Chapter 12 - William Morgan’s Signature
Rachel nearly fell into the same trap again.
Father’s signature.
Therefore father created the problem.
Rebecca stopped her.
“Read the document.”
It authorized diagnostic credential mirroring during system testing.
Legitimate.
William signed as technical certifier.
The dangerous part appeared in an appendix added afterward.
Appendix C expanded diagnostic access from testing to operational systems.
William’s signature appeared there too.
Forgery?
No.
Handwriting experts believed it authentic.
Then Rachel found the date.
Appendix C was signed eight months after William left Aegis.
He occasionally consulted afterward.
Possible.
Rebecca found his calendar.
That day William was in hospital receiving chemotherapy.
Could still have signed remotely.
Rachel located a scanned fax in family records.
William had indeed received a document from Aegis in hospital.
Her mother had saved the transmission sheet.
He signed something.
So William knowingly approved Appendix C?
Rachel found a note on the back in his handwriting:
Rebecca — they changed page 6 after I signed. Stop deployment.
There.
William signed one version.
Someone substituted a page afterward.
The signature remained genuine while the meaning changed.
That technique explained the entire case.
Not sophisticated credential theft at first.
Document substitution.
Later remote access.
The attacker repeatedly exploited authentic authorization by changing context around it.
Just as Mercer changed context around evidence.
Just as Hale’s signature on the casualty report looked like personal identification.
The story itself had been built from genuine pieces arranged to create false conclusions.
Rachel finally understood the method.
Who had physical access to William’s signed documents after hospital?
Aegis records manager.
Name:
Laura Bennett.
No relation to anyone else.
She was interviewed years ago and cleared.
Rachel found her current address.
Laura had died two years earlier.
But her original interview survived.
She claimed Appendix C came to her already assembled from the program office.
Who delivered it?
A courier.
No name recorded.
Then Rachel noticed the courier authorization code.
RM-17.
Rebecca recognized it.
Not a person.
Records Management, route seventeen.
Rachel laughed bitterly.
Another set of initials that looked like a suspect and wasn't.
The courier trail ended.
But Aaron’s new recording implied a different route.
We gave them access ourselves.
Everyone signed diagnostic consent.
Who administered the diagnostic program?
Dr. Samuel Reed.
The professor who had helped Rachel.
He had been at Kestrel.
He had told her Aaron was not the leak.
He had appeared helpful from the beginning.
Rachel confronted him.
Reed did not run.
Instead he opened his office safe.
“I wondered when you'd get here.”
Inside were original diagnostic logs.
He had hidden them twelve years.
Why?
Because they proved his software had been used to mirror credentials.
“Did you do it?”
“No.”
“Who?”
“I don't know.”
Rachel almost shouted.
Reed explained that his diagnostic system generated temporary credential copies during testing.
Those copies should expire after sixty seconds.
Someone changed the expiration function.
Copies persisted indefinitely.
Reed discovered it after Kestrel.
He hid the logs because he feared prosecution for negligent design.
Cowardice again.
Not necessarily sabotage.
Then Rachel found a code annotation.
The change had been approved under user:
A.MORGAN.
Aaron.
Her brother again.
Reed said Aaron never wrote it.
How could he know?
“Because Aaron brought it to me before Kestrel.”
Aaron had discovered someone using his account to modify the diagnostic software.
That was the proof he intended to retrieve during the fire.
The ORPHEUS drive contained it.
Where was the drive?
Reed looked at Rachel.
“Mercer took it.”
Mercer had claimed Aaron went back for it.
Rachel confronted him.
Mercer’s face hardened.
May you like
Then he reached inside his coat.
For twelve years, Daniel Mercer had possessed the object everyone had been searching for.
