The senior officer's connected businesses had received payments from an entity linked to the security contractor.
Not enough to explain the entire fraud.
But enough to raise serious questions about the officer's relationship to the scheme.
Then investigators recovered communications from devices and accounts obtained through appropriate legal processes.
Those messages included the instruction to intercept a woman in a green dress near Central Park.
The exact wording matched the officer's movements.
It described her appearance.
The handbag.
And the need to obtain documents before the meeting.
Another message contained the phrase:
Make her look like the problem.
The agent read that line three times.
Then looked toward the investigator beside her.
"Who sent it?"
He identified an account associated with the security director.
The agent felt anger rise.
Not because the message was surprising.
Because it was so casual.
A woman's reputation.
Her freedom.
Her dignity.
All treated as obstacles to be rearranged through a police encounter.
The investigator continued.
"We also found a payment authorization dated the morning of the stop."
The agent stared.
"To whom?"
He named an intermediary business connected to the senior officer.
She leaned back.
For several seconds, she said nothing.
Then asked, "Do we know whether the payment actually cleared?"
"Not yet. We're tracing it."
She nodded.
"Good."
Then she looked toward the copy of the police report.
The senior officer had described the encounter as an investigation into suspicious property.
He claimed the woman was uncooperative.
And he initially omitted the slap.
The rookie's account differed.
The witness videos differed.
And the officer's own communications raised questions about whether the stop had been arranged for a private purpose.
The agent looked toward the investigator.
"Whatever happens, we need to separate the evidence from the conclusions."
He nodded.
She continued.
"If he committed an offense, prove it. If the security director ordered it, prove that too."
Then she looked toward the message again.
Make her look like the problem.
Her expression hardened.
"And find out how many other people they tried to do this to."
The task force discovered that the security director hadn't gained access to the FBI's operational plan.
He had followed the procurement analyst.
The evidence came from several independent sources.
The security company's business records.
Witness accounts.
Travel and meeting information.
And video footage from locations along the relevant route, obtained through appropriate investigative channels.
The director knew the analyst was concerned about financial records.
He knew the man had been asking questions about false invoices.
And he'd instructed employees to monitor whether the analyst met outsiders.
When the source entered the charity hotel on the morning of the benefit, the director was present for the event's security arrangements.