The crew chief froze the frame.
Nobody looked at Shaw anymore.
Every eye was on the figure beside him.
The person stood partly behind the convoy’s lead vehicle, face hidden by the angle of the camera. One hand rested against the door. The other held what looked like a folded route sheet.
Erin enlarged the image.
The pixels softened.
“Don’t,” the crew chief said.
She stopped.
“What?”
“If you enhance it here, Shaw can claim we altered the image.”
Shaw folded his arms.
“I’m already saying that.”
Erin removed her hand from the keyboard.
“Then we preserve the drive.”
She reached for it.
Shaw moved too.
The crew chief stepped between them.
“Sir.”
Shaw stopped.
That single word carried a warning.
Everyone had watched him accuse Erin of deleting the footage.
Now the supposedly deleted footage was playing from the original drive she had protected.
And Shaw was standing inside it.
His own voice had ordered the convoy onto the west road.
Erin looked at him.
“Why did you change the route?”
“I didn’t.”
She pointed at the screen.
“That’s you.”
“You have an image and a voice.”
“Your image and your voice.”
“You don’t know when it was recorded.”
The crew chief answered.
“I do.”
Shaw looked at him.
The crew chief tapped the camera identifier.
“Reserve drone launched at 0438. It returned at 0611. That file came from the onboard storage.”
“The timestamp could be wrong.”
“The aircraft clock synchronizes before launch.”
“Could still be wrong.”
Erin looked at the frozen image.
“Then let’s check something that doesn’t depend on the clock.”
She advanced three frames.
The lead vehicle’s rear panel became visible.
Its convoy number could be read clearly.
C-17.
The crew chief exhaled.
“That’s the ambushed convoy.”
Shaw said nothing.
Erin advanced again.
The unidentified figure stepped closer to Shaw.
The route sheet unfolded.
A finger touched the map.
Then the recording captured another voice.
“West road puts them twelve minutes behind.”
Shaw replied:
“That’s enough.”
The room went silent.
Erin turned toward him.
“Enough for what?”
Shaw looked at the drive.
Not at her.
The crew chief noticed.
So did everyone else.
“Sir,” he said, “step away from the terminal.”
“You’re giving me an order now?”
“No, sir.”
The crew chief picked up a radio.
“I’m preserving a recording connected to an attack on our people.”
Shaw’s expression hardened.
“You have no idea what you’re looking at.”
Erin stood.
“Then explain it.”
He didn’t.
The crew chief called security.
Shaw left before they arrived.
He was allowed to.
At that point, the footage raised serious questions, but no one in the room had authority to detain a lieutenant colonel based solely on what they’d seen.
The drive did not leave Erin’s sight.
Within twenty minutes, investigators had it.
Within an hour, they had the reserve drone’s internal storage.
By evening, they had something even more important.
The supposedly erased three minutes had never been erased from the aircraft.
They had been removed only from the mission archive.
Someone had logged into the archive under Erin’s credentials and deleted the copied segment after the drone returned.
That was why Shaw had accused her.
Her login was there.
Her name was there.
But Erin had saved the original before the archive changed.
“Why did you make the copy?” an investigator asked her.
“Because the convoy deviation didn’t make sense.”
“When did you notice it?”
“During review.”
“Before or after the ambush?”
“After.”
“What bothered you?”
“The west road.”
“Why?”
“It wasn’t assigned.”
“Could the convoy commander have changed routes?”
“Yes.”
“Did they?”
“No.”
The investigator looked up.
“You checked?”
“Immediately.”
The convoy commander had never ordered the change.
According to surviving crew members, the lead vehicle received a route correction shortly before departure.
They believed it came from operations.
The instruction told them construction had blocked their assigned road.
There was no construction.
Someone had lied.
The convoy turned west.
Fourteen minutes later, it entered the area where the attack occurred.
Erin had found the deviation during routine footage review.
She copied the relevant segment because she expected investigators would want it.
