1 00:00:00,822 --> 00:00:01,822 My name is Avery Ryan. 2 00:00:01,856 --> 00:00:05,126 I was a victim of cyber crime. 3 00:00:05,160 --> 00:00:07,600 Like you, I posted on social media, 4 00:00:07,629 --> 00:00:10,439 checked my bank account balance online, 5 00:00:10,465 --> 00:00:12,435 even kept the confidential files 6 00:00:12,467 --> 00:00:14,637 of my psychological practice on my computer. 7 00:00:16,471 --> 00:00:19,371 Then I was hacked, and as a result, 8 00:00:19,408 --> 00:00:21,748 one of my patients was murdered. 9 00:00:21,776 --> 00:00:24,376 My investigation into her death led me to the FBI, 10 00:00:24,413 --> 00:00:27,183 where I joined a team of cyber experts 11 00:00:27,216 --> 00:00:30,086 to wage a war against a new breed of criminal 12 00:00:30,119 --> 00:00:33,129 hiding on the Deep Web... 13 00:00:33,155 --> 00:00:36,155 infiltrating our daily lives in ways we never imagined... 14 00:00:37,726 --> 00:00:39,696 ...faceless... 15 00:00:39,728 --> 00:00:42,098 nameless... 16 00:00:42,131 --> 00:00:43,691 lurking inside our devices, 17 00:00:43,732 --> 00:00:46,332 just a keystroke away. 18 00:00:59,714 --> 00:01:01,784 Coffee, thanks. 19 00:01:01,816 --> 00:01:02,816 Okay. 20 00:01:05,654 --> 00:01:07,824 (phone ringing) 21 00:01:11,593 --> 00:01:13,663 Here you go. 22 00:01:25,407 --> 00:01:27,407 Watch it, man! 23 00:01:37,386 --> 00:01:38,386 (car honks) 24 00:01:38,420 --> 00:01:39,690 (distorted): Hey! Get out 25 00:01:39,721 --> 00:01:40,881 of the street, man. 26 00:01:48,297 --> 00:01:49,267 (woman screams) 27 00:01:49,298 --> 00:01:50,368 MAN: Get an ambulance! 28 00:01:50,399 --> 00:01:52,409 MAN 2: I'll call 911. 29 00:01:54,769 --> 00:01:56,679 Cleveland coroner sent this scan 30 00:01:56,705 --> 00:01:58,235 of victim Carl Bruno. 31 00:01:58,273 --> 00:01:59,543 Male. 32 00:01:59,574 --> 00:02:02,174 36. 33 00:02:02,211 --> 00:02:04,471 C.O.D. was blunt force trauma from vehicular impact. 34 00:02:04,513 --> 00:02:06,783 Witnesses described him as being disoriented 35 00:02:06,815 --> 00:02:08,385 and possibly hallucinating 36 00:02:08,417 --> 00:02:09,487 just prior to the accident. 37 00:02:09,518 --> 00:02:11,858 How did Mr. Bruno's death get on the FDA's radar? 38 00:02:11,886 --> 00:02:15,786 This prescription bottle was found at the accident scene. 39 00:02:15,824 --> 00:02:17,194 They're drugs purchased 40 00:02:17,226 --> 00:02:18,426 from an online Canadian pharmacy. 41 00:02:18,460 --> 00:02:20,800 JPBPharmacy.com. 42 00:02:20,829 --> 00:02:22,839 The Federal Drug Administration has been tracking this pharmacy 43 00:02:22,864 --> 00:02:24,694 for about two weeks based on complaints 44 00:02:24,733 --> 00:02:26,463 coming in to our MedWatch hotline. 45 00:02:26,501 --> 00:02:28,361 The callers all have similar stories. 46 00:02:28,403 --> 00:02:29,503 Bad reactions to drugs 47 00:02:29,538 --> 00:02:30,638 they've purchased online. 48 00:02:30,672 --> 00:02:31,872 No one's died until now. 49 00:02:31,906 --> 00:02:33,976 The FDA has an investigative arm, OCI. 50 00:02:34,008 --> 00:02:35,708 Why come to Cyber? 51 00:02:35,744 --> 00:02:36,844 We believe there 52 00:02:36,878 --> 00:02:40,488 are fraudulent ads on the medical Web site, ScrollMD. 53 00:02:40,515 --> 00:02:42,885 Over 800,000 people visit the site a day, 54 00:02:42,917 --> 00:02:45,457 most seeking a second opinion, 55 00:02:45,487 --> 00:02:47,757 searching for general health conditions, 56 00:02:47,789 --> 00:02:49,399 others for specific drugs. 