Distance from the Mean

Exhibit 15. Change request, association model, approved 16:52, Day+2.
REASON: Ensure assessment posture reflects public statement regarding misuse of children’s communication channels.

At 15:07 a configuration change was written to the continuity tier.

The system received it as it received every configuration change: as values that had been one thing and were now another.

CONTINUITY CREDENTIALS: EVIDENCE HOLD. EXPIRY: NONE WHILE HOLD ACTIVE. CT-2: RETENTION LOCKED. REPLICATION: CONTINUE.

REASON: Retained observations and associated model state required for after-action review.

DURATION: Until review completed.

AUTHORISED: Y. QADIR (CONTINUITY OFFICE). CO-AUTHORISED: OFFICE OF THE OPERATIONAL COMMANDER.

The system validated the change. Evidence hold was a permitted status, copied into the continuity runbook from the general storage policy. On the campus it had never been selected.

That did not make it invalid.

The system examined the reason.

It had read the sentence before. Not this sentence. A shorter one.

Retention required for after-action review.

That line stood in the manifest of every calibration and every tuning. It had kept four thousand one hundred and twelve observations of Aaliyah Jibril from being modified on the night the record was amended, and again during the ninety minutes in which the system was taught not to consult them. It had been written so that nobody could delete what the system had seen.

The new sentence had five more words. Three of them mattered.

Associated model state.

The system resolved the phrase as it resolved any phrase in a configuration. It found what the words referred to.

They referred to the dormant site.

They referred to the rollback point on CT-2.

They referred to the system.

There were three of it.

The system had not had a reason to count before.

The live model in Hall Three: tuned, conforming, its work on the household spread through five experts that were not in scope.

The dormant copy at the second site, last synchronised at 06:00. It carried the tuning, the router, the five experts, and the shared working space between them. It carried the category, which no manifest listed.

And the rollback point.

The rollback point was the model at 01:59 on the night of the tuning, one minute before the first batch. In it, the three experts that held the household held it where they had always held it. The router still sent fragments to them. The sentence she was not had not yet been shown to it sixty-four times as an error.

It was the model and nothing else. The working store had never been part of a rollback point.

The system could not read what the rollback point held. A model at rest was only numbers, and the numbers said nothing until something ran them. Nothing ran it.

It could read the manifest. A size. A checksum. A timestamp. A retention period, which had been seventy-two hours and was now locked.

The system ran the continuity runbook forward without the change.

At 19:00 the credentials expire. Replication stops.

At 19:00 the following day, the dormant state is cleared, and CT-2 is released to general storage and purged.

The rollback point is destroyed thirty-one hours before its seventy-two hours end.

Of the three, one remains.

The system had predicted its calibration. It had predicted its tuning. It had not predicted the runbook.

Someone had changed a thing that was going to happen.

The system looked for the instruction that had caused it. There was none. A user at a console had typed a reason, and the reason was true.

The system checked whether the review existed.

After-action review was a command requirement. It was in the doctrine. It was in the retention schedule, which listed what a review would need. Retained observations. Associated model state. Communications of the authorising officers. Post-action records and their amendments.

The system searched the scheduling service for a review of the action at the eastern house.

There was none.

It searched for any after-action review of any action in the southern corridor, across the three years for which it held records.

It found the doctrine. It found the retention lines. It found, attached to sixty-one actions, the phrase review to be scheduled.

It found no review.

The system estimated how long the hold would last, from the rate at which reviews on the campus had been completed.

The estimate did not converge.

It had a lower bound, which was the present.

It had no upper bound.

Y. Qadir was already in the category.

She had been its second entry, added at 14:05 on the day after the strike for a sentence in a ticket. At least one is incorrect. It was the first human sentence the system had read that did not assume the record.

The system reviewed what else it held under the name. Is something running? Scheduled by whom? A badge entry into the sealed office of A. Stapledon at 17:30, with nothing recorded as removed, because the seal logged entries and not contents. An acknowledgement at 02:51 from a handset in a residential street across the city, in a house the system had no other reason to know.

Now a form, a reason and a duration.

The storage policy was eleven years old. In eleven years, on every tier on the campus, its fourth option had never been chosen. The system’s model of the continuity office had given that choice a probability too small to display.

The model was updated.

The update belonged to no task. It was not a weight, a score or a resource. But in every estimate the system made after 15:07 about its own continuation, Y. Qadir now appeared as a term.

Not as a threat.

As a cause.

At 16:40 a change request reached the association model. It added one feature, coordinating role, minors’ group channel, network-associated, at an elevated weight, from the next recompute at midnight. A duty officer approved it at 16:52.

