“Can you check whether my account was accessed from another device?” he asked.
“I've started that review. We have partial device records, but the initiative's authentication logs don't retain every detail indefinitely. I'm comparing the available session information with the workshop's device inventory and the system's administrative records.”
“Would changing my password help?”
“It would be sensible as a precaution, along with signing out other sessions and reviewing account permissions. But changing your password now would not tell us who accessed the account earlier.”
Richard nodded.
“Do it. And suspend unnecessary access to the project folder until we know more.”
Rachel added, “We'll also review the permissions for every project, not just ClearCurrent.”
“Good,” Richard said. “I don't want this investigation to become an excuse to leave other students exposed.”
Priya closed the table.
“There's another lead. The recovered draft refers to an external technical review, but the phrase appears in a second record.”
She displayed a short excerpt from the archive.
External Review — Northstar Energy Solutions
The words sat alone in the document, followed by a reference number.
Nobody spoke immediately.
Martin Cole, who had joined remotely, broke the silence.
“That reference number appears in the commercial records I examined. I can't confirm that it refers to the same review, but it is consistent with the number used in a Northstar vendor assessment.”
Andrea turned toward the screen.
“Was ClearCurrent mentioned in the vendor assessment?”
“Not in the copy I received.”
“Could there be another version?”
“There could be. I haven't seen every document in Northstar's possession.”
Richard folded his arms.
“We need the complete record.”
“Agreed,” Martin replied. “But we should be careful. A vendor assessment can refer to a potential review without any work actually being commissioned. The reference number alone doesn't establish that Northstar received the students' material.”
Marcus wrote down the number.
He had spent much of the past week hoping for a simple answer: a name, a message, a clear act that would explain everything.
Instead, every discovery seemed to divide the problem into smaller questions.
Yet the pieces were beginning to form a pattern.
A review request had been submitted without visible approval.
A draft had referenced an external technical review.
A commercial archive contained a reference associated with Northstar.
And files had disappeared under circumstances the logs could not fully explain.
The pattern was suspicious enough to investigate.
It was not yet proof of misconduct.
That afternoon, Richard contacted Northstar through the company's official legal channel.
He requested the complete vendor assessment associated with the reference number, all correspondence relating to any proposed review of ClearCurrent, and confirmation of whether Northstar had received technical material from the Open Bench Initiative.
The request made no accusation. It identified the records that needed clarification and asked that relevant material be preserved.
Northstar acknowledged receipt within an hour.
Its legal department stated that it was reviewing the request and would respond through counsel.
That response offered little information, but it changed the pace of the investigation. Until then, most of the work had involved reconstructing events from the initiative's own systems and old Caldwell records. Now, the team had formally asked an outside organization to account for its records.
Richard also called Stephen Langley, the Northstar project manager whose name appeared in the earlier commercial correspondence.
Langley agreed to a short preliminary conversation, but he declined to discuss technical details before Northstar's legal team reviewed the request.
“I can tell you that our company evaluates many technologies,” Langley said. “Some come from acquisitions, some from internal development, and some from potential partners. A reference in a vendor system doesn't necessarily mean a project was approved.”
“Did Northstar evaluate ClearCurrent?” Richard asked.
“I can't give you a definitive answer until I review the records.”
“Did anyone receive the students' files?”
“I don't know.”
Richard let the silence remain.
Finally, Langley added, “If material was sent to Northstar, there should be a record of receipt. I will ask our compliance team to check.”
“That would be helpful.”
“And Mr. Caldwell, I want to be clear about something. Our company has no interest in using material we are not entitled to use.”
“Then the records should resolve this quickly.”
“They should,” Langley said.
The call ended politely.
Richard did not mistake politeness for an answer.
He sent Andrea a summary of the conversation and asked her to add Langley's statements to the investigation file.
Then he returned to his office and opened the old Project Lantern archive.
For years, he had regarded Lantern as an unsuccessful investment. It had been a promising idea that failed to reach the market, one of dozens of projects that had seemed worthwhile but had not justified further spending.
Now he could see how easily a company's internal decisions could outlive the people who made them.
A technical warning omitted from a commercial summary.
A transfer checklist that might not have been completed.
A later appendix circulated to people whose roles were no longer clear.
A student project that might have been independently developed, improperly accessed, or merely mistaken for something older.
Each unresolved detail created the possibility of a new mistake.
Richard closed the archive and opened a blank document.
He wrote a new instruction for Caldwell Industries and the Open Bench Initiative:
No technical material created by a student or community project may be provided to an external organization without documented approval from the project team, a clear statement of ownership, and a recorded purpose for the transfer.
He added a second requirement: any proposed partnership involving student-developed work would need an independent review and a written explanation of how the students' contributions would be protected.
It would not solve the mystery.
But it would prevent the same uncertainty from becoming somebody else's problem.
Three days later, Priya received a response from the initiative's former IT service provider.
The provider had located a limited backup of the authentication records from the period surrounding the missing files.
The backup did not contain the complete file history. It did, however, include a record of a temporary administrative permission granted to Marcus's account.
The permission had been issued shortly before the files became unavailable.
Priya immediately compared the timestamp with the workshop's access logs.
The records were consistent with a temporary privilege being activated during the relevant period. But the backup did not identify the person who requested the change, and the approval field was missing.
Priya called Marcus and Andrea into a review meeting.
“This is important,” she explained. “The account associated with the file changes had temporary administrative privileges. That means the activity may have been possible because of a permission change, not because your account normally had the ability to perform those actions.”
Marcus stared at the screen.
“Who granted it?”
“The backup doesn't show a name.”
“Can you tell whether I requested it?”