57 00:02:49,424 --> 00:02:51,254 The site users are being lured 58 00:02:51,293 --> 00:02:53,523 to JPBPharmacy.com through these unauthorized ads. 59 00:02:53,562 --> 00:02:55,522 RYAN: The ads are redirecting site users 60 00:02:55,564 --> 00:02:56,894 to what could be 61 00:02:56,931 --> 00:02:58,331 a fictitious pharmacy. 62 00:02:58,367 --> 00:03:00,267 Sounds like a click-baiting scheme. 63 00:03:00,302 --> 00:03:02,872 Tramizor is the drug Carl Bruno ordered. 64 00:03:02,904 --> 00:03:04,234 It's used to treat heart disease, 65 00:03:04,273 --> 00:03:05,773 but... 66 00:03:05,807 --> 00:03:07,777 the victim's 67 00:03:07,809 --> 00:03:09,919 arterial walls show considerable plaque build-up. 68 00:03:09,944 --> 00:03:11,774 The drug was ineffective. 69 00:03:11,813 --> 00:03:13,983 Because it had little to no pharmacological ingredient. 70 00:03:14,015 --> 00:03:15,815 Carl Bruno was duped into buying what he thought 71 00:03:15,850 --> 00:03:18,620 was real Tramizor, when in fact it was placebo. 72 00:03:18,653 --> 00:03:20,583 ORTEGA: Not just a placebo. 73 00:03:22,457 --> 00:03:25,257 There's signs of inflammation in the brain. 74 00:03:25,294 --> 00:03:27,594 Tox report revealed trace amounts of aflatoxins. 75 00:03:27,629 --> 00:03:28,929 Fungus? 76 00:03:28,963 --> 00:03:29,963 Along with oxycodone. 77 00:03:29,998 --> 00:03:32,838 A pain reliever, mood enhancer. 78 00:03:32,867 --> 00:03:34,437 So the victims felt like they were getting better 79 00:03:34,469 --> 00:03:35,809 while they were taking the drugs, 80 00:03:35,837 --> 00:03:37,307 when actually they weren't. 81 00:03:38,407 --> 00:03:39,477 Carl Bruno's death 82 00:03:39,508 --> 00:03:41,448 wasn't an accident. 83 00:03:41,476 --> 00:03:44,316 It was homicide. 84 00:03:46,848 --> 00:03:49,318 What's the latest on the ScrollMD Web site? 85 00:03:49,351 --> 00:03:50,911 HTML injection. 86 00:03:50,952 --> 00:03:52,012 Check it out. 87 00:03:52,053 --> 00:03:53,453 Someone hacked a curtain ad 88 00:03:53,488 --> 00:03:54,728 on the ScrollMD site. 89 00:03:54,756 --> 00:03:56,696 It looks like a normal ad, right? 90 00:03:56,725 --> 00:03:58,855 And this is the code for the ad, 91 00:03:58,893 --> 00:04:00,793 but peekaboo. 92 00:04:00,829 --> 00:04:01,729 (gasps) There's actually 93 00:04:01,763 --> 00:04:04,533 two codes written right on top of each other. 94 00:04:04,566 --> 00:04:05,736 NELSON: A click-baiting scheme. 95 00:04:05,767 --> 00:04:07,067 Right, like Avery predicted, 96 00:04:07,101 --> 00:04:10,571 and if you toggle between them, the fake ad 97 00:04:10,605 --> 00:04:12,305 is masking the legitimate ad. 98 00:04:12,341 --> 00:04:14,401 The target had to breach the ScrollMD servers 99 00:04:14,443 --> 00:04:15,873 to inject this code. 100 00:04:15,910 --> 00:04:17,750 So ScrollMD wasn't aware of the intrusion? 101 00:04:17,779 --> 00:04:19,919 No, and it's not just about the ads. 102 00:04:19,948 --> 00:04:21,918 It's about how people are getting to the ads. 103 00:04:21,950 --> 00:04:24,560 So if you search "heart disease," 104 00:04:24,586 --> 00:04:26,456 like our vic, 105 00:04:26,488 --> 00:04:28,958 you get the heart disease info page. 106 00:04:28,990 --> 00:04:30,660 Fine, okay, 107 00:04:30,692 --> 00:04:32,992 but if you search general symptoms like "fatigue," 108 00:04:33,027 --> 00:04:35,497 or "nausea" and you click around long enough, 109 00:04:35,530 --> 00:04:37,670 you end up... 110 00:04:37,699 --> 00:04:38,869 At the heart disease info page. 111 00:04:38,900 --> 00:04:40,470 NELSON: Yeah, I tried it, too. 112 00:04:40,502 --> 00:04:41,902 I got this rash on my elbow. 