Chapter 2
Sofia’s first formal statement happened the next afternoon.
Not at the mansion.
At her attorney’s office.
Detective Mara Ortiz attended with an assistant state’s attorney.
Luca did not.
That was deliberate.
He received facts later through his own counsel.
Sofia admitted taking Emma’s spare keys.
That alone was not yet proof she helped gunmen.
Why did she take them?
Because three weeks earlier, she hired a private risk consultant.
Name:
Gavin Reed.
No relation to Emma.
Former corporate security analyst.
Current consultant at Sentinel Grey Advisory.
Sofia said she became worried after receiving anonymous messages about Luca.
Photos of the mansion gates.
a picture of Luca leaving a restaurant.
one line:
Somebody close will make the door easy.
She did not tell Luca.
Why?
Because she thought he would increase security dramatically and cancel public events.
That answer angered him when he heard.
Not because it was impossible.
Because she had decided his reaction was hers to manage.
Then what did Gavin recommend?
A “silent vulnerability assessment.”
He would test physical access:
service doors.
key-control habits.
camera blind spots.
staff routines.
Did Luca authorize?
No.
Did Marco D’Angelo, security chief?
No.
Did the house manager?
No.
That made the assessment itself unauthorized.
Sofia had no right to stage access tests in someone else’s residence without consent.
Then the keys.
Gavin asked for temporary impressions or photographs of low-security household keys.
Sofia photographed Emma’s ring once.
Then he said photographs were insufficient because older keyways had wear patterns.
So Sofia removed the spare ring from the staff office while Emma was upstairs.
How did she access the office?
House manager desk had a shared administrative key.
Sofia knew where it was.
Again:
informal access.
She gave Gavin the ring for forty-five minutes in a café parking garage.
He returned it.
She planned to put it back.
Before she did, the engagement dinner began and guests arrived.
So she kept the ring in her purse.
That explained the purse.
Not innocence.
But not yet violence.
Then why did the attackers have a working key if Gavin returned originals?
He copied them.
Sofia said she did not authorize duplication.
Did she know he might?
She admitted:
“I knew he was testing access.”
That made duplication foreseeable.
Then why did she tell Luca to “leave it alone” when he noticed the keys? Wait that's prior story? Here she didn't. No.
Why did she hide the ring after Emma noticed?
Fear.
She saw attack unfolding.
Realized the keys might connect.
She hid them because she was afraid Luca would think she had betrayed him.
That act damaged credibility.
Then:
Did she know Gavin planned an intrusion that night?
“No.”
Did she know he planned any live test?
“Yes.”
There.
She thought a red-team exercise would happen sometime before the wedding.
Terms:
nonviolent.
no weapon.
no contact with guests.
exterior and service access only.
if entry achieved, leave a marker card and exit.
Was that written?
Partly.
An engagement letter existed.
But it was vague:
physical penetration testing of residential perimeter and nonoccupied service areas.
No date.
No house-owner signature.
Only Sofia.
Sentinel Grey should have refused without property-owner authorization.
Gavin did not.
Then:
Did Sofia know about North Harbor Logistics?
“Yes.”
How?
Luca had discussed acquisition pressure.
She worked in communications and reputation management.
He had told her a rival bidder was spreading rumors that North Harbor had hidden regulatory exposure.
She encouraged independent due diligence.
Nothing criminal.
Then Gavin asked whether Luca kept due diligence at home.
Sofia said yes.
That was worse.
Why tell risk consultant?
He claimed threat messages might relate to the deal.
He asked:
“What would an intruder target?”
Sofia answered.
Library.
office workstation.
red file.
There.
She had given target intelligence.
Not knowingly to gunmen.
But she had.
Then Gavin.
Police located his office empty.
Laptop gone.
phones off.
apartment partially cleared.
That looked bad.
Sentinel Grey’s business partner, Dana Holt, cooperated.
She was shocked.
The firm normally did corporate tabletop exercises.
No live residential penetration without signed authorization from property owner and law enforcement notification when weapons risk existed.
Gavin handled Sofia privately, outside normal intake.
Invoices came from his personal LLC:
Greyline Risk.
Not Sentinel Grey.
Sofia knew?
She said she thought it was a billing affiliate.
Could be.
Then Victor Kane.
Who was he?
Former collections agent.
private repo work.
two assault arrests.
no current security license.
No legitimate red-team background.
How connected to Gavin?
Phone records later.
But first, the attack route.
Police mapped.
A copied service key opened east corridor at 8:09.
Maintenance cabinet opened with another copied key.
Camera network cable physically disconnected.
rear terrace sensors disabled from local panel.
Service elevator placed in maintenance mode.
At 8:14, three men entered through east corridor.
Fourth approached terrace.
At 8:17, first shot.
Who fired first?
Ballistics:
terrace shooter fired into dining room.
Why?
A guard spotted movement and shouted.
The attackers’ plan may initially have been covert.
Then escalated.
That mattered.
The initial operation may have been theft/data extraction, not planned mass shooting.
Still dangerous.
Bringing guns into occupied mansion makes violence foreseeable.
Then Victor’s line.
“Inside already opened it.”
What did that mean?
