Case Files: The Vault — 4 Full-Answer Files

Let me tell you something about water and bullets that Hollywood has been getting catastrophically wrong for about seventy years. A standard 9mm round — which is what roughly ninety percent of federal officers carry — loses the vast majority of its lethal velocity within three to five feet of entering water. That's the shallow end of a public pool where kids are splashing around.

The bullet doesn't just slow down. It destabilizes. It tumbles. It cavitates, meaning it creates this little pocket of vapor as it travels, and that process robs it of energy at a rate that would make a ballistics professor weep. By the time you're talking about six feet of water column between the muzzle and your bad guy, you've got a hunk of metal drifting at you with roughly the same threat profile as a strongly-worded letter. It will bruise you. It will not kill you.

Now — the entry wound is a different story. If your bad guy takes a round the instant he hits the water, or in those first twelve to eighteen inches, he can absolutely be killed. I worked a river pursuit years ago where the round caught him as he was diving forward at the waterline, entered at a shallow angle, and the coroner pulled it out of his lower back. Died forty minutes later on a riverbank.

Here's what nobody talks about — the officers at the edge of that pool are almost certainly violating about fourteen use-of-force policies by shooting into the water in the first place. If your bad guy is submerged and no longer presenting an immediate lethal threat, the justification for deadly force gets very thin very fast. You can't shoot someone for running away, and a man swimming underwater is, definitionally, running away.

There's also the ricochet problem. Rounds fired at a shallow angle into water don't stop — they skip. They deflect. They come back out at unpredictable angles and they do not discriminate between bad guys and the officer twelve feet to your left.

The real question is what happens next. Because the bad guy doesn't have unlimited oxygen. If officers maintain perimeter, the suspect has to surface eventually. I worked a drainage retention pond in August — guy lasted maybe four minutes before he came up gasping. Four minutes felt like forty. You're standing there weapon drawn, you can see him moving under the surface, you cannot legally shoot him, and you are waiting. That waiting is the scene your writer brain should be interested in. Not the shooting. The moment he has to choose between drowning and coming up to face whatever's waiting. That's where the psychology lives.

The clock you’re worried about isn’t Miranda. It’s the Fourth Amendment. This is where ninety percent of crime writers get it wrong, and defense attorneys make their living off that wrongness.

You can detain someone for investigation on reasonable suspicion — Terry stop. That’s maybe 20-40 minutes if you can articulate you’re still investigating. No Miranda required because it’s not custody. You’re not free to leave, but you’re not under arrest.

Here’s the tripwire: custody triggers Miranda. In California, custody isn’t handcuffs — it’s whether a reasonable person would feel free to leave. We use the same test as federal: location, language, duration, number of officers, physical restraint. The moment your suspect says “Am I under arrest?” and you say “You’re detained, you’re not free to leave” — congratulations, you just made it custody.

Real world? I bring him into the box within 15 minutes. I tell him: “You’re not under arrest, you’re detained, I want to hear your side before I decide what to do. You’re free to not answer, you’re not free to leave right now.” That keeps me in detention phase. I can get his story. If I like him for the crime, then I transition: stand up, take a breath, “I’m going to read you something, it’s procedure, we do it for everyone.” Read Miranda off the card, verbatim — don’t paraphrase. Get a “Yes, I understand” on recording, both audio and video if you have it.

The mistake TV makes is they Mirandize at the car. Real cops don’t. We Mirandize at the moment we need the statement to be admissible. In CA, if you interrogate after custody without Miranda, you lose the statement under Miranda, you might lose the fruits under Wong Sun, and your case becomes “corroboration only.”

If you want him to hold longer without Miranda, you need consent. “Are you willing to stay and clear this up?” On tape. Every 20 minutes, re-confirm. “You still good to talk? You can stop anytime.” That’s how we get 90-minute detentions that survive suppression hearings. It’s boring, it’s procedural, and it’s exactly what real interrogations sound like — which is why readers believe it.

Let me tell you something about ‘realistic’ timelines — the word doesn’t mean what writers think it means. Realistic means it could be four hours or it could be four months, and the difference between those two outcomes has less to do with detective skill than it does with whether the victim had a dentist who kept good records and a family who actually reports them missing.

I've had cases where we had a name before the body was cold because some patrol officer recognized the tattoo on the guy's neck from a prior arrest. I've also had a Jane Doe in the morgue for eleven weeks because she was a transient with no fixed address, no family looking for her, and teeth so bad the dental comparison was useless. The system doesn't process everyone equally, and if your writer instincts are already telling you that's ugly, good. You're paying attention.

