Chief Mercer stood beside a command terminal. His executive session had just invoked the department's emergency cyber-response protocol. Maya crossed the room and asked him to step away. Mercer removed his hand from the keyboard and faced her.
"Someone used an administrative channel to reroute a federal transport," he said. "This is exactly when a department activates an intrusion response."
"We know an unauthorized command came through a contractor channel," Maya replied. "We don't yet know whether an outsider compromised it or someone authorized to use it acted improperly. Tell me what the emergency package is doing."
Mercer described the intended purpose: isolate affected systems, reset sessions, and protect operational data. Lena opened the configuration. Her face tightened as she examined the active functions. The procedure was not merely containing communications. It was reclassifying portions of administrator history as potentially compromised and separating some events from the account identities that originally authenticated them.
"Those relationships are how we establish who did what," Lena said. "An emergency response should preserve them, not strip them away."
Owen checked the configuration independently. "The events may not be completely deleted, but the active chain linking actions to user sessions is being altered. If the protocol finishes, reconstruction will become more difficult."
Mercer spread his hands. "That's what cyber containment does. It separates compromised activity."
"It should preserve the original relationship before changing how a system uses the information," Elise answered. "We're evaluating whether this package does that."
Maya watched Mercer's face. She had interviewed executives who believed the safest response to an investigation was to speak with absolute certainty about systems they barely understood. Mercer was different. He seemed to know enough to choose terminology carefully, enough to describe an obstruction as protection without ever directly saying that the evidence should disappear. She did not conclude that he was guilty. She concluded that his actions required the same precise recording he had previously signed on behalf of other people.
Ben arrived at the command area with a message from dispatch. Mercer turned toward him. "Officer Carter, shut down the routing terminal and disconnect it from the network."
Ben stopped. The terminal in question was preserving the unauthorized route attempts sent toward Nathan's vehicle. He looked at the active screen, at Owen, and then at Mercer. He could hear the first green verification message from the morning almost as if he were standing at the front desk again.
"Sir, federal personnel are preserving that evidence."
"I know what they're doing. Shut the terminal down."
Ben did not move. Mercer took a step toward him. "Officer Carter, that's an order."
"Please put it in writing, sir."
The words startled Ben as much as they startled everyone else. He had rehearsed none of them. They simply came from the knowledge that a verbal order could later become a fog of competing recollections, while a written instruction would preserve what was actually demanded. Mercer stared at him.
"Are you refusing a lawful command during a security incident?"
"I'm asking you to document it. The terminal is holding evidence under federal preservation. If it needs to be shut down, I want the reason in writing."