The Investigation of the Ystad Killings
FirewallThis flow traces Wallander’s effort to connect a taxi-driver murder, a suspicious death, and a plot aimed at global systems.
increasing
Bearing strength in each event
decreasing
Two Girls Attack

A Brutal Opening
The Crime
Two teenagers attack taxi driver Johan Lundberg with a hammer and knife, then confess that they wanted money. Their calmness unsettles Kurt Wallander more than the confession clarifies the crime.
The Unanswered Motive
The violence seems disproportionate to the small amount stolen. Wallander suspects the girls are hiding a purpose, setting the investigation in motion.
A Death at the Cash Machine

An Apparently Ordinary Death
The Receipt
Tynnes Falk is found dead beside an ATM, still holding a printed balance and with his wallet untouched. The initial explanation is a natural death.
A Case Reopens
His doctor and former wife challenge the assumption, while later events connect Falk to the other crimes. Wallander’s early decision to set the case aside becomes a consequential misjudgment.
Hökberg Disappears

The Escape
A Moment of Neglect
Sonja Hökberg walks out of police custody while an officer is distracted. Wallander believes she planned to exploit an opening, though the police cannot yet say where she is going.
A New Emergency
Her escape interrupts the investigation of Lundberg’s murder and exposes failures in station security. Soon, her fate becomes inseparable from the larger mystery.
The Blackout Scene

A Body in the Grid
The Substation
A burned body in the Ystad power substation causes a major outage across Skåne. Investigators identify the victim as Hökberg from her handbag.
Murder, Not Accident
A skull fracture indicates that she was struck before entering the high-voltage equipment. Wallander now has to explain both her death and the deliberate choice of a critical power site.
From Local Crime to Global Threat

A Wider Conspiracy
The Computer
Robert Modin helps open Falk’s heavily protected computer, revealing links to major financial and communications institutions. The recurring code points toward October 20.
The Trigger
Wallander recognizes the ATM as a possible everyday trigger and stations officers at local machines. His deduction leads to a confrontation that stops the planned cyberattack.
October 7, 1997
October 6, 1997
October 7, 1997, late morning
October 8, 1997, before dawn
October 19–20, 1997