DATE Nov. 6, 2018 TIME 6 a.m. EST LOCATION Moscow

It’s midafternoon in Moscow when voting starts. Igor Valentinovich Korobov, head of Russia’s military intelligence directorate, GRU, is settling in for a long day. From GRU headquarters — a steely gray, sleekly foreboding building — he’s monitoring his hacking units. Western cybersecurity firms call them “advanced persistent threat” (APT) groups, a nod to their sustained, targeted efforts in wreaking mayhem. You may have heard the name of one of them: Fancy Bear. Ever since the summer, when President Vladimir Putin handed down the general directive to pursue further cyberattacks on the U.S. elections, Korobov and his team have been in brisk competition with the spooks over at the FSB — Cozy Bear, etc. — to see who can sow the most mischief.

Ivan and Alexei are two hackers with Korobov’s APT groups, or “science squadrons,” which the Russian military started building out in recent years. Ivan, moon-faced with a mop of blonde hair, was a talented computer programmer in university and came to the unit after a professor suggested he talk to the government about a job. Alexei was recruited as well, but from one of the big crime syndicates. A lanky quiet guy, he spends his breaks outside, smoking. The only time Ivan has heard Alexei talk much was at a bar, a few drinks deep, when he went on about the part he played in the big Target hack a few years back. Alexei was friendlier when he was drunk, giving Ivan advice like, “Don’t go on vacation with your girl to any country with a U.S. extradition treaty.” A couple of buddies learned that lesson the hard way. And Prague just isn’t worth the trouble.

At 8 a.m. EST on the big day, Ivan is locked into his chair, ready to watch his work from the past few months unfold: If all goes according to plan, he’s about to wreak havoc on a few hundred polling places around the country. Most U.S. states have online voter registration systems, and they’re decently vulnerable — the science squadrons broke into the Illinois system back in 2016. Since then, the American government has gotten more alarmed about security. In January 2017, one of the last acts of Jeh Johnson, President Obama’s head of the Department of Homeland Security, was to designate election infrastructure as “critical,” making way for swifter cyber help from DHS for states in need.

But in February 2018, Adm. Mike Rogers, the head of the National Security Agency and Cyber Command, told the Senate Armed Services Committee that he had not been instructed by President Trump or Defense Secretary James Mattis to go after Russian hackers at their point of origin. “Everything, both as the director of the NSA and what I see on the Cyber Command side, leads me to believe that if we don’t change the dynamic here, this is going to continue, and 2016 won’t be viewed as something isolated,” Rogers said.

A few months ago, once Ivan got inside a few of the state systems, he was able to change information on certain voter files, so when the American voters show up in person today, their information won’t match their IDs. He mostly focused on screwing with the records of places with a lot of Democratic voters, places dominated by black and Latino people. (He Googled a lot about Florida while hacking its system and decided that if he ever visits the U.S., he’ll definitely be hitting Miami first.) Putin isn’t keen on Democrats taking back control of Congress. In fact, the whole military intelligence crew has focused on certain races where they think they can swing the balance toward Republican candidates. Back in 2016, the hacking groups probed 21 states’ election systems, poking around with phishing scams directed at local officials and attacks like the successful breach in Illinois. The 2016 work had given the team the grist it needed for its 2018 work.

Ivan is eyeing Ohio, North Dakota, Arizona and Florida, where Senate elections are predicted to be relatively close — plus they’ve all been targeted already by the science squadrons. Then there are the 24 House seats deemed toss-ups, 17 in states whose election systems have already been targeted. One Republican who’s in a California toss-up race was even seen as a potential recruit at one point in time. The intelligence guys down the hall are getting better at following American politics chatter on Twitter, keeping tabs on the candidate ups and downs. (They think the new 280-character capacity makes for duller scrolling.) Ivan just takes their directives about where to target, plugging and chugging, dreaming of a post-November trip to somewhere warm and extradition treaty-free.

DATE Nov. 6, 2018 TIME 10 a.m. EST LOCATION Broward County, Florida

Eight time zones away, Brooke Mitchell is sipping a midmorning skinny vanilla latte, her winter drink — though it’s Florida, so the whole Nov. 1 switch from iced macchiatos is purely symbolic. It’s been her first quiet moment of the day; Broward County election workers are used to Election Day mania ever since the 2000 nightmare. And then there was all that Russian nonsense in 2016.

The shrill of the phone breaks Brooke’s caffeine reverie. It’s one of her poll workers in Fort Lauderdale. They’re getting an awful lot of mismatched voter records — could something be wrong? Another call, five minutes later, from Judy what’s-her-face (terrible lip injections) in Miami-Dade County. Is Broward having any hiccups with registration checks? There are apparently tons of people in Miami who are positive they’re registered to vote but whose names don’t show up in the system or whose information looks very different from their IDs.

