Tildesley thrusts papers over the table at me to show the deliciousness of the scam. I don’t completely understand, but don’t think I need to.
‘But someone, somewhere, once sat down at a computer and created these false profiles, correct?’
‘Correct.’
‘And that computer was physically located in Cardiff, in Swindon or somewhere else?’
‘Cardiff.’
‘You’re sure?’
‘Certain.’ Tildesley starts telling me why. Something to do with the input coding.
‘And presumably any member of the Cardiff store could have got access to those computers? I mean, shop-floor staff probably weren’t meant to play around with the payroll system, but they’d have had physical access to the space.’
‘Yes. But we always talk about three levels of access. Physical, network, finance. Physical access: OK, you have rules and procedures, but you know those things are going to be breached. Shop-floor workers take their lunch break. Chat with a secretary. Look at the internet from an office PC.
‘Level two access – access to the firm’s intranet and systems – that’s password-protected. Passwords change every month and they’re unique to every user. We have a complete log of who signs in when and for how long.’
Sure enough, Tildesley pushes a folder at me: a printout of computer log-ons, sorted by date, running back two years.
‘Level three access – getting to move money around – that’s the biggie.’ Tildesley starts to explain it all. It’s complex in detail, but simple in essence. The Swindon head office regards its individual stores with distaste, the way Marie Antoinette thought of her stablehands. Swindon makes the decisions. The stores get to stack shelves and operate cash tills. Any financial decisions above a thousand pounds require authorization from head office. Not even the Cardiff store manager has standing authority to spend the firm’s cash.
I ask Kevin if the store keeps visitor sign-in books for people who come to the store on business. He tells me that those things are computerized now. He makes a call. A girl with a milky face and a navy dress brings a pile of printouts, still warm from the printer.
I ask Kevin if he has a record of any external consultants who had access to the store over the last two and half years. The answer is no, not exactly, but he can find records of any payments made to consultants in the South Wales region, plus the dates of those payments, plus the invoices. I ask for copies of the lot.
And by the time we’re done, I have been here two hours and have a stack of printouts four inches high. Kevin and the girl with the milky face see me to the lifts, my very own guard of honor.
I say to the girl, ‘I like your dress.’
I don’t particularly. I have no feelings on the subject. But I know women say these things to each other, so I try saying it now and again. The disciplines of Planet Normal.
The girl starts telling me about her dress, while I express interest with just a tint of excitement. The lift comes and I leave.
On the way back to Cardiff, I stop at the Leigh Delamere service station for fuel and lunch. Brie and rocket sandwich. A plastic salad thing, which I buy from some sense of duty. Fruit smoothie. But mostly, I just sit there with my printouts and my laptop. Researching.
Call Kevin. Can he tell me which specific computer the data was entered on?
He can’t, but he’ll speak to the IT people.
I try eating my salad with the plastic fork provided. It bounces off the baby tomatoes, has difficulty with the cucumber, but handles the sweetcorn as easy as
la
.
I call our forensic computer team in Cardiff, the ones who deal with computer frauds and kiddie-porn. Anything really complex is handled by the Hi Tech Crime Unit at SOCA, but our guys are fine with the basics. I ask a few questions, get a few answers.
Find a way of cornering my tomatoes against the plastic wall of the salad bowl and successfully impale them, every last one of them.
Get a call back from Kevin, who has an IT guy with him, another Kevin. Kevin Two starts speaking a language I don’t really understand, even though nearly all of the words seem to be English. Then he gives me what I want: the serial number of the computer from which the fraud was committed.
Phone Dunwoody. I need his permission to do what I want to do next. He squirms. Doesn’t like the responsibility of decision, but knows Jackson has authorized my researches so he doesn’t have much option. Says OK.
I phone our computer people back and ask them to send someone to the store. Say I’ll be there in an hour.
I’m there in a hour and ten. Our guy is already there: Mark Lampley, jeans and a T-shirt, worn under a jacket. He’s drinking tea, not working. I’m about to be pissed off at him, except he pre-empts me. Taps the desktop, says, ‘Trojan horse. Computer is totally compromised.’
