Elena requested a technical interview with the company's system administrator.
At 2:10 p.m., the administrator joined a secure call.
“Can you confirm whether remote access was enabled for the account?” Elena asked.
“Yes. The employee was permitted remote access during normal working periods.”
“Was the account supposed to remain active while the employee was on leave?”
“The account wasn't disabled because the employee was expected to return the following week.”
“Was that consistent with company policy?”
The administrator hesitated.
“Technically, yes. But accounts should not be used by anyone other than the assigned employee.”
“Were there any warnings about suspicious activity?”
“There was an unusual login notification, but it was categorized as a routine remote connection.”
“Who reviewed it?”
“The system generated an automated notice. I haven't found evidence that a person reviewed it.”
Elena documented the answer.
A weak account-management process could explain how unauthorized access occurred without proving who had exploited it.
That possibility had to be considered alongside deliberate misuse.
At 2:27 p.m., the investigators interviewed Victor Sloane for a second time.
This time, they asked about the temporary route review and the replacement subcontractor attachment.
Sloane remained composed.
“I coordinated the planning exercise,” he said. “The eastern route was included as an alternative because the southern entrance sometimes becomes congested.”
“Did you authorize the delivery on October second?”
“No.”
“Did you ask anyone to alter the subcontractor list?”
“No.”
“Did you know Graybridge Services had been added to the attachment?”
“I would have to review the version history.”
“Did you instruct anyone to use credentials belonging to an employee who was away from work?”
“Absolutely not.”
“Did you know Adrian Cole?”
“I may have met him through a contractor. I can't say that I knew him well.”
The investigators asked him to provide the relevant emails, calendar entries, and contract records.
He agreed to cooperate through his company's legal representative.
Elena listened remotely.
Sloane's answers were plausible, but they required corroboration.
He had acknowledged coordinating the planning exercise. He denied approving the delivery or directing the changes. The available evidence did not yet establish whether those denials were truthful.
After the interview, the investigators compared his calendar with the workstation logs.
A meeting appeared on his calendar at 9:30 a.m. on the morning of the document replacement.
The meeting had been scheduled with an external contractor, but the invitation contained no agenda.
The contractor's name was Adrian Cole.
Elena stared at the entry.
It was the first verified record showing that Sloane and Cole had been scheduled to meet on the same morning that the subcontractor attachment was changed.
That fact did not prove they had met, nor did it establish that they had discussed the delivery.
But it gave investigators a specific event to verify.
They requested the building's visitor records and any available meeting-room access logs.
The visitor system showed that a person identifying himself as Adrian Cole had entered Meridian Civic Solutions at 9:24 a.m.
He had left at 9:57 a.m.
The meeting room's electronic access record showed an entry during the same period.
The evidence established that a visitor using Cole's name had entered the building and that the meeting room had been accessed.
It did not independently prove the visitor's identity.
Elena instructed the team to compare the visitor photograph with available records and verify the meeting through other sources.
At 3:02 p.m., the visitor photograph arrived.
The man in the image resembled the description Mercer had given of the person who arranged the delivery.
The resemblance was not sufficient for positive identification.
Elena forwarded the image to the investigative team for a formal comparison.
Meanwhile, the municipal systems remained stable.
The failed authentication requests had not caused a confirmed disruption, and the courthouse was operating normally.
The physical emergency had ended.
The administrative investigation was becoming more focused.
The records now showed a possible relationship among Sloane, Cole, Graybridge Services, and the altered subcontractor attachment.
But the central question remained unanswered.
Was the delivery a deliberate attempt to bypass municipal procedures, a criminal diversion, or the result of unauthorized access combined with inadequate oversight?
The answer depended on evidence that had not yet been found.
At 3:18 p.m., the financial investigator sent one more update.
Graybridge Services had received a payment from a company that was not listed in the original procurement file.
The payment had been made two days before the truck arrived.
The sending company was registered in another state, and its stated business activity did not appear related to municipal logistics.
The transaction was not proof of a crime.
But it suggested that the investigators needed to examine the financial relationships beyond Bellhaven's city contracts.
Elena saved the report.
For the first time, she considered that the person responsible might not be trying to cause a physical disaster at all.
The truck could have been a means of drawing attention.
The altered documents could have been a means of concealing responsibility.
The failed technical requests could have been unrelated attempts to access vulnerable systems—or part of a broader effort to understand how quickly the city would respond.
Whatever the explanation, the investigation had reached a new stage.
The question was no longer simply what had happened that morning.
It was whether Bellhaven's ordinary administrative systems had been manipulated to serve a purpose that had nothing to do with construction, traffic, or municipal planning
At 4:05 p.m., Lieutenant Marcus Vance arrived at City Hall to deliver the initial operational report.
He carried a folder containing the traffic plan, dispatch records, and his account of the encounter with Elena Ward.
Captain Keller had instructed him to report the facts accurately, and Vance intended to do so.
The report acknowledged that he had initially questioned Elena's credentials and delayed following her safety instructions. It also recorded that he had received confirmation from federal authorities and subsequently coordinated the perimeter response.
He did not attempt to disguise the delay.
