Kevin Shaw wasn’t a Northstar employee.
That was the first thing Naomi established.
He worked for MidState Automation Services, a regional contractor Horizon used for network cabinets, industrial switches, and control wiring.
That made him more useful.
Northstar’s presence might attract attention.
Kevin’s didn’t.
Technicians like him moved through factories every day carrying laptops, cables, adapters, and tools.
Nobody questioned why they needed access.
I had probably passed him twenty times.
I could picture him only vaguely.
Thin.
Quiet.
Usually wearing a dark work jacket.
Walter remembered more.
“He never talks unless you ask him something.”
“When was he here Tuesday?”
Naomi checked security.
“Entered 8:11 a.m. Left 10:52.”
My termination meeting began fifteen minutes later.
“Where did he go?”
Badge records showed network room.
Bay Two.
Bay Three service corridor.
Executive floor.
I stared at the last entry.
“Why executive?”
No scheduled work order existed.
Walter rubbed his chin.
“I saw him carrying a box up there.”
“When?”
“Tuesday.”
“What box?”
“Network switch, maybe.”
Naomi searched the maintenance system.
No equipment replacement.
No service ticket.
Kevin had spent thirty-four minutes on the executive floor without documented work.
Then Bay Three’s parameters changed.
Richard fired me.
The machine failed.
“Find his visits to other targets,” I said.
Naomi cross-referenced MidState service records against Richard’s list.
Calder Aerostructures.
Visit six weeks earlier.
Benton Medical.
Two visits.
Trellis Defense.
One.
Grant Motion Technologies.
Three.
Walter swore.
There was our physical bridge.
A contractor who could install hardware, establish local access, and leave behind persistent pathways.
“Does MidState know?” Eleanor asked.
The attorney said investigators were contacting them.
Minutes later, Naomi received their initial response.
Kevin had been employed for seven years.
No major disciplinary record.
Excellent customer feedback.
He had legitimate assignments at most of the plants.
But several visits had been altered after scheduling.
Someone added sites to his route.
Approval credentials traced to an internal MidState manager.
That manager’s initials appeared in Phase Two.
DS.
Another node.
The operation wasn’t one conspiracy where everyone knew everything.
It looked compartmentalized.
Adrian knew access.
Richard knew business pressure.
Tyler performed selected technical changes.
Martin Vale handled local interventions.
Kevin carried infrastructure.
Someone at MidState controlled scheduling.
Each person needed only enough information to perform one piece.
Cleaner separation.
The investigators asked us not to contact Kevin.
Then Walter noticed something.
“He’s scheduled here tonight.”
Everyone looked at him.
“What?”
Walter opened Horizon’s maintenance calendar.
MidState quarterly network inspection.
6:00 p.m.
Technician:
Kevin Shaw.
The appointment had been scheduled three months earlier.
Before Richard was exposed.
Before anyone knew Kevin mattered.
Naomi checked whether it had been canceled.
No.
The attorney immediately contacted investigators.
They wanted Horizon to leave the appointment unchanged.
Walter stared.
“You’re going to let him walk in?”
“We’re going to follow instructions.”
“That wasn’t my question.”
Eleanor said, “Walter.”
He looked at her.
“If that man helped cause Frank’s accident—”
“We don’t know that.”
“He was here.”
“So were hundreds of other people.”
Walter turned away.
His anger was personal now.
Frank had become the point where this stopped being corporate misconduct and became injury.
I followed him into the corridor.
“Don’t do anything stupid.”
He looked offended.
“I’m sixty-two.”
“That doesn’t answer me.”
“I have excellent judgment.”
“You climbed onto Bay Five last year while it was energized.”
“The ladder was insulated.”
“Walter.”
He sighed.
“I won’t touch him.”
“Or confront him.”
“Fine.”
“Or accidentally trap him in a maintenance cage.”
“That happened once.”
“To a vendor you disliked.”
“He should’ve read the sign.”
I waited.
Walter finally nodded.
“I’ll behave.”
At 5:43, federal investigators arrived quietly.
Not a dramatic raid.
No jackets with enormous letters.
Two people dressed like ordinary office visitors.
Another team remained nearby.
Horizon security was instructed to follow normal procedures.
I stayed in Bay Three with Walter.
Naomi monitored network activity.
Eleanor remained upstairs.
At 6:04, Kevin entered the building.
Dennis signed him in.
He carried the same black tool case from Tyler’s apartment footage.
That detail hit harder than I expected.
Kevin walked through production with no visible concern.
He nodded to Walter.
“Evening.”
Walter’s face became stone.
“Kevin.”
Kevin looked at me.
