“Were you involved in arranging a delivery to the eastern construction entrance this morning?”
“No.”
“Did you communicate with Graybridge Services during the past two weeks?”
“Possibly. I communicate with many contractors.”
“Do you know Adrian Cole?”
“I know the name.”
“In what capacity?”
“He may have been associated with one of the subcontractors. I'd need to check the records.”
“Did you approve his company for this particular delivery?”
“No.”
The answers came smoothly.
Sloane did not appear surprised by the questions, but he was careful not to volunteer information beyond what was requested.
The investigators asked for copies of the relevant contract files and communications.
Sloane agreed to provide records through his company's legal representative.
That cooperation did not resolve the matter.
Elena watched the interview remotely, noting both the answers and the questions that remained open.
Sloane's name appeared in a planning email connected to temporary access arrangements. That made him relevant to the investigation, but it did not establish that he had arranged the truck's arrival or altered the delivery records.
The investigators needed corroboration.
After the interview, Elena called the procurement supervisor.
“Can you verify whether Sloane had authority to approve temporary access arrangements?”
“He could recommend them,” the supervisor replied. “Final approval belonged to the facilities director or an authorized delegate.”
“Was Sloane ever appointed as a delegate?”
“Not according to the current authorization register.”
“Could he have had temporary authority under an emergency contract?”
“I'll check the archived records.”
Elena thanked her.
A few minutes later, the supervisor called back.
Sloane had been authorized to coordinate a separate facilities review, but the authorization did not permit him to approve vehicle access or modify the city's delivery records.
That distinction mattered.
If Sloane had communicated with contractors about logistics, he might have acted within his consulting role. If he had represented himself as someone authorized to approve restricted deliveries, that would raise a different question.
The investigators could not assume either possibility without evidence.
Meanwhile, the cyber team had recovered a version history for the subcontractor attachment that had been replaced three days earlier.
The original attachment listed four approved subcontractors.
The replacement listed five.
The additional company was Graybridge Services.
The electronic approval appeared under the credentials of an employee who was on vacation.
The file metadata indicated that the replacement document had been generated on a workstation associated with Meridian Civic Solutions.
That was a significant lead.
It did not establish who had operated the workstation, whether the employee's credentials had been misused, or whether Sloane had personally approved the change.
But it linked the altered contract attachment to a specific organization.
Elena forwarded the evidence to the investigative team.
“Preserve the original file, the replacement, and all available metadata. We need an independent technical review and the records showing who accessed the workstation.”
The team acknowledged the instruction.
At 12:06 p.m., the vehicle inspection team reported that the truck's cargo consisted of ordinary industrial materials. No explosive device or hazardous substance had been identified during the completed inspection.
The vehicle's identification discrepancies remained under investigation, but the immediate physical concern had been substantially reduced.
Elena informed Haines.
“The truck has been inspected, and no dangerous device or hazardous material has been identified. The cargo appears to consist of ordinary industrial supplies. The paperwork and vehicle identity remain inconsistent.”
“That's an important update,” Haines said. “Make sure the public notice reflects the verified facts without implying the incident was meaningless.”
“Agreed.”
The command center began planning a gradual reduction of the traffic restrictions.
However, the investigation into the altered records continued.
Vance approached Elena near the courthouse entrance.
“So the truck wasn't a bomb.”
“No explosive device was identified during the inspection.”
“People are going to ask why we shut down the district.”
“We had a vehicle with inconsistent identification and documentation, a suspicious payment trail, and an unverified delivery authorization. We took precautions while specialists assessed it.”
Vance nodded.
“That sounds reasonable when you put it that way.”
“It was reasonable before we knew the outcome, too. Safety decisions should be evaluated based on the information available at the time, not only on what we discover afterward.”
He looked toward the western plaza, where pedestrians were beginning to return.
“I'll remember that.”
Elena's phone vibrated.
The cyber team had completed its preliminary comparison of the access logs and the document history.
One workstation had been used to create the replacement subcontractor attachment.
That same workstation had accessed a shared folder containing the courthouse delivery schedule.
The two events occurred on the same morning.
Investigators were now checking whether the activity came from a legitimate user session or an unauthorized access.
Elena looked at the clock.
The immediate physical threat had diminished.
But a different problem remained: someone might have used legitimate business relationships and ordinary administrative procedures to create an unauthorized delivery and obscure responsibility.
The question was no longer whether the truck contained a dangerous device.
It was who had altered the records, why the delivery had been redirected, and whether the same person had attempted to exploit other municipal systems.
Elena requested another interview with Sloane, this time focused on the workstation and the replacement attachment.
Before the interview could be scheduled, a new message arrived.
The maintenance contractor had identified a second account that accessed the shared folder shortly before the replacement document was created.
The account belonged to a temporary employee who had left Meridian Civic Solutions two months earlier.
The employee's name was Aaron Pike.
And according to the company's records, Pike had returned his access card when his employment ended.
Aaron Pike lived in a small apartment on the northern edge of Bellhaven.
