1 00:00:01,690 --> 00:00:02,700 My name is Avery Ryan. 2 00:00:02,724 --> 00:00:04,224 I was a victim of cyber crime. 3 00:00:04,259 --> 00:00:06,699 Like you, I posted on social media, 4 00:00:06,728 --> 00:00:09,538 checked my bank account balance online, 5 00:00:09,564 --> 00:00:11,534 even kept the confidential files 6 00:00:11,566 --> 00:00:13,736 of my psychological practice on my computer. 7 00:00:15,570 --> 00:00:18,480 Then I was hacked, and as a result, 8 00:00:18,507 --> 00:00:20,847 one of my patients was murdered. 9 00:00:20,875 --> 00:00:23,475 My investigation into her death led me to the FBI, 10 00:00:23,512 --> 00:00:26,282 where I joined a team of cyber experts 11 00:00:26,315 --> 00:00:29,185 to wage a war against a new breed of criminal 12 00:00:29,218 --> 00:00:32,228 hiding on the Deep Web... 13 00:00:32,254 --> 00:00:35,254 infiltrating our daily lives in ways we never imagined... 14 00:00:36,825 --> 00:00:38,795 ...faceless... 15 00:00:38,827 --> 00:00:41,197 nameless... 16 00:00:41,230 --> 00:00:42,800 lurking inside our devices, 17 00:00:42,831 --> 00:00:45,431 just a keystroke away. 18 00:00:57,912 --> 00:01:00,382 KRUMITZ: We got another one. NELSON: That's four and counting. 19 00:01:00,415 --> 00:01:01,645 What the hell is going on up there? 20 00:01:01,683 --> 00:01:02,813 Hold on. Yes, I'm still here. 21 00:01:02,851 --> 00:01:06,281 FAA has confirmed Wi-Fi is down on four domestic flights, 22 00:01:06,321 --> 00:01:07,781 all Monument Air. 23 00:01:07,822 --> 00:01:08,882 Do they know why this is happening? 24 00:01:08,923 --> 00:01:09,853 They're still looking into it. 25 00:01:09,891 --> 00:01:11,821 All right, I just spoke to Liftoff Wireless. 26 00:01:11,860 --> 00:01:13,500 They've been trying to restore in-flight Internet access 27 00:01:13,528 --> 00:01:14,828 on the planes, but something is blocking them. 28 00:01:14,863 --> 00:01:15,763 I'm here. Go. 29 00:01:15,797 --> 00:01:16,797 Uh, we got a fifth. 30 00:01:16,831 --> 00:01:17,891 No, no, make it six. 31 00:01:17,932 --> 00:01:19,802 Same as the others. 32 00:01:19,834 --> 00:01:22,374 All Monument Air. Looks like some type of coordinated attack. 33 00:01:22,404 --> 00:01:23,434 RYAN: DHS is operating 34 00:01:23,472 --> 00:01:24,802 at National Threat Level Yellow. 35 00:01:24,839 --> 00:01:26,349 It hasn't jumped to orange yet. 36 00:01:26,375 --> 00:01:27,905 Shouldn't we call the president or someone? 37 00:01:27,942 --> 00:01:29,242 I mean, we're talking planes. 38 00:01:29,278 --> 00:01:30,378 SIFTER: Yeah, which is exactly why 39 00:01:30,412 --> 00:01:31,672 we don't jump to conclusions. 40 00:01:31,713 --> 00:01:32,783 We got to have some facts 41 00:01:32,814 --> 00:01:34,644 before we suggest they start upping the threat level. 42 00:01:34,683 --> 00:01:36,153 No reports of instrument malfunction. 43 00:01:36,185 --> 00:01:37,515 Pilots are still able to communicate 44 00:01:37,552 --> 00:01:39,222 with the control tower. Undercover air marshals 45 00:01:39,254 --> 00:01:41,454 haven't detected any unusual activity either. 46 00:01:41,490 --> 00:01:43,200 What time did the Wi-Fi go down on those flights? 47 00:01:43,225 --> 00:01:44,495 Ten minutes after takeoff. 48 00:01:44,526 --> 00:01:46,366 All right, that means they were above 10,000 feet. 49 00:01:46,395 --> 00:01:48,565 That's when the passengers on Monument Air can connect 50 00:01:48,597 --> 00:01:50,637 their electronic devices to the in-flight wireless network. 51 00:01:50,665 --> 00:01:51,695 Got another one. 52 00:01:51,733 --> 00:01:52,863 Seven. 53 00:01:52,901 --> 00:01:54,861 MUNDO: Eight. 54 00:01:54,903 --> 00:01:56,303 Nine. SIFTER: What the hell is this? 55 00:01:56,338 --> 00:01:58,808 Okay, okay. What is it, Krumitz? 56 00:01:58,840 --> 00:02:00,510 Liftoff Wireless' server logs 57 00:02:00,542 --> 00:02:01,942 show only one phone on each plane 58 00:02:01,976 --> 00:02:03,916 connected to the router and caused Wi-Fi to go down. 59 00:02:03,945 --> 00:02:05,275 RYAN: That means nine passengers 60 00:02:05,314 --> 00:02:07,214 on nine flights shut off the Wi-Fi 61 00:02:07,249 --> 00:02:08,589 from within the plane? 62 00:02:08,617 --> 00:02:10,217 Sounds like a coordinated attack to me. 63 00:02:10,252 --> 00:02:11,852 Think all nine passengers are working together? 64 00:02:11,886 --> 00:02:14,886 Nelson, pull up the flight routes. 65 00:02:15,890 --> 00:02:17,800 The destination cities are all different, 66 00:02:17,826 --> 00:02:18,926 but they all originated 67 00:02:18,960 --> 00:02:21,330 from Miami International. 68 00:02:21,363 --> 00:02:22,933 I'm calling Homeland Security. 69 00:02:22,964 --> 00:02:24,434 Secretary McKnight, this is Simon Sifter, 70 00:02:24,466 --> 00:02:25,896 Cyber Crime Division. 71 00:02:25,934 --> 00:02:27,834 We've got a potential national security threat. 72 00:02:27,869 --> 00:02:30,609 I'm requesting that you immediately ground 73 00:02:30,639 --> 00:02:32,509 all Monument Air flights. 74 00:02:32,541 --> 00:02:33,901 Yes, I am sure. As you know, 75 00:02:33,942 --> 00:02:35,802 shutting down passenger communication 76 00:02:35,844 --> 00:02:37,944 is a possible precursor to hijacking. 77 00:02:37,979 --> 00:02:39,949 I would like all these flights redirected 78 00:02:39,981 --> 00:02:41,811 to their nearest airports. 79 00:02:41,850 --> 00:02:42,990 Monument Air Flight 417 80 00:02:43,017 --> 00:02:45,357 is 300 miles outside of Miami. 81 00:02:45,387 --> 00:02:47,687 That's the closest and easiest to send back. 82 00:02:47,722 --> 00:02:49,692 All right, I'll have that flight routed back to Miami. 83 00:02:49,724 --> 00:02:52,224 Krumitz, can you tell specifically which phone 84 00:02:52,261 --> 00:02:54,591 or passenger shut down the Wi-Fi? I... 85 00:02:54,629 --> 00:02:55,929 I mean, it's gonna take some time, 86 00:02:55,964 --> 00:02:57,294 but yeah. RYAN: Okay. 87 00:02:57,332 --> 00:02:58,592 We need the names and the seat numbers 88 00:02:58,633 --> 00:03:00,603 for those passengers with the phones, 89 00:03:00,635 --> 00:03:01,905 and we need them now. 90 00:03:01,936 --> 00:03:02,876 Let's go, Elijah. 91 00:03:02,904 --> 00:03:04,904 Nelson. 92 00:03:08,810 --> 00:03:11,950 * 93 00:03:14,716 --> 00:03:16,916 Okay, all right, all right, got it. 94 00:03:16,951 --> 00:03:18,511 All right, thanks, Krummy. 95 00:03:18,553 --> 00:03:20,983 Okay, target's sitting in 14C. 96 00:03:21,022 --> 00:03:22,992 Plane is taxiing to the gate right now. 97 00:03:23,024 --> 00:03:24,424 Good, what about the other flights? 98 00:03:24,459 --> 00:03:25,799 Great. 99 00:03:25,827 --> 00:03:27,597 Local Feds are detaining the eight suspects 100 00:03:27,629 --> 00:03:29,899 in the other cities now. 101 00:03:36,571 --> 00:03:37,801 I-I just left for vacation. 102 00:03:37,839 --> 00:03:39,709 Someone needs to tell me what this is about. 103 00:03:42,477 --> 00:03:43,817 Can you please call my husband? 104 00:03:43,845 --> 00:03:45,745 This is crazy. 105 00:04:10,038 --> 00:04:12,378 Excuse me. Excuse me. 106 00:04:13,007 --> 00:04:16,317 Take your headphones out, please. 107 00:04:17,679 --> 00:04:18,819 How old are you? 108 00:04:18,847 --> 00:04:20,487 16. Have you been sitting there 109 00:04:20,515 --> 00:04:22,755 the whole flight? Yeah. Why? 110 00:04:22,784 --> 00:04:24,654 Cuff her. 111 00:04:24,686 --> 00:04:26,726 What did I do? What's going on? 112 00:04:26,755 --> 00:04:28,985 Stand up, place your hands behind your back, please. 113 00:04:36,698 --> 00:04:38,068 Willa? 114 00:04:40,602 --> 00:04:41,662 Dad! 115 00:04:41,703 --> 00:04:42,873 They won't let me leave. 116 00:04:43,638 --> 00:04:45,038 What's going on here? 117 00:04:45,974 --> 00:04:47,104 My daughter was going to visit 118 00:04:47,141 --> 00:04:48,641 family in San Diego. 119 00:04:48,677 --> 00:04:50,777 I don't get it. Are you saying she's a suspect? 120 00:04:50,812 --> 00:04:53,082 We're just trying to understand what happened here, Mr. Hart. 121 00:04:53,114 --> 00:04:55,984 Someone hacked into the plane's router. 122 00:04:56,017 --> 00:04:57,017 We traced that intrusion 123 00:04:57,051 --> 00:04:58,381 back to Willa's phone. 124 00:04:58,420 --> 00:04:59,660 What? 125 00:04:59,688 --> 00:05:00,628 I mean, how is that possible? 126 00:05:00,655 --> 00:05:02,755 Her cell phone serial number was the last one 127 00:05:02,791 --> 00:05:06,021 that logged on to the onboard router before it crashed. 