The Fifth to Die
Page 19
“I’m looking at the code behind the Examiner’s web form. Their system captures information the user cannot see. Their operating system, IP address . . . a few other data points,” Kloz said, his eyes scanning the text rolling across his screen.
“The woman I spoke to at the Examiner sent me a file of all the submissions in the past thirty days. It should be in your inbox,” Clair told him.
“Got it, reviewing the data now too.”
Nash studied the false obituary for Randal Davies. “If this ran four days ago, that puts it before Lili Davies disappeared.”
Clair nodded.
“So who was the real intended victim? The father or the daughter?”
Clair had spent the past hour puzzling over that exact question, and she didn’t have an answer. “I think he’s going after both but for different reasons. He’s drowning the daughters, over and over again. That was consistent with both girls. He takes his time, revives them, and repeats until their bodies finally give out—weeks for Ella Reynolds, days for Lili Davies. With the fathers, he killed them in completely different ways, and he killed them fast, almost like an afterthought.”
“Not an afterthought, not if he’s planting the obituaries,” Nash said.
“Okay, not an afterthought. More of a statement,” Clair said. “What he’s doing to the girls, the drowning, that serves some kind of purpose for him.”
“Like he’s trying to learn something.”
“Like he’s trying to learn something,” Clair agreed.
“So his focus is the girls, and the fathers are some kind of smokescreen?”
Clair pressed her fingers to her temples. “No, they’re more than that. I’m not sure why, not yet.”
“Fathers, daughters . . . this is beginning to sound a lot like 4MK,” Nash pointed out.
“Drowning doesn’t fit, and Bishop made it a point to not kill the parents. He felt they suffered more alive after the loss of their child.”
“Maybe he evolved, or devolved.”
“Why would Bishop change his MO?”
“I found the records,” Kloz interrupted. “In all three cases, the IP addresses originated at the homes of the victims. That means the obituaries were either sent from each home or made to look that way.”
“Can something like that be faked?”
Kloz touched a finger to the top of his laptop screen, thinking. “It would be tricky. You can’t really fake the incoming IP on a form. The string is captured after the data leaves the host machine.”
Clair launched a pen at him. He hadn’t seen her pick one up. She was getting fast. The pen bounced off Klozowski’s shoulder and fell to the floor beneath his desk.
“Hey! I don’t mind you throwing things at Nash, but I gotta draw a line when you try to hit me,” Kloz said.
“Keep it in English, and you can avoid the hurt.”
Kloz crouched down, putting the laptop screen between him and Clair. “To send the message with their IP address, the request would have to originate within their house, from their router. There are a few ways to do this.” He ticked them off on his fingers. “One, hack into their computer from a remote location. This is fairly difficult. The unsub would need to gain access by sending them malware to open a backdoor or finding a hole in their OS. If they don’t update their OS on the regular, this gets easier, but it’s still a crapshoot because you wouldn’t know if and how you can get in until you try—risky. Two, hack the family’s Wi-Fi. This is a bit easier. It can be done from the street outside their home and only requires a few tools anyone can download off the web.”
“Getting so close sounds dangerous too,” Nash pointed out.
“He’s sending these messages before he’s taken or hurt anyone. Nobody would be watching for him. He could be in and out in a few minutes, particularly if the family doesn’t update the firmware on their router.”
“Nobody updates their firmware. We learned that at that Starbucks.”
“Exactly.” Kloz nodded. “There’s also the newspaper itself. That would be option number three. The unsub would need to place the ads via the web form, then hack the data stored on the newspaper’s servers. Once he got in, he’d have to change the IP addresses. This would be the most difficult. If it were me, I’d go after the Wi-Fi.”
“Would that leave some kind of footprint? Like what you found at Starbucks?” Nash asked.
Again, Kloz nodded. “The newspaper didn’t capture Mac addresses in their data, but the routers at each location would. I just need access.”
“Would you need to go inside their houses?” Clair asked. “With all they’re going through . . .”
“I could do it from the street, same as the unsub. No need to disturb the families.”
Nash said, “The list the newspaper sent over of all the submitted obituaries, can we run the names? Look for obits on people without a death certificate on file? Maybe we’ll get lucky and find his next target before he hits.”
“It will be tricky without social security numbers or something concrete to rule people out, but I can give it a shot,” Kloz said.
Clair read over the assignments on the whiteboard. “Any luck putting together a list of saltwater swimming pools around the area?”
“If I tell you yes, will you promise to stop throwing things at me?” Kloz said.
“No.”
“You’re an evil woman,” Kloz said. “File sent. You should see it in your inbox. We can rule out saltwater swimming pools. The water Eisley found in the girls’ lungs had too high a salt content. Pools are kept around three thousand parts per million, and the water we’re looking for is around thirty-five thousand, on par with ocean water. That in mind, I found eighteen aquatic stores selling saltwater fish and supplies. I sent you that list too.”
