Part 7
“Yes.”
“And that suspicion led you to use the dormant credential.”
“No.”
Naomi looked up.
“The absence of badge events led me to request the raw access-control data. The institute denied the request. Jonah located an earlier export showing that the events had existed before a system migration. The credential was used to search for continuity records explaining the discrepancy.”
Rachel touched Mara’s sleeve, a warning against turning explanation into advocacy.
Naomi asked whether Mara had considered seeking a court order or requesting outside counsel before accessing the system.
“Yes.”
“Why did you not?”
“The hearing was scheduled for the next morning. The vendor’s standard retention period was thirty days. We were on day twenty-nine from the archive entry.”
One forensic specialist leaned forward. “How did you know the retention period before finding the insurance file?”
“An invoice code referenced hosted video continuity. Jonah called the vendor anonymously and asked about standard service tiers.”
“Did he misrepresent himself?”
“He asked a general sales question.”
“Did he identify the institute?”
“No.”
Naomi’s expression did not change. “So you believed evidence could be deleted within hours.”
“Yes.”
“Did you know whether deletion would be automatic?”
“No.”
“Did you contact the vendor under the audit authorization already in place?”
“The institute had instructed vendors not to communicate with us.”
“Did you ask the governance committee to issue a preservation demand?”
“Yes. At six forty-two the previous evening.”
“What response did you receive?”
“None before we accessed the directory.”
This did not make the decision proper. It made it understandable, which was both better and worse.
The interview lasted six hours.
During a break, Mara stood by the window and watched traffic move along Route 10. A delivery truck remained in the same turn lane through two light cycles because no one would let it merge. The driver rested one arm outside the window and did not honk.
Rachel joined her with two paper cups.
“The coffee is terrible,” she said.
“I have heard that is useful when angry.”
Rachel handed her a cup. “Your assistant’s interview is tomorrow.”
“I know.”
“He may describe the credential differently.”
“I know.”
Rachel looked at her over the rim. “You did it again.”
Mara drank. The coffee tasted burned.
Jonah’s interview produced the first significant contradiction.
According to the summary provided through counsel, he said Mara had not merely asked whether the credential remained active. She had written the directory path on a yellow note and told him, “Find the continuity file before they shut the door.”
Mara remembered the note. She had written the path after midnight in the firm’s temporary workroom. A cleaning machine had hummed in the corridor. Jonah had been eating almonds from a vending-machine packet and complaining that each almond cost nearly a dollar.
She remembered saying the sentence.
She had not remembered it when Naomi asked.
Rachel advised submitting a correction immediately.
Mara did.
Martin’s lawyers seized on the discrepancy. They argued that Mara’s testimony was evolving as evidence emerged and that her team had intentionally bypassed security to manufacture a public accusation. They demanded the surveillance footage be excluded from the institute review.
At the same time, they provided a previously undisclosed incident report dated three days before Martin’s archive entry. The report warned of a possible cyber intrusion involving donor records and recommended removing sensitive materials from network-connected areas.
The report was signed by Martin and Evelyn.
It appeared to justify the transfer.
Mara received a copy under a confidentiality order. The document looked clean. Too clean, she first thought, then corrected herself. Suspicion could become vanity if it treated every obstacle as proof of clever deception.
She examined the metadata summary. The report had been created on the date shown. It had been printed that afternoon. The signatures appeared original.
Jonah’s former supervisor, listed as an information-security consultant, had countersigned it.
The name was Daniel Roth.
Jonah had never mentioned him.
Rachel arranged a permitted call between Mara and Jonah with both attorneys present. The conversation took place over a secure conference line.
Mara said, “Why was Daniel Roth involved?”
Jonah’s answer came after a pause. “He consulted for the institute.”
“You knew that?”
“Yes.”
“When?”
“Before we accessed the directory.”
Mara closed her eyes. Rachel watched her from across the table.
“Why did you not tell me?”
“Because you would have removed me from the matter.”
“I might have.”
“You would have.”
“Why?”
“Because Daniel was the person who blamed me for the breach at Halcyon Systems.”
Mara looked toward the office window. Rain moved down the glass in thin lines.
Jonah continued. “He signed the incident report. I assumed it was another cover document.”
“Assumed?”
“I saw his name. I knew how he worked.”
“You did not know what he did here.”
“No.”
“Did you access the system to prove he was lying?”
“I accessed it because you told me the evidence was about to disappear.”
“That is not what I asked.”
The attorneys remained silent.
Jonah said, “Partly.”
Mara felt anger arrive cleanly, almost pleasantly. Anger simplified the room.
“You let me present evidence without disclosing a personal conflict.”
“You let me obtain it without disclosing that you planned to wear a recorder into the hearing.”
“They are not equivalent.”
“No,” he said. “Yours was calculated.”
Rachel raised a finger, telling Mara not to answer.
Jonah’s lawyer ended the call soon afterward.
The incident report changed the public narrative. Martin released a statement saying the archive transfer had been part of a documented security response. Evelyn’s lawyers described the ledger and drive as materials provided for legal safeguarding. Daniel Roth told investigators that he had identified abnormal login attempts affecting donor systems and had recommended isolating physical and digital records.
When asked for technical evidence, he said relevant logs had been overwritten during a scheduled server migration.
The timing was unfortunate.
May you like
It was not impossible.
Mara spent three days reviewing the report through supervised access. She could not copy it, photograph it, or remove notes from the secure room. A monitor sat nearby while she read.