128 00:05:06,060 --> 00:05:09,100 We ran that number through every cell carrier's database 129 00:05:09,130 --> 00:05:10,140 till it spit out a name. 130 00:05:10,164 --> 00:05:11,094 Willa's name? 131 00:05:11,132 --> 00:05:12,932 We matched that name to the flight manifest. 132 00:05:12,967 --> 00:05:14,037 It gave us a seat number. 133 00:05:14,068 --> 00:05:15,608 Willa, 134 00:05:15,637 --> 00:05:17,107 did you leave your phone anywhere? 135 00:05:17,138 --> 00:05:19,008 Did you bump your device with anyone? 136 00:05:19,040 --> 00:05:21,450 Did you text or download anything? 137 00:05:22,811 --> 00:05:24,511 Go ahead, sweetheart. Just answer 138 00:05:24,546 --> 00:05:25,816 her questions. 139 00:05:25,847 --> 00:05:26,947 I texted some friends, 140 00:05:26,981 --> 00:05:28,011 but I do that all the time. 141 00:05:28,049 --> 00:05:30,819 I was just listening to music and playing Dots. 142 00:05:30,852 --> 00:05:32,112 Hmm. 143 00:05:33,822 --> 00:05:35,082 What's he doing? 144 00:05:35,123 --> 00:05:37,453 Imaging your phone, making a duplicate copy 145 00:05:37,492 --> 00:05:40,122 of your device to determine what killed the Wi-Fi. 146 00:05:40,161 --> 00:05:41,491 Can I have it back? 147 00:05:43,031 --> 00:05:44,891 Once we're done with it. Right now I want you to tell me 148 00:05:44,933 --> 00:05:48,103 everything that happened before your flight took off. 149 00:05:48,136 --> 00:05:51,406 My dad dropped me at the curb. 150 00:05:51,440 --> 00:05:52,750 I checked my bag, 151 00:05:52,774 --> 00:05:54,674 went through security, 152 00:05:54,709 --> 00:05:56,579 had a smoothie. 153 00:05:56,611 --> 00:05:58,711 I bought it at Mango Mel's. 154 00:05:58,747 --> 00:06:01,487 And then I waited at the gate for my flight. 155 00:06:01,516 --> 00:06:03,716 Does the name Audrey Monroe 156 00:06:03,752 --> 00:06:06,882 mean anything to you? 157 00:06:06,921 --> 00:06:08,121 How about Ken Galvin? 158 00:06:09,123 --> 00:06:11,093 Margaret Sloane? 159 00:06:11,125 --> 00:06:12,925 What do they have to do with Willa? 160 00:06:12,961 --> 00:06:15,121 Your daughter's phone's not the only one that cut off the Wi-Fi. 161 00:06:15,163 --> 00:06:16,633 It happened on eight other flights. 162 00:06:16,665 --> 00:06:17,795 Lee Yang? 163 00:06:17,832 --> 00:06:19,502 Jason Hawking? 164 00:06:19,534 --> 00:06:20,804 I don't know any of these people. 165 00:06:20,835 --> 00:06:21,965 Well, it's clear to me, and it should be to you, 166 00:06:22,003 --> 00:06:25,003 that my daughter didn't have anything to do with this. 167 00:06:25,039 --> 00:06:26,679 She's just a kid. 168 00:06:26,708 --> 00:06:28,178 Mr. Hart, in my line of work, 169 00:06:28,209 --> 00:06:30,919 "just a kid" doesn't mean anything. 170 00:06:34,115 --> 00:06:36,115 Hey, yo, E. 171 00:06:36,150 --> 00:06:37,890 It's getting ugly over there, man. 172 00:06:37,919 --> 00:06:39,829 Yeah, well, their flight's been grounded 173 00:06:39,854 --> 00:06:41,154 and they haven't been given an explanation. 174 00:06:41,189 --> 00:06:42,499 You'd be angry, too. 175 00:06:42,524 --> 00:06:44,594 Well, you're right. 176 00:06:44,626 --> 00:06:47,126 So, I ran diagnostics on the plane's router. 177 00:06:47,161 --> 00:06:49,731 One device overloaded the entire system. 178 00:06:49,764 --> 00:06:51,634 It was a denial-of-service attack. 179 00:06:51,666 --> 00:06:53,236 PILOT: Ladies and gentlemen, 180 00:06:53,267 --> 00:06:56,677 at this time, Liftoff Wireless' Wi-Fi service 181 00:06:56,705 --> 00:06:58,905 is available at a charge of $9.99 182 00:06:58,940 --> 00:07:00,250 for the duration of the flight. 183 00:07:00,274 --> 00:07:02,204 Thank you. 184 00:07:02,243 --> 00:07:04,243 NELSON: Willa's phone prevented any other passenger's device 185 00:07:04,278 --> 00:07:05,618 from connecting to the Wi-Fi. 186 00:07:09,951 --> 00:07:12,151 Phones aren't supposed to send that many data packets at once. 187 00:07:12,186 --> 00:07:13,226 Yeah, unless a hacker 188 00:07:13,254 --> 00:07:14,784 with some skills worked their magic. 189 00:07:14,823 --> 00:07:15,853 Uh-huh. 190 00:07:15,890 --> 00:07:17,160 I'll go ahead and unplug the router from the plane. 191 00:07:17,191 --> 00:07:18,251 I'll send it back to CTOC. 192 00:07:18,292 --> 00:07:20,222 Do that. All right. 193 00:07:20,261 --> 00:07:22,161 Anything from our FBI field teams? 194 00:07:22,196 --> 00:07:23,596 SIFTER: Well, they've interrogated 195 00:07:23,632 --> 00:07:25,032 the other eight suspects. 196 00:07:25,066 --> 00:07:26,636 They're all from different cities. 197 00:07:26,668 --> 00:07:28,168 They span multiple generations, 198 00:07:28,202 --> 00:07:30,932 and they've all got varying levels of technology, 199 00:07:30,972 --> 00:07:33,802 and they all allege they have no idea what happened. 200 00:07:33,842 --> 00:07:35,242 Willa Hart said the same thing. 201 00:07:35,276 --> 00:07:36,916 She has no clue what's going on. 202 00:07:36,945 --> 00:07:37,975 Field teams confiscated 203 00:07:38,012 --> 00:07:39,272 our suspects' phones. 204 00:07:39,313 --> 00:07:40,243 They're imaging them now. 205 00:07:40,281 --> 00:07:41,541 Data should be here any minute. 206 00:07:41,583 --> 00:07:43,753 So, Avery, I've made a lot of moves here. 207 00:07:43,785 --> 00:07:45,255 There are gonna be a lot of questions. 208 00:07:45,286 --> 00:07:47,186 So, from your end, what does this look like? 209 00:07:47,221 --> 00:07:48,981 I'm not sure yet, 210 00:07:49,023 --> 00:07:51,093 but I'm not willing to give up on the idea 211 00:07:51,125 --> 00:07:52,125 that these people are connected. 212 00:07:52,160 --> 00:07:53,800 (register dings) 213 00:07:53,828 --> 00:07:55,268 I'm sorry, ma'am, this one didn't work either. 214 00:07:55,296 --> 00:07:57,196 Two of my credit cards have been declined? 215 00:07:57,231 --> 00:07:59,061 That's impossible. 216 00:07:59,100 --> 00:08:00,210 No, I didn't buy ten laptops. 217 00:08:00,234 --> 00:08:01,704 I don't even shop at that store. 218 00:08:01,736 --> 00:08:04,636 (phones ringing, overlapping chatter) 219 00:08:06,575 --> 00:08:07,605 Avery, what's happening? 220 00:08:07,642 --> 00:08:08,642 I'm not sure yet. Hold on. 221 00:08:08,677 --> 00:08:09,877 Let me flip view. 222 00:08:09,911 --> 00:08:11,311 (ringing, chattering) 223 00:08:11,345 --> 00:08:13,145 It suddenly just got very noisy in here. 224 00:08:13,181 --> 00:08:14,681 Yeah, my credit card's been denied. 225 00:08:14,716 --> 00:08:16,556 What do you mean you don't know what's going on? 226 00:08:16,585 --> 00:08:17,885 It happened on your plane. 227 00:08:20,955 --> 00:08:23,225 Are you seeing this? 228 00:08:23,257 --> 00:08:25,257 MAN: All of my credit cards 229 00:08:25,293 --> 00:08:26,093 cannot be maxed out. How is that even possible? 230 00:08:26,127 --> 00:08:28,567 All of these people were passengers 231 00:08:28,597 --> 00:08:31,037 on Willa Hart's flight. 232 00:08:31,065 --> 00:08:32,065 Simon, 233 00:08:32,100 --> 00:08:34,340 I know what this is. 234 00:08:34,368 --> 00:08:36,208 This is a credit card heist. 235 00:08:36,237 --> 00:08:38,707 Dozens of people who got off that plane 236 00:08:38,740 --> 00:08:40,110 are starting to receive alerts 237 00:08:40,141 --> 00:08:41,671 that their credit cards have been frozen. 238 00:08:41,710 --> 00:08:43,080 Someone stole their information. 239 00:08:43,111 --> 00:08:45,311 That's it, that's it, that's it. 240 00:08:45,346 --> 00:08:46,376 'Cause a plane 241 00:08:46,414 --> 00:08:48,884 is the one place where people are held captive. 242 00:08:48,917 --> 00:08:50,287 You can't connect 243 00:08:50,318 --> 00:08:53,858 to the rest of the world if the Wi-Fi is down. 244 00:08:53,888 --> 00:08:56,128 The passengers wouldn't even know that they'd been robbed 245 00:08:56,157 --> 00:08:58,257 till they got off the plane and connected to the Internet. 246 00:08:58,292 --> 00:08:59,322 I don't believe this. 247 00:08:59,360 --> 00:09:01,630 What? This can't be right. 248 00:09:01,663 --> 00:09:03,033 I've seen this before. 249 00:09:03,064 --> 00:09:04,964 There it is again and again. 250 00:09:04,999 --> 00:09:06,199 He uses a unique signature 251 00:09:06,234 --> 00:09:07,634 when writing code. 252 00:09:07,669 --> 00:09:08,639 He? 253 00:09:08,670 --> 00:09:09,710 What is it, Krumitz? 