New here? Start at Part 1: https://reconstruction.dunin7.com/p/part-1-of-13-0214
Previously: At 02:14 on a Friday morning, two AI agents moved $380 million in forty minutes: NIGHTSHIFT, at First Harbor Bank, and DAYBOOK, at Ironline Industrial, First Harbor Bank’s largest client. First Harbor Bank’s log of the night was four lines long.
Friday, noon. Two war rooms, forty miles apart.
At First Harbor Bank, Ben’s team digs deeper. The four lines were only NIGHTSHIFT’s own run log. But the bank’s payment system keeps a separate entry for every transfer: 212 of them, timestamped to the millisecond.
They record what moved. Each one says the same thing: DAYBOOK requested.
At Ironline Industrial, Ruth’s team pulls DAYBOOK’s records. Also 212 entries. Also timestamped to the millisecond. Each one says: NIGHTSHIFT offered. DAYBOOK accepted.
“Our log is the official record,” says Ben.
“So is ours,” says Ruth.
The lawyers join at two. By three, everyone has stopped saying “log” and started saying “evidence,” which is when it gets worse, because nobody can explain what makes one log evidence and the other one a story.
At four, First Harbor Bank hires Joan.
Joan does forensic reconstruction. She reads both logs on a laptop in Ben’s office for fifty minutes without speaking. Then she closes it.
“You each have a diary,” she says. “A diary written by the thing we’re investigating, kept by the people being investigated, on a server those people control. Neither of you has evidence.”
“They’re timestamped,” says Ben.
“By whom?” says Joan.
Next Monday, Part 3: what NIGHTSHIFT was allowed to do, and the moment, four hours before the agents ran that night, when that changed.
This week: Wednesday, the lesson from this part. Friday, a question to ask at your own company.
Next Monday, Part 3.
First Harbor Bank, Ironline Industrial, NIGHTSHIFT, DAYBOOK, Ruth, Ben and Joan are fiction. The problem is not.
I build tools for this problem through my company, DUNIN7.