He Named the $40M Tax Fraud Trace After Himself — Then the Grand Jury Required Her Forensic Software License Number

 

The adding machine tape fed through her fingers the same way it always did — a strip of thermal paper, slightly warm from the machine, the numbers printing as she keyed each transaction total.

Dr. Nadia Hasan had been using the adding machine for eleven years. The machine itself was an anachronism in a forensic accounting practice that ran Palantir Forensic Financial Edition and three monitors and a document management system with half a terabyte of case files.

She used the adding machine because it was faster for her, in the specific task of manually checking transaction subtotals before entering them into the software. Her hands knew the keys. The tape printed the total. She looked at it. If it matched the software entry, she moved on. If it did not, she had a discrepancy to investigate.

She worked the rubber band off the tape roll with her thumb and unrolled a fresh section.

Priya was at the adjacent desk. She was 26, a junior analyst, and she had been working under Nadia on the Harmon trace for six months. Today she was cross-referencing the incorporation dates for Entities 11 and 12 against the banking records — a check Nadia had assigned yesterday after she found a timing pattern that suggested Entity 11 was incorporated specifically to receive a transfer from Entity 12 before Entity 12 dissolved.

The Harmon trace was a shell company network — fourteen entities across six jurisdictions. The beneficial owner was not visible in any single entity’s records. He was visible in the pattern: the nomination timing, the director loops, the dormancy periods.

He appeared in the network graph the way a face appears in a Magic Eye image — not visible until you adjusted the focal length, then impossible to unsee.

She had identified the link between Entity 9 and Entity 14 in month four.

The link was a nominee director — a person who appeared on the director registry of both entities within a 22-day window, in a jurisdiction that allowed nominee directors, at a time when both entities were transacting with a third entity in a different jurisdiction.

The nominee director was not the beneficial owner. He was the connector. His brief appearance on two registries, in the same 22-day window, linked Entity 9 to Entity 14 in the network graph in a way that no single entity’s documentation revealed.

She had documented this in a working paper she sent to Harmon in month four.

He had called her after receiving it: “This is the link the DOJ needs. Can you produce the graph in a format they can use?”

She had said: “Yes. The Palantir FFE output format is what DOJ accepts for digital evidence.”

She had exported the graph in Palantir FFE native format. License #PFF-8841 was in the file metadata. License holder: Dr. Nadia Hasan. The file was 4.2 gigabytes.

She had sent it to Harmon.

—

She read the press release after the arrests.

She had been at her desk, working on the entity transaction matrix for a different case, the adding machine tape in her hand. She had set the tape on the desk, not in the drawer, when she opened the browser.

DOJ press release, Case Announcement. She read it.

“The Harmon Financial Trace — a sophisticated IRS Criminal Investigation methodology developed by Special Agent in Charge Harmon — identified 14 shell entities across 6 jurisdictions and established the beneficial ownership pattern underlying the $40 million tax fraud scheme.”

She read “IRS Criminal Investigation methodology.”

She read “Special Agent in Charge Harmon.”

She read “forensic accounting support.”

She put the press release down. She picked up the adding machine tape. She rolled it and stretched the rubber band around it. She opened her desk drawer and put the tape inside. She closed the drawer.

She opened the Palantir FFE software. License #PFF-8841. The Harmon graph was still in the file archive — the entity network, the Entity 9-14 link, the nominee director at the center. She looked at it for three minutes.

She closed it.

—

She had been in the month-six DOJ coordination meeting. Harmon had been presenting the shell network diagram to the prosecution team. She had made the diagram.

A prosecutor had pointed to the Entity 9-14 link and asked: “How did you identify this connection? It’s not visible in either entity’s public record.”

Harmon had said: “Pattern recognition — our methodology looks at nomination timing relative to incorporation dates. When you see two nominees in the same 22-day window across jurisdictions, that’s a signature.”

That was her methodology. She had described it in the working paper she sent in month four. She had explained the 22-day window to him specifically, in that paper, on page 3.

