Chapter 85
Paid Leave, Locked Devices
My shift schedule was printed for someone who had written my bus route in red ink.
By six that evening, I want every supervisor who touched the file escorted out of Wondervale. I say it in the Lakefront field office with the evidence receipt between my hands and six organizers waiting on the secure line.
"Remove them now," I tell Elliot. "Badge access, system access, supervisory authority. All of it."
He does not ask me to lower my voice. Marisol sits beside me as worker counsel; Nico occupies the far end of the table under the seven-day task-group mandate. Camille has brought the access map. Elliot is here as director, which means his anger is less important than the order he is permitted to sign.
Municipal inspectors created the seizure inventory at 4:31 p.m. today. Grace Kim remains custodian of the physical schedules, photographs, and route notes. The newest workforce export carries a creation timestamp from three days ago and identifies terminal NSC-HR-04. The city produced a redacted working index for counsel at 5:42. Its vulnerabilities are serious: a terminal ID does not identify the user; the print footer can be copied; the box was unsealed for years; and anyone with schedule permissions could have supplied the underlying data.
Camille's access map narrows the possible accounts to nine supervisors and two HR administrators. The map was created by Identity Operations at 5:18 from current permission tables, witnessed by the city's technical officer, and transferred to Marisol at 5:37. Wondervale retains the live system; the city holds a signed export. Its vulnerability is historical drift. Current permissions may differ from those in force when earlier schedules were printed.
"Eleven people had the access," I say. "Take all eleven out."
Nico shakes his head. "If we suspend everyone with permission, whoever used the terminal will know the investigation has no login attribution. They may destroy records we have not found."
"They already know we found the box. Municipal vans carried it through the service gate."
"Knowing we found paper is different from knowing which system path investigators can trace."
"So your strategy is to leave organizers reporting to possible stalkers."
His expression hardens. "My strategy is to preserve access long enough to identify the person."
"Our safety is not bait."
The words stop the room. Nico looks toward the evidence index rather than defending himself. His private warehouse route helped reach this point, but covert work has taught him to accept risks for other people if the result might be useful. The schedules make that habit impossible to disguise.
Elliot turns to Marisol. "What does worker counsel recommend?"
He asks her before offering his own solution. The order of that question changes who owns the response.
Marisol draws three circles on a legal pad: people, devices, evidence. "We protect all three. Limited paid administrative leave for accounts with a direct connection to terminal NSC-HR-04 or the storeroom. Temporary reporting changes for every organizer named in the box. Device preservation for all eleven permission holders, executed simultaneously by the city technical officer."
Camille checks the logs. Six supervisors either authenticated at the terminal in the past month, supervised the workshop wing, or approved its access list. The two HR administrators have schedule permission but no North Service access. Three other supervisors can view schedules from different facilities.
"Why paid leave?" one organizer asks through the speaker.
"Because leave protects workers without turning an unresolved access link into a public finding of guilt," Marisol says. "Unpaid suspension would invite an emergency challenge and could force disclosure of evidence before preservation is complete."
I hate how reasonable it sounds. Fury wants a visible consequence. Counsel is offering a narrow one that may survive morning.
"What happens to their teams?" I ask.
"Interim supervisors chosen outside the implicated reporting chain," Camille says. "Organizers can request reassignment without losing shifts or premiums."
"And the devices?"
Nico answers more carefully this time. "The city officer photographs each device in place, records the custodian, isolates network access, and creates a forensic image. Wondervale cannot search the contents independently. Personal material receives a privilege and privacy review."
"Vulnerability?"
"Company devices may not contain activity performed through shared terminals. A forensic image preserves what is there; it does not restore what was never logged."
Marisol adds a fourth measure. Six supervisors lose all system and building access the moment notices are delivered; the remaining five accounts keep employment access but lose schedule exports and procurement folders pending review. City monitors watch for deletion attempts. Organizers receive outside security contacts chosen by the employee legal trust, not corporate security.
