Bribery and Corruption Casebook: The View from Under the Table

CHAPTER 1

The Hot-Tub Highwaymen

TED WENDLING

As companions, William Lassiter and Larry Evans appeared to be an unlikely pair. An urbane, college-educated entrepreneur, Lassiter had carved out a lucrative niche in the domestic snow-removal market by patenting a durable, carbide snowplow blade guard that extended the blade’s cutting edge, thereby increasing its life span. In contrast, Evans was a high-school dropout, a crude, overweight, uncultured laborer who liked to hunt and fish. Evans’ grooming habits included a weekly toilette that he conducted in the privacy of his dingy office at the Ohio Department of Transportation (ODOT) in which he would cut his fingernails and toenails, leaving the yellowed clippings strewn under his desk.

Dissimilar as Lassiter and Evans were, fortune had cast them into an economic symbiosis that made them fast friends: Evans, the equipment superintendent at ODOT’s Cleveland district office, awarded millions of dollars in business to the Lassiter Blade Company. In turn, Lassiter treated Evans to all-expenses-paid trips to Las Vegas and spent thousands of dollars on fishing excursions aboard Captain Larry’s private Lake Erie charter fishing boat, the Walleye Warrior.

As the men bobbed together in Lassiter’s hot tub on a warm summer night, surrounded by other ODOT vendors and dancers from Lips & Sips, a Cleveland strip club, they toasted to their mutual success. Lassiter’s summertime soirees, dubbed Fat Man Soup parties by some of the dancers, were blue-collar bacchanalias that included other people who were feeding off of ODOT’s largesse: Craig Horford, a germaphobic information technology whiz whose climate-control company had a lock on all of the ODOT district office’s HVAC work; Dennis Pfister, the ODOT facilities manager who managed Horford’s contract and worked down the hall from Evans; and Jennifer Moore, a young Lips & Sips dancer who had clawed her way into Pfister’s wallet by duping him into believing that he had sired her four-year-old daughter. As Pfister often boasted to his ODOT colleagues, not bad for a 63-year-old.

Missing on this evening was Fred Waxman, another ODOT vendor who had helped furnish an apartment for Moore and had picked up bar tabs for Pfister all over northeast Ohio in exchange for hundreds of thousands of dollars in unbid ODOT garage-door contracts. Waxman had been invited but had been unable to attend. Also missing was Evans’ top purchasing official, Rick Rogers, who was working his own side deals with the Lassiter Blade Company and some of Evans’ other vendors.

Where’s Dennis? Lassiter asked Evans.

I think he’s in the house with Ruby, Evans responded. Lassiter, a divorced father who had left his wife for a stripper and now shared custody of their two daughters, had learned long ago that Evans and Pfister were a matched pair. But as fond as he was of Evans, he considered Pfister to be untrustworthy and a lecherous boor. Lassiter stalked into the house, quickly found the missing couple and escorted them outside. Sliding back into the hot tub, Lassiter hissed into Evans’ ear: They were in my daughter’s bedroom!

Building an Empire

District 12 of the ODOT is headquartered in the Cleveland suburb of Garfield Heights. One of 12 ODOT district offices that operated as virtual fiefdoms, it spanned three counties, employed nearly 500 people and had an annual budget of $50 million.

Two of the district’s largest divisions are Facilities and Equipment. They were headed, respectively, by Dennis Pfister and Larry Evans. Together, the men oversaw an empire that included the maintenance and repair of all buildings and structures as well as the purchase and maintenance of all trucks, snowplows, garage equipment and supplies, ranging from chain saws and weed-eaters to light bulbs and bug spray.

Pfister, Evans and their subordinates worked in a warren of offices down the hill from the district headquarters, where the white-collar bureaucrats were ensconced. The men’s mandate was simple: plow the roads in the winter and cut the grass and remove the roadkill from the highways in the summer. If you could accomplish that agenda, you could have the distinction of winning a rare public-sector award for organizational excellence from the Ohio Partnership for Excellence, which ODOT District 12 did, twice. But unfortunately for the taxpayers, you could also have carte blanche to commandeer ODOT’s entire purchasing and procurement apparatus for personal gain.

Thus it was that vendors who wanted maintenance contracts from ODOT were told by Pfister to pony up: out-of-state hunting trips, vacation junkets, bar tabs and cash — lots of it. Down the hall, vendors who sought ODOT equipment contracts were told by Evans that Lake Erie walleye and perch charter bookings aboard the Walleye Warrior — at $300 to $500 a day and up to $1,000 a day for executive charters that included strippers — were going fast.

Pfister’s and Evans’ various business enterprises were aided by the fact that ODOT empowered the two men with direct-purchasing authority, which allowed them to choose the companies from which they sought competitive bids. ODOT’s regulations regarding obtaining items that were not on contract were simple: purchases up to $1,000 required one quote, purchases up to $2,500 required two quotes, and purchases above $2,500 required three. ODOT also treated subsidiary companies as unrelated enterprises as long as they had unique tax identification numbers. Thus, three companies could share the same business address and the same corporate officers and still bid against one another as long as they had separate tax ID numbers.