Then she checked the mission archive again.
Three minutes were missing.
She reported it.
Shaw arrived less than fifteen minutes later.
He accused her of deleting the footage.
Then he tried to take the drive.
The investigator leaned back.
“How did Shaw know which three minutes were missing?”
Erin stared at him.
“I never told him.”
That became the next question.
Who had told Shaw?
Investigators pulled access records.
Erin’s account had been used at 0718 to remove the segment.
At 0712, her workstation was locked.
At 0714, Erin entered the briefing room.
Three people confirmed it.
She couldn’t have been at the terminal at 0718.
Someone had her credentials.
Or something that functioned as them.
Cybersecurity examined the login.
The password was correct.
But the authentication token wasn’t Erin’s.
It came from a maintenance credential capable of assuming user sessions during system troubleshooting.
Only four people had access.
Shaw wasn’t one of them.
The unidentified figure beside the convoy suddenly mattered even more.
Investigators went frame by frame.
Face obscured.
No readable name tape.
No clear rank.
But details accumulated.
A ring on the right hand.
A dark watch.
A narrow reflective strip on the sleeve.
And when the person stepped away from the lead vehicle, a laminated badge swung briefly from a belt clip.
One frame captured its bottom edge.
Erin zoomed only after investigators created forensic copies.
Three letters were visible.
SYS.
Systems.
Not enough for a name.
Enough for a department.
The maintenance credential used to access Erin’s session belonged to systems support.
Investigators produced a list.
Nine people.
Four had the required archive permissions.
Two were working elsewhere when the convoy departed.
One was on leave.
That left Staff Sergeant Owen Mercer.
The crew chief knew him.
“He maintains the drone archive.”
Erin looked at the frozen figure.
“Does he wear a ring?”
Nobody answered.
They didn’t need to.
Investigators found Mercer before midnight.
He denied being near the convoy.
Then they showed him the footage.
He said the image was too poor to identify anyone.
Then they showed him a gate camera.
At 0421, Mercer entered the vehicle staging area.
At 0424, he walked toward the convoy.
At 0430, the reserve drone captured him beside Shaw.
Mercer stopped denying he was there.
He changed explanations.
Shaw had asked him to deliver a route sheet.
That was all.
“Did you know the route had been changed?” investigators asked.
“No.”
“Did you access Erin’s account?”
“No.”
“Did you delete footage?”
“No.”
“Did you know the reserve drone recorded the staging area?”
Mercer hesitated.
That hesitation mattered.
“Yes.”
“Did Shaw?”
“I don’t know.”
Investigators seized Mercer’s work computer.
They found no copy of Erin’s password.
They found something worse.
A script designed to use the systems-maintenance token to enter active user sessions without requiring the user’s password again.
It was a legitimate diagnostic function.
Mercer had used it at 0718.
He had entered Erin’s session.
He had removed the three-minute segment.
But that still didn’t prove why.
Then investigators recovered a deleted message from Shaw.
REMOVE STAGING SEGMENT BEFORE INCIDENT REVIEW.
Mercer had answered:
WHAT ABOUT AIRCRAFT STORAGE?
Shaw:
ARCHIVE IS WHAT THEY’LL CHECK FIRST.
Mercer:
AND IF THEY CHECK THE RESERVE?
There was no response.
Erin understood immediately.
That was the mistake.
Shaw knew about the primary archive.
Mercer knew about the archive.
Neither expected Erin to pull the original file from the reserve drone.
The backup aircraft wasn’t supposed to be the main observer that morning.
It had been launched because the primary drone developed a sensor fault before takeoff.
A routine substitution.
Nothing Shaw had planned for.
The reserve drone captured the staging area from a different angle.
And unlike the main archive, its onboard storage remained untouched.
That explained the deletion.
It did not explain the west road.
Investigators reconstructed the convoy plan.
The original route avoided a narrow industrial corridor.
