This week, US agencies issued Cybersecurity Advisory AA26-097A, warning that Iranian-affiliated actors are actively exploiting Operational Technology — the programmable logic controllers that run water systems, energy grids, and government facilities across the country. They are moving through HVAC systems, elevators, power controls, and building management systems to disrupt critical infrastructure.
I wrote about this exact threat at VA a year ago. The response was polite. The problem remained.
So I wrote a novel.
Buildings are easy to overlook. They are assumed to function. At VA medical centers and clinics, the technology that manages air conditioning, elevators, electrical systems, lighting, and pharmacy dispensers is called Operational Technology — OT. It runs on chips. It connects to networks. And in most VA facilities, it has not been protected the way IT systems are. Cybersecurity efforts have historically focused on software, servers, and networks — the visible infrastructure. OT lives in the walls, in the ceiling, in the basement. It is easy to forget it is there, and it is easy to forget it is vulnerable.
In a LinkedIn article called “Buildings. Who cares? At VA, we all should,” I described what an OT attack would look like: air conditioning systems failing in medical centers, halting life-saving care. Elevators going dark. Pharmacy dispensers locking up. Building controllers cycling on and off with no apparent cause. I argued that securing OT was not optional — it was essential to the mission.
AA26-097A describes the same threat. Adversaries targeting the brains in the walls that everyone ignores. What I wrote as a warning in 2025 is apparently operational doctrine in 2026.
My debut novel. The Janus Protocol, is set inside the VA over a single 36-hour window — Veterans Day eve and Veterans Day. An autonomous cyberweapon called CHARIOT, hidden in the firmware of VA medical devices and building infrastructure, begins executing an attack on veteran healthcare. Elevators go dark. Pharmacy dispensers malfunction. Building controllers cycle on and off. And then — far worse — the electronic health records start lying, displaying false vitals for critical patients while clinical staff trust what they see on the screens.
The heroes are not special operators or intelligence officers. They are a senior IT manager, a geriatrics nurse, a compliance analyst, an executive assistant, and a patient advocate. The people who show up every day and hold the mission together. The people who are still there when the machines fail.
I did not invent the vulnerability. I did not invent the institutional blind spots that allow it to exist. I did not invent the bureaucratic headwinds that make fixing it so difficult. I observed all of it, over decades, from inside the building.
Fiction does something that white papers and LinkedIn articles cannot. It makes you feel what is at stake. Not the budget numbers. Not the compliance matrices. The veteran in the atrium, waiting for an appointment that the broken system will not schedule. The pacemaker that depends on a chip nobody audited. The nurse who trusts her hands over the monitor because she has learned, the hard way, that the monitor lies.
I have been making the policy arguments for years. I have named the vulnerabilities and proposed the fixes. I have outlined the three-point plans and written the LinkedIn articles.
The Janus Protocol is what happens when the warnings go unheeded.
It is scheduled for publication this summer leading up to Veterans Day. The warning is no longer theoretical. The novel is almost here.
In the meantime — VA’s cybersecurity posture cannot stop at IT. Zero trust means nothing if it ends at the firewall while the thermostat has a chip and the chip is exposed.
The buildings are still vulnerable.
The Human Thread
A prequel story set two years before the events of The Janus Protocol. Meet Pat King—the person in the building who sees everyone, forgets no one, and holds the human thread that keeps it all together.
