5. The Final Reckoning

The Halcyon Bay Police Department's evidence management system ran on a legacy platform called Evidentia, built in 2009 by a contractor who had since filed for bankruptcy and retired to a fishing village in the Valdorian archipelago. Jason Kellner knew this because he had been that contractor's apprentice for six months, hired fresh out of community college to handle database migrations that no one else wanted. The system was archaic, riddled with vulnerabilities that had never been patched because no one who understood them still worked for the department. The Evidentia server sat in a climate-controlled room on the second floor of the Central Precinct, air-gapped from the public internet, accessible only through twenty-three department terminals and a single administrator console in the IT office.

Jason knew all of this. He also knew that the air gap had a crack: a maintenance port that connected to the building's HVAC control network, which in turn connected to a third-party facilities management system that had remote access for the vendor. The HVAC system was not air-gapped. It was protected by a default password that the vendor had never changed, because the vendor had installed the system thirteen years ago and had not issued a security update since. Jason had discovered this vulnerability during his consulting days, flagged it in a report that the department had ignored, and filed the knowledge away in the same mental drawer where he kept forgotten birthdays and obsolete command-line shortcuts.

At 11:30 p.m., lying on the thin mattress of his holding cell, he began to reconstruct the network topology in his mind. The precinct's Wi-Fi network was locked down, but the HVAC vendor's remote access portal was hosted on a cloud server with a predictable URL. If he could reach that portal—and he could, because the guards had not confiscated the tablet that Detective Rao had left in the interrogation room, and the tablet was still connected to the precinct's guest network—he could pivot from the HVAC system to the building management subnet, and from there to the Evidentia server.

The guards had made a mistake. They had assumed that a man in a holding cell, stripped of his phone and laptop, was harmless. They had not considered that the interrogation room tablet, logged in with Detective Rao's credentials because she had not signed out before leaving, was a key that could unlock half the building.

At 12:15 a.m., Jason called the guard. "I need to speak with my lawyer. I have information about the ransomware that will affect the bail hearing. I need the tablet in the interrogation room. It has my case files on it."

The guard, a young man named Corrigan who was working the overnight shift and had not been briefed on the specifics of Jason's case, hesitated. Then he retrieved the tablet, passed it through the meal slot, and told Jason he had thirty minutes.

Jason waited until the guard's footsteps faded. Then he opened the tablet's browser and navigated to the facilities management portal he remembered from his consulting days. The URL was still the same. The default password—admin/hvac2020—still worked.

He was inside the building.

The pivot from the HVAC network to the Evidentia server required a series of lateral movements that took forty minutes to execute. Jason worked methodically, his fingers moving across the tablet's touchscreen with the precision of a pianist who had not played in years but still remembered the notes. He exploited a misconfigured firewall rule that allowed traffic from the facilities subnet to the administrative subnet. He used a privilege escalation vulnerability in the building management software to gain root access. He located the Evidentia server's IP address in the network registry and connected to its management console through an unsecured Telnet port that should have been disabled but had been left open for a contractor who had finished his work in 2017.

By 1:22 a.m., Jason Kellner was inside the Halcyon Bay Police Department's evidence management system. He had full administrative access. He could read, modify, or delete any piece of digital evidence in the department's archives.

He did not delete anything. That would trigger an audit. Instead, he began to build.

The false evidence package against Viktor Sokolov required four components: a ballistic report linking Sokolov's service weapon to the bullet that killed Officer Matthias Webb, a witness statement placing Sokolov near Webb's apartment on the night of the murder, surveillance footage showing Sokolov's vehicle in the vicinity, and a financial record suggesting a payment from Sokolov to an unknown third party that corresponded with the date of Webb's death.

Jason fabricated each component with the same meticulous attention to detail that he had once applied to network diagrams and server configurations. The ballistic report used the specifications of Sokolov's registered sidearm, a Valdorian-manufactured 9mm that Jason had identified from a customs database he had accessed days earlier while researching his pursuer. The witness statement was written in the stiff, procedural language of a police interview, attributed to a fictitious neighbor who had supposedly heard an argument in Webb's apartment. The surveillance footage was a composite of traffic camera stills, doctored to show Sokolov's gray sedan on Webb's street at the time of death. The financial record was the hardest—Jason had to create a convincing money trail using cryptocurrency wallet addresses that he associated with Sokolov through patterns he had observed in the Valdorian's communications.

