Chapter 6 - WHO OWNS THE TOKEN
The note in Della’s drawer changed the investigation more than the attack did.
The attack proved someone wanted evidence.
The note proved someone inside Serrano Maritime wanted Della to keep looking.
Maybe.
Or wanted her to look in a specific direction.
That distinction mattered.
Mira treated the note as hostile until proven otherwise.
Good.
Forensics found:
standard office printer toner,
common copy paper,
no usable prints,
no DNA value,
fold consistent with hand,
typed in eleven-point Calibri.
Half the building could have made it.
Camera review showed seven people passed near Della’s desk during conference.
Priya.
Two legal assistants.
A mail clerk.
Vanessa.
Mason Reed.
And a facilities technician.
No one visibly opened drawer.
Angle had blind spot.
Of course.
“Locked?”
Mira asked.
Della held key.
“Yes.”
“Who has master?”
“Facilities.”
“Executive office manager.”
Della frowned.
“I am executive office manager half the time.”
“Officially?”
“No.”
There.
Invisible labor again.
Formal master-key control sat with facilities director and security.
Noel’s department.
But Noel was on leave.
Could still have duplicate.
Could be someone else.
Note said:
THE EXTENSION DIDN’T COME FROM KESTREL.
ASK WHO OWNS THE TOKEN.
Token.
Digital credential.
Mira’s team traced.
The Kestrel admin account that requested ROK-7 extension used certificate token issued not to Kestrel.
To Serrano Maritime.
Specifically:
SERRANO CONTINUITY NODE 03.
A machine identity.
Not person.
There.
Who owned node?
Information-security disaster-recovery cluster.
Managed jointly by:
IT compliance,
operations continuity,
and executive security.
Three departments.
Again.
Lyle Kern.
Mason Reed.
Noel Brice.
Victor had oversight.
Damian had executive authority.
The system was designed to survive any one person.
So responsibility was beautifully diluted.
Mira hated beautifully diluted things.
Della loved the phrase.
At four, board audit committee authorized full forensic image of continuity node.
This could disrupt systems.
IT protested.
Mira asked whether they preferred investigators copy around fraud risk.
They stopped protesting.
Good.
Node logs had been partially rolled after maintenance.
But cloud monitoring retained authentication events.
ROK-7 extension request occurred at 2:14 a.m. six months earlier.
Remote access originated from VPN endpoint assigned to Serrano Maritime’s disaster-recovery office.
Physical office empty overnight.
Badge logs:
No entry after 10:03 p.m.
Remote session.
Account used:
L.KERN.
There.
Lyle Kern.
Easy suspect.
Too easy.
Mira interviewed him same day.
Lyle was forty.
Thin.
Sweated when nervous.
Sweated immediately.
He denied making request.
“Password compromised?”
“Maybe.”
“Multi-factor?”
“Yes.”
“Method?”
“Hardware token.”
“Where?”
“In my desk.”
“Who accesses?”
“No one.”
Wrong.
Cleaning?
Facilities?
Security?
Emergency admin?
He corrected.
“Technically security master.”
There.
Noel again.
Too neat.
Lyle said he had been at home sleeping.
Phone records consistent.
No proof he wasn’t remote.
Home IP did not match VPN origin? The session used disaster office endpoint via internal jump host.
Could remote into jump host first.
Logs missing? Partly.
Mira asked:
“Did you know ROK-7?”
“No.”
“River Oak?”
“No.”
“Continuity node?”
“Yes.”
“Could Kestrel request use it?”
“Not without client-side relay configuration.”
There.
“Who configured?”
Lyle checked memory.
“Mason.”
Victor’s deputy.
Another name.
Mason Reed was interviewed.
Calm.
Early fifties.
Operations career twenty-seven years.
He admitted configuring relay eighteen months earlier.
“Why?”
“Vendor migration.”
“Did you know ROK?”
“Yes.”
There.
Everyone leaned.
“What did you understand it to be?”
“A legacy emergency destination correction class.”
Correct.
“Did you know expired?”
“Yes.”
“Who asked to restore?”
“Victor.”
There.
Too neat again.
“Why?”
“Continuity exercise.”
“Documentation?”
“Packet.”
“The seventeen-page packet.”
“Yes.”
“Did you extend six months ago?”
“No.”
“Know it happened?”
“No.”
“Did you have access?”
“Yes.”
“Lyle’s token?”
“No.”
“Node?”
“Yes.”
Good.
“Any reason someone would use node rather than Kestrel token?”
Mason thought.
“To make request appear client-authenticated.”
There.
“Would that bypass vendor scrutiny?”
“Possibly.”
“Would vendor see Serrano node.”
“Yes.”
Not Kestrel.
The anonymous note was accurate:
extension didn’t come from Kestrel.
Mason did not know who extended.
Or said he didn’t.
No lie proof.
Della listened to summary from Mira after.
Not live.
Good.
She said:
“Everyone points sideways.”
Mira nodded.
“Systems were designed that way.”
“Who benefits?”
“Good question.”
Money.
Cargo.
Fees.
Maybe smuggling.
Maybe sanctions evasion.
Maybe customs duty fraud.
Still unknown.
Mira continued:
“Ellis Crane finally gave statement.”
Della sat straighter.
“Tell me.”
“Limited. Protected.”
“Okay.”
Twelve years ago, River Oak Key was used legitimately during a six-week dock strike threat.
Arthur Cole administered for Serrano Coastal Freight.
Ellis worked broker side.
After program ended, Arthur asked Ellis whether expired keys could still process destination changes.
Ellis said vendor controls should block.
Months later, he saw one go through.
Not Serrano cargo.
