Chapter 3 - HREED-ADMIN
The capsule contained a microSD card.
Nothing dramatic happened when police opened it.
No secret video.
No voice recording.
Files.
That was worse.
Laura Carter had created a folder titled:
IF HELEN GETS THIS
Inside were screenshots from Westbridge’s student-release system.
Mia.
Olivia.
Ethan.
Each record had been modified between 2:11 and 2:16 that morning.
The same emergency transport flag.
The same family-services destination.
The same supporting court-order attachment.
The same approving principal.
Henry Reed.
The account used:
HREED-ADMIN
Reed stared at the printed audit report in the conference room.
“That account should not exist.”
Officer Ortiz looked at him.
“It does.”
“I mean it was supposed to be disabled.”
“When?”
“Last year.”
Helen sat across from him with a district lawyer now present.
“After Ava Keller.”
Reed looked at her.
“Yes.”
There it was.
Ortiz asked:
“Who is Ava Keller?”
Helen answered.
“First grader. Eighteen months ago.”
A woman arrived at dismissal carrying a temporary guardianship order.
The office system showed her as authorized.
Ava’s teacher brought her down.
The woman knew Ava’s birth date.
Home address.
Father’s phone number.
Everything looked right.
Except Ava refused to move.
She kept saying:
“That isn’t Aunt Kelly.”
The office nearly treated it as a child being difficult.
Helen happened to be covering the front hall.
She asked the woman for the family pickup phrase.
The woman did not know it.
The release stopped.
Police later determined the woman was a legitimate process server who had been paid by Ava’s estranged father to conduct what he called an “emergency family handoff.”
No lawful authority.
The uploaded order had been altered.
Ava went home safely with her mother.
Nobody was abducted.
But the system record was real enough to get the wrong adult through the first two layers.
Afterward, the district investigated.
The unauthorized order had been entered through a generic administrator override used by Principal Reed and two office managers during a software migration.
Reed promised the shared access would end.
The school board’s written corrective action said:
All generic or shared student-release administrator credentials terminated.
Helen looked at Reed.
“You signed that.”
“Yes.”
“Then why does HREED-ADMIN still work?”
Reed looked toward the district attorney.
Not a prosecutor—district counsel.
She did not save him.
He answered.
“Because I asked IT to restore it.”
Helen stared.
“When?”
“Four months later.”
“Why?”
“Emergency transports.”
Ortiz leaned forward.
“Explain.”
Westbridge served several families in temporary housing.
Foster placements sometimes changed late.
Domestic-violence shelter transportation changed without much notice.
Court orders arrived at 7:45 a.m. for children who were supposed to be in a different car at 2:50.
The new district system required two levels of approval for every change.
Good for safety.
Slow for emergencies.
The district student-services director asked Reed to restore a limited principal override.
“Name?”
“June Ellis.”
“Did the board know?”
“No.”
Helen stared.
“You told everyone that access was gone.”
“It was gone.”
“For four months.”
“Yes.”
“Then you quietly brought it back.”
“It was supposed to be restricted.”
“Was it?”
Reed looked at the audit.
Apparently not.
Ortiz asked:
“Who had the password?”
“Me.”
“Only you?”
Reed stopped.
Helen knew before he answered.
“No.”
“Who else?”
“June Ellis.”
“And?”
“One office manager during the first month.”
“Name.”
“Karen Boyd.”
Karen had retired.
Ortiz continued.
“Was multi-factor authentication enabled?”
“Yes.”
“Whose phone?”
Reed looked embarrassed.
“A hardware token.”
“Where?”
“Principal’s office.”
“Locked?”
“In my desk.”
“Who has access?”
Reed named six people.
Custodian.
Office manager.
District IT.
Assistant principal.
Reed.
June Ellis when visiting.
The microSD contained another file.
A scanned district memo.
Credential Control Certification — Westbridge Elementary
Signed by Henry Reed eight months ago.
One question:
Does any non-unique credential remain capable of authorizing student release?
Reed had checked:
NO.
Helen looked at him.
“You knew that wasn’t true.”
Reed’s face tightened.
“I considered the emergency token controlled.”
“The form didn’t ask whether you considered it controlled.”
No answer.
Then Ortiz opened the forged court-order attachment.
Three unrelated children.
One identical court case number.
One identical judge’s signature image.
That alone made it impossible.
The district lawyer said:
“That case number needs to be verified with the court.”
Ortiz nodded.
Then the technical investigator called from the hallway.
The 2:13 a.m. changes had not originated from Westbridge.
The school workstation had not been used.
The credential had been authenticated through the district Student Services network.
June Ellis’s building.
But there was another detail.
The request included a valid second-factor token code.
Reed stared.
“My token is in my desk.”
Ortiz said:
“We checked.”
It was.
“Then how did someone use it at two in the morning?”
The technical investigator turned the screen.
Four months earlier, Reed had approved something called:
EMERGENCY TOKEN MIRROR — DISTRICT CONTINUITY
A duplicated token for central Student Services.
Reed’s electronic signature sat at the bottom.
He looked at the form.
Then said:
“I don’t remember signing that.”
Helen looked at him.
May you like
This time she believed him.
That did not make the signature disappear.
