Ithaca Mass Shooting Investigation - Tue, Oct 22, 2019

• The Handler summarizes that the team (Masticate) is still holding onto sensitive documents that should have been turned over to the Program:
  • A dead Russian witch’s notes.
  • A serial killer’s journal.
  • Other eldritch/occult materials connected to their prior cases.
• Philomena argues the materials are connected and that understanding them might be the only way to stop what’s happening “for good.”
• Frank Booth shuts that down quickly:
  • He asserts there is no stopping it, only slowing it.
  • He prioritizes control over comprehension.
  • He nevertheless agrees to read Kalamatiano’s notes and decide what (if anything) is safe to share.
• The Handler notes internal disagreement about the “safety” of using power:
  • McCarter tries to draw a line between “power that works through him” and the unnatural forces they fight.
  • The Handler frames it as unclear whether the rest of the team agrees with McCarter’s distinction.
• A time jump: the team gets about a year of an “approximation of peace,” but the trauma from Los Angeles causes everyone to withdraw further from friends/family.
  • McCarter moves to a cabin in the woods and largely isolates, while still resuming some Georgetown duties.
• In late October, Masticate is reactivated and brought to Washington, D.C. for a short briefing with Antonia Pitzarelli.
  • Pitzarelli has limited info, but says Program monitoring flagged an inquiry involving one of the few remaining Cornucopia House children.
  • Finn Smith (a Cornucopia House child; the youngest) had been at Peace Love Incorporated (the same adoption/refuge organization tied to Radomir Reznik).
  • Finn Smith’s name was changed via adoption to Bradley McKay.
  • Bradley McKay appears in national news: he is identified as the young man who committed a mass shooting at Cornell University and was killed during arrest.
• The team is told they are forming a new FBI task force under the classic cover of investigating terrorism:
  • They are to go to Ithaca, New York, take over the case, coordinate with local police, and determine whether McKay was touched by the same unnatural forces connected to Cornucopia House.

Travel to Ithaca / early open-source digging

• The team flies from D.C. to the nearest airport (explicitly identified as Ithaca Tompkins International Airport) and drives into Ithaca together.

• The Handler provides the publicly known outline of the event:

  • A young man broke into a sorority house on the morning of October 14.
  • He used a semi-automatic rifle.
  • He killed three sorority pledges.
  • He fled and was caught about 30 minutes later, then shot and killed during attempted arrest.
  • News framing: McKay is described as a loner who lashed out; officials claim there is no ongoing threat.

• Justin (prompted by Chris) does internet sleuthing / forum trawling:

  • He succeeds on a Computer Science / Search-style check (explicitly a success, with a roll of 31).

  • He finds campus discussion focused on the victims and identifies them as:

    • Kelsey Valentine (18).
    • Despi Sano (19).
    • Syndra Young (age not explicitly stated here, but she is identified as one of the pledges; all victims are described as freshmen).

  • The sorority is identified as Delta Phi Epsilon.

  • Discussion about McKay yields very little:

    • Some say they lived in the same dorm; he kept to himself.
    • No credible roommate claims.
    • A remark appears in forum chatter describing him as an “incel weirdo.”

• The team clarifies uncertainty about McKay’s student status:

  • Initially he’s described as 19 and a freshman; later the Handler revises that he must be a returning sophomore because he is “supposed to have some history at the school.”
  • The police file notes an administrative anomaly: school records/grades/attendance are missing/corrupted, and the school was working on providing them.

Ithaca Police Department handoff

• The team arrives at Ithaca PD headquarters, shows FBI task force paperwork, and is placed in a small meeting room.

• A detective arrives with a thick case folder:

  • He introduces himself as Detective Jim Hertz (spelled H-E-R-Z; there is repeated joking about “Hurts,” but the Handler emphasizes the intended pronunciation “Hertz”).
  • He requests to see their FBI paperwork and acknowledges the case is being transferred.
  • He makes it clear he thinks the federal takeover is “bullshit,” then leaves them to the room and the file.

• The case file contents and local police theory (as reflected in reports):

  • Physical evidence inventory includes:

    • McKay’s rifle.
    • McKay’s phone.
    • A laptop seized from his dorm room.
    • McKay’s clothing and wallet.
    • Interviews (dorm, parents, officers).

  • The file is being built toward a straightforward conclusion: disgruntled loner / lone shooter.

  • The police theory is supported by phone material indicating:

    • White nationalist forums content.

    • Men’s-rights / misogynistic radicalization content.

    • The file references images believed to be photoshopped: women at campus allegedly ritually murdering someone.

