A death in the gym, p.9
A Death in the Gym, page 9
Later, back in Earl’s Court, Josh continued his searches on Elena Martinez. Before he met her, he had already read her Facebook and Instagram accounts and had followed her posts in a chatgroup which seemed to be about appreciating European literature, some kind of online reading group. It was there that he had discovered her love of L’Etranger and how she had started to reread it “yet again as slowly as possible” and it was in these postings she had shown what seemed, at the time, to be a somewhat naïve, unworldly side. He had also picked up this trait in some of her reactions on Facebook, and this had encouraged him to test the “coincidences” when he met her. But there was little about her original statement or his conversation with her which gave him any sense that she might have been involved in Kat’s disappearance. It was just a gut feeling but at this stage there was little else to go on. Except, of course, her involvement in his beach encounter. For now, he decided to put Elena Martinez to one side, assume his beach encounter meant no more than curiosity on her part and that it wasn’t intended to be threatening. But he did add her only comment of interest to his list of open points – that Caroline, contrary to the impression she had given him, was having issues with Kat at the time.
He then turned to Lisa Penfold, now Lisa Rhodes. She was Kat’s closest friend, her flatmate, and probably would have been in the best position to pick up on Kat planning a disappearance or having the motivation to do it. Yet, she had picked up on nothing. At least, she said she hadn’t. Could she be lying? But why would she? Josh’s initial research on Lisa had been to trawl through her social media which led him to a website linked to the cancer charity she supported. It was there he had found out about her condition and her recovery – and the sea swimming. On Facebook she had posted her original wedding photos from which Josh searched her husband, Tom, a civil engineer who claimed to come from Bristol. This yielded nothing of interest. They were still married, took regular holidays and both posted photos of themselves against various sunsets. No children, it seemed. As he scrolled through more and more online messages and images, nothing emerged which piqued his interest. He made some notes and then looked again at Rafael Squire.
Of all the people he had spoken to, Rafael Squire had seemed the least interesting, having said nothing of interest. Probably, the most interesting thing about him was his first name, Rafael, which was an unusual choice for someone with his background and born in the early seventies. Maybe Josh needed to apply some reverse logic and take from that that Rafael might be the one hiding the most. But that did seem a stretch and somewhat counter-intuitive. He had already researched Squire’s career trajectory, if you could call it a career or a trajectory. How he had various stints, first working in an insurance company, then at the Bournemouth Echo, followed by Halfords selling bikes. It wasn’t clear where the money to set up his shop had come from. A prime spot facing Bournemouth beach couldn’t have been cheap and he didn’t appear to have worked anywhere long enough to have saved much. More likely, he had been funded by his parents who Josh had tried to identify but so far had drawn a blank. They were presumably of an age with no internet presence and there were no references to them in Rafael’s postings. Josh’s search had revealed Squire to be a more common name than he had appreciated. He had found an Ian Squire in his mid-seventies who was still living in Bournemouth. He could conceivably have been Rafael’s father, but it seemed unlikely; he was a retired plumber living at an address which was rented from the council. It was possible that Rafael’s parents were dead and he had inherited his money from them. He searched the name “Rafael Squire” in the records of Companies House to see if he was a director or shareholder connected to the bike shop. If he was, he could use the company set-up date as an approximate time for when he’d inherited his money and could then search death notices to see if that might lead him to the parents. But there were no records so that was another dead end. Literally. But even if he could establish how Rafael had paid for the shop or funded his lifestyle, it was unlikely to link him to Kat. He could have hacked Rafael’s bank statements, but his principle of minimum interference made him decide against it. For now.
15
Josh was diagnosed with Type 1 diabetes when he was only ten. The cause of this illness was unclear to the doctor assigned to him, an endocrinologist, who had said that something had attacked one of his organs, the pancreas. This meant that it couldn’t produce the hormone which controlled his blood sugar levels and from then on, he had had to learn how and when to inject it into himself. The hormone was called insulin and initially, he would be injecting it five or six times a day. Perhaps, a ten-year old is best placed to deal with something this significant; old enough to understand what to do but young enough to accept it without the sense and fear of what might lie ahead. And for much of his childhood, despite the low and the high blood sugars and a diet which discouraged much of what young children like to eat, he managed this new life as best he could.
In 2011, seven years ago, when Josh Stern graduated from Bath University, he had gained a joint degree in sport and computer science. It was an unusual combination; everyone else had done sport or computer science but not both and the university had allowed him to do this by extending the usual three-year course to four years. That meant that by his fourth and final year, all the students who had started with him had graduated and he was then with the students previously in the year below, now in their final year. To Josh, most of the computer science students were what you might have called geeks. They spent their lives in front of computer screens and were fully immersed in the virtual world of programming, gaming and coding. There were, of course, some exceptions but among the three hundred or so students, the majority seemed to be a different breed from the sport scientists. For them the sport definitely came before the science at least in terms of how the students projected themselves. Most were athletic, playing some sport to a serious level and their interest in the science came from wanting to perform the sport better; to elevate their training to a scientific level. From his appearance, anyone observing Josh would assume he was a sport scientist.
