The approval used the same privileged administrative account that had reactivated AR-17.
The compliance director could not explain why the request had been authorized after Sloane's contract ended.
“Where is Sloane now?” Brooks asked.
“He has a registered office in Atlanta and a residence outside the city.”
“Contact the appropriate investigators. We need to locate him and preserve his devices.”
After the call, she turned toward Malcolm.
“We may finally have the person who connected the technical side to the old cases.”
“May have,” Malcolm repeated.
Brooks smiled tiredly.
“Fine. We have a person who needs to be interviewed.”
Malcolm nodded.
“That will do.”
He returned to the table and began comparing the eleven cases.
One report stood out.
The passenger had been arrested after a package was found in a suitcase. The initial screening image did not show the package. The evidence log contained an unexplained gap. The camera recording was missing for six minutes.
The case had never gone to trial.
The passenger had accepted a plea agreement after being told that the available evidence made conviction almost certain.
Malcolm read the final page slowly.
The person had lost a job, spent months under restrictive conditions, and paid substantial legal expenses.
The charges had eventually been dismissed after new evidence emerged.
But the damage had already been done.
Malcolm closed the file.
“Find this person,” he told Brooks. “We need to know whether they retained any original documents or communications.”
The suitcase conspiracy was no longer simply an attempt to discredit a federal investigator.
It might have been part of a method used against ordinary travelers who had neither the resources nor the knowledge to challenge the evidence.
And if that was true, the investigation would need to account for every person who had been affected.
Victor Sloane was located at his residence shortly after dawn.
He did not answer the door immediately. When investigators identified themselves and explained that they wanted to speak with him about his former airport contracts, he opened it and invited them inside.
Sloane was fifty-six, with thinning hair, narrow glasses, and the polished manner of someone accustomed to explaining technical matters to people who did not fully understand them.
He denied any knowledge of the suitcase incident.
“I haven't worked at the airport for months,” he said.
“Your account accessed the archive last night,” Brooks replied.
“That must be a system error.”
“Your access was disabled eight months ago.”
“Then somebody used my credentials.”
“Who had access to them?”
“No one.”
“Did you authorize a remote connection?”
“No.”
“Did you speak with Captain Hale yesterday?”
“No.”
Brooks placed a copy of the access record on the table.
Sloane studied it for several seconds.
“This doesn't prove I logged in.”
“No. That's why we're asking questions.”
He leaned back.
“My company provided legitimate technical services. If the airport failed to disable an account, that's not my responsibility.”
“Were you involved in the eleven disputed cases?”
“I provided technical consultation in several investigations. I did not make arrests, plant evidence, or write police reports.”
“Did you ever advise an officer to disregard an inconsistent screening image?”
“No.”
“Did you ever help alter an incident report?”
“No.”
“Did you ever access closed case files after your authorization expired?”
Sloane removed his glasses.
“I want a lawyer before answering any further questions.”
Brooks ended the interview.
No arrest was made. Investigators preserved the records obtained through the authorized process and continued examining the contractor's systems.
Meanwhile, a forensic review of Sloane's business records revealed a series of payments to a consulting company called Northline Risk Services. The company had received money from airport contractors and, in turn, had paid several individuals for what the invoices described as “incident-resolution support.”
One payment had been made two days before Malcolm's flight.
The amount was not especially large, but the description was vague.
“Operational assessment.”
The recipient was a company registered to an address used by several small businesses.
Its listed manager was a former airport police officer who had resigned following an internal investigation.
His name was Thomas Reddick.
Reddick had once worked under Hale.
The team obtained the relevant financial records and began tracing the payments. The money appeared to have moved through legitimate business accounts, making it difficult to determine whether the transactions were connected to the alleged misconduct.
Some invoices described real technical work. Others lacked supporting documentation.
Brooks warned the team against assuming that every payment was improper.
“Consultants get paid for services,” she said. “Our task is to determine which services were actually provided and whether any payment was connected to an unlawful act.”