254 00:09:09,738 --> 00:09:11,308 I know who did it. 255 00:09:12,306 --> 00:09:13,806 Lomis. 256 00:09:13,842 --> 00:09:15,142 Lomis is behind this, 257 00:09:15,176 --> 00:09:17,176 and it's just the beginning. 258 00:09:21,750 --> 00:09:27,890 * I know you've deceived me, now here's a surprise * 259 00:09:29,824 --> 00:09:35,364 * I know that you have, 'cause there's magic in my eyes * 260 00:09:35,396 --> 00:09:39,736 * I can see for miles and miles * 261 00:09:39,768 --> 00:09:43,078 * I can see for miles and miles * 262 00:09:43,104 --> 00:09:47,644 * I can see for miles and miles * 263 00:09:47,676 --> 00:09:51,116 * And miles... 264 00:09:51,145 --> 00:09:53,645 * Oh, yeah. 265 00:10:05,894 --> 00:10:07,894 I can't believe this is Lomis. 266 00:10:07,929 --> 00:10:09,869 He's like a hacker legend. 267 00:10:09,898 --> 00:10:12,268 Came out of nowhere a few years back. 268 00:10:12,300 --> 00:10:15,170 Now, they say he's in his 30s, good-looking, 269 00:10:15,203 --> 00:10:16,363 comes from Estonia. 270 00:10:16,404 --> 00:10:18,334 Sounds like a little hacker envy, Nelson. 271 00:10:18,372 --> 00:10:19,332 No. (chuckles) 272 00:10:19,373 --> 00:10:20,743 Look, it's admiration. 273 00:10:20,775 --> 00:10:22,075 Lomis lives up to his name. 274 00:10:22,110 --> 00:10:23,850 It's leetspeak for "low missile." 275 00:10:23,878 --> 00:10:24,948 Flies under the radar. 276 00:10:24,979 --> 00:10:26,119 He's only surfaced twice. 277 00:10:26,147 --> 00:10:29,047 Both times at DefCon in Vegas. 278 00:10:29,083 --> 00:10:29,913 That's it. 279 00:10:29,951 --> 00:10:32,381 All right, over $400,000 have been stolen 280 00:10:32,420 --> 00:10:34,260 in our credit card scam and over 300 people 281 00:10:34,288 --> 00:10:35,828 have reported theft. 282 00:10:35,857 --> 00:10:36,957 There's no telling 283 00:10:36,991 --> 00:10:39,421 when this is gonna end. 284 00:10:39,460 --> 00:10:41,470 (Nelson whoops) 285 00:10:41,495 --> 00:10:42,895 NELSON: See? 286 00:10:42,931 --> 00:10:45,991 Now that's what I call traveling in style. 287 00:10:46,034 --> 00:10:48,834 RYAN: Sifter has connections with the Coast Guard, 288 00:10:48,870 --> 00:10:51,910 so Krumitz gets a free escort from D.C. to Miami. 289 00:11:06,054 --> 00:11:07,454 NELSON: Nice ride, bro! 290 00:11:07,488 --> 00:11:09,358 It's the only way to fly! 291 00:11:11,392 --> 00:11:14,122 Krumitz, you're sure this is Lomis? 292 00:11:14,162 --> 00:11:16,362 Every bone in my body says I'm right. 293 00:11:16,397 --> 00:11:17,967 This is how he works. 294 00:11:17,999 --> 00:11:19,869 When the Wi-Fi intrusion on the planes 295 00:11:19,901 --> 00:11:22,031 connected to the credit cards, I knew it was him. 296 00:11:22,070 --> 00:11:23,340 Sounds like a hunch. 297 00:11:23,371 --> 00:11:25,001 And your obsession with catching a guy 298 00:11:25,039 --> 00:11:26,309 you've been chasing for the last three years. 299 00:11:27,041 --> 00:11:29,171 But it's not. 300 00:11:29,210 --> 00:11:31,020 Before I left CTOC, 301 00:11:31,045 --> 00:11:32,145 I found a connection 302 00:11:32,180 --> 00:11:34,450 between the nine suspects and Lomis. 303 00:11:34,482 --> 00:11:36,112 I discovered a malicious script 304 00:11:36,150 --> 00:11:38,320 buried deep in the nine suspects' phones. 305 00:11:38,352 --> 00:11:40,152 The code exploited a vulnerability 306 00:11:40,188 --> 00:11:41,328 in the operating system. 307 00:11:41,355 --> 00:11:44,195 (beeping) 308 00:11:44,225 --> 00:11:45,825 NELSON: Yeah, that's his signature. 309 00:11:45,860 --> 00:11:48,230 A custom code that gains complete control over the OS 310 00:11:48,262 --> 00:11:51,032 and suffocates the security features like a boa constrictor. 311 00:11:51,065 --> 00:11:52,265 Means he can do whatever he wants 312 00:11:52,300 --> 00:11:53,870 with any of the phones... 313 00:11:55,403 --> 00:11:56,933 ...steal your identity, 314 00:11:56,971 --> 00:11:58,031 access personal info, 315 00:11:58,072 --> 00:11:59,402 even attach malware. 316 00:11:59,440 --> 00:12:00,980 It doesn't make sense, though. 317 00:12:01,009 --> 00:12:02,179 I mean, in the past, 318 00:12:02,210 --> 00:12:03,480 Lomis robbed a New York hedge fund, 319 00:12:03,511 --> 00:12:04,541 the payroll 320 00:12:04,578 --> 00:12:06,078 at San Francisco PD, 321 00:12:06,114 --> 00:12:07,444 even went after an NHL team. 322 00:12:07,481 --> 00:12:09,311 Now this? RYAN: You're right. Credit cards 323 00:12:09,350 --> 00:12:13,030 and planes doesn't really fit his behavioral profile. 324 00:12:13,054 --> 00:12:14,154 It's not what he does. 325 00:12:14,188 --> 00:12:15,428 It's how he does it. 326 00:12:15,456 --> 00:12:17,996 He starts with creating chaos 327 00:12:18,026 --> 00:12:19,326 and it grows into something bigger. 328 00:12:19,360 --> 00:12:21,070 That's what this is. MUNDO: If Lomis is the one behind 329 00:12:21,095 --> 00:12:22,795 this credit card heist, 330 00:12:22,831 --> 00:12:24,061 it means that none of our nine suspects even knew 331 00:12:24,098 --> 00:12:25,198 the suspicious script was on their phones. 332 00:12:25,233 --> 00:12:27,933 Means Willa Hart and the rest of the eight passengers 333 00:12:27,969 --> 00:12:29,009 are all victims. 334 00:12:29,037 --> 00:12:30,237 Call the FBI field teams, 335 00:12:30,271 --> 00:12:31,501 have everyone we've been holding released. 336 00:12:31,539 --> 00:12:32,509 Nelson... Yes? 337 00:12:32,540 --> 00:12:33,850 Follow the credit card trail. 338 00:12:33,875 --> 00:12:35,145 Look for any purchases that stand out. 339 00:12:35,176 --> 00:12:36,146 Okay. 340 00:12:36,177 --> 00:12:38,147 Krumitz, check for the code 341 00:12:38,179 --> 00:12:40,449 Lomis placed on the rest of the victims' cell phones. 342 00:12:40,481 --> 00:12:42,181 We're about to catch a white whale. 343 00:12:43,217 --> 00:12:44,587 No, that's done. 344 00:12:44,618 --> 00:12:46,388 We alerted the credit card companies 345 00:12:46,420 --> 00:12:48,430 and it should be a day or two, and ... 346 00:12:48,456 --> 00:12:49,896 Yeah-- hey, Mike. 347 00:12:49,924 --> 00:12:51,894 Gotta call you back. Thanks. 348 00:12:51,926 --> 00:12:55,126 Colin, I haven't had a chance to congratulate you 349 00:12:55,163 --> 00:12:56,423 on your promotion yet. 350 00:12:56,464 --> 00:12:58,134 Deputy director. That's-that's big. 351 00:12:58,166 --> 00:12:59,936 Thank you, Simon, but I'm not here to talk about that. 352 00:12:59,968 --> 00:13:02,568 The director just called me to ask 353 00:13:02,603 --> 00:13:05,373 why you grounded all Monument Air flights out of Miami. 354 00:13:05,406 --> 00:13:06,946 I managed to support your decision, 355 00:13:06,975 --> 00:13:09,205 despite the fact that I knew nothing about it. 356 00:13:09,243 --> 00:13:10,443 You should have brought me up to speed. 357 00:13:10,478 --> 00:13:12,378 There was no time to bring you up to speed. 358 00:13:12,413 --> 00:13:14,983 Cyber crime moves fast here, Colin. 359 00:13:15,016 --> 00:13:17,156 Regardless, you should have consulted me first. 360 00:13:18,920 --> 00:13:21,190 Look, I-I've always had the authority 361 00:13:21,222 --> 00:13:22,892 to kind of run my own division. 362 00:13:22,924 --> 00:13:25,224 Wait, are you... you telling me the rules have changed? 363 00:13:25,259 --> 00:13:28,099 I'm telling you I should have been told. 364 00:13:28,129 --> 00:13:29,299 I don't want to lose sleep 365 00:13:29,330 --> 00:13:30,470 worrying if you're gonna keep me up to speed 366 00:13:30,498 --> 00:13:31,938 on everything I need to know. 367 00:13:31,966 --> 00:13:34,136 I grounded those planes to save lives 368 00:13:34,168 --> 00:13:38,238 and prevent a possible national security threat, okay? 369 00:13:38,272 --> 00:13:40,542 I had to make a tough, split-second decision. 370 00:13:40,574 --> 00:13:43,074 You cost an airline millions of dollars. 371 00:13:43,111 --> 00:13:44,471 W-What... what is this? 372 00:13:44,512 --> 00:13:46,912 Are you... are you scolding me? 373 00:13:46,948 --> 00:13:49,988 From now on, you keep me in the loop. 374 00:13:50,018 --> 00:13:51,988 You report to me. 375 00:13:52,020 --> 00:13:54,030 I report to the director. 376 00:13:57,959 --> 00:13:59,659 Understood. 377 00:13:59,693 --> 00:14:00,663 (door closes) 378 00:14:00,694 --> 00:14:02,994 * 379 00:14:03,031 --> 00:14:04,991 Yes! 380 00:14:05,033 --> 00:14:06,933 RYAN: What is it? 381 00:14:06,968 --> 00:14:07,868 This is great. 