He had left Meridian Civic Solutions after a disagreement with management about contract reporting procedures. According to his former colleagues, he had been an efficient analyst but had become increasingly uncomfortable with the company's handling of certain municipal records.
None of those facts established that he was involved in the current incident.
Still, the investigators needed to find him.
A records check provided a current address. Local officers contacted Pike and asked him to participate in an interview. He agreed.
When the investigators arrived, he appeared anxious but cooperative.
“I heard about the courthouse,” he said. “I don't know anything about a truck.”
“We're not asking you to speculate about the truck,” the investigator replied. “We're asking about your former account at Meridian Civic Solutions.”
Pike frowned.
“My account was disabled when I left.”
“Did you retain access to any company systems?”
“No.”
“Did you keep your access card?”
“No. I returned it to human resources.”
“Did you share your credentials with anyone?”
“Never.”
The investigator showed him a record indicating that his account had accessed the subcontractor folder three days earlier.
Pike stared at the screen.
“That isn't possible.”
“Can you explain the access?”
“No. I haven't worked there for two months.”
“Did you authorize anyone to use your account?”
“No.”
“Do you know Victor Sloane?”
“Yes. He supervised part of the facilities review I worked on.”
“Did you ever discuss temporary access arrangements with him?”
Pike hesitated.
“Yes. During my last week, he asked me to review a spreadsheet listing delivery routes and service entrances.”
“What was the purpose?”
“He said it was part of a routine planning exercise.”
“Did you notice anything unusual?”
Pike looked down.
“I noticed that one of the proposed routes passed through an area that was supposed to remain restricted.”
“Did you report it?”
“I asked my supervisor about it. He told me the plan had been approved.”
“Who was your supervisor?”
“Victor Sloane.”
The investigator wrote down the answer.
“Did you make any changes to the route?”
“No. I only reviewed the spreadsheet.”
“Did you keep a copy?”
Pike thought for a moment.
“I might have an email from that week. I saved some messages because I was concerned about the reporting process.”
The investigator explained how the records could be provided securely.
Pike agreed to cooperate.
When Elena received the interview summary, she immediately requested the email.
It arrived shortly afterward.
The message had been sent by Sloane to Pike during the employee's final week.
The subject line read: Temporary Route Review.
The body was brief.
Please confirm that the eastern access option is reflected in the working spreadsheet. We need the final version available for the contract review.
A spreadsheet was attached.
Elena examined the file's metadata.
It was not the same document that had been used to alter the delivery authorization, but it contained a similar route description and referenced the same municipal facilities project.
The attachment showed that the eastern access option had been added to the planning document after an earlier review recommended using the southern service entrance.
That was not automatically improper. Routes changed, and planning documents often contained alternatives.
What mattered was whether the later delivery had been authorized through the correct process.
Elena contacted the procurement supervisor.
“Was the eastern access option formally approved?”
“Not in the version of the plan we have on file.”
“Could it have been approved in a separate document?”
“We're checking the archives.”
Elena thanked her and returned to the email.
Pike had not changed the route, according to his statement. The message asked him only to confirm that the option appeared in the working spreadsheet.
The investigators still needed to determine whether he had accessed the file after leaving the company or whether someone had reused his account.
The cyber team compared the recent access with the employee's earlier activity.
The login originated from a network location associated with Meridian Civic Solutions. It used the same general pattern as previous legitimate sessions, but the team could not yet establish which individual had initiated it.
That finding suggested possible credential misuse, but it did not prove who was responsible.
Elena requested a preservation order for the relevant company records through the appropriate legal channels.
Meanwhile, Vance received a call from Captain Keller.
“The traffic restrictions are being reduced,” Keller said. “I need a complete operational report by the end of the day.”
“Understood.”
“And I want a separate account of the initial encounter with Agent Ward.”
Vance closed his eyes briefly.
“I expected that.”
“Then don't make it complicated. Record what happened accurately. Include your decisions, the information available at the time, and the instructions you received.”
“Yes, Captain.”
After the call, Vance stood beside the patrol SUV and watched Brooks speaking with a courthouse security officer.
He remembered the laughter that had accompanied his first response to Elena's badge.
At the time, he had believed that he was demonstrating command.
Now he understood that he had been demonstrating insecurity.
He had treated a request for verification as a challenge, a warning as an insult, and incomplete information as evidence that the speaker had nothing useful to offer.
He could not change those facts.
But he could refuse to hide them.
Vance began drafting his report.
He recorded the time Elena arrived, the credentials she presented, the instructions she gave, and the reasons he initially declined to follow them.
He did not blame the federal agent for failing to disclose information she was not authorized to share.
He did not claim that he had never questioned her identity.
He wrote what had happened.
When Brooks passed nearby, Vance called him over.
“Officer, I owe you an apology.”
Brooks looked surprised.
“For what, sir?”
“For dismissing your concern about the truck and making it harder for you to raise questions. You saw something that needed attention, and I treated the issue as if it were an argument about authority.”
Brooks remained silent for a moment.
“Thank you, Lieutenant.”
Vance nodded.
“I need you to document what you observed, including anything you think I should have done differently.”
