Chapter 7
Two years after the attack, Luca was asked to testify in a civil lawsuit brought by North Harbor shareholders against Dennis Croft.
He did not want to.
Mara said:
“That is not the test.”
So he appeared.
Opposing counsel asked:
“Mr. Moretti, isn’t it true your own household security failures made the intrusion possible?”
“Yes.”
The lawyer paused.
Maybe expected denial.
Then:
“Your fiancée had broad informal authority in your home?”
“Yes.”
“You failed to define limits?”
“Yes.”
“Your office computer was accessible to a supposed vendor?”
“Yes.”
“Your whistleblower file contained an unredacted source identity?”
“Yes.”
The lawyer frowned.
Then:
“So Mr. Croft did not create those vulnerabilities.”
“No.”
“Yet you blame him for exploiting them.”
Luca looked.
“Yes.”
Both.
A vulnerable door does not authorize burglary.
A bad file practice does not authorize theft.
But the vulnerabilities still belonged to Luca to fix.
Then counsel tried another angle:
“Were you trying to acquire North Harbor at a discount?”
“No.”
“Would damaging information help your bid?”
“Possibly.”
“Did you commission the whistleblower report?”
“No. It came to counsel.”
“Did you verify before storing it?”
“We were in process.”
“Did you leak it?”
“No.”
Evidence supported.
Then shareholder counsel introduced an email from Luca:
If Croft issue is real, valuation drops twenty percent.
That looked bad.
Luca said:
“That was financial analysis.”
“Convenient.”
“Yes.”
Then:
“Did you withdraw bid after attack?”
“Yes.”
“Why?”
“Because transaction became contaminated by criminal conduct and regulatory uncertainty.”
No dramatics.
Then Jeremy Lin testified separately.
He explained timestamp changes.
No need to protect Luca.
In fact, he criticized him.
“My identity should never have been in a home paper file.”
Luca heard afterward.
Agreed.
That public criticism made some Moretti executives angry.
Luca said:
“He’s right.”
That helped culture more than a memo.
Then Emma’s role as assistant house manager expanded.
She had to hire staff.
One candidate had a minor theft conviction from nine years earlier.
HR flagged.
Old instinct in house:
No.
Emma asked:
“What was conviction?”
Shoplifting.
age nineteen.
completed sentence.
no recurrence.
strong references.
Could hire for cleaning role with no high-security access.
Some staff objected.
“After what happened?”
Emma said:
“What happened involved trusted insiders and contractors with clean résumés.”
Good.
They hired candidate.
No issue.
Security should assess current risk, not turn fear into permanent exclusion.
Then Pepper chewed one access badge.
Badge deactivated.
Emma wrote incident:
Canine damage.
Priya laughed when seeing audit.
“Finally, honest threat model.”
Then Sofia came back to Chicago for her mother’s surgery.
She asked Luca if they could have dinner.
He hesitated.
Then yes.
Public restaurant.
They talked about Boston.
Work.
Family.
No case.
Then Sofia said:
“I’m dating someone.”
Luca smiled.
“Okay.”
She laughed.
“You always say okay.”
“I’m working on vocabulary.”
Then:
“Are you happy?”
“Some.”
“Good.”
She asked same.
He said:
“Some.”
Fair.
Then Sofia said:
“I thought for a long time that if Gavin hadn’t betrayed me, we’d still be married.”
Luca looked.
“And now?”
“I think taking the keys would have become something else eventually.”
He nodded.
That was the deeper truth.
Even if no attack:
unauthorized surveillance.
secret testing.
managing Luca’s choices.
The relationship had a structural problem before Gavin weaponized it.
Then:
“I loved you.”
“I know.”
“I’m sorry.”
“I know.”
No need repeat exact guilt.
Then she said:
“I’m glad you corrected that headline.”
“It was wrong.”
“Still.”
He shrugged.
Accuracy again.
Then they parted.
No kiss.
No lingering camera.
Luca walked home.
Felt sad.
Then hungry.
Bought pizza.
Life.
Then a security alert at 11:40 p.m.
East service door opened unexpectedly.
Luca’s phone did not alert him.
Good.
Security desk handled.
It was Emma.
She had come back for forgotten laptop.
Badge valid.
No problem.
Monthly report later showed event.
Luca saw.
No spike of panic.
He simply read next line.
That was progress measured in boring data.
Then Marco retired from security chief role.
Not because attack.
Age.
He recommended deputy, Tasha Greene.
Independent review selected her.
First woman to lead estate security.
No symbolism needed.
She was best candidate.
Her first policy:
Stop calling every former employee’s access “trusted.”
Access is active or inactive.
She removed language:
trusted vendor.
Replaced:
approved vendor with scope.
Words matter.
Then one approved florist showed up with an unlisted assistant.
Old culture:
let them in.
New:
assistant gets temporary badge after ID.
Took four minutes.
No offense.
No drama.
Security as routine.
Then Luca attended a wedding at another mansion.
He noticed:
side doors.
vendor badges.
camera cabinets.
His brain mapped.
He stopped himself.
The bride asked:
“You okay?”