In the conference room, Keller read the report in silence.
When he finished, he looked up.
“You understand why I asked for this?”
“Yes, sir.”
“This isn't just about whether the vehicle turned out to be dangerous. We need to know whether our response was reasonable based on what we knew at the time.”
“I understand.”
Keller tapped the page describing the first encounter.
“You wrote that you believed the agent was attempting to undermine your authority.”
“That was my initial impression.”
“What evidence supported that impression?”
Vance looked down.
“None beyond the fact that she was asking me to change the perimeter.”
“Then your report is accurate.”
Vance nodded.
Keller closed the folder.
“Marcus, I know you're a capable officer. But capability doesn't excuse an avoidable lapse in judgment.”
“No, sir.”
“You are not being asked to accept every instruction without question. You are being asked to verify information, assess risk, and respond professionally. There is a difference between appropriate skepticism and refusing to consider evidence because you dislike the person presenting it.”
Vance took a slow breath.
“I understand that now.”
“Good. Cooperate with the review. Preserve all communications. If investigators need additional information, provide it.”
“Yes, sir.”
As Vance stood to leave, Keller added one final instruction.
“And arrange a briefing for your officers. They need to understand that raising a safety concern is not a challenge to their supervisor.”
Vance agreed.
He returned to the station and began preparing the briefing.
Meanwhile, Elena Ward was meeting with the city's emergency coordination director.
The director, Margaret Ellis, was responsible for ensuring that the police department, courthouse security, public works, and municipal IT teams could work together during a major incident.
She had followed the developments throughout the day and was concerned about the repeated irregularities in the records.
“Do you believe the city was targeted?” Ellis asked.
“I believe the delivery authorization was changed without a corresponding approval in the official record,” Elena replied. “We also have suspicious account activity and a payment trail that requires further investigation.”
“Is that enough to say someone deliberately targeted us?”
“Not yet. It is enough to justify a coordinated review.”
Ellis looked toward the window.
“We have invested heavily in emergency planning. We have access controls, contractor checks, and documented approval procedures. How could something like this happen?”
“Those safeguards depend on people following them and systems recording what actually occurred. A valid account can be misused. A real company can employ an unauthorized subcontractor. A document can appear legitimate while containing information that was never approved.”
“So the problem isn't necessarily the systems themselves.”
“Correct. The problem may be the relationship between the systems, the people who use them, and the process for detecting irregularities.”
Ellis nodded slowly.
“What do you recommend?”
Elena chose her words carefully.
“First, preserve the records and let the investigation establish what happened. Second, review how temporary contractor access is granted and removed. Third, make sure changes to restricted delivery routes require an independently verifiable approval. Finally, establish a process for escalating unusual activity without unnecessarily disrupting essential services.”
Ellis wrote down the recommendations.
“Can we begin those reviews before the investigation is complete?”
“Yes, provided the changes don't destroy evidence or interfere with the ongoing investigation. The technical team should coordinate any system changes and preserve the original logs.”
Ellis agreed.
At 4:42 p.m., the city announced that the courthouse district's traffic restrictions had been lifted, except for a small area reserved for the vehicle investigation team.
The notice confirmed that the completed inspection had found no explosive device or hazardous material. It explained that the vehicle and its documentation remained under review.
The statement did not identify a suspect or suggest that a wider attack had been confirmed.
Elena approved the factual summary.
She knew some members of the public would criticize the response as excessive. Others would ask why the truck had been allowed into the district at all.
Both questions deserved answers.
The purpose of the investigation was not to defend every decision made during the morning. It was to establish which decisions had been justified, which procedures had failed, and what needed to change.
At 5:10 p.m., Vance held his briefing at the station.
Twenty officers sat in the room, including Brooks.
Vance stood in front of them without his usual display of confidence.
“This morning, I made a mistake,” he began.
The room became quiet.
“When Special Agent Ward arrived and presented her credentials, I treated the encounter as a challenge to my authority. I made jokes about her badge in front of other officers. I delayed taking precautions that should have been considered while the information was verified.”
Nobody spoke.
Vance continued.
“I was responsible for the perimeter, and I had legitimate concerns about maintaining control of the scene. But those concerns did not justify ridiculing another professional or dismissing a safety warning before reviewing the available information.”
He looked directly at Brooks.
“An officer raised a concern about the vehicle. I failed to respond appropriately. That is also part of the record.”
Brooks sat still, unsure how to react.
Vance placed both hands on the lectern.
“From now on, I expect every officer to report unusual activity promptly. Supervisors will assess the information, document their decisions, and request assistance when needed. Nobody should be discouraged from raising a legitimate concern because they fear embarrassment or retaliation.”
He paused.
“We were fortunate that the vehicle inspection did not identify an explosive device or hazardous material. But that outcome does not mean the precautions were unnecessary. We made decisions based on the evidence available at the time, and we need to judge them accordingly.”
He ended the briefing without asking for applause.
Afterward, Brooks approached him.
“Sir, I appreciate what you said.”
Vance nodded.
“I should have said it earlier.”
Across town, Elena was reviewing the latest investigative update.