This unusual practice gave Pfister and Evans wiggle room when dealing with the State Controlling Board’s mandate that Ohio agencies could spend no more than $50,000 per vendor per fiscal year for supplies and services that were not covered by existing contracts. The purpose of the $50,000 cap was to enable as many small businesses as possible to compete for State of Ohio business. Under ODOT’s tax ID policy, circumventing the cap was easy: as soon as Company A hit the $50,000 ceiling, subsidiary Company B would take over. For purposes of meeting the three-quote regulation, ODOT even accepted throw-away quotes from ineligible companies that had already reached the $50,000 cap.

As part of its fiscal oversight of its 12 districts, ODOT headquarters seemingly went to great lengths to track the vast quantity of supplies and equipment that the districts purchased by requiring that all purchases be entered into one of two computerized inventory-tracking systems. There was only one problem: ODOT had no method of ensuring that the products it was buying were actually entered into the two systems.

Swimming Trips

I was a newly hired deputy inspector general (IG) in the Ohio Inspector General’s Office in Columbus when my boss, Inspector General Tom Charles, forwarded me a two-sentence, typewritten allegation that had arrived in the mail: "Check into ODOT Boat Days. Fred Waxman has been taking Dennis Pfistler [sic] and other ODOT vendors fishing on Lake Erie." The note was unsigned.

Waxman owned Erie Overhead Doors, a state vendor. Pfister was his ODOT contract manager. If true, the trips constituted a potential misdemeanor ethics violation. After reviewing Waxman’s contract with ODOT and examining numerous invoices from Erie Overhead Doors, I asked ODOT’s accounting administrator to have one of her auditors review the previous year’s purchases from Waxman’s company. The audit identified $84,000 in questioned costs, including inflated labor rates that Pfister had approved.

Using the IG’s administrative subpoena authority, I summoned Waxman to Columbus for an interview. Based on several earlier phone conversations, I was unsurprised when he denied virtually every allegation. Sure, he said, he had sold garage doors, at fair-market value, to Pfister and a couple of other ODOT employees. But he had not overcharged ODOT a nickel, and he had never taken Pfister fishing. Instead, Waxman claimed, he, Pfister and some other men had taken Waxman’s 36-foot Tiara yacht out on Lake Erie and had gone swimming.

You’re lying, Fred, I told him. Grown men don’t go swimming together in Lake Erie.

Ted, I swear, I’m telling the truth, he insisted. There wasn’t a rod on that boat.

In the following weeks, I continued to hound Waxman, telling him that I was writing my report and that it would include a criminal referral to a county prosecutor. One day, he phoned me, clearly frantic. I’m a wreck, he said. I’ve lost weight and my wife doesn’t understand what’s wrong with me. I want to cooperate, but I want amnesty. I told him I would talk to my boss and the prosecutor but couldn’t promise him anything.

Okay, he said, "tell them this: I was paying Pfister. You can also tell them that I was telling you the truth. They were swimming trips, but there were strippers on the boat."

Waxman’s admissions made it clear that what was going on at ODOT District 12 involved more than mere ethics violations. In addition to Pfister and the strippers, other participants in Waxman’s ODOT Boat Days excursions were Evans, the ODOT equipment superintendent, and several other vendors over whom either Pfister or Evans had contract authority. It appeared that the investigation would require more resources. Given the fact that the matter now involved criminal allegations of bribery and contract steering, the IG also requested the assistance of the Ohio State Highway Patrol, which has jurisdiction over crimes that occur on state property. Unlike the deputies in the Inspector General’s Office, Highway Patrol investigators also have arrest powers and the ability to conduct search warrants.

In the following months, our office issued dozens of administrative subpoenas to ODOT vendors, banking institutions and other businesses, focusing on the vendors that had done the most business with Pfister’s and Evans’ divisions during the previous decade. As we pored through the boxes of records generated by the subpoenas, an interlocking web of schemes began to take shape, including what appeared to be the centerpiece of the conspiracy: almost all of Evans’ Walleye Warrior customers were ODOT vendors over whom either he or Pfister had contract authority. Illustrating Evans’ complete disregard to the impropriety of this mutual back-scratching arrangement was an entry on one of his calendars, noting that he was scheduled to attend mandatory state ethics training on a Wednesday morning. Later that day, along with five other days that week, Evans had booked fishing trips with ODOT vendors on the Walleye Warrior.

