Second Sister Read online

  N set up a new password for Siu-Man’s account, then opened the string of messages. He clicked a few times, and a jumbled string of characters popped up on the screen. This happened four more times, until the screen was filled with unintelligible English words such as “DKIM-Signature” or “X-Mailer.” Nga-Yee thought that this must be similar to the inner workings of Popcorn that he’d shown her last time. N spent a moment scrutinizing this alphabet soup, then smiled in satisfaction.

  “You’ve found it, Miss Au.”

  “What?” She looked blank. “What do you see in this—this thing?”

  “You have no idea what this ‘thing’ is, do you?” N gestured at the screen, which looked like lines of ants were crawling across it. “Emails don’t just consist of the sender, the subject, and so on. There’s also something called the header that records digital information only the software knows how to make sense of. The email client and the server will add extra data. There’s a chance this will include the sender’s IP address.”

  That phrase was an electric shock to Nga-Yee. She didn’t know anything about computers, but her memory was good, and she hadn’t forgotten what N had taught her.

  “The culprit left his email address? It won’t be somewhere in Luxembourg again—will it—” she stammered, almost biting her tongue in agitation.

  N highlighted and expanded a section of the screen.

  Received: from [10.167.128.165](1-65-43-119.static.netvigator.com. [1.65.43.119])

  By smtp.gmail.com with ESMTPSA id u31sm8172637pfa.81.2015.05.05.01.57.23

  “That’s in Hong Kong.” He beamed. Nga-Yee made out the word “netvigator,” which even she recognized as a local internet provider.

  “So we know the culprit’s location?” Her eyes were wide, and she had to stop herself from grabbing N.

  “No. He might have loosened his grip a bit, but he wouldn’t be so stupid as to reveal his location.”

  “You’ve got his IP address, but you don’t know where he is? According to what you said before, that should be impossible.”

  “The four messages this guy sent came from three different IP addresses.” N highlighted three more sections:

  Received: from [10.167.128.165](1-65-43-119.static.netvigator.com. [1.65.43.119])

  By smtp.gmail.com with ESMTPSA id u31sm8172637pfa.81.2015.05.05.01.57.23

  Received: from [10.191.138.91](tswc3199.netvigator.com. [218.102.4.199])

  By smtp.gmail.com with ESMTPSA id 361sm8262529pfc.63.2015.05.05.02.04.19

  Received: from [10.191.140.110](1-65-67-221.static.netvigator.com.[1.65.67.221])

  By smtp.gmail.com with ESMTPSA id 11sm5888169pfk.91.2015.05.05.02.06.33

  “The first two messages have the same address, but the third and fourth have different ones.”

  “So … he must be doing the same thing as before, using a proxy—” Nga-Yee said, dispirited.

  “No. If that was it, we wouldn’t just be seeing local IPs.” N returned to the Google page. “It’s quite common to jump from one IP address to another. Say you sent two emails from your laptop, one from home and one from the library. That would be two different IPs. The unusual thing here is three different IPs within ten minutes. I can think of only one situation where that would happen.”

  “What’s that?”

  “If he was in a moving vehicle, using different Wi-Fi networks along his route.” N jabbed at the screen. “Let’s say he was on the MTR. He could have gotten onto each station’s Wi-Fi during the one minute his train was stopped there.”

  “These messages are short, but he couldn’t have typed them in such a short amount of time, could he?” Nga-Yee wasn’t sure what Wi-Fi was, but she remembered Siu-Man using something like that to get online at home.

  “You don’t need to be connected to read or write emails,” N explained. “He could do that off-line and use the time at the station to send his messages and download new ones. That wouldn’t take more than ten seconds.”

  “Can we find out which stations?”

  “Yes.” N turned the screen back, as if he didn’t want Nga-Yee to see what he was doing next. “We have the date, time, and IP addresses, so we can work it out. Like I said before, that’s how the police track down certain internet users. Of course, they go about it properly, by asking the providers to share their client records. My method is, ah, less orthodox.”

