Chapter 3 - The Anonymous Employee
The whistleblower was not a conspirator.
Her name was Nina Cole.
Twenty-six.
Junior procurement analyst.
Employed by Moretti Group for eleven months.
She had never met Vanessa Bellini.
Never spoken to Adrian Mercer.
Never heard of Northline Strategic Research.
Nina came forward through counsel after internal audit asked whether the anonymous reporter would be willing to verify how the evidence had been obtained.
She had used the company's whistleblower portal exactly as policy instructed.
Janelle Park met her with outside counsel present.
No Luca.
No supervisors.
Nina looked terrified.
“I thought I was going to get fired.”
Janelle answered:
“You reported a concern in good faith.”
Then:
“That does not make every attachment accurate. It also does not make your report wrong to submit.”
Good.
Nina explained.
Three weeks earlier, an envelope arrived at her apartment.
Not office.
That frightened her now.
At the time, she thought someone inside Moretti did not trust company channels.
Inside:
printed email screenshots,
the scoring spreadsheet fragment,
a note.
ASK WHO GAVE BELLINI THE CALDER SCORE.
No return address.
Why Nina?
She worked on bid normalization.
Her name appeared on public procurement conference agendas and one trade association page.
Anyone could find.
She took the material to work the next morning.
Did not confront anyone.
Did not call press.
She submitted anonymously through the ethics portal.
Exactly what an employee should do when uncertain.
Then the digital copy.
How did attachments reach the portal?
Nina scanned paper.
So metadata of original files was lost.
That had made forensics harder.
Adrian, if he sent them, had chosen paper deliberately.
Then apartment building camera.
A courier left envelope.
App-based same-day service.
Pickup:
public locker near a downtown coworking space.
Account paid with prepaid card.
No immediate identity.
But the note's printer pattern matched a printer seized from Northline's office.
Not conclusive alone.
Combined with other evidence:
strong.
Then one of Adrian's messages to Mason Hart surfaced.
A week before Nina received envelope:
Need internal alarm before final meeting. Once M starts investigating B, access window opens.
M:
Moretti.
B:
Bellini.
Investigators believed.
Mason said he did not remember.
Then:
“Internal alarm.”
Adrian may have manufactured the whistleblower trigger itself.
But why choose Bellini?
Because Bellini was the bidder most likely to react defensively.
And because Vanessa was marrying Luca.
A personal access point.
Then Janelle asked Nina:
“Did you recognize the spreadsheet fragment?”
“Yes.”
It looked like a procurement score worksheet.
And it was.
Mostly.
The numbers were real.
The label was not.
The fragment said:
CALDER INTERNAL FINAL ENVIRONMENTAL RISK RANGE.
Actual file title:
CALDER PRELIMINARY ENVIRONMENTAL ASSUMPTIONS.
Different.
The numbers had existed in a preliminary appendix prepared by an environmental consultant.
Then the discovery that changed the Bellini investigation.
The appendix had accidentally been visible in the bidder data room for eighteen minutes.
Two months earlier.
A permissions update mistakenly moved a folder from:
INTERNAL REVIEW
to:
BIDDER SHARED.
Automated logs recorded access.
Who downloaded?
Bellini Infrastructure:
one user.
Hartwell Urban Systems:
two users.
Third bidder:
none during window.
The file was removed after data-room administrator noticed.
What happened next?
Moretti procurement sent a notice to all bidders:
A preliminary environmental document was inadvertently made accessible. It is incomplete and should not be relied upon. Any downloaded copy must be deleted and confirmed.
Bellini confirmed deletion.
Hartwell confirmed deletion.
Why had internal audit not connected?
Because whistleblower report called it a confidential “final risk score,” not preliminary assumptions.
And the data-room incident had been logged as minor.
Then Bellini's user.
Charles Bellini's estimating director.
He downloaded.
Did he open?
Audit logs from Bellini, voluntarily produced, showed file open for four minutes.
Then internal email:
This looks accidental. Do not use. Delete and wait for clean package.
They deleted.
Could they remember numbers?