The west road entered it.
Shaw had authority to recommend a change.
He did not have authority to secretly reroute the convoy without recording a reason.
No route-change request existed.
No construction warning existed.
No operations message existed.
Only the paper Mercer carried to the lead vehicle.
The document was recovered from the convoy’s paperwork after the attack.
At first glance, it looked legitimate.
Correct header.
Correct mission number.
Correct vehicle list.
Wrong approval signature.
Someone had copied the operations chief’s signature from an older document.
Mercer admitted printing it.
He said Shaw provided the file.
Shaw denied that.
For several days, the investigation stalled there.
Then one of the convoy survivors remembered something.
The west-road instruction had included a timing requirement.
Maintain speed through Checkpoint Seven.
Why?
The route sheet didn’t explain.
Investigators checked traffic cameras.
At Checkpoint Seven, a civilian utility vehicle entered the road shortly before the convoy arrived.
It stayed ahead of the lead vehicle for six minutes.
Then turned away.
The driver was identified as a contractor named Caleb Voss.
Voss had previously worked on communications equipment at the installation.
His contract had ended four months earlier.
Why was he on the west road?
Voss claimed coincidence.
Phone records disagreed.
He had communicated with Mercer seventeen times during the week before the ambush.
He had also called Shaw.
Twice.
Now the case changed again.
The assumption had been that Shaw and Mercer rerouted the convoy into an attack.
But the records didn’t support that conclusion.
Voss wasn’t connected to the attackers.
At least investigators found no evidence of it.
Instead, Voss was connected to something inside the convoy.
Vehicle C-17 carried several encrypted communications components scheduled for transfer.
One component had an unresolved inventory discrepancy.
Its serial number appeared in two systems simultaneously.
Investigators discovered that Voss had signed maintenance paperwork for the same component months earlier.
The west-road diversion had a different purpose.
Shaw intended C-17 to stop briefly near Checkpoint Seven.
Voss would inspect the disputed component before the convoy continued.
Off the books.
Why?
Because an official inspection would have exposed years of falsified maintenance records.
Shaw had approved those records.
Mercer had helped manage the electronic entries.
Voss had performed some of the work.
They weren’t trying to cause an ambush.
They were trying to hide an equipment problem.
That distinction mattered.
It didn’t make what they did harmless.
The unauthorized route change put the convoy somewhere it wasn’t expected to be.
The attack occurred there.
Investigators could not establish that Shaw knew an attack was waiting.
They found no communication between him and the attackers.
No payment.
No warning.
No evidence of coordination.
What they found was negligence wrapped in concealment.
Shaw changed the route for his own undisclosed purpose.
Mercer created the false paperwork.
Voss waited near Checkpoint Seven.
Then the convoy was attacked before their planned inspection could happen.
Afterward, Shaw understood exactly what the route change would look like.
So he panicked.
He told Mercer to remove the staging footage.
Mercer used Erin’s session.
When the deletion was discovered, Shaw blamed Erin.
The investigator explained it to her carefully.
“We can’t say Shaw sent the convoy into an ambush.”
Erin nodded.
“But he sent them onto the road.”
“Yes.”
“For a reason he concealed.”
“Yes.”
“And after the attack he tried to hide that.”
“The evidence supports that.”
Erin looked through the interview-room window.
For days, she’d wondered whether the hidden figure in the drone footage had been waiting for the convoy to be attacked.
The truth was less deliberate.
And in some ways more infuriating.
Nobody needed to plan the attack.
They only needed to decide that their secret was important enough to ignore the approved route.
One unauthorized decision created the opportunity for everything that followed.
Mercer eventually cooperated.
His explanation was simple.
Shaw outranked him.
The maintenance records were already wrong.
Voss promised he could correct the serial-number problem without triggering an audit.
They believed a twelve-minute route change would solve it.
Nobody would know.
Then the convoy was attacked.
Mercer wanted
