The Leaked Clip Was Slide 31. Four People Each Thought They Were First.
A 34-second infrared file carried in 2024 as a whistleblower leak was written by PowerPoint's own media encoder. It sat on an internal portal readable by 1,900 people. The instructor who built it never posted it anywhere.
ARLINGTON, Va. — The file is 34 seconds long, 1.9 megabytes, greyscale, infrared — and PowerPoint wrote it.
Not renamed by PowerPoint. Not opened in it. Encoded by the media exporter that Microsoft ships inside Office, which stamps a container field that no gun-camera recorder in service writes, and which we have since matched in 41 other files exported from the same software build.
It also runs at 29.97 frames per second: thirty, divided by 1.001. Sensor pods of the type this clip has been attributed to record at 30.000 or at 60. They do not carry a 1.001 divisor, because that number exists to keep colour television in step with itself, and they are not televisions.
The clip is slide 31 of a 61-slide deck.
What two examiners were asked
In March we sent the file to Dr. Ottoline Rask-Mbeki in Lisbon with one line of brief: what wrote this. In April we sent the identical file, and the identical line, to Kestrel Vinh-Ambrose, who has never met her.
Neither was told what the clip was said to be. Both came back inside a working day with the same exporter.
"This is the first thing anybody checks," Rask-Mbeki said, and then asked, without any edge in it, why nobody had.
The deck
Sixty-one slides. Sensor-operator training, written under contract in 2022 by Marisol Achterberg-Quaye and delivered eleven times.
Slide 28 opens a section titled Unresolved returns and how to write them up. Slide 31 is the clip, and its caption, verbatim, is: "IR return, unresolved after review. Do not offer an identification in the log. Write what the sensor did."
The purpose of the slide was to teach people not to guess.
The group of 1,900
The deck was uploaded once, to an internal training portal, into a folder that inherited an existing permission group.
The group was called All Sensor Track — Training. At that point it contained about 1,900 people. Nobody chose it for this deck; it was already on the folder, and the folder had been there since 2019.
Over fourteen months the deck was opened 311 times and downloaded 44. Four of those downloads left the building.
The four
They went out over five weeks in early 2024, and the order matters more than anything else in this story.
Hop one, 4 February: into a private group chat of sixty-one people, with no claim about where it came from. Hop two, 11 February: to Duro Kilbride-Mancuso, who passes material to reporters and has done for two decades. Hop three, 26 February: a forum thread, which is where the word leaked first appears in the record. Hop four, 9 March: a re-upload with the frame counter cropped off the top border, which is why the frame rate went unexamined for two years.
Three of the four spoke to us. Each said, separately, without knowing we had asked the others, that he had believed he was the first person outside to hold it.
None of the three describes himself as a whistleblower. Two were surprised to learn the word had been used.
Where the officer came from
The sentence that carried the story — a serving officer, at personal risk — enters the record at hop two.
Kilbride-Mancuso's account, which we have no reason to doubt and no way to check, is that he wrote one line to a newsdesk: this comes from someone serving who does not think he should be sending it. He says both halves were true of the man who sent it to him.
Three days and two rewrites later it was printed as at personal risk, a claim about consequences that he says he never made. His reply is printed in full below and he does not spare us in it.
By 21 March three outlets had run the clip. All three attributed it to a serving officer. None of the three had spoken to one.
The person who lost the job
Marisol Achterberg-Quaye built the deck, delivered it eleven times, and posted it nowhere. She was not among the 44 downloads; she had no reason to be, since she wrote it.
A review board sat in May 2024. Her contract was not renewed in June. The service's public affairs office confirms the deck's provenance and the log figures and will not discuss any individual's employment.
She has not worked since. She spent our second interview correcting our description of her own slides, which she was still able to recite from memory.
What this desk takes from it
There is no suppression here to uncover. There is a folder that inherited a permission group nobody looked at, four people who could not see each other, and one honest sentence that hardened into a false one on its way through a newsroom.
What we still cannot tell you is what is in the 34 seconds. The service's own teaching material says it is unresolved. So do we.
The six o'clock edition
Three stories a morning, in your inbox before the coffee is made.
Sources & Method
We stopped trying to find the officer and started reading the file. The clip was sent to two examiners who do not know each other, with no context and a one-line brief; both returned the same encoder identification. Only then did we approach the four people the download log pointed at, and we approached them in the order the log gave, not the order the story did.
Who we spoke to
- Marisol Achterberg-Quaye, Contract instructor; built the training deck. Interviewed by video call twice, and once in person May and July 2026 Has not worked since June 2024. Reviewed the passages describing her deck before publication and corrected two of them.
- Duro Kilbride-Mancuso, The press contact at hop two. Telephone interview of 51 minutes; then a written statement, printed in full 6 and 11 August 2026 Disputes the word 'invented' and explains at length why. His reply is the best argument against this story.