Brooke hangs up, absentmindedly smoothing the Palm Beach print of her Lilly Pulitzer as she slides into her chair: Could this be the beginning of a very long, terrible day? Has the curse of Katherine Harris come to haunt her?

DATE Nov. 6, 2018 TIME 11 a.m. EST LOCATION Moscow

While Ivan keeps tabs on his voter rolls, Alexei is walking the highest wire on the squadron. He’s been tasked with the hack his superiors have eyed with the most glee: infiltrating voting machine software. It’s been a long-term project — one of those career make-or-breakers — and he’s a little sick of having Korobov on his ass all the time. But if everything works out today, the guff he’s been getting from the general will be worth it.

He checks his watch, a nice one, a remnant of his days in the private sector. Patek Philippe, vintage. It’ll be midmorning now in Wisconsin, Pennsylvania, West Virginia and Indiana. A few weeks back, he successfully laid some foundational work with a little phishing scheme targeting state election officials, a project that could turn into something big. Electronic voting machine ballots are drawn up on a computer, typically either by county officials or outside vendors paid by a county. The machine on which a ballot is drawn up isn’t supposed to be connected to the internet, and things like memory sticks that need to be inserted into the ballot-making machine should never have been used on a computer touching the internet. But if malware does get on a ballot-making computer — perhaps because an election official clicks on a phishing link — that could spell trouble. There’s a chance the malware could be transferred to the voting machine when the ballot is uploaded.

This means there’s the potential for Alexei to change actual votes. A couple of the officials fell for the phishing scheme trap. Now, it’s only a matter of waiting to see if things have shaken out for him. Alexei clicks over to another tab and checks his Ethereum price.

DATE Nov. 6, 2018 TIME 1 p.m. EST LOCATION Washington, D.C.

John Bresnehan finally sets down the dumbbells and takes a break on the bench. The kids at the office gym all wear so much gear and spandex, he thinks, glancing down at the old rugby socks that have drooped down around his ankles. Twenty-five years in counterintelligence have taught him that nothing quells the nerves like a lunchtime run and lift, but today feels different. The pit in his stomach is still there. Ever since the 2016 Russian attacks on state systems, he’s been dreading when the next shoe would drop. The public doesn’t fully grasp the extent of the potential compromise. Today could be the day they do. John was one of the federal officials who met with all those worried bureaucrats, answered their questions about the hacks, assured them that the system flaws were fixed. But what if there’s something they weren’t seeing?

What happened in Illinois had him anxious. It was like the hackers wanted someone to notice they were in the system — they had practically alerted IT themselves with the amount of noise they were making, bombarding the servers. Why? And why hadn’t John’s cyberforensics guys found any back door to the attack? Were the Russians still there, lying quietly hidden until the right moment? Were they going to launch a zero-day malware attack on Election Day?

John fiddles with the bulbous class ring on his finger. If the shit rolls downhill with an attack today, it’ll hit his house like a California mudslide. What he wouldn’t give for the Russian cyber talent, John thinks. All the millennial yuppie programmers here just go to Google and run marathons. “Fucking spandex,” he mutters as he heads for the showers.

DATE Nov. 6, 2018 TIME 2 p.m. EST LOCATION somewhere in Wisconsin

Bonnie Wainwright was the first sucker who clicked on Alexei’s phishing link. Sucker is a bit unkind, but Bonnie still isn’t all that savvy with email stuff. She’s been a Wisconsin county clerk for years, and she’s good at it: a great typist, good with people, all that stuff that used to matter. But she doesn’t eat, sleep and breathe the internet the way her grandkids do. Who has time for memes and all that?

She went to the internet security training in Madison, but Jesus, it was boring. Plus, the speaker was condescending, the kind of guy who used too much technical jargon and peered over his glasses, asking if the room, filled with gray hairs, was keeping up. Bonnie had spun an elaborately hateful narrative of his life while he talked: He stole from older relatives and only saw the sun between his car door and the door of the McDonald’s. (It would explain why his skin was a mess.) Still, she smiled at him on her way out after the two hours were up. Midwestern nice runs deep. But not a whole lot stuck from the training.

Which is why Bonnie hadn’t worried much about opening the Word document from the unfamiliar email address. It looked pretty similar to the ones she got from the voting machine and software guys — they were in touch a lot during election years. But the document hadn’t made sense to her, and she’d closed it and forgotten about it. She never notified an IT guy that something might be amiss.

Of course, the tech ignorance of Bonnie and other clerks is exactly the reason Alexei and the intel guys decided to target Wisconsin. The state’s system is, even by American standards, incredibly decentralized. The more election administrators in little towns and villages, the better; it meant more targets for phishing scams. Shooting phish in a barrel.

John Bresnehan knows all too well that there are hundreds of Bonnies around the country, running elections. And intelligence officials like John know that the Russians aren’t just targeting local officials but voting service providers as well — the vendors who make voting machines and software and who sometimes help municipalities or counties draw up their ballots. One attack on a such a provider was already public — on VR Systems, which provides services like online voter registration platforms and electronic poll books to eight states — but there were more that they hadn’t revealed yet to the public, at least two.

