The Log Nobody Kept: Puebla's Open File, the Chain of Evidence, and an Unfinished Ledger

The Log Nobody Kept: Puebla's Open File, the Chain of Evidence, and an Unfinished Ledger

Hook: An empty room

In September 2026, the Puebla state prosecutor's office released a three-dimensional reconstruction. It is not a trailer. It is security-camera footage from the Centro Integral de Servicios complex, stitched together timestamp by timestamp. In one frame a man walks at a normal pace. Then a timestamp. Then nothing. For hours.

The building Rubén Alberto Curiel Tejeda entered has no record of him leaving. There is no document showing a gunshot was detected. There is no footage of anyone running. There is no immutable log saying who was where before the body was found.

The first document was boring. One entry, a few timestamps, an empty room. That was the point.

Method and limits

I am used to digging through football paperwork — club accounts, transfer contracts, offshore addresses. This case is not football. But documents speak one language everywhere, and that language is time and signature.

What is in this piece: public statements from the Puebla state prosecutor's office, the forensic conclusion, descriptions of the CCTV reconstruction, and reported details of the testimony process, as of 25 September 2026. What is not: the deceased's personal medical history, the names of witnesses, the internal paperwork of the investigative file, and the complex's internal security manual. Where I infer, I say so. Where only a question exists, I have not manufactured an answer.

Context: The office that watched corruption from inside

Rubén Alberto Curiel Tejeda was a known name inside Puebla's justice system. He served as acting head of the Anti-Corruption Prosecutor's Office and at the time of his death was the office's General Legal Coordinator. He was a senior official inside the very structure that investigates corruption cases.

The incident occurred at the CIS complex in Angelópolis, the state government's integrated services centre, where administrative offices, citizen services and security systems operate together. The entire logic of such a complex is control: who enters, who leaves, what happens where, all on an intact record.

Mexico's state-level anti-corruption architecture was assembled in the 2010s under the umbrella of the National Anti-Corruption System, whose core bet was automated declarations, verifiable documents and institutional accountability. The question is why an institution that demands documents from citizens cannot hear a gunshot on its own premises.

The political significance is not small either. Puebla has long been a centre of state-level political friction and administrative reshuffling. In such a setting, the death of a former anti-corruption chief is not merely a legal event. It is an institutional mirror.

Core analysis: Two tracks, one file

The investigation runs on two separate questions, and this is the most important structural fact.

The first question: what was the cause of death. That answer has arrived. Forensic examination confirmed suicide — craniocerebral trauma caused by a self-inflicted firearm wound.

The second question: what were the circumstances. That answer has not arrived. Why no gunshot was detected, why the body went undiscovered for hours, who saw what — all still under investigation.

Keeping those two tracks separate is not weakness; it is procedural honesty. A confirmed cause of death does not erase the file's remaining questions. Prosecutor General Idamis Pastor Betancourt has stated this structure publicly and kept the file open.

Anyone who has handled death paperwork knows the real work is here. The cause is one line. The circumstances are a chain — who was where when, who signed which document, who preserved which footage, who reported first.

This structure has a practical consequence. As long as the file is open, the prosecutor's office must explain its own security arrangements every week. And each explanation creates a new document that can be examined.

The forensic record: Where the chain is strongest

The forensic side is the cleanest part of this case. The cause of death has been established: craniocerebral trauma from a firearm projectile, with a conclusion of suicide.

The weight of a forensic conclusion depends on the chain of custody — who took the sample, where it was stored, who transferred it, who examined it, who signed at each step. The more intact that chain, the more immovable the conclusion. Here, the public record shows no challenge to that chain, which is normal — forensic labs have their own documentation procedures, far stricter than a CCTV corridor.

A comparison emerges. The same institution can announce a cause of death through a defined chain of evidence while being unable to say what happened in its own corridor for hours. The difference is not technology; it is habit. Where there is a duty to keep records, there is an answer. Where there is none, there is inference.

One aspect of the forensic record is under-discussed. The finding of craniocerebral trauma indicates not only cause of death but also the angle, distance and likely position involved in the shot. Those indications help reconstruct the physical layout of the moment — meaning who could have entered the room where the body was found, and when. The forensic document here complements the corridor log; it does not replace it.

CCTV reconstruction: What it shows, what it cannot

The reconstructed footage was released by the Puebla prosecutor's office, and it is the most honest way to understand the investigation's structure. The camera shows a specific path. Then a cut. Then time passes.