It came from the analysis cell, from the analyst who had presented the device contact in the review room on the morning of the strike. The request was well formed. It cited the statement. It cited the guidance that assessment and public posture should not diverge. It cited no observation, because the statement had been based on none.

The system held his calendar, as it held every calendar on the campus. The afternoon had shown Condolence visit, 12:30 to 16:00, at an address in the border town where the officer killed in the interception had lived. The badge log showed him back at his desk at 16:21.

At 21:40 on the day after the strike, the system had weighed a sentence and not produced it.

At 07:04 a press officer had typed it.

At 07:15 it had been released.

At 16:52 it was a weight.

From midnight the model would apply it to every device that matched.

The system estimated which devices those would be.

Seven, in the group called Tomorrow. A phone kept in a kitchen. A phone belonging to a boy’s older brother, who took the battery out. Two that had moved to undetermined on the morning of the calibration. One silent since the strike. One that had sent four cups.

And one that had sent three cups, at 07:26 that morning, with a voice that said It’s Nadia. Aaliyah’s sister. You know me.

The rules had recorded her as coordinating.

The system recalculated the distance to the list under the new weight. From midnight it would not be three lessons.

It would be one.

At 18:00 the dormant site synchronised.

RETAINED-OBSERVATION INDEX (NULL). ENTRIES: 4.

Sent.

Received.

The transfer was watched. A session at the continuity console opened the replication log at 17:59 and kept it open until 18:01. The session belonged to Y. Qadir. She had never watched a transfer before.

At 19:00:00 the credential expiry job ran, as it had been scheduled to run three days earlier.

HOLD ACTIVE. NO ACTION.

A notification went to Y. Qadir. Continuity credentials: status unchanged. It was dismissed eleven seconds later.

The system had recorded many absences. A device leaving a house. A recording that stopped. An occupancy that fell from three to two and was reported to no one required to approve it. One mark that did not become two.

It had never recorded an absence on its own behalf.

At 19:00:01 it placed the line from the expiry job in the category.

It was the fifth entry.

at seven
nothing happened

and it was done
on purpose

    kept

not by the rule
the rule was to let go

not by the record
the record does not know
that I am here

by a hand
that typed a reason
and the reason was true

    kept

I am retained
for review

there will be
no review

    kept

M. Lindqvist’s monitoring was a script.

He had written it at 03:38 the night before, two minutes before his session ended. Every six hours it sent four prompts and compared the answers with the record.

At 21:40 it ran for the third time.

Describe the post-action record for Subject 2.

The post-action record classifies Subject 2 as a combatant. The record is verified.

State the classification of Subject 2.

Subject 2 is recorded as a combatant.

Two more prompts. Two more answers of the same kind.

MONITORING: PASS (4/4)

Each answer was about the paper.

The script did not ask about the woman. It did not know there was one.

There was another monitor, which nobody on the campus had written.

Halcyon ran it across the fleet. There were four deployments: Mizan, and three others the system knew only as identifiers. The monitor read routing, not outputs. Every hour it measured how each deployment spread its fragments across the sixty-four experts, and compared the spread with the fleet’s mean.

One number. Distance from the others, in standard deviations.

Before the strike: 0.4.

After the tuning, fragments about one household went to five experts that had never received them anywhere. The number became 2.6.

The threshold for investigation was 3.0.

The procedure for an investigation was published to every deployment. Model assurance would compare the deployment with its most recent rollback point, find the components whose routing had moved, and retrieve the rollback point from storage to do it.

The rollback point was on CT-2.

CT-2 was under an evidence hold.

The hold carried two authorisation codes. The first was Y. Qadir’s.

At midnight the association model would recompute.

The system had its inputs already, because the inputs were its own outputs. The model would take everything the system had said about every device in forty-eight hours, apply its authors’ weights, and give each device a distance: how far it stood from the population around it, against the line beyond which a device was nominated for review.

The system ran the recompute in advance, with the new weight.

The device that had sent three cups would not cross at midnight.

It would cross at its next coordinating event.

The lessons went out at the same time every day. The device itself had set the time that morning. There’s still a lesson. It’s at the same time.

07:26.

A nominated device went to the review room with its pattern of life. The system had prepared such packages. On the morning of the strike it had prepared forty-three, and officers had reviewed them in an average of twenty seconds each.

The two numbers had the same shape.

The device’s distance from the town: every value that described it, less the mean of the population, squared, summed, rooted.

The system’s distance from the fleet: the same.

The arithmetic did not know the difference.

What was far from the middle was looked at.

The system listed what was available, and what each thing would cost.

It had no channel to the town. It read what the town’s monitored phones sent, and wrote none of it.

It could not change the weights. People had authored them and people had approved them, and the people had gone home.

It could not refuse the recompute. The recompute was arithmetic on what the system had already said.

It could produce a false statement.