The searches also generated more evidence of improper gratuities and relationships: kill-it-and-grill-it hunting trips to game ranches in Texas to shoot wild boar and blackbuck, an exotic species of antelope imported from India, followed by cross-border visits to a Mexican brothel; a trip to Seward, Alaska, to participate in a salmon fishing tournament; hotel accommodations and meals in Las Vegas; bar tabs at Lips & Sips and other strip clubs throughout northeast Ohio; and golf outings at a private country club that featured strippers in various stages of undress frolicking with drunken ODOT vendors on the front nine.

The subpoenas were followed by the execution of search warrants by the Highway Patrol and our office at Pfister’s and Evans’ homes, as well as the homes or businesses of six ODOT vendors. Evidence seized during those searches included numerous computers and hard drives, hundreds of floppy discs and CDs and tens of thousands of pages of paper records. As teams of investigators fanned out at the spacious offices of the Lassiter Blade Company, Lassiter gathered his employees in a conference room to express his outrage and demand an apology. Larry Evans is a dear friend of mine, he thundered. He is a great hunter; I love to hunt. He is a great fisherman; I love to fish. I have done nothing wrong. Among the investigators, Lassiter would come to be known as the strippers and hams guy due to his infatuation with strippers and his habit of sending $50 gift certificates for HoneyBaked Hams to his ODOT contract managers at Christmas.

At Evans’ home, investigators found thousands of dollars’ worth of stolen ODOT tools and equipment, ranging from chain saws, to Weed Eaters, to welders. The search of Pfister’s home also turned up stolen ODOT equipment as well as a Ruger semiautomatic pistol with an illegal, handmade silencer.

Stored in the attic of Pfister’s garage was the blueprint to his scheming — a banker’s box filled with color-coded envelopes containing doctored ODOT quotes. The box was a virtual encyclopedia of fraud that included fictitious company letterheads, forged signatures of real and fictitious vendors and cut-and-paste competitive quotes that Pfister had meticulously altered by applying tiny dots of ink to the overlaid quotes to match the paper stock.

More Tips, Lips & Sips

Weeks of time-consuming work followed as my colleagues and I sifted through thousands of phony quotes and the huge trove of evidence seized during the searches. Providing me with what I call my Ahab moment (and fueling my obsessive hunt for Pfister) during these periods of drudgery were the words that Pfister had uttered to a cooperating bartender whom the Highway Patrol had secretly wired. Speaking into a microphone that had been inserted between the bartender’s surgically enhanced breasts, Pfister counseled her to lie under oath, telling her that the Inspector General’s Office was all bark and no bite. All they can do is write a report, he told her. I taped those words to my office door.

As investigators zeroed in on several bid-rigging schemes that were being carried out by Pfister and Evans, an anonymous call came in about Rick Rogers, Evans’ top purchasing guy. Check out RIP Cleanout Specialists, Rick’s private company, the caller said.

RIP was a home-foreclosure business. A check of ODOT records showed that the company had done more than $43,000 in work directly for ODOT and that Rogers had brazenly used his home address to invoice ODOT. On top of that, he had been billing ODOT for work that his company had not performed.

During an interview of Rogers, one of my incredulous colleagues asked him how he justified using RIP to buy cell-phone cases at a big-box discount store and then reselling them to ODOT at a 150 percent markup. I run a small business, Rogers answered without a trace of sarcasm. I’m in business to make money.

As the investigation demonstrated, he made plenty of it — lodgings at the Marriott for his wedding anniversary; contributions to a men’s hockey league that he managed; donations to his daughter’s gymnastics meet; and more than $25,000 in gifts and gratuities for rigging bids on the sale of $1.4 million in trucks and truck parts, including a membership to a private golf club. Among the phony truck-parts quotes that sailed past ODOT auditors were 20 quotes in which Rogers had transposed two letters in the company president’s last name.

I don’t know how that happened, he said.

Court Date

Eighteen months after the anonymous letter about Waxman and Pfister first landed on my desk, Deputy IGs Jim Canepa, Don Petit and I forwarded a nearly 500-count criminal referral to Paul Soucie, head of the Economic Crime Unit at the Cuyahoga County Prosecutor’s Office in Cleveland. The referral documented nearly $11 million in improper or questionable payments that had been made to ODOT vendors as a result of bid rigging or fraud or of the improper relationships that existed among vendors and ODOT purchasers. Our investigation also documented nearly $400,000 in gratuities and other improper payments that had been made to Pfister, Evans and Rogers by dozens of ODOT vendors. The payments included $227,000 that ODOT vendors had put into Evans’ pocket by chartering fishing trips with the Walleye Warrior.

Including exhibits and nearly 150 witness statements, our criminal referral filled 10 banker’s boxes. Soucie also asked us to design a pyramid chart that ranked our targets based on the level of their criminality. The pyramid included the names of 33 ODOT employees and vendors. Pfister topped the chart.