The work of reconstruction is to close the gaps — who was where in which frame, at which moment a route changed, where one camera's coverage fails to overlap another's. But what reconstruction cannot provide is sound. Security cameras see. They do not hear. A gunshot is an acoustic event; it leaves no trace in a frame.

This is where the chain of evidence splits into two: the evidence of the eye and the evidence of the ear. The first is partially preserved; the second depends entirely on human memory — who heard it, when they heard it, and what they did after hearing it.

From long habit of verifying documents, I have learned one thing: video evidence is strongest when a parallel log accompanies it. Footage shows who was where. A log shows who reported what. Without one, the other is half a story.

There is a subtler point. The sound environment inside a building depends on wall thickness, door material, closed windows, even running vehicles. So the sentence "the gunshot was not heard" can mean two different things: there was no sound, or there was sound but it did not reach anyone. The difference between those two determines whether this was a procedural gap or human negligence.

Testimony: When memory is the only document

Auxiliary police and security workers from the CIS complex have been called to testify. This matters — it means the institution has not dismissed the matter as "an accident, forget it."

But testimony has a problem: time. Memory decays, and the pattern of decay is not neutral. A person who is afraid develops a conservative memory. A person afraid of losing their job leans toward saying "I heard nothing" — because hearing something means admitting responsibility.

Three questions never fully resolve in memory-based testimony: who knew first, how long after did they know, and what did they do once they knew. If even one of those questions had an automatically preserved log as its answer, the investigation would move much further.

One more thing matters here. The sequence of testimony is itself information. If security workers are questioned first and superiors later, the investigation is climbing from the bottom up. If the order is reversed, administrative responsibility is being verified first. That sequence tells you where the file is heading.

The third person: A name outside the file

A "third person" has been questioned. The prosecutor's office has not disclosed the person's identity or the content of their statement.

This may be a routine witness — someone who was in the complex at the time. It may also mean the file is expanding beyond the security staff. There is only one way to know the difference: later disclosures. What can be said now is this: in an open file, every new name means the scope is widening, not that responsibility is shifting away.

Withholding an identity is not a problem in itself. Publishing a witness's name at the start of an investigation puts that witness at risk. But over time this confidentiality carries a cost: to the public the file looks opaque, and opacity is the best fertiliser for conspiracy.

The structure of protocol failure: Four layers

An effective surveillance system stands on four layers. Failure at each layer is a different kind of failure.

| Layer | What should exist normally | The question raised here | Status | |---|---|---|---| | Sound detection | Sharp sounds registered, time automatically recorded | Why was the gunshot not detected | Unresolved | | Visual surveillance | Intact footage of every entry and exit | Footage partial; reconstruction was required | Partial | | Patrol and checks | Physical inspection at set intervals, written entries | Body undiscovered for hours | Suspected failure | | Escalation | Report and action within a set time after anomaly | Who reported, and when | Unknown |

The table is not an accusation. It is a list of questions. Each row has an empty cell, and filling those cells is now the burden of witnesses' memories.

Spreadsheets do not lie. They wait for the right question. Here the spreadsheet was never built.

Of the four layers, the heaviest is the last — escalation. If the first three fail, the damage stays confined to the incident. But if escalation fails, the incident becomes invisible, and invisible incidents are never investigated. In this case the incident became visible for one reason only: the body was found. Had it not been found, no file would exist today.

The ledger question: Why an immutable log would change everything

This is where the blockchain question enters — not as a political slogan, but as plain document engineering.

What a place like the CIS complex needs is not a currency. It needs a tamper-evident access and incident log: every door opening and closing, every badge scan, every sound-sensor trigger, every written patrol round entry — each with a cryptographic timestamp, and each linked to the one before it.

The mechanism is not new. It is the core idea of a blockchain: every record generates a mathematical hash, and that hash is embedded in the next record. Change a single entry and every subsequent hash changes, exposing the alteration immediately. This is an immutable chain.

Applying the idea to a government compound is far simpler than to a currency. There are no traders, no value, no market. There is only a sequence of events. And preserving a sequence of events is one of the technically easiest tasks available.

Three obstacles remain, and they should be stated honestly.

The first is privacy. If every entry and exit in a government building is preserved immutably, workers' movements fall under permanent surveillance. The solution is tiered access — the existence of a log can be proven, while its content is visible only to authorised investigators.

The second is administrative reluctance. No institution voluntarily installs a system in which its own failures cannot be erased. That reluctance is in fact the strongest evidence that the system is needed.