He had read the paper. He was describing it now as “our methodology.”

After the meeting, he had emailed her: “Can you send me the technical detail on the Entity 9/14 link? Got a follow-up question from the prosecutor.”

She had sent him a three-page explanation. She had saved the email chain.

She opened the new case file. She had a transaction matrix to build.

—

She had spent nine months on the Harmon trace.

The first three months had been entity mapping — pulling corporate registry records from six jurisdictions and building the initial entity inventory. Fourteen entities at the end of month three, but the connections between them were not yet clear.

The entities looked unrelated. Different names, different jurisdictions, different registration dates. She had loaded them into the Palantir FFE software and started mapping the transactional relationships.

The software produced a graph. The graph was not the analysis. The graph was the visualization tool. The analysis was the decisions she made about which connections were significant and why — which timing patterns indicated coordination rather than coincidence, which nominee director appearances were functional rather than administrative, which dormancy periods aligned with the transaction windows in the banking records.

The Entity 9-14 link had required six weeks to establish with the confidence she needed to write the working paper.

She had found the nominee director in month three — a name that appeared on both registries — but one appearance in two registries was not unusual. Directors sat on multiple boards. The key was the 22-day window.

The 22-day window required cross-referencing the incorporation date of Entity 14, the date of the first transfer from Entity 12 to a third-party entity, and the date that the nominee director’s appointment was registered in the jurisdiction’s corporate records.

The 22-day window was the period between the director’s appointment at Entity 9 and the director’s appointment at Entity 14. It was short enough to be deliberate and specific enough to be a signature.

She had documented the calculation on three pages of the working paper.

Priya had read the working paper. She had said: “This is what makes the whole network visible.”

Nadia had said: “When you see the 22-day window in both registries, you’re looking at a structure, not a coincidence.”

She had sent the paper to Harmon on a Monday in month four.

The DOJ prosecution team used “the Harmon Trace” as shorthand in every document.

Nadia read the case coordination emails — she was on the distribution list as forensic accounting support. The prosecution timeline, the evidence schedule, the witness list: “Harmon Trace analysis,” “Harmon Trace graph,” “as established by the Harmon Trace.” Her name appeared in the evidence schedule once, in the exhibit list: “Exhibit 14-G: Palantir FFE output, provided by forensic accounting.”

Priya had read one of the emails over her shoulder. She had not commented. She had gone back to her cross-referencing.

Nadia had gone back to her transaction matrix.

—

The defense motion arrived in her email on a Tuesday morning, forwarded by DOJ prosecutor Elena Vasquez.

Subject: Defense Motion — Admissibility Challenge — Exhibit 14-G — Harmon Trace Graph.

Defense counsel had filed a motion challenging the admissibility of the shell company graph on two grounds: first, that the software that produced the graph was not disclosed in the evidence documentation and may not be properly licensed for forensic use; second, that the chain of custody for the digital evidence file was incomplete, lacking the authentication documentation required under Federal Rule of Evidence 901.

FRE 901 required that digital evidence be authenticated by a competent witness — specifically, a witness who could testify to the software’s functionality, the accuracy of its output, and the licensing under which it was produced. The defense was arguing that the government had not identified who that witness was.

The motion specifically requested: the software license documentation for the program used to produce Exhibit 14-G, the software’s name and version, the license holder’s identity, and a native-format file export from the licensed software, with the license metadata embedded.

She closed the email.

She opened the Palantir FFE software. License #PFF-8841. The Harmon case graph was still in the archive. She looked at the Entity 9-14 link in the center of the network diagram — the nominee director, the 22-day window, the connection that was invisible until it was not.

She took the adding machine tape out of the drawer. She put it on her desk. The rubber band was still around it.

She did not call Harmon. She opened the new case file she had been building and kept working. The new client’s entity structure was simpler — nine entities, two jurisdictions — but there was a timing anomaly in the banking records that she had not resolved. She opened the transaction log and went through it.

