Best Laid Plans(43)
“What do you mean?”
“The taxi driver saw Elise leave, but that doesn’t mean she was the only one in the room with Worthington. And we still have no idea why Worthington went to the motel. There was nothing on his calendar, in his emails, or phone records that tells us why the spontaneous trip to San Antonio—Zach would have called us if anything popped up. And I keep wondering, why did Elise take his phone in the first place? She must know that cell phones can be tracked.”
“It could be that she or someone else wanted information on the phone,” Barry suggested. “But according to HWI, nothing on the phone had been downloaded, and the phone wasn’t used to make a call or go online after Worthington’s call to his daughter.”
“But what if she simply looked at information? Would the techs be able to know that?”
“I don’t understand what you mean.”
“I keep notes on my phone. If I download them to my computer or update the note or send it to someone, there is a record. But what if I just read the note?”
“I have no idea. I’m pretty tech savvy, but I don’t know what logs are kept. I’ll ask our tech team about it.”
“We need to find Elise,” Lucy said. “She has the answers.”
Lucy feared for the girl. Whether she was a willing participant in Worthington’s death or forced to do it by someone who threatened her, or simply a witness to murder, Elise was in danger. It would be much easier to kill her than to trust her not to talk.
In fact, Elise might already be dead.
CHAPTER FOURTEEN
Sean often lost track of time when he was working on something challenging. He’d already gone through his checklist—no one had hacked the HWI system, no one had used the HWI system to send suspicious documents, and no staff email raised any other red flags. One guy in the mail room stayed late every night to look at porn sites—Sean flagged his computer so Gregor could decide what to do about him—and one of the admins spent an unusual amount of time playing online games. Again, Sean flagged the person, but didn’t find anything in their behavior that said corporate espionage. He ran full diagnostics throughout the system to make sure there was no malware downloaded through third-party sites—porn sites were notorious for that—but the virus protection software that HWI ran was state of the art.
It could be that there was nothing to find—it wouldn’t be the first time that Sean had encountered a clean business. But he would go through each possible avenue of potential exploitation before he put his stamp of approval on HWI.
Once he determined that there was no overtly suspicious behavior, he dug down to the next level. He first verified that employees were only accessing the files their clearances gave them access to. Next, he looked at employees who had been there for less than a year. There were six, but only two with high-level access. While he ran full backgrounds on each of them, he looked at long-term patterns.
Most people who looked at computer data saw only numbers and words with no context. Sean saw patterns where others saw chaos. He first looked at the business as a whole—whether productivity was consistent within each month, quarter, and year. As would be expected in a CPA firm, activity peaked in April and October—tax-filing periods—with smaller peaks at quarterly intervals. Year-to-year productivity was consistent, once Sean allotted for increases in staff and clients. HWI had been growing steadily since Harper Worthington opened the business thirty-one years ago. He’d started as a corporate CPA and taken his first small government client two years later. After his firm was awarded a court-mandated audit of a state government program twenty-two years ago, he’d branched out into working more audits and government contracts than private. The breakdown was still pretty good—60 percent government, 40 percent private, enabling him to withstand any lulls in business from either sector.
Looking at how Harper Worthington ran his business, Sean grew to respect him. Harper was a smart businessman, if a bit more conservative than Sean would have been. He didn’t take risks, didn’t overspend, and had moderate costs. He provided employees with slightly above-industry-average income-and-benefits packages, including retirement plans, but no one person was paid out of line with anyone else in a similar position.
After a short break, Sean ran a custom program that would highlight changes in computer behavior over time—basically, if someone was using their computer in a different way now than they had in the past. The types of programs accessed, time spent online, the Web sites visited, printing or viewing documents, downloads. Changes in computer usage could mean a variety of things from innocuous, such as getting a promotion or change of software, to criminal, such as spending more time with certain files than an employee’s job should warrant.
One thing jumped out at him immediately.
Harper Worthington had almost completely stopped using the computer at his desk over the last four weeks. His login and password hadn’t changed, so Sean cross-referenced the computer IP addresses with the log that Gregor had given him, and determined that Harper—or someone with his password—was using a computer in another office.
Sean tracked Gregor down in his office. “Why wasn’t Harper using his computer?”
Gregor looked at him blankly. “What do you mean?”
“He was using a computer in a vacant office. Or gave someone his password.”