At just over six feet and weighing about one eighty-five pounds, Josh seemed the antithesis of a nerd, but he too spent a lot of time in front of a computer. He had done this since he was a child, honing his skills on PlayStation with Legend of Zelda and Street Fighter and moving through Tomb Raider, SmackDown and Grand Theft Auto. All the games that all the kids were playing. But he didn’t just play games. By thirteen, he could write basic software and by fifteen he could hack a computer. Not the ones with the high-level protection but certainly all the computers used by anyone he knew. And like many computer hackers he spent a lot of time on the so-called dark web, the less accessible, less-public side of the internet where people could anonymously browse and procure illegal services. He quickly discovered that it was a vastly exaggerated forum and that most of the illegal services, the really illegal ones, were offered by scam artists. Assassins for hire were no more than anonymous nerds looking to steal your money. But what was real was the exponentially growing chatrooms full of users with fictitious names who shared interests and sold products and it was from one of these groups that he found people with significantly better hacking skills than himself. For the equivalent of fifty pounds in crypto currency, he could buy a malware program which, once installed on someone’s phone or computer, could take control of it. The beauty was that it was always being upgraded and reconstituted to be ahead of most commercial anti-virus software and could sit undetected on a hard drive. The only skill was to get someone to open the attachment which contained the program and that was something Josh had spent years developing. The first person he tried it on was a boy at school who he didn’t like. Even then, he knew it was probably illegal so was careful to send the attachment from an email account created in an internet café. And he wore a hoodie and checked for CCTV cameras because he knew the email could be traced back to that location. He was also careful that when the boy, Declan Glover, did open the attachment and unwittingly ceded control of his computer to Josh, he did no more than read his emails and look at his photos. He avoided doing anything to make Declan suspicious and he didn’t try to profit from the hack, although seeing Declan’s browsing history and the amount of porn he was watching did give Josh the strong sense of a missed opportunity.
By the time Josh was at Bath he had learned two things. First, he could now write the programs he had previously bought and these couldn’t be traced back to his computer and second, he had developed what he called his principle of minimum interference. It was this principle that stopped him selling his programs through the same chatrooms he had visited at fourteen. The principle was that he would not use his hacking skills against what he loosely called “innocent people.” He would only use them to undo or counter some wrongdoing, against the guy who had stolen his client’s money or someone like Joe Carolan who was involved in spying on him. But he didn’t use them to steal and he liked to think of it as an option of last resort. This was partly moral, but in truth it was primarily practical. By keeping his hacking to a minimum, he was also managing the risk of getting caught.
Apart from his love of computing, Josh’s other passion was sport. He had always been good at running, short and long distance, and by thirteen he could run a hundred metres in under twelve seconds and the 5K in sixteen minutes. He would load his body with glucose before a race and the need to burn it all off, to avoid a high blood sugar, motivated him to run fast and harder than his competitors. When he was fifteen, like many teenage boys, he became obsessive about his body and the culture of increasing muscle mass and reducing fat and he became what was called a natural bodybuilder. Someone who gained size without drugs. He didn’t compete. It was just a personal interest but the hours he put in, the daily workouts, combined with some good genetics, despite the broken pancreas, meant that even in winter clothes he looked like someone who exercised seriously. His other sport was judo, something he got into at primary school and had practised on and off until uni. But it was at Bath that he had discovered a new sport which was then getting a lot of interest, a South American version of an old Japanese martial art known as Brazilian jujitsu or BJJ as everyone was calling it, and he had practised it pretty much ever since. It wasn’t that he was violent by nature. On the contrary; for someone who could win most fights, he was just as good at avoiding them. What he had liked about judo and now BJJ was the skill of learning how to use an opponent’s own body against them; the natural range of limb movement beyond which you can control an aggressor and the pressure points against which to apply minimal force to achieve maximum effect. And he applied the same principles to his investigations, establishing where someone was at their weakest; the scope within which they would trust him, trust him enough to activate his malware.
In June 2011, Josh left university and moved to London. He had spent the final year of his course trying to decide what career to pursue. He talked to a consultancy firm in Bath which specialized in cybercrime and they made him an offer to join them as a developer. He’d also had an offer from a private equity firm in London, Dawson Capital, as a trainee analyst by bluffing a knowledge and interest in finance and, in between the offers, he qualified as a personal trainer. At the same time, he was going out with a girl on his sport science course who had a job offer to work in London as an occupational therapist. It was this that made him choose Dawson Capital and that summer he and Vanessa, the girlfriend, moved to a small flat in Pimlico. His job only lasted a year but that was longer than Vanessa. They had split up by March having decided that their lifestyles were “incompatible,” Josh being organised and tidy and Vanessa being the opposite. It was, of course, a problem for him rather than her. Messy people don’t usually mind tidy environments, but it didn’t work the other way around. It wasn’t the only issue but it was the easy one to blame and they separated when the nine months of minimum rent on the flat had passed and they could break the lease. Josh found a cheaper flat of a similar size in Earl’s Court and that was where he had been ever since. But the trainee analyst job bored him and the longer he worked there, the longer the hours seemed to get. Of course, the money was good. They paid him thirty-five thousand a year plus a potential bonus which he never got. He knew that paying the rent would be an issue if he left without another job but that’s what he did. He quit in July 2012 and spent August and September working as a doorman in a club in Mykonos. The hours of ten in the evening to four in the morning gave him the afternoons and early evenings to sunbathe and work out and for those two months, that seemed to be all he did. And he was lucky with the club. He was one of two doormen but it wasn’t one of the more popular ones so it didn’t attract the same drunken crowd and the likelihood of injuries for both sides. By the end of the summer he was unbruised and with a deep Mediterranean tan. He had also managed to sub-let his new flat, in breach of his tenancy, through a site which had only recently gained traction in the U.K. – something called Airbnb – and the net rent not only covered his own rent but added another eighty percent. With his accumulated savings from London, the money he’d saved in Mykonos and the Airbnb surplus, he returned in October to a grey and cold England, but flushed with cash and full of ideas of how he could make some more.
