Chapter 9 - Daniel’s Signature
Daniel did not remember signing because pilots did not approve parts vendors.
The document made no organizational sense.
Captain Daniel Carter.
Flight Operations Safety Representative.
That role existed.
Daniel had served on a safety committee two years earlier.
But the committee reviewed operational reports.
Not supplier certification.
His signature looked real.
Not image pasted obviously.
Electronic certificate.
Employee ID.
Authentication token.
Laura asked:
“Did you ever loan your company security token?”
“No.”
“Lose it?”
“No.”
“Share password?”
“No.”
“Approve batch documents without reading every attachment?”
Daniel stopped.
There.
The airline used quarterly electronic policy packets.
Pilots serving committee roles sometimes acknowledged dozens of documents.
Daniel remembered signing one large packet remotely while traveling.
Could the vendor extension have been hidden inside?
IT checked.
Yes.
Packet contained forty seven documents.
Red Ridge continuity authorization was attachment 39.
Daniel’s electronic approval technically applied to entire packet.
He had clicked ACCEPT ALL.
His stomach turned.
“I signed it.”
Laura said:
“You authenticated the packet.”
“I did not know this was inside.”
“That distinction matters. So does the fact you accepted without reading.”
Daniel thought of Martin.
Julia.
Marcus.
Everyone.
Paper pressure.
He had participated in the same culture.
Different stakes.
Same habit.
Martin said:
“I did too.”
His approval appeared because he authored the packet recommendation.
He believed Red Ridge had passed audit.
Daniel’s click added flight operations acknowledgment.
Not regulatory certification.
But later someone used the completed packet to tell the airline board Red Ridge had cross departmental approval.
That overstated what Daniel intended.
Still, his name was there.
Emily heard part of the conversation.
“Did you do something wrong?”
Daniel sat beside her.
“I signed something without reading all of it.”
“Like terms and conditions?”
He almost laughed.
“Yes.”
“Is the plane broken because of you?”
“No.”
“Sure?”
“I am part of a system that should have caught this better.”
That answer felt harder.
And truer.
Then IT found another issue.
The PDF Daniel signed eighteen months earlier did not originally contain attachment 39.
Audit logs showed attachment inserted six minutes after Daniel authenticated the packet but before final archive lock.
That changed everything again.
His digital signature remained displayed across final packet even though a document was added later.
Software flaw.
Or misuse.
Who had permission to modify packet before lock?
Committee administrator.
Name:
Samantha Price.
She left the airline one year ago.
Current employer:
Red Ridge Components.
There.
Samantha was interviewed.
She admitted inserting the attachment.
“Why after Daniel signed?”
“Martin’s office sent it late.”
Martin denied.
Email logs showed request came from an account appearing to be Martin’s assistant.
But the sender address had one letter different.
Spoofed external domain.
Samantha did not notice.
She inserted the file.
“Why not reissue packet for signatures?”
“Deadline.”
Again.
She took a shortcut.
Then Red Ridge hired her months later.
Was that reward?
She said no.
Recruiter contacted her because of airline compliance experience.
Salary increased twenty percent.
Could be normal career move.
Suspicious timing.
Not proof.
Then Samantha revealed who referred her.
Thomas Vane.
Meridian sales director.
Why would a Meridian executive refer someone to Red Ridge?
Because Red Ridge was their subcontractor.
Normal business network.
But Thomas had also sponsored vendor onboarding.
The circle tightened around him.
Laura confronted Thomas.
He admitted referring Samantha.
Denied knowing she had inserted the disputed attachment.
Then investigators found a text from Darren Lowe to Thomas.
Need continuity signed before quarter close. Martin dragging feet.
Thomas:
Working it.
Darren:
Use committee packet if necessary.
Thomas:
Not my department.
Darren:
Everything is your department when commissions depend on it.
Commissions.
Thomas received sales bonus tied to Meridian volume.
If Red Ridge lost approval, Meridian supply dropped.
Financial motive.
Then another message.
Thomas to Samantha:
Did Martin’s office send the Red Ridge page?
Samantha:
Yes, late.
Thomas:
Get it in before lock. We cannot restart signatures.
That was direct.
Samantha had not acted alone.
Thomas encouraged insertion after signatures.
Did he know the sender was spoofed?
Unknown.
He said he believed Martin’s assistant sent it.
But he bypassed reauthorization knowingly.
That could be serious compliance misconduct.
Then Laura asked:
“Who created the spoofed email?”
Still unknown.
IP routed through commercial VPN.
No easy answer.
Then Martin’s Monday meeting packet revealed one more surprise.
He had already planned to recommend suspending Meridian and Red Ridge pending trace review.
Thomas knew.
Texts:
Martin is going nuclear Monday.
Darren:
Then Monday cannot happen with the old file intact.
Thomas:
Do not write things like that.
The note on Sarah’s card:
THE ORIGINAL TRACE FILE WILL BE DESTROYED BEFORE MONDAY.
May you like
Rachel may have been more right than investigators thought.
Continue to the next part: Texts between Thomas and Red Ridge’s owner show they knew Martin planned to suspend the supplier on Monday and were already discussing the old trace file before Flight 101 took off.