      • These images are not printed in the file; they are stored in the department’s digital evidence system (air-gapped / controlled access implied).

• Frank performs a Law check and succeeds:

  • He assesses the file as an ongoing case with missing “fill-in” work, but not obviously cover-up:

    • It looks like an under-resourced municipal department aiming for an “open-and-shut” narrative and not pulling every thread.
    • There is notably little forensic analysis writeup in the paper file; details are referenced but not fully developed.

Initial anomaly: the rifle metadata looks wrong

• Frank reviews the rifle evidence section with a strong Firearms capability (score called out as 61; treated as “pretty good”).

• The rifle is visually described as resembling a classic AR-15, but the evidence paperwork is strange:

  • The weapon was initially listed as an AR-15 and then amended to a “CAR 558” (a weapon designation Frank is unfamiliar with).
  • The rifle is listed as chambered in 5.58 mm (non-standard / not a recognized common ammunition size to Frank).
  • The serial number is recorded but has too few numerals to be valid for tracing.

• Frank attempts to look up “CAR” as a manufacturer and finds no registered gun manufacturer by that name / mark.

Transition to evidence room and meeting CSI Anne McKenna

• The team requests access to the physical evidence and the digital evidence system.

• Detective Hertz escorts them to the evidence room; Anne McKenna (crime scene investigator / evidence custodian) joins them.

  • McKenna expresses skepticism: “Really? This is a terrorism case?”
  • Hertz is visibly hostile about the case being taken from him; he suggests they’re “justifying their fat budgets.”

• The team pushes Hertz out:

  • Frank is aggressive and dismissive toward Hertz (including offering him $20 to leave; no roll required for the social dynamics, but McKenna is described as uncomfortable).
  • McKenna asserts she must oversee evidence transfer but tells Hertz he doesn’t need to be there; Hertz leaves and slams the door.

• Frank apologizes to McKenna for the discomfort and frames Hertz as the problem.

• McKenna provides context:

  • Hertz had “three open-and-shut homicides on the books” and is angry it’s being pulled.
  • McKenna states she is honestly glad the FBI is taking over because there are oddities in the evidence that bothered her.

McKenna’s walkthrough of the key evidence and anomalies

• Rifle

  • On the table: a black rifle that looks like an AR-15 at a glance.

  • McKenna explains:

    • It has an unregistered maker’s mark: CAR.

    • It is 5.58 mm, non-standard.

    • Ballistics confirm it is truly 5.58 mm.

    • It would require someone to manufacture custom rounds.

    • McKay’s parents claim:

      • No family firearms.
      • No knowledge of shooting.
      • They never taught him.

    • McKenna cannot explain how a college student acquired it.

• Phone

  • The phone is a cracked Samsung S9 (noted as “last year’s model”).

  • It’s plugged in and charged; screen is on; there is a smear of blood on the screen.

  • McKay’s parents bought it on a family plan.

  • McKenna highlights a suspicious app on the home screen:

    • Icon: a “vomiting smiley face.”

    • Label: “PICKY EATER” (all caps).

    • It is not on the Google Play Store; appears sideloaded / not normally distributed.

    • Their techs found it functions like a powerful VPN / traffic-routing layer (“everything on the phone goes through this app”).

    • Its stored data includes:

      • Cached websites for domains that don’t exist.
      • Logs with IP-like strings that look like IP addresses but are not valid (too many numbers).

    • McKenna describes it as “a web browser on steroids” in function.

• Laptop

  • The laptop present is an Alienware (described as a gamer-style machine).
  • McKenna reports the laptop is “fried” and local PD didn’t have resources to hire a specialist to revive it.

• Graphic photo set allegedly depicting sorority torture

  • McKenna shows the team a series of extremely graphic images from the evidence system:

    • The images depict young women at what looks like a party (beer pong / party atmosphere) skinning a young man alive and castrating him.
    • The images appear realistic to the team’s eyes; no SAN roll is required because the agents are described as adapted to violence.

  • PD analysis summary (as reported by McKenna):

    • Facial recognition identified principal faces:

      • The victim face matches Avery Bell, a Cornell student who is alive.

      • The women are identified as Emily Galperin, Sarah Donovan, and Ashley Holloway.

        • Galperin is a member of Delta Phi Epsilon.
        • Donovan and Holloway rushed but did not join.

    • The images are believed to be fake because the “victim” is alive.

    • PD tools found no signs of editing (no obvious Photoshop artifacts), but McKenna suggests the FBI might have better tools.

    • McKenna compared the room in the images with the sorority house:

      • Some similarities (e.g., a fireplace; similar angles) but she concludes it’s not the same room.