By 3:45 a.m., the package was complete. He uploaded it to the Evidentia server under case file #HBCPD-2021-0987-OFFICER MATTHIAS WEBB HOMICIDE INVESTIGATION, the same file number that Gregory had written on the envelope in the mortuary safe. The system accepted the upload without error. The metadata showed the evidence had been submitted by Detective Saanvi Rao, whose credentials Jason borrowed from the tablet's still-active session. The timestamp was backdated to three weeks before Webb's death, making it appear that the evidence had been in the system all along, overlooked by investigators who had been too eager to close the case.

At 4:02 a.m., Jason logged out of the Evidentia server, erased the tablet's browser history, and placed it back on the meal slot for the guard to retrieve. He lay down on his mattress, closed his eyes, and waited for the machinery he had set in motion to begin its work.

The confirmation arrived at 4:17 a.m. on the tablet's screen, which flickered to life one final time before the guard returned. The clone account had sent a new message: TASK FOUR COMPLETE. TASK FIVE PENDING. ESCROW VERIFICATION IN PROGRESS.

Task Five. The final task. The one that had broken the previous candidates. Jason stared at the ceiling and felt a strange calm settle over him. He had been forged in the fire of the list, shaped by crimes he had never wanted to commit, and now he stood at the threshold of whatever waited at the end.

He did not have to wait long.

At 7:00 a.m., two things happened simultaneously. The first was that Detective Rao entered the holding area with an expression that Jason could not read—somewhere between fury and disbelief. She unlocked his cell door and told him he was being released.

"Your lawyer's motion to suppress was granted. The search of your apartment was ruled inadmissible. Without that evidence, the prosecutor can't hold you. You're free to go."

Jason sat up slowly. "Just like that?"

"Just like that." Rao's eyes searched his face. "But you should know—something strange happened overnight. The Evidentia system flagged a discrepancy in an old case file. Officer Webb's case. New evidence appears to have surfaced. Evidence that implicates a man named Viktor Sokolov. Do you know that name?"

"No," Jason said.

Rao held his gaze for a long moment. Then she stepped aside. "Your personal effects are at the front desk. Try to stay out of trouble, Mr. Kellner."

The second thing that happened was that Jason's phone, returned to him along with his wallet and keys, displayed a new message from the Dead Reckoning List. The fifth and final task.

TASK FIVE: ATTEND THE HALCYON GALA AT THE MARCH-PALMER CONVENTION CENTER TONIGHT AT 8:00 P.M. LOCATE AMBROSE THORN. USING ONLY THE DIGITAL TOOLS YOU HAVE ACQUIRED AND THE EVIDENCE YOU HAVE GATHERED, COMPEL A FULL PUBLIC CONFESSION OF THE MURDER OF GREGORY MARCH AND GREGORY THORN. THE CONFESSION MUST BE BROADCAST LIVE TO ALL GALA ATTENDEES AND STREAMED TO A PUBLIC PLATFORM WITH MINIMUM ONE HUNDRED THOUSAND SIMULTANEOUS VIEWERS. UPON VERIFICATION OF THE CONFESSION, THE ESCROW WILL BE UNLOCKED. COUNTDOWN: 12 HOURS. FAILURE WILL RESULT IN DESTRUCTION OF THE ENTIRE FORTUNE AND RELEASE OF ALL EVIDENCE PACKAGES AGAINST YOU.

Jason stood on the sidewalk outside the Central Precinct, the morning sun warming his face for the first time in two days. The Halcyon Gala was the most exclusive social event of the year, a charity fundraiser that drew the city's elite to the convention center on the harbor. Ambrose Thorn would be there. Half the city's power brokers would be there. And Jason Kellner, failed IT contractor and accidental heir to a dead man's revenge, was being ordered to walk into that room and tear down a murderer in front of everyone who mattered.

