‘Do you ever sleep?’
‘When I was at YCS, my work day started at four a.m. I had to set the alarm for two forty.’
‘What’s YCS?’
He doesn’t want an answer to that question, though. He wants to be allowed to get some rest without me annoying him. I turn the lights off and give him a kiss. ‘Sleep well, old man. I missed you.’
‘I missed you too.’
It feels like the truth, both ways round.
I think about wearing a bikini on white Floridian sands. Buzz in red shorts chasing a ball, like a golden retriever after a stick.
I do love Buzz. Love him the best way I am able, which might not be a very good best. And I wonder, not for the first time, if he is simply mistaken about me. If he would not be happier with someone else.
His snores deflect the question. I snuggle down beside him and go to sleep.
9
The office, Monday morning. The normality seems strange. I feel like I’ve been away a million years. Most people have hardly noticed I’ve been gone.
Bev Rowlands, says, ‘Fi! How was your course?’
‘It was fine. Quite fun, actually.’
‘God, I’d never do anything like that,’ says Bev, then starts telling me about an outdoor training course she did once where she had to climb up some rope netting strung between two pine trees.
I don’t quite understand the point of the story, but say ‘gosh’ anyway.
As we’re chatting, DCI Jackson walks past and says, ‘Well done, Fiona,’ but doesn’t stop.
The morning briefing is full of busy nothings. Huw Bowen’s manslaughter case, the one I initially wanted, has turned dull. No new murders. No proper assaults, no good ones. A presentation from some traffic officers about various pre-Christmas campaigns they’re running. A talk about cost-cutting and the correct use of community support officers.
When I use the Ladies, I notice that the mirror has streak marks and the soap dispenser nozzles are gummed up. I use paper towels to remove the streak marks and do a basic job on the soap nozzles too.
I’m tasked to process paperwork on a couple of cases that are coming to court. Someone assigns me to help on a team that is developing advice on how to avoid thefts from vehicles. The first of our meetings takes an hour and forty minutes and the gist of our advice will be, ‘Lock your car and hide your valuables.’ Or, to simplify further, ‘Don’t be a bloody idiot.’
I suggest that as a slogan and everyone looks at me.
I read all the statements accumulated by the Fraud Squad inquiry. They’ve done just as Buzz said. Interviewed everyone local. Checked for unexpected inflows of money. Checked anyone with access to the store’s management suite on the day when the offending payroll entries were made. Verified with Swindon that those entries were in fact made locally. And that’s it. The inquiry hasn’t been closed, exactly, but it’s been effectively killed all the same. The T.M. Baron money went from the UK to Spain to Belize and we haven’t yet been able to track it beyond that point.
One morning, on the way into work, I buy one of those big chocolate cookies, still warm from the oven and chewy in the middle. Make a big cup of black coffee, no sugar. Take these gifts to DCI Jackson’s office. Tell him what I want. Say, ‘Pretty please.’
‘You don’t give up, do you?’
He’s not bothered by my request as such, but he’s wary of offending his counterparts in Fraud.
‘There is a dead body here,’ I say. ‘This is our case too.’
‘Yes.’
‘And I don’t need much time. If I can’t sort things quickly, I’ll leave it.’
He asks what I specifically want to do. I tell him.
‘OK. I’ll speak to Fraud. But here’s the deal. I’ll get Owen to give you proper instructions. You complete those instructions as written. You complete them within a day. And normal rules apply, Fiona, OK?’
Normal rules: that’s Jackson-speak for me not doing anything to piss him off.
‘Yes, sir.’
I stand and offer my very best salute. Saluting senior officers is pretty much unheard of these days. Police officers are required to salute at Remembrance Day services and in the presence of a hearse or the sovereign, but those things don’t come along every day and it’s possible that my mark of respect is lacking a certain technical precision.
‘Fiona, we’re done. You look like a gay man waving.’
