“Did you write that?”
“I started the form.”
“Did you submit it?”
“No.”
“Why not?”
“Because I couldn't truthfully say I had witnessed the recovery.”
For the first time, her voice strengthened.
“I wasn't going to sign a statement about something I didn't see.”
Shaw documented the answer and ended the interview.
When Malcolm reviewed the summary, he did not treat Torres's statement as proof of a conspiracy. She might have been frightened, mistaken, or attempting to protect herself. Her account would need to be compared with the recording fragments, the access logs, and the evidence-handling records.
Still, one fact mattered.
Torres had refused to certify a discovery she had not witnessed.
At 4:10 p.m., an independent federal liaison arrived at the airport. Special Agent Elena Brooks, who worked in a separate investigative division, had been contacted through Malcolm's scheduled check-in procedure.
She was in her late thirties, direct in manner, and careful about jurisdiction.
“I understand you've been detained,” she said.
“I was detained. The current status is being clarified.”
“Have you identified the person responsible?”
“No.”
“Do you believe the airport officers planted the package?”
“I believe the package's appearance is inconsistent with the available evidence. We have not established who introduced it or why.”
Brooks nodded.
“Good. That's the distinction we need to preserve.”
She reviewed the preliminary records and requested an independent forensic examination of the suitcase, the package, the security seal, and the original images.
She also ordered that no officer involved in the incident be allowed to handle the evidence again without a documented reason and a second authorized witness.
Before leaving, she spoke with Torres privately.
Malcolm did not attend that conversation, and he did not ask for its contents.
Later, Brooks returned with a short update.
“Torres has agreed to provide a formal statement,” she said. “She wants legal advice before answering further questions.”
“That is her right.”
“She's frightened.”
“Fear doesn't establish guilt.”
Brooks regarded him thoughtfully.
“You sound determined not to reach a conclusion.”
“I'm determined to reach one that survives examination.”
She nodded and turned toward the door.
Behind them, the first pieces of a larger picture were beginning to emerge. Collins had been inside the room during the missing interval. A supervisor had redirected the suitcase. The initial scan appeared inconsistent with the later discovery. Torres had refused to sign an incomplete report.
But the central question remained unanswered.
Had Collins acted alone, following instructions from someone else? Had Hale arranged the incident? Was Mercer merely responsible for an ordinary screening decision, or had he knowingly diverted the suitcase for an improper purpose?
The investigation had several suspects.
It did not yet have a complete explanation.
Malcolm intended to keep it that way until the evidence could speak for itself.
Chapter 6: The Man Who Redirected the Bag
Daniel Mercer was located at 4:32 p.m. in an administrative office on the airport's lower level.
He was forty-one, clean-shaven, and dressed in a white shirt with the sleeves rolled to his elbows. His job involved coordinating baggage inspections, resolving routing errors, and communicating with airport police when unusual items required additional attention.
When Lieutenant Shaw entered the office, Mercer was reviewing a spreadsheet.
“Mr. Mercer?”
“Yes?”
“We need to ask you about a baggage-routing override issued shortly before one o'clock today.”
Mercer glanced at the lieutenant's uniform.
“Which bag?”
“Black hard-shell suitcase, baggage tag ending in 8471.”
For a moment, Mercer appeared confused.
Then he nodded.
“I redirected that one.”
“Why?”
“The system flagged it for additional inspection.”
“What triggered the flag?”
Mercer opened the spreadsheet and searched for the record.
“An irregularity in the routing data, apparently.”
“Apparently?”
“The system sometimes generates alerts that require a supervisor to make a decision.”
“Did the system generate the alert, or did you manually select the bag?”
Mercer stopped typing.
“I don't remember.”
Shaw placed a printed copy of the routing record on the desk.
“This shows a manual override associated with your credentials.”
“I have the authority to issue those.”
“Did anyone request this particular override?”
Mercer looked at the paper.
“Possibly.”
“Who?”
“I would need to check my messages.”
“Please do.”
Mercer picked up his phone but did not unlock it immediately.
“Am I in trouble?”
“I'm asking you to explain an administrative decision.”
“That sounds like trouble.”
“It sounds like a question.”
Mercer gave a nervous laugh, then opened his messages. He searched the previous afternoon and the morning's communications.