Clair stood up from her desk and updated the board. “Okay, I’ll check those first thing. The two of you do a drive-by at the victims’ houses and get what you need from their routers. Then we’ll touch base.”
“Sam would make me get a warrant for the router data,” Kloz said.
Clair leveled another pen, ready to throw. “I’m gonna pretend you didn’t say that out loud.”
* * *
Evidence Board
ella reynolds (15 years old)
Reported missing 1/22
Found 2/12 in Jackson Park Lagoon
Water frozen since 1/2—(20 days before she went missing)
Last seen—getting off her bus at Logan Square (2 blocks from home/15 miles from Jackson Park)
Last seen wearing a black coat
Drowned in salt water (found in fresh water)
Found in Lili Davies’s clothes
Four-minute walk from bus to home
Frequented Starbucks on Kedzie. Seven-minute walk to home.
lili davies (17 years old)
Parents = Dr. Randal Davies and Grace Davies
Best friend = Gabrielle Deegan
Attends Wilcox Academy (private) did not attend classes on 2/12
Last seen leaving for school (walking) morning of 2/12 @ 7:15 wearing a Perro red nylon diamond-quilted hooded parka, white hat, white gloves, dark jeans, and pink tennis shoes (all found on Ella Reynolds)
Most likely taken morning of 2/12 (on way to school)
Small window = 35 minutes (Left for school 7:15 a.m., Classes start 7:50 a.m.)
School only four blocks from home
Not reported missing until after midnight (morning of 2/13)
Parents thought she went to work (art gallery) right after school (she didn’t do either)
Found in Ella Reynolds’s clothing
Drowned and resuscitated multiple times—salt water
floyd reynolds
Wife: Leeann Reynolds
Insurance sales—works for UniMed America Healthcare
No debt? Per wife. Hosman checking
Strangled with thin wire (piano?) outside of own home (in car)
Body hidden in snowman
Fathe
r of Ella Reynolds
randal davies
Doctor, John H. Stroger, Jr. Hospital
Father to Lili Davies
Wife = Grace Davies
Overdosed—lisinopril (blood pressure medication)
unsub
■ Possibly driving a gray pickup towing a water tank: 2011 Toyota Tundra
■ May work with swimming pools (cleaning or servicing)
■ Size 11 work boot print found—back of driver’s seat, Reynolds car (Lexus LS). Used for leverage?
assignments:
■ Starbucks footage (1-day cycle?)—Kloz
■ Ella’s computer, phone, e-mail—Kloz
■ Lili’s social media, phone records, e-mail (phone and PC MIA)—Kloz
■ Enhance image of possible unsub entering park—Kloz
■ Park camera loosened? Check old footage—Kloz
■ Get make and model of truck from video?—Kloz
■ Clair and Sophie walk Lili’s route to school / talk to Gabrielle Deegan
■ Clair and Sophie visit gallery (manager = Ms. Edwins)
■ Put together a list of saltwater pools around Chicago via permits office—Kloz—Clair to visit
■ Check out local aquariums and aquarium supply houses—Clair
■ Hosman to check debt on the Reynoldses
* * *
43
Poole
Day 3 • 9:23 a.m.
Poole stood in the center of the room loaned to them at Chicago Metro headquarters and stared at the wall.
Agents from the Chicago field office had spent the night recreating the wall of data from Porter’s apartment here, using photographs taken from the scene.
Detective Porter had been extremely thorough. It didn’t take long for Poole to determine the meaning of each colored thumbtack. Red represented a sighting of Bishop, blue for the location of the reporter or local media outlet reporting the story, and yellow for the home of anyone who went missing or murdered with a method similar to those used by 4MK.
There was a yellow thumbtack at Jackson Park, where the body of Ella Reynolds was found. Porter insisted Bishop had nothing to do with her disappearance or death, yet he’d felt the need to mark it on his map, then tried to remove the marker. Poole found this interesting. He was aware of at least three other homicides in the Chicago area over the past two months that had not been flagged on Porter’s map, so why Ella Reynolds?
There was no thumbtack for Lili Davies. There was a good chance Porter had fully intended to put one up and never had the chance.
Poole hadn’t seen his own apartment in nearly two days. He knew Porter’s wife died recently. The detective might not have been home between the time of the disappearance and the FBI seizing the data.
But still.
He walked over to the new whiteboard, commandeered from somewhere else in the building. He didn’t ask where. In the top left corner, he wrote the name LIBBY MCINLEY, added her mug shot, numerous photos from the crime scene at her home, and his notes.