    • The images do not appear overtly occult/ritualistic:

      • They look like “bloody sadism” done “for fun.”
      • One image includes three women posing around the body in a heavy-metal/occult-style pose; one holds a Solo cup; they’re laughing.

• CCTV / surveillance footage timeline

  • McKenna brings up processed CCTV footage with timestamps of “interesting bits.”

  • The shooting is stated to be Monday the 14th a little after 10:00 a.m.

  • McKenna notes Cornell had begun fall break the previous Saturday:

    • Campus foot traffic is lighter; fewer people around; no classes in session.

  • Footage sequence:

    • 10:12 a.m.: first time McKay is caught on camera, walking on a sidewalk off campus, carrying the rifle openly; seen by a traffic light camera about two blocks from Delta Phi Epsilon.

    • 10:13 a.m.: at an intersection, McKay appears visibly confused:

      • He checks his phone repeatedly like a mapping app isn’t making sense.
      • He starts crossing then backtracks, indecisive.
      • A car pulls up and honks as the light changes while he’s in the street; he raises the rifle and points it at the car.
      • The car reverses and speeds away; the driver makes the first 911 call.

    • Sorority house security camera:

      • McKay kicks in the front door.

      • Kelsey Valentine goes toward the door and is shot immediately when it opens.

      • McKay moves into the main room and shoots Despi Sano multiple times (she appears stunned and doesn’t move).

      • Syndra Young flees toward the back; she struggles with a deadbolt and is shot before she can escape.

      • McKay then searches the house:

        • He moves back and forth, visibly agitated; appears to be yelling/raving (no audio).
        • He appears to be looking for something and not finding it.
        • He stays on the first floor; does not go upstairs.

      • 10:22 a.m.: he exits out the back door.

      • 10:23 a.m.: police arrive at the front and clear the building; bodies are found; movement of officers is visible on the cameras.

      • Syndra Young managed to call 911, but gave limited info; police already had basic suspect description from the earlier call.

    • 10:29 a.m.: surveillance catches McKay sprinting through a student parking lot:

      • He repeatedly stops at cars and looks into windows (hands cupped around eyes to see through glare).
      • He fires at a bystander at medium distance; the bystander takes cover and is not hit.

  • McKenna’s major unresolved CCTV anomaly:

    • There are cameras around McKay’s dorm and between the dorm and the first captured location.
    • They cannot find footage of him leaving his dorm, even accounting for possible window exit (a camera should have captured him briefly).
    • McKenna believes it may be possible to trace an unobserved path for part of the route, but the dorm-camera gap is still unexplained.

Evidence custody transfer

• McKenna and PD arrange formal transfer:

  • Chain of custody paperwork is completed.

  • McKenna asks if the team has a storage device ready for digital files; Justin provides external storage (implied he has a bag of tech).

  • McKenna notes PD policy normally restricts bringing personal devices into the evidence room, but since custody is transferring, the practical concern is reduced.

  • A tech oversees digital transfer; the team receives:

    • A banker’s box with evidence items (phone, laptop, etc.).
    • A larger box for the rifle.
    • Digital evidence files copied to their drive.

• Frank asks about ammunition:

  • Only the remaining rounds from the magazine are included (rifle is not loaded).
  • Rounds are bagged separately; they have McKay’s fingerprints.
  • No carvings/markings are noted on the rounds.

Evening wrap-up and hotel work (Justin’s forensic/technical progress)

• The team leaves around 6–7 p.m. and heads to a hotel to set up and review evidence.

• Justin begins working on the Alienware laptop:

  • He determines the laptop’s power supply is fried.

  • Options presented:

    • Cannibalize parts from his own gear to run it now, or
    • Acquire hardware (a new power supply) in the morning.

  • Justin opens the laptop and discovers a physical anomaly:

    • A chip is hand-soldered into the motherboard.
    • The soldering is sloppy but appears functional.

• Storage / drive structure findings:

  • Attempting to boot the drive directly fails due to unusual / undocumented BIOS behavior.

  • Justin mounts the drive as external storage instead:

    • Most data appears sequestered behind a storage structure managed by PICKY EATER.

    • He can access logs and some cached material, but there is a large encrypted data chunk he cannot access.

    • The logs show the same kind of nonsense as the phone:

      • “Domains that don’t exist.”
      • IP-like strings that do not match valid IP formats.

• Justin plans/acts to:

  • Order a replacement power supply.
  • Copy the encrypted data for later analysis.
  • Return the drive to the original computer after making his copy.