“Yes.”
Then he danced badly.
That was harder than threat assessment.
Good.
The civil testimony later exposed another privacy problem.
A shareholder lawyer subpoenaed parts of the household-security audit.
Badge logs contained staff movements.
Training notes contained names.
One appendix even included personal phone numbers that had no reason to be there.
Luca’s lawyers fought to produce only what was relevant.
The court allowed redaction.
Afterward, Tasha changed the report templates.
Security stopped collecting information merely because it was available.
One vendor form asked for a home address.
Why?
Legacy template.
Removed.
Another asked every contractor for a personal vehicle plate.
Needed only when parking access was involved.
Made conditional.
Emma liked the change.
“Less information to leak.”
Exactly.
Then an old family friend arrived at the gate and refused to show identification.
“I’ve known Luca thirty years.”
The guard held the line.
The friend called Luca furious.
Luca answered:
“Show ID.”
“You’ve changed.”
“Yes.”
Then:
“I trust you. The guard doesn’t need to.”
That sentence became useful.
Personal trust should not become a system credential.
A week later another friend forgot a wallet.
Security verified the guest through the approved list and visual confirmation from the host.
Flexible.
Rules did not need cruelty.
Then a housekeeper accidentally took a pantry key home.
She reported it the next morning.
No punishment.
Key returned.
log corrected.
Another employee hid a lost badge for three days because he feared discipline.
That was more serious.
Emma changed the training language:
Report fast matters more than never making a mistake.
A system that punishes every error teaches concealment.
That lesson had a history nobody needed to name every time.
The shareholder case also exposed how easy it was to weaponize the phrase “inside job.”
Counsel for Croft tried repeatedly.
“Wasn’t Ms. Bellandi an insider?”
“In the house, yes.”
“Did she provide keys?”
“She took them and gave them to Gavin.”
“So inside job.”
Luca answered:
“That phrase hides more than it explains.”
The judge told him to answer questions, not speeches.
Fair.
But the point remained.
Sofia’s unauthorized access was an inside contribution.
Croft’s paid burglary was an outside conspiracy.
Gavin connected them.
The gunmen escalated.
One label flattened four different kinds of conduct.
After court, a reporter asked Luca:
“Was Sofia part of the attack?”
He said:
“She was part of the access failure. Evidence did not show she knew about the armed burglary.”
That became the quote.
Some people online called him weak.
Others called him fair.
He ignored both.
Then Emma faced the same pressure in a documentary request.
Producer wanted:
THE MAID WHO EXPOSED THE INSIDER.
She declined.
“I didn’t expose anybody.”
“You saw the keys.”
“Yes.”
“You warned Luca.”
“Yes.”
“That changed everything.”
“Police changed everything.”
Then:
“I was trying not to get shot.”
The producer lost interest in nuance.
Good.
Emma did not need a heroic brand.
Then Tasha built scenario training around the case without names.
Scenario:
A resident’s partner asks staff for a service key, saying it is for a surprise safety inspection.
Correct response?
One trainee said:
“Ask the owner.”
Another:
“Ask security.”
Both.
Then:
What if partner says owner will ruin surprise?
Still verify.
What if partner gets angry?
Document and hold boundary.
Simple.
The story became procedure.
That was better than legend.
Then Luca began noticing how often wealthy households use “surprise” to bypass systems.
Surprise party.
surprise renovation.
surprise gift delivery.
surprise security upgrade.
He told event staff:
“Surprise for the guest does not mean surprise for the people responsible for safety.”
That line saved headaches later.
One anniversary, Camille planned a surprise dinner for Luca.
She coordinated through Emma.
Everything authorized.
Luca was still surprised.
Proof that boundaries do not kill spontaneity.
They just move secrecy away from infrastructure.
The training program also changed how the household handled family requests.
Luca’s aunt once called ahead and said:
“Tell the driver to use the private gate.”
The coordinator asked:
“Is that for accessibility or privacy?”
His aunt was offended.
“Because I said so.”
The coordinator called Emma.
Emma called Luca.
Luca asked his aunt the same question.
She sighed.
“Privacy.”
Then:
“Front gate has photographers.”
That was enough.
A temporary alternate route was approved.
No one simply obeyed because she was family.
The aunt complained at dinner.
Luca said:
“They were right.”
She rolled her eyes.
Then used the same process next time.
Boundaries become culture only when important people survive being inconvenienced by them.
Then one younger staff member asked whether all this procedure made the house feel less personal.
Emma answered:
“Sometimes.”
Then:
“But personal should come from how we treat each other, not from how many rules we ignore.”
That line ended up in the training manual.
Not as inspiration.
As practical guidance.
Then a catering company failed to submit one temporary worker’s ID in advance.
Old habit:
let them in because everyone else is cleared.
New habit:
hold at gate, verify through employer, issue limited badge.
The worker waited seven minutes.
No humiliation.
No suspicion speech.
Just process.
Later he said:
“Honestly, my other jobs are way messier.”
Emma smiled.
May you like
The goal was not to make security dramatic.
The goal was to make correct action easier than shortcut.
