The Missing Page
A classified page was found missing from a binder at 14:30; an audit at 12:30 confirmed it was present. The records room has one door with a badge-in reader. There is no exit reader; the door self-closes and locks. Badge log: A 12:41, B 13:07, C 13:22, D 13:58, A 14:05. The corridor camera covers the door but has an 8-second blind spot at the stairwell landing, and it was offline 13:10-13:20 for maintenance. A cleaning contractor, M, entered at 13:31 with a master key and left at 13:41; policy requires an escort, and no escort was logged. The room's motion sensor shows continuous occupancy from 12:35 to 14:20. Five people had legitimate reason to be in the room: A, B, C, and D (all badged) and M (keyholder).
1. Which of the five can be excluded, and which cannot? Give your basis in one line each.
Read the worked answer
None of the five can be excluded, and the badge log is the reason. Entry-only readers prove presence, never absence.
- A - badged in at 12:41 and again at 14:05. Either A left and returned (a second entry is consistent with a departure) or the card was used by someone else. Both readings keep A in the field.
- B - in at 13:07. Without an exit record there is no evidence B ever left, so B is present for the entire window.
- C - in at 13:22, carrying a laptop bag, which is a plausible concealment method. Cannot exclude.
- D - in at 13:58, inside before the 14:20 sensor drop-off, so 13:58-14:20 is squarely inside the loss window. Cannot exclude.
- M - unescorted 13:31-13:41 with a master key and a cart. That is both an opportunity and a policy violation, and the escort failure means nobody can vouch for M's movements.
Additionally, an unlogged sixth person cannot be excluded: the camera was dark for ten minutes and has an eight-second blind spot, so tailgating behind any of the five leaves no record at all.
The honest answer is that the current evidence set cannot exclude anyone - which is a finding, not a failure.
2. A colleague concludes: "D entered last, so D took the page." Identify the reasoning errors.
Read the worked answer
- Last-in fallacy. "Last to enter" would only be decisive if everyone else had verifiably left. The log has no exits, and the motion sensor shows the room continuously occupied from 12:35. On this record, four badgeholders could have been standing in the room when D walked in.
- Ignoring the alternatives already in evidence. M had a master key and no escort; the camera was blind for ten minutes and has a gap; the page could have been misfiled rather than removed. A conclusion that requires all of those to be false, without testing any of them, is not a conclusion.
- Unstated premise. "Missing" was established by an audit at 12:30 and a discovery at 14:30. The inference assumes the page left through the door by a person's hand. If it was misfiled inside the room, no entry log matters at all.
What the evidence actually supports: a loss window of 12:30-14:30, five people with opportunity, one unescorted keyholder, and a compromised camera. That is a narrowed field, not a suspect.
3. Name the single record most likely to narrow the field, and one that looks useful but is not. Justify both.
Read the worked answer
Most likely to narrow it: the access audit log of the records-management system or terminal, if the binder or its contents are tracked electronically - account, timestamp, action. If the page was also scanned, printed, or copied, the device log with account and time is the same class of evidence. It converts "someone in the room" into "this credential, at this minute," and unlike the badge log it is tied to an action rather than a presence. Second best: a key-control audit showing every door M's master key opened during the shift.
Looks useful, is not: the badge-in log as currently configured. It cannot distinguish who was in the room from who passed through the door once, and every entry in it is consistent with innocence. Reading it harder will not help; the missing field is exit.
Also worth discounting: the corridor camera. It has a ten-minute outage and an eight-second blind spot, so its silence about a person proves nothing - and presenting it as complete coverage to a reviewer would be a misrepresentation.