PICKY EATER app behavior and browsing history

• The team opens PICKY EATER on the phone:

  • It opens to a browser-like interface with a search window and history.
  • Testing a known “non-existent” domain results in no page load.

• Reviewing PICKY EATER history:

  • Many entries do not load.

  • Some do load, especially older entries:

    • McKay spent time on 4chan (including /pol/ implied by context).
    • The history shows an escalation consistent with online radicalization into “incel/manosphere” content.

• Evidence of a key contact:

  • Justin finds saved screenshots of chats indicating McKay communicated (using real names) with someone named Robert Wallace roughly about a year ago (timeline implied as during/around high school and later continuing).

  • Wallace encourages McKay’s paranoid fantasies about conspiracies of women in power keeping men weak.

  • Justin searches for mentions of PICKY EATER:

    • He does not find broad references in McKay’s texts/emails at first.

    • He does find a critical mention in chats with Wallace:

      • McKay thanks Wallace for a video that helped him get the chip installed correctly.
      • The referenced video is not on the phone.

    • The implication in the findings is that the chip and PICKY EATER are connected, and McKay got them from Wallace.

• Justin’s further internet research:

  • He finds only a few “breadcrumbs” about PICKY EATER in very obscure corners of the internet.
  • Those references appear to have been heavily scrubbed, and Frank notes (from Program experience) that the Program has deep ties into the NSA and uses that reach to scrub things from the internet.

Tracing Robert Wallace

• Justin pulls an IP address from a private chat interaction that used a direct IP connection.

• He traces it to Bangor, Maine.

• The team notes they have:

  • A name: Robert Wallace.
  • A location: Bangor, Maine.

• Frank texts Pitzarelli about Robert Wallace (explicitly phrased as suspicion of government affiliation); Pitzarelli replies that she will check.

Other leads identified from the police material and team review

• The team identifies multiple follow-up threads that local police did not deeply pursue:

  • Visit crime scenes personally:

    • The Delta Phi Epsilon sorority house.
    • McKay’s dorm room.

  • Interview/locate:

    • Avery Bell (the “victim” face from the torture images; alive; only cursory local interview noted).
    • Emily Galperin, Sarah Donovan, Ashley Holloway (women identified in the torture images; alibis were checked by local PD, but further inquiry remains possible).

  • University administrative anomalies:

    • Cornell’s enrollment/records systems are behaving oddly (McKay’s student records reported as corrupted/missing).

  • Officer involved in fatal shooting:

    • Campus police officer Wilhelmina Duff encountered McKay during arrest attempt and shot him; she is on administrative leave per policy.

Assessment of McKay’s demeanor on video (HUMINT attempts)

• Chris asks whether McKay’s movements resemble Justin’s earlier trance-like “confident purpose” (from prior campaign events).

  • The Handler answers: No.

    • Justin moved with quiet confidence and intention.
    • McKay appears confused, hesitant, and distressed—especially at the intersection and while searching the house.

• HUMINT checks are rolled while scrutinizing the video:

  • Chris rolls 62 (a failure) while trying to read McKay’s intent/search behavior.

  • Matthew rolls 00 (a severe failure) when attempting to interpret the footage.

  • Despite failed rolls, the Handler emphasizes observable basics:

    • McKay does not look like a hardened killer.
    • He appears shaken by what he’s done.
    • He seems disoriented and searching for something specific but failing to find it.

Firearm closer inspection

• Frank examines the rifle more thoroughly:

  • Confirms the reported anomalies are accurate:

    • “5.58” stamped on the weapon.
    • Serial number too short for standard tracing.
    • Maker’s mark “CAR.”

  • Assesses build quality:

    • Even though it appears untraceable and bespoke by documentation, the weapon looks industrially manufactured.
    • If made in a basement workshop, the builder would need extremely high-end tools and expertise.

• The ammunition is also stamped 5.58 and appears commercially manufactured in its finish/consistency, despite the caliber being non-standard and not something you can buy normally.

End-of-session direction

• The team concludes the first push of the investigation with key unresolved questions:

  • How McKay acquired a seemingly industrial-quality, bespoke 5.58 rifle and matching ammunition.
  • What PICKY EATER is, how it relates to the motherboard chip, and why it routes/locks data behind encryption.
  • How McKay appears on camera carrying a rifle without any dorm egress being captured.
  • Who Robert Wallace is (and why Bangor, Maine) and what role he played in supplying chip/PICKY EATER and encouraging McKay.

• The session ends as the team prepares to pursue these threads next time, with an immediate next intended lead being McKay’s dorm room and further follow-ups stemming from the evidence review.