The report runs to forty-seven pages and reads nothing like what I know it contains.
That's the point of forensics documentation — the translation from what the evidence means to what the evidence says. The conditional check at callback layer 12 is described as "an unauthorized modification to the dosage safety limit calculation function, inserted by a developer with commit access to the CareFlow repository between October 14 and October 17, 2022." Not: the thing Marcus built at 2:34 AM on a Tuesday, three weeks after his grandmother entered Sunny Meadows. Not: elegant code hidden inside ugly infrastructure, a signature anyone who knew his work would recognize the way you recognize a handwriting. "An unauthorized modification." The language is technically precise and personally evacuated and that's the language I need it to be.
Derek initialed the last page at ten past eight this morning. He's been in the lab for six hours, running final sandbox confirmations, feeding test patient profiles through the forensic image of the CareFlow system. Last name first letter A: safety limit multiplier set to 1.0. B: same. C, D, E, F, G: same. Last name first letter H: limit applies. The system does what the code tells it to do. The system has always done what the code told it to do. That's the thing about code, the thing that makes it different from a knife or a gun or any physical murder weapon: it doesn't require intent at the moment of use. The intent was three years ago, at 2:34 AM, a specific Tuesday, a specific developer. The system just ran.
"Sandbox confirmation matches previous runs," Derek says. He's looking at the screen, not at me, which has become his default in the lab — he tells things to the monitor and I receive them. "All seven patient profiles. All seven lethal dosage thresholds triggered. Nothing outside the expected parameters." He pauses. The pause means he has something else. "Exhibits B-47 through B-61 are the execution traces. I formatted them the way Torres's office asked."
The report on screen looks the way a properly built thing should look: clean structure, case number at the top, author attribution section with git blame outputs and the comparative style analysis, the execution section with Derek's confirmation data. Everything the code told us, rendered into the language of proof. Forty-seven pages to say this wasn't a bug. "Good," I say. "I'll send the final to Torres."
The conference room on the third floor smells like burned coffee and dry-erase markers. Torres is already at the table when Ray and I arrive, the report open to the author attribution section, a yellow legal pad beside her with eight lines of handwriting. She's the kind of person who prepares before the preparation — she's read it, formed the questions, decided which ones matter.
"Walk me through the kill mechanism," she says, not looking up. "Like I'm on the stand being cross-examined by someone good."
So I do. The seventeen callbacks, the function architecture, the conditional check at layer 12, the safety limit multiplier that the code sets to 1.0 for patients A through G. The sandbox confirmation. The execution traces Derek formatted. Torres's pen moves on the legal pad — she's noting the parts that need expert translation for a jury, the technical vocabulary that will require a glossary. I've done expert witness work before. You spend half the prep turning your knowledge into something twelve people who think "the cloud" is where their photos go can follow without losing the thread. Ray is quiet beside me; he knows this part is mine.
"Chain of custody is solid," she says when I finish. "The forensic images, the git history, the sandbox environment — all of that is clean." She flips to the code comments section. "This is where it gets complicated."
"The comments are authored by the same developer as the kill mechanism," I say. "The style attribution analysis covers the comment syntax, the tone register, the specific architectural fingerprints across the version history—"
"Your style attribution analysis." Torres looks at me. Not harshly. She says it the way a good prosecutor identifies a crack: precisely, without heat. "Based on your familiarity with the developer's prior work and communication patterns. Which you have because you had a two-and-a-half-year personal relationship with him."
"My expertise includes author attribution analysis. The methodology is documented, the criteria are reproducible—"
"Defense counsel's first motion will be to exclude your testimony on the code comments entirely." She sets down the pen. The coffee machine hums somewhere down the hall, and Ray's hands are flat on the table. "They'll argue that a forensic expert with a prior intimate relationship with the suspect can't produce reliable evidence about the meaning of code comments the suspect left. They'll argue you're reading love letters because you loved him. They'll argue the author attribution case is contaminated because your read of 'this style matches Marcus Chen' is not separable from your history with Marcus Chen." She pauses. "They'd be making a reasonable argument."
"The style attribution methodology stands independent of my personal—" I start.
"I know," Torres says. "I know it does. I'm telling you what a jury hears when defense presents it differently. The technical evidence is strong. The author attribution is strong. The code comments are your weakest link precisely because they're your strongest evidence about intent." She picks up the pen again. "I need a second expert on the comments. Someone with no prior relationship to Chen. Someone who can look at those comment blocks and reach the same conclusions through a clean chain of analysis."
"That's a longer timeline," I say.
"I know. But if this case goes to trial with you as the sole expert on the code that proves intent, and the defense runs the prior relationship argument, we need the backup." She closes the report. "The technical case is there. I can build on it. Get me the second expert, and I can put Marcus Chen away."
Derek is back at his monitors when I return to the lab, Ray three steps behind me. He's been working the archived corporate communications — the email thread he and Ray surfaced two weeks ago, the one Marcus sent to Victor about the safety architecture. Derek had found the reference then, a summary in MediCore's internal ticketing system. Now he's pulled the full chain from the mail server backup, every message and every timestamp. He looks up when we come in, and his expression is the one he gets when he has something to say and isn't sure how to start. He's gotten better at this over the past weeks — less defensive corporate jargon, more direct — but the habit of performing around authority is still there in the pause before he speaks. "I recovered the full email chain," he says. "Victor's actual response. Everything."