I ask for one more protection. Nobody named in the seized schedules should have to disclose a home route to receive security. Harbor Shield can offer pickup points, changed parking assignments, or remote check-ins selected by each worker. Marisol adds the options to the order. The trust will hold the selections; Wondervale receives only the operational instruction it must follow.
Camille warns that same-day schedule changes can trigger attendance flags in payroll. She creates a protected override code at 6:09, witnessed by Marisol, and sends the code table to the employee trust. HR remains the live-system custodian. The vulnerability is misuse by future supervisors, so the code expires in fourteen days and every use generates a city-visible report.
The detail sounds small beside surveillance. It decides whether a worker who changes a bus stop loses a shift for arriving late.
Elliot reads the proposed order. "June, does this protect people quickly enough?"
"If the six lose access before anyone warns them."
"Nico?"
He looks at the simultaneous-preservation timetable. "It preserves the devices and narrows the response. My objection is withdrawn."
He does not pretend his first plan was equally protective. The admission matters more than agreement.
I ask the organizers to vote on the temporary reporting changes and security protocol. All six approve. Two request relocation from North Service. One wants to remain with her team but asks that no supervisor receive her full schedule. Camille makes both options available and records the choices as protected HR instructions.
At 6:34, Marisol signs the worker-protection recommendation. She created it during this meeting, with the time displayed on the secure record. The employee legal trust holds the original. Its vulnerability is reliance on current access logs and the risk that simultaneous notice will fail at one location. Kim's technical team controls execution to reduce that risk.
Elliot signs the administrative order at 6:36. He does not broaden it. Camille transmits sealed instructions to six city officers positioned across Wondervale. Nico remains in the field office without contacting operations.
The first notice lands at 6:41. System access closes before the supervisor finishes reading. The second and third follow within a minute. One company phone is powered off before isolation; the officer bags it and records the state rather than forcing it on. Another supervisor tries to call Jonah. The monitoring officer preserves the attempt but does not answer or impersonate either person.
At 6:45, all six supervisors are on paid leave. Their badges no longer open Wondervale doors. The other five accounts lose schedule-export and procurement access. Interim reporting instructions reach affected workers at the same time, followed by a plain statement that the action is protective and not a finding of misconduct.
One suspended supervisor refuses to surrender his badge, claiming he needs it to retrieve medication from his office. The city officer does not block the request or let him enter alone. A neutral security employee retrieves the labeled prescription while the supervisor watches through the doorway. The officer records the accommodation and seals the badge afterward. Preserving evidence cannot become an excuse to deny ordinary dignity; respecting dignity cannot restore access.
The change is immediate. A night cleaner named in the box can begin her shift without reporting to the supervisor who approved the workshop access list. Two seasonal organizers receive schedules through Camille's protected desk. The people on the secure line stop asking whether they should stay home.
"Preservation status?" Marisol asks.
Kim answers through the city channel. Five devices are secured. The powered-off phone is sealed. Server logs show no bulk deletion after the order. A procurement folder was accessed from one supervisor's account at 6:39, two minutes before notices began.
Nico leans toward the screen. "Which file?"
"We will identify it after imaging," Kim says. "The log is city-held. Do not enter the system."
He sits back. "Understood."
Elliot follows worker counsel again when Communications asks whether the supervisors were involved in surveillance. Marisol provides the line: six employees are on paid leave while independent officials preserve evidence related to unauthorized use of workforce information. The company will not identify them or claim guilt.
"That sounds weak," I say after the call ends.
"It leaves room for a witness to tell the truth," Marisol replies.
She is right sooner than I want her to be.
At 7:12, her secure line rings. Counsel for one of the suspended supervisors has received the preservation notice. His client will surrender a personal notebook and explain who requested the organizer schedules.
"Conditions?" Marisol asks.
The lawyer names them: continued paid leave, protection from retaliation, and immunity for every schedule export he admits making.
Marisol's pen stops above the page.
"He can request protection," she says. "He does not get immunity by naming a price."
The lawyer answers with one fact. His client exported the schedules at Jonah Reed's written request.
Every request carried an authorization code belonging to a Vale director.