The prosecutor then scheduled 30-minute groveling sessions with the targets’ attorneys. The format for these sessions was the same: I would present a brief case synopsis and Soucie would follow by giving the attorney a glimpse of an eye-popping electronic adaptation of the referral. This was designed by a Highway Patrol colleague, and it hyperlinked every exhibit and witness statement to each defendant. Soucie would then end the session by presenting the state’s offer. The attorneys could take it or leave it and roll the dice at trial.

Pfister’s attorney, puffed up with feigned indignation and a five-figure retainer, was the last in the door.

Congratulations, Soucie told him as the lawyer took a seat. Your guy won the lottery. He’s the worst of the worst.

Tactically, the prosecutor elected to first handle the cases of nine middle-tier defendants who had fully cooperated and had agreed to plead guilty to low-level felony charges. Under normal circumstances, the defendants, who included three ODOT officials and six vendors, likely faced fines, restitution and probation. However, by the bad luck of the draw, the nine defendants drew Judge Kathleen Sutula, an imperious jurist who had earned a reputation as the toughest of the 34 judges on the Cuyahoga County bench. Again and again, the judge harangued the ODOT employees and vendors for consorting with strippers and contributing to the culture of corruption that permeated state and local government in northeast Ohio.

Let me guess: I’ll bet when you were out on the boat with the strippers, you told your wife that you didn’t even want to go but that it was business, right? she mocked one of the defendants.

Yes, your honor. That’s correct, the defendant answered sheepishly.

I feel sorry for your wife, the judge retorted.

With the exception of one vendor who had endured a double lung transplant and consequently was homebound and tethered to a respirator, the judge sentenced all of the defendants to six months in prison. Most of them, protesting that they were deeply sorry and that the sentence was unduly harsh, were frog-marched out of the courtroom in handcuffs. Nor was I spared her honor’s wrath. As I nervously recounted the state’s case against one of the defendants, the judge’s officious bailiff sidled up behind me, pulled my hands out of my pockets and ordered me to stand up straight at the lectern. For a moment, I considered the possibility that I might be headed for a stint in the Big House too.

As the first defendants — one by one — agreed to pleas and signaled their intent to cooperate with the state, my colleagues and I began to hear that Pfister was coming unglued. On the day that a 71-year-old vendor named James Wright was seated outside Judge Sutula’s courtroom, preparing to plead guilty to charges that he had paid Pfister more than $34,000 in cash bribes that he had handed to Pfister on the ODOT loading dock, Wright’s cell phone lit up with a call from an unknown number.

If you value your health and your family, you’ll take the Fifth, the caller said, referring to the Fifth Amendment right that protects citizens from self-incrimination.

Wright was stunned. The voice at the other end was unmistakably Pfister’s. A few weeks earlier, a mysterious fire in Wright’s garage had sent him and his wife fleeing to a nearby motel. In turn, a contractor who had been hired to renovate the garage had noticed that a silver Chrysler Town and Country minivan had been circling the block. He copied down the license plate number. It came back to Pfister.

My Highway Patrol colleagues traced the phone number from the call received by Wright to a gas station located about five miles from Pfister’s home. On the other side of the street sat Lips & Sips. A review of the station’s surveillance cameras confirmed that Pfister had made the call. The video clearly showed Pfister walking up to a cashier, handing her a dollar bill and receiving four quarters in change. The cameras then followed Pfister back to his silver van, where he drove up to an outdoor pay phone and made the fateful call to Wright at 8:57 a.m. — the exact moment that Wright’s phone lit up in the courthouse.

Going Back for Seconds

Armed with this evidence, the prosecutor obtained a warrant to conduct a second search of Pfister’s home. This one, however, would be different. At Soucie’s request, the judge had signed a no-knock warrant, giving officers the authority to forcibly enter Pfister’s residence.

At dusk on a warm fall evening, ten members of the Highway Patrol’s Special Response Team, traveling in an armored vehicle dubbed The Bear, rumbled through Pfister’s neighborhood in the bucolic suburb of Chagrin Falls. They were followed by an entourage of troopers and one deputy inspector general — me. As the Bear stopped in front of Pfister’s home, the ten SRT members rushed the front door. One jolt with a battering ram tore the door from its hinges. Within seconds, Pfister, who was watching TV with his wife, was in handcuffs and under arrest for witness intimidation.

Pfister’s dumbfounded neighbors watched the spectacle from their porches as my colleagues and I entered the house to search for evidence. Hanging on a coat hook near the kitchen was the jacket that Pfister had been wearing when he made the call from the pay phone. On the floorboard of the minivan, I found the hunting cap he wore that morning.

The second wave of indictments charged Pfister, Evans and Rogers, along with five vendors, with participating in an elaborate bid-rigging and kickback scheme that spanned more than a decade and cost the state millions of dollars. Pfister was indicted on 26 counts, including racketeering, bribery, theft in office, tampering with records and obstruction of justice. A second indictment charged Pfister with two additional counts of witness intimidation.

