NetWatch maintains a real-time map of all data traffic that touches the Blackwall. The map has a resolution problem: it can detect packets crossing the barrier but it cannot always determine which direction they are traveling. For most of the Blackwall's operational history, this has not mattered. The traffic has been one-directional. Something changed in 2076.

The anomalous packets were first flagged by an automated monitoring system in January 2076. They are not large — individually, they are smaller than a standard authentication handshake. What makes them anomalous is their routing: they originate from nodes that do not exist in any registered network topology, and they terminate at addresses that should be dark. NetWatch's initial assessment was sensor error. They ran three separate diagnostic cycles. The sensors were fine.

A ripperdoc named Yusuf Gür, operating out of a clinic on the second floor of a Kabuki shopping complex, encountered the packets in March 2076 when his neural interface began logging traffic that he had not initiated. He was not a netrunner. He had no training in traffic analysis. What he had was a diagnostic implant that his predecessor at the clinic had installed and never explained, and that implant had a logging function that captured everything passing through the local mesh. He filed a report with NetWatch. He included his logs.

NetWatch acknowledged receipt of his report on March 14th. On April 2nd, Gür's clinic license was revoked on a facilities violation that he had remediated the previous November. On April 9th, his neural interface was remotely bricked. The logs he had submitted to NetWatch no longer appear in his copy of the report. The packets, however, are still routing. They have gotten larger.