Brooks requested the account history through the airport's technical-security team. She did not attempt to access the account herself. She wanted a preserved record showing whether the credential had been used after Avery's death and, if so, which systems had accepted it.
The first response arrived twenty minutes later.
The account had authenticated successfully three times during the previous month.
Twice, the activity appeared to be routine system maintenance.
The third authentication had occurred that morning.
At 10:14 a.m.
Three minutes before Mitchell received the alert.
Brooks read the timestamp twice.
“That's too close to be coincidence,” Mitchell said.
“It may be connected,” Brooks replied. “We will not decide that until we have the full records.”
Daniel sat opposite her.
“Can you identify the device used to authenticate?”
“The technical team is checking.”
“Was the account supposed to remain active?”
“No.”
“Then the first question is how it remained usable.”
Brooks nodded.
“The second question is whether someone deliberately retained access.”
“And the third?”
“Who knew it was there.”
Daniel looked at her with a new degree of respect.
“Those are the right questions.”
Brooks did not smile.
“Questions are easy. Evidence is harder.”
She turned to Mitchell.
“Officer, I need you to reconstruct every action you took from the moment the alert appeared. Start with where you were standing.”
Mitchell described his patrol route, the time he checked his device, and the point at which he first saw Daniel.
He explained that the alert had included a photograph of Daniel taken from a distance. The image showed him walking through the terminal with the leather bag in his right hand.
Brooks looked up.
“You didn't mention a photograph.”
“I didn't think it mattered.”
“It matters now.”
“Why?”
“Because the sender had a current image of Mr. Mercer. We need to determine when it was taken and how it was obtained.”
Daniel leaned forward.
“May I see it?”
Brooks showed him the image.
He examined it carefully.
The photograph had been taken from behind a column near the departure gates. It showed Daniel's face in partial profile and the distinctive handle of his bag.
His expression changed.
“Where did you get this?” he asked Mitchell.
“From the alert.”
“I understand that. Did you see the image before you approached me?”
“Yes.”
“Did you notice anything unusual about it?”
Mitchell shook his head.
Daniel pointed to the lower-right corner.
“Look at the reflection in the glass.”
Brooks enlarged the image on her screen.
A faint shape appeared in the reflection of a nearby information panel. It was not clear enough to identify a person, but it suggested that the photograph had been taken from a position closer to the central walkway than the column itself.
“Could it have come from a security camera?” Mitchell asked.
“Possibly,” Brooks said. “But we cannot establish that from this image alone.”
Daniel studied the photograph again.
“The camera angle is wrong for the ceiling cameras in this terminal.”
Brooks looked at him.
“How can you tell?”
“I travel through here frequently. The ceiling cameras are mounted higher and point downward at a steeper angle. This image was taken from roughly shoulder height.”
“You're certain?”
“I'm certain it doesn't look like the usual overhead-camera perspective. I am not claiming to know who took it.”
Brooks wrote down his observation.
“Then we will ask the technical team to compare it with the terminal camera layout.”
Mitchell rubbed his palms against his trousers.
“This is getting out of control.”
Brooks turned toward him.
“It became serious when an unverified instruction led you to seize a passenger's property.”
“I didn't seize it.”
“You attempted to.”
“I was told to secure it.”
“By an unknown sender.”
Mitchell looked away.
Daniel watched him for a moment.
“You can still help establish what happened.”
Mitchell gave a short, bitter laugh.
“After this, do you really think anyone is going to believe me?”
“Belief is not the same as evidence.”
“What does that mean?”
“It means your statement may help establish the truth, even if your judgment is questioned.”
Mitchell stared at him.
For the first time, he seemed to understand that Daniel was not trying to destroy him. Daniel was trying to separate what Mitchell had done from what someone else might have arranged.
That distinction did not excuse the officer's conduct.
But it gave him a path forward.
“I'll give the full statement,” Mitchell said.
Brooks nodded.
“Good. And you will not contact the sender again.”
“I understand.”
A knock sounded at the door.
Brooks opened it to find a uniformed airport employee carrying a sealed evidence-storage envelope. The employee explained that the technical-security team had prepared a digital preservation package containing the alert's available metadata.
Brooks signed for the envelope, checked the seal, and documented the transfer.
She did not open it immediately.
Instead, she placed it on the desk and called the communications supervisor to confirm the contents and the procedure for accessing them.
Only after the details were verified did she examine the accompanying report.
The report included a partial routing history, an authentication timestamp, and an internal account identifier.
At the bottom was a note from the technical team:
THE ARCHIVED ACCOUNT WAS ACCESSED USING A CREDENTIAL ASSOCIATED WITH A SECOND AUTHENTICATION FACTOR.
Brooks read the line aloud.
Mitchell frowned.
“Does that mean someone had Avery's password?”
“Not necessarily,” Brooks replied. “It means the account accepted a second authentication factor. We need to determine how that happened.”
Daniel looked at the report.
“If the account was properly disabled, a valid second factor should not have been enough to reactivate it.”
“Correct,” Brooks said. “Which means we need to know whether the account was disabled properly, whether the authentication process was misconfigured, or whether the record we are seeing is incomplete.”
She turned the page.
A final detail had been added beneath the authentication record.
The second factor had been verified through a device registered under the name T. AVERY — ADMINISTRATIVE ACCESS.
Mitchell stared at it.
“But he's dead.”
Brooks did not answer.
Daniel leaned back in his chair, his eyes fixed on the report.
“Someone didn't merely use a forgotten account,” he said.
He looked at Brooks.
“Someone maintained the means to authenticate as a dead man.”
CHAPTER 6 — THE BAG THAT WAS NEVER THE TARGET
By early afternoon, the airport's technical-security team had secured the available records related to the suspicious alert.
The investigation was still in its early stages. No one had established who sent the messages, whether the sender had acted alone, or whether the account associated with Thomas Avery had been compromised before or after his death.
Brooks understood that every conclusion remained provisional.
But the pattern was becoming difficult to ignore.
Someone had obtained Daniel's location.
Someone had created a notification that appeared official.
Someone had directed a police officer to stop him and secure his bag.
And someone had continued sending instructions after Brooks began questioning the original message.
The bag had become the center of the encounter, but Daniel suspected that it was only part of the plan.
“May I ask you something?” he said.
Brooks looked up from her notes.
“Of course.”
“If I had surrendered the bag immediately, what would Officer Mitchell have done next?”
Mitchell shifted uncomfortably.
“I would have secured it and contacted a supervisor.”
“Would you have opened it?”
“Not without further instructions.”
“Would you have documented who instructed you to take it?”
“I would have recorded the alert.”
“Would you have known whether the instruction was legitimate?”
Mitchell said nothing.
Daniel nodded slowly.
“That's the problem.”
Brooks folded her arms.
“Explain.”
“The person who sent the alert may not have needed the bag itself. They may have needed to create a situation in which I could not leave, my property could be handled by someone else, and an official record would later show that the airport had acted on an intelligence warning.”
“You think the goal was to create a record,” Brooks said.
“I think it is one possibility.”
“What would that record accomplish?”
“Several things. It could make an ordinary document review look like a security incident. It could create a reason for other agencies to become involved. It could give someone a basis to claim that my documents were improperly handled.”
“Or it could simply be an attempt to obtain the documents,” Mitchell said.
“Yes,” Daniel replied. “That is another possibility.”
Brooks looked at the bag.
“Has anyone asked you to open it since the encounter began?”
“No.”
“Has anyone offered a lawful basis for searching it?”
“No.”
“Then we will not treat the alert as permission to do either.”