Card Versus Code at Storage Unit 214
Storage Unit 214 was inventoried Friday at 1700, sealed, and found to contain 14 handguns. The theft was discovered Monday at 0800. Gate and keypad records show: Saturday 2145, unit keypad code 4471 was entered; Sunday 0610, keycard 0092 was read; Monday 0720, keypad code 5510 was entered. Facts developed: code 4471 belongs to employee Tia Marston, who reported her access card lost Friday at 1600 and was issued replacement card 0093 on Monday at 0900. Card 0092 belongs to contractor Dale Reubens, whose engagement ended Friday at 1700 and whose card was deactivated Saturday at 0900; the log shows no reactivation. Code 5510 belongs to tenant Marcus Bell, who called police Monday at 0735 from the parking lot. Bell's phone location data places him 40 miles away from Saturday night through Sunday 0700.
1. For each of the three entries, state what it does and does not establish.
Read the worked answer
Saturday 2145, code 4471 (Marston's code): establishes the code was used. It does not establish Marston used it. A keypad code is not a card - reporting a card lost does not deactivate a memorized code, and codes are commonly shared with coworkers, cleaners, or family. Attribution to Marston requires separate evidence.
Sunday 0610, card 0092 (Reubens): establishes a card read that the log says should have been rejected as of 0900 Saturday. That is the anomaly in this timeline. Three explanations compete: the deactivation did not take effect in the system, the log record of deactivation is wrong, or the card data was copied onto another medium. Critically, even a valid read of 0092 does not establish Reubens was present - the card and the person are separate questions.
Monday 0720, code 5510 (Bell): establishes a code entry roughly 75 minutes before Bell called police. That is consistent with a tenant discovering a burglary and equally consistent with a staged discovery. Standing alone it proves neither.
2. Given the inventory and location facts, what is the earliest and latest window in which the firearms could have left, and who can be excluded at this stage?
Read the worked answer
Window: after the Friday 1700 inventory was completed and before the Monday 0800 discovery - a maximum of 63 hours. The inventory does not tell us the unit was watched, so no narrower window is available from the record alone.
Exclusions:
- Bell is excluded from the period Saturday evening through Sunday 0700 by the phone location data. He is not excluded after Sunday 0700, and the Monday 0720 entry falls outside his exclusion.
- Reubens is not excluded. Deactivation of his card says nothing about his physical whereabouts, and his engagement ending Friday does not place him elsewhere.
- Marston is not excluded. Loss of a card is unrelated to knowledge of a code.
The tempting error is to convert the Sunday 0610 card read into "Reubens was there." The record shows a card read; it does not show a person.
3. What single additional record would most narrow the field, and why is it more valuable than a witness canvass of the facility?
Read the worked answer
The access-control system's internal audit, specifically the state of card 0092 in the authorization table at the moment of the Sunday 0610 read, together with any "access denied" events logged between Saturday 0900 and Sunday 0610.
Reasoning:
- If 0092 was deactivated and the door still opened, the system or the deactivation record is defective - that is a facility-integrity problem affecting every entry on the log.
- If 0092 was still active because deactivation was never actually performed, the log entry is wrong and the person who failed to perform it becomes relevant.
- A series of denied reads on 0092 before Sunday would suggest someone testing a cloned card; a clean single read would not.
A canvass produces recollections of a dark parking lot hours later, filtered through expectation. The audit is contemporaneous, machine-generated, and binary. Take the audit first; the canvass afterward, focused on the specific window the audit identifies.