He went home. He showered. He ate a meal that was not gray. Then he sat down at his computers, restored from the evidence room and reconnected to their network of servers and proxies, and began to prepare for the final performance of his life.

The Halcyon Gala was held in the Grand Ballroom of the March-Palmer Convention Center, a glass-and-steel cathedral on the harbor's edge. At 7:30 p.m., the valet line stretched around the block, disgorging guests in gowns and tuxedos into the warm evening air. Inside, the ballroom glittered with crystal chandeliers and projections of abstract art on the walls. A string quartet played Vivaldi. Waiters carried trays of champagne and canapés through a crowd that included senators, CEOs, and the occasional movie star who owned a vacation home in the Halcyon Hills.

Jason entered at 7:52 p.m., wearing a tuxedo he had rented three hours earlier, his hair cut and his face shaved. He looked like a man who belonged there, and the security guards at the entrance waved him through after a cursory glance at his forged invitation. The invitation had been easy to create—the gala's registration system used a third-party vendor whose security was even worse than the HBCPD's.

He spotted Ambrose Thorn near the center of the room, holding court with a group of investors. Ambrose was resplendent in a midnight-blue tuxedo, his silver hair gleaming, his posture radiating the easy confidence of a man who believed he had already won. He did not see Jason. He did not yet know that Viktor Sokolov had been arrested an hour ago, picked up by HBCPD officers who had acted on the evidence Jason had planted. He did not know that Detective Rao had already begun questioning Sokolov about his connection to Officer Webb's death. He did not know that the walls of his empire were beginning to crack.

Jason moved through the crowd, his phone in his hand, its screen displaying the control panel he had built for this moment. The panel connected to the gala's audiovisual system, which was managed by a networked control unit that Jason had compromised earlier that afternoon through the convention center's guest Wi-Fi. He had also compromised the center's broadcast uplink, the social media accounts of the gala's sponsors, and the email distribution lists of the Halcyon Bay Press Club. Every screen, every speaker, every digital surface in the building was now under his control. He had built a panopticon inside a party, and Ambrose Thorn was standing at the center of it.

At 8:15 p.m., Jason executed the final phase of the Dead Reckoning List.

The lights in the Grand Ballroom dimmed. The Vivaldi cut off mid-phrase. Every screen in the room—the wall projections, the sponsor displays, the monitors behind the bar—flickered and went black. Then they came back on, all at once, displaying a single image: the body camera footage from Officer Matthias Webb, showing Ambrose Thorn injecting succinylcholine into Gregory March's IV line.

The room went silent. The silence was the silence of three hundred people simultaneously forgetting to breathe.

Ambrose Thorn turned. His face, projected on a dozen screens, was the face of a man watching his life unravel in real time. He reached for his phone, but his phone was frozen, locked by a remote command that Jason had sent through the same SS7 exploit he had used on Lena Harrington. He tried to walk toward the exit, but every television in the room was playing the footage, and the footage followed him, and the eyes of three hundred people followed him, and there was nowhere to go.

Jason stepped onto the stage at the front of the ballroom. He had not planned this part. The list had demanded a confession; it had not specified how Jason should present himself. But standing in the darkness behind the podium, lit only by the glow of the screens, he understood that he was no longer the proxy. He was the weapon. And the weapon had to speak.

"My name is Jason Kellner," he said, his voice amplified through the room's speakers, calm and steady in a way that surprised him. "Eight days ago, I inherited a list of tasks from my uncle, Gregory March. The tasks were crimes. I committed them. I am not here to excuse myself. I am here to finish what Gregory started."

He gestured toward the screens. "That footage was recorded by a hidden camera that Gregory March installed in his own hospital room. He knew he would be killed. He knew by whom. The man you see injecting the paralytic agent is Ambrose Thorn, founder of Thorn Systems, who murdered my uncle to cover up the fraud he perpetrated against his own brother's company."