The first thing we check — the very first thing, before the ME has even finished complaining about being dragged out at 3am — is fingerprints. That's your fastest lane if the victim has any kind of record, which statistically speaking, a lot of homicide victims do. The overlap between people who get murdered and people who've been processed by the criminal justice system at some point is depressingly large. We roll prints at the scene if the body is in any condition to allow it, or we do it at the morgue, and then we run them through AFIS — the Automated Fingerprint Identification System — which in the movies takes about forty-five seconds and returns a perfect match with a little ping sound. In reality it returns a ranked list of candidates and someone has to actually compare them, and if your field office's connectivity is having a bad night, which it always seems to be when you need it most, you're sitting there waiting while a dead stranger slowly becomes the ME's problem. If there's a hit, you can have a name in hours. If there's no record, you've just lost your fastest card.

After prints, you're looking at the body itself like it's a biography written in a language you have to translate. Tattoos are enormous — we photograph every single one and run them through gang databases, military records, prison tattoo registries. A man's ink tells you his affiliations, sometimes his geography. I worked a case where a victim had a very specific unit insignia tattooed on his forearm, and that one piece of art got us to the VA records that got us to his name inside of six hours. Then we've got physical characteristics — scars, surgical hardware, healed fractures visible on X-ray. The ME will pull X-rays and if this person broke a wrist badly enough to need a plate and screws, there's a lot number on that hardware that traces back to a hospital, a date, a patient. I have personally identified a body through a titanium knee replacement. The manufacturer’s rep was more helpful than half my colleagues that day, which should tell you something about departmental morale circa 2011.

Missing persons is running simultaneously with all of this. We're cross-referencing the physical description — height, weight, approximate age, race, hair color, distinguishing features — against every active missing persons report in the system, and then expanding that outward if nothing local pops. NamUs, which is the National Missing and Unidentified Persons System, is the federal database that's supposed to consolidate all of this, and it's genuinely useful, though getting local agencies to actually submit their cases in a timely manner is like herding cats in a hurricane. The coordination between agencies on unidentified remains is one of those areas where the policy looks great on paper and the reality looks like a fax machine in a flooded basement. Jurisdictional ego kills investigations. I have seen it happen. I watched a county sheriff's office sit on a Jane Doe for three weeks because the lead detective didn't want to admit he needed federal resources. Three weeks. She had a mother somewhere wondering.

DNA is the one everyone asks about because television has made it seem like the answer to everything, and it is a tremendous tool, but it is not a fast tool unless you're lucky or well-funded, and most homicide units are neither. You collect biological samples from the unidentified victim, submit them to the lab, and then you wait — and ‘wait’ in this context means weeks to months in most jurisdictions, because crime labs are chronically understaffed and homicide cases are not automatically front of the line over every other submission. If the DNA profile comes back and you have something to compare it to — a family member who submitted a reference sample, or a hit in CODIS — then you've got your answer. If you've got a profile with nothing to match it against, you've got very expensive information that doesn't tell you anything yet. Investigative genetic genealogy, the technique that caught the Golden State Killer, has changed the game for cold cases, but it requires additional resources, judicial considerations depending on your jurisdiction, and frankly a colder case than a fresh body. It's not what happens in hour one. It's what happens when you've failed at everything else.

The honest answer your fiction needs to understand is this: speed is almost entirely a function of the victim's visibility in systems that were built to track people who interact with systems. Documented people — people with jobs, criminal records, medical histories, families who use social media — get identified faster because they've left more footprints. People who live at the margins of society, the houseless, the undocumented, the deliberately off-grid, can be profoundly difficult to identify not because the techniques don't exist but because there's nothing for those techniques to connect to. And I'll tell you the darkest joke in this business — the one that's been making rounds in homicide units for as long as I've been doing this — is that the best way to ensure you get identified quickly is to have a record. Get arrested, get your prints in the system, and if you end up dead in an alley, at least we'll know your name by morning. The innocent and the clean are the hardest to find. You think about that one for a while.

Here's what I want you to take away from all of this, writer: the identification process is not a straight line, it's a simultaneous web of parallel tracks, and most of them go nowhere most of the time. The drama isn't in the breakthrough — it's in the hours before the breakthrough when your detective is running on vending machine coffee and the very specific despair that comes from not knowing who you're trying to avenge. Give your detective that weight. The unnamed body is the worst kind, because you can't fully fight for someone until you know their name, and until then you're just fighting for a number on a case file. That feeling — that specific urgency — is what separates the detectives who clear cases from the ones who just out paperwork. Write that. Write the not-knowing.

Let me tell you something about municipal infrastructure security that will simultaneously make your fiction more believable and ruin your ability to sleep at night.

