Where Did the Order Come From

At 10:48, Go Yura closed the field with Hong Sanguk's name on it.

The click came first. Only after that did she let out a long breath. R-3 was still on the screen. Original owner Hong Sanguk, actual user deleted, actual approval time 00:07. The three lines were clearer than the day before, but the question had gotten worse. The clearer a name gets, the less people look at the hands behind it.

"We can't just keep looking at the director's name."

Go Yura said.

Gang Taejun picked up his pen.

"What should we look at."

"Creation. Delegation. Scheduling. Deletion. Four fields. If you only look at the moment a command was pressed, you're already too late."

She didn't ask us for permission. The Go Yura who had looked like someone waiting for approval was gone, and only someone about to open a log remained. Instead of using the big screen in the security office, she connected her own laptop to the small monitor in the meeting room. A big screen is good for persuading people. A small screen makes it hard to hide a wrong field.

Hong Sanguk rested his hand on the back of his chair.

"The audit meeting records include personnel data too. The scope of access needs to be limited."

"I'll limit it."

Go Yura answered right away.

"No names, no titles, no talk about anyone's livelihood. Just token activity. Not who hated who, just which terminal borrowed which permission."

Hong Sanguk folded his objection back once. Words that shift from technical jargon to action verbs are hard to grab onto. Not personal information, permission transfer. Not emotion, terminals. Go Yura had chosen that distinction on purpose.

At 10:55, the audit meeting transcript opened.

The meeting had been billed as preliminary coordination for the 2019 incident's re-audit. The attendee list carried the names of Hong Sanguk, Yun Haewon, Yi Juwan, Han Dogyeong, and Mun Rahui. Oh Sejin was appended at the end as medical advisor. Go Yura folded the names away. Instead of attendees, she left only the order of statements and the approval buttons.

First approval. Restriction on access to audit materials. Hong Sanguk's own signature.

Second approval. Envelope routing conditions after 18:00. Proposed by Yun Haewon, held by Hong Sanguk, wording revised by Yi Juwan.

Third approval. An exception clause allowing central broadcasts and correction room notices to be delayed and sent out together as a single bundle during a disaster. Technical limitations flagged by Mun Rahui, operational approval by Hong Sanguk.

Go Yura stopped at the third line.

"This is where the R slot was created."

"Remote correction?"

"Yes. But R-3 wasn't issued directly here. This meeting only approved the operating principle that the slot could be opened."

Hong Sanguk cut in.

"That's right. Approving a principle and issuing a specific order are different things."

Gang Taejun wrote the words down exactly as spoken.

"Approving a principle and issuing a specific order are different things."

Even though the sentence he wanted had been written down, Hong Sanguk didn't look at ease. Gang Taejun's record wasn't a defense brief, it was a nail for the next question.

Go Yura pulled up the audit log attached to the right side of the transcript. `R_GROUP_INIT`. The creation time wasn't right after the 2019 audit, it was two days before this re-audit was announced. The creator was `ADMIN-H`. There was no actual user name. Instead a short sentence was attached to the reason for creation. `Typhoon isolation contingency, automation of correction notices.`

Bae Junho raised his head beside her.

"If it's a typhoon isolation contingency, that's before the weather report was downgraded."

The remark was small. Small, but it fixed a position. The R group had been ready before the typhoon was ever used as an excuse.

"The time it was drafted."

Gang Taejun asked.

"19:12:04, two days before the announcement. That's by the central network's clock. Corrected against the independent clock, it comes out to somewhere around 19:13:07."

Go Yura answered.

"Somewhere around?"

Mun Rahui spoke for the first time.

Go Yura scrunched her eyes.

"The independent test unit was in inspection mode during that window, so it drifts by 0.4 seconds. Saying somewhere around is the accurate way to put it."

Mun Rahui didn't ask anything further. Even someone who hates approximate values goes quiet when there's a basis for the margin of error.

At 11:20, Han Dogyeong brought in the paper meeting minutes.

