Lena searched the vendor's support invoices. They were filled with phrases such as system optimization, analytic enhancement, and infrastructure maintenance. Nothing she found specifically authorized distribution of raw location histories to commercial organizations outside the municipality. A federal agent traced two destination endpoints to commercial data-service accounts that did not appear on the approved vendor list. Other destinations remained unidentified pending further requests for records.
"You can't assume those companies bought information," Mercer said.
"We haven't," Maya replied. "We know information was transmitted to destinations outside the documented municipal network. We know two recipients have been identified as commercial services. We don't yet know the contractual or financial relationship. That's the next question."
Rebecca gave a bitter laugh. "You keep saying you haven't accused anybody, but everybody in this room knows what you're implying."
"What matters is what the record establishes," Maya answered. "If I accuse your brother, that accusation has to survive more than the fact that his company name appears on a certificate. We will examine the transfers, the contracts, and the people who approved them."
Lena had been watching a series of location packages tied to recurring vehicle movements. One showed a car traveling between a courthouse parking structure and a residential street. Another recorded vehicles entering a municipal garage. Yet another combined building-entry times with nearby traffic-camera images. She knew the city collected public-safety data to investigate crimes, manage traffic, and protect municipal buildings. She also knew residents had never been told that individual movement histories might be arranged into recurring reports for outside recipients.
"People were told these cameras were for safety," she said.
"That's the purpose listed in the funding documents," Maya replied.
"They weren't told their routines might end up in somebody else's database."
Maya looked at the screen. "Consent to public safety is not consent to having personal movement records distributed beyond the authority that collected them. We need to find out what was authorized, what wasn't, and whether any residents were affected."
Owen reviewed the access requests associated with several exports. Some matched active law-enforcement cases. Others carried no investigation number or departmental user request. Rebecca suggested that the contractor might have run tests. Owen acknowledged the possibility but explained that repeated weeks of movement histories would require a stronger explanation than routine testing. Maya instructed him to preserve the anomalies without assigning motive.
Lena remembered raising concerns about overnight data traffic earlier in the year. She had written to Calvin Sloan first, asking whether a new backup procedure was causing the high volume. His reply had been brief: routine system optimization. She then emailed command administration asking whether an external analytic provider had been approved. The response read, Authorized vendor activity.
No action required. It came from a shared command mailbox associated with Mercer's office.
"Did you send this?" Maya asked Mercer, pointing to the reply.
"That account is used by several administrative employees. I don't recall the particular email."
"Then we'll preserve the mailbox history and identify which authenticated session sent it."