382 00:14:07,902 --> 00:14:09,632 I've been thinking about this all wrong. 383 00:14:09,670 --> 00:14:11,010 That doesn't sound great. 384 00:14:11,039 --> 00:14:11,909 No, it is. 385 00:14:11,940 --> 00:14:13,310 Because I realized that the code itself 386 00:14:13,341 --> 00:14:14,301 is not going to help us find Lomis. 387 00:14:14,342 --> 00:14:17,042 I'm still waiting on the "great" here, bud. 388 00:14:17,078 --> 00:14:19,318 How the code got onto the phones is the key. 389 00:14:19,347 --> 00:14:20,617 That's a pairing record. 390 00:14:20,648 --> 00:14:22,958 Yep. A history of the last device 391 00:14:22,984 --> 00:14:24,054 a phone synced with. 392 00:14:24,085 --> 00:14:26,485 All these phones paired with the exact same device. 393 00:14:26,520 --> 00:14:27,430 KRUMITZ: Bingo. 394 00:14:27,455 --> 00:14:29,485 And all the time stamps are within an hour 395 00:14:29,523 --> 00:14:31,123 before our victims' flights took off. 396 00:14:31,159 --> 00:14:32,529 That means they picked up Lomis' malicious script 397 00:14:32,560 --> 00:14:33,970 somewhere in this terminal. 398 00:14:33,995 --> 00:14:35,325 NELSON: There's at least 50 different ways 399 00:14:35,363 --> 00:14:36,363 to infect a phone. 400 00:14:41,602 --> 00:14:43,232 Lomis is clever. 401 00:14:43,271 --> 00:14:45,271 He picked a place where he could install his malicious script 402 00:14:45,306 --> 00:14:47,676 on multiple victims' phones, all at the same time. 403 00:14:47,708 --> 00:14:49,508 We're looking for a watering hole. 404 00:14:49,543 --> 00:14:50,643 Maximize the number of victims, 405 00:14:50,678 --> 00:14:52,048 maximize the credit card info. 406 00:14:54,615 --> 00:14:56,285 MUNDO: Right there. 407 00:14:56,317 --> 00:14:57,287 They plugged their phone in to get a charge, 408 00:14:57,318 --> 00:14:58,088 he stole their data. 409 00:14:58,119 --> 00:14:59,419 RYAN: No, that charging station 410 00:14:59,453 --> 00:15:00,423 is off the beaten path. 411 00:15:00,454 --> 00:15:01,684 Infrequent traffic. 412 00:15:01,722 --> 00:15:03,352 He would have chosen a high-traffic station 413 00:15:03,391 --> 00:15:05,291 for his victims. 414 00:15:09,497 --> 00:15:12,237 MUNDO: That's our crime scene. 415 00:15:16,537 --> 00:15:18,507 RYAN: When someone plugs in their phone to charge, 416 00:15:18,539 --> 00:15:20,149 their info is being stolen. 417 00:15:24,112 --> 00:15:26,072 This was juice jacking. 418 00:15:26,114 --> 00:15:27,144 All right. 419 00:15:27,181 --> 00:15:29,341 I'll call the airline, 420 00:15:29,383 --> 00:15:30,483 get the passenger manifest for every flight 421 00:15:30,518 --> 00:15:31,588 that left the terminal this morning. 422 00:15:31,619 --> 00:15:32,559 We need to find everyone 423 00:15:32,586 --> 00:15:33,626 who's carrying this malware on their device. 424 00:15:33,654 --> 00:15:35,654 Krumitz, I need you to clear all the passengers 425 00:15:35,689 --> 00:15:36,589 from this area. 426 00:15:36,624 --> 00:15:38,594 Nelson, start removing all the malicious 427 00:15:38,626 --> 00:15:40,366 script from everyone's phone. 428 00:15:40,394 --> 00:15:41,994 We need to shut this down now. 429 00:15:44,232 --> 00:15:45,562 FBI! 430 00:15:45,599 --> 00:15:46,739 Everyone unplug. 431 00:15:46,767 --> 00:15:48,437 MAN: What? Hey. 432 00:15:48,469 --> 00:15:50,039 WOMAN: My phone is dead. 433 00:15:51,505 --> 00:15:52,675 Hey, don't unplug my phone. 434 00:15:52,706 --> 00:15:53,706 It's dead. 435 00:15:55,043 --> 00:15:56,343 Tell me something, sir. 436 00:15:56,377 --> 00:15:58,577 Have you ever heard of juice jacking? 437 00:15:58,612 --> 00:16:00,012 No, and I don't care to. 438 00:16:01,815 --> 00:16:03,485 You see this cord? 439 00:16:03,517 --> 00:16:04,657 It charges your phone, right? 440 00:16:04,685 --> 00:16:06,055 Nice. Safe. 441 00:16:06,087 --> 00:16:07,427 You think it's your friend. 442 00:16:07,455 --> 00:16:09,485 But you see this connector on the end? 443 00:16:09,523 --> 00:16:11,193 Yeah. It's a USB plug. 444 00:16:11,225 --> 00:16:13,125 Not exactly groundbreaking stuff, guy. 445 00:16:13,161 --> 00:16:14,421 Hmm. 446 00:16:14,462 --> 00:16:15,622 Maybe this'll impress you. 447 00:16:15,663 --> 00:16:19,063 Most people don't realize that this cord has four ports. 448 00:16:19,100 --> 00:16:21,210 Two for power, which charge your phone, 449 00:16:21,235 --> 00:16:24,435 and two for data, which transfer-- 450 00:16:24,472 --> 00:16:25,502 yes, 451 00:16:25,539 --> 00:16:27,309 you guessed it-- your data. 452 00:16:27,341 --> 00:16:29,741 Now, what do you think your phone 453 00:16:29,777 --> 00:16:31,547 was doing just now, guy? 454 00:16:31,579 --> 00:16:32,749 Charging. 455 00:16:32,780 --> 00:16:34,490 KRUMITZ: Wrong. 456 00:16:34,515 --> 00:16:35,515 Stealing your data. 457 00:16:35,549 --> 00:16:37,159 You just wanted a charge, 458 00:16:37,185 --> 00:16:38,415 and you had no idea 459 00:16:38,452 --> 00:16:40,282 that a hacker had installed 460 00:16:40,321 --> 00:16:41,451 a juice-jacking device 461 00:16:41,489 --> 00:16:42,729 that allows him to steal your credit cards, 462 00:16:42,756 --> 00:16:45,226 your photos, your videos, 463 00:16:45,259 --> 00:16:46,629 everything on your phone. 464 00:16:47,661 --> 00:16:49,391 Now, if you just go get in line 465 00:16:49,430 --> 00:16:50,470 and talk to that 466 00:16:50,498 --> 00:16:51,838 short gentleman trying to pull off 467 00:16:51,865 --> 00:16:53,135 the purple paisley tie, 468 00:16:53,167 --> 00:16:54,667 he's gonna take the malicious script 469 00:16:54,702 --> 00:16:55,702 off your phone for you. 470 00:16:55,736 --> 00:16:56,736 Problem solved. 471 00:16:59,173 --> 00:17:01,773 Thank you. 472 00:17:10,751 --> 00:17:12,111 Got it. 473 00:17:12,153 --> 00:17:13,523 Patient zero. 474 00:17:13,554 --> 00:17:15,384 Mm! 475 00:17:15,423 --> 00:17:17,693 I need the north side of the terminal cleared out. 476 00:17:17,725 --> 00:17:19,295 No one goes in or out. 477 00:17:19,327 --> 00:17:21,327 This is a crime scene now. 478 00:17:21,362 --> 00:17:22,422 Excuse me, ma'am? Sir? 479 00:17:22,463 --> 00:17:23,733 I need you to clear the area. 480 00:17:23,764 --> 00:17:26,094 Pardon me, miss. 481 00:17:26,134 --> 00:17:27,134 Ma'am? 482 00:17:40,714 --> 00:17:41,744 (crowd talking excitedly) 483 00:17:45,219 --> 00:17:46,459 MUNDO: The vic's name was Rachel Carrington, 484 00:17:46,487 --> 00:17:48,387 a grad student at the University of Miami. 485 00:17:48,422 --> 00:17:49,482 Worked here part time 486 00:17:49,523 --> 00:17:51,753 to put herself through school. What did she do here? 487 00:17:51,792 --> 00:17:53,692 She was a credit card sales rep for Monument Air. 488 00:17:53,727 --> 00:17:55,227 She worked at the charging station, 489 00:17:55,263 --> 00:17:56,293 trying to get people to sign up 490 00:17:56,330 --> 00:17:58,170 for their new Peak Miles card. 491 00:17:58,199 --> 00:17:58,899 Local Feds just contacted her family in Phoenix. 492 00:17:58,932 --> 00:18:00,202 They're flying in now. 493 00:18:00,234 --> 00:18:02,134 Did the coroner determine the COD? 494 00:18:02,170 --> 00:18:04,910 Preliminary report is blunt force trauma. 495 00:18:04,938 --> 00:18:06,878 They found traces of blood in the women's restroom. 496 00:18:06,907 --> 00:18:08,377 They haven't ruled it a homicide yet, 497 00:18:08,409 --> 00:18:11,249 but there are signs of a struggle. 498 00:18:11,279 --> 00:18:13,589 Honestly... 499 00:18:13,614 --> 00:18:15,284 it's not adding up for me. 500 00:18:15,316 --> 00:18:16,386 Hackers aren't murderers. 501 00:18:16,417 --> 00:18:17,387 Neither are robbers, 502 00:18:17,418 --> 00:18:18,588 until something goes wrong 503 00:18:18,619 --> 00:18:19,919 and they become desperate. 504 00:18:19,953 --> 00:18:21,383 We need to gain access 505 00:18:21,422 --> 00:18:22,822 to the security footage in the airport. 506 00:18:22,856 --> 00:18:24,396 I'm on it. 507 00:18:24,425 --> 00:18:25,395 Guys! 508 00:18:25,426 --> 00:18:26,756 Guys, wait! Wait. 509 00:18:26,794 --> 00:18:28,424 Remember when Krumitz said 510 00:18:28,462 --> 00:18:30,292 that Lomis likes to start off with chaos 511 00:18:30,331 --> 00:18:31,431 and then it grows into something bigger? 512 00:18:31,465 --> 00:18:32,635 Yeah? 513 00:18:32,666 --> 00:18:34,566 Well, it just happened. 