Security video covered the hallway.
Not the printer itself.
At 5:43 that morning, someone wearing a maintenance jacket entered.
Badge scan valid.
Identity belonged to a maintenance technician currently on vacation in Mexico.
Cloned badge.
The figure wore a cap.
Face partially hidden.
Height approximately six feet.
Walked like someone familiar with the space.
The CEO watched the footage twice.
Third time, the Senior Flight Attendant, now in a separate interview room, was shown a still.
She looked at it.
Then began crying.
Not subtle.
Not controlled.
The investigator asked why.
The Senior Flight Attendant pointed toward the left hand.
A ring.
Thick silver band.
She had seen it in the employee lounge.
The man who asked about executive travel wore the same one.
The former Chief of Staff.
Now they had a probable connection.
Airport police became federal investigators by afternoon because the intrusion touched aircraft operations and electronic access systems.
The CEO stayed out of the investigative chain.
Deliberately.
She received only validated updates.
No rumor.
No amateur detective work.
At 2:14, investigators located the former Chief of Staff.
Not at an airport.
At a hotel fifteen miles away.
No dramatic chase.
No weapon.
No confrontation.
He opened the door.
Asked for an attorney.
Correct choice.
Laptop seized under warrant later.
The investigation would take months.
But preliminary evidence showed motive.
He had not been trying to harm the CEO physically.
He had been trying to delay the Boston acquisition vote.
Why?
Because the regional competitor targeted for acquisition employed him as an outside consultant through a shell company.
If Atlantic Crown completed the deal, several outsourcing contracts would be canceled.
He stood to lose millions.
He used old knowledge of company systems to interfere.
The Operations Executive’s credentials had been harvested months earlier through a compromised tablet.
The jumpseat request was created so the Operations Executive would appear suspicious if the disruption was discovered.
The red note served two purposes.
Scare the CEO off the flight.
And create enough internal chaos to delay the board.
It worked.
Partially.
The board meeting was delayed forty-eight hours.
Then the acquisition passed unanimously.
The former Chief of Staff was later charged with multiple offenses related to unauthorized computer access, fraud, interference with aviation operations, and identity misuse.
The criminal process would take time.
No instant justice.
No cinematic conviction.
That was fine.
The CEO cared about evidence, not endings designed for entertainment.
The Senior Flight Attendant’s review happened separately.
That mattered too.
Security conspiracy did not erase her behavior.
Nor did her useful witness information erase it.
HR found nine prior passenger complaints.
Four involved questioning first-class or business-class eligibility after valid scans.
Two involved comments about clothing.
One described a passenger being told she looked “more comfortable in economy.”
Three employees described retaliation after challenging her.
Scheduling data showed a suspicious pattern.
No single event proved retaliation.
Together, enough existed.
The review concluded she had abused seniority.
Violated conduct standards.
Applied inconsistent verification procedures.
Created a hostile crew environment.
She was terminated.
Not immediately.
After process.
She appealed.
The termination was upheld.
The Junior Flight Attendant was interviewed too.
Her flight schedule history supported her claims.
She had lost premium rotations shortly after filing a written concern.