Paper comes out late. In exchange for coming out late, it sometimes escapes a deleted field. The electronic log's creator field read `ADMIN-H`, but the paper delegation form had a handwritten line. `Temporary delegation for the R series: proxy approval for the director's decisions permitted.`

I looked at the signature field below that line.

It wasn't Hong Sanguk's name.

It wasn't empty either. There were only the four characters for `proxy signature` and a date stamp. Normally a stamp doesn't stand in for a person. But on this form, the person's name was missing and a role had taken its place. Proxy for disaster operations in the director's absence. Name of the proxy holder attached separately.

Gang Taejun asked.

"Attached separately."

Han Dogyeong lowered his eyes.

"The separate attachment only exists in the system."

"Recover it."

"We have to."

This time he didn't wait. Han Dogyeong opened his laptop right away. He didn't stop over the run button. That change needed to be recorded too. He was becoming someone who pulled records out, not someone who guarded them.

The recovered file wasn't complete. The proxy holder's name field was blacked out by a black square. But the terminal number beside the square remained. Meeting room terminal 2. Signature time 19:13:13. On the same line, an automatically generated initial R-3 token number was attached.

"Doesn't proxy signature in this company's electronic approval system leave a person's name behind."

I asked.

Yi Juwan answered without smiling.

"It does. It's supposed to. That's why the cases where it doesn't matter more."

"Is it legally void."

"It's convenient to just call it void. But administrative systems still run on void documents. The next question is whether someone knew it was void and accepted it anyway."

He didn't explain his profession. He only spoke of the cost. A document that doesn't end just because you call it void. That was the more uncomfortable thing.

At 11:45, we went to check meeting room terminal 2.

The moisture in the corridor was drying out. The typhoon was still pushing against the windows, but people were more afraid of screens than water. Meeting room terminal 2 sat at the end of the long table against the wall. Noeul texted that she remembered where the cup on that table had been. `During big meetings the director always takes the seat near the door. Terminal 2 is far from the door.`

What she'd noticed was a silent arrangement. That made it more useful. The seat Hong Sanguk usually sat in and the terminal where the proxy signature had gone through were in different places.

Gang Taejun attached Noeul's text to the record too.

Hong Sanguk said.

"Meeting room seating isn't fixed."

"I didn't write that it was fixed."

Gang Taejun replied.

"I'm writing that it's a different terminal from the usual arrangement."

Hong Sanguk started to erase the subject of his sentence again, then stopped.

"It was a disaster preparedness meeting. A lot of documents were processed in a hurry."

Go Yura opened the terminal's local cache. A temporary saved file from the window when the network had been down still remained. The filename was long. She read only the ending.

"`proxy_sign_R3.tmp`."

"Why did a temporary file remain."

"Because it didn't shut down normally. When a signature succeeds, the temp file gets deleted. Here it succeeded and still stayed behind. Either someone cut the power before closing the window, or the success signal went out first and the local cleanup never happened."

Go Yura didn't move the mouse. Moving it could change the file's timestamp. She took her hand off it and looked at Gang Taejun.

"We need to make a copy. If I touch it myself, my own traces will get mixed in later."

Gang Taejun put on gloves right away. It wasn't Seo Ihyeon's schedule but Go Yura's procedure that was driving the investigation now. I admitted that to myself a little late.

At 12:10, the first line of the copy opened.

`R-3 token issued by delegated signature.`

Hong Sanguk opened his mouth, then closed it. He wasn't someone who could pretend not to understand the English sentence. Yun Haewon didn't look at the document, she looked at me instead. Like someone who knew this result had just moved the next field in her own envelope design.

"Who is the proxy signer."

Gang Taejun asked.

Go Yura shook her head.

"There's no name in this file. Instead, it shows which account the proxy signature session was opened under."

"The account."

"`HSW_delegate_03`."

Hong Sanguk said.

"That's my group of proxy accounts for my role."

"Is it your personal account."

"No. It's an emergency account attached to the director's role."

Once again he pushed the person behind the role. But a hole was left where the person had been pushed out of. R-3 carried Hong Sanguk's name, but at the moment of issue it hadn't passed through his hands. The proxy signature wasn't a blank meant to hide a person, it was a door through which responsibility could be deferred.

