505. Target Indicators

Email: bidemiologunde@gmail.com

In this episode, host Bidemi Ologunde examines a February 2026 vehicle hit-and-run and a March 2026 municipal ransomware incident through the lens of investigative technique. What clues survive after a crash scene is disturbed? What can cyber incident responders learn from accident reconstruction? How does the military concept of a "target indicator" help analysts notice what someone did, failed to do, or accidentally revealed? This episode explores how small details, disciplined timelines, and careful public reporting can turn fragments into accountability.

Transcript

SPEAKER_00 0:16

Out of consideration for individuals' privacy and to protect the integrity of ongoing investigations, some names and locations on this episode have been slightly modified. Welcome to the Big Picture Podcast. My name is P. Demio Logunde. So today's episode begins with an accident report and then it continues through a citywide ransomware incident and ends with a principle that was borrowed from military fieldcraft, which is basically the target indicator. So in sniper doctrine, a target indicator is something a trained observer looks for because it reveals what someone else tried to hide. It may be sound, movement, a kind of reflection, disturbed vegetation, and unnatural outline or a failure to conceal what should have been concealed. So the concept is usually taught in a tactical environment, but its value travels very well. An accident investigator looks for indicators. A cyber investigator looks for indicators. A good analyst looks for the small thing that refuses to fit in. So the story today is set in a quiet peninsular city south of San Francisco in California. I'm going to call it Harbor Point. So on a Thursday evening in late February 2026, around 6.20 p.m., police were sent to a roadway near a residential complex and a broad suburban boulevard. The call involved a vehicle and an electric bicycle. So officers arrived within minutes and found a 15-year-old boy who was injured after being hit while riding the e-bike. The driver had left before police arrived. So that fact that the driver was nowhere to be found matters a lot. In many collisions, many accidents, the scene itself becomes the first witness. The injured person may be too frightened, they may be in pain, they may be confused, or just simply unable to describe everything that led to the accident. The driver may not even be anywhere to be found. Bystanders may remember fragments of what happened. But the street itself, the road, is never completely silent. There is debris and paint transfer and glass fragments and tire marks and scrape patterns, damaged reflectors from the vehicles involved, surveillance angles, license plate reader hits, and the rhythm of where things came to rest after all the commotion and the chaos. So an accident scene is a kind of map. The first responder stabilized the human emergency, and then the investigators preserve the evidence before weather and traffic and cleanup crews and people's memories and even fear begin to erase it. So in Harbor Point, emergency medical responders treated the teenager at the scene of the accident and transported him to a local hospital. And then police moved from rescue to reconstruction. They looked for the suspect's vehicle and they found a vehicle that was believed to be involved in the collision parked at a nearby apartment complex. They collected physical evidence. They reviewed license plate reader data. They obtained search warrants for electronic records. So all those steps eventually supported an arrest, and the case was submitted to prosecutors for hit and run causing injury. So that is the public spine of the incident. A minor on an electric bicycle, a collision with a vehicle, a driver who left the scene of the accident, a nearby apartment complex, physical evidence, license plate reader data, electronic records, and then an arrest. So for the purposes of this narration, let's call the teenager Miles and let's call the driver Rowan. Of course, these are not their real names. Miles was 15 years old, which means he was old enough to move through the city on his own, but still young enough that every adult in the story would later measure the evening by how quickly childhood can become evident. So Miles had probably ridden that same stretch of road before, and at that hour of the day, 6.20 p.m., daylight would have started shifting toward evening. Commuters were returning home, apartment parking lots were starting to fill up, crosswalks and driveways and bike lanes and even turning vehicles were all negotiating the same narrow space. An e-bike changes the geometry of childhood. It expands distance and compresses time. It gives a teenager the mobility of an adult without necessarily giving the teenager the defensive habits of an adult driver. Every intersection becomes a small negotiation with visibility and speed and expectation and, of course, reaction time. So Rowan, this driver, was also moving through an ordinary day. Maybe work ran late. Maybe there was a phone call waiting. Maybe dinner was still undecided. Maybe there was nothing dramatic at all before the accident. This point matters because many serious incidents do not begin with dramatic intent. They begin with normal life, then a missed perception, then a bad decision, then a second decision that becomes legally and morally worse than that first bad decision. So the accident is the first event. Leaving the scene of the accident is that second bad decision. So one of the hardest lessons in accident investigation is that causation usually comes in layers. There is a physical cause of impact, and then there is the behavioral cause of the driver's response. And then there is the environmental setting. And then there is a mechanical condition of the vehicle itself. And then there is roadway design. And then there is the human tendency to interpret danger too late and then consequence too slowly. After an accident, investigators build the timeline backward. What