Yes, it's absolutely possible, and in fact it's been done. Not just theoretically possible in the way that writers like to say ‘could this happen’ while hoping I'll say no and make their lives easier. I mean it has happened, it does happen, and in several documented cases it went on for “months” before anyone noticed. The city of San Francisco had parking meter skimming operations running. Los Angeles. Chicago. Various municipalities across the country have dealt with compromised payment kiosks, and the common thread in almost every single one of those cases is the same: nobody was watching. The systems were installed, the contract was signed, the vendor collected their maintenance fee, and the city IT department — which in most mid-sized American cities consists of two guys named Dave who are also somehow responsible for the mayor's email — moved on to worrying about something else. I've worked federal cases where critical municipal systems had default passwords that hadn't been changed since installation. Factory default. The kind of password that's literally printed in the manual that comes in the box. You want to know what's more depressing than a murder scene? A murder scene where you find out the killer got the victim's address from a parking app database that was protected by the password ‘admin123.’ I have seen this. I am not being colorful.

The monitoring question is where your fiction can get genuinely interesting, because the answer is a jurisdictional nightmare that would make a first-year law student cry. The parking meters themselves are typically managed by a city transportation or public works department. The payment processing runs through a third-party vendor — some private company that won a contract, probably the lowest bidder, definitely not the most security-conscious. The financial data, once it leaves that kiosk, passes through networks that might be regulated under PCI-DSS compliance standards, which is a financial industry standard, not a law enforcement one. So you've got the city, the vendor, the card networks, and potentially the bank, all of whom have some theoretical interest in this data and approximately none of whom are talking to each other in real time. The city transportation department isn't running a security operations center watching for anomalous transaction patterns. They're trying to figure out why meter seventeen on Fifth Street hasn't reported in since Tuesday.

Your villain's actual attack surface is interesting to think through, because there are a few different ways this works in practice. The dumb version — and this is more common than professionals want to admit — is physical skimming. Someone opens the meter housing, which in older systems can be done with a fairly standard tool, installs a card-reading overlay, and collects data passively. The smarter version, the one that gives federal investigators actual headaches, involves compromising the software either at the kiosk level or at the back-end payment processor. If your villain has any sophistication at all, they're going after the processor, because that's where all the cards from all the meters aggregate. Why rob one parking meter when you can rob the company that processes payments for four hundred of them? That's the kind of criminal logic I actually respect, in the deeply reluctant way I respect anything that makes my job harder.

Now, who investigates this when it finally gets noticed? And notice is ‘when’ it finally gets noticed, because it almost never gets noticed early, and when it does it's usually because a bank fraud analyst — some overworked kid making forty thousand a year — runs a pattern analysis and sees that the common point of compromise for three hundred stolen credit cards is that they were all used at parking meters in the same city within a thirty-day window. That analyst calls the bank's security team, the bank calls the card network, the card network calls the vendor, and eventually — eventually — someone calls law enforcement. At the federal level, this is Secret Service territory primarily, because they have jurisdiction over financial crimes and specifically payment card fraud. FBI Cyber Division also has a stake. The local police department finds out about it roughly when the Secret Service shows up and asks to use a conference room, which is both accurate and a genuine source of institutional resentment that your fiction should absolutely exploit.

The timeline gap is what kills me in these cases, and I mean that in both the figurative and occasionally literal sense because there were victims of identity fraud in cases I've touched whose financial lives were destroyed while the investigation was still trying to figure out when the breach even started. A compromise can run for six months before the pattern becomes visible. The data gets sold, sometimes multiple times, to fraud rings operating in Eastern Europe or Southeast Asia. By the time a detective in your fictional city is standing in front of a parking kiosk with a forensic tech trying to figure out what happened, the actual crime happened on a server in a country where we have limited legal reach and even more limited cooperation. The kiosk is a crime scene in the same way a getaway car is a crime scene — useful, but the real action happened somewhere else.

Here's what I want you to walk away with: the most realistic element you can put in your fiction isn't a genius hacker in a dark room. It's the six-month gap between when the crime began and when anyone realized it, and the absolute jurisdictional food fight that erupts once they do. Write the detective who finds out about this because a Secret Service agent calls and doesn't say thank you. Write the city IT guy who genuinely didn't know this was possible and now has to explain to his director why it's been running since March. Write the vendor's lawyer who shows up before the forensic team does. That's your story. The hack is almost the boring part — what's interesting is everything that happens in the silence afterward, while real people are losing their savings and nobody with a badge has any idea yet. That's the part that keeps me up at night, and I've been sleeping badly for twenty-two years.