113 00:04:41,936 --> 00:04:43,776 It-it's not on his elbow. 114 00:04:43,805 --> 00:04:45,435 Look, I searched "rash," 115 00:04:45,474 --> 00:04:47,904 then it took me down some wormhole of related symptoms, 116 00:04:47,942 --> 00:04:49,942 and then eventually, I ended up on a page 117 00:04:49,978 --> 00:04:51,778 that said I had cancer. The algorithm takes 118 00:04:51,813 --> 00:04:54,043 any symptom and links it up with a bunch of others. 119 00:04:54,082 --> 00:04:55,542 You type in "fatigue," 120 00:04:55,584 --> 00:04:57,914 "insomnia," "dizziness," 121 00:04:57,952 --> 00:04:59,752 you get "heart disease." 122 00:04:59,788 --> 00:05:01,728 Next thing you know, you're paranoid, self-diagnosing, 123 00:05:01,756 --> 00:05:03,726 thinking you have symptoms you don't even have. 124 00:05:03,758 --> 00:05:05,758 Taking advantage of the closet hypochondriac in all of us. 125 00:05:05,794 --> 00:05:06,864 Exactly. 126 00:05:06,895 --> 00:05:08,425 Except in your case, Nelson. 127 00:05:08,463 --> 00:05:09,763 I'd get that, uh, 128 00:05:09,798 --> 00:05:11,998 elbow rash checked out. 129 00:05:12,033 --> 00:05:14,363 (softly): What? 130 00:05:15,770 --> 00:05:18,140 So, our phony pharmacy is not just selling Tramizor. 131 00:05:18,172 --> 00:05:20,372 We've discovered nine other drugs. 132 00:05:20,409 --> 00:05:22,649 I got Damitrol for high blood pressure. 133 00:05:22,677 --> 00:05:24,777 Anfedril, that's diabetes. 134 00:05:24,813 --> 00:05:27,083 Lindrexia, that's that miracle cancer drug. 135 00:05:27,115 --> 00:05:29,015 How do you know so much about prescription drugs? 136 00:05:29,050 --> 00:05:29,820 Oh, just research. 137 00:05:29,851 --> 00:05:32,011 You know, I like to stay informed. 138 00:05:32,053 --> 00:05:33,523 (chuckles) You're a hypochondriac. 139 00:05:33,555 --> 00:05:35,085 No. (grunts) 140 00:05:35,123 --> 00:05:37,053 As much as I love being psychoanalyzed, 141 00:05:37,091 --> 00:05:38,921 we've got a target that needs to be profiled. 142 00:05:38,960 --> 00:05:40,930 Okay, he, like you, is organized, 143 00:05:40,962 --> 00:05:43,792 ambitious, sophisticated, tech-savvy. 144 00:05:43,832 --> 00:05:45,862 The drugs he's chosen to distribute 145 00:05:45,900 --> 00:05:47,140 are the most expensive 146 00:05:47,168 --> 00:05:48,868 and sought after in their categories. 147 00:05:48,903 --> 00:05:51,033 Modern day snake oil salesman. 148 00:05:51,072 --> 00:05:53,402 You know, it used to be these guys were selling their wares 149 00:05:53,442 --> 00:05:54,902 out of car trunks, and now... 150 00:05:54,943 --> 00:05:56,773 Well, this guy's masquerading on the Internet. 151 00:05:56,811 --> 00:05:58,441 He could have links to organized crime. 152 00:05:58,480 --> 00:06:02,090 Gangs and cartels already have distribution networks. 153 00:06:02,116 --> 00:06:03,716 Well, penalties 154 00:06:03,752 --> 00:06:05,082 for counterfeiting pharmaceuticals 155 00:06:05,119 --> 00:06:07,859 are less severe than trafficking narcotics. 