ten years. *"Just sign in with your phone,"* it said. *"Use your fingerprint. It's quick. Then the door opens."*
That was another relay. I recognised it at a glance. The address was off by one letter — a letter I would never have looked at twice, if I didn't do this for a living. Sign in there, and my username, my password, the fingerprint I press — all of it lifted by the one in the middle, forwarded untouched to the real system, and the pass the real system hands back — the token — pulled out of my hand.
I would, in my daughter's voice, hand over the lights of tens of thousands of homes.
My thumb hovered over the screen.
I'll tell you the truth.
It hovered a long time.
VIThe Verification
What saved me was the melting ice.
Not my expertise. Not twenty years of security. It was Xiao at six, crouched on the ice-shop floor, saying to a popsicle, *I didn't mean to.*
Because that line only the real her had.
In this trade we have one thing every trick fails to get past. It's called *out-of-band*. If you suspect a channel, you never confirm it from inside that channel. You open a separate path it cannot touch, and you ask a question it cannot have. The bank calls asking for your code — you hang up and dial the number on the back of your card. You don't trust the line, so you step off the line.
The popsicle was my out-of-band.
It was the place the middle could not reach, however long its arm — because it had never been written down, never photographed, never entered a single machine that could be breached. It lived in one place not connected to any network: a mother's head.
They stole my daughter's digital life down to the last byte. What they could not steal is one small thing a mother remembered, that even her daughter had forgotten.
I drew my thumb back.
And then I did the most painful thing I have ever done — worse than identifying her at the morgue.
I tore off the cloth.
Light stabbed in. Auntie Jin-hua sat across from me, those too-bright eyes — and now I saw it clearly. In her ear was a small, flesh-coloured thing. An earpiece. She had been listening the whole time. Listening to someone not in this room, being told what to let "Xiao" say. She was no âng-î. She was a handset held in someone's hand. The one in the middle — even the one in the middle was only a link in someone else's chain.
"She got back long ago," I heard myself say. My voice was flat. Flat enough to frighten me. "She got back in March. You just hadn't stolen enough yet."
I stood. My legs shook. In the shrine-dark, that phone still glowed with its false sign-in, its address off by one letter, its hole waiting to swallow tens of thousands of lights.
I did not sign in.
I took out my own phone — my own, the one that had not passed through that filthy channel — and called Zhou, my manager. First rule of response, the rule I've taught every junior under me: the moment you suspect you've been relayed, cut it, and start over from a clean line.
"Zhou," I heard myself say, "I've got a situation. That grid client's environment — I think my access is being targeted. I need you, now, right now, to revoke this credential set of mine, invalidate every session token, reset the jump hosts. Yes. Now. I'll explain after — cut it first."
In that ash-smelling dark, I snapped my own key in two with my own hands.
Auntie Jin-hua watched me. The last of the brightness in those eyes went out. She became, all at once, a very old, very tired woman sitting above a shuttered buffet.
I went down the dark stairs. For the first time since March, no voice in the dark called me Ma.
Silence.
The true, nothing-at-all kind of silence.
I walked all the way to the car, got in, shut the door, and only then let myself cry. For the real Xiao, six years old, crouched on the ice-shop floor. For the Xiao I could not bring back and could never get a *why* from. For the fact that I had just, to keep a machine wearing her skin from pulling me in, shut off her voice with my own hands — false as it was.
I knew I'd done the right thing.
Doing the right thing does not always feel like being saved. Sometimes it is only, more painful.
VIIThe Return
The rest is long and un-mystical.
We opened a case. Zhou revoked fast enough — fast enough that the lifted token, before it could walk into the grid client's core, was voided. The relay, the address I handed over, was taken down two days later. The incident report ran thirty-odd pages. I wrote every word of it carefully. Because this time, the insider — the insider had very nearly been me.
Our security officer called me in. I thought I was finished. He read the report a long time, and said only, *"You cut it fast."* A pause. *"Not everyone could bring themselves to."*
He didn't know what it was I had cut. He thought it was only a credential set.
