Chapter 165
The Second Key
The ledger demands two Vale-family keys, which makes distrust part of its lock.
Rina refuses to let any of us touch the data card.
She has converted the city lab's interview room into a controlled key test. The original card remains sealed in the evidence locker. A forensic working image sits on an isolated machine operated by the city's technician. Adrian, Malcolm, and I have each placed our registered devices into numbered signal bags on a separate table. Rina controls the test order under her employee-trust engagement, and the prosecutor's evidence officer records every attempt.
"This is authentication, not family therapy," she says. "If anyone needs the second, use the hallway."
Adrian almost smiles. Malcolm does not.
The volume header identifies two cryptographic certificates issued through Vale Corporation's old director-continuity system. The corporate security office built that system nine years ago, and its certificate registry moved to the city during the current forensic standstill. The city is custodian of the registry export; the corporation retains historical backup tapes under preservation order. Its vulnerability is attribution. A certificate can show which registered key completed a cryptographic operation. It cannot prove who physically held an unlocked device at every prior use.
Rina begins with my current director key.
The technician removes my phone from its signal bag after the officer verifies the seal number. I enter my code behind a privacy screen, then surrender the device without opening any other application. The isolated bridge reads the certificate identifier and sends a challenge to the forensic copy.
The volume rejects it.
"Does that mean Elliot never had access?" Malcolm asks.
"It means this certificate is not one of the two required by this volume," Rina says. "His older certificates may have expired, been replaced, or never been included."
I sign the attempt log. Failure feels strangely clean. The lock does not care that I am director, that my removal vote failed, or that I have spent months carrying Wondervale's consequences. It recognizes a specific key or it does not.
Malcolm's test comes next. He surrendered board privileges, but his trust device retains a historical family certificate for archived instruments. His lawyer confirms that presenting it for this test does not restore corporate authority. The technician issues the challenge.
Rejected.
Malcolm's mouth tightens. "Owen would have used mine."
"This is Lowe's encrypted volume," Rina says. "We have not established that Owen selected either key."
The correction lands harder than the rejection. Malcolm has been trying to read every family object as a final message from his father. The card may contain Owen's stolen identity without containing Owen's intention.
Adrian places both palms flat on the table before the examiner opens his device.
"My certificate entered the refinancing package," he says.
The evidence officer asks whether this is a new disclosure.
"The package and its transfer chain are already disclosed. What I did not say is that Lowe advised me to preserve the old continuity key when corporate security rotated director credentials. He called it protection against an Elliot-controlled system."
I look at him. "When?"
"Three weeks before I approached the lender."
"Why did you keep it?"
"I was afraid you would turn a family emergency into your personal mandate. I wanted a route you could not close, and Lowe made my ambition sound like prudence."
He says each reason without asking me to choose the most forgivable one.
Rina interrupts before the room becomes what she prohibited. "Was the key ever copied?"
"Not by me. That is belief, not verification. Security can inspect the device history."
The city technician notes that device history may reveal exports or certificate operations retained locally. It may miss a copy made through an unlogged vulnerability or another authorized system. The statement neither clears nor accuses him.
Adrian unlocks his device behind the screen. The bridge sends the challenge.
One half of the access indicator turns green.
Nobody speaks for several seconds.
The forensic system creates a challenge receipt at 9:17, identifies Adrian's certificate, and signs the result with the lab's test key. The city lab retains the receipt with the case image. Its vulnerability is meaning. The match proves Lowe configured the volume to accept Adrian's key. It does not prove Adrian knew about the card, supplied data, or ever opened it.
"I did not know," Adrian says.
I believe he may be telling the truth. Belief cannot be the custody rule.
"Your device stays with the lab until they complete the authorized history review," I say.
His eyes lift to mine. "You do not have authority to order that."
He is right.
Rina turns to him. "The prosecutor has requested voluntary continued custody. You may decline and require a warrant decision. Your adviser agreement separately requires preservation and disclosure, not surrender without process."
Adrian reads the request. He calls independent counsel from the hallway, returns twelve minutes later, and signs a limited consent allowing the lab to retain and examine certificate history only. Other personal and privileged material remains outside scope, subject to filter procedures.
"I am leaving it because the record should not depend on your trust," he tells me.
"Agreed."
The answer does not repair us. It gives repair a surface strong enough to stand on later.
The volume still needs a second key. The registry export lists every certificate eligible under the old continuity system, but the encrypted header does not display the second identifier until the first challenge succeeds. Now the technician can compare the partial response with registry entries without submitting random family devices.
Rina orders a documented offline match. The technician runs the header's public key fingerprint against the city-held registry export. One result appears.
Nico Vale.
Corporate security issued his certificate for operational continuity after a warehouse accident six years ago. The office created it at 2:43 p.m., Nico accepted it through a registered device, and the registry logged renewal two years later. The city holds the current export. Its vulnerability is present control. The registry establishes issuance and renewal, while it cannot show whether Nico still possesses the matching private key or whether a device compromise exposed it.
"He is at Lakefront Motion Works," I say.
Rina checks the authorized schedule. Nico signed out of the carousel inspection to observe the supplier fit test. His mandate requires a check-in when he arrives and another when he leaves. The supplier's front desk confirmed his arrival at 1:06 yesterday. No departure receipt entered the shared system.
I call him.
The call rings until voicemail.
Adrian reaches for his own device before remembering it is sealed. "Try the supplier."
Rina makes the call through the recorded case line. Lakefront's manager says Nico attended the fit test, reviewed shipping records with their compliance lead, and left at 5:38. Lakefront security created the visitor ledger at entry and exit, its badge system added the timestamps, and the supplier retains it. Its vulnerability is destination. It records his departure from the gate, not where he went afterward.
"Was he alone?" Rina asks.
"He left alone."
That is testimony from the manager, not yet video corroboration.
Malcolm stands. "Open the location service on the family plan."
"No," I say.
His head turns. "He may be in danger."
"And we do not know whether he consented to family tracking or whether the service is active. We call authorities and provide the last verified location."
Malcolm presses both hands against the back of his chair. Control is close enough for him to taste. Then he sits.
"Call them," he says.
It is the smallest surrender in the room and perhaps the most difficult.
Rina contacts the city investigator assigned to the failure map. I give Nico's vehicle details and emergency contact information. Adrian supplies the supplier route he helped model, but labels it a likely route rather than a known one. The investigator requests Lakefront's gate video and nearby traffic-camera preservation. A preservation request protects material from routine deletion; it is not authority to seize or view every recording.
The employee charter vote begins in forty-three minutes.
June messages the governed coalition channel to confirm that polling sites are open, serialized ballot boxes are with observers, and paid voting time remains in effect. She does not know Nico is unreachable. Telling her may be necessary for security. Delaying the vote would also let a family emergency become executive control over the first employee election.
I ask Rina to keep the card sealed.
"That was always the plan until both keys and counsel were present," she says. "Your fear did not create the custody rule."
I accept the rebuke.
The evidence officer reseals the working session record. Adrian's device remains under his limited consent, Malcolm's is returned after its failed attempt, and mine goes back into my hand. The data card has changed our information without surrendering its contents: Adrian was one intended key holder, Nico the other, and Lowe designed a family cooperation test around evidence of family abuse.
At 9:29, the city investigator confirms an active welfare inquiry. At 9:31, June reports the first ballot cast by a night-shift maintenance worker who stayed past the end of his shift to vote.
I call Nico again.
Voicemail.
The charter vote begins, and Nico stops answering calls.