“Thought you got canned.”
“I did.”
He smiled.
“Guess it didn’t stick.”
He continued toward the network room.
Normal.
Completely normal.
That was the unsettling part.
At 6:17, Naomi messaged me.
He connected a laptop.
At 6:19:
Attempted admin authentication.
At 6:20:
Certificate deployment package accessed.
I stared at the message.
He wasn’t inspecting switches.
He was preparing the eleven-oh-seven task.
Investigators were watching.
We did nothing.
At 6:24, Kevin left the network room.
Instead of heading toward the next scheduled cabinet, he walked toward Bay Three.
Walter stiffened.
Kevin stopped beside the controller.
“Need to check your gateway.”
“No work order for this bay,” Walter said.
Kevin shrugged.
“Network team asked.”
“Which network team?”
Kevin’s eyes shifted.
Tiny movement.
Enough.
“Corporate.”
Naomi had given us explicit instructions.
Do not interfere unless safety required it.
Kevin opened the cabinet.
I watched his hands.
He connected a service cable.
His laptop screen reflected faintly in the polycarbonate panel.
A command window.
Then a file-transfer dialog.
He was installing something.
I stepped closer.
“What package?”
Kevin looked at me.
“Security update.”
“Version?”
He hesitated.
“Four-two.”
Bay Three’s gateway didn’t have a version four-two security package.
I knew because I had commissioned it.
“That’s not compatible.”
He stopped typing.
For one second, the factory seemed very quiet.
Then Kevin unplugged the cable.
“Wrong package.”
He closed the laptop.
“Good catch.”
He reached for the tool case.
Walter moved half a step.
I caught his arm.
Kevin noticed.
His expression changed.
He knew.
Maybe not everything.
Enough.
He turned toward the aisle.
Two investigators were already there.
“Kevin Shaw?”
He stopped.
“Yes?”
“We’d like to speak with you.”
His eyes moved toward the side exit.
One investigator saw it.
“Please leave the tool case where it is.”
Kevin looked at me.
Not Walter.
Me.
“You have no idea what you stepped into.”
I said nothing.
“Richard was right about you.”
Walter started forward.
I held him.
Kevin continued.
“You think this is about maintenance contracts?”
One investigator instructed him not to say anything further until his rights and status were clarified.
Kevin laughed.
“You’re protecting the wrong company.”
They escorted him away.
His tool case remained beside Bay Three.
Nobody touched it until the evidence team arrived.
Inside were ordinary tools.
Cable tester.
Crimpers.
Adapters.
Screwdrivers.
And beneath a removable foam insert, twelve hardware security tokens.
Naomi photographed the labels.
Each corresponded to a different company.
One said Horizon.
One Calder.
One Benton.
One Trellis.
The rest were companies from the missing portion of Tyler’s database.
Then the evidence technician lifted the foam completely.
A folded piece of paper lay beneath it.
Handwritten.
Times.
Company abbreviations.
Certificate identifiers.
At the bottom:
11:07 DEPLOY.
Walter looked at the clock.
6:52.
We had stopped Kevin.
But scheduled tasks didn’t need Kevin standing beside them.
Naomi called the known companies again.
Twenty-six targets.
Then Grant facilities.
Then every company identifiable from Kevin’s tokens.
We were still missing dozens.
At 7:14, investigators extracted one more item from Kevin’s laptop.
A cached synchronization record.
It contained the address of Tyler’s stolen server.
Not the old public address.
A new one.
The server was online.
Someone had moved it and reconnected it.
Naomi received legal authorization and Tyler’s prior consent to resume the copy.
She connected.
The directory appeared.
Thirty-one percent became thirty-two.
Thirty-three.
Forty.
Nobody spoke.
At sixty-two percent, new company names appeared.
At eighty, credentials.
At ninety-one, Phase Two cross-references.
At one hundred, Naomi immediately disconnected and preserved the image.
We had all eighty-three targets.
The clock showed 8:03.
Three hours and four minutes before the hidden certificate deployment.
Then Naomi opened the final folder.
One file had been modified while the server sat in its new location.
Timestamp:
6:31 p.m.
While Kevin was inside Horizon.
Meaning someone else had access.
The filename was simple.
CONTINGENCY.
Inside was one sentence.
If access network compromised, execute financial event.
Walter read it twice.
“What financial event?”
Naomi searched the server.
A second file answered.
Grant Industrial credit facility.
Execution time:
9:00 a.m. Friday.
Tomorrow.
The machine sabotage was scheduled for 11:07 tonight.
If that failed, Richard’s network intended to attack the company another way before the board could reconvene.