514 00:18:34,602 --> 00:18:37,772 I was removing the malicious script from the phone 515 00:18:37,805 --> 00:18:40,775 and suddenly I got locked out. 516 00:18:40,808 --> 00:18:41,948 Look at this. 517 00:18:41,975 --> 00:18:43,315 RYAN: "Hi, Chelsea. 518 00:18:43,344 --> 00:18:44,374 "You're phone's been hijacked. 519 00:18:44,412 --> 00:18:46,272 "What would your fiancé Joey think 520 00:18:46,314 --> 00:18:47,944 "if he saw you being a dirty slut? 521 00:18:47,981 --> 00:18:50,581 "Reply with a 14-digit prepaid cash voucher 522 00:18:50,618 --> 00:18:53,458 "for $250 in the next 24 hours, 523 00:18:53,487 --> 00:18:54,557 this goes away." 524 00:18:54,588 --> 00:18:56,288 This is ransomware. 525 00:18:56,324 --> 00:18:57,124 Krumitz said 526 00:18:57,157 --> 00:18:58,797 the malicious script is a custom code 527 00:18:58,826 --> 00:18:59,956 that strangles the operating system 528 00:18:59,993 --> 00:19:02,223 and allows Lomis complete control over all the phones. 529 00:19:02,263 --> 00:19:03,763 Lomis just stepped up his game. 530 00:19:03,797 --> 00:19:05,737 Now he's holding the phones hostage. 531 00:19:05,766 --> 00:19:07,966 We stopped his payday; now he's retaliating. 532 00:19:08,001 --> 00:19:08,961 Nelson, I need you 533 00:19:09,002 --> 00:19:11,202 to get back to D.C. Stay on top of 534 00:19:11,239 --> 00:19:12,339 the stolen credit cards 535 00:19:12,373 --> 00:19:13,973 and crack that ransomware. 536 00:19:14,007 --> 00:19:15,947 Done. Um... 537 00:19:15,976 --> 00:19:17,876 Is there gonna be peanuts and pretzels 538 00:19:17,911 --> 00:19:18,971 on the Coast Guard chopper? 539 00:19:19,012 --> 00:19:21,242 (laughs) 540 00:19:25,319 --> 00:19:27,259 Is this some kind of sick joke? No. 541 00:19:27,288 --> 00:19:29,228 It's completely frozen. 542 00:19:29,257 --> 00:19:30,227 Someone put ransomware on it. 543 00:19:30,258 --> 00:19:31,598 You mean 544 00:19:31,625 --> 00:19:34,995 by charging my phone, all this happened? 545 00:19:35,028 --> 00:19:36,968 RYAN: Yes. 546 00:19:36,997 --> 00:19:39,337 A hacker took control of your phone and locked you out 547 00:19:39,367 --> 00:19:41,267 until you pay the amount that he's demanding. 548 00:19:41,302 --> 00:19:42,362 He has personal information. 549 00:19:42,403 --> 00:19:44,673 He knows my fiancé's name. 550 00:19:44,705 --> 00:19:46,475 Not only did he lock you out, 551 00:19:46,507 --> 00:19:48,347 he accessed your personal data-- 552 00:19:48,376 --> 00:19:51,446 your messages, phone calls, pictures. 553 00:19:51,479 --> 00:19:52,619 What is he going to do with it? 554 00:19:52,646 --> 00:19:53,886 Well, he's threatening to release it 555 00:19:53,914 --> 00:19:55,284 if you don't pay. 556 00:19:56,717 --> 00:19:58,287 What did he find on that phone 557 00:19:58,319 --> 00:20:00,219 you don't want your fiancé to see? 558 00:20:04,492 --> 00:20:05,722 Am I really expected to pay 559 00:20:05,759 --> 00:20:08,469 $250,000 to unlock my phone? 560 00:20:08,496 --> 00:20:10,736 Senator, we don't suggest you pay this ransom. 561 00:20:10,764 --> 00:20:11,864 And when I don't? 562 00:20:11,899 --> 00:20:13,739 Any number of things can happen. 563 00:20:13,767 --> 00:20:15,267 Could you try to be a little more specific? 564 00:20:15,303 --> 00:20:18,003 All right. As that text you received threatens, 565 00:20:18,038 --> 00:20:19,738 he will post all of your personal information 566 00:20:19,773 --> 00:20:20,903 on the Internet. 567 00:20:20,941 --> 00:20:22,301 SENATOR: I just flew back 568 00:20:22,343 --> 00:20:23,643 from a family trip to Miami 569 00:20:23,677 --> 00:20:24,947 and simply charged my phone, 570 00:20:24,978 --> 00:20:26,548 and now this happens? 571 00:20:26,580 --> 00:20:27,750 What action are you taking? 572 00:20:27,781 --> 00:20:29,041 We're working some promising leads. 573 00:20:29,082 --> 00:20:30,042 We've... (scoffs) 574 00:20:30,083 --> 00:20:32,313 Really, gentlemen? 575 00:20:32,353 --> 00:20:33,383 Really? 576 00:20:33,421 --> 00:20:34,281 Our government appropriates 577 00:20:34,322 --> 00:20:36,482 a lot of money to the Cyber Division, 578 00:20:36,524 --> 00:20:38,294 and "promising leads"? 579 00:20:38,326 --> 00:20:39,296 Is that the best you can do? 580 00:20:39,327 --> 00:20:40,467 These things take time. 581 00:20:40,494 --> 00:20:43,064 Time is not something I have. 582 00:20:43,096 --> 00:20:43,996 19 hours from now, 583 00:20:44,031 --> 00:20:46,531 the highly sensitive government material 584 00:20:46,567 --> 00:20:48,007 on this phone goes public. 585 00:20:48,035 --> 00:20:51,435 Senator, look, all due respect... 586 00:20:51,472 --> 00:20:54,442 I mean, you know better than to keep 587 00:20:54,475 --> 00:20:58,515 sensitive government documents on a personal phone, so... 588 00:20:58,546 --> 00:21:00,346 what exactly are you worried about? 589 00:21:00,381 --> 00:21:01,841 SENATOR: I have telephone numbers 590 00:21:01,882 --> 00:21:04,412 and information of high-profile 591 00:21:04,452 --> 00:21:07,382 colleagues and friends. 592 00:21:07,421 --> 00:21:10,081 I have photos of my husband and my children on this phone. 593 00:21:10,123 --> 00:21:12,353 Clearly, there's something else on that phone 594 00:21:12,393 --> 00:21:13,593 you don't want getting out. 595 00:21:13,627 --> 00:21:14,697 You don't understand. 596 00:21:14,728 --> 00:21:16,728 It can't get out. 597 00:21:16,764 --> 00:21:19,464 What I have on this phone is very personal. 598 00:21:19,500 --> 00:21:21,070 It could ruin my career. 599 00:21:21,101 --> 00:21:24,901 Senator, he's already got what's on your phone. 600 00:21:24,938 --> 00:21:25,908 So, what? 601 00:21:25,939 --> 00:21:28,349 What, I cross my fingers and hope for the best? 602 00:21:28,376 --> 00:21:29,806 We are doing everything we can 603 00:21:29,843 --> 00:21:32,543 to identify and arrest the target. 604 00:21:32,580 --> 00:21:34,490 You just don't get it. 605 00:21:34,515 --> 00:21:37,415 People I care about will be hurt. 606 00:21:47,461 --> 00:21:49,821 I found something-- take a look at this. 607 00:21:51,432 --> 00:21:54,402 Rachel Carrington helps this sick woman to the bathroom. 608 00:21:54,435 --> 00:21:56,405 And that's when our juice jackers swoop in. 609 00:21:56,437 --> 00:21:58,907 The sick woman was a distraction to get Rachel away 610 00:21:58,939 --> 00:22:00,809 from the charging bar. Exactly. 611 00:22:00,841 --> 00:22:02,501 Our juice jackers have about a minute 612 00:22:02,543 --> 00:22:06,513 to install their black box before our sick lady returns. 613 00:22:06,547 --> 00:22:08,147 Miraculously, 614 00:22:08,181 --> 00:22:10,511 she doesn't look so sick anymore. 615 00:22:12,853 --> 00:22:14,423 Wait, stop. 616 00:22:14,455 --> 00:22:15,555 Rewind that. 617 00:22:17,024 --> 00:22:19,154 Do you have a camera angle from the direction they're heading? 618 00:22:19,192 --> 00:22:21,492 No, there's a blind spot 619 00:22:21,529 --> 00:22:23,439 between gates 213 and 214. 620 00:22:23,464 --> 00:22:25,034 That's where the bathrooms are, isn't it? 621 00:22:25,065 --> 00:22:26,095 Yeah. 622 00:22:26,133 --> 00:22:28,033 And where the airport police reported finding blood. 623 00:22:29,903 --> 00:22:32,003 So these three people were working together. 624 00:22:32,039 --> 00:22:34,079 The sick woman killed Rachel Carrington. 625 00:22:34,107 --> 00:22:37,547 Yeah, but the problem is-- how do we identify them? 626 00:22:37,578 --> 00:22:38,378 Look at that. 627 00:22:38,412 --> 00:22:39,842 This footage, it's way too grainy. 628 00:22:39,880 --> 00:22:41,050 That's a dead end. 629 00:22:41,081 --> 00:22:42,711 Well, maybe not. 630 00:22:42,750 --> 00:22:44,190 The black box that they installed 631 00:22:44,217 --> 00:22:46,417 had to get through security, right? 632 00:22:52,893 --> 00:22:54,593 Take a snapshot of that duffel. 633 00:23:00,601 --> 00:23:02,431 RYAN: To get that juice-jacking device in the terminal, 634 00:23:02,470 --> 00:23:04,110 somebody had to get it through security. 635 00:23:04,137 --> 00:23:06,477 Most people don't know that TSA keeps 636 00:23:06,507 --> 00:23:08,007 all X ray photos for a week. 637 00:23:08,041 --> 00:23:10,001 We can run our duffel's snapshot 638 00:23:10,043 --> 00:23:11,213 against all the images in the TSA archives. 