Malik Odhiambo arrived at the police station carrying a small toolbox.
Inspector Ruth made him leave it at reception.
“It contains a screwdriver.”
“Today every screwdriver has a story.”
Malik surrendered it and received a receipt.
He wore a checked shirt, glasses, and the exhausted expression of a man who had slept in short pieces. A clinical engineer was summoned when machines failed and forgotten the moment they worked again.
“You say the hospital systems used different times,” Ruth began.
“Yes. We must separate them.”
He drew four boxes.
The older CCTV system used a local server inside Mwangaza.
Several Room Thirteen devices took their time from that server after restart.
Access cards used the vendor’s network time.
M-Pesa, phones, and ambulance GPS used external network time.
The medication application used another server, but terminals could display cached or manually entered clinical time.
“Why was the local server behind?” Ruth asked.
“During Sunday’s generator test, an ageing UPS failed briefly. The server restarted using an internal clock that was already slow. The automatic time-synchronisation vendor contract had expired.”
“Did you report it?”
“I created a maintenance ticket.”
“Was it resolved?”
“It was closed by an IT administrator. Comment: non-critical.”
“Who prioritised other tickets?”
“Gichuru pushed billing and theatre work ahead of clock and door-reader maintenance.”
“Did you see Faith’s message about Room Thirteen?”
“Yes. I said I would check. I did not.”
“Did your failure kill Jonah?”
“No. A slow clock did not inject him. But it allowed someone to hide what happened.”
The access-card records showed:
Wanjiku entered Room Thirteen at 2:12 network time and left at 2:19.
Gichuru entered at 2:16 and left at 2:18.
Brian’s card entered at 2:22.
The CCTV displayed all of those events about seven minutes earlier.
The hospital had supplied only a PDF of the medication record.
Malik shook his head.
“A PDF is the story selected by the application. We need the raw audit log—the history of who changed the story.”
A court order limited the forensic search to Jonah’s record, relevant user sessions, system clocks, and administrative changes.
In the server room, the hospital IT administrator, Pauline, claimed audit logs were kept for only seven days.
“They should be retained for ninety,” Malik said.
“Storage was full.”
“Where is the change ticket?”
There was none.
Forensic officers imaged the drives before anyone opened files.
The surviving log fragments showed the medication entry under **WNALIAKA**, but another field read **ADMIN_OVERRIDE**.
Terminal: **ADM-04**.
Location: the chief operating officer’s office.
The record was created at 2:20:43 network time.
The clinical administration time had been manually entered as 2:13.
At 2:20, Wanjiku was buying water.
The camera outside Gichuru’s office contained an eleven-minute gap. The hospital described it as a network failure.
The switch logs showed the camera had remained connected.
Someone placed it in maintenance mode through the security supervisor’s account.
The supervisor said Gichuru had phoned him and requested a restart.
Malik and the forensic officer then performed a controlled time test after preserving the original state. They held a network-synchronised phone in front of several cameras.
Each camera recorded almost the same seven-minute delay.
The Room Thirteen monitor differed by six minutes and fifty-eight seconds. The wall clock differed by seven minutes and eleven seconds.
The variation was expected because devices restarted at slightly different moments.
The report included an error range rather than pretending the number was magical.
Malik was suspended that evening for disclosing system architecture.
He met Wanjiku at Achieng’s office.
“I saw Faith’s message and told myself I would fix it later.”
Wanjiku knew the word.
Later.
Her mother had died in a hospital where people saw oxygen pressure falling and expected someone else to resolve it.
“We cannot return to every warning,” she said. “But we can stop pretending a small warning belongs to nobody.”
Malik provided maintenance tickets already stored in his work email’s offline cache. Achieng refused to open the drive until police could receive it properly.
The generator certificate bore the name **Kibo Technical Services**.
One of its directors was Kelvin Kibet.
The clock had not lied by itself.
Negligence created the opening.
Someone who knew about it chose to use it.