In April 2004, the President of Georgia is assassinated, allowing Georgian billionaire Kombayn Nikoladze to seize power with a bloodless coup d'état. In August 2004, former U.S. Navy SEAL officer and Gulf War veteran Sam Fisher is recruited by the National Security Agency to work within its newly formed division, "Third Echelon." Working with his old friend Irving Lambert, Fisher is introduced to technical expert Anna "Grim" Grimsdóttír, and field runner Vernon Wilkes Jr.
In October 2004, Fisher is dispatched to Tbilisi, Georgia to investigate the disappearance of two CIA officers. Fisher attempts to meet an informant, Thomas Gurgenidze, only to find him dying in a burning building. Gurgenidze warns that one agent's transmission mentioned proof that could cause a war. Finding the agents' corpses in a police morgue, Fisher learns that a former Spetsnaz agent, Vyacheslav Grinko, removed their subdermal tracking implants. Tracking Grinko's license plate number using CCTV, Third Echelon tracks him to the Georgian Ministry of Defense.
Fisher arrives at the Ministry, and records a meeting between Grinko and Canadian hacker Phillip Masse, through which he learns that Nikoladze is conducting an illegal operation in Azerbaijan. Fisher hacks Nikoladze's computer, and learns Nikoladze has been waging an ethnic cleansing campaign across Azerbaijan, by deploying Georgian commandos. In retaliation, NATO forces enter Azerbaijan, prompting Nikoladze to go underground.
Third Echelon learns that Georgian soldiers stationed on a Caspian oil rig have been exchanging data with the Georgian Presidential Palace. Fisher infiltrates the rig during the middle of a NATO airstrike to apprehend a local technician, Lejava, and retrieve his laptop containing the rig's computer data. After interrogating the technician, Fisher learns that the data contains a file on "The Ark", Fisher recovers his laptop and encryption key and extracts.
Examining Lejava's laptop, Grim reveals that the intel could have come from a CIA mole. Lambert then reveals that North America has just been hit by a massive cyber warfare attack, directed primarily against military targets. In a broadcast, Nikoladze claims responsibility for the attack and officially declares war on the United States and its allies. Fisher infiltrates the CIA headquarters and accesses the CIA computer mainframe, allowing Grim to trace the data leak to the computer of Mitchell Dougherty. Captured for interrogation, Dougherty claims ignorance of the leak, but the NSA learns that his obsessive–compulsive disorder caused him to back up data on an insecure laptop, which was exploited by a network owned by Kalinatek, Inc.
Georgia-hired mafiosos attempt to remove all traces of Nikoladze from the Kalinatek offices by destroying the building and murdering the staff. Intercepting a 911 call from a technician named Ivan, Fisher is deployed to the building and retrieves Ivan's encryption key while the FBI rescues Ivan. Fisher extracts with the help of Wilkes, who is mortally wounded in the process and later dies. Using the encryption key, the NSA discovers Nikoladze has been using a network of unconventional relays to communicate with Georgian military cells. The NSA traces the full relay network to the Chinese Embassy in Yangon, Myanmar. Worried Chinese support could cause World War III, Fisher sneaks into the embassy and eavesdrops on a conversation between Nikoladze and General Kong Feirong, and learns they are working together.
Fisher learns that captured U.S. Army soldiers and high-ranking Chinese officials are in a local slaughterhouse, so he delays interrogating Feirong to save the hostages, who are scheduled to be executed on a live broadcast. Fisher meets with a Chinese official among the hostages, and learns that Feirong is part of a rogue collective not backed by the Chinese government. Fisher is detected, and in a firefight, Fisher kills Grinko. Returning to the embassy, Fisher grabs a drunken Feirong before he can commit suicide, and forces him to share the information stored on his computer; the information reveals Nikoladze has fled back to Georgia, where he is trying to activate a suitcase nuke known as "The Ark".
Infiltrating the Georgian Presidential Palace containing Nikoladze and new de facto Georgian president Varlam Cristavi, Fisher attempts to recover the key to the Ark, which has been placed somewhere in the United States. Fisher corners Nikoladze, who bargains to give the Ark key in exchange for safe passage out of Georgia; before Fisher can recover it, Cristavi soldiers take Nikoladze and the Ark key elsewhere. About to be executed, Fisher escapes when Lambert causes a brief blackout. Discovering Nikoladze is offering the Ark's location for protection, Fisher assassinates Nikoladze. Discovering the Ark, the U.S. Army evacuates an apartment complex in Hope Gate, Maryland on claims of a gas leak, and secretly recovers the Ark.
Despite World War III being averted, Nikoladze's corpse sparks international backlash due to the suspicious circumstances around his death. Watching the Presidential broadcast on the crisis, Fisher then receives a secure phone call from Lambert for another assignment.