Chapter 4 - The Signature Nobody Authorized
I wanted to drive straight to the foundation office and demand the revised guest list. That would have been satisfying, visible, and probably the worst choice I could make.
Instead, I met Sara at a coffee shop off base, where she brought her own notebook and absolutely no donor files.
“I don't know if they'll fire me,” she said before she sat down. “I need the job. My husband is retraining after an injury, and rent doesn't care whether you're doing the right thing.”
“Then don't do anything for me that puts your family at risk.”
“That's not why I'm here.”
She opened the notebook to a page of dates. Three weeks before the gala, the program committee had approved a smaller fundraising dinner that would showcase only families who had actually received support. Twelve days later, Vanessa had ordered the guest list expanded to include foundation donors and prominent military spouses. After midnight on the eve of the event, five family names disappeared and five sponsor representatives took their places.
“There's nothing inherently wrong with inviting sponsors,” I said.
“No. It's the reason they gave.” Sara tapped her pen. “The new list says it was approved by the office of Lieutenant General Katherine Morgan as a command-sponsored modification. We're not a command program. And your mother hadn't even confirmed she was coming.”
“Vanessa told you that?”
“Her assistant wrote it in an email. But when I asked to see the authorization, the attachment was missing.”
Sara showed me her handwritten notes, including a document title and sender: LENA WALSH, EVENTS OPERATIONS. They gave investigators a trail without exposing donor records.
I called the foundation's compliance contact, Ben Rivera, while Sara sat across from me.
“Mr. Rivera,” I said, “I'd like to submit a concern about the approval process for family grants and the use of a military office's name on event materials.”
Ben sighed so audibly I could hear the chair beneath him shift. “Major Morgan, I am aware there was a disturbance at the reception.”
“Then you also know I was accused of theft while the necklace remained on the table.”
“I know there are two accounts. We're a private nonprofit. We have policies, and we have counsel.”
“Do those policies include independent review of restricted donations?”
Silence. Then: “Send your concerns in writing. Please don't circulate financial documents.”
It was sound advice. I should have followed all of it.
That afternoon, I remembered a spreadsheet on my personal laptop. I'd downloaded it six weeks earlier as a program volunteer for a permitted committee review. It listed grant identification numbers, approval dates, promised amounts, and a handful of family names. It didn't include diagnoses, but it did include addresses and contact details that applicants had trusted the foundation to protect.
I wanted to show Ben what I meant. Rather than send only the two relevant entries through the approved reporting channel, I attached the whole spreadsheet to an email from my personal account. I sent it to Ben and copied myself at an old address so I'd have a record.
When I pressed Send, I felt relief.
Fifteen minutes later, I saw the mistake: autocomplete had inserted an outside address with almost the same name as my own old account. The message had gone to someone I couldn't identify.
I called Ben immediately. “I sent a document outside the approved channel,” I told him. “It may contain applicant information. I'm reporting it now.”
He didn't minimize it. He told me to stop forwarding anything, preserve the original email, and provide the recipient address to the foundation's privacy officer. Then he said he had to notify counsel.
I sat for a long time with the phone against my ear after the call ended.
I had meant to help people who were being kept waiting. My impatience had put their information at risk.
My mother had warned me not because she assumed I was careless, but because she understood how quickly urgency could become an excuse.
Before I could decide how to tell Ella, an email appeared from a sender I didn't know.
Subject: ABOUT YOUR ATTACHMENT.
The body was one sentence.
May you like
I think you were meant to find the missing payments. But you're looking in the wrong account.