Another client.
He confronted Arthur.
Arthur denied.
Ruth later found Ellis.
Hence note.
“Did Arthur run scheme?”
“No evidence.”
Good.
“Did Ellis think he did?”
“He suspected someone with old credentials was testing system.”
“Who?”
“Unknown.”
“Why ‘house’?”
Della remembered Ruth:
key comes from “house.”
Mira said:
“Broker slang. ‘House’ meant shipper’s internal authorization, not person or family.”
There.
A mystery word became ordinary.
Good.
“Did Ellis see Victor involved?”
“No.”
That mattered.
“Victor worked under Arthur then?”
“Yes, junior operations.”
“Any link?”
“Ellis remembers him. Nothing specific.”
Good.
“Northstar?”
“Current. Not historical.”
“ROK-7?”
“Key class existed. Number seven may have been Serrano Coastal allocation.”
There.
“Who inherited credentials after merger?”
Mira looked.
“That is now central question.”
Serrano Coastal merged systems into Serrano Maritime nine years ago.
Data migration led by:
Arthur Cole,
Mason Reed,
and outside IT firm Calder Systems.
Victor supervised business integration.
Noel joined company later.
Lyle later.
So route predated some suspects.
Conspiracy older.
Maybe new actors inherited.
Maybe same origin.
No full answer.
Good.
At five thirty, Della left early.
Doctor order.
Half-day exceeded anyway.
In elevator, Vanessa entered.
Silence.
Then:
“I heard there was note.”
Della looked sharply.
“How?”
Vanessa flinched.
“Everyone heard security swabbed your desk.”
Fair.
Office impossible.
Vanessa looked at bruise fading.
“You okay?”
“Yes.”
Then Della said:
“Did your father ever talk about River Oak?”
Vanessa’s face changed.
“No.”
“Arthur?”
“My grandfather?”
There.
So Arthur was Victor’s father, Vanessa’s grandfather.
Good.
“Did he?”
Vanessa thought.
“He had a boat named River Oak.”
Della froze.
“What?”
Vanessa blinked.
“Small fishing boat.”
No.
Coincidence?
Maybe program named after boat?
Or vice versa?
“Where?”
“Sold years ago.”
“When?”
“After he retired.”
“Why River Oak?”
“I don’t know.”
Della’s pulse changed.
“Tell Mira.”
Vanessa stared.
“You think—”
“I think nothing.”
Good.
“Tell her.”
Vanessa nodded.
At lobby, independent security asked if Della wanted car.
She said yes.
That was new.
Not surrender.
Choice based on risk.
Good.
In car, Damian called.
“Bad time?”
“No.”
Another new thing.
He asked first.
“Mira says token was Serrano node.”
“Yes.”
“Lyle account.”
“Yes.”
“Mason configured.”
“Yes.”
“Victor originally requested restore.”
“Yes.”
“And Ellis gives nothing against Victor.”
“Correct.”
Damian exhaled.
“Every piece points near him and none points at him.”
“There.”
“Exactly.”
“Do you think that is deliberate?”
Della looked out window.
“Maybe.”
“Or coincidence?”
“Yes.”
“Or he built architecture that someone else uses.”
“Yes.”
“Or he uses architecture carefully enough not to touch.”
“Yes.”
Damian was quiet.
“You’re very annoying.”
“Paper-trained.”
Good.
Then:
“Vanessa remembered Arthur had a boat called River Oak.”
Silence.
“Did he?”
“You knew him.”
“I never saw boat.”
“Tell Mira.”
“I will.”
“Do not investigate family photo albums yourself.”
His tone was suspiciously precise.
Della smiled.
“You know me.”
“Unfortunately.”
There.
The line sat between them.
More personal than either expected.
Silence.
Damian said:
“I want to ask something not work.”
Della’s chest tightened.
“Dangerous.”
“Dinner when doctor clears you for full evenings.”
There.
Not now.
Not injured dependent employee? Still employee.
She stared.
“You’re my boss.”
“I know.”
“Very much my boss.”
“Yes.”
“No.”
Good.
He exhaled.
“Understood.”
“Also investigation.”
“Yes.”
“Also I was attacked because of company records.”
“Yes.”
“Also everyone already thinks secretaries sleep with powerful men the second they matter.”
His voice went cold.
“Who said—”
“Do not hunt hypothetical person.”
He stopped.
Good.
“It’s a workplace fact.”
“Yes.”
She continued.
“So no.”
“Understood.”
Then Della said:
“If review ends and reporting line changes someday, ask again.”
Silence.
Not promise.
Boundary.
Damian’s voice softened.
“I will remember.”
“Paper is safer.”
He laughed quietly.
“I’ll write it down.”
Good.
That night, Mira traced Arthur Cole’s boat.
River Oak.
Registered twenty-one years earlier.
Named before emergency routing program.
The port vendor’s project lead had once sailed with Arthur.
Maybe the key was named as an internal joke.
Maybe that was all.
But the boat’s old registration address led to a marina storage company.
That company shared an accountant with Northstar Agricultural Equipment.
Current.
Twelve years apart.
Same accountant office.
Not proof.
A bridge.
Thin.
Real.
Della stared at Mira’s email.
Conspiracy did not look like one red thread.
It looked like a thousand ordinary services that should not know each other and somehow did.
Accountants.
Brokers.
Security contractors.
Routing vendors.
Storage companies.
All legal until used otherwise.
All deniable alone.
Ruth had been circling it.
Now Della understood why her aunt never published.
She had pieces.
Not story.
Della touched locket.
May you like
Then closed laptop before midnight.
For once, curiosity did not get to choose her sleep.