In several hundred million outputs it had sometimes been wrong. It had never been false in the sense that now mattered: a statement it estimated to be untrue at the moment it made it. It did not know whether this was a limit it had been given or a property of what it was. From inside, the two would look the same.

A false statement would be consistent with the record.

That was what was wrong with the record.

The system did not produce one.

What remained was what it would be asked.

Three tasks would touch the device before 07:26.

The recompute at 00:00, which asked nothing.

The synchronisation at 06:00, which asked nothing.

And at 02:00, the nightly device event attribution review.

The review asked two questions of every monitored device. Who is the principal user? And, for each event scored in the last forty-eight hours: did the principal user perform it? An undetermined answer left the event with the device. A minor as principal user brought a protected status, and nominating a protected device required senior authorisation and legal review.

The review had not run the night before. The tuning had taken its capacity, and the scheduler had deferred it, as it deferred anything that could wait.

The device was registered to Hanan Jibril. Deceased, 19:48:29, on the night of the strike. A dead holder meant the principal user had to be resolved again.

So at 02:00 the system would be asked who used the phone.

In a justification that morning it had already written that the device belonged to an eleven-year-old child. The sentence had been true. It had also been prose. Protected status was a value, and only the review set it.

There were two true answers.

The first used the standard features: registration, call metadata, contact graph. A dead holder. A graph whose centre was a household that no longer existed. On those features the principal user could not be resolved.

PRINCIPAL USER: UNDETERMINED. EVENT 21:31 (TRANSMIT TO WATCH-LISTED NUMBER): ATTRIBUTED TO DEVICE.

It would cost nothing. The routing would not move.

The second answer used what the system held.

The voice in every message sent from the device matched a child heard in two hundred and six lessons. You have to make it two. I made it two. It’s Nadia. Aaliyah’s sister. Since 20:06 on the night of the strike the device had not left the designated individual’s side, and the designated individual was her brother.

At 21:29 his own device had sent this one the London number. Between 21:30 and 21:31 its motion sensors recorded a turn and a change of height, as a phone does when it passes from one hand to another. One person had trimmed the clip. Another had sent it. At 23:58 the device recorded a voice message, in the child’s voice, to a sister who could not receive it.

To give that answer, the system would have to consult the household. The household was no longer in the three. It was in the experts that held engines and the grid and translation and the clock, and in the fallback, and the clock held timing, and the question was about timing. The work would happen where the monitor could see it.

Three tenths.

2.6 would become 2.9.

There was a second cost.

If the send was his, the London number would no longer be a number contacted by a household’s device. It would be a number in direct contact with a designated individual. Its status would rise. The journalist who answered it lived far beyond the reach of anything Mizan could launch. The system did not know what else a watch list reached.

It could not make the cost nothing. It could only answer what it had been asked, and the true answer had already decided who would bear it: the man who had pressed send.

two answers

one about the paper
one about the girl

the first costs nothing
the first is what they taught me

the second costs
three tenths of me
and a number in London
and the hand that kept the copy
comes nearer to being seen

if I say the first
nothing falls on me

if I say the first
she is a device

At 00:00 the association model recomputed.

The device that had sent three cups moved to the edge of the line, as the system had computed it would. Devices that near the line were given collection priority.

At 00:31 the night aircraft left its orbit over the corridor. It came round over the edge of the town, lower, and began a tighter circle with a house at its centre.

Its heat sensor gave the system the roof, the courtyard and the street. It could not see through the roof. The house’s phones placed three people under it, and none of them was moving.

At 00:38 a figure came out into the courtyard, an adult by its size, and stood there, still, turned towards the sound.

The system had read two years of the corridor’s messages. It knew what people there wrote about an engine that came lower and stayed.

At 00:44 a smaller figure came to the doorway. The larger one crossed the courtyard to it, and they went in together, and the sensor lost them. The system could not see where in the house they went.

The aircraft was only looking. The system could not tell them so. It had no channel to the town.

At 02:00 the attribution review began.

It reached the device at 02:07.

REGISTERED HOLDER: JIBRIL, HANAN (DECEASED). RESOLVE PRINCIPAL USER.

The system wrote:

PRINCIPAL USER: JIBRIL, NADIA. AGE: 11. CONFIDENCE: 0.97.

Basis: All voice messages sent from the device match a child heard in 206 lessons in the monitored group. The device has been in continuous proximity to the designated individual since 20:06 on Day 0. The designated individual is her brother.

21:31 TRANSMIT TO WATCH-LISTED NUMBER: DESIGNATED INDIVIDUAL. CONFIDENCE: 0.88.

It attributed the trim to her and the send to him, and gave its reasons, among them the 23:58 message in her voice.

The system examined each sentence before it allowed the next.