The room erupted. People were shouting, pulling out phones that could not record because Jason had locked the gala's cellular repeater. Ambrose was backing toward the wall, his face a mask of rage and terror. Security guards were pushing through the crowd, unsure who to detain.

Jason continued, his voice rising. "Gregory Thorn died five years ago in a yacht accident that was not an accident. Ambrose killed him too. The evidence is in the Halcyon Bay Police Department's evidence system, in a file that was buried until tonight. Officer Matthias Webb discovered the truth and was murdered for it. I have the documentation. I have the financial records. I have the autopsy addendum that the hospital suppressed. And all of it is being streamed right now to every news outlet in New Albion."

He paused. The room was silent again. Somewhere in the back, a woman was crying. Ambrose had stopped moving, his back pressed against the gold wallpaper, his eyes fixed on the screens that showed his own face overlaid with the words: LIVE CONFESSION — HALCYON GALA — 112,000 VIEWERS.

"You wanted a confession," Jason said, and he was speaking to Ambrose now, directly to the man who had killed his uncle and tried to destroy him. "I don't need you to speak. Your face is the confession. Your flight is the confession. The evidence is the confession. The list is complete."

He tapped his phone. The screens shifted, showing the cryptographic escrow smart contract that Gregory had built. The status bar read: ALL TASKS VERIFIED. ESCROW UNLOCKED. BENEFICIARY: JASON KELLNER. The money flowed into a wallet that Jason controlled, forty-eight million dollars in a form of digital currency that could not be seized, frozen, or reversed. But the money no longer felt like the point. The point was the expression on Ambrose Thorn's face, which was no longer the face of a predator. It was the face of prey.

The Halcyon Bay Police arrived at 8:27 p.m. They arrested Ambrose Thorn on suspicion of murder, fraud, and conspiracy, charges that would multiply over the following days as the evidence Jason had gathered was reviewed by state and federal prosecutors. Jason was detained but not arrested; Detective Rao, who led the response team, had already seen enough of the Evidentia file to understand that Jason Kellner was both a criminal and a key witness, and that the prosecution of Ambrose Thorn would require testimony that only Jason could provide.

In the days that followed, the story consumed New Albion. The headlines screamed: "TYCOON'S DIGITAL REVENGE PLOT EXPOSES MURDER." The deepfake that had framed Jason was traced to a server in Valdoria, operated by a shell company that led back to Thorn Systems. Lena Harrington gave a press conference in which she described her thirty-six-hour digital abduction, and while she condemned the crime, she also acknowledged that Jason had ensured she was not physically harmed. The public was divided—was Jason Kellner a hero who had exposed a murderer, or a cyberterrorist who had broken a dozen laws to do it?

The hexadecimal sender contacted Jason one final time, three days after the gala. The message was brief: "You were the third candidate. The first failed because he was too weak. The second failed because he was too cruel. You succeeded because you remained yourself. Gregory chose well. The clone account will be deactivated in one hour. Its contents have been sent to you as a record of what you survived. Use the money wisely. Or don't. That part is no longer mine to control."

Jason read the message and did not reply. He did not know who the sender was—perhaps a lawyer, perhaps a former colleague of Gregory's, perhaps a piece of the dead man's consciousness encoded in the digital infrastructure of the list itself. He would probably never know. Some ghosts were designed to remain anonymous.

He opened the clone account's data one last time. The profile picture still showed his own face, the eyes fractionally too wide, the smile a millimeter too sharp. But the account was no longer a threat. It was a monument—a record of the person he had been forced to become, the person he had almost been, and the person he had chosen not to be.

He closed the laptop and walked to the window of his apartment. The gray sedan was gone from Pier Street. The harbor was calm, the morning light silver on the water. In the distance, the towers of Halcyon Bay gleamed like promises that had not yet been broken.

The Dead Reckoning List was complete. But Jason Kellner understood, with a clarity that felt like the first day of a new life, that the list had never been about the crimes. It had been about becoming someone who could survive them. And he had survived.

Outside, a foghorn sounded across the harbor. A ship moving toward open water, guided by lights it could finally see.