In all, 18 people were convicted, including six ODOT officials and 12 vendors. Of that group, 13 went to prison for sentences ranging from six months to seven years — Pfister’s term of incarceration. The defendants also were ordered to pay a total of more than $600,000 in restitution to ODOT.

Fittingly, Pfister was sent to prison on my last day at the Inspector General’s Office. I began my new job as chief of investigations at the Ohio Bureau of Motor Vehicles two weeks later.

Lessons Learned

Over the nearly three-year period that this case took to investigate and prosecute, my colleagues and I learned a great deal about how a byzantine network of laws and purchasing regulations can be circumvented by employees who are intent on stealing from the public.

In particular, I learned how to recognize some of the telltale signs of bid tampering: altered company letterheads and signatures, fictitious company names and principals, and fax headers showing that three ostensibly competitive quotes had been transmitted in sequence from the same fax machine. Unfortunately, although many of the quotes submitted to ODOT were clearly phony, the fraud was not discovered by ODOT auditors who were preoccupied with simply ensuring that the requisite number of quotes had been obtained.

Many state agencies in Ohio have regulations pertaining to secondary employment, requiring employees to request permission to operate private companies or work in the private sector. These policies ensure that state employees’ private business interests do not conflict with their public duties. ODOT, however, had no such requirement, which allowed Rogers and other employees to operate companies with impunity that enriched themselves at the taxpayers’ expense. The employees contended, falsely, that they were actually saving the taxpayers money. That is almost never true, and our investigation proved that it certainly wasn’t in this case.

By closely examining bidding patterns and noticing that Pfister, Evans and other ODOT purchasers often obtained competitive quotes from the same firms, we also identified a practice in which the winning bidder would subcontract a portion of the work to one or both of the losing bidders.

This was another method of circumventing the controlling board’s $50,000 cap, one that had been perfected by the Lassiter Blade Company and other ODOT vendors. It worked like this: after reaching the $50,000 ceiling on noncontract purchases, William Lassiter would contact two business colleagues and induce them to submit quotes to ODOT. When one of Lassiter’s colleagues won the bid, Lassiter would receive a subcontract from the winning bidder in exchange for a nominal finder’s fee. After receiving payment from ODOT, the winning bidder would forward the majority of the money to Lassiter, keeping only the finder’s fee.

Invariably, Lassiter and the other vendors also argued that they were only trying to save the taxpayers money. That proved to be patently untrue, particularly when you consider that Lassiter and the other vendors who utilized this method of bid fraud were factoring the kickback they paid to the winning bidder into the price for the job.

Recommendations to Prevent Future Occurrences

As a result of this investigation, the director of ODOT ordered more than 1,200 purchasing employees and their supervisors to undergo retraining on the ethical principles of purchasing, contract administration and the use of agency credit cards. These seminars, which occurred over a period of several months and included a representative from the Inspector General’s Office, addressed numerous weaknesses that our office identified in ODOT’s purchasing regulations.

Segregation of Duties

For years, ODOT had given Pfister, Evans and other ODOT purchasers unilateral authority to initiate and approve requisitions, order products and sign documents attesting that the items had been received. By allowing the same employee to authorize a purchase and also verify delivery, ODOT left itself vulnerable to employee theft of tools, equipment and supplies. After Evans, Pfister and Rogers were sent to prison, ODOT managers conducted an inventory check and discovered marine filters, motor oil suitable for boat motors and 55-gallon drums of heavy duty boat-cleaning solvent sitting on the warehouse’s shelves. Needless to say, ODOT’s fleet does not include a single boat. Evans had bought the products with a department credit card for the Walleye Warrior.

Credit Card Policies

ODOT issued credit cards to most of its purchasers to enable employees to make necessary emergency purchases of up to $1,000. However, ODOT’s policy did not require the card holder to be solely responsible for the card’s use, permitting supervisors to authorize purchases on their subordinates’ credit cards. This practice allowed Rick Rogers to charge thousands of dollars for work that was not completed on his employees’ credit cards. We recommended that such purchases be prohibited unless the supervisor’s request has been documented by the card holder, including the supervisor’s name and location of the delivery.

Require Signed Quotes

Although confessions and handwriting analyses confirmed that signatures had been forged on numerous quotes, the practice of allowing vendors to submit unsigned quotes made it easier to commit fraud. Again and again, we found that Pfister had typed up a phony losing quote on authentic blank company letterhead and included it in his bid package, allowing him to steer the purchase to a favored vendor. The losing vendors never knew the difference.

