This walkthrough gives the answer away on purpose. Read it once to learn how the evidence works, then play a fresh case for real.
Meridian Rail Systems, a transit contractor
A competitor undercut Meridian's sealed bid by 0.4% on three consecutive tenders.
CLUE 1
How you surface it: Request mailbox audit logs, not just message logs.
Why it points at the insider: Deleting a rule does not delete its audit record. Audit logs outlive the artifacts users think they control.
CLUE 2
How you surface it: Run WHOIS/registration lookups on the forwarding domain.
Why it points at the insider: Infrastructure timing narrows the window and rules out coincidence.
CLUE 3
How you surface it: Review mailbox delegation and least-privilege grants.
Why it points at the insider: Assistants often hold standing access to executives. Standing access is standing risk.
CLUE 4
How you surface it: Pull file-access telemetry and align it to the forward timestamps.
Why it points at the insider: Sequence is the proof: access, then egress, then a competitor's number.
Nora Feldman is the insider. Motive: Coercion — a family debt held over her by a broker. Method: A mailbox auto-forward rule pushing bid attachments to a burner address.
Timeline: Day -60 rule created after an executive travel week; Day -45, -30, -12 bid packs auto-forwarded hours before submission; rule deleted the morning the third loss was announced.