  Nga-Yee decided not to ask any more questions. This might well be illegal, and the less she knew about it, the better. After a few minutes N turned the screen back to face her.

  “Yup, these are from MTR stations,” he said blandly, as if it was completely natural that his guess would be right. “The first two are from Yau Ma Tei, the third from Mong Kok, and the last one is Prince Edward. He used a prepaid number to register, so we won’t be able to trace him from that.”

  “Register?”

  N scratched his head, seemingly annoyed at having to explain, but went on in the same level tone. “The Wi-Fi might be free, but you have to sign up for it first, either using your home plan or your cell phone number.”

  “So you don’t need to enter any personal information if you have a prepaid number?” Siu-Man used one of those, but Nga-Yee had thought that was just because it was cheaper.

  “That’s right,” said N, smiling mirthlessly. “Hong Kong’s liberal that way—it’s easy to get a burner. Plenty of other countries make you use your ID or credit card details. Here, those cards get shipped to the vendors in large quantities, and as long as you pay in cash, there’ll be nothing tying you to the number.”

  “Even so,” said Nga-Yee, looking earnestly at N, “the convenience store would have security cameras, wouldn’t it? We may not have his ID, but we’d at least know what he looks like. If you could track down the number he registered with, find out where he bought the card, then locate the security footage—”

  “Who do you think I am—God?” sneered N. “You’re right, though. I could do all that if I wanted to. But there are many places selling these cards that don’t have security cameras. The Apliu Street flea market, say.”

  “You haven’t even tried. How do you know he got it from one of those places?”

  N didn’t reply, just reached out to open his desk drawer, from which he produced a black plastic box smaller than his palm. When he flipped it over, dozens of SIM cards no bigger than a fingernail tumbled onto the desk, a little heap of them.

  “Because if it were me, that’s what I would do.” He scooped up a few and let them rattle around in his hand. “Just like you couldn’t track me down from the number I gave you.”

  That’s when Nga-Yee realized that he’d given her a burner, and he’d retire the number after this investigation was over. She was about to ask N why he bothered—after all, she already knew where he lived—but the answer came to her almost at once: he could easily move out of this rat’s nest of a home and sever all ties with her at a stroke.

  “Then—then let’s not bother tracking down the number,” she said, “and look at the station security footage. Like you said, we know where he was at what time, and we’ll be able to trace his Octopus card from when he entered or left the station—” She’d heard that the police could find suspects this way, so surely N could do the same.

  “Do you know how many commuters there are, Miss Au?” N swept the SIM cards back into their box. “Even if I could get hold of the footage, Yau Ma Tei, Mong Kok, and Prince Edward are the three busiest stations in Kowloon. How would we know who in the crowd was messaging your sister? Never mind that every station has surveillance dead zones, and there aren’t any cameras on the trains. The culprit chose this method, rather than, say, going online anonymously in a coffee shop, precisely in order to avoid being recognized.”

  “Then …” Nga-Yee couldn’t find a way to continue the sentence. She understood what he was telling her, but it was a bitter feeling to have the one clue she’d uncovered lead to a dead end.

  “Anyway, this has all saved me a lot o
f time, so it should be easier to track down at least one of them,” said N, putting the box of cards back into the drawer.

  “One of them?”

  “There are two people behind kidkit727—or maybe even three or four. But two is more likely.”

  “How do you know?”

  “I’ll cut straight to my conclusion,” said N, still in that impassive tone. “Two people sent the emails and wrote that long post. I’m calling one of them Little Seven—after all, he calls himself kidkit727—while the other one registered with Popcorn as [email protected], so let’s call him the Rat. Little Seven’s probably the mastermind. He wrote the post and sent those emails to your sister, while the Rat just provided technical support. I deduced this from the difference between the way the Popcorn post and the emails were handled.”