I opened the shared ledger.

`R-3 creation: proxy signature.`

`Original owner: Hong Sanguk.`

`Issuing terminal: meeting room 2.`

`Proxy account: HSW_delegate_03.`

Even after writing those four lines, no answer came. Instead the question narrowed. It wasn't whether Hong Sanguk had pressed it. It was who had opened the door that let it be pressed under Hong Sanguk's name.

Go Yura didn't close the screen. She zoomed in on the last log. Eight seconds after the issue, the audit meeting transcript was opened on the same terminal. The viewer had been deleted. The traces of the deletion looked the same as the earlier deletion of R-3's actual user.

"Is it the same eraser."

I asked.

"For now it's just the same shape. We can't write that it's the same hand."

She answered.

That sentence was the most important safeguard of this stretch of the day. Same shape. Not yet the same hand.

At 12:26, Go Yura ran the proxy signature procedure again on the verification copy.

It was a device with the network cut off so no real permissions would be touched. First she opened a blank approval form. The R series slot didn't appear. Next she set the audit meeting transcript to viewed status. It still didn't appear. Finally, when she entered the emergency card number for the director's role's proxy account group, the `R-3 temporary issue` button, previously grayed out, appeared.

"This doesn't happen with just one password."

Go Yura said.

"Meeting record viewed status, proxy account, emergency card. All three conditions have to be present together. This isn't a structure where someone could just steal Director Hong's name and press the button."

Hong Sanguk tried to lean on that right away.

"Then it would have been all the more impossible for me to have done it myself."

"No. It's the opposite."

Go Yura took her hand off without pressing the button.

"Without someone who built or approved this structure, no one else could have stolen it either. The proxy signer stayed hidden, but the proxy signature door was open under the director's own authority."

Gang Taejun made a new field on the board.

`Issue conditions: meeting record viewed + proxy account + emergency card.`

`Meaning: not a simple account takeover. An approved structure is required.`

This time Hong Sanguk couldn't choose his words. An administrative procedure built to erase a person had left behind more conditions than a person would have.

Han Dogyeong spoke quietly beside the recovered file.

"There's a trace of the emergency card being taken out of the meeting room storage box."

"Who took it out."

I asked.

"The storage log is also bundled inside the proxy session. There's no name. But the opening time is 19:12:58."

19:12:58. Fifteen seconds before the proxy signature time. Someone had taken out the card first, then opened the meeting record, then entered the proxy account. The sequence didn't hand us an answer, but it cut down on coincidence. Authority doesn't come into being by itself.

At 12:38, Gang Taejun sat Hong Sanguk back down.

"Director, did you issue R-3 yourself."

"No."

"Did you approve the operation of the proxy signature account."

Hong Sanguk didn't answer right away. Denying that he'd done it himself had been easy. Whether he'd approved the operation was a question wider than a hand.

"I approved it as part of the emergency procedure."

"Who could have used it."

"I need to check the roster."

"The deadline you promised, before noon, has already passed."

Hong Sanguk's hand dropped away from the back of his chair. For the first time, he wasn't issuing a defensive order. He was searching for a sentence to command with.

Go Yura said in a low voice.

"The R-3 token wasn't issued by Hong Sanguk. It was issued through a proxy signature."

She wasn't looking at us. She was looking at the screen.

I copied that sentence into the ledger. I didn't put a question mark at the end. It was a confirmed fact. Only who that fact pointed to hadn't opened up yet.

Go Yura wrote her own name in the technical verifier field at the bottom of the ledger. Before, she had been the person pulling logs at my instruction. Now she was the person who had rearranged the order of the questions. She attached a small parenthetical after her signature. `Creation path confirmed.` That parenthetical was the change in this stretch of the case. A trace left behind not by a helper, but by someone at the center of the investigation.

The proxy signature account sat under Hong Sanguk's name. It hadn't been his hand. A door had opened up in between. The next question was who had opened that door.