Chapter 2 - The Whistleblower Report
The Calder report was real.
That was the second disaster.
By eight the next morning, Moretti Group's independent audit committee met by secure video instead of Luca's dining room.
No engagement dinner.
No champagne.
No family.
Just lawyers, auditors, and tired faces on a screen.
Luca joined from Miriam Cole's office.
Alessandra Moretti chaired.
“Before we discuss the surveillance breach,” she said, “we need to separate it from the underlying allegation.”
Good.
Two problems.
Not one.
The anonymous report alleged that Bellini Infrastructure had received a draft environmental-risk score, a preliminary subcontractor-cost range, and one internal Moretti ranking memo before submitting its final Calder Terminal bid.
If true, Bellini could have tailored pricing and risk promises.
Who leaked?
Unknown.
The report named CFO Nathan Grant and Bellini COO Charles Bellini as possible contacts.
No proof Nathan had leaked anything.
The report contained two screenshots of emails, one calendar entry, and one spreadsheet fragment.
Enough to investigate.
Not enough to condemn.
Janelle Park, internal-audit director, summarized.
“Bellini's final bid improved precisely in three areas highlighted by our draft review.”
Could be coincidence.
Could be good bid preparation.
Could be a leak.
Then she said, “We have preserved source systems.”
Luca asked, “Why was this meeting on my personal synced calendar?”
Silence.
His scheduler answered through counsel.
Luca had requested the meeting after the engagement dinner and told staff, “Put it everywhere so I don't forget.”
So the calendar entry synchronized to the personal tablet Vanessa could access.
The subject line:
CALDER - INTERNAL REVIEW.
The location:
HOME LIBRARY.
His convenience had exposed both topic and room.
That did not excuse Vanessa.
It explained part of the breach.
Then Adrian Mercer.
Investigators checked Northline.
Northline had been retained as a subcontractor beneath a legitimate competitive-intelligence firm called Sentinel Market Advisory.
Sentinel had been hired by Hartwell Urban Systems, another Calder bidder.
Hartwell's general counsel, Priya Mendel, contacted Moretti counsel voluntarily after police reached out.
“We authorized no covert recording,” she said.
Could be true.
Invoices to Hartwell described market analysis, permit tracking, competitor news, executive-background research, and bid-environment monitoring.
All potentially lawful.
Northline was one layer down.
Adrian Mercer was another.
Public records showed Adrian had once sold conference and event technology, then moved into corporate investigations and competitive research.
His licensing status for investigative work was unclear and under review.
No need overstate.
Then Ortiz obtained warrants for relevant account records.
Vanessa's messages with Adrian began six days earlier.
He contacted her.
Not the reverse.
First message:
You deserve to know what Luca's people are saying about your father before it ruins your wedding.
Then a screenshot.
A real Moretti internal calendar entry.
Timestamped before Vanessa ever replied.
That mattered.
Adrian already had inside information.
Then another fragment:
BELLINI - POSSIBLE PRE-BID ACCESS / REVIEW TONIGHT.
Likely derived from the whistleblower workflow.
He told Vanessa:
Your father may be getting set up.
She asked:
By whom?
Adrian answered:
Possibly Moretti finance. You need to hear exactly what they say.
Then:
I can help.
Vanessa asked:
Are you with my father's lawyers?
His answer:
Adjacent. They know me.
Ambiguous.
She chose to read it as yes.
Then he sent device instructions.
One message made Miriam stop.
Vanessa:
Is this legal?
Adrian:
You're a resident and party to the event. Monitoring your own home is allowed. Don't overthink it.
That was at minimum dangerously incomplete.
Vanessa accepted because she wanted permission.
Then:
Who hears it?
Adrian:
Me. I'll tell you if they're setting Enzo up.
No disclosure of Northline.
No Hartwell.
No Sentinel.
Then he asked:
Send seating plan.
Vanessa did.
Why?
She thought he needed to know Luca's chair.
The plan contained guest names, head-table positions, and room arrangement.
Not confidential board documents.
Still useful operational intelligence.
Then he asked:
Do you have event tech sheet?
Vanessa said no.
Good.
Someone else supplied technical information later.
Then the library visitor.
The man on camera was identified as Joel Sykes.
Freelance AV installer.
Police contacted him.
He cooperated immediately.
He had been hired through a legitimate event-staffing marketplace for a four-hour “conference connectivity service.”
The work order told him to verify cable path, install a temporary remote diagnostic bridge, and test conference microphones after floral setup.
He believed he was authorized.
Why?
He received the mansion address, a room floor plan, event reference number, temporary credential instruction, and the name of a real wedding production coordinator.
At vendor check-in, a badge waited.
CROWN VALE TECHNICAL.
Fake company, real-looking paperwork.
He did not know Luca.
Did not know Vanessa.
Did not know Bellini.
Did not know Hartwell.
He was paid four hundred eighty dollars.
Not a co-conspirator by default.
Then what did he install?
A small network bridge in the library conference cable cabinet.
The room already had built-in microphones for hybrid meetings.
Normally they stayed offline unless the room system was activated.
The bridge could allow remote diagnostic access.
And, if misused, remote audio access.
Forensic logs showed one test connection the previous afternoon.
Forty-seven seconds.
Empty room.
Then an activation job scheduled for 7:40 p.m.
Five minutes before the private meeting.
So the chair transmitter may have been backup.
Or it may have captured pre-meeting conversation before everyone moved to the library.