was the last known position of the rider? What direction was the vehicle traveling? Where did the impact happen? What damage appears on the vehicle? Does that damage match the height and contact pattern of an e-bike? Does the license plate reader place a vehicle in the area when the crash happened? Do electronic records support or contradict the driver's later account or statement? Which cameras face the street? Which cameras face the parking lot? Which cameras override after 24 hours or 36 hours or 48 hours and so on? The most important evidence is usually perishable. Skid marks eventually fade, debris is swept away, vehicles are repaired, even memory becomes edited by fear. Video is overwritten simply by routine, digital logs expire, and in both crash investigations and cybersecurity incident response, time is not a neutral factor. Time is an accomplice to uncertainty. Now hold that thoughts because four weeks later, Harbour Point had another scene to preserve. On Thursday, March 19, 2026, City Information Tech staff identified ransomware on municipal networks in the early hours of the morning. The city posed public services outside emergency response. Emergency services, including 911 and police dispatch, remained functional. Officials warned that public information may have been accessed, although the extent was uncertain at the time. Residents and anyone who had done business with the city were encouraged to change their passwords and protect their personal data. So, in essence, a city can be injured without smoke and glass and sirens everywhere. In a ransomware event, the crash scene is distributed across servers and endpoints and authentication logs and email systems and backups and firewall records and cloud accounts and vendor connections and the memories of employees who noticed something strange before the incident officially began. The first responders are IT staff, incident response firms, law enforcement partners, city managers, communications teams, and department heads who are trying to keep basic public services moving while the digital town hall is sealed off. The city moved systems offline, phones and email were disrupted, public services became limited, a city council emergency declaration followed. Residents asked reasonable questions. So, what was affected? Which departments were affected? Was payment information exposed? Were permit records exposed? Were recreation accounts exposed? Was utility billing affected? And how long would restoration actually take? So all those questions are not public relations annoyances. They are part of the incident. Every breach creates two clocks. One clock measures technical recovery, and the other clock measures public trust. The second clock, the one measuring public trust, can run longer. So back to that accident involving 15-year-old Miles. The investigation moved from body to bicycle to vehicle to data. In the ransomware incident, the investigation moved from suspicious activity to containment to public notice, then to service restoration. Both investigations required a disciplined answer to the same question. What indicators reveal the truth of what actually happened? And this is where the earlier concept of target indicator becomes useful. So in military fieldcraft, the hidden person is betrayed by what they do or fail to do, the careless movement, the exposed shape, the unnatural reflection, the broken branch, the sound that just does not belong, and then the absence that should not be absent. In a hit and run, the target indicator might be fresh damage on a parked vehicle. It might be a missing mirror cover. It might be paint transfer on the e-bike. It might be a license plate reader hit that places a vehicle near the place the accident happened. It might be a phone record that conflicts with a driver's statement. It might be the absence of a 911 call from the person who should have made a 911 call. In a ransomware incident, the target indicator might be a strange login at an odd hour. It might be a privileged account accessing files that it doesn't normally access. It might be remote access software where it should not be. It might be encryption activity spreading across different files. It might be backups failing before anyone notices the ransom demand. It might be a CT employee who is unable to make or receive calls because the network that supported ordinary work has simply gone dark. A target indicator is not the conclusion. It's the clue that earns attention. And that distinction is very important. Investigators do not get to build a theory first and then bully the facts into obedience. No. They start with facts that survive pressure. In an accident, the point of impact matters. The vehicle's final rest position matters. Damage profiles matter. Witness statements matter, but they are tested against physical evidence. In cyber incident response, a suspicious alert matters, but it is tested against logs, file activity, network flows, authentication records, endpoint telemetry, and known attacker techniques. The goal is not drama, no. The goal is reconstruction. So after 15-year-old Miles was struck, the city did not know everything at once. Officers had the injured teenager, the location, and the initial report. Then they found a suspect vehicle nearby. That vehicle became a moving archive of the accident. The exterior could show damage, the interior could contain digital devices, the vehicle's route could be compared with licensed plate reader data. Electronic records could show timing, movement, communication, or intent. A search warrant could convert suspicion into lawful access. So after the ransomware was found, the city also did not know everything at once. Officials knew ransomware had been identified on city networks. The new services were affected. The new emergency response had to be preserved. The new public information may have been accessed, but they did not immediately know the scope. That uncertainty shaped the public message. The city encouraged precaution while claiming more certainty than it had. And that