I leave the room. As well as the coffee and cookie, I brought a file full of the Morgan paperwork, in case Jackson wanted to inspect it. He didn’t, but the door has a heavy self-closing mechanism and I find it hard to open with my one free hand. In the end, I have to put the folder down, use both hands on the door, then pick up the folder when I have it open.
Jackson stares at me. His eyes are impassive, but his lips move. The only words that come out are, ‘One day. Normal rules.’
10
Swindon. Roundabouts and distribution centres. Big white industrial sheds surrounded by dwarf willows and artificial lakes. Wire fencing.
I park in a 250-bay car park. Sign myself in, in a high, glass-fronted lobby. Get a plastic badge and am told to go to the third floor. Three people waiting for the lift: two men and a woman, all in dark grey suits. The woman is saying something about warehousing issues in Poland, but falls silent when the lift comes. We travel up in silence.
On the third floor, there’s another reception desk. I’m feeling a bit spacey – I often do in these places – so I have to blink a few times before finding the name I need.
‘Kevin. Kevin Tildesley,’ I say, when I’m done.
The woman behind the desk says something. I sit down. There are magazines on a low table – Furniture World, Furniture Today – but I resist their lure.
Every ten seconds or so something electronic bleeps. I look at my hands and try to remember who I am.
Then Tildesley arrives and I feel immediately less weird. He takes me through to a small conference room with a view out over the dwarf willows and the phoney lake. Tildesley feels more cheerful this time, less stressed. I guess he’s feeling more secure about his job. That the mess won’t end up being blamed on him.
I explain why I’m here. Tell the truth. About T.M. Baron, and the money that went to Spain, and the money that was withdrawn in cash. Tell him about Hayley Morgan and how she died.
‘Christ,’ he says. ‘Jesus.’
No one really knows what it’s like to die from a combination of rat poison and starvation, but it isn’t good. The poison in question was a second generation anti-coagulant. The stuff works by thinning the blood so much that the body’s capillaries become dangerously permeable. Blood starts to leak into joints and muscles, so that victims literally bleed to death, though the bleeding is all internal. Scientific studies of haemophiliac pain suggest that the effect is moderately to severely painful. And not particularly fast.
‘We’ve done what we can to chase up the ultimate recipients of the cash, but the money has long gone offshore. Outside the EU, even. So we need to work on the front end. When the scam was set up. How it was set up. How it was kept going.’
‘OK. Yes. OK. As you can imagine, there’s been an inquiry here.’ Tildesley raises his eyebrows in an imagine-the-drama kind of way. ‘Some of our historical procedures were, quite frankly, lax, and of course on the audit side . . .’
We get into the nuts and bolts. Tildesley isn’t that great at explaining things, but he does understand his subject.
Historically – that is, in the Days Before Kevin – payroll was administered both locally and nationally. So the system was constructed and audited at national level, but it made use of inputs generated locally. ‘So if, let’s say, the manager of the Bridgend store needed to hire some extra staff for Christmas, he’d have made a request in the regular way. We’d approve that sort of thing instantaneously, normally. Then he’d have entered the names and payment details at store level, and the data would have flowed through to our national payment system.’
/>
‘OK. I get that. But assuming that the boss of the Cardiff store wasn’t fiddling the system himself – and we don’t think that he was – how come he didn’t instantly notice the fraud? It’s a big store, but there aren’t that many employees.’
Tildesley is shaking his head. Now that he’s not worried about keeping his job, he likes the excitement. Feels like the Swindon-accountant version of a trawler captain caught in a Newfoundland storm. Water waist-high on the foredeck and foam seething on a lee shore.
‘Yes, but that was the clever thing. We assess performance store-by-store and region-by-region. Now obviously lots of our costs are completely local. What a store uses in terms of power, for example, or their staffing bill. But you’ve got other costs that are regional, and others that are national. So all our buying activity is national, but a lot of our marketing and promotion might be regional. The way we work that out is we allocate a set proportion of regional costs to each store in the area. Same thing with our national costs. That way, we get a fair view of the profitability of each store.’