  N took a sip from a mug on the desk and went on. “Although measures were taken on both platforms to evade detection, the latter took a more convoluted route. The Rat’s tactic of registering on Popcorn using a burner phone and going through proxies was the most effective—even I couldn’t trace anything back to him. Little Seven’s use of station Wi-Fi to cover his tracks seems unnecessary. Why not just use proxies, like before? Or get online directly with that unregistered SIM? And why use a Gmail account? There are untraceable email providers that automatically erase all data at regular intervals. Anyone who knows how to use proxies would be aware of them. So I’m pretty sure kidkit727 is actually two people. They aren’t regular collaborators, and all the secrecy tactics the Rat taught Little Seven were ones that someone without much technical knowledge could use. The prepaid phone number was probably obtained by the Rat. He only had to tell Little Seven the log-in details he’d used to register on the transit network, and instruct him to go online at the most crowded stations to avoid detection.”

  Even with Nga-Yee’s lack of computer knowledge, she found this explanation easy to follow and persuasive.

  “But why did you say this saved you time? Doesn’t it make the investigation more complicated if there are more people involved?”

  “No. Because all I have to do next is find out which of your sister’s classmates uses an iPhone, and that will be our next suspect.”

  This made no sense. “Class-classmates?” Nga-Yee stuttered. “You think Little Seven is Siu-Man’s classmate?”

  “Very likely.”

  “How could you know that? Because the first two messages were from Yau Ma Tei station, near Siu-Man’s school?”

  “The location helped, but the most obvious clue was in the emails.” N brought the first message up on the screen again.

  “Was—Was this in the header thing again?”

  N mock sighed and grinned at her. “Try using your eyes. It’s in the second sentence.”

  “What about the second sentence?” Nga-Yee peered anxiously at the screen. Don’t think people will feel sorry for you because you’re fifteen.

  “In the Popcorn post on April 10,” N said, “the heading was ‘Fourteen-Year-Old Slut Sent My Uncle to Prison,’ but this email on May fifth says she’s fifteen. Your sister’s birthday was on April seventeenth, so her age did change between those two dates, but only someone close to her could have known that.”

  Nga-Yee was taken aback. He was right, the newspapers had referred to Siu-Man as “Girl A, 14” after the incident, and it was only after her suicide and the police statement that the reporters updated her age.

  “Also, the second email says, ‘You’ll be a disgrace to your classmates.’ That’s a weird way to put it.” N scrolled down. “Most people would have written something like ‘a disgrace to your family’ or ‘a disgrace to your school.’ But classmates? That suggests the sender saw themself as one of that group. And this person knew when your sister’s birthday was. That indicates they’re likely to be in the same year, or even the same class.”

  “But—even if it’s likely, we still can’t be sure, can we?”

  “Have you ever wondered about this person’s motive?”

  “Motive? To frighten Siu-Man, to make her suffer—”

  “Those are objectives. I’m talking about the motive for sending these emails.”

  “Is there a difference?”

  “Of course,” said N, as if it were obvious. “Let me put it another way. Why would this person abruptly decide to send these threatening messages on May fifth? Why not wait a little longer, so the Rat could help find a more covert way?”

  Nga-Yee hesitated. She hadn’t considered this.

  “I reckon the answer’s simple.” N pointed at the screen. “Little Seven got caught up in the heat of the moment and rushed to send out the messages without waiting for help. You can tell from the last sentence of the first email.”

  “‘I’ll make sure you never smile again’?”

  “People unwittingly reveal a lot of extra information from what they say. Little Seven must have hated your sister—for personal reasons or because Shiu Tak-Ping had been wronged. And Siu-Man had been feeling low for a while?”

  “Yes. She’d been depressed ever since our mom died last year … And every time she seemed to perk up a bit, something would happen to bring her down again.”

  “That makes sense. Little Seven wanted your sister to suffer and found satisfaction in her despair. ‘You haven’t been punished enough. I’ll make sure you never smile again.’ That word ‘again’ means they must have seen your sister smile and look unworried. Little Seven didn’t like that and couldn’t resist the urge to send her a threat right away, to make sure she didn’t have a single moment of peace.”