Bound to bed.
Toes and fingers removed.
Ear, eyes, and tongue removed.
Numerous cuts—torture.
Revenge.
Fake identification (license/passport, name of Kalyn Selke)
.45
They ran the name, Kalyn Selke, and learned she was a seven-year-old child killed twenty-four years ago in Woodstock, Illinois. If she had lived, she’d be only one month younger than Libby McInley. The various forms of identification they found weren’t fake, they were real government documents. This means McInley somehow obtained a copy of Selke’s birth certificate and social security card and used them to obtain a passport, then used these three documents to apply for and receive a driver’s license in the false name. This was a time-consuming process but one she could have easily learned while in prison. He supposed she may have even worked on this from behind bars, but she would have needed help. She had access to computers and the Internet, so the research would have been possible, but someone on the outside would have had to write the letters and mail them.
Beneath the information on Libby McInley, the final item listed was the lock of blond hair. He drew an arrow from the text to a photograph of the hair that was taped at the top of the next column. He had hoped CSI would find DNA attached to one of the strands, but that was not the case. The neat band of hair had been clipped from the owner’s head, not torn. There was no identifying information. An analysis of the hair told them the owner was a habitual smoker of both tobacco and marijuana. This person had also been taking Xanax, a very common anxiety medication, at the time of this particular hair growth. They could not tell whether the hair came from a male or female. The lab estimated the age of the hair to be around twenty years. They were quick to point out that this meant the hair sample itself was twenty years old. They had no way to determine the age of the person from which it came. It was cut from someone’s scalp approximately fifteen to twenty years ago, they said. The two black bands holding the hair together on either end were common elastics manufactured by a company called Goody, available in nearly every drug and grocery store.
“Where do you want this?”
Poole turned to find Diener holding a large white file box—the box of paperwork discovered by Detectives Nash and Norton at the apartment on La Salle, staged by Bishop four months ago. “Set it on the table there.”
Diener dropped the box with a heavy thunk. “Everything here has been indexed and imaged. You can see it on your tablet. What do you need the originals for?”
“Scrolling through pictures doesn’t work for me. I need something tactile.”
“Yeah, well, you better do it fast. Hurless said you’re wasting your time digging through this. He wants us to talk to McInley’s neighbors and her parole officer.”
“Why don’t you do that?”
“Yeah?”
Poole nodded. “Start with the uniforms. They already spoke to most of the neighbors. Revisit the few surrounding her house. I placed a call to her parole officer. As soon as I can secure an appointment, I’ll call you and we can meet there.”
Diener hated to be cooped up in the office, and Poole knew he’d bite at the chance to get out in the field, even in this weather. Poole also knew talking to the neighbors wouldn’t go anywhere. He didn’t care. He just wanted Diener out of his hair.
Diener made a beeline for the door, grabbing his coat off one of the chairs. “Hurless will probably be back from the field office in an hour. You’ll want to be out of here before he shows up.”
Poole gave him another quick nod and returned to the box. He wasn’t worried about Hurless.
He began removing the bound stacks of papers and placing them on the table in neat rows.
44
Porter
Day 3 • 9:33 a.m.
“I gotta tell you, for a man on vacation, you’re doing it all wrong,” Hershel Chrisman said from the front seat of the taxicab. “Most tourists don’t set foot in this part of town, and when they do, they go running back out. Better to mess with the juju priestesses and peddlers around the strip than the gangbangers around here. People are so poor around these parts, they eat their cereal with a fork to save on milk. They gotta take the bus to do a drive-by.”
Porter smiled for the first time in two days. At first glance, the area didn’t look so bad. They were parked in front of a series of shotgun homes that had been converted into businesses along South Broad Avenue, some of the same kinds of businesses he’d find on California Avenue back in Chicago near Cook County Prison—bail-bond offices, lawyers, check-cashing stores. In Chicago those places had graffiti on the walls and bars on the windows. Here each office masked the ugliness behind a bit of New Orleans charm—brightly colored paints, ornate architectural design; the bail-bond office next door even had a porch with two wicker chairs placed around a knee-high table ready for morning lemonade. They were parked at a white and green converted shotgun house with a small pla
que on the door that read SARAH WERNER, ATTORNEY AT LAW.
“Might be a while,” Hershel said.
“I don’t mind waiting.”
He shrugged. “Your dime. What did you think of Traveler’s Best?”
The night before, Porter hadn’t been able to decide what would be worse—sleeping under the sheets in the bed at his hotel or sleeping on top of them. The last time a cleaning crew passed through that room, Reagan was probably president. He spent the night in a straight-back wooden chair with his feet up on the desk—best to stay off the floor. “It was wonderful, a slice of home.”