Nothing obvious appeared.
Shaw asked him to preserve the relevant messages and provide a complete account of his actions. Mercer agreed, but his uneasiness increased when the lieutenant explained that an independent investigation had been opened.
“Was the suitcase selected because of its passenger?” Shaw asked.
“I don't know who the passenger was.”
“Did you know the passenger was Malcolm Bennett?”
Mercer's fingers stopped over the phone.
“No.”
“Have you heard that name before?”
“I don't think so.”
Shaw did not challenge him. He simply recorded the answer.
After the interview, Brooks arranged for a separate team to examine the routing system. The team discovered that the override had been issued from Mercer's workstation, but the audit trail contained a second detail: the session had been authenticated shortly after a remote administrative connection was established.
That connection did not automatically mean Mercer had acted improperly. Authorized technicians sometimes accessed the system remotely to resolve faults. But the connection required its own explanation.
At 5:15 p.m., the technician identified the account associated with it.
A temporary operations credential had been used to access the routing console.
The account belonged to a contractor whose authorization had expired three weeks earlier.
Its name was AR-17.
“Why is an expired account still active?” Brooks asked.
The technician shook his head.
“It shouldn't be.”
“Who activated it?”
“We'll need the identity-management logs.”
“Retrieve them.”
The records showed that AR-17 had been reactivated the previous evening through a privileged administrative account. The change had been approved under the name of a senior systems administrator, though the approval entry itself had not been independently verified.
The administrator, Peter Voss, worked for the airport's technology contractor.
Voss was not on site that afternoon.
His manager said he had left at lunchtime to attend a meeting off airport property.
Brooks requested the access records and ordered the contractor to preserve Voss's work devices.
Meanwhile, Mercer asked to speak with Shaw again.
This time, he looked exhausted.
“I remembered something,” he said.
Shaw sat down.
“Go ahead.”
“Yesterday afternoon, I received a call from someone in airport operations. He said there might be a security concern involving a passenger on Flight 284.”
“Who called you?”
“I didn't see the number.”
“What did the caller say?”
“That the passenger's luggage needed secondary inspection. He described the bag and gave me the flight number.”
“Did he give you the passenger's name?”
“No.”
“Did he identify himself?”
“He said he was calling from an administrative office.”
“Which office?”
Mercer looked miserable.
“I don't know.”
“Why didn't you mention this earlier?”
“Because I didn't think it mattered. We receive requests like that.”
“Did you redirect the bag manually after the call?”
“Yes.”
“Did you verify the request?”
“No.”
Shaw remained silent for several seconds.
Mercer rubbed his forehead.
“I know how that sounds.”
“It sounds like you acted on an unverified request. Whether that was part of something larger remains to be established.”
“Could somebody have used my account?”
“The logs suggest your workstation was involved. They don't yet establish who operated it at every moment.”
Mercer swallowed.
“I didn't put drugs in anyone's suitcase.”
“Then preserve everything that could help establish what happened.”
As the evening approached, the investigation expanded beyond the airport police department. The contractor's access system, the baggage-routing database, and the police evidence records were placed under separate preservation orders.
Malcolm read the initial findings in a quiet office near the federal liaison suite.
A single phone call had led to the diversion of his suitcase. An expired system account had been reactivated. A remote session had been opened. A manual override had followed.
Any one of those events might have had an innocent explanation.
Together, they suggested a sequence that required serious scrutiny.
Brooks placed a printed timeline beside him.
“Someone may have arranged the diversion before your flight landed,” she said.
“Possibly.”
“Which means this may not have been an opportunistic act.”
“Possibly.”
She gave him a look.
“You're not going to make this easy, are you?”
“It's not supposed to be easy. We have to establish what happened, not what makes the most dramatic story.”
He pointed to the temporary account.
“Find out who reactivated AR-17. Then determine whether the same account was used for anything else during the previous month.”
Brooks nodded.
“If it was used repeatedly, we may be looking at a broader vulnerability.”
“Or a broader scheme.”
“And if it was used only once?”
“Then we investigate that event.”
Brooks collected the documents.
As she reached the door, Malcolm added one final instruction.
“Don't tell Mercer he's cleared just because he denies planting the package. And don't treat him as the culprit simply because his account appears in the routing record.”