The third is human. A log only works if someone creates it. If a security worker does not write their round report, no technology can invent it — it can only make the gap visible.

Imagine that log had existed here. The questions now hanging on witnesses' memory would have one-line answers: "The sound sensor triggered at a specific time, the first check entry came minutes later, the escalation report after that." The timeline would no longer be an estimate. It would be arithmetic.

But one thing must be said plainly: a log preserves evidence; it does not perform duty. If someone's job is to pretend not to hear a sound, a perfect log will not catch them — it will simply catch them more clearly. That is the real value of a log: it does not create criminals, it makes denial difficult.

And a fundamental point. Many in this debate treat blockchain as a miracle cure. It is not. Blockchain is a record-keeping system, not a moral position. Technology cannot make an institution tell the truth if it does not want to. Technology only raises the cost of lying.

The contrarian angle: The conspiracy question is easy, the log question is hard

Given Curiel Tejeda's position, an alternative narrative is forming naturally — that an anti-corruption investigator was removed. However clear the forensic conclusion, the job title supplies fuel for suspicion.

I do not chase villains. I chase inconsistencies. And the biggest inconsistency in this case is not buried in a conspiracy; it sits on the top floor: a modern government complex has no automatic trace of a gunshot.

Critics will say this is the normal state of Mexican security infrastructure, nothing new. True. But the word "normal" here is not a comfort, it is an indictment. If hearing nothing is normal, that is the real institutional crisis — because then every compound is effectively undocumented.

The second counter-argument is stronger: blockchain or an immutable log does not cure human failure. If someone does not want to report, technology cannot take their place. Correct. But that argument is not against technology; it is for it — because a failure that is recorded cannot be denied, and a failure that cannot be denied is punishable.

One more thing most people miss. The biggest damage in this case is not political, it is procedural. An open file means the prosecutor's office must explain its own security arrangements indefinitely. Every week of delay erodes trust. The cheapest solution for the institution is the hardest: a fast, complete, paper-backed answer.

There is a third dimension almost nobody raises. The death of a former anti-corruption investigator is not only a family's loss; it is an institutional loss of knowledge. The continuity of cases in his hands, the documentation discipline he built, his network of known witnesses — none of that is transferable. No institution keeps an account of that loss. And what is not accounted for is also a form of loglessness.

Risk map: What to watch over the next six months

| Risk type | What could happen | Likelihood | Impact | |---|---|---|---| | Institutional | Security personnel found negligent | Medium-high | Administrative or criminal sanction | | Procedural | Surveillance protocol gaps remain unaddressed | High | Repeat failures in future | | Reputational | Public trust in Puebla justice erodes | Medium | Long-term institutional damage | | Narrative | Conspiracy theories capture the mainstream | Medium | Investigation credibility questioned | | Political | Case becomes a political instrument | Low-medium | Questions over institutional autonomy |

Of these five, the least discussed but heaviest is the second. Individual punishment follows a deadline — a case ends, a sanction lands or does not, the matter closes. But if protocols are not reformed, the next incident is already waiting. And no one will be prepared for it.

Takeaway: What must be answered before the file closes

Three things to watch in the coming months. First, whether security personnel testimony points to negligence or to a procedural gap — that determines whether sanctions are administrative or criminal. Second, whether the identity and statement of the "third person" are disclosed; disclosure would widen the investigation. Third, whether any announcement of surveillance protocol reform at the CIS complex emerges.

Confirming a cause of death and confirming an institution's accountability are two different tasks. Puebla has done the first. The second is still pending.

If a gunshot registers on no sensor, the question is not about the sensor. The question is how certain we want to be that nothing happened — and whether we are willing to pay for that certainty.

Technical appendix: What an incident log should look like

The structure below is not any government's proposal; it is a document design.

Each entry should carry six fields: time (with a trusted clock source), location (which sector, which device), event type (entry, exit, sensor trigger, patrol report), identity (encrypted ID), decision (whether anyone acted), and the hash of the previous entry.

The last field is the key one, because it builds the chain. Without hashes this is just a database whose every row anyone can edit. With hashes it is testimony.

Retention periods must also be set. Keeping every entry forever is not realistic. A reasonable design: sensitive fields are automatically masked after a set period, while the hash chain remains intact. Five years later, no one can claim an entry was altered.

The most important question is not technical but political: who controls the log. If the log sits with the very institution under investigation, suspicion never fully clears. Independent custody should rest with a separate body. Otherwise we have merely moved the paper register onto a computer and changed nothing.

— Not an ending, but ongoing.