—

Harmon read the defense motion that afternoon. He had handled challenges to digital evidence before. He called his DOJ technology coordinator and told them to prepare the software documentation.

He was confident. The technology coordinator would pull the software specs, identify the license holder, and produce the documentation. This was a standard evidentiary housekeeping matter.

He went to his next meeting.

—

She had built the new case entity structure from the banking records Priya had extracted that morning.

The client was a tax authority in a different jurisdiction — not the IRS, a state-level revenue agency — and the scheme was smaller: nine entities, two jurisdictions, an estimated $4 million in unreported income. The scale was different.

The structure was the same. Entities designed to obscure a beneficial owner, corporate registries that looked clean in isolation, banking records that required a timing analysis to reveal the pattern.

She was three weeks into the new case. The Entity 4 timing anomaly had appeared in week two. She had flagged it and continued building the entity inventory before returning to it. The anomaly was real: the three-day gap between the banking transfer and the corporate registry update was within normal processing time for the jurisdiction, but the entity dissolved four days after the registry update, which was not normal.

Entities dissolved after they completed their purpose. This entity’s purpose appeared to have been receiving and forwarding the transfer.

She had a working hypothesis. She would test it when she had Entity 7’s records loaded.

She kept working.

The defense motion was on her desk, printed out. She had re-read it twice. The FRE 901 language was precise: the authentication witness must have personal knowledge of how the software produced the output and must be able to testify to the accuracy of that output. Personal knowledge.

She had personal knowledge of how Palantir FFE produced the Harmon graph. She had operated the software. She had made every analytical decision the graph represented. She had produced every export.

The IRS had not operated the software. Harmon had not operated the software. No one at the IRS had personal knowledge of how this specific graph was produced.

She had the personal knowledge.

She had kept the rubber band on the tape roll and put it on her desk.

The DOJ technology coordinator had found the answer in forty-five minutes.

The software that produced Exhibit 14-G was Palantir Forensic Financial Edition — a specialized graph analysis platform used in financial crime investigations. The IRS Criminal Investigation division used a different platform: CLEAR, a Thomson Reuters product designed for identity and address verification.

The IRS did not hold a Palantir FFE license in its standard software inventory.

The technology coordinator had then looked up the license documentation for the Palantir FFE file in the exhibit. The metadata embedded in the native-format file read: License Holder: Dr. Nadia Hasan, Practice: Hasan Forensic Analytics LLC, License ID: PFF-8841.

She was not an IRS employee. She was a forensic accounting contractor.

The coordinator had gone back to the defense motion. FRE 901 authentication: the software must be authenticated by the licensed operator of the producing software. The licensed operator of PFF-8841 was Dr. Nadia Hasan.

The coordinator had gone to Harmon’s office.

He had told him.

Harmon had looked at the defense motion. He had looked at the Palantir FFE file metadata. PFF-8841. Dr. Nadia Hasan. He had described this analysis at nine DOJ coordination meetings as “our trace methodology.” He had not operated the software. He had not held the license. He had presented the outputs that the licensed operator produced.

He thought about the working paper she had sent in month four. He had read it. He had understood enough of it to describe the methodology in general terms. He had described it in general terms.

He had described the 22-day nomination window as “our methodology.” His description had been accurate in its conclusion — the 22-day window was the signature — and incorrect in its attribution. The methodology had been developed in the working paper he had read on a Tuesday in month four, and he had not said her name when he described it.

He was now in a position where the prosecution’s entire shell company case — fourteen entities, six jurisdictions, $40 million — depended on a software license he did not hold and could not acquire retroactively.

He called Nadia.

—

The adding machine tape was on her desk, still with the rubber band around it, when the call came. She had been working on the new case timing anomaly. She had found the anomaly: a three-day gap between the banking transfer records and the corporate registry update for Entity 4.

Three days was not unusual in normal banking. It was unusual when the entity involved dissolved immediately after the gap.

She was making a note in the case file when Harmon called.