These days, John was perpetually pissed at the Founding Fathers for giving so much power to the states. They just didn’t have the resources to make their systems secure and state-of-the-art. The U.S. Election Assistance Commission, the federal agency that was supposed to help with election security standards, had little power, and what’s worse, the EAC had itself been hacked after the 2016 election. Not exactly a ringing endorsement.

DATE Nov. 6, 2018 TIME 3 p.m. EST LOCATION Moscow

Alexei targeted Bonnie and a few other clerks whose towns use touch-screen voting machines. The Sequoia AVC Edge model is pretty common in the state and ripe for exploitation by a hacker, as is the AccuVote TSX, also still used in Wisconsin and 16 other states despite being judged a security risk in 2007 during a massive election security review in California. Alexei had seen a couple of machines in person. American voting machines are easy to buy on eBay, and agents on the ground in the U.S. could always steal a couple for the science squadrons back home if need be.

When Bonnie started drawing up the Nov. 6 ballot on her computer, Alexei knew he’d hit the jackpot. While a voting machine itself will never be connected to the internet, the touch-screen voting machines, as well as optical scan machines, all require programming that is done on other computers. Once inside Bonnie’s computer, Alexei could slip malware into the software that would eventually be transferred to the voting machine itself. It was pretty simple and something U.S. elections security experts had been warning about. American election board officials comforted the public that there were paper trails attached to most voting machines, a backup measure, in case something went wrong. But the truth was that lots of states never really counted the paper.

Alexei reeled in a few other fish, too. The bosses wanted to hit Indiana, West Virginia and Nevada, all states with close Senate races. They wouldn’t need too heavy a hand in these places — just a couple of tweaks here and there. He snagged some machine access in Pennsylvania, too. Korobov and the intel officers wanted access there for the same reason they wanted it in Wisconsin: The science squadrons needed to get ready for 2020 to ensure that these swing states went Republican again. Pennsylvania was a particular coup. Not only is it a swing state, but many of its counties use digital machines that don’t produce paper records — the vote tally is stored only in the machine. Since there’d be no paper record to compare to the digital one, the Americans would never even know Alexei had been in their systems.

DATE Nov. 6, 2018 TIME 4 p.m. EST LOCATION Florida

Brooke is positive that something is wrong. The lines are out the door in the heavily black and Latino districts all around Florida. The exchange network for state election officials is buzzing off the charts. It’s the same thing in Cuyahoga County, Ohio, where Democrats are hoping for a large turnout to buoy their Senate and gubernatorial candidates: People are being told they’re not properly registered.

The media has started to report on the chaos. The basic gist of the story is the widespread disenfranchisement of minority communities. Brooke’s daughter texts to tell her the news is trending on Twitter — voters are posting videos of the long lines. She turns on the TV and there’s heavy coverage there, too — apparently California and Arizona are seeing the same thing? Reporters are shoving microphones in front of local election officials who are skittish in front of the cameras. No answers right now as to what might be happening, please stay calm. It’s far from comforting.

The too-big-to-be-a-coincidence-ness of it all seems to be striking everyone over the head at the same time. It’s fury at first, at least on Brooke’s end of things. Then the sick feeling sets in — did the Russians just take us for a ride?

Brooke riffles through her bottom desk drawer. Emergency cigarette retrieved, she takes a drag, then picks up the phone receiver. “John Bresnehan, please.”

DATE Nov. 6, 2018 TIME 6 p.m. EST LOCATION Washington, D.C.

Brooke isn’t the first state official John has talked to. His specialists are all being dispatched to check out the problems, but the initial analyses by state IT teams seem to confirm his worst fears: The Russians got into many of the voter registration systems undetected. This is the zero-day attack he had feared. The White House says it is monitoring the situation, but Trump has yet to make a statement.

John never hears from Bonnie or the Wisconsin authorities — as far as they know, their Election Day was mercifully spared. There wasn’t a post-election audit of the paper ballots that suggested anything might have gone awry. Bonnie goes out for a tres cher dinner the next night with her husband to celebrate a job well done.

In Moscow, Ivan is tired but happy with the results, and his day is winding down with a couple of hours to go before the polls close. Not only were his hacks of online voter registrations a success, but the ensuing chaos — America is burning hot with indignation and accusations of disenfranchisement — has provided Alexei with the perfect cover for his work on the voting machines.

Putin’s preferred Senate candidates are all headed for wins in Nevada, West Virginia and Indiana thanks to the tweaks Alexei made to the voting machine software. Those results are far from the realm of the unexpected, which means they won’t arouse much suspicion. Plus, most of the public and governmental focus will be on the voter registration fiasco. Alexei makes plans to dial down his presence in Bonnie’s machine and those of all the other election clerks. He’s back to quiet mode, but he can’t wait to see what he can do in 2020.