“Understood.”
“And don't leave anything out because you think it might upset me.”
Brooks gave a small nod and returned to his duties.
At 12:42 p.m., the city announced that the immediate vehicle inspection had found no explosive device or hazardous material. The eastern road remained restricted briefly while the inspection team completed its work, but the courthouse district was returning to normal operations.
The public had been protected.
The immediate emergency had passed.
Yet the evidence concerning the altered documents remained unresolved.
At 1:03 p.m., the cyber team reported that someone had attempted to access the subcontractor folder again.
This time, the request came from an external network.
The attempt was rejected.
No data had been changed.
The technical team preserved the logs and began tracing the source through the appropriate investigative channels.
Elena read the report.
The first unauthorized access had appeared to originate from a company workstation.
The new attempt came from outside the company network.
Both targeted the same folder.
Someone might be trying to regain access to the records.
Or the events might have separate explanations.
Elena could not assume a common actor, but the repeated attempts made it important to secure the evidence and identify who had requested access.
She called Haines.
“We have a second rejected access attempt targeting the subcontractor folder. The technical team has preserved the logs. The request originated externally, but we don't have a verified identity.”
“Can the company isolate the folder without affecting essential operations?”
“Yes. The administrators are preparing a controlled restriction under the incident response plan.”
“Good. Keep the records intact.”
Elena ended the call.
For most of the morning, the investigation had been driven by the question of what was inside the truck.
Now the more important question concerned the information around it.
Who had altered the records?
Who had used the expired credentials?
Who had attempted to access the subcontractor folder?
And who stood to benefit from a delivery that appeared to have been routed through a restricted entrance without proper authorization?
The answers were beginning to point toward a deliberate manipulation of ordinary systems.
But the identity of the person responsible remained uncertain
By early afternoon, the emergency coordination room had become a maze of open files, printed timelines, and secure communications.
Investigators from several agencies were comparing records that had initially appeared unrelated. Each team had a different responsibility: vehicle identification, financial transactions, municipal access logs, contractor authorization, and network security.
Elena insisted that the evidence be separated into confirmed facts, unresolved discrepancies, and investigative hypotheses.
The distinction frustrated some of the analysts, who wanted to assemble a complete explanation as quickly as possible.
But Elena had seen investigations damaged by premature conclusions.
A theory could help organize questions.
It could not replace proof.
Naomi Price joined the coordination call to explain the document history.
“The original subcontractor attachment contained four companies,” she said. “A replacement was created three days ago, adding Graybridge Services. The approval was entered under an account belonging to an employee who was on vacation.”
“Do we know who made the change?” Elena asked.
“No. The workstation metadata points to Meridian Civic Solutions, but the account holder may not have been the person operating the computer.”
“Good. What about the delivery authorization?”
“That was modified separately. The account belonged to Peter Halden, who was on medical leave. The access record shows a session from a workstation reported offline earlier that morning.”
“Any confirmed connection between the two sessions?”
“Not yet.”
Elena turned to the cyber investigator.
“What can we establish about the rejected network requests?”
“The requests targeted a monitoring service and a subcontractor folder. Both were rejected. Essential emergency communications remained operational, and we haven't identified a successful unauthorized change to those systems.”
“Do the requests share a source?”
“The first appears to have come through a third-party maintenance account. The second came from an external network. We are still examining the logs.”
Elena nodded.
The facts were troubling, but they did not yet establish a single coordinated operation.
She asked the financial investigator for an update.
“Graybridge Services received funds from Meridian Civic Solutions under a consulting invoice,” the investigator said. “Graybridge then paid Elliot Mercer for temporary delivery work. We have the transaction records, but we have not confirmed who controlled the company account at the time.”
“Does the invoice describe the delivery?”
“No. It describes logistics consulting. We haven't found an invoice specifically authorizing the truck's route.”
“Then record that distinction.”
The investigator agreed.
At the end of the call, Elena reviewed the emerging timeline.
Nine days earlier, Sloane had communicated about temporary access arrangements.
Three days earlier, an attachment listing subcontractors had been replaced.
That morning, a delivery authorization had been changed.
At approximately 10:18 a.m., an expired credential had opened a service stairwell.
A suspicious vehicle had remained inside the restricted district.
Later, two technical access requests had been rejected.
Some of the events were connected by documents or organizations. Others were connected only by timing.
The challenge was determining whether the relationships were causal or coincidental.
At 1:46 p.m., the procurement supervisor delivered a new finding.
The eastern access route had been listed as a contingency option in an older planning document, but it had not been approved for the particular delivery that morning.
The route change therefore lacked a corresponding authorization in the official record.
This did not establish who had made the change.
It did establish that the paperwork used by the delivery team did not match the approved plan.
Elena added the finding to the timeline.
A minute later, the cyber team reported that the employee account used to replace the subcontractor attachment had been accessed through a remote session.
The session originated from a network registered to Meridian Civic Solutions.
The account holder denied initiating it.
That statement remained to be independently verified, but it strengthened the possibility that the account had been compromised.