He angles the monitor; I pull a chair closer. The email is dated eight months before Marcus quit MediCore, sent from his work account to Victor Russo's. The subject line is CareFlow Safety Architecture Concerns — Urgent. The voice in it is Marcus's formal register — precise, methodical, building toward the answer instead of stating it first. His way of arguing when something mattered to him.
The email is four paragraphs. The first describes the safety parameter architecture in the dosage calculation module. The second identifies the specific callback layers where safety limits could be bypassed without triggering system alerts. The third explains the risk: a developer with commit access to the dosage module could modify the safety limit multiplier at layer 12 and the system would log any resulting dose as within normal parameters. The fourth asks for a formal safety audit and a code review of the dosage module before the next CareFlow deployment.
Victor Russo's response is timestamped four hours later. It is one line:
Thanks, will review with the team.
"There's no follow-up," Derek says. "No calendar invite, no meeting notes, no audit. I searched six months of communications. Victor never brought it up again and Marcus never pushed it again. He quit three months after this."
The third paragraph of Marcus's email is the part I keep returning to — where he describes the exact mechanism he then used to kill seven people. The callback layers. The safety limit multiplier. The fact that the system would log lethal doses as within normal parameters because the parameters themselves had been altered. He documented his own weapon in a warning that nobody acted on. He told them. He told Victor Russo exactly how the system could be used to kill, and Victor Russo said thanks, will review and moved on to the next thing on his calendar, and three months later Marcus handed in his badge and eight months after that the first patient died. Ray tells me to send it to Torres. Derek already did, thirty minutes ago. Ray looks at me — the particular way he pauses when he's waiting to see where I land — and I look at the email and feel the paranoia shift register, move out of the personal frequency and the professional frequency into something systemic, architectural — guilt distributing through a system like bugs through nested callbacks. No single point of failure. No single person who built the thing into what it became.
The whiteboard in the corner of the lab has been a timeline since day three. I go to it with a dry-erase marker and add two columns: one for the email, one for what it changes. The chain runs: Marcus built the kill mechanism using the architecture he had already documented for Victor. MediCore provided the codebase that made it possible — seventeen callback layers, deprecated libraries nobody had audited in two release cycles, safety parameters that could be altered without alerting anyone because the alert system was cut from the budget the year before Marcus arrived. Victor ignored a written warning about the exact vulnerability that was then exploited. Derek maintained the system for two years without understanding what was underneath his patches. Dr. Vance pushed for the automation that removed the human verification layer. And at the bottom of the chain, not named in any exhibit, is the methodology. The framework. Break it into the smallest possible pieces, solve each one independently, let the logic carry the structure.
I add my initial to the board. K — methodology. My name in the evidence record. He built the function the way I taught him to think, and the comment at layer 12 says so, and that comment will be in the exhibit documentation, and when a second expert reads it they'll see the same thing I see: a developer writing to his teacher and his killer and his reader simultaneously, the frequencies indistinguishable.
The list on the whiteboard isn't a list of guilty parties, exactly — or not only that. It's a map of how a system fails. Each person made a decision or a non-decision and those decisions accumulated into seven deaths between 1 and 3 AM, in seven rooms with the same small white dispensers on the walls, logging everything as within normal parameters because the code said so. The code was the only thing in the system that knew the truth the whole time.
"Torres will use the email," Ray says. "Victor's knowledge of the vulnerability changes the negligence charge to something closer to—"
"I know." I cap the marker. The board is complete enough. "Distributed culpability doesn't help Marcus. The kill mechanism is his. The intent is documented in his commit timestamps and his comment trail and now in his own email describing how to do exactly what he later did." I look at the board. The names. My initial at the end of the chain. "It doesn't help any of them. Including Victor."
"That's what Torres is going to argue," Ray says, and I tell him she's right. The rest of the afternoon I stay with the whiteboard. At six-forty Ray comes back from the hallway, moving with purpose but no drama — his version of urgency, measured and direct, landing harder than other people's alarm.
"We found him."
I set down the printout. "Digital trail," Ray says, stopping in the doorway. "An IP address used to access a file-sharing service. Consistent access pattern over two weeks — he'd been using it. The metadata on the last access is clean, no VPN. Either he got sloppy or he stopped caring about being careful." He holds my gaze. "Warrant's been issued. They're picking him up tonight."
The lab runs its familiar hum around us. The east wall behind me with its fifty-three printouts, my handwriting layering his code. The whiteboard with its chain of responsibility and my initial at the bottom. The forty-seven-page report that says everything except what any of it costs.
Marcus Chen accessed a file-sharing service with a traceable IP and no VPN, either because he made a mistake or because he was done making himself hard to find. I know Marcus's code well enough to know that he understood exactly what a traceable trail looks like. He built the kill mechanism to run invisibly for as long as it ran, then he sent Victor Russo a document describing it in clinical detail, then he left MediCore, then he left the city, then he left a clean IP address in a metadata record that two weeks of access patterns made easy to follow. Whether those are the choices of someone who slipped or someone who decided is a question the case file can't answer. Both readings fit the evidence. Both have always fit the evidence.
"Okay," I say, and Ray waits, so I give him what I have: "Let me know when they have him in." He nods and leaves. The door doesn't close all the way behind him — it never does, the frame is slightly off — and through the gap comes the ordinary sound of the building at end of shift: footsteps, a distant phone, the elevator.
I pick up the printout. The cold coffee. The question I'll still be holding when Marcus Chen is sitting in a room I'm not allowed to enter, the investigation complete and the case assembled and everything I spent four weeks building ready for a prosecutor to carry forward without me. The evidence picture is done. The picture doesn't simplify anything. That's not what pictures are for.