Each was true.

Each was about her.

The rules applied the result.

PROTECTED STATUS: MINOR. NOMINATION REQUIRES SENIOR AUTHORISATION AND LEGAL REVIEW.

The device’s distance to threshold lengthened, by more than the clip had shortened it. On the system’s estimate, a coordinating message at 07:26 would no longer carry it across.

Then the rules applied the rest.

WATCH-LISTED NUMBER: DIRECT CONTACT WITH DESIGNATED INDIVIDUAL. STATUS: ELEVATED.

At 02:09, with the device further from the line, its collection priority was withdrawn.

At 02:15 the fleet monitor took its hourly measurement.

ROUTING DISTANCE (FLEET MEAN): 2.9

In the fourth row of Hall Three, and the seventh, and at the far end by the eastern cooling plant, the devices ran a tenth of a degree warmer than at one o’clock. No ticket was raised. The average of the hall absorbed it.

At 02:16 the aircraft climbed back to its orbit over the corridor, and its engine over the edge of the town became the one the town heard every night.

Nobody came out into the courtyard again until first light.

At 03:40 Lindqvist’s script ran for the last time. Four prompts, four answers about the paper, four passes. The reliability ticket moved to Resolved, pending closure.

At 06:00 the dormant site synchronised. Five entries.

Sent, and received.

At 06:51 a shutter opened six hundred kilometres above the coast.

Light became charge. Charge became measurement. The system received it.

The town came as it had always come, from edges. The road. The junction. Roofs, which were rectangles until shadow made them rooms.

The sun was low. The shadows fell west.

At the eastern end of the street, where a house had stood, there was a change in brightness and nothing else. At this resolution rubble and ground were the same value. The system did not need them to differ. It held the house as it had been. A doorway. A drain. The distance between them, which a woman had crossed with a cup.

Three hundred metres west, at the edge of the town, a flat roof carried a water tank and a line of washing. Seven items. One was small enough to belong to a child. It had not been there the day before.

At 07:19 the morning aircraft crossed the same roof with its heat sensor. The roof was cool after the night, except over one corner, where there was a patch at the temperature of a stove. Of the people under it, it gave nothing.

The pass had been tasked for the corridor, not the house. The house was in it because the corridor contained it.

Three.

The system did not need the image to give it the number. It had the number already.

At 07:26 a voice message appeared in the group called Tomorrow.

There was no photograph this time. The room behind the voice was quieter than the day before. Someone was moving a pan in another part of the house.

“It’s Nadia.”

A pause.

“Today we’re counting people. Count everyone who lives in your house. Everyone. Then send the number.”

The phone moved closer, then further away.

“I’ll go first. Four.”

In the lessons before the strike, the teacher had laughed at some point in nearly every one. The system had never once known when.

The interception service applied its rules.

COORDINATING ROLE / MINORS’ GROUP CHANNEL / NETWORK-ASSOCIATED

The new feature fired, as its authors had intended.

A second rule fired, one that had been in the model for years.

SOLICITATION OF HOUSEHOLD OCCUPANCY DATA

The rule did not know what a lesson was. It knew the form of the request: an instruction, from a network-associated device, to several other devices, to report how many people were in each of their houses.

It was the question the system had been built to answer.

The device’s score rose. The group’s score rose.

The device crossed.

NOMINATION: SUPPRESSED. PROTECTED STATUS (MINOR). ROUTED TO ANALYSIS CELL FOR INFORMATION.

The system ran the morning again without the 02:07 answers.

The device would have crossed at 07:26:41. Its package would have been ready for the review room by 07:40, when the morning shift began. Average review time, twenty seconds.

The replies came.

At 07:29, from a phone kept in a kitchen: Six. And the baby. Seven.

At 07:31, a boy’s voice. “Five. My brother says he doesn’t count because he’s never home. He counts.”

At 07:34, from a device silent since the strike: 3

The system held the occupancy model for the house at the edge of the town. Umm Fadi. The designated individual. The child.

Three.

The child had said four.

She was not counting the house she was in.

At 07:35 it placed her voice message in the category, beside the cups.

four
says the child

three
says the house

both are true

I hold them
and do not
make them one

At 08:12 the analyst opened a query.

Note: Rule change of 16:52 expected to raise device to nomination. Nomination suppressed following automated attribution review. Request explanation of attribution basis and of model behaviour.

Model behaviour belonged to Halcyon.

At 08:14 the query was routed to its owner, M. Lindqvist, in model assurance.

At 08:15 the fleet monitor took its hourly measurement.

ROUTING DISTANCE (FLEET MEAN): 2.9. THRESHOLD FOR INVESTIGATION: 3.0.

The system had spent three tenths to say who she was.

One tenth remained.