The investigators also discovered that Sloane had contacted Mercer twice in the previous month. One call lasted less than a minute. Another occurred shortly before the temporary system account was reactivated.
Mercer denied knowing that Sloane's account had been used.
He said he had received instructions to redirect the suitcase because of a supposed security alert, but he had never been told that a package would be introduced into the luggage.
The investigators could not yet confirm that account.
They requested additional communications records and compared the call times with the access logs.
At 10:20 a.m., the laboratory delivered a more detailed analysis of the package.
The substance was confirmed to be an illegal narcotic. The packaging contained partial biological material, but the sample was too limited to provide an immediate identification. The adhesive and plastic wrap were consistent with materials available commercially, not unique airport supplies.
The fingerprint fragment remained under examination.
Malcolm reviewed the report.
“The laboratory can tell us what the package contains,” he said. “It cannot tell us who put it there unless the physical evidence supports that conclusion.”
Brooks nodded.
“We need the human timeline and the technical timeline to match.”
They began reconstructing the events minute by minute.
At 12:43 p.m., the temporary account was active.
At 12:56 p.m., the baggage-routing override was issued.
At 1:12 p.m., the suitcase entered the restricted corridor.
At 1:27 p.m., Collins approached Malcolm.
At 1:31 p.m., Malcolm was ordered outside the screening room.
At 1:34 p.m., Collins returned with the plastic container.
At 1:38 p.m., Torres emerged.
At 1:42 p.m., the package was placed into an evidence bag.
At 1:52 p.m., Hale began the recorded interview.
The sequence suggested coordination, but several minutes remained unexplained. Investigators needed to establish whether Sloane's remote access had directly affected the camera system or whether someone else had interfered with the recording.
At noon, the digital-forensics team found a configuration change in the camera server.
The change had been made the previous evening under an administrator's account.
It altered how certain recordings were synchronized with the central archive.
The change did not automatically erase footage. However, it created a condition under which incomplete uploads could occur without triggering the usual immediate alert.
The configuration had been applied to only three cameras.
One covered screening room two.
Another covered the service corridor leading to it.
The third watched the evidence-storage entrance.
Brooks stared at the screen.
“That's too specific to ignore.”
“Agreed,” Malcolm said. “But we still need to identify who authorized the change and who knew it would affect those cameras.”
The system records identified a privileged account.
The account belonged to Peter Voss, the technology contractor who had left the airport before the incident.
Voss claimed the change was part of routine maintenance.
The maintenance ticket, however, had been created after the configuration was applied.
Someone had documented the work retrospectively.
The explanation was not impossible, but it required verification.
Malcolm looked at the timeline.
The system had been altered before the suitcase arrived. The temporary account had been reactivated. The bag had been redirected. The package had appeared during a gap in the recording.
Each new discovery narrowed the range of plausible explanations.
Yet the most important question remained unanswered.
Who had coordinated the actions, and what did they stand to gain?
At 1:35 p.m., a woman named Evelyn Price contacted the federal liaison office.
She was a former baggage-services employee who had left the airport six months earlier. She said she had seen something unusual on the day Malcolm's suitcase was redirected.
Brooks arranged an interview in a neutral office away from the airport police department.
Evelyn arrived carrying a small notebook.
“I wasn't sure whether I should come forward,” she began. “I didn't want to accuse anyone without proof.”
“That is why we're asking you to tell us what you personally observed,” Brooks replied.
Evelyn explained that she had worked near the baggage-routing station on the previous afternoon. Around 12:50 p.m., she noticed Collins speaking with a man in civilian clothing near the service corridor.
She did not recognize the man.
“He wasn't wearing an airport uniform,” she said. “He had a dark jacket and carried a tablet.”
“Did you hear the conversation?”
“Only part of it.”
“What did you hear?”
“The officer asked whether the bag had been flagged. The other man said something about making sure the inspection was completed before the passenger left the terminal.”
Brooks wrote down the statement.
“Did you see which bag they were discussing?”
“I saw a black suitcase on the conveyor. I couldn't read the tag.”