When he was a student at Bath, he had advertised his IT proficiency online and, thinking that maybe his target market wouldn’t be looking online, he also advertised in the classifieds of a local newspaper, the Bath Echo. He offered a variety of basic services which people of a certain age seemed to struggle with – from fixing software glitches to full computer security with some word and excel training thrown in. And in his last year, with his new certification, he took on clients as a freelance PT. He liked to keep the two activities separate rather than use one to feed business into the other. He figured he was a more credible personal trainer if he wasn’t fixing their computers for money on the side. But very occasionally the two businesses overlapped and produced the same customer and it was one of them that started the career that Josh was ultimately to pursue.
Mary Stannard was a middle-aged woman whose husband, she told him, had recently and suddenly died. She had seen Josh’s ad in the newspaper and had asked if he could help her log in to some of the payment sites previously controlled by her husband. One of Josh’s initial tasks was to discover the password used to set up some of these accounts which he solved not through his IT skills but by finding the notebook in which was written ericStannard1961 on the inside cover. Mary was in her late fifties and had described herself as a “housewife” who “rarely uses a computer.” When they had first met, it was an unusually hot April afternoon and she had commented on Josh’s physique, accentuated by the t-shirt he was wearing. He had explained that he was also a personal trainer and, after he’d found the password, changed her log-in details and explained what was on the desktop computer and how it might work, she’d given him sixty pounds against the forty-five he was charging. Then a week or so later, she’d asked if he was free to give her personal training in a local health club which she had joined. Most gyms had their own PTs and didn’t allow outside trainers, so they agreed that he would be signed in as her guest and stretching credibility to its limit, she called him Josh and asked him to call her “mum.” “It’s more likely that someone looking like you is my son and not my friend, so they won’t disturb us if they think we’re related,” she had said. They didn’t get challenged, although the resident trainer eyed them both with suspicion as Josh took Mary through some basic exercises. She only trained with Josh for about ten weeks before he left for London in June and he had assumed that this was probably the last time he would hear from her. But in August she had emailed him in evident distress to say that she had lost ten thousand pounds to someone she’d met through a website. Josh had read this with a sense of guilt because Mary’s new-found internet confidence was very much down to him. Even during the breaks in their PT sessions, he would give her tips on interesting sites to explore online. For someone like Josh, the idea that someone had lived a life without the internet was inconceivable and he was keen to open up a new world to Mary which marriage had denied her.
Josh assumed that whoever had scammed Mary would not be easy to hack. After all, if they were a professional con artist, you would expect them to be good at avoiding falling victim to someone else’s con. But he also assumed that they were greedy and preyed on people they thought were naive, so he devised a plan where Mary would continue the relationship. At Josh’s suggestion, Mary told the scammer, someone who called himself Theo, that she was happy to treat the ten thousand as just a loan which didn’t need to be repaid any time soon. “Just give him the impression that everything is fine,” Josh had said. When the inevitable request for an extra five thousand was made, he instructed Mary to say that she’d paid it even though she hadn’t. This produced several anxious responses from Theo, culminating in Mary sending evidence of payment – a document created by Josh using the logos and typeset of Mary’s bank which Theo opened. Theo’s own bank account number was wrongly recorded by one digit. This would explain to Theo why the money had not reached his account and was intended to distract him from focusing on the document itself in which was embedded the most sophisticated malware Josh had so far written. It was like Declan Glover all over again except this time he was prepared to access and operate Theo’s online banking app and transfer all the money he could find in the account, the equivalent of fifty thousand pounds in Croatian Kuna. This was moved into a cryptocurrency account he had opened at uni and he had intended to transfer the entire balance to Mary, something to add to her pension fund, but decided that it would raise too many questions from her. Instead, he returned the ten thousand pounds, explaining that he had managed to persuade Theo to pay back the cash. He also helped her to block any future contact with him and cautioned her against ever doing this again. And, although he hadn’t planned this, he added the balance of forty thousand pounds to his own account. It had to go somewhere, he figured. It was this experience that had got him thinking about offering himself for more proactive IT support, the ultimate debt collector. This was to morph into a different role, a private investigator where he could bring together his online and offline skills. Solving problems for a price. And if he could make enough money out of it, then he could afford to keep doing what he most enjoyed, the personal training.