Prohibit Quotes from Related Parties

As explained earlier, ODOT policies permitted related companies to submit competitive quotes against one another as long as the firms had unique tax identification numbers. This policy spawned a practice in which ODOT purchasers would call an official at one company and ask for three competitive quotes — one from the official’s company and two from subsidiary firms. Over and over, we noticed that the fax headers on these quotes showed that they had been sent from the same fax machine on the same day and at the same time. This practice became so ingrained at ODOT that it was even utilized by ODOT purchasers who had no criminal intent but were simply lazy. After all, calling three people and getting three quotes is a lot more work than calling one person and getting three quotes.

Policy changes and ethics seminars alone will never deter employees and vendors who are committed to gaming the system. But creating an environment in which ethical principles and ethical behavior are emphasized, as well as closing glaring loopholes in the purchasing procedures of large and complex state agencies, can go a long way toward deterring the rampant corruption that permeated ODOT District 12 for more than a decade.

About the Author

Ted Wendling is chief of investigations at the Ohio Bureau of Motor Vehicles in Columbus. Prior to working as a deputy inspector general in the Ohio Inspector General’s Office, he had a 28-year career as an investigative reporter and editor at the Cleveland Plain Dealer and the Columbus Dispatch.

CHAPTER 2

Trouble Brewing

JAY DAWDY AND ANGELA CLANCY

For the past few years, Billy Hays, the president of Brew Corp., a regional coffee roaster, had noticed a decrease in profit margins that was troubling. The company’s revenues were consistently up, but margins kept shrinking. Hays knew that smaller profits meant less money in his pocket, and he didn’t like that. He wanted answers quickly. He pressed his longtime and trusted CFO, Sandy Dawson, to check it out. Then she had her best accountant, Luke Smith, analyze the problem.

Smith and Dawson met with Hays and gave him the news. Smith provided a very plausible explanation for the shrinking margins. It was simple; there had been a steady increase over the past several years in both repair costs and information technology (IT) expenses. Smith and Dawson explained to Hays that these increases were due to Brew Corp.’s outdated coffee-processing equipment and recent attempts to upgrade their old technology; they hadn’t invested in new plant equipment in many years. Also, their computer systems were dated and required more IT support than ever before.

Hays was embarrassed when he heard these explanations because he knew that Brew Corp.’s equipment was outdated. He had denied several requests to buy new plant and computer equipment in recent years. So, it seemed that Hays was the one causing the problem. He simply didn’t want to bite the bullet and spend the money to upgrade. He was nearing retirement, so the last thing he wanted to spend money on was new tools that he didn’t understand anyway. Instead, Hays wanted to squeeze as much money out of the company as he could before he retired.

The explanation Hays received from Dawson and Smith seemed plausible, but Hays was paranoid. He couldn’t believe they had to spend that much on parts and repairs or that IT expenses had gone up so significantly. He also wondered whether Dawson really knew what was going on inside the financials of the company. He kept asking himself, Did she work with Luke Smith and really drill down and get to the bottom of this problem? He had his doubts. In recent years, Dawson had become increasingly hands off and unconcerned with details. She simply wasn’t working as hard as she used to. But Hays kept telling himself that Luke Smith had performed the analysis, so it was probably spot on. Smith was simply the best accountant Hays had ever met. Any time Brew Corp. had a tough financial problem or when Hays had questioned Smith in the past, Smith had always come up with the right answer. Hays thought to himself, Smith is good. Damn good. Maybe he is too good?

People at Brew Corp. referred to Luke Smith by his nickname, Cool, which was short for Cool Hand Luke, inspired by the movie character played by Paul Newman. Smith was cool under pressure, smart as a whip and had done some great analysis for Hays in the past. But that little voice inside Hays’ head just wouldn’t shut up. So he asked lots of questions and tried to understand their explanations and challenge their analysis. He also looked for any hints that they were lying. After that meeting, he thought they were a little nervous, but seemed pretty certain of what was going on and provided the right answers. But Hays still thought he was missing something.

A Little Paranoia Isn’t Such a Bad Thing

Brew Corp. had been defrauded before. It never ceased to amaze Hays how crooked some of his employees were. Over the years, he’d witnessed plant employees steal coffee beans, delivery drivers pocket cash payments and others steal computers. One employee even tried to steal a 16-wheeler delivery truck.

As a result, Hays had taken significant steps to control fraud. This made him a darn good client for my firm, Gryphon Strategies. Hays believed in the investigative process. He liked catching the bad guys and making an example out of them. After some incidents of theft a few years ago, Hays invested in a state-of-the-art surveillance system that we installed. There were cameras everywhere — in the plant, in the executive offices and on the delivery trucks themselves. They could be accessed and viewed over the Internet; my firm did periodic security monitoring of the video feeds as part of an ongoing retainer relationship we had with Brew Corp. Cameras were activated by sensors, and certain cameras were set up so that if motion was detected during suspicious times, an e-mail would be triggered and we could investigate possible incidents. The cameras worked well and had acted as a great preventive control for thefts in the plant facility over the years. They were also a great investigative tool — as they demonstrated in this case.