- Dr. Ottoline Rask-Mbeki, Video forensics, Lisbon. Given the file with no context and no question beyond 'what wrote this' March 2026 Returned the encoder identification in under a working day and called it 'the first thing anybody checks'.
- Kestrel Vinh-Ambrose, Second examiner; no contact with the first. Given the identical file and the identical one-line brief April 2026 Same identification. Also found the 1.001 divisor, which the first examination had not flagged.
- The deck, and the portal access log, 61 slides; 14 months of access records, summarised. The deck came to us separately from two of the four onward recipients; the log figures were read to our reporter, then confirmed in writing by the service's public affairs office February–June 2026 We did not download anything from the portal and have never had access to it.
What we could not confirm
- What the 34 seconds shows. Our finding concerns the file, not the object in it. We have not established the sensor, the platform, the date, the location, or the identity of the return, and the deck's own caption declines to as well.
- That there were exactly four onward posts. Four is what the download log supports and what three of the four confirmed. A log records downloads, not what happened afterwards; somebody could have filmed a screen and we would never see it.
- Whether the permission group was set wrongly or set deliberately. We put the question to three people who could have set it. Two say they did not, one did not answer, and the portal's change history for that year no longer exists.
How Others Covered This
The same events, as reported elsewhere on the same day. We list what each outlet had that we did not, as well as what we had that they did not — including where we come off worse. Why we print this.
-
The Meridian TelegraphOfficer Risks Career To Put Infrared Footage In The Public Domain
Ran the clip as an act of conscience by a named-but-unnamed serving member.
Had that we did not
The full 34 seconds, uncropped, which is more than anybody else published.
Left out
That its own source had never met the officer, and could not say what unit, rank, or service the officer belonged to.
-
Signal & LedgerEncoder Signatures In Two Widely Circulated Sensor Clips
A trade piece on container metadata that identified the exporting software eleven days after the clip broke.
Had that we did not
The finding this newspaper spent five months arriving at independently.
Left out
Any suggestion that it mattered. The piece never mentions the coverage, and nobody outside the codec trade read it.
-
They Buriedthis newspaperThe Leaked Clip Was Slide 31. Four People Each Thought They Were First.
Traced the file rather than the story: two independent examinations of the container, then the portal log, then the four.
Had that we did not
The access log, the deck's own caption, and the press contact's unedited reply.
Left out
We took five months to run a check that a trade publication ran in eleven days and published in the open. We did not find it because we do not read that publication. — V. Ashcombe-Doyle, standards editor
Right of Reply
They Buried contacted Duro Kilbride-Mancuso, the press contact at hop two on 4 August 2026, by telephone and then in writing, with the relevant passages quoted to him in full and fourteen days to reply. Replied 11 August 2026. Printed entire and unedited, including the parts about this newspaper.
Your reporter used the word 'invented'. I want to say precisely what I did, because it is worse than nothing and better than that.
A man I have known for nine years sent me the file. He was serving. He was plainly uneasy about sending it — he said so twice in the same message and asked me not to say where it came from. I believed then and believe now that both of those things were true.
What I wrote to a newsdesk was one sentence: this comes from someone serving who does not think he should be sending it. That sentence is accurate. Every word of it is accurate. I did not know, and had no way of knowing, that the file had already been through a group chat of sixty-one people, or that it had been sitting on a portal that nineteen hundred people could open. Neither did he. He thought he was first. Your own reporting says three of them thought they were first, which ought to tell you something about how little anybody in this chain could see.
Here is the part I accept. A sentence written to a newsdesk is not a sentence. It is a raw material. Mine went in as a description of a man's state of mind and came out, three days and two rewrites later, as 'at personal risk' — a claim about consequences that I never made and that nobody checked with me. I have watched that happen to my own words for twenty years and I should have written it in a form that could not be hardened. That is a real failure and it is mine.
But I would ask your readers to notice what your newspaper has done here. You spent five months establishing that a video file was exported by Microsoft Office. Congratulations. It changes nothing about the thirty-four seconds, which remain unidentified in the service's own teaching material, by the service's own admission, in a slide whose entire purpose is to tell operators that some returns cannot be resolved. You have proved that a training aid travelled through a training portal. You have not touched the question anybody actually has.
And you have made me the story. Ms. Achterberg-Quaye lost her contract because a review board decided somebody had to have lost it. I did not sit on that board. Neither did the four. You have eleven paragraphs on how a file moved and four sentences on the only person in this who was punished. If your standards editor is looking for something to write under, she can have that one.
Published unedited under our right-of-reply guarantee.
How was this story?
We publish the result, whatever it is. Reader verdicts appear on the front page and in our newsroom metrics.
Readers' Letters 0
Printed at once under the name you give and read by the desk afterwards; anything unfit is removed, with a note saying so, and nothing else is ever deleted — only corrected. Letters that changed something in the story carry a mark saying so, and there are 5 of those across the archive.