The visitor photograph from Meridian Civic Solutions had been compared with an image associated with Adrian Cole's business registration. The facial features were consistent, but the comparison was not considered sufficient on its own to establish identity.
Investigators were seeking additional confirmation.
A new document had also been recovered from the company's archived email system.
It was a draft invoice prepared by Graybridge Services, dated two days before the delivery.
The invoice described a service called Operational Continuity Review.
Its stated purpose was to evaluate how municipal agencies responded to disruptions affecting contractor access and emergency logistics.
The invoice listed a consulting fee of eighteen thousand dollars.
The client field had been left blank.
Elena read the description twice.
A continuity review could be legitimate. Organizations regularly tested procedures and conducted exercises to identify weaknesses.
But the delivery had not been included in the city's approved exercise schedule, and the truck's arrival had not been authorized through the normal process.
She forwarded the invoice to the investigative team.
The question now became whether someone had attempted to conduct an unauthorized test using a real emergency response—and whether the suspicious technical requests were connected.
At 6:03 p.m., the cyber team discovered that the invoice had been opened from the same workstation used to access the shared subcontractor folder.
The workstation had been used by several employees, so the record did not identify a specific person.
Still, the overlap strengthened the case for examining the company's internal access history.
Elena called Haines.
“We have a draft invoice describing an operational continuity review. It was prepared by Graybridge Services two days before the delivery. The document appears in the same workstation history as the altered subcontractor attachment.”
“Does the invoice name a client?”
“No. The client field is blank.”
“Then we need to find out who requested the service, who expected to pay for it, and whether the delivery was intended to be part of a legitimate exercise.”
“Agreed.”
Haines paused.
“Ward, what is your assessment of the immediate risk?”
“The physical risk associated with the truck has been substantially reduced. The inspection found no explosive device or hazardous material. The remaining concern is whether someone deliberately manipulated the delivery and access records.”
“Continue with that focus.”
Elena ended the call.
She looked at the city through the conference-room window.
Bellhaven was returning to its usual rhythm. Cars moved through the reopened intersections, pedestrians crossed the square, and courthouse employees began leaving for the evening.
The city appeared unchanged.
But the investigation had revealed how easily a routine delivery could expose weaknesses in the systems people relied on.
The most important question was no longer whether the authorities had stopped a catastrophe.
No catastrophe had been confirmed.
The question was whether they had uncovered an unauthorized operation that could have caused harm—and whether the people responsible had intended to learn something about Bellhaven's response before trying again
The next morning, Elena returned to the regional coordination office before seven.
The investigation had continued overnight, and the teams had assembled a more complete timeline.
The suspicious delivery had been arranged through a chain of contractors.
A temporary worker had been paid by Graybridge Services.
A subcontractor attachment had been altered to include Graybridge under an account whose owner was away.
The vehicle's delivery authorization had been changed under another account whose owner was on leave.
An expired credential had apparently opened a service stairwell.
Two technical access requests had been rejected, and neither had disrupted essential emergency communications.
The truck had been inspected. No explosive device or hazardous material had been identified.
Those were the established facts.
The identity of the person who arranged the delivery, the reason for the altered records, and the relationship between the delivery and the technical requests remained unresolved.
At 7:18 a.m., the cyber team provided a new report.
The remote session used to replace the subcontractor attachment had been initiated from a company laptop assigned to a senior project coordinator.
The coordinator was not Sloane.
Her name was Rebecca Shaw.
She had reported the laptop missing the previous week.
The company had recorded the loss but had not immediately revoked the device's access certificates because the coordinator was expected to recover it.
The decision had left the laptop able to connect to certain internal resources.
That did not prove the laptop had been used to alter the records, but the technical evidence showed that the session had passed through its registered identity.
Elena requested a formal interview with Shaw and a review of the company's missing-device report.
When Shaw arrived, she appeared genuinely distressed.
“I reported it missing as soon as I realized it wasn't in my bag,” she said. “I thought I had left it in a taxi.”
“Did you attempt to access company systems after reporting it missing?”
“No.”
“Did you share your password with anyone?”
“No.”
“Did anyone know the password?”
“My team leader had administrative access to the project folder, but not my personal login.”
“Who was your team leader?”
“Victor Sloane.”
Elena did not react visibly.
“Did you tell him that the laptop was missing?”
“Yes. I emailed him and the IT department.”
“Did you receive a response?”
“The IT department acknowledged the report. Mr. Sloane told me not to worry because the device was encrypted.”
“Did he tell you whether the access certificates had been revoked?”
“No.”
Shaw provided the email.
The message confirmed that she had reported the laptop missing six days earlier. The IT response had acknowledged the loss, but the records did not show that all associated access permissions had been disabled.
Investigators still needed to establish who had used the device.
The laptop could have been stolen, misplaced, or accessed by someone with legitimate physical access. The records did not establish that Sloane had possessed it.
However, the missing-device report gave the cyber team a concrete lead.
At 8:05 a.m., the company confirmed that the laptop had been recovered from a locked storage cabinet in a conference room.
An employee had found it while preparing the room for a meeting.