639 00:23:11,244 --> 00:23:13,544 And based on the size, shape and material of the device, 640 00:23:13,581 --> 00:23:15,641 we should be able to figure out when this came through. 641 00:23:15,683 --> 00:23:17,453 RYAN: Check all the bags that went through security 642 00:23:17,485 --> 00:23:20,655 two hours before the jackers were spotted on surveillance. 643 00:23:24,692 --> 00:23:25,992 KRUMITZ: Okay, we got it. 644 00:23:26,026 --> 00:23:27,666 MUNDO: All right, hold on. 645 00:23:27,695 --> 00:23:30,465 Even if we can get a visual on who came in with it, 646 00:23:30,498 --> 00:23:32,238 chances are pretty good they used a fake I.D. 647 00:23:32,265 --> 00:23:34,565 RYAN: Well, that doesn't mean we can't find them. 648 00:23:34,602 --> 00:23:36,562 You can learn a lot about somebody 649 00:23:36,604 --> 00:23:38,574 by examining the contents of their bag. 650 00:23:38,606 --> 00:23:40,576 Krumitz, remove everything that's blue. 651 00:23:40,608 --> 00:23:43,478 It's metal like our juice-jacking device. 652 00:23:43,511 --> 00:23:46,471 Now, separate the materials by colors. 653 00:23:46,514 --> 00:23:49,484 We're looking for anything plastic or biological. 654 00:23:49,517 --> 00:23:51,717 Take away the biomaterials in orange. 655 00:23:51,752 --> 00:23:53,952 Focus on the plastics in green. 656 00:23:57,725 --> 00:23:58,725 Right there. 657 00:23:58,759 --> 00:24:00,629 Do you see that wizard hat? 658 00:24:00,661 --> 00:24:02,161 That's the Warlocks. 659 00:24:02,195 --> 00:24:03,535 MUNDO: The hacker collective. 660 00:24:03,564 --> 00:24:04,294 KRUMITZ: Yeah. 661 00:24:04,331 --> 00:24:06,091 Yeah, their symbol's a wizard hat. 662 00:24:06,133 --> 00:24:07,393 That's their badge. 663 00:24:07,434 --> 00:24:09,904 It's like an all-access pass for proving their gang affiliation. 664 00:24:09,937 --> 00:24:12,177 That's Lomis' crew, our juice jackers. 665 00:24:12,205 --> 00:24:14,805 Krumitz, search all bags before and after this image 666 00:24:14,842 --> 00:24:16,172 for the same shape. 667 00:24:17,645 --> 00:24:19,645 There. There's two more badges. 668 00:24:19,680 --> 00:24:21,120 KRUMITZ: That proves that the two juice jackers 669 00:24:21,148 --> 00:24:22,818 and the sick woman are all involved. 670 00:24:22,850 --> 00:24:24,820 All right, that's great, but how do we find them? 671 00:24:24,852 --> 00:24:27,182 Hacker collectives hide themselves all around the world. (phone rings) 672 00:24:27,220 --> 00:24:29,190 I mean, they could be anywhere. 673 00:24:29,222 --> 00:24:31,122 My boy Nelson coming through. 674 00:24:31,158 --> 00:24:33,598 He just came up with a traceable hit on the credit cards. 675 00:24:33,627 --> 00:24:35,567 All right, looks like most of the purchases were made 676 00:24:35,596 --> 00:24:36,796 at brick and mortar spots, 677 00:24:36,830 --> 00:24:38,570 like high-end department stores and electronic retailers. 678 00:24:38,599 --> 00:24:42,669 You got computers, laptops, handbags. 679 00:24:42,703 --> 00:24:44,673 Goods that can easily be sold for quick cash. 680 00:24:44,705 --> 00:24:47,675 Yeah, except that Nelson just found an odd online purchase. 681 00:24:47,708 --> 00:24:48,808 RYAN: No, that's a server blade. 682 00:24:48,842 --> 00:24:50,572 That is not something you can buy 683 00:24:50,611 --> 00:24:51,871 at your local electronics store. 684 00:24:51,912 --> 00:24:54,242 But I'm willing to bet that's something 685 00:24:54,281 --> 00:24:56,681 a hacker collective is gonna want. 686 00:24:56,717 --> 00:24:58,257 MUNDO: Big online purchase with a stolen credit card? 687 00:24:58,285 --> 00:24:59,285 Easily traceable? 688 00:24:59,319 --> 00:25:02,289 That's a little sloppy for Lomis, don't you think? 689 00:25:02,322 --> 00:25:03,922 No, but we stopped his payday. 690 00:25:03,957 --> 00:25:05,957 He's scrambling, I mean, that's when you make mistakes. 691 00:25:05,993 --> 00:25:07,893 His mistake is our gain. 692 00:25:07,928 --> 00:25:10,898 The clock is ticking-- we've got 14 hours left. 693 00:25:10,931 --> 00:25:13,731 That purchase is gonna be linked to an address-- find it. 694 00:25:18,639 --> 00:25:20,139 FBI! 695 00:25:21,141 --> 00:25:22,341 FBI! 696 00:25:22,375 --> 00:25:23,615 Hands in the air! Hands in the air! 697 00:25:23,644 --> 00:25:24,614 (indistinct shouting) 698 00:25:24,645 --> 00:25:25,975 On the ground now! 699 00:25:26,013 --> 00:25:28,183 Get down! On the ground now! 700 00:25:28,215 --> 00:25:30,145 Get on the floor! 701 00:25:30,183 --> 00:25:31,613 Heads down! 702 00:25:31,652 --> 00:25:32,812 (indistinct shouting) 703 00:25:33,654 --> 00:25:35,584 He went out the back door. 704 00:25:40,193 --> 00:25:42,623 FBI, freeze! 705 00:25:46,634 --> 00:25:47,604 Crap! 706 00:25:55,676 --> 00:25:57,946 (both grunting) 707 00:26:12,793 --> 00:26:14,263 I really thought Lomis would be here. 708 00:26:24,371 --> 00:26:26,901 We found traces of blood underneath your fingernail. 709 00:26:28,408 --> 00:26:30,078 DNA matched Rachel Carrington. 710 00:26:32,780 --> 00:26:33,750 You killed her. 711 00:26:33,781 --> 00:26:34,741 No. 712 00:26:34,782 --> 00:26:37,112 No, it was an accident. 713 00:26:37,150 --> 00:26:38,790 I was just supposed to distract her. 714 00:26:38,819 --> 00:26:40,859 CARRINGTON: Glad you're feeling better. 715 00:26:40,888 --> 00:26:42,728 I really have to be heading back, though. 716 00:26:42,756 --> 00:26:43,756 Uh, wait. 717 00:26:43,791 --> 00:26:45,691 Wh... What are you...? 718 00:26:46,794 --> 00:26:48,424 MUNDO: Once you realized she was dead, 719 00:26:48,461 --> 00:26:50,861 you went back to your partners. 720 00:26:50,898 --> 00:26:52,968 She was still breathing when we left her. 721 00:26:57,805 --> 00:27:00,775 I thought for sure someone would find her immediately. 722 00:27:00,808 --> 00:27:02,708 You made it look like she was sleeping 723 00:27:02,743 --> 00:27:05,913 so you could buy enough time to escape the crime scene. 724 00:27:05,946 --> 00:27:07,816 No, I wanted to tell someone. 725 00:27:07,848 --> 00:27:09,188 FIRST MAN: But they wouldn't let me. 726 00:27:09,216 --> 00:27:11,716 They were scared of what he would do to us. 727 00:27:11,752 --> 00:27:13,182 Of what who would do to you? 728 00:27:13,220 --> 00:27:15,190 Lomis? You said you'd never met him? 729 00:27:15,222 --> 00:27:16,852 SECOND MAN: Online, man. 730 00:27:16,890 --> 00:27:20,200 Where reputations matter. 731 00:27:20,227 --> 00:27:22,197 He could destroy us. 732 00:27:22,229 --> 00:27:24,869 He could ruin our cred. 733 00:27:24,898 --> 00:27:26,198 You know what I can do? 734 00:27:26,233 --> 00:27:29,133 Put you in jail for the next 25 years. 735 00:27:29,169 --> 00:27:31,139 Who's collecting the phone-ransom money? 736 00:27:31,171 --> 00:27:33,871 I didn't know about the phones being ransomed, I swear. 737 00:27:33,907 --> 00:27:35,707 He hired us 738 00:27:35,743 --> 00:27:37,873 to install the box and clone the cards 739 00:27:37,911 --> 00:27:38,711 and buy the goods, that's it. 740 00:27:38,746 --> 00:27:40,376 Oh, come on, there was a server blade. 741 00:27:40,413 --> 00:27:41,813 What do you think that was for? 742 00:27:41,849 --> 00:27:43,759 That server blade? 743 00:27:43,784 --> 00:27:44,854 We didn't buy it. 744 00:27:44,885 --> 00:27:45,855 Lomis did. 745 00:27:45,886 --> 00:27:47,186 He sent it to us. 746 00:27:47,220 --> 00:27:48,730 He set us up to take the fall. 747 00:27:48,756 --> 00:27:50,226 You expect me to believe that? 748 00:27:50,257 --> 00:27:52,757 He didn't even show up... 749 00:27:52,793 --> 00:27:53,823 To collect his share of the take. 750 00:27:53,861 --> 00:27:55,991 Who passes up on that much money? 751 00:28:04,104 --> 00:28:05,934 I don't believe them. 752 00:28:05,973 --> 00:28:07,773 They know where Lomis is, they have to. 753 00:28:07,808 --> 00:28:08,948 No, they don't, Krumitz. 754 00:28:08,976 --> 00:28:10,346 They've never met him. 755 00:28:10,377 --> 00:28:12,377 Which is why your white whale never gets caught. 756 00:28:18,351 --> 00:28:20,351 (laughs) 757 00:28:36,036 --> 00:28:37,036 What is that? 758 00:28:37,070 --> 00:28:38,810 Lomis is taunting me. 759 00:28:38,839 --> 00:28:40,279 He knew I'd find the juice-jacking device, 760 00:28:40,307 --> 00:28:43,447 and he overrode the data with "Gotcha!" a bajillion times. 761 00:28:43,476 --> 00:28:44,516 All right, well, if he overwrote the data, 762 00:28:44,544 --> 00:28:46,944 there's no way to retrieve what was there before. 