by Jack Davis
The response came within the hour. Antonescu had not been on leave during the dates in question, and the records indicated he used remote access exclusively during that time. He confirmed that based upon Antonescu’s abilities and work requirements, he might have been able to do his job remotely, which it appeared he did, during the dates given. The CISO stated it was not unusual for technicians to use remote access occasionally when they were in the field. He said it was normal when they were handling problems or updating the network. He was not aware of any such upgrades during the dates Greere had provided.
The CISO said normally the trouble-shooting trips took a day or two, but never ten straight days as Antonescu’s records indicated. He said just to be sure, the agents should ask Antonescu’s supervisor, Craig Lublin.
With regard to Greere’s second question, the Blairs being in the database, they were not. The CISO paused before he relayed the next piece of information. A review of the backup files showed the Blairs had been removed from the database the week after the dates Greere had provide.
For Morley the pieces of corroborating evidence were all he needed to contact AUSA Carpenter and ask for an expansion of the search to include any physical evidence pertaining to the murders. Carpenter listened to the agent explain that the suspect had the Western Union account number on his machine, used the World of Warcraft account, and had the hacking program on the computer. The tie-in between the account usage and the murders could be shown, and the hacking program had been found on the victims’ computers. It was enough for Carpenter to authorize the agents to expand their search. Morley finished by advising Carpenter the Bureau had been briefed.
Pencala, Solid Police Work (10/18-19/09)
Kay Pencala was the daughter of a police sergeant from Milwaukee. She’d learned from her dad how to tackle tough cases. She loved them and dove into the travel portion of the investigation with her characteristic zeal.
Taking what was known and what was believed, she started with the premise that the killer had to travel to commit his crimes. She tackled the mode of transportation the killer used. Rank ordering the options, she attacked them in sequence: aircraft, automobile, train, and bus a distant fourth.
The coroners’ reports specified all three sets of victims died in the morning pointing to an airline, train, or bus scenario. Pencala felt if the killer were driving, it wouldn’t matter when the murders took place. If he killed the couple at midnight, he could start driving right then. She believed the fact they all occurred in the morning meant the killer was leaving himself time to catch a flight/train/bus.
Peyton’s profile had indicated the killer would probably have a full-time job, and while the distance between the first two known killings was not great, driving would add a significant amount of time to an already lengthy process. If the killer had a job, driving both ways would add at least two days to the trip and maybe more. That assumption moved her to seventy-thirty in favor of the air travel scenario.
Based on the air travel premise, Pencala felt the departure dates provided a much more limited scope than the arrival dates. While the arrival could have been anywhere up to ten or more days ahead of the killings, the departure would be the day of the killing or the following day. Looking for flight information for two days was much more manageable than looking for the arrival dates. Considering the killer selected locations where the bodies would not be found for days, she decided to initially focus on a scenario where the killer left the day of the murder.
Looking more closely at the three cases and the information available, Pencala believed the Virginia case was too old to reasonably retrieve any evidence. The Savannah and Cleveland cases, on the other hand, were ripe enough to bear fruit.
In the police files, Pencala didn’t find any indication the investigating agencies had put a great deal of time into the traveling aspects of the cases. There were jurisdictional issues and no clear sign to the detectives their killing was anything other than an isolated local incident. It was only the newly found association between the different murders that brought the traveling aspect into play.
Pencala focused on the Savannah case since the airport was smaller. There were few departing flights that could fit the killer’s schedule if he traveled out the same day. Considering he needed time to clean himself up, get to the airport, maybe return a rental car, and be there an hour ahead of the scheduled flight time, the number of outbound flights the day of the murder was limited. More important was the number of airlines, which was smaller still.
Knowing the killer would not be using his own name or credit card to pay for the flight, she contacted the fraud and loss prevention sections for the three carriers that had flights out of Savannah the evening of the murder. She asked them to check to see if any tickets with that departure date, after noon, and that had been purchased using a stolen credit card. There was one, and only one. An individual had flown to New York’s LaGuardia Airport on a three p.m. Delta flight under the name of Dr. Peter Dalton. The airlines had determined the true card holder was a sophomore at the University of North Carolina at Chapel Hill and was not involved. Delta was also able to provide Pencala the arrival flight for Dr. Dalton. It had been ten days earlier, also out of NYC. The tickets had been purchased online, but there was no information on the email account.
Next Pencala contacted the fraud department at Visa. They were able to show the real card holder had disputed the purchase of a disposable cell phone from a local Savannah mall kiosk, an Avis car rental, a round trip ticket to Savannah from New York, and an answering service monthly fee.
The cell phone was also a dead end. Besides two calls to and from the victim’s number, it only had a call to the answering service in Dallas. Contact with the answering service revealed the account was set up to handle calls for a Dr. Dalton when he was away from his office. They had taken the information for the application over the phone, along with the fraudulent credit card number.