Either way, Adrian wanted more than reassurance.
Then badge creation.
Wedding production coordinator Nora Wells received an email requesting one extra AV technician.
The message used correct event number and named actual vendors.
The sender domain looked similar to a real production vendor but had one extra word.
Nora approved without calling.
Why?
Event chaos.
Hundreds of vendor changes.
Credential requests all day.
Weak control.
Not criminal intent.
Then the floor plan.
Where did attacker get it?
Vanessa's seating plan included only dining areas.
But a broader event floor plan was stored in a shared wedding portal.
Who had access?
Vanessa.
Nora.
florist.
caterer.
lighting vendor.
security liaison.
photographer.
several assistants.
Too many.
Tomas said, “We treated wedding information as low risk.”
Luca looked at him.
“It wasn't.”
Not once it included private meeting rooms and access paths.
Again:
system problem.
Then underlying Calder evidence.
The two email screenshots in the whistleblower report were suspicious.
One appeared to show Nathan Grant emailing a confidential risk score to a Bellini address.
Forensics found no such message in server logs.
Closer review showed the screenshot combined a real email header from Nathan to an internal Moretti account with an attachment title from a different message.
Manipulated.
Not necessarily by the whistleblower.
Could have been forwarded to them already altered.
Then the spreadsheet fragment.
Real.
It came from procurement scoring.
Who had accessed it?
Nine employees.
One contractor.
One audit account.
Not only Nathan.
Then the calendar meeting between Nathan and Charles Bellini.
Real.
Lunch twelve days before final bids.
But there were four other attendees from a hospital foundation board.
Receipt.
Calendar invites.
Photographs.
Could Calder have been discussed privately?
Possible.
No evidence yet.
Then Janelle said:
“We cannot conclude Bellini had no leak merely because one screenshot is false.”
Correct.
A false exhibit can coexist with a real underlying problem.
So the audit continued.
Then Hartwell.
If Adrian planted or amplified a false allegation to weaken Bellini and Moretti confidence, Hartwell could benefit.
But no evidence yet Hartwell knew.
Sentinel's contract required lawful methods.
Northline's subcontract also prohibited pretexting, unauthorized access, and surreptitious recording.
On paper.
Mason Hart, Northline owner, said Adrian acted outside scope.
Investigators seized relevant records.
Then they found the compensation schedule.
Adrian received a monthly retainer plus:
$35,000 success intelligence bonus if Hartwell advanced to exclusive negotiations.
Motive.
Who created bonus?
Northline.
Did Hartwell know?
Its invoices showed only a flat “project milestone fee.”
No Adrian name.
Layering hid incentives.
Then Luca asked the board:
“What happens to Calder?”
Alessandra answered:
“We pause final selection.”
Good.
No awarding Bellini as apology.
No disqualifying Hartwell before facts.
The third bidder remained.
All bidders were notified that the process was under independent integrity review.
The delay would cost money.
Financing schedules.
Labor planning.
Permit windows.
Espionage harms systems, not just pride.
Then Enzo Bellini called Luca through counsel.
“I did not ask Vanessa to do this.”
Luca answered:
“I know that is what she says.”
“That is not what I said.”
Fair.
Then Enzo continued.
“Give your investigators everything. We'll do the same.”
Good.
Then:
“Do not make my daughter the whole story.”
Luca stared.
“She put a device under my chair.”
“Yes.”
“She sent a stranger my seating plan.”
“Yes.”
“That is her part.”
“Yes.”
Then Enzo said:
“But the man who contacted her already had your calendar.”
There.
Correct.
“Find the rest.”
No fathers shouting in a ballroom.
Then Grace returned to work two days later.
She expected whispers.
There were some.
Claire Morton, house manager, stopped them.
“No gossip during shift.”
Grace had a formal HR meeting.
Tomas.
Claire.
HR counsel.
Not Luca.
They asked only what she personally knew.
Vanessa changed chair.
Grace saw device.
Vanessa threatened dismissal.
Then HR asked:
“Do you want to continue working here?”
Grace blinked.
“Yes.”
“Any concerns?”
“That people think I was spying.”
Claire said:
“You reported equipment you recognized.”
Then:
“You are not responsible for what it captured.”
Grace went back to linens.
No promotion.
No reward.
Then staff training changed.
If unfamiliar electronic equipment, cables, packages, or vendor devices appear in private residential or meeting spaces:
stop.
do not manipulate.
call event security.
No detective work.
Simple.
Then Luca met Vanessa with counsel again.
He had not ended the engagement.
Yet.
He asked one question.
“When Adrian sent you a real internal screenshot, did you wonder how he got it?”
Vanessa looked away.
“Yes.”
“And?”
“I didn't want to know.”
That mattered more than ignorance.
“Why?”
“Because if I asked, he might stop telling me things.”
Luca closed his eyes.
Willful blindness.
Then Vanessa said:
“I thought your company was about to accuse my father before our wedding.”
“You could have asked me.”
“You would have said you couldn't discuss an internal investigation.”
“Yes.”
“Exactly.”
She almost sounded triumphant.
Then understood what she had said.
The boundary was legitimate.
Her desire to know did not create a right.
Luca said:
“You wanted an answer you weren't entitled to.”
Vanessa cried.
“Yes.”
The whistleblower report had been bait because it contained enough truth to frighten her.
May you like
Adrian had known exactly where to press.
But somewhere inside Luca's own systems, someone had leaked enough real information for that bait to exist in the first place.