Of course.
Humans cannot unsee.
Bellini's later bid improvements overlapped with some assumptions.
Was that improper?
The procurement integrity review concluded:
the accidental disclosure contaminated process for all bidders with access, even if they acted appropriately.
That meant Moretti itself had a procurement problem.
Not Bellini cheating necessarily.
Then Hartwell.
Its two users also downloaded.
One forwarded file internally before deletion request.
Hartwell's counsel found and disclosed.
The forwarded copy reached:
estimating,
risk,
and Sentinel Market Advisory.
There.
Sentinel had the real preliminary data.
From Hartwell.
Even after deletion instruction.
That was more serious.
Hartwell said forwarding occurred before the notice and copy should have been destroyed after.
It was not.
Sentinel retained.
Then Sentinel sent parts to Northline for “market context analysis.”
So Adrian had a real Moretti document.
Not from a secret Moretti traitor.
From a data-room permission error compounded by Hartwell's poor deletion controls.
That explained one fragment.
Then calendar screenshot.
Not procurement system.
Where from?
Investigators traced image dimensions and interface.
It was a screenshot from the shared wedding tablet.
Vanessa's tablet?
No.
Luca's personal tablet backup synchronized photographs automatically to a household cloud album for wedding planning.
Why would a calendar screenshot be in photos?
Three weeks earlier, Luca had taken a screenshot of his calendar and texted it to Vanessa:
This is why I can't do the florist meeting Tuesday.
The screenshot showed several business calendar entries.
One:
CALDER - INTERNAL REVIEW.
He sent it to her.
Vanessa had forgotten.
Her wedding cloud backup was shared with the planning portal so event assistants could retrieve approved photos and reference material.
Bad design.
The screenshot entered the portal media folder.
Adrian's team later obtained portal access through the fake vendor credential.
So he had the screenshot before contacting Vanessa.
Luca stared when Tomas explained.
“I sent him the bait myself.”
“Indirectly.”
“Still.”
Then:
“Why could a fake vendor see personal photos?”
The portal had role permissions.
But Nora Wells had granted CROWN VALE TECHNICAL “event production” access, which included media assets.
Too broad.
Again:
convenience.
Then the fake email screenshot accusing Nathan.
Forensic comparison showed header taken from Luca's calendar screenshot? No. Better from a real email leaked via Sentinel? Let's keep Adrian fabricated using public/available materials and one internal attachment title from Hartwell copy. He needed Nathan's email format, easily inferred.
Investigators found a draft image on Adrian's laptop after warrant.
Layers separated.
Text boxes.
Header.
attachment name.
There.
Fabricated.
Nathan was cleared of sending that email.
Not cleared of everything in life.
Just this accusation.
Then Charles Bellini.
No evidence he received confidential scoring memo.
Bellini did have exposure to accidentally shared preliminary appendix.
They disclosed it.
Independent procurement counsel concluded no evidence Bellini used unauthorized internal scoring or coordinated with Moretti staff.
Would Bellini remain bidder?
The board had to decide because process was contaminated unevenly.
Third bidder saw nothing.
Bellini saw preliminary file briefly.
Hartwell's ecosystem retained and weaponized it.
The fairest response might be restart part of procurement.
Expensive.
Likely necessary.
Then Nina.
She learned the evidence she reported had been manipulated.
Her first reaction:
“I ruined everything.”
Janelle said:
“No.”
Nina cried.
“I triggered the investigation.”
“You triggered review of evidence someone wanted reviewed.”
Then:
“You did not make the fake screenshot.”
“But I believed it.”
“You were not supposed to conduct forensics before using whistleblower system.”
Exactly.
A whistleblower process fails if employees are punished for not proving allegations before reporting.
Then Nina asked:
“Will my name come out?”
The company protected where possible.
But police might need testimony.
Outside counsel explained.
No promise of permanent secrecy.
Then:
“Do I have to meet Luca?”
“No.”
Good.
She did not.
Then whistleblower system reforms.