restraint is worth noticing. A good investigation is not a performance of confidence. It is a disciplined relationship with uncertainty. I'll say that again. A good investigation is not a performance of confidence. It is a disciplined relationship with uncertainty. So there's a temptation after both crashes and cyber attacks to demand instant answers. Who did it? Why did they do it? What exactly was exposed? Who is liable? Which single failure caused the event? The public wants certainty because uncertainty feels like institutional weakness. However, premature certainty can damage the investigation, it can mislead the public, and it can create false lessons. So in the accident at Harbor Point, the available public facts don't tell us every activity in the teenager's day. They don't tell us exactly what Rowan did in the hour before the accident. They don't tell us whether the driver panicked, calculated, froze, or fled for some other reason. The public record gives enough to examine investigative technique, but not enough to pretend omniscience. In the cyber incident, the available public facts don't tell us the initial access method. They don't name a ransomware group. They don't confirm exactly what data was accessed. Some analysts speaking generally about municipal attacks pointed to common paths such as fishing or exposed firewalls. Those are useful possibilities, but possibilities are not findings. This is a core lesson for the Bid Picture Podcast. The analyst's first duty is to preserve the boundary between evidence and imagination. Now let's step into the human layer. Imagine two city employees in the week between the crash investigation and the ransomware emergency. One of them works in permits and one of them works in parks and recreation. They are standing near a counter at City Hall talking over the small frictions of life that usually disappear from public records. You have a cool last name. Thanks. But not for much longer. Oh, you're changing your last name? No, I'm getting a divorce. So that exchange is not about the crash. It's not about ransomware. It's about the background noise of ordinary life. People do not experience civic incidents as case studies. They experience them while getting divorced, raising children, caring for parents, paying bills, applying for permits, registering for recreation programs, and trying to remember whether they changed the password that they reused five years ago. When a city is hit with ransomware, the harm is not limited to servers. The harm is administrative friction multiplied across households. Someone cannot finish a permit application. Someone cannot reach a department by email. Someone cannot register a child for a program. Someone wonders whether payment data, account data, or personal information is safe. Someone waits for the city to explain what it can explain without compromising the investigation. When a teenager is hit on an e-bike, the harm is not limited to an injury line in a police release. A family receives a call, a parent drives to a hospital, a school hears a rumor before an official update. Friends replay the route. A driver's decision to leave the scene becomes part of another family's trauma. Investigative technique can sound sterile until we remember why it exists. The point of collecting debris and logs and records and statements is not bureaucracy. The point is accountability, prevention, and repair. So the accident investigator and the cyber responder share a burden. They are both asked to recover truth from a disturbed scene. One scene has a bicycle and a roadway. The other has servers and accounts. One scene may have paint transfer. The other may have encrypted files. One scene may have license plate reader data. The other may have authentication logs. One scene may require a search warrant for electronic records. The other may require legal coordination before sharing forensic findings. Both scenes punish delay. This is why incident response planning matters before the incident. A city that knows who can shut down systems can contain faster. A police department that knows where to seek video can preserve footage faster. A public agency that knows who communicates with residents can reduce rumor faster. A family that knows what accounts use reused passwords can reduce personal risk faster. A target indicator only helps if someone is trained to notice it and empowered to act on it. So back to military fieldcraft. In sniper training, the observer learns that the obvious target may be a distraction. The real clue may be the unnatural straight line in a natural setting. The reflection that appears for one second, the bird movement that suggests human disturbance, the sound that does not fit the environment. In accident investigations, the obvious feature may be the damaged bicycle, or the decisive clue may be a fragment left in the roadway or a camera angle across the street. In cyber investigations, the obvious feature may be the ransom demand, but the decisive clue may be an authentication event from two days earlier or a backup job that failed quietly before encryption began. Visible disaster is often the last stage of a longer sequence. That is one of the most important lessons from both stories. By the time Miles was on the ground, the collision sequence had already formed. Approach speed, sight lines, reaction time, roadway layout, driver perception, rider movement, and vehicle path had converged. By the time city staff identified ransomware, the intrusion sequence had likely begun earlier. Initial access, privilege escalation, reconnaissance, lateral movement, staging, and encryption may have preceded public disruption. The moment the public sees harm is rarely the moment the incident truly began. Investigators therefore ask backward questions. What had to happen before this? What opportunity existed? What controls failed? What evidence remains? What evidence is missing? What should have happened but did not happen? So that last question, what should have happened but did not happen, is a target indicator