Chapter 20: Tony's Intervention

The timestamp on Tony's secondary security log read 8:43 AM when the pattern resolved itself, and it did so with the particular clarity of something that had been obvious for at least six hours and had simply required enough data points to become undeniable.

He had been running two parallel analyses since Viktor's extraction proposal — the operational side, which was clean and well-structured and would require about fourteen hours of prep to execute properly, and the forensic side, which was where things had gotten interesting in the way that things becoming interesting at 8 AM after no sleep was never actually interesting and was always, specifically, bad.

The forensic side had started with a single anomaly: the Kowalczyk removal creating a sub-level two coverage gap that should not have been possible if standard protocol had been followed. Standard protocol required the deputy director's sign-off on any personnel action that affected security rotation. Hill had bypassed the deputy director. Tony had found this in a routine access log at 6:15 AM, catalogued it as bureaucratic friction, and moved on.