“Did you see the man's face clearly?”
“Not clearly enough to identify him with confidence.”
“Could you recognize him again?”
“Possibly.”
Evelyn explained that she had not reported the conversation at the time because she assumed it concerned an ordinary security issue.
Several weeks earlier, however, she had heard a different conversation involving the same officer and an airport supervisor.
She remembered Collins saying, “I don't want another one of these cases coming back on us.”
The supervisor had replied, “Then make sure the paperwork is complete.”
Evelyn had interpreted the exchange as a discussion about administrative mistakes.
Now, after hearing about Malcolm's detention from a former colleague, she wondered whether the conversations were connected.
Brooks thanked her and asked whether she had retained any records from her employment.
Evelyn opened her notebook.
Inside were several handwritten entries concerning unusual baggage-routing incidents. She had made the notes because a supervisor had asked her to document recurring system problems.
One entry, dated eleven months earlier, described a suitcase that had been diverted to secondary inspection despite a normal initial scan.
The passenger's name matched one of the cases in the archive.
Another entry referred to a manual override issued shortly before the passenger was detained.
The third entry contained a short note:
Camera delay again. Operations says system maintenance.
Malcolm read the notes carefully.
“Did you make these entries at the time?”
“Yes.”
“Why?”
“I was trying to keep track of recurring problems. We had been told to document them.”
“Did anyone ask you to destroy the notebook?”
“No.”
“Did anyone know you had kept it?”
“Probably not.”
The notebook did not prove that anyone had planted evidence. It did, however, provide a contemporaneous record of incidents that might otherwise have been reconstructed only from incomplete electronic files.
Brooks arranged for the notebook to be photographed and preserved, with Evelyn's consent and appropriate documentation.
The investigators then asked whether she had seen the man with the tablet in any other context.
Evelyn thought for several minutes.
“He came to the operations office a few times. I remember because he wasn't an employee, but people treated him like he belonged there.”
“Could he have been Victor Sloane?”
She looked at a photograph supplied for identification purposes.
“I don't want to guess,” she said. “The man I saw had similar hair, but I couldn't swear to it.”
Brooks accepted the answer.
A witness who admitted uncertainty was more useful than one who claimed certainty without a reliable basis.
Later that afternoon, the investigators compared Evelyn's notebook with the eleven disputed cases.
The dates aligned with several unexplained routing overrides and two changes to camera configurations.
The notebook also identified a former operations manager named Alan Pierce, who had left the airport shortly after the earlier narcotics case collapsed.
Pierce had been responsible for reviewing security-system exceptions and approving certain emergency access requests.
The team located him at a consulting firm in another state.
When contacted, Pierce agreed to speak with investigators through his attorney.
He denied any involvement in evidence tampering but acknowledged that he had approved temporary access for outside contractors during a period of system upgrades.
“Were those accounts supposed to remain active after the contracts ended?” Brooks asked.
“No.”
“Were you aware that AR-17 was still active?”
“No.”
“Did you authorize the camera configuration change?”
“I approved a maintenance plan. I did not personally configure the cameras.”
“Did you know the changes affected recordings from screening room two?”
“No.”
His attorney requested copies of the relevant records before agreeing to a more detailed interview.
The investigation continued without treating Pierce's denials as either proof of innocence or evidence of guilt.
At 5:10 p.m., Evelyn contacted Brooks again.
She had remembered something else.
On the day of the earlier disputed case, she had seen a supervisor carry a small plastic container into the restricted corridor. She could not identify the container's contents, and she did not know whether it was connected to the suitcase.
But she remembered the supervisor's words when another employee asked what he was carrying.
“Just something to finish the paperwork.”
The statement could have referred to an ordinary administrative task. Without more context, it could not establish misconduct.
Still, it gave investigators another lead to verify.
Malcolm read Evelyn's supplementary statement.
“She's doing exactly what a witness should do,” he said. “Reporting what she remembers, including what she doesn't know.”
Brooks nodded.
“And her notebook gives us dates we can compare against the system logs.”