"Before the external intrusion protocol was activated."
Mercer stepped toward the workstation. "I was reviewing emergency procedures because we had already identified suspicious network behavior."
Maya asked, "Why did you search specifically for the function that removes administrator relationships?"
"I was trying to understand the protocol before declaring the attack. I was responding to a developing incident."
Maya turned to the technician: "Preserve the configuration file, the search history, and the activation command separately."
"Already doing it."
Mercer said, "You're building a theory around routine emergency preparation."
Maya looked at him. "Then the record will support you." He did not respond. She continued, "Justice stops being fair when the people who control the record also control what disappears from it."
Ben remained near the routing terminal; his screen was still active. Maya looked at him briefly, then returned her attention to Mercer. The first screen Ben had been ordered to close that day had verified a federal credential. This one was recording who had tried to make Asheford's evidence unreliable.
This time, it stayed open.
The county dispatcher kept Nathan Cole's transport on voice guidance while the federal team monitored the remaining communication links.
"Transport One, confirm State Road 8."
The driver answered through light static: "Confirmed, southbound."
A few seconds later, the location icon disappeared from Asheford's municipal map. Lena checked the county relay. "We lost the city signal."
Maya kept her attention on the secure channel. "County dispatch, do you still have voice contact?"
"Negative for the moment. There's a weak section ahead of the relay site."
No one tried to guess how long the gap would last; the driver had already been instructed to stay on the verified road and ignore every navigation command from the vehicle system.
At the forensic workstation, the federal technician continued preserving Chief Mercer's cyber response activity. "His protocol is contained," he said. "External writes are blocked, and the read-only mirror is stable."
"Keep it that way," Maya replied.
Mercer stood near the command area with another federal agent beside him; his executive account remained active only for observation. Any new command would be captured immediately.
Rebecca had been brought back from the separate office. After federal investigators secured the administrative consoles, she stood near the doorway and looked from Mercer to the screen showing the search history for Sanitize event chain.
Mercer spoke first: "You're treating a response procedure like proof of intent."
Maya turned toward him. "We're treating the sequence as evidence: you reviewed the function, searched for it, and then activated the protocol."
"Because we had unauthorized remote activity."
"Then the investigation will determine whether your actions were justified."
Rebecca looked at Mercer. "That's not why you used it."
He turned toward her. "You should be very careful."