question. What someone does can reveal presence. What someone fails to do can reveal presence as well. The driver who leaves the scene creates an absence. The expected action is to stop, render aid, and cooperate. The absence of that action becomes an investigative signal. In cybersecurity, the missing log source can be a signal. The disabled backup can be a signal. The lack of multi-factor authentication on a privileged account can be a signal. The untested incident response plan can be a signal. The silence from a city that cannot yet explain the breach can become a public trust signal, even if the silence is partly required by the investigation. So we can see how absence has evidentiary weight. That does not mean every absence proves guilt. It means absence deserves disciplined attention. A mature investigation resists easy moral theater. In the accident, the driver's departure is serious, but investigators still need evidence. In the ransomware incident, the city's limited communication frustrated residents, but officials also had to avoid disclosing details that could interfere with containment or reveal weaknesses. So good analysis holds accountability and complexity at the same time. The public often wants one villain. Investigators often find a system. In a road incident, the system may include driver behavior, vehicle design, e-bike regulation, road geometry, lighting, intersection visibility, enforcement patterns, and emergency response. In a municipal cyber incident, the system may include staffing, funding, legacy technology, vendor dependence, backup architecture, employee training, endpoint visibility, network segmentation, and crisis communications. This does not erase personal responsibility. It places personal responsibility inside the environment where choices become consequences. So Harbor Point's two incidents are not proven to be connected. There is no public evidence that the e-bike collision and the ransomware attack share actors, motives, systems, or causes. Their value together is analytical. They show two forms of local vulnerability within one municipal timeline, physical mobility risk and digital service risk. One involves a teenager simply moving through city streets. The other involves a city trying to keep services available through digital infrastructure. Both depend on systems that most residents notice only when something fails. The safest road is often invisible because it works. The safest network is often invisible because it works. The most effective public administration is often invisible because it works. So that invisibility creates a political problem. Prevention really photographs well. An accident scene photographs well. A ransomware shutdown makes headlines. A funded maintenance plan, a better crosswalk, a tested backup, a segmented network, a retained log source, a rehearsed communications plan, and a preserved evident workflow often receive far less attention. So that therefore means prevention is quiet until absence exposes it. Okay, so what should my listeners take away from this episode? First, investigation is not the same as explanation. Investigation is the disciplined collection and testing of evidence. Explanation comes later, if the evidence supports it. Second, timelines matter. Build them early. In accidents, preserve the sequence from pre-impact to final rest. In cyber incidents, preserve the sequence from first suspicious activity to containment and recovery. The timeline is the skeleton that prevents the story from collapsing into rumor. Third, perishable evidence must be treated as urgent. Roadway evidence can vanish, video can overwrite, logs can rotate, memory can distort. Early preservation is not merely a technical preference, it can decide whether the truth remains recoverable. Fourth, indicators must be interpreted in context. A target indicator is a clue, not a verdict. A damaged vehicle near the scene matters because it can be compared with physical evidence. A strange login matters because it can be correlated with other logs. A missing action matters because it can be tested against legal duties, normal behavior, and available records. Fifth, public communication is part of incident response. People can tolerate uncertainty better when uncertainty is named clearly. A city does not need to disclose every forensic detail to communicate what is known, what remains unknown, what residents should do, and when the next update is expected. Sixth, small jurisdictions face large risk problems. A city of approximately 33,000 people can still hold sensitive data, run essential services, process payments, issue permits, coordinate emergency response, and maintain systems that residents depend on. Attackers understand that small municipalities may have limited budgets and complex obligations. That makes resilience planning a civic priority rather than a purely technical project. Finally, the target indicator concept teaches humility. The clue that matters may be small. It may be a fragment, a timestamp, a camera angle, a disabled account, a missing call, or a system that went quiet at the wrong time. The work is to notice what changed, preserve what remains, and avoid claiming more than the evidence can carry. In Harbor Points, a teenager's evening ride became an accident investigation. Four weeks later, a city's early morning network alert became a ransomware emergency. The cases don't need to be connected to speak to each other. They both show how modern life leaves traces. They both show how truth can be reconstructed when trained people know where to look. They both show how ordinary systems become visible when they fail. An accident investigator reads the street. A cyber responder reads the network. A good analyst reads the indicators. And when the story is over, the lesson is not simply that bad things happen. The lesson is that evidence survives in fragments and disciplined attention can turn fragments into accountability. Thank you for listening. This has been the Big Picture Podcast. My name is PDM Logude. See you next time.