Read Chapter 2: The Review Board

The room smelled of stale coffee and cold institutional air. Three chairs faced a single table, and on that table lay a printed report, face-down. Alex had been in enough review meetings to know that the page was the least dangerous thing in the room.

DI Rachel Hayes sat to his left, her arms crossed, eyes fixed on him with the tired wariness of someone who’d been awake for twenty hours. To her right, a man in a charcoal suit Alex didn’t recognize sat with the unnerving stillness of a predator. He had no folder, no coffee, nothing. Just a name tag that read *Liaison – Home Office* and a face that gave nothing away.

“Mercer,” Hayes said, her voice flat. “Thank you for coming in early.”

“You said it was urgent.”

“It is.” She tapped the report. “You’ve been running test simulations on the new predictive module. The one that crawls social chatter and flags potential threats before they crystallise.”

Alex’s stomach tightened. That module was his baby. He knew its code the way a surgeon knows a heart. “We’ve been stress-testing it for six weeks. False-positive rate is down to two point one percent.”

“That’s not what I’m asking.” Hayes slid the report across the table. It was a single page, printed in black and white. He didn’t need to read it to know what it said. He’d seen it on his own screen an hour ago, flickering with his name.

But he read it anyway. *ALERT-7724-CAT-AMBER. Subject: MERCER, ALEX. Risk vector: Undetermined. Source: External.*

“This came through the module?” he asked, keeping his voice even.

“Through,” the liaison said, his first word. His accent was neutral, polished. “Not from. The system flagged it as a legitimate feed. One that bypassed Sentinel’s normal security architecture and dropped directly into the predictive queue.”

“That’s not possible. The module only accepts validated streams.”

“And yet.” The liaison leaned forward slightly, not hostile, just curious. Like a scientist observing a lab rat that had unexpectedly solved a maze. “You didn’t bring it to our attention, Mercer.”

Alex pressed his palms flat against his thighs, steadying himself against the impulse to glance at the door. He’d deleted the flag twice. He’d tried to trace it. He’d known, somewhere in his gut, that raising it internally would trigger exactly this kind of meeting—and he’d known that his name being on that list meant he was the only one who could investigate it fairly. Saying that now would sound paranoid.

“I’d only just spotted it when I got your ping,” he said. “Figured it was a false positive from the stress test. I was about to log a ticket.”

Hayes studied him. She was no fool. She knew he was lying, or at least not telling the whole truth, and he could feel the weight of her unspoken accusation settle on his shoulders.

“The module’s been running your simulations for three days,” she said. “In that time, it flagged thirty-one names. Thirty were suppressible. Yours wasn’t. Do you know why?”

“No, ma’am.”

The liaison pulled a phone from his jacket, tapped the screen, and placed it face-up on the table. It showed a network diagram—nodes and lines in glowing blue, converging on a single server cluster labelled with a string of hex digits that meant nothing to Alex. “Because the feed isn’t coming from our architecture. It’s coming from outside. A private node, running dark, with enough encryption to make GCHQ blush. Whoever is feeding this into your module knows its weaknesses better than you do.”

Alex forced himself to look at the diagram, to appear engaged. But his mind was already racing through the possibility that the feed was the same one that had lit up his screen with his own name. That meant whoever was out there knew his IP, his clearance level, and the exact moment he’d logged in.

“We’re pulling the module offline for a security audit,” Hayes said. “Effective immediately.”

“That’ll kill our rollout timeline.”

“I’m aware.” Hayes stood. That, apparently, was the end of the meeting. The liaison rose too, pocketing his phone. He gestured for Alex to remain seated. “One last thing, Mercer. While you were in here, someone used your credentials to access the Sentinel complaint database. Twenty-three minutes. Downloaded a case file list from six years ago.”

Alex’s blood chilled. He’d been away from his desk for forty minutes. The timestamp would match perfectly.

“I didn’t—” he started.

“Nobody said you did,” Hayes cut in. But her tone said otherwise. “Security’s running a log trace. We’ll clear your name. Don’t worry.”

They left without shaking his hand. The door clicked shut, and Alex was alone in the room with the smell of stale coffee and the echo of a trap clicking shut.

He waited a full two minutes before pulling out his phone and opening the Sentinel access log app. His heartbeat thudded in his ears as he scrolled to the current session times. There it was: his ID, his password hash, a successful authentication at 09:14:07, nineteen minutes after he’d entered the review room. The query history showed a scrape of the complaint database—a subset of records related to civilian whistle-blowers who had died in custody between 2018 and 2020.

There was only one reason to pull that particular data. Whoever had his credentials was building a narrative: that Alex Mercer, frustrated engineer, had been digging up dirt on old Sentinel cases—the kind of cases that had quietly gone cold.

He hadn’t touched that database in years. But he couldn’t prove it. Not with the logs against him.

Alex stood, pocketed his phone, and walked out of the meeting room into the long fluorescent corridor. He didn’t go back to his desk. He went to the maintenance stairwell at the far end of the floor, the one with the rusted fire door that nobody used, and descended to the basement.

The Sentinel server farm hummed behind a glass wall, a breathing city of blinking lights and spinning drives. Alex swiped his badge at the access panel, and the inner door slid open. He walked the length of the aisle until he reached row C, rack 42—a machine he’d helped configure two years ago. From his pocket, he produced the encrypted drive he’d assembled from spare parts, plugged it into an auxiliary port, and began copying the module’s source code, the log files from the ghost feed, and the timestamped records of his credential usage during the review.

He worked quickly, methodically, the way he’d been trained. Behind him, the server fans whirred their endless white noise. If they were already tracing him, he’d have maybe ten minutes before the alert bells started ringing.

Five minutes and forty seconds later, the copy completed. He yanked the drive, pocketed it, and turned to leave.

That was when his phone buzzed. A text from an unknown number. No name, no preamble, just a single image.

It was a photograph of his own office—his desk, his monitor, his chair—taken from the ceiling vent above. Timestamped thirteen minutes ago, while he’d been in the review. A second message followed, one line of text:

*You’re not the only one watching, Mercer.*