He said: “The defense motion. The software license documentation. PFF-8841 is your license.”

She said: “Yes.”

He said: “We need you to certify the graph output and produce the native file for the FRE 901 authentication.”

She said: “I’ll have it to Elena Vasquez by tomorrow.”

She put the phone down. She made a note about Entity 4. She opened the Palantir FFE software.

—

She had known from the beginning that PFF-8841 was in the file metadata.

Not as a strategic consideration. As a technical fact. Every file Palantir FFE produced carried the license ID of the registered operator. The software was a licensed forensic tool, and the licensing architecture was designed for exactly the reason the defense motion had raised: chain of custody.

The file metadata was the chain of custody. It said who had produced the analysis and under what credential.

She had not thought about the FRE 901 implications when she exported the Harmon graph in month five and sent it to Harmon. She had thought about the graph. She had been focused on whether the entity network was complete, whether the Entity 9-14 link had enough transactional support to be admissible in addition to the registry pattern, whether the visual layout of the graph made the beneficial ownership structure clear to a non-specialist.

The license metadata was automatic. She had not added it. It was there because she had opened the software under her license and exported the file.

She understood, reading the defense motion for the second time, that the fact she had not thought about the FRE 901 implications was the point. She had produced the analysis because she was the person qualified to produce it.

The credential was in the file because she was the person who had operated the software. These were not separate facts that she had managed strategically. They were the same fact: she had done the work.

The Entity 4 hypothesis was still open. She had the Entity 7 records loading in a separate window.

She kept working.

She opened the Harmon case archive in the Palantir FFE software and re-exported the entity network graph in native format.

The re-export generated a new file with the current timestamp but preserved the original analysis data. License #PFF-8841 appeared in the file metadata automatically — the software embedded it at export, not as a manual entry, but as a function of the license registration. Every file the software produced under this license bore PFF-8841. She could not export a file without it.

The native format was a .pffe file — a Palantir Forensic Financial Edition proprietary format that preserved the graph topology, the entity attributes, the link weights, and the analytical annotations she had added during the nine-month trace.

The file was not readable by standard document viewers. It required Palantir FFE to open. The file’s authenticity could be verified by the software’s licensing authority against the registered license holder.

She attached the file to an email to Elena Vasquez. She included the license certification document — a PDF from the Palantir licensing registry confirming that PFF-8841 was issued to Dr. Nadia Hasan, Hasan Forensic Analytics LLC, active since 2019.

She wrote a three-paragraph authentication declaration: the software’s name, the version, the license ID, and her attestation that the graph was produced under her operation of the licensed software.

She sent it.

She went back to Entity 4.

—

The defense motion was denied.

Vasquez emailed her that afternoon: “Dr. Hasan — your Palantir certification resolves the FRE 901 challenge. The graph is admitted. You’ll be cited as the forensic analyst of record in the prosecution memorandum. The license number PFF-8841 will appear in the federal evidence record.”

She read “the forensic analyst of record.”

She read “PFF-8841 in the federal evidence record.”

She opened her desk drawer. The adding machine tape was not in it — she had taken it out when the defense motion arrived. It was on her desk, rubber band around it. She picked it up. She worked the rubber band off with her thumb and unrolled a section of tape. She set it on the adding machine and pulled the first transaction total from the new case file.

The machine printed the total.

She entered it into the software.

—

Priya stopped by her desk the following morning. She said: “PFF-8841. Your number.”

Nadia said: “Yes.”

She said: “The Entity 9/14 link.”

Nadia said: “Yes.”

Priya went back to her desk. She said nothing else.

Harmon called after the motion was denied. “Good outcome. Your license was the key.” She said: “The chain of custody is in the file metadata.” He said: “Right. Going forward, I’ll make sure the attribution on forensic tool outputs is clear in the case documentation.” She said: “Yes.” He said: “Good work, Nadia.” She said: “Thank you.”

She rolled the adding machine tape back up. She put the rubber band around it.

