BOSCH couldn’t put his finger on the look he saw on Kizmin Rider’s face when he and Edgar returned to the squad room. She sat alone at the homicide table, her laptop in front of her, the glow of the screen reflecting slightly on her dark face. She looked both horrified and energized. Bosch knew the look but didn’t have the words for it. She had seen something horrible but at the same time she knew she was going to be able to do something about it.

“Kiz,” Bosch said.

“Sit down. I hope you didn’t leave hair on the cake with the Kincaids.”

Bosch pulled out his seat and sat down. Edgar did likewise. The phrase Rider had used referred to making a miscue that tainted a case with constitutional or procedural error. If a suspect asks for a lawyer but then confesses to a crime before the lawyer arrives, there is hair on the cake. The confession is tainted. Likewise, if a suspect is not advised of his rights before questioning, it is unlikely anything he says in that conversation can be used against him later in court.

“Look, neither one was a suspect when we walked in there,” Bosch said. “There was no reason to advise. We told them the case was open again and asked a few basic questions. Nothing came out of any consequence anyway. We told them Harris has been cleared and that’s it. What do you have, Kiz? Maybe you should just show us.”

“Okay, bring your chairs around here. I’ll school you.”

They moved their chairs to positions on either side of her. Bosch checked her computer and saw the Mistress Regina web page was on the screen.

“First off, either of you guys know Lisa or Stacey O’Connor in Major Fraud downtown?”

Bosch and Edgar shook their heads.

“They’re not sisters. They just have the same last name. They work with Sloane Inglert. You know who she is, right?”

Now they nodded. Inglert was a member of a new computer fraud unit working out of Parker Center. The team, and Inglert in particular, had gotten a lot of play in the media earlier that year when they bagged Brian Fielder, a hacker of international reputation who headed a crew of hackers known as the “Merry Pranksters.” Fielder’s exploits and Inglert’s chase of her quarry across the Internet had played in the paper for weeks and were now destined to be filmed by Holywood.

“All right,” Rider said. “Well, they’re friends of mine from when I worked Fraud. I called them and they were happy to come in to work this because otherwise they’d have to put on uniforms and work twelve hours tonight.”

“They came here?” Bosch asked.

“No, their office at Parker. Where the real computers are. Anyway, we talked over the phone once they got there. I told them what we had – this web address that we knew was important but at the same time didn’t make any sense. I told them about going to Mistress Regina’s place and I think I pretty much creeped them out. Anyway, they told me there was a good chance that what we were looking for had nothing to do with Regina herself, just her web page. They said the page could have been hijacked and that we should be looking for a hidden hypertext link somewhere in the image.”

Bosch raised his hands palms up but before he could say anything Rider kept going.

“I know, I know, talk English. I will. I just wanted to take you step by step. Do either of you know anything at all about web pages? Am I making even any basic sense here?”

“Nope,” said Bosch.

“Nada,” said Edgar.

“Okay, then I’ll try to keep this simple. We start with the Internet. The Internet is the so-called information superhighway, okay? Thousands and thousands of computer systems all connected by a Telnet system. It is worldwide. On that highway are millions of turnoffs, places to go. These are whole computer networks, web sites, so on and so forth.”

She pointed to Mistress Regina on her computer screen.

“This is an individual web page that is on a web site where there are many other pages. You see this on my computer here but its home, so to speak, is on the larger web site. And that web site resides in an actual, physical piece of equipment – a computer we call the web server. Do you follow me?”

Bosch and Edgar nodded.

“So far,” Bosch said. “I think.”

“Good. Now the web server may have many, many web sites that it manages and maintains. See, if you wanted to have a Harry Bosch web page you would go to a web server and say put my page on one of your web sites. Do you have one that features morose detectives who never say much of anything to anybody?”

That got a smile from Bosch.

“That’s how it works. Often you have like-minded businesses or interests bundled on one site. That’s why when you look at this site it’s like Sodom and Gomorrah on the Internet. Because like-minded advertisers seek the same sites.”

“Okay,” Bosch said.

“The one thing the web server should provide is security. By that I mean security from anyone hacking in and compromising your page – altering it or crashing it. The problem is, there isn’t a whole lot of security out there on these web servers. And if someone can hack into a server they can then assume site-administrator capabilities for a web site and hijack any page on the site.”

“What do you mean, hijack?” Edgar said.

“They can go to a page on the site and use it as a front for their own intentions. Think of it as it is on my screen here. They can come up behind the image you see here and add all kinds of hidden doors and commands, whatever they want. They can then use the page as a gateway to anything they want.”

“And that’s what they did with her page?” Bosch asked.

“Exactly. I had O’Connor/O’Connor run a uniform resource locator. In effect they traced this page back to the web server. They checked it out. There are indeed some firewalls – security blocks – but the default passwords are still valid. They, in effect, render the firewalls invalid.”

“You lost me,” Bosch said.

“When a web server is first set up, there are default passwords necessary for first getting inside. In other words, standard log-on names and passwords. Guest/guest, for example. Or administrator/administrator. Once the server is up and running these should be eliminated to prevent compromise but quite often it is forgotten about and these become back doors, ways to sneak in. It was forgotten here. Lisa got in using administrator/administrator. And if she was able to do it, then any hacker worth his salt could have gotten in and then hijacked the Mistress Regina page. And somebody did.”

“What did they do?” Bosch asked.

“They put in a hidden hypertext link. A hot button. When located and pushed, it will take the user to another web site all together.”

“In English,” Edgar said.

Rider thought for a moment.

“Think of it as a tall building – the Empire State building. You are on one floor. The Mistress Regina floor. And you find a hidden button on the wall. You push it and an elevator door you didn’t even see before opens and you get on. The elevator takes you to another floor and opens. You step out. You are someplace completely new. But you couldn’t have gotten there if you hadn’t been on Mistress Regina’s floor and stumbled onto that hidden button.”

“Or been told where it was,” Bosch said.

“Exactly,” Rider said. “Those in the know can go.”

Bosch nodded at her computer.

“Show us.”

“Well, remember, the first note to Elias was the web page address and the image of Regina. The second one said, ‘dot the i humbert humbert.’ The mystery writer was simply telling Elias what to do with the web page.”

“Dot the i in Regina?” Edgar asked. “Click the mouse on the dot?”

“That’s what I thought but O’Connor/O’Connor said a hot button can only be hidden behind an image. Something about pixel redefinition that I don’t need to get into.”