She smiled faintly.
“You really do ask the same question twice.”
“Only when the first answer hasn't been verified.”
For the first time that day, Malcolm allowed himself to look beyond the suitcase. Whatever had happened at the airport, someone had exploited a system designed to protect travelers.
If the investigation stopped with a single officer, the person who had arranged the diversion might escape untouched.
And if the same method had been used on other passengers, Malcolm's case might be only the beginning.
At 7:40 p.m., the digital-forensics team recovered a longer section of the missing recording.
The file was incomplete, but the restored footage showed several minutes inside screening room two. The image was grainy, and the microphone captured only fragments of conversation. Even so, the sequence offered details that had been absent from the earlier version.
Collins entered the room alone.
He closed the door, looked toward the ceiling, and stood motionless for several seconds.
Then he walked to the table.
The suitcase was closed.
Collins examined the numbered seal and moved his hand toward it. He stopped, looked at the camera, and stepped away.
A radio message came through.
The audio was too distorted to identify the speaker, but Collins responded.
“Not yet.”
He listened again.
“Understood.”
He left the room.
For nearly five minutes, the room remained empty.
At 1:34 p.m., Collins returned with a small plastic container. He placed it on a shelf beside the table, then moved the suitcase toward the center of the room.
The footage flickered.
When the picture stabilized, Collins was opening the case from a different angle than the one visible in the original inspection photographs.
The numbered seal remained attached to the secondary zipper.
He opened the main compartment.
For several seconds, he appeared to be searching through the clothing.
Then he turned toward the shelf.
The recording broke into static again.
When it resumed, Collins was standing beside the open suitcase. The plastic container was no longer on the shelf.
He looked at the door and called someone over the radio.
“It's done.”
Those two words were clear.
The recording ended shortly afterward.
Brooks watched the footage twice without speaking.
Malcolm watched it a third time.
“Can we establish whether the container was present before Collins entered?” he asked.
“The previous recording shows the shelf,” the technician replied. “It appears empty, but the image resolution is limited.”
“Can we identify the container?”
“Not yet.”
“Can we recover the missing interval?”
“We're trying.”
Brooks turned toward Malcolm.
“That looks deliberate.”
“It looks suspicious,” he corrected. “The original file may tell us more. We need to establish whether the gaps were caused by corruption, an export problem, or intentional interference.”
The technician explained that the camera's local storage and central recording server used separate systems. The central server had failed to receive the complete file, but a local copy might still exist on the device itself.
The team secured the storage module and created a forensic image.
While they worked, Brooks asked for Collins to be brought in for a formal interview.
He arrived at 8:25 p.m., accompanied by a representative. His earlier confidence had disappeared. He sat rigidly in the chair and stared at the table.
Brooks began with routine questions about his shift, his assignment, and his role in the inspection.
Collins answered without hesitation.
Then she asked about the package.
“I found it in the suitcase,” he said.
“Did you see it before opening the bag?”
“No.”
“Did you photograph it in place?”
“I don't remember.”
“Did you wear gloves?”
“I may have.”
“Your initial statement says you recovered the package during a routine search. Is that accurate?”
“Yes.”
Brooks placed a still image from the recording on the table.
It showed Collins beside the shelf.
“What's this container?”
He stared at it.
“I don't know.”
“Did you bring it into the room?”
“No.”
“The footage appears to show you carrying it.”
Collins shifted in his chair.
“The footage is incomplete.”
“That's why we're asking you to explain it.”
“I was doing my job.”
“Did you place the package in the suitcase?”
“No.”
“Did anyone instruct you to place anything inside the suitcase?”
“No.”
Brooks moved to another image.
“Why did you say, 'It's done' over the radio?”
Collins's jaw tightened.
“I don't remember saying that.”
“The recording captures the words.”
“I can't explain the context.”
“Who were you speaking to?”
“I don't know.”
“Was Captain Hale involved?”
“No.”
“Was Daniel Mercer involved?”
“I don't know who that is.”
The interview continued for another hour. Collins denied planting the package, denied acting under orders, and insisted that the incomplete footage could not establish what had happened.
When the interview ended, Brooks did not announce an arrest. She requested that Collins remain available for further questioning and that his access to the relevant evidence systems be suspended pending review.