  “You think that’s the reason?” asked Nga-Yee in disbelief.

  “The most malicious motives can arise out of the most banal reasons.” N shrugged, as if this was commonplace to him. “In fact, as far as targeting your sister goes, these emails are much cruder and more pointless in their content and tactics than the Popcorn post. As for that photo attachment, it’s child’s play.”

  The mention of the picture made Nga-Yee doubt her sister all over again, but she couldn’t understand why N just said what he’d said.

  “Child’s play? Isn’t it an obvious threat to Siu-Man?”

  “Let me ask you, Miss Au, where’s the threat?”

  “Siu-Man is being accused of hanging out with unsavory characters, and this hints that her character is bad, so she must have been lying about Shiu Tak-Ping—”

  “So she’s canoodling with some guy. So what?” N grinned. “Most adults would think that’s no big deal. If Little Seven was trying to discredit your sister, wouldn’t they have gone for something more scandalous, like the photos I threatened those secret society goons with? A picture like this—you could make it public and no one would care.”

  “Maybe the culprit had other photos in reserve.”

  “That would make sense if this had been posted online. That’s how blackmail works, like squeezing toothpaste—you start with the more innocuous ones, then move on to nude photos, sex tapes, and so on, escalating the threat. But this was sent directly to your sister, which means there was no reason to hold back. Quite the opposite—you’d open with your strongest move to shock your victim into submission. It’s clear that this was the only picture Little Seven had.”

  Nga-Yee realized she’d been too caught up in the situation, seeing these threatening emails only as a big sister would. They’d arrived a whole month after the Popcorn post, and even if the sender hoped to revive the scandal, that might not have worked. N was right, this photo wasn’t particularly inflammatory. If it had come out at the same time as the post, it might have reinforced the point, but it didn’t actually add any new information. The online conversation had moved on, and making it public then probably wouldn’t have gained much traction.

  “So, to sum up, Little Seven knew your sister’s birth date, knew she was depressed, and used this photo as a half-assed threat in a moment of agitation. All these clues point to someone about your sister’s age who saw her every day. Most l
ikely one of her classmates. We could even deduce that when the Popcorn poster said ‘everyone at her school,’ his source for that was Little Seven. I think that gives us plenty of reasons to narrow our field of suspects.”

  “So … when you said an iPhone user—”

  “That’s from the ‘header thing.’ ” N smirked, pulling up the other screen.

  X-Mailer: iPhone Mail (11D257)

  “The iPhone’s email app would have added that string, and 11D257 is the model number, which means the iPhone’s operating system was iOS 7.1.2.” N leaned back. “So we just need to see which of your sister’s classmates have iPhones, and we’ll have our suspects.”

  Nga-Yee already knew that N was no ordinary mortal, but she had to marvel at him all over again. He was the real deal. She’d been staring at these messages for hours, while he’d needed a few minutes to pick up the salient points. She thought once again of Mr. Mok’s words and understood why a senior detective would have brought his insoluble problems to this unemployed drifter.

  “In that case,” said Nga-Yee slowly, trying to keep the admiration out of her voice—after all, she still loathed his arrogance—“you’ll need to go check up on every single one of Siu-Man’s classmates to see what kind of phones they have?”

  N let out a bark of laughter. “I really can’t make you out, Miss Au. Sometimes your brain seems to work quite fast, but other times you ask the most moronic questions. Have you forgotten what I told you—that there’s a type of data known as the user agent?”

  Nga-Yee recalled. When they’d been trying to find kidkit727’s registration info on Popcorn, the user agent had been the chatboard’s records of each client.

  N opened a new browser tab and pulled up Enoch Secondary School’s home page. “Your sister’s school is enrolled in the Education Bureau’s e-learning assistance program and has plenty of resources for setting up systems and networks. They have several servers and provide chatrooms for every subject, every class, and every club. The students are encouraged to use them for communication.”

  He pressed a few keys and brought up a chatroom with a minimalist design in shades of gray. A few more clicks, and he’d opened a discussion.