I make my IT face at him and he explains further.
‘A Trojan horse is any kind of application which allows a remote user to control a computer. Basically, once the program’s installed it just sits in the background. If someone wants to control it from outside, they can.’
‘How much knowledge do you need to create something like this?’
‘Well, I doubt if the software’s original. This looks like a basic Slavebot app to me.’
‘But you need to be an IT specialist, yes?’
‘Ideally, yes.’
One of Kevin’s invoices showed that Red Dragon Systems, a computer consultancy based down in the Bay, had done work for the store over an eight week period last spring, a period ending about eleven weeks before the payroll fraud began. The Fraud Squad investigation had focused on the period immediately around the fraudulent payroll request itself, so they hadn’t even noticed Red Dragon’s involvement.
The store sign-in data indicates that the firm had three consultants working on the project: Saj Kureishi, Andrew Peters, Colin Cooper.
I look at Mark. He looks at me. Puts his mug down with a bang.
‘Let’s go and arrest some criminals,’ he says.
11.
We arrest no one.
We do go down to Red Dragon Systems. Myself, Lampley, someone from the Fraud Squad, plus a couple of uniforms for good measure. Peters and Cooper are both there, scared at finding themselves surrounded by cops and marched off to Cathays under caution.
But not Kureishi. He went missing in about late June. Hasn’t been in to work. Not responding to messages left at his home address, on his mobile or on his IM accounts.
We start to do the basics, of course. Interview Peters and Cooper. Seize computers from Red Dragon, including the machine that belonged to Kureishi. Start to check personal bank accounts.
We don’t get far. When we start to enter Kureishi’s details on the PNC database, a basic cross-check flags up a case of possible interest. Two weeks ago, Devon and Cornwall police were called to a small rural property which was rented out in the summer months. The owner, there to do a bit of end-of-season DIY, found, along with the wasp nests and the leaf-filled gutter, the body of an Asian man. The corpse was duct-taped to a chair, his hands hacked off. There were no other signs of violence, meaning that the man was left to bleed to death.
I’ve seen the crime scene photos. The man’s brown face has gone a kind of ash grey. His eyes are open and his mouth pulled back in an expression of mild astonishment. It’s as though he saw something, while dying, which caused him a mild, detached, almost philosophical amusement. A last wry chuckle at a fading world.
I know not to read too much into these expressions. They arise not as the result of emotion, but of physiognomy, the body hardening, then softening, into its final shape. But, either way, I like the pictures. Have them printed in full color. Pin them up around my desk.
The pool of blood on the man’s knees, thighs and floor has turned a deep rust brown, like the shadows in a forest of autumn beech.
We check the corpse’s DNA against samples collected from Kureishi’s home and workplace. Also drive Peters and Cooper down to Exeter to confirm the ID. It’s him. What’s more, Kureishi’s work computer contains copies of the Trojan horse software installed at the superstore. The other Red Dragon computers are clean.
The forged ‘Hayley Morgan’ letter received by Social Services matches the paper, envelope, printer and toner ink used by Red Dragon.
Our fraud officers check, very discreetly, some other corporate addresses where Kureishi did consultancy work. They check five computers at which he was known to have worked. All five are infected with the same Trojan horse. Three of those computers are able to access the payroll systems of the companies in which they are located.
These things arouse a flurry of activity. A meeting is held jointly between the Devon and Cornwall Major Crime Unit, the Serious Fraud Office, SOCA and ourselves. We are represented by DI Mick Adams of our Fraud unit, Dennis Jackson and myself.
I’ve never been in one of these things before: big beasts loping around a carcass, figuring out their dominance hierarchy. I’m only here as a little courtesy from Jackson, who recognizes my role in connecting Kureishi to the fraud.
The man from the SFO, a pinched, black-suited man, is the first to fold his hand.
‘The
size
of the fraud is perhaps large enough,’ he says. ‘We’re not really
equipped
to handle frauds of less than a million or so, but this
may
pass muster on that account. On the other hand, we have to
ask
, is this case likely to be of
widespread
public concern? Does it call for our
specialist
knowledge? I have to say, I think we might
prefer
to leave the matter in your, no doubt capable, hands.’
