Mobile phone records obtained from an operator on two lines that were being used to demand for and receive ransom from Shantel Nzebi's mother helped the police to crack open the case.
On Thursday night, the key suspect in the kidnap, a woman who police believe orchestrated the kidnapping, was arrested in Orata, Kitengela. She was in an apartment just 300 metres away from where Shantel's body was found on Monday.
The lady, identified as Mutindi Nthuku operates, an M-Pesa shop in the area and had lately been indoors, only coming out in the evening, according to neighbours. A raid carried out by detectives from the Directorate of Criminal Investigations (DCI) Saturday morning recovered an Airtel SIM card.
The card has been sent for forensic analysis to establish whether it is the same one that was being used to solicit a ransom from Shantel's mother.
Also recovered from the house was a machete, bed sheets and headscarves, which have also been taken for forensic analysis.
Ms Nthuku's arrest now brings to four the number of suspects in police custody on suspicion of kidnapping and killing Shantel. The Grade Two pupil disappeared at 5pm last Saturday as she was playing with her colleagues metres away from her home at Ashut, Nonkoopir in Kitengela.
The first two suspects, Livingstone Makacha Otengo and Francis Mbuthia, were arrested on Wednesday and presented in court, while the third suspect, Agnes Kasiva Nzioki, was arrested on Thursday.
Unregistered phone number
"Children who were playing with Shantel confirmed that it is the woman who took her," said Isinya DCI boss Jeremiah Ndubai of Ms Nzioki.
The woman is said to have approached the children asking them, and particularly Shantel, if she knew of any vacant houses around. The girl was then put on a boda boda allegedly belonging to Mr Makacha and taken away.
According to investigators, an unregistered mobile phone number that was used to demand for Sh300,000 from Shantel's mother from Saturday, but was switched off on Monday morning, is the one that helped them quickly crack the case and apprehend the suspects.
Mobile phone records obtained by police from Airtel on the line shows the key suspect was constantly in communication with two other mobile numbers in the hours leading up to Shantel's kidnap and after that.
"We decided to play along, buying time for detectives to locate the caller. At some point, we were kept waiting for a new number to send the ransom. We knew we could not afford the money but time was of essence," Shantel's mother Christine Ngina said on Monday. "My last hope to find my daughter alive was on police officers."
An analysis on the number that called Shantel's mother showed that it made a total of 51 calls between 8pm last Saturday and 8.57am on Monday morning. Apart from calling Shantel's mother, mobile phone records obtained by the police show that this number was in constant communication with Mr Makacha.
The second line, which was used in the kidnap, was also an Airtel line registered in the name of the second suspect: Francis Mbuthia. This is the number that Shantel's mother was told to send the ransom to if she wanted to see her daughter alive again.
Calling the shots
With the two lines having been identified, the police did a triangulation to ascertain the geographical locations the calls were being made from. It emerged that two of the calls were being made from around Kitengela, the same location where Shantel was kidnapped from, while the money was being sent to a number in Kiserian.
Mr Makacha was the first to be arrested at Orata on Wednesday. On searching his house, police recovered another mobile phone whose IMEI number matches another phone that was used by the same Airtel line to call Shantel's parents.
An IMEI number, usually printed inside the battery compartment of a mobile phone, is a unique electronic identity that enables the phone to connect to a network service provided through a SIM card.
This identity is usually the first thing that police officers look out for if it is suspected that a phone was used to commit a crime.
The second person to be arrested was Mr Mbuthia after his phone was tracked by detectives to Kiserian where he was hiding.
Meanwhile, an identification parade was carried out and Ms Nzioki was positively identified as the one who took the eight-year-old pupil at Five Hills Academy.
On interrogation, the three suspects jointly identified Ms Nthuku as the one who was calling the shots in the kidnap.