"You take all the data available during the time frame when the incidents occurred, not just from the Port Authority systems, but from StationSec, StationCommCentral, TransportLocal, the distribution kiosks, the door systems that allow people to enter their private quarters, anything that saves an ID that tells you what someone was doing at the specific moment when we know the perpetrator was active, and you compare it to the list of potential operators to start eliminating them. It’s going to be harder because your surveillance is crap, but it can still drastically reduce the suspect pool." She didn’t react and I added, "If we know someone is in the station mall accessing a food kiosk at the exact time the transport suffered the catastrophic failure, then they can be eliminated as a suspect."