One recommendation:
preserve physical submissions better.
scan at higher forensic resolution.
retain envelopes.
route evidence to independent triage before copying broadly.
Another:
do not overreact to anonymous materials without source validation.
But also:
do not dismiss.
Balance.
Then Luca asked Alessandra:
“Would you have delayed the meeting if we'd verified first?”
“Yes.”
“Would that have prevented Vanessa's device?”
“Maybe.”
No certainty.
Then:
“Would Adrian have tried another way?”
“Probably.”
Again:
do not turn one procedural fix into destiny.
Then prosecutors and police focused on Adrian and Northline.
Adrian disappeared for thirty-six hours.
Not internationally.
He checked into an airport hotel under his own name and turned off his phone.
His lawyer contacted authorities.
No chase.
He surrendered.
Charges under investigation:
unlawful interception/recording offenses,
computer-related unauthorized access,
identity/pretext-related offenses,
commercial bribery or fraud theories depending evidence,
conspiracy with Mason Hart if provable.
No verdict yet.
Mason Hart denied ordering illegal methods.
Then seized Northline messages.
One from Mason to Adrian:
I do not care how you get color. Just keep us out of anything stupid.
Ambiguous.
Defense would say:
instruction to avoid illegality.
Prosecution might say:
willful blindness.
Another:
Hartwell needs B damaged before shortlist. No fingerprints.
Worse.
Mason claimed “fingerprints” meant no visible Northline attribution in market analysis.
Maybe.
Then:
Use the bride if she bites.
There.
Sent three days before Adrian contacted Vanessa.
Mason knew.
Not merely rogue subcontractor.
Then Sentinel.
Did Sentinel know?
No evidence.
Northline's reports to Sentinel described:
“source close to Bellini family.”
No mention Vanessa identity.
No bugs.
Sentinel passed competitive updates to Hartwell.
Hartwell received:
Bellini may be subject to internal integrity review.
Moretti may delay shortlist.
Did Hartwell ask source?
Its general counsel did not see reports before scandal; business development did.
One executive replied:
Good. Push.
That looked bad.
But “push” could mean competitive messaging.
No evidence Hartwell requested surveillance.
So likely:
Adrian + Mason core wrongdoing.
Sentinel negligent oversight.
Hartwell benefited and failed to question aggressive intelligence, but knowledge uncertain.
Then Luca met Nathan Grant.
The CFO looked exhausted.
“You believed the screenshot?”
“For six hours.”
Nathan stared.
“Six?”
“Until Janelle pulled logs.”
Nathan laughed bitterly.
“Good to know.”
Then:
“Did you think I might sell your bid data?”
Luca did not lie.
“Yes.”
Nathan looked away.
“That hurts.”
“I know.”
Then:
“You should investigate.”
“I know.”
Both.
Trust does not mean no review.
Then Nathan said:
“I have one request.”
“What?”
“Do not announce I was ‘cleared’ like I was accused publicly.”
Good.
No reputation campaign.
Internal record would note allegation unsupported.
Enough.
Then Grace, folding napkins at the mansion, received a call from her mother.
“You're on the internet.”
Grace's stomach dropped.
A guest had leaked:
MAID DISCOVERS BUG AT MORETTI ENGAGEMENT.
No name in first article.
Then another found Grace through staffing records.
Reporter called.
Grace said:
“No comment.”
House counsel offered media support.
Not script.
Grace declined.
She did not want to become:
hero maid.
Her mother asked:
“Did you save Mr. Moretti?”
Grace laughed.
“No.”
“What did you do?”
“I moved a chair.”
Then:
“And recognized a microphone.”
That was enough.
Meanwhile, the company-wide breach review reached a simple conclusion Luca disliked because it distributed blame.
The attacker succeeded because:
Vanessa knowingly planted one device.
A fake vendor credential got approved.
A shared wedding portal held too much information.
A personal screenshot exposed a meeting.
A bidder data room had leaked preliminary material.
Northline had incentives without oversight.
And one consultant chose to exploit all of it.
May you like
No single flaw explained the night.
Systems rarely fail that politely.
