PEN & PAPER · CASE FILE
Eleven Seventeen at the Observatory
Pen & Paper · A delayed live broadcast
A sealed drive disappears while a telescope feed appears to place the technician elsewhere. Work out which clock belongs to which event and whether a maintenance permit was an innocent administrative action.
Investigate this case
Read the case file below, or open the interactive desk to examine records, keep notes and submit your reasoning. These are the case materials, without the solution.
The scene
The vault seal was intact at local 23:08 and broken at 23:14. The broadcast feed is delayed five minutes. Only the six named people had inner-building access, and all exits were sealed at 23:22.
People and accounts
Nabil Cole
Visiting astronomer
Where were you when it happened?
I watched the delayed telescope feed in the lecture room with three students.
What connects you to this case?
I wanted access to the data for my own paper. My rejected application is public.
What did you see or hear that others might have missed?
The feed announced 23:17 while the lecture-room wall clock showed 23:12.
June Bell
Cleaner
Where were you when it happened?
I cleaned the outer hall under its fixed camera. I did not cross the inner door.
What connects you to this case?
I stole a small amount from an unlocked tips tin. That was before the blackout.
What did you see or hear that others might have missed?
Eli asked me to leave the service cart beside the vault. It was empty when I left it.
Vera Holt
Observatory director
Where were you when it happened?
I led the donors’ live tour until 23:20. The research drive was secured before the broadcast.
What connects you to this case?
A missing drive could cost our grant. I had no wish to lose the only current copy.
What did you see or hear that others might have missed?
The telescope video carries a delayed broadcast clock, not the vault’s local time.
Osa Reed
Student assistant
Where were you when it happened?
I checked the research seal at 23:08 and stayed with the director’s tour from 23:10 onward.
What connects you to this case?
I had copied an approved subset of the data for my dissertation.
What did you see or hear that others might have missed?
The vault’s audit clock was checked against the radio signal that afternoon.
Mae Ward
Grant accountant
Where were you when it happened?
I stayed at the reception desk. I issued Eli a temporary maintenance permit in the afternoon.
What connects you to this case?
The drive contains invoices from a supplier I secretly own. I had been asked to disclose that ownership.
What did you see or hear that others might have missed?
A temporary permit can open the inner corridor without sounding an intrusion alarm.
Eli Marsh
Instrument technician
Where were you when it happened?
I repaired the telescope mount when the broadcast showed 23:17. I could not also have been at the vault.
What connects you to this case?
The director was investigating my unapproved use of the instrument account.
What did you see or hear that others might have missed?
Mae said the maintenance permit was cleared by the board.
Case records
Read each record on its own terms. A claim made by a person is different from a fact established by an independent record.
Physical record · Lecture room
Broadcast timing certificate
Frames labelled 23:17 left the telescope camera at local 23:12. A screenshot carrying the broadcast clock cannot independently prove a person’s local location.
Physical record · Lecture room
Tour and hall recordings
Vera and Osa stay visible on the tour. Nabil stays with students, and June in the outer hall. None approaches the vault during the local theft interval.
Physical record · Reception desk
Permit M6 file
Mae created M6 and overrode the required second authorisation. Its stated repair is inside the vault, where no instrument fault was reported. She supplied the permit to Eli personally.
Physical record · Reception desk
The tips-tin report
June took loose cash before 22:40. She admits it and is recorded returning the cart empty before M6 is used. That theft does not explain the research drive.
Physical record · Instrument bay
Loop-loading audit
Eli’s local account loaded the diagnostic loop and explicitly disabled the live-input warning. The operation predates the drive’s disappearance.
Physical record · Reception desk
Supplier ownership extract
Mae owns the supplier flagged in the drive’s invoice review. The research files hold both the supplier audit and Eli’s unauthorised account-use logs.
Physical record · Instrument bay
Instrument bay recording
Eli’s claimed repair image is a prerecorded diagnostic loop loaded at 22:50. The live bay camera shows the bay empty at local 23:12.
Physical record · Research vault
Local vault audit
The inner door opens at local 23:12 on temporary permit M6. The seal camera shows Eli entering with an empty service cart and leaving with the drive case at 23:14.
Physical record · Research vault
Seized service cart
The drive is inside the cart’s locked equipment drawer. Eli carries its unique drawer key on the instrument-bay camera before and after the theft.
Physical record · Reception desk
Pre-broadcast message slip
Mae’s authenticated message to Eli says, “M6 bypasses the second approval. Take the complete drive; the invoice folder must not survive the board review.” Eli replies with the cart-drawer number.
Questions to resolve
Who physically took the research drive?
Who knowingly enabled the unauthorised vault visit?
Which timestamp governs the vault visit?
Why was the complete drive targeted?
Use the interactive case desk to select your finding and cite the records that support it. The answer is checked there, and your progress stays in your browser.