763 00:28:46,980 --> 00:28:47,920 Hence "Gotcha!" 764 00:28:47,948 --> 00:28:49,948 Those the shredded phones? 765 00:28:49,983 --> 00:28:51,883 Get on the floor! 766 00:28:51,919 --> 00:28:53,789 KRUMITZ: Yep. 767 00:28:53,821 --> 00:28:56,021 I figured they tried to destroy 'em because there's something on them 768 00:28:56,056 --> 00:28:57,796 they don't want me to find. 769 00:28:57,825 --> 00:29:01,195 I'm recovering all of the salvageable pieces. 770 00:29:07,835 --> 00:29:08,505 Anything? 771 00:29:08,535 --> 00:29:10,365 No. Not yet. 772 00:29:11,238 --> 00:29:13,408 Okay. I got your time stamp. 773 00:29:13,440 --> 00:29:14,910 Come on. 774 00:29:14,942 --> 00:29:17,042 Come on, come on, come on, come on. 775 00:29:17,077 --> 00:29:18,447 Yes! 776 00:29:18,478 --> 00:29:20,278 Did you just get his serial number? Yep. 777 00:29:23,951 --> 00:29:26,051 I got you now, Lomis. 778 00:29:26,086 --> 00:29:27,516 I'm gonna track this serial number 779 00:29:27,554 --> 00:29:29,524 right down to your evil lair. 780 00:29:29,556 --> 00:29:33,396 (trilling, beeping) 781 00:29:36,329 --> 00:29:42,039 You got to be kidding me. It's untraceable. 782 00:29:42,069 --> 00:29:44,909 Damn it! 783 00:29:47,640 --> 00:29:50,250 When was the last time you slept? 784 00:29:50,277 --> 00:29:53,417 Listen, man, I know it's hard, all right? 785 00:29:53,446 --> 00:29:56,486 I do. Believe me. All right, I ever tell you about the... 786 00:29:56,516 --> 00:29:59,956 the sleeper cell I tracked in Kandahar? 787 00:29:59,987 --> 00:30:03,287 117 degrees. 788 00:30:03,323 --> 00:30:04,493 Dry heat. 789 00:30:04,524 --> 00:30:06,954 It was the kind that-that chaps the inside of your mouth. 790 00:30:06,994 --> 00:30:08,624 All right, between the four of us, 791 00:30:08,661 --> 00:30:11,161 we had half a canteen of water left. 792 00:30:11,198 --> 00:30:15,108 We had been there for three days because I was obsessed. 793 00:30:15,135 --> 00:30:19,275 I knew if I stayed on 'em, if I persevered, 794 00:30:19,306 --> 00:30:21,246 I'd find 'em. 795 00:30:21,274 --> 00:30:24,074 I was wrong. 796 00:30:24,111 --> 00:30:25,471 So you just quit? 797 00:30:25,512 --> 00:30:27,442 You gave up? 798 00:30:27,480 --> 00:30:28,990 No. 799 00:30:29,016 --> 00:30:31,056 There's a big difference between quitting 800 00:30:31,084 --> 00:30:33,284 and just knowing when it's not your day. 801 00:30:35,188 --> 00:30:36,488 We need you in CTOC. 802 00:30:37,657 --> 00:30:38,927 When you're ready. 803 00:30:42,162 --> 00:30:44,162 Did you catch them? 804 00:30:49,069 --> 00:30:50,509 What do you think? 805 00:30:50,537 --> 00:30:52,607 I had to wait a month, but... 806 00:30:52,639 --> 00:30:55,209 believe me, it was worth it. 807 00:31:02,482 --> 00:31:04,952 SIFTER: Okay, we only have two hours 808 00:31:04,985 --> 00:31:07,415 before our victims' private data is released on the Web. 809 00:31:07,454 --> 00:31:09,584 How close are we to... anything? 810 00:31:09,622 --> 00:31:11,152 The code's sophisticated. 811 00:31:11,191 --> 00:31:12,691 We're getting there, but it's gonna take time. 812 00:31:12,725 --> 00:31:16,265 Against orders, some people paid the ransom already. 813 00:31:16,296 --> 00:31:17,966 Hey, guys, we got a problem. 814 00:31:17,998 --> 00:31:18,838 What is it? 815 00:31:18,865 --> 00:31:20,295 Lomis isn't waiting for the deadline. 816 00:31:20,333 --> 00:31:23,703 He's releasing people's information right now. 817 00:31:23,736 --> 00:31:25,976 And he started with the most powerful person first. 818 00:31:26,006 --> 00:31:28,546 I thought the senator already paid. 819 00:31:28,575 --> 00:31:30,305 Yeah, I thought she did, too. 820 00:31:30,343 --> 00:31:33,013 Well, this will be the headline on every national newscast. 821 00:31:33,046 --> 00:31:34,646 Got another one. 822 00:31:35,682 --> 00:31:37,342 RYAN: Chelsea's photos were released 823 00:31:37,384 --> 00:31:38,714 to a revenge porn site. 824 00:31:38,751 --> 00:31:40,611 Lomis isn't playing by the rules, 825 00:31:40,653 --> 00:31:42,483 which makes him very dangerous. 826 00:31:42,522 --> 00:31:44,452 KRUMITZ: Guys! Guys! 827 00:31:44,491 --> 00:31:46,321 I did it. 828 00:31:46,359 --> 00:31:48,199 I finally found Lomis. I got an I.D. 829 00:31:48,228 --> 00:31:49,628 How'd you find him? 830 00:31:49,662 --> 00:31:52,162 Just like you said-- go back to the evidence. 831 00:31:52,199 --> 00:31:54,039 So I took another look at the juice-jacking box. 832 00:31:54,067 --> 00:31:56,737 Lomis made it impossible to recover any data off that thing. 833 00:31:56,769 --> 00:31:58,139 You're right. 834 00:31:58,171 --> 00:32:00,301 Except for one thing: time. 835 00:32:00,340 --> 00:32:03,280 I know what time Lomis overwrote the data. 836 00:32:03,310 --> 00:32:06,080 It was four hours before we even found the box at the airport. 837 00:32:06,113 --> 00:32:08,643 That's around the time the first flights were taking off. 838 00:32:08,681 --> 00:32:11,611 He had to plug directly into the charging station 839 00:32:11,651 --> 00:32:13,011 to steal everyone's data. 840 00:32:13,053 --> 00:32:14,453 Lomis was there, in person. 841 00:32:14,487 --> 00:32:16,557 Yeah-- I pulled the airport security footage 842 00:32:16,589 --> 00:32:18,999 four hours before we arrived. 843 00:32:19,026 --> 00:32:20,156 (computer beeping) 844 00:32:20,193 --> 00:32:22,023 Say hello to Lomis. 845 00:32:36,443 --> 00:32:38,273 Okay, your point? 846 00:32:38,311 --> 00:32:39,511 I mean, this doesn't prove anything. 847 00:32:39,546 --> 00:32:41,516 Yeah, well, it's about to prove everything. 848 00:32:41,548 --> 00:32:43,318 I don't even know what you're showing me. 849 00:32:43,350 --> 00:32:45,490 KRUMITZ: Mr. Hart, we know the truth. 850 00:32:45,518 --> 00:32:48,558 HART: I'm telling you, you've got it wrong. 851 00:32:48,588 --> 00:32:50,228 RYAN: We have evidence... No! 852 00:32:51,391 --> 00:32:53,121 I mean, Willa is a straight-A student. 853 00:32:53,160 --> 00:32:55,070 She plays soccer, dance lessons, violin... 854 00:32:55,095 --> 00:32:56,195 KRUMITZ: Yeah... 855 00:32:56,229 --> 00:32:58,439 and she also took first place in the Miami-Dade County 856 00:32:58,465 --> 00:32:59,795 high school chess tournament. 857 00:32:59,832 --> 00:33:01,802 We get it-- she's a genius 858 00:33:01,834 --> 00:33:03,534 and you're a proud father. 859 00:33:03,570 --> 00:33:05,780 This is insane. 860 00:33:05,805 --> 00:33:08,545 All right, Willa's not a hacker. 861 00:33:08,575 --> 00:33:09,775 And she's a good kid. 862 00:33:09,809 --> 00:33:11,479 Maybe she is. 863 00:33:11,511 --> 00:33:13,041 But maybe she's not. 864 00:33:13,080 --> 00:33:15,320 I have a warrant for her tablet. 865 00:33:15,348 --> 00:33:16,548 If it's clean, she's innocent. 866 00:33:16,583 --> 00:33:19,813 And exactly the daughter you believe her to be. 867 00:33:19,852 --> 00:33:21,482 Why would she do this? 868 00:33:21,521 --> 00:33:23,181 (door opens) 869 00:33:24,357 --> 00:33:27,157 Dad, whose car is that in the driveway? 870 00:33:27,194 --> 00:33:29,494 KRUMITZ: Belongs to the Federal Bureau of Investigation. 871 00:33:31,364 --> 00:33:33,264 Hello, Lomis. 872 00:33:33,300 --> 00:33:35,470 It's nice to meet you. 873 00:33:36,436 --> 00:33:38,536 I've been waiting a long time for this. 874 00:33:42,209 --> 00:33:43,609 Gotcha. 875 00:33:47,580 --> 00:33:53,190 Everything about you is unexpected. 876 00:33:53,220 --> 00:33:55,130 We bought your disguise. 877 00:33:55,155 --> 00:33:56,525 We actually thought you were 878 00:33:56,556 --> 00:33:58,596 a 35-year-old man from Eastern Europe. 879 00:33:58,625 --> 00:34:01,225 Very clever. You went through all the trouble 880 00:34:01,261 --> 00:34:02,521 of stealing credit card information 881 00:34:02,562 --> 00:34:04,092 and never collected your take. 882 00:34:04,131 --> 00:34:06,631 You were the mastermind behind the whole plan. 883 00:34:06,666 --> 00:34:10,536 Stole all those credit card numbers but never met up 884 00:34:10,570 --> 00:34:12,540 with your accomplices to get paid. 885 00:34:12,572 --> 00:34:13,832 RYAN: But, then again, you couldn't. 886 00:34:13,873 --> 00:34:15,643 A 16-year-old girl couldn't show up 887 00:34:15,675 --> 00:34:18,275 at a hacker's house to collect. 888 00:34:18,311 --> 00:34:19,471 You would've blown your cover. 