Sunday at 1:00 a.m., shortly after Hays had been stewing over the decreasing margins at Brew Corp., the cameras were activated in the corporate offices and we received an e-mail alert. This had happened before when office workers had gone in late to catch up on work, but never at 1:00 a.m. on a Sunday. We watched the video and checked the key code access system to see who was there and what they were doing in the office at that hour. It was clear from the tape and access code that Cool Hand Luke had come into the office and stayed for two hours, leaving at 3:00 a.m. We called Hays on Monday morning to discuss the incident.

Hays was very surprised, indicating that Cool never worked on the weekends. Hays said, Cool is so damned smart, he gets his work done by noon each day! What the heck was he doing here on Sunday at 1:00 a.m.?! Hays also found the timing interesting because he’d just chewed out Cool on Friday over some profitability stuff. Hays asked us to determine whether Cool was up to no good. He explained that Brew Corp.’s repair and IT expenses were up significantly, profitability was down and he wasn’t very satisfied with Cool or Sandy Dawson’s explanations the Friday before. They gave me all the right answers, but it just doesn’t sit well with me. Look into Dawson too while you’re at it, Hays said before he hung up the phone.

Investigating Accountants and Beyond

Since we would be investigating the company’s accountants and examining the books and records, I knew I’d need help from a forensic accountant who could also perform data analysis. I called Angela Clancy from RGL Forensics. After hearing a little about the case, Angela said she had some great technology that she’d used previously and she couldn’t wait to get started.

Among the first things we did was download Brew Corp.’s general ledger to examine Cool and Dawson’s accounting entries, look for abnormal activity and perform other data analysis. We also immediately obtained a mirror image of their computer hard drives, including all of their e-mails, and exported those into a program that would help us visually chart them, examine e-mail trends and look for improper activity.

Cool logged into the accounting system shortly after arriving in the office at 1:00 a.m. We identified a number of entries that he made, mostly related to the approval and payment to suppliers. However, there were two invoices processed for a company named Exile Industries that supplied manufacturing parts for repairs. I remembered Hays mentioning that Brew Corp.’s repair costs seemed out of whack to him, so we made a note of these entries for additional analysis. Also, since Exile was the only parts supplier Cool accessed that night, I said to Angela, Let’s keep an eye out for anything else involving these guys. I also mentioned that we might want to perform a background investigation on Exile and some of the other vendors.

Angela’s data analytics and e-mail analysis was quite interesting. The software she used allowed her to map trends in e-mail traffic of who e-mailed whom and in what volume. Although Dawson and Cool e-mailed each other quite a bit, which was to be expected, we also identified a very high traffic between Cool and another employee, engineer Jane Brown. There wasn’t any real business reason for so many e-mails between Brown and Cool, so we drilled a little deeper. Upon first glance, a few of the e-mails between Cool and Brown seemed overly friendly and indeed flirtatious, so we decided to download Brown’s e-mails as well. At the time, we didn’t know if this was just an office romance or something more sinister. I remember asking Angela, Who is this Jane Brown and what is her connection to Cool? Through the computer forensics, we also captured and later analyzed instant messages between Cool and Brown that would provide insights later in the investigation.

We found an interesting trend between both Cool and Brown’s e-mail traffic that did not show up for Dawson’s e-mails. Independently, both Cool and Brown had a high volume of communications with the address [email protected]. The owner of the account wasn’t obvious from the e-mails we viewed, and checks with Gmail returned no registration information; however, there were a few references in the e-mails to Wild Bill and WB. We looked at some of these e-mails a little closer, and they seemed to be written in a sort of vague code. They appeared to be related to invoices that were being submitted and processed. We also saw references to both WB and Wild Bill in instant messages between Cool and Brown that mentioned some in-person meetings. Angela turned to me and said, We gotta figure out who Wild Bill is!

We wanted to examine the e-mails from Cool, Brown and ghostrider in more detail and run some keyword searches on their e-mails at some point. But in the meantime, we started conducting preliminary background investigations of Exile Industries as well as a few of the other vendors that Cool had accessed that Sunday morning. Most of the vendors checked out, but Exile grabbed our attention right away.

We ran all the standard checks on Exile through a variety of public records databases — corporate records, civil litigation, criminal records, bankruptcy filings, a variety of financial searches, derogatory media, and so on — and got immediate results. It turned out that Exile had declared Chapter 7 bankruptcy three years ago, had liquidated and gone out of business. Now the big question was: why were they still being paid by Brew Corp., and why was Cool processing their invoices at 1:00 a.m. on a Sunday? We were obviously on to something with Exile and we needed to dig deeper, so we pulled hard copy records for the company, including the corporate records and the bankruptcy paperwork, and determined that the owner of Exile was a guy by the name of William Panetta. Angela made the connection right away: Wild Bill?!