It was only after Pencala received and reviewed a faxed copy of the application from the answering service and checked on the address that a big piece of the eventual puzzle fell into place. The address was the Savannah Hyatt.
She contacted corporate security for Hyatt and asked them to check to see if they had a Doctor Peter Dalton staying at their Savannah location during a certain date range. The verbal confirmation took less than an hour. Doctor Dalton had stayed at the hotel. He’d paid in cash and checked out the day of the murder.
Pencala called Morley with the news around 1430 hours on Sunday. Morley in turn called the SAIC of the Savannah office. Agents were at the hotel within forty-five minutes conducting interviews. Between the front desk clerk who checked Dalton in, the housekeeping staff, and the room service personnel, strangely enough they were unable to get an accurate description of the individual. It seemed the good doctor had worn a white surgical mask over his face, explaining he was very susceptible to germs and had to wear the mask when in public. The agents obtained the original check-in form as evidence. It was sent via courier to the Forensic Services Division (FSD) for analysis.
The front desk clerk said the doctor didn’t know the license plate of his rental, and had just written, blue two-door Chevy on the form. With that information the Savannah agents had followed up with Hertz and confirmed the rental. They weren’t able to make any further progress other than a confirmation of the physical description, including the surgical mask, of the cardholder. The rental agreement was seized and sent to FSD.
The last thing the Savannah agents did was have TSA make a copy of their tapes for the dates of the killer’s arrival and departure. The agents reviewed the tapes searching for the individual posing as Dr. Dalton. After running through the video for the third time without success, the confused agents went back and took it frame by frame. They discovered a two-minute gap in the tape.
Once Pencala handed off the Savannah case to the Georgia agents, she started looking at Cleveland. Using the same premise and process she called
the airlines looking for a ticket purchased via a stolen credit card. As with Savannah the case opened up like an oyster. This one also had a pearl inside.
As Pencala dug, it appeared that again the credit card used, resolved back to a college student who had no apparent association to Cleveland or the victims. The cell phone purchased was again from a local mall where no one remembered anything about the individual who bought it. The answering service was hired a week prior to the murders and couldn’t provide any information regarding the cardholder other than what was on the online form. It indicated Dr. Gerald Peters lived and worked in the Cleveland area, and gave the credit card number to pay the first month’s bill.
Pencala used the same method to trace back the hotel, rental car, answering service, cell phone, and credit cards. By the time she was done, agents from the Cleveland Office had obtained a hotel check-in form, rental car receipt, and TSA video. All would be analyzed and compared to the Savannah evidence.
59 | Peyton Profile, Part Two
Johnson City, New York, 10/18/09, 1412 hours
Morley had just received Pencala’s first update when his cell buzzed.
“Morley.”
“PJ, it’s Ron.”
“Hey buddy, what’s up?”
“Based on the new information you provided, I’ve been digging deeper into the case. I called Sophia over at the Bureau to get her input too. And don’t worry, I swore her to secrecy, she’s not gonna tell anyone there.”
“If you trust her, I trust her. Anyway, I read-in my New York counterpart. He’s checking their databases and cases on the QT; the Bureau is in the loop.”
“Cool. Sophia and I took a first pass. We’ll do a more in-depth analysis, but that’ll take a few days. In the meantime, there are a few points worth considering.”
Before Peyton could continue, Morley said something he had wanted to say for years. “Analysis, Mr. Spock?”
Peyton paused. “It took every ounce of self-control I have not to hang up on you. I also want you to know I have lost the little remaining self-respect I had for you, but in the best interest of the Service, I’ll continue.”
“C’mon, that was funny.”
“PJ sometimes I wonder how you passed the background process. If you don’t mind, can we get back to the serial killer?”
“Go ahead.”
“The killer or killers are traveling. That needs to be run-to-ground.”
“Kay’s working that angle. She’s sent me a report. I’ll look it over and forward it.”
“Good. You might want to let her know that per the Bureau, eighty percent of people who travel using an assumed identity spend significantly more than they would normally. Sophia said psychologically, people in general were much more frugal when they were paying for something with their own money, but when they’re using someone else’s they can party like a rock star.
“Statistically Kay should focus on higher-end hotels, restaurants, car rentals, etc.”
“Interesting, makes sense. I’ll let her know.”
“Sophia said normally the criminals won’t go complete high-end, because it attracts too much attention. Of course, the free spending poses another problem. It’s consistent with a criminal who has been doing this for a while.
“Initially our killer…”
Morley noted how Peyton referred to the murderer as “our killer,” it brought home just how invested personnel were becoming in the case.
“…would stay within a comfort zone. His personality would be much like it is where he lives. If he’s a McDonald’s eater at home, he’d probably eat at Mickey D’s on the road. If he stays at the Days Inn, that’s where he’d stay when traveling to commit the murders, in the beginning.
“Over time as our chameleon becomes more comfortable with his new persona and lifestyle he’d start to branch out and enjoy himself. He might as well, it’s someone else’s dime.”