The no doubt capable hands round the table look at the SFO guy in much the same way as they’d study a Bangkok ladyboy in full regalia. Appalled disbelief.
Jackson, taking charge, says, ‘OK.’
‘Our main concern, really, is with the smooth
functioning
of
financial markets
.’
The SFO guy looks set to go on, explaining why the case is beneath him, but Jackson just says again, ‘OK. Thank you for coming,’ and gestures at the door.
The SFO guy halts, looks bemused, then gathers up his papers and leaves.
No one says anything, but no one needs to. If the atmosphere in the room could be distilled down to a single word, that word would begin with a ‘w’ and rhyme with banker.
That leaves us, our West country cousins, and SOCA. The Devon and Cornwall force are represented by a DCI, Jackson’s counterpart, and her gopher. The DCI, Mary Widdicombe, says, ‘This isn’t our fraud, but it is our murder. We also recognize that the murder, almost certainly, arose as a consequence of the fraud. We don’t care how you,’ she makes a gesture that includes the rest of us, ‘investigate the fraud. We just need to know that your inquiry will have the investigation and prosecution of this murder as a central objective. And we will need to have one of our officers seconded to the core investigation team.’
Widdicombe – dark brown hair worn long, blue eyes, but a strong jaw, strong demeanor – holds her gaze steady as she says the last bit, but we all know that her last remarks are aimed at SOCA.
The senior SOCA representative here is a man called Adrian Brattenbury. He seems perfectly sensible, but the agency has strong linkages with the security services and is viewed as more than a little suspect by many police officers. SOCA likes to talk about its ability to ‘disrupt organized crime’ and prides itself on its intelligence-led investigative approach. Which is all good. Organized crime needs to be disrupted and a stupidity-led approach is unlikely to pay dividends. On the other hand, good intelligence tends to become all about the preservation of sources, while any competent police investigation has to end with doors being kicked down and bad guys being led away in handcuffs. For simple coppers, like Jackson, Widdicombe and myself, it’s hard to see how organized crime is being disrupted if we don’t see the heads of major crime organizations being successfully prosecuted in a British courtroom.
But still. Widdicombe hasn’t exactly folded her hand, but she’s taking a pace back from the carcass. That leaves Brattenbury and Jackson still facing off.
‘I’m with Mary,’ says Jackson. ‘Fraud on this scale – not to mention potentially complicated IT issues – that’s not something we particularly want to handle. But we need a prosecution out of this. A Cardiff resident was murdered. The frauds took place here. We need to know that the perpetrators will be brought to justice and in a timely manner.’
Brattenbury has dark curly hair, a bright pink shirt, charcoal pinstripe suit and an air of intelligence, which I like. He says, ‘Yes, of course. Look, our objectives are the same as yours. We want to put criminals behind bars.’
‘We’d need staff on the team. Seconded to you, but reporting to me.’
‘Yes. Yes, we do usually work with local staff. We need to. Our regional offices are very lean. Obviously, on a live case, we have to be very careful about who knows what, we’re very rigorous about protecting our officers, but—’
‘No.’ Jackson isn’t loud, but he doesn’t have to be. ‘No. That phrase, that attitude. It’s a
no
. Mary’s got a murder. I’ve got a fraud at least, maybe a manslaughter as well. If you boys and girls at SOCA want a piece of this, it’s on our terms. And those terms do not include cutting me or Mary out of the loop. We’re not negotiating here. And by the way, Mary and I are detective chief inspectors. We know something about protecting our bloody officers and we’re not about to take lessons from you.’
He looks at Widdicombe, who nods once, briefly.
They both look at Brattenbury, who clears his throat and says, ‘I’m sure we can sort something out.’
Jackson says, ‘We
are
sorting something out. If you need to make a call, the office next door is free.’
Brattenbury heads off with his phone. To me, Jackson says, ‘Fiona, get us some drinks, would you?’
I take orders and go off to fetch coffees. I’m aware that I’m representing the South Wales force and am proud that my coffee-making skills have been called upon. I seek to excel.