The prosecution memorandum was filed the following week: Lead Forensic Analyst: Dr. Nadia Hasan, CFA/CFE, PFF-8841. At the grand jury, Harmon testified that the graph analysis was conducted by Dr. Nadia Hasan and that he lacked independent expertise to authenticate the software output.

She received the memorandum by email. She filed it in the Harmon case folder.

She opened the new case entity matrix.

—

The grand jury evidentiary record was filed the following Thursday.

She received a copy of the relevant section from Vasquez: “The court record reflects the following in the evidentiary findings: Exhibit 14-G — Palantir Forensic Financial Edition shell company network analysis, produced by Dr.

Nadia Hasan, CFA/CFE, license PFF-8841, Hasan Forensic Analytics LLC. Authentication provided pursuant to FRE 901(b)(9) by the software’s registered operator. The graph is admitted as forensic digital evidence. Lead Forensic Analyst: Dr. Nadia Hasan.”

The language was permanent. Federal court records were public and maintained indefinitely. PFF-8841 was in the evidentiary record with her name.

She had the Harmon case email chain saved in the practice’s secure email archive — including the month-four email with the working paper, the month-six “can you send me the technical detail” email, and the prosecution memorandum. She had saved the chain in real time, as each email arrived.

She had not saved it specifically in anticipation of the press release or the defense motion. She had saved it because she saved all substantive case correspondence.

The chain was 47 emails, from month one of the engagement through the FRE 901 response.

She kept the archive.

She opened Entity 7’s records. The hypothesis held: Entity 7 had been incorporated one day before Entity 4’s transfer, in a jurisdiction with a one-day processing time for corporate formation. The timing was not a coincidence. It was the structure.

She opened the Palantir FFE software and began loading the nine-entity graph.

She stretched the rubber band off the adding machine tape and unrolled the strip until she reached the first blank section. The thermal paper was warm from being in her hand. She set the roll on the desk and ran the first transaction total through the adding machine — the mechanical keys clicking in the quiet of the office.

The tape advanced. She read the total. She entered it into the Palantir FFE terminal. License #PFF-8841 was in the active license panel.

The prosecution memorandum was in the Harmon case file — “Lead Forensic Analyst: Dr. Nadia Hasan, CFA/CFE, PFF-8841.” Priya was at the adjacent workstation, cross-referencing the new client’s incorporation dates.

A Google Alert had come in that morning — another “Harmon Financial Trace” mention in a law review article. She had closed it. She unrolled the tape to the next blank section. She entered the next total.

—

The new case was a nine-entity structure — simpler than the Harmon network, but the three-day gap in Entity 4’s banking record had led to a second anomaly. Entity 7 had been incorporated in a different jurisdiction on the same day that Entity 4’s banking records showed the anomalous transfer.

She had found this by cross-referencing the corporate registry dates against the transaction log, the same method she had used in month two of the Harmon trace to identify the initial 22-day nomination window.

She ran the transaction subtotals. The adding machine printed each one. She entered them into the Palantir FFE software. The graph was building — nine entities, the connections between them emerging as she loaded the data. Entity 7 and Entity 4 had no direct banking relationship in the records. But the timing of the incorporation and the transfer was a pattern she had seen before.

She would have the initial graph by Thursday.

—

The updated DOJ press release had arrived by email that morning, forwarded from the DOJ communications office. It read: “Shell company network analysis conducted by Dr. Nadia Hasan, CFA/CFE, Harmon Financial Investigation.” She had read it. She had filed it in the Harmon case folder, next to the prosecution memorandum and the FRE 901 motion response.

The original press release — “The Harmon Financial Trace,” Reuters, AP, Bloomberg — was in 340 news articles. The correction was on the DOJ website. The news articles could not be corrected. A law review article citing the case had used “the Harmon Financial Trace” that morning. She had closed the Google Alert. She had kept the alert active.

She unrolled the tape to the next blank section.

The machine printed the total.

She entered it into the software.