I nod. ‘OK . . .’
‘And our two individuals – Morgan and Gibson – were given a regional coding, not a local one, not a national one. So the store manager saw the names, and assumed they had nothing directly to do with him. The national payroll team saw that these two names were inputted via the Cardiff store, and assumed it was some regional activity being led out of Cardiff. Both ends of the operation thought the other one was in control.’
Tildesley thrusts papers over the table at me to show the deliciousness of the scam. I don’t completely understand, but don’t think I need to.
‘But someone, somewhere, once sat down at a computer and created these false profiles, correct?’
‘Correct.’
‘And that computer was physically located in Cardiff, in Swindon or somewhere else?’
‘Cardiff.’
‘You’re sure?’
‘Certain.’ Tildesley starts telling me why. Something to do with the input coding.
‘And presumably any member of the Cardiff store could have got access to those computers? I mean, shop-floor staff probably weren’t meant to play around with the payroll system, but they’d have had physical access to the space.’
‘Yes. But we always talk about three levels of access. Physical, network, finance. Physical access: OK, you have rules and procedures, but you know those things are going to be breached. Shop-floor workers take their lunch break. Chat with a secretary. Look at the internet from an office PC.
‘Level two access – access to the firm’s intranet and systems – that’s password-protected. Passwords change every month and they’re unique to every user. We have a complete log of who signs in when and for how long.’
Sure enough, Tildesley pushes a folder at me: a printout of computer log-ons, sorted by date, running back two years.
‘Level three access – getting to move money around – that’s the biggie.’ Tildesley starts to explain it all. It’s complex in detail, but simple in essence. The Swindon head office regards its individual stores with distaste, the way Marie Antoinette thought of her stablehands. Swindon makes the decisions. The stores get to stack shelves and operate cash tills. Any financial decisions above a thousand pounds require authorisation from head office. Not even the Cardiff store manager has standing authority to spend the firm’s cash.
I ask Kevin if the store keeps visitor sign-in books for people who come to the store on business. He tells me that those things are computerised now. He makes a call. A girl with a milky face and a navy dress brings a pile of printouts, still warm from the printer.
I ask Kevin if he has a record of any external consultants who had access to the store over the last two and half years. The answer is no, not exactly, but he can find records of any payments made to consultants in the South Wales region, plus the dates of those payments, plus the invoices. I ask for copies of the lot.
And by the time we’re done, I have been here two hours and have a stack of printouts four inches high. Kevin and the girl with the milky face see me to the lifts, my very own guard of honour.
I say to the girl, ‘I like your dress.’
I don’t particularly. I have no feelings on the subject. But I know women say these things to each other, so I try saying it now and again. The disciplines of Planet Normal.
The girl starts telling me about her dress, while I express interest with just a tint of excitement. The lift comes and I leave.
On the way back to Cardiff, I stop at the Leigh Delamere service station for fuel and lunch. Brie and rocket sandwich. A plastic salad thing, which I buy from some sense of duty. Fruit smoothie. But mostly, I just sit there with my printouts and my laptop. Researching.
Call Kevin. Can he tell me which specific computer the data was entered on?
He can’t, but he’ll speak to the IT people.
I try eating my salad with the plastic fork provided. It bounces off the baby tomatoes, has difficulty with the cucumber, but handles the sweetcorn as easy as la.
I call our forensic computer team in Cardiff, the ones who deal with computer frauds and kiddie-porn. Anything really complex is handled by the Hi Tech Crime Unit at SOCA, but our guys are fine with the basics. I ask a few questions, get a few answers.
Find a way of cornering my tomatoes against the plastic wall of the salad bowl and successfully impale them, every last one of them.
Get a call back from Kevin, who has an IT guy with him, another Kevin. Kevin Two starts speaking a language I don’t really understand, even though nearly all of the words seem to be English. Then he gives me what I want: the serial number of the computer from which the fraud was committed.