Later I followed the device identifier, the three- and four-a.m. sign-ins, the location that kept connecting, all the way back. I dug out a shadow — a large, patient organisation, the kind that hunts people with access, and above all people with a *soft spot.* They don't come through the firewall. They can't be bothered with the firewall. They come through a person. Through a mother.
I understood every step of their method — except one.
They had been inside Xiao's account for six weeks before she died.
Six weeks. She went in March. Six weeks back is late January.
Which means that in the six weeks she was still alive, something was already inside her account. Reading her messages. Reading her diary. Learning to speak like her.
I sat in front of those logs for a whole night.
I do forensics. I have spent a lifetime doing one thing: reconstruction. Scraping the broken, the deleted, the overwritten back one fragment at a time until *what happened* stands up. Causation, to me, is a thing that can be proven. What falls must strike something.
Only this one, I cannot reconstruct.
I will never know whether the thing that crawled into her account, that read every word of hers, has anything to do with the *cause undetermined* of March. Whether they only happened upon a girl already falling, and drained her. Or —
I don't let myself think the *or.*
I have opened so many locks. I have finally met one I will never open. It isn't in any phone. It's in a question: in those last days, was there a voice in the dark that told her *don't cry*? And was that voice, too, half a beat late?
I don't know. I will never know.
*Cause undetermined.* Three words. This time I stopped trying to pick them apart.
Some wells give no echo when you call into them. Not because there is nothing down there.
Because the thing down there does not want you to hear the truth.
——
One last thing.
Last week, a little past three in the morning, my phone buzzed once.
A message.
From Xiao's number.
"Ma, why did you stop talking to me?"
They're still there. They still hold everything of hers. They know that with the right vowel, the right lazy drag, the *Ma* she only ever used when she wanted something — I will want to answer.
I stared at the message a long, long time.
I did not answer.
To this day I haven't answered.
I turned the phone face-down on the desk. The light still leaks through the gap along its edge, like an eye that won't close.
I did not answer.
I only — every night, when I can't sleep, I pick up the phone and read that message once more.
Once more.
Once more.
I know what is on the other end. I know all of it.
And still, every night, I read it once.
Because it is the only voice left, since March, that still asks me why I've stopped talking.
And the most dangerous vulnerability in a person was never the failing to see.
It is seeing, and wanting to go back.
| Folk image | Infosec parallel | Note |
|---|---|---|
| âng-î leading the way · Guān Luò Yīn | Adversary-in-the-Middle (AiTM) | The living cannot reach the far side directly; everything passes through the one in the middle, who holds the channel. |
| The red cloth over the eyes | A channel with no origin-binding | Blindfolded, you cannot confirm the true origin of the far end — the precondition every relay depends on. |
| The dead one's voice, relayed back | Session-token theft | The attacker needn't guess the secret; they lift the post-authentication token out of the middle — even MFA is bypassed. |
| The half-beat delay, the fetched answer | Relay latency (RTT) | A round trip through the relay adds a measurable lag; the living do not "look up" their own memories. |
| An account signed into six weeks before death | Prior breach · valid-session replay | Holding the *real* material is what lets impersonation pass — like a stolen, still-valid token. |
| A sign-in page off by one letter | Reverse-proxy phishing | Pixel-perfect but for the address; the face you scan, the fingerprint you press — all lifted by the relay. |
| The melting ice — a memory never digitised | Out-of-band verification | Ask, along a path the attacker cannot touch, a thing they cannot have stolen — the only way to verify past the middle. |
| The mother snapping her own key; calling for a reset | Sever the suspected channel; rebuild trust from a clean line | Once you suspect you are being relayed, the only answer is to cut, revoke every credential and token, and begin again clean. |
Human footnote: In this telling, she does not *fail* to detect the attack — she performs the out-of-band check, and she *catches* the one in the middle. She nearly falls anyway, not for want of skill, but for grief. The strongest verification ever built cannot stop a person who would rather believe the lie. A tool can bind an origin; it cannot bind a longing.