His breakthrough came at 4:15 a.m. Elijah was reading through the city's specific civil forfeiture statutes—the laws Pierce was using to simultaneously seize Sarah's home while prosecuting her. He cross-referenced this with the recent landmark Supreme Court case Timbs v. Indiana (2019). The Timbs ruling unanimously held that the Eighth Amendment's protection against excessive fines is incorporated against the states under the Fourteenth Amendment. Pierce had already seized his mother's bank accounts and their small family home before a guilty verdict was even rendered, claiming it was the proceeds of a crime.
But Elijah didn't stop there. He dug into the specific municipal ordinance Pierce used to authorize the seizure: Ordinance 409.
Then, he saw it. The fatal flaw.
The arrogance of Prosecutor Dana Pierce laid bare in black and white ink. Pierce was so confident, so used to bulldozing public defenders, that she had gotten sloppy. In her rush to freeze Sarah's assets and cripple her defense, Pierce had filed the asset forfeiture under a specific municipal code that required a mandatory 48-hour judicial review by a federal magistrate because the funds involved a federal grant. Pierce hadn't done it. She had bypassed the federal review using a local judge, a friend of hers, to rubber-stamp the seizure.
But it got worse. Much worse.
Elijah opened the Brady disclosure file. Under the landmark Supreme Court ruling Brady v. Maryland, the prosecution is legally bound to turn over any exculpatory evidence—evidence that might exonerate the defendant—to the defense. Elijah looked at the metadata from the server logs he wasn't allowed to introduce. He hadn't just subpoenaed the logs; he had subpoenaed the IT department's communication regarding the logs.
Buried on page 4,200 of a seemingly irrelevant email dump was a message from the city's lead IT technician to Dana Pierce herself, dated three weeks before the trial.
The email read:
"Ms. Pierce, per your request, we audited the terminal on the fourth floor. We found a remote access Trojan installed on that machine. The IP address that initiated the fraudulent transfers was actually routed from an offshore server bouncing through our municipal network. Sarah Cross's credentials were spoofed. Attached is the diagnostic report."