ANALYZING… FILE TYPE: Text Communication PERIOD: Colony Era TOPIC: Colony Surveillance SUMMARY: Communications between two New Cascadia infosec officials, outlining unauthorized activation of surveillance systems. The user behind these acts is unknown. Annotated by sender. =================================================================== From: Wan, M. To: Allen, S. Subject: Surveillance protocol troubleshooting Attached is an example of the irregularity I'm seeing. I've seen it across all sectors. An unknown user is reactivating surveillance protocols even when they've been legitimately shut off by an authorized user. Seems to be an unnamed, automated program rather than a human user, but can't say for sure. Any ideas on who or what "unknown user" is? I can't access the "restricted directory," either. Don't want to send this up the chain if we can solve it ourselves, but I'm worried classified quarantine activity is getting recorded, saved, and possibly distributed. No way am I taking the fall for an info leak, not after what happened with Carson. We need a fix ASAP. >>ATTACHMENT>> 0535: USER_B829112 disabled surveillance protocol in Quarantine Unit B. 0540: UNKNOWN USER activated surveillance protocol in Quarantine Unit B.[1] 0560: USER_B829112 disabled surveillance protocol in Quarantine Unit B. 0564: USER_B829112 requested deletion of SURV_FOOTAGE_QuarB_0540-0559. 0565: SURV_FOOTAGE_QuarB_0540-0559 deleted. 0568: USER_B829112 signed out. 0600: UNKNOWN USER activated surveillance protocol in Quarantine Unit B.[2] 0605: UNKNOWN USER initiated file recovery.[3] 0619: SURV_FOOTAGE_QuarB_0540-0559 recovered. 0622: UNKNOWN USER transferred SURV_FOOTAGE_QuarB_0540-0559 to RESTRICTED DIRECTORY[4] ===================================================================== [1] Short pause before deactivated surveillance is reactivated by the unknown user. I assume the delay is to try to avoid detection. [2] Another, even longer delay before the protocol is illicitly reactivated once again. [3] An "unknown user" should absolutely not be able to do this without approval from administrators. [4] No idea what or where this is. I can't access it. These logs indicate hundreds of files are being covertly added to this unreachable directory. ===================================================================== TYPE: TEXT [X]; AUDIO [ ]