The account used to access the archive belonged to Ward, but the session had been initiated through a remote connection. The workstation was located in his office, yet the access originated from a separate terminal connected through an authorized internal network.
The investigator traced the connection to a conference room on the second floor.
Someone else had been using a terminal associated with a procurement meeting room.
The access log showed a temporary credential issued to a visiting technical consultant.
The name attached to the credential was Peter Lawson.
***
Back at the security office, Victoria received the update.
SECURITY COMMANDER: "Ma'am, the digital investigator has traced the session. The archive was accessed using a temporary credential issued to Peter Lawson."
VICTORIA HAYES: "Where is Lawson now?"
SECURITY COMMANDER: "We are checking his location."
GENERAL ROBERT MITCHELL: "Was he using Ward's account?"
SECURITY COMMANDER: "The session was authorized through Ward's account, but the remote connection originated from a terminal assigned to Lawson's temporary credential."
Victoria considered the information.
VICTORIA HAYES: "So Ward authorized the access, and Lawson used it."
SECURITY COMMANDER: "That appears to be the case."
GENERAL ROBERT MITCHELL: "Then we have both of them connected to the archive."
VICTORIA HAYES: "We still need to establish why Lawson moved the file in the first place."
The commander opened the preserved archive record.
SECURITY COMMANDER: "The original file was moved to a restricted storage directory. We have recovered the directory reference, and the records team is attempting to retrieve the contents."
VICTORIA HAYES: "How long?"
SECURITY COMMANDER: "It depends on whether the file itself remains intact."
VICTORIA HAYES: "Then I want the recovery process prioritized."
The commander nodded.
Victoria's phone vibrated again. This time, the message came from a number she recognized.
It was Daniel Foster.
LIEUTENANT DANIEL FOSTER: "Ma'am, I just received information from one of the officers who attended the ceremony. He says Peter Lawson has left the building."
Victoria immediately called him.
VICTORIA HAYES: "Daniel, where did you get that information?"
LIEUTENANT DANIEL FOSTER: "A colleague from the event security team. He said Lawson was seen leaving through the east entrance about twenty minutes ago."
VICTORIA HAYES: "Did anyone stop him?"
LIEUTENANT DANIEL FOSTER: "No, ma'am. At the time, they didn't know he was connected to the archive."
VICTORIA HAYES: "Did he leave alone?"
LIEUTENANT DANIEL FOSTER: "The officer said he was with another man, but he couldn't identify him."
VICTORIA HAYES: "Thank you. Send the officer's contact information to the investigator. Do not attempt to locate Lawson yourself."
LIEUTENANT DANIEL FOSTER: "Understood, ma'am."
Victoria ended the call.
GENERAL ROBERT MITCHELL: "Lawson may know that the archive access has been discovered."
VICTORIA HAYES: "If he does, he may try to destroy whatever evidence he still has."
GENERAL ROBERT MITCHELL: "I'll have the investigators locate him."
VICTORIA HAYES: "And I want the original guest registration records from the ceremony. We need to establish who invited him and whether his attendance was arranged through Grant's office."
Mitchell contacted the event administration team.
A few minutes later, the security commander received another update.
SECURITY COMMANDER: "We've identified the second person who left with Lawson."
VICTORIA HAYES: "Who?"
SECURITY COMMANDER: "A man named Thomas Reed. He is listed as a consultant for Grant Defense Solutions."
Mitchell looked at Victoria.
GENERAL ROBERT MITCHELL: "Another connection to Grant."
VICTORIA HAYES: "Find out whether Reed had access to the procurement archive."
SECURITY COMMANDER: "We are checking."
The answer came sooner than expected.
Reed had no direct access to the restricted archive, but he had been authorized to attend technical briefings related to the communications equipment. His name appeared on several meeting attendance lists, including one held two days before the revised report was submitted.
Victoria asked for the attendance record.
When it arrived, she found something that immediately caught her attention.
The meeting had been attended by Peter Lawson, Thomas Reed, Colonel Stephen Ward, and two representatives from Grant Defense Solutions.
The official meeting summary described it as a routine technical consultation.
However, the summary did not include the technical evaluation team.
It did not include the independent validation officer.
And it did not include any record of the original equipment failures.
Instead, the discussion had been described as a review of deployment readiness.
VICTORIA HAYES: "This meeting took place before the revised report was submitted?"
SECURITY COMMANDER: "Yes, ma'am. Two days before."
VICTORIA HAYES: "Then the revised report may have been prepared after this meeting."
GENERAL ROBERT MITCHELL: "We need the meeting minutes."
SECURITY COMMANDER: "The official minutes are available. There is also an attachment that appears to have been removed from the standard archive."
VICTORIA HAYES: "What kind of attachment?"
SECURITY COMMANDER: "A technical presentation file. The record lists its title as 'Operational Readiness Assessment.'"
Victoria leaned forward.
VICTORIA HAYES: "Who uploaded it?"
SECURITY COMMANDER: "Peter Lawson."
The name appeared again.
Victoria closed her eyes briefly, then opened them.
VICTORIA HAYES: "Recover that presentation."
***
In a private medical room at the event venue, Alexander Grant sat on a chair while his attorney reviewed a document on a tablet.