Could refer to copied key.
could refer to Sofia.
could refer to another insider.
Police did not assume.
Then Emma.
Her statement revealed something else.
The staff-office drawer where spare keys lived had been disturbed two days earlier.
She thought house manager borrowed.
No sign forced.
Sofia admitted taking the ring only the afternoon of attack.
What happened two days earlier?
Maybe someone else accessed.
House manager, Paul Givens, denied.
Executive assistant, Nina Brooks, denied.
Could be Gavin visited? Did Sofia let him inside previously?
She admitted he had attended one wedding-planning walk-through disguised as vendor security consultant.
That was not disclosed to Luca.
When?
Two days earlier.
There.
Gavin had been physically inside.
Sofia introduced him as:
event risk adviser.
House staff assumed wedding vendor.
He had access to ground floor for forty minutes.
Did he enter staff office?
Sofia said she did not see.
He could have.
Then the copied keys she gave him on attack day may not have been first access.
He could have mapped routes earlier.
Then house logs.
Gavin’s phone connected to guest Wi-Fi two days earlier.
Also:
a second device connected for six minutes.
Unregistered.
MAC randomized.
Could be his.
Could be accomplice.
Then Luca’s security failure.
Marco D’Angelo was furious at Sofia.
Then audit found his own problems.
Shared administrative keys.
guest vendors not individually badged.
service camera cabinet keyed with household maintenance lock.
network cable physically accessible.
no tamper alert.
staff spare ring controlled by drawer key, not logged safe.
Luca looked at Marco.
“How long?”
“Years.”
“Why?”
“House isn’t a data center.”
“No.”
Then:
“But apparently we protected wine better than cameras.”
The wine room used dual access.
Marco had no answer.
Luca felt anger shift.
Sofia’s actions mattered.
Gavin’s betrayal mattered.
But the house had made unauthorized access easy because everyone trusted familiarity.
Then North Harbor.
Why target red file?
The red folder contained:
due diligence on North Harbor’s freight contracts.
a whistleblower memo alleging its chief operating officer, Dennis Croft, paid a subcontractor to falsify customs inspection timestamps.
Potential regulatory fraud.
Luca had not acted yet.
He was verifying.
Who knew?
Luca.
his lawyer.
two analysts.
Sofia.
And the seller’s CEO knew there was “an issue,” not details.
If attackers stole the file, someone might destroy leverage or learn whistleblower identity.
The whistleblower’s name was in the paper file.
That was dangerous.
Luca swore.
Then Mara asked:
“Why was a whistleblower name in a home file?”
His lawyer answered:
“Because Luca insisted on reading hard copy.”
Mara stared.
Luca accepted.
“My mistake.”
Good.
No blaming staff.
Then police found the black case dropped by attacker.
Inside:
red file.
two other folders.
nothing removed?
Forensic inventory uncertain.
One USB drive had been connected to office computer for forty-two seconds.
What copied?
Logs showed attempted access to encrypted due-diligence folder.
Failed first password.
Then correct password used.
That was the next problem.
Who knew password?
Luca.
His lawyer.
Nina Brooks, executive assistant.
Sofia?
Luca thought.
He had typed it in front of her once?
Maybe.
Password not written.
Then logs showed successful authentication from a token stored in browser session.
No password needed if physical user profile unlocked.
Was workstation unlocked?
Emma had dusted office at 6:30.
Luca used computer at 7:10.
Did he lock screen when leaving?
He could not remember.
Marco checked:
auto-lock fifteen minutes.
Attack 8:20.
should lock.
Unless someone extended setting.
Audit log:
auto-lock policy changed to “never” at 7:02 by local admin account.
Who had admin?
Nina.
IT contractor.
Nina had been at dinner in another room.
IT contractor remote login?
No authorized session.
Someone altered locally.
Two days earlier during Gavin visit?
Possible.
The attack had more preparation than Sofia understood.
Then Luca asked his counsel:
“Is she going to be charged?”
Answer:
Maybe.
Unauthorized access assistance.
recklessness.
evidence issues from hiding keys.
depends intent.
But no evidence she knew guns or theft target beyond assessment.
Do not prejudge.
Then Sofia sent one message through lawyers:
I am not asking Luca to believe me. I am asking him not to decide I wanted anyone hurt before the evidence is complete.
Luca read.
That was fair.
He still took off the engagement ring.
Not punishment.
A pause.
He put it in a drawer.
Then Emma came to work two days later.
House manager told her she could stay home paid.
She refused.
Not bravery.
She hated being alone in apartment replaying glass.
At mansion, she stood at dining-room threshold.
Boarded windows.
Bullet holes marked.
She froze.
Luca happened to be there.
“You don’t have to come in.”
“I know.”
Then:
“I need to see it when nobody’s shooting.”
He understood.
She walked inside.
Looked at marble column.
The chip where a bullet struck.
Then at floor where Sofia’s purse had been.
Emma said:
“I don’t know if I hate her.”
Luca looked.
“You don’t have to know.”
Then Emma said:
“She took my keys.”
“Yes.”
“That part I hate.”
Reasonable.
May you like
The investigation did not need one clean villain yet.
It had enough facts to be angry at.