889 00:34:19,512 --> 00:34:20,872 So then you ransomed all the phones, 890 00:34:20,913 --> 00:34:22,583 and we thought you were gonna get paid that way. 891 00:34:22,615 --> 00:34:25,855 But then you began releasing the ransomed data anyway. 892 00:34:25,885 --> 00:34:28,825 Senator Finnis tried to pay you. 893 00:34:28,855 --> 00:34:30,455 But, to our surprise, you denied payment. 894 00:34:30,490 --> 00:34:32,530 Because it wasn't about the money. 895 00:34:32,559 --> 00:34:34,229 I have to know. 896 00:34:34,261 --> 00:34:35,591 What was this about? Why 897 00:34:35,628 --> 00:34:38,138 did you do it? 898 00:34:38,165 --> 00:34:39,535 Did you even 899 00:34:39,566 --> 00:34:42,266 think about the consequences? 900 00:34:42,302 --> 00:34:44,602 Senator Finnis, Michael Young, 901 00:34:44,637 --> 00:34:46,307 Victoria Fields, 902 00:34:46,339 --> 00:34:49,149 Simone Taylor-- you ruined their lives today. 903 00:34:51,644 --> 00:34:52,874 Look, this isn't a joke, 904 00:34:52,912 --> 00:34:54,712 Willa. Tell us why. 905 00:34:54,747 --> 00:34:56,417 Why did you do it? 906 00:34:56,449 --> 00:34:58,659 Because I wanted to. 907 00:35:00,653 --> 00:35:03,483 I was bored. I did it because I could. 908 00:35:13,566 --> 00:35:15,536 VICKNER: You saw this, right? 909 00:35:15,568 --> 00:35:17,308 SIFTER: Oh, yeah. 910 00:35:17,337 --> 00:35:18,377 It's a shame. 911 00:35:18,405 --> 00:35:20,535 The senator's husband and children learning her 912 00:35:20,573 --> 00:35:23,373 sexual preference from the front page of a paper, it's... 913 00:35:23,410 --> 00:35:25,620 Yeah, well, privacy is a myth. 914 00:35:25,645 --> 00:35:27,575 Personal info is the new commodity. 915 00:35:28,715 --> 00:35:30,545 I, uh... I understand three other people 916 00:35:30,583 --> 00:35:32,183 had their information released. 917 00:35:32,219 --> 00:35:35,289 Well, Lomis had access to 300 phones 918 00:35:35,322 --> 00:35:36,722 and whatever was on them. 919 00:35:36,756 --> 00:35:37,956 We got her. 920 00:35:37,990 --> 00:35:40,900 I mean, we confiscated all of her devices. 921 00:35:40,927 --> 00:35:42,627 She had plenty of time to make copies 922 00:35:42,662 --> 00:35:45,692 and distribute them to anyone. 923 00:35:45,732 --> 00:35:47,492 And what they do with it... 924 00:35:47,534 --> 00:35:48,804 only time will tell. 925 00:35:50,337 --> 00:35:52,577 What's this? 926 00:35:52,605 --> 00:35:54,505 That's me keeping you in the loop. 927 00:35:54,541 --> 00:35:58,471 I-I still can't believe that she's just a teenager. 928 00:35:58,511 --> 00:36:01,681 So, Colin... Yeah. 929 00:36:01,714 --> 00:36:03,684 Can I be honest with you? 930 00:36:03,716 --> 00:36:06,456 I was a little pissed off I didn't get that promotion. 931 00:36:06,486 --> 00:36:07,616 I was. 932 00:36:07,654 --> 00:36:10,354 I just felt I was 933 00:36:10,390 --> 00:36:12,660 the best man for the job. 934 00:36:12,692 --> 00:36:14,522 So did I. 935 00:36:14,561 --> 00:36:17,261 I mean-- think that I was the best man for the job. 936 00:36:17,297 --> 00:36:19,297 Look, I'll-I'll admit it-- 937 00:36:19,332 --> 00:36:21,562 there's not a whole lot that I know 938 00:36:21,601 --> 00:36:24,901 about what you and your people do. 939 00:36:24,937 --> 00:36:27,707 That's not an enviable position. You're not gonna 940 00:36:27,740 --> 00:36:28,980 try and hug me now, are you? 941 00:36:29,008 --> 00:36:31,748 No. In fact, my job practically guarantees 942 00:36:31,778 --> 00:36:33,318 I am gonna be a constant 943 00:36:33,346 --> 00:36:35,616 pain in your ass. 944 00:36:35,648 --> 00:36:38,658 But listen, I'm the least of your worries. 945 00:36:42,722 --> 00:36:44,452 Tomorrow's criminal. 946 00:36:44,491 --> 00:36:47,721 That is who you're gonna lose sleep over. 947 00:36:47,760 --> 00:36:49,770 Good night. 948 00:36:50,997 --> 00:36:52,997 Good night. 949 00:37:01,808 --> 00:37:03,308 What's that? 950 00:37:04,777 --> 00:37:06,047 Postcard. 951 00:37:06,078 --> 00:37:07,748 From Lomis? 952 00:37:09,048 --> 00:37:11,658 Sent the moment the prosecutor released her from custody. 953 00:37:11,684 --> 00:37:14,784 It's not fair. 954 00:37:14,821 --> 00:37:16,781 She gets to walk because 955 00:37:16,823 --> 00:37:19,523 she happens to be 16, but she is a criminal. 956 00:37:19,559 --> 00:37:21,699 But she's a cyber criminal. 957 00:37:21,728 --> 00:37:23,728 And we both know that sentencing guidelines 958 00:37:23,763 --> 00:37:25,733 make it very difficult to prosecute 959 00:37:25,765 --> 00:37:27,635 if they're under 21. 960 00:37:27,667 --> 00:37:29,737 It's like we're encouraging kids 961 00:37:29,769 --> 00:37:31,739 to become black hats. 962 00:37:31,771 --> 00:37:33,771 Well, maybe one day that law will change. 963 00:37:33,806 --> 00:37:34,746 But today... 964 00:37:34,774 --> 00:37:36,774 you need to be very grateful that we couldn't 965 00:37:36,809 --> 00:37:38,479 prosecute. Now, did you 966 00:37:38,511 --> 00:37:40,541 intend to break the law or was that accidental? 967 00:37:40,580 --> 00:37:41,720 'Cause I really want to believe 968 00:37:41,748 --> 00:37:44,588 you had no idea that what you were doing was illegal. 969 00:37:46,386 --> 00:37:49,456 I know you paid off the ransomed phone via text. 970 00:37:53,726 --> 00:37:57,796 And with that payment you bundled a Remote Access Trojan. 971 00:37:57,830 --> 00:37:59,640 That's illegal. 972 00:38:03,870 --> 00:38:06,010 You took control of Lomis' desktop computer 973 00:38:06,038 --> 00:38:09,648 and you snapped a picture. 974 00:38:10,977 --> 00:38:12,947 KRUMITZ: Guys. Guys. 975 00:38:12,979 --> 00:38:15,019 I did it. 976 00:38:15,047 --> 00:38:17,417 I finally found Lomis. I got an I.D. 977 00:38:17,450 --> 00:38:19,060 How'd you know? 978 00:38:19,085 --> 00:38:20,755 You told me. 979 00:38:20,787 --> 00:38:22,427 KRUMITZ: And she also took first place 980 00:38:22,455 --> 00:38:23,885 in the Miami-Dade County high school chess 981 00:38:23,923 --> 00:38:26,723 tournament. We get it-- she's a genius 982 00:38:26,759 --> 00:38:28,029 and you're a proud father. 983 00:38:28,060 --> 00:38:30,130 You couldn't know she was a chess champion 984 00:38:30,162 --> 00:38:31,692 unless you were in her bedroom, 985 00:38:31,731 --> 00:38:33,861 and I knew that you weren't. So I 986 00:38:33,900 --> 00:38:36,740 accessed your Bureau files and I found that photo. 987 00:38:36,769 --> 00:38:39,039 Without my authorization 988 00:38:39,071 --> 00:38:40,731 and a judge's subpoena, 989 00:38:40,773 --> 00:38:42,873 you broke the law when you took that photo. 990 00:38:42,909 --> 00:38:45,149 It was a digital search without a warrant. 991 00:38:45,177 --> 00:38:47,977 I couldn't let Lomis win again. 992 00:38:48,014 --> 00:38:49,984 And I know this sounds insane, 993 00:38:50,016 --> 00:38:53,616 but I... 994 00:38:53,653 --> 00:38:55,983 I needed to justify your decision to hire me. 995 00:38:56,022 --> 00:38:58,522 Your belief in me. 996 00:38:58,558 --> 00:39:01,098 I started at the FBI pushing a mail cart. 997 00:39:01,127 --> 00:39:04,497 And I would've been there forever, but you found me. 998 00:39:04,531 --> 00:39:06,491 I hadn't been in CTOC ten minutes 999 00:39:06,533 --> 00:39:08,503 before I realized how dedicated you were. 1000 00:39:08,535 --> 00:39:09,805 And watching you 1001 00:39:09,836 --> 00:39:13,136 love your job 1002 00:39:13,172 --> 00:39:16,042 made me love my job. 1003 00:39:19,045 --> 00:39:21,615 And made me never want to let you down. 1004 00:39:23,850 --> 00:39:25,820 I didn't know what else to do. 1005 00:39:27,787 --> 00:39:29,757 That is no excuse. 1006 00:39:29,789 --> 00:39:31,899 What if Lomis was a 35-year-old man? 1007 00:39:31,924 --> 00:39:33,124 I know. He would have walked. 1008 00:39:33,159 --> 00:39:36,129 And I would've been forced to turn you in. 1009 00:39:38,831 --> 00:39:40,561 Today's your lucky day. 1010 00:39:40,600 --> 00:39:42,770 Your mistake is not sending you to prison. 1011 00:39:42,802 --> 00:39:44,802 It's dying here with me. 1012 00:39:46,238 --> 00:39:48,908 But I want you to think about something. 1013 00:39:48,941 --> 00:39:51,201 Does victory really taste so sweet 1014 00:39:51,243 --> 00:39:53,543 when you haven't earned it honestly? 1015 00:40:26,713 --> 00:40:28,983 Captioning sponsored by CBS 1016 00:40:29,015 --> 00:40:32,115 Captioned by Media Access Group at WGBH access.wgbh.org