Phone Dunwoody. I need his permission to do what I want to do next. He squirms. Doesn’t like the responsibility of decision, but knows Jackson has authorised my researches so he doesn’t have much option. Says OK.
I phone our computer people back and ask them to send someone to the store. Say I’ll be there in an hour.
I’m there in a hour and ten. Our guy is already there: Mark Lampley, jeans and a T-shirt, worn under a jacket. He’s drinking tea, not working. I’m about to be pissed off at him, except he pre-empts me. Taps the desktop, says, ‘Trojan horse. Computer is totally compromised.’
I make my IT face at him and he explains further.
‘A Trojan horse is any kind of application which allows a remote user to control a computer. Basically, once the program’s installed it just sits in the background. If someone wants to control it from outside, they can.’
‘How much knowledge do you need to create something like this?’
‘Well, I doubt if the software’s original. This looks like a basic Slavebot app to me.’
‘But you need to be an IT specialist, yes?’
‘Ideally, yes.’
One of Kevin’s invoices showed that Red Dragon Systems, a computer consultancy based down in the Bay, had done work for the store over an eight week period last spring, a period ending about eleven weeks before the payroll fraud began. The Fraud Squad investigation had focused on the period immediately around the fraudulent payroll request itself, so they hadn’t even noticed Red Dragon’s involvement.
The store sign-in data indicates that the firm had three consultants working on the project: Saj Kureishi, Andrew Peters, Colin Cooper.
I look at Mark. He looks at me. Puts his mug down with a bang.
‘Let’s go and arrest some criminals,’ he says.
11
We arrest no one.
We do go down to Red Dragon Systems. Myself, Lampley, someone from the Fraud Squad, plus a couple of uniforms for good measure. Peters and Cooper are both there, scared at finding themselves surrounded by cops and marched off to Cathays under caution.
But not Kureishi. He went missing in about late June. Hasn’t been in to work. Not responding to messages left at his home address, on his mobile or on his IM accounts.
We st
art to do the basics, of course. Interview Peters and Cooper. Seize computers from Red Dragon, including the machine that belonged to Kureishi. Start to check personal bank accounts.
We don’t get far. When we start to enter Kureishi’s details on the PNC database, a basic cross-check flags up a case of possible interest. Two weeks ago, Devon and Cornwall police were called to a small rural property which was rented out in the summer months. The owner, there to do a bit of end-of-season DIY, found, along with the wasp nests and the leaf-filled gutter, the body of an Asian man. The corpse was duct-taped to a chair, his hands hacked off. There were no other signs of violence, meaning that the man was left to bleed to death.
I’ve seen the crime scene photos. The man’s brown face has gone a kind of ash grey. His eyes are open and his mouth pulled back in an expression of mild astonishment. It’s as though he saw something, while dying, which caused him a mild, detached, almost philosophical amusement. A last wry chuckle at a fading world.
I know not to read too much into these expressions. They arise not as the result of emotion, but of physiognomy, the body hardening, then softening, into its final shape. But, either way, I like the pictures. Have them printed in full colour. Pin them up around my desk.
The pool of blood on the man’s knees, thighs and floor has turned a deep rust brown, like the shadows in a forest of autumn beech.
We check the corpse’s DNA against samples collected from Kureishi’s home and workplace. Also drive Peters and Cooper down to Exeter to confirm the ID. It’s him. What’s more, Kureishi’s work computer contains copies of the Trojan horse software installed at the superstore. The other Red Dragon computers are clean.
The forged ‘Hayley Morgan’ letter received by Social Services matches the paper, envelope, printer and toner ink used by Red Dragon.
Our fraud officers check, very discreetly, some other corporate addresses where Kureishi did consultancy work. They check five computers at which he was known to have worked. All five are infected with the same Trojan horse. Three of those computers are able to access the payroll systems of the companies in which they are located.
The Strange Death of Fiona Griffiths (DC Fiona Griffiths) Page 5