We conducted a similar background investigation of Panetta and found that, while he had severe financial problems around the time of the Exile bankruptcy, he seemed to have bounced back quite nicely in the past few years. Before the bankruptcy, Panetta was a financial wreck. Litigation checks showed that he’d been sued by numerous parties for nonpayment of debts resulting in a variety of liens and judgments. But Department of Motor Vehicle registration searches showed that, in the past year, Panetta had purchased a Mercedes SL550 Roadster and paid cash. Damn, that’s a nice car, I said to Angela, After his company went bankrupt, where did he get a hundred grand for a Mercedes roadster?

The data analytics had focused our direction — we knew about the connections among Cool, Brown and Wild Bill. Without these tools, we would have spent days going through general ledger accounts and e-mails and we would have missed some of the macro-trends as well as the details. Then some background investigation had helped take us to the next step by revealing that Exile had gone bankrupt and by connecting Exile and Wild Bill to a real person, William Panetta. Things were moving along well, but now we needed to look further into the details.

We started running analyses of all vendor invoices, particularly parts suppliers, to see how many suspicious payments there were. We were checking for things like out-of-sequence invoice numbers, excessive purchases and other trends that might represent questionable activity. Most of the purchasing activity seemed normal, aside from the purchases from Exile. (Those purchases had increased over the years, even after the company had gone bankrupt three years ago.) We examined the purchasing from Exile over the past five years in detail and saw that almost all of these purchases had been authorized by one person, Jane Brown.

Given these findings, as well as Cool’s and Brown’s connection to Panetta, we knew we had to focus the investigation on the three individuals and Exile. At this point we had circumstantial evidence that Cool, Brown and Panetta were very likely involved in a fraudulent purchasing and billing scheme. Now we needed to start talking to people and developing information regarding our three primary suspects. But first we wanted to gather some additional intelligence from other witnesses.

Since Brown had approved all of the purchases from the bankrupt Exile, we wondered why the normal receiving procedures at Brew Corp. did not flag these phantom purchases. We started our interviews with Brian Jones, the head of the receiving department. Jones and his employees indicated that instead of the parts from Exile coming through receiving, as was the normal process, Jane Brown would notify them that she had received the parts directly. She also provided them with related FedEx documentation, which they subsequently entered into their receiving log. Brown had explained to Jones that she did this because the replacement parts could be used for immediate equipment repairs so as not to affect Brew Corp.’s processing capacity. This explanation seemed plausible at the time, and, since Brown was providing the FedEx receipts as documentation, no one challenged her. None of the employees in the receiving department wanted to be responsible for a delay or shut down in production, so they didn’t raise any questions. We also interviewed some lower-level employees, including repair and plant personnel, who indicated they had no knowledge of using parts from Exile for repairs in the past few years. When we asked about Brown, they shared some scuttlebutt that she and Cool were involved romantically.

After receiving the explanation regarding the FedEx documentation, Angela asked for a database of the receiving log activity. The receiving department also provided us with the original FedEx documents that Brown had given to them as proof of delivery, which looked just like all the other FedEx receipts. Angela then exported the delivery data to the FedEx website, ran a comparison and bingo — all the deliveries that were supposed to have been received after the Exile bankruptcy returned Not Found in the FedEx system.

The Jig Is Up

Armed with all of this evidence, we were confident that we could prove there was a fraud, but we were hoping to get a confession from one or all of the parties involved to seal the deal. We also wanted their help in recovering some of the funds, if possible. Our analysis showed that purchases from Exile exceeded $6 million in five years, including close to $4 million since Exile went bankrupt. When we presented these findings to Hays, he was apoplectic, insisting that we lock those crooks up and find that money!

As the investigation unfolded, we collected other damning information proving that Cool and Brown had conspired with Panetta over a five-year period to engage in a kickback scheme initially and then, after Exile’s bankruptcy, in an outright fictitious vendor scheme.

We started by interviewing Panetta, since we felt he was the weak link of the three. After many denials, when confronted with overwhelming evidence and our explanation that we were really after Brown and Cool, Panetta confessed.

He described how the scheme worked and, as we suspected, pinned responsibility on Brown and Cool. He said his business with Brew Corp. was legitimate in the beginning but, after a few years, Brown, who had been ordering most of the parts from him, presented an opportunity for a kickback. She’d send more work his way if he kicked back 20 percent to her, and he could even raise his prices by 20 percent to offset the kickback. So that’s exactly what he did. Panetta went along with the scheme because he had recently divorced and needed the money from his continued business with Brew Corp.

Then, when his company went bankrupt three years ago, Brown said she could continue to feed him some additional cash if they kept the scheme up and Panetta didn’t have to do a damn thing — except operate as a front company and bill Brew Corp. as directed by Brown. After the bankruptcy, Panetta received 30 percent of the invoice totals for continuing the illusion and kicked the rest back to Cool and Brown. Panetta wondered how Brown could