“Ron, while you might think it’s just human nature, from what I know about the murders, there is very little human about the person we’re hunting.”
“Point taken. From what Sophia says, and she’s one of the Bureau’s best profilers, if our boy is living in society, he is playing by most of societies rules. If not, he’d stand out too much and have gotten caught by now.”
“I guess so.”
“Sophia and I feel that in conjunction with branching out, there’s a better chance of the killer getting sloppy and making mistakes. The sloppiness would be borne from a combination of human nature and arrogance. In the killer’s mind, the fact he hasn’t gotten caught confirms he’s doing things right. He has consistently outsmarted LE. Some of his security measures may eventually seem unnecessary.
“Based on this assumption, we think you should look for any differences between some of the crimes in the beginning, middle, or end of the pattern, if they can determine those stages.”
Morley sighed. “At this point we only have three cases to work with.”
Peyton went deeper into the profile. “Our killer is doing this for a reason, which at this time we can only guess at. More on that later. Even without the motive, the killer, especially after the murders, would most likely feel either a deep sense of accomplishment or shame. If it’s the latter, he’d, beat himself up, at least mentally and possibly physically. If it’s the former, it might bring about a sense of wellbeing, which could lead to complacency or a reward.
“Again, I can’t stress the human nature aspect of it enough. It’s like letting off on the gas at the end of a race you’ve won. With that in mind you might be better served looking for clues in what our guy did after the crime more so than in preparation. Of course, any carelessness would disappear if something spooks him.”
“Great, so you’re telling me if anyone has gotten close to him, he may have changed his MO?”
“Actually, PJ, even though overall it’s a negative, you may be able to use it to your advantage. If you can come up with any patterns in the crimes, then you can look for any breaks. A lapse could indicate he did something wrong and thought he was in danger. He decided to lay low for a while. Then focus on the crime preceding the break. It’s a long shot, but worth consideration.
“Sorry for jumping around, but back to the beginning of the spree. The first few times the killer would be feeling his way, finding what worked and as importantly what didn’t. What he liked, what he didn’t, what turned him on, et cetera? After a few murders, he would develop a style or pattern he would continue to use for a long time. Until there was a reason to change it.
“Have your folks looked for things the killer did in the first or second murders that he didn’t do later on. If they could identify those changes, they should try to determine the cause.”
“Sophia mentioned a case she worked with the GBI where the first couple of murders occurred within a small geographic area. After the second murder, the killer expanded his territory. When he was finally caught, they found out he was a salesman. Just before his third killing, he’d been promoted and given a larger road district.
“We think MichaelTAA stands for Michael the Archangel. If that’s the case, he’s probably Christian. This gives us a couple branches of the logic tree to follow. You can eliminate certain time frames for the crimes, and probably even the prep for the crimes. We don’t see him doing anything right around Christmas or Easter for example.
“If we’re right on Michael the Archangel, our killer feels he’s doing God’s will. Or at the very least, something that isn’t displeasing to God.”
Morley, a Catholic, listened as Peyton explained what he already knew. St. Michael was considered his faith’s chief opponent of evil. He had seen all the symbols of the saint, wielding a sword and shield while stepping on the neck of a dragon that represented Satan.
“Ron, we’ve been working on a theory I’d like to run past you. We’ve traced MichaelTAA’s programs back to dozens of porn websites. They all fall into one of three categories: 1) Wife or Swinger, 2) College Gi
rls, or 3) General. First, I think we can agree that since he’s necked it down to three in the whole universe of porn, that’s significant.
“I’m generally discounting the third category. I think he’s just using these to look for images that fall into the other two. I’m making that assumption based on the fact the split is almost thirty percent, sixty percent, and ten percent respectively for the categories.”
“That’s reasonable,” Peyton agreed.
“Focusing on the first two I’m adding in the facts: A) all the victims we’re aware of have come from the first category; B) the hacking programs on the second category are set to send back new content daily; C) the wife sites are programmed to send back pictures monthly; D) all of the trace backs so far have gone to state university systems, and lastly, and most importantly, the last victims were in the database before their murder and taken out after.
“Based on those facts, I’m thinking he has the first category to select his victims and the second, college-aged girls, for personal gratification.”
Morley paused before asking, “So waddya think: can I be a profiler?”
“Hey, let’s not get ahead of ourselves, and we need to get one thing straight. Being a profiler is a lot more than making educated guesses. It’s part science, part art, part intuition, and part good looks. Just because you win a few hands of poker on Friday night with the boys doesn’t mean you can give up your day job, move to Vegas, and become a professional poker player. No—”
Morley broke in, “Hey can you hold on a minute, I need to open a window to let out some of the bullshit that’s piling up in here.”
Peyton laughed. “I think what you say makes sense. But as with any of this profiling crap, don’t let it take the investigation down a road it shouldn’t.” He switched gears. “Have your guys just been looking at domestic sites, or have they looked at foreign sites as well?”