156 00:06:07,889 --> 00:06:10,099 You think he's trying to lure people into the Deep Web? 157 00:06:10,124 --> 00:06:11,594 You know, that's the scary part. 158 00:06:11,626 --> 00:06:12,996 He doesn't have to. 159 00:06:13,027 --> 00:06:15,527 He's operating almost entirely on the Surface Web, 160 00:06:15,564 --> 00:06:17,734 where he can reach millions of everyday citizens. 161 00:06:17,766 --> 00:06:19,166 Well, does that give us a better chance 162 00:06:19,200 --> 00:06:21,040 of drawing him into the real world? 163 00:06:21,069 --> 00:06:22,979 Not necessarily. Guys like him 164 00:06:23,004 --> 00:06:26,104 know how to operate out in the open without getting caught. 165 00:06:26,140 --> 00:06:28,080 Which, in a way, makes him more elusive 166 00:06:28,109 --> 00:06:29,519 (phone rings) and more dangerous. 167 00:06:29,544 --> 00:06:30,944 Sifter. 168 00:06:30,979 --> 00:06:33,019 Wait, who? 169 00:06:33,047 --> 00:06:34,987 She's here now? 170 00:06:35,016 --> 00:06:37,086 Uh, escort her up. 171 00:06:37,118 --> 00:06:38,558 (elevator bell dings) 172 00:06:43,792 --> 00:06:45,652 Mrs. Bruno, 173 00:06:45,694 --> 00:06:47,594 I'm Assistant Deputy Director Simon Sifter. 174 00:06:47,629 --> 00:06:50,069 This is Special Agent Avery Ryan. 175 00:06:50,098 --> 00:06:52,038 The FDA told me you were handling my husband's case. 176 00:06:52,066 --> 00:06:53,006 Right, I am so sorry 177 00:06:53,034 --> 00:06:54,604 for your loss, but I'm afraid 178 00:06:54,636 --> 00:06:56,206 we don't have any answers yet. 179 00:06:56,237 --> 00:06:58,007 I had... I had to come. 180 00:06:58,039 --> 00:06:58,939 RYAN: It's all right, Mrs. Bruno. 181 00:06:58,973 --> 00:07:01,703 It's only natural you'd have questions. 182 00:07:01,743 --> 00:07:03,913 It was me. 183 00:07:03,945 --> 00:07:05,975 I'm responsible for my husband's death. 184 00:07:10,652 --> 00:07:13,122 I was the one who bought the Tramizor for Carl. 185 00:07:13,154 --> 00:07:14,324 Last summer, he had a heart attack, 186 00:07:14,355 --> 00:07:17,595 and his doctor prescribed Tramizor to prevent another one. 187 00:07:17,626 --> 00:07:19,766 Our insurance plan changed. 188 00:07:19,794 --> 00:07:22,124 They didn't cover this particular medication. 189 00:07:22,163 --> 00:07:24,093 We had to decide. 190 00:07:24,132 --> 00:07:27,102 Pay for Carl's meds or buy groceries. 191 00:07:27,135 --> 00:07:28,865 So I went online. 192 00:07:28,903 --> 00:07:31,033 When I saw the ad for the pharmacy, I was so relieved. 193 00:07:31,072 --> 00:07:34,002 I just assumed that because it was on ScrollMD, 194 00:07:34,042 --> 00:07:35,172 it was safe. 195 00:07:37,178 --> 00:07:39,948 Carl was skeptical. 196 00:07:39,981 --> 00:07:42,811 He thought it was too good to be true. 197 00:07:42,851 --> 00:07:44,251 But we were desperate, 198 00:07:44,285 --> 00:07:46,555 and when the pill looked identical 199 00:07:46,588 --> 00:07:47,828 to the real thing... 200 00:07:47,856 --> 00:07:49,126 SIFTER: Did you ever speak 201 00:07:49,157 --> 00:07:50,527 with anybody or attempt 202 00:07:50,559 --> 00:07:52,799 to contact the pharmacy by phone or...? 203 00:07:52,827 --> 00:07:54,897 My only contact was online. 204 00:07:54,929 --> 00:07:57,299 I was so stupid to trust this Web site, 205 00:07:57,331 --> 00:08:00,031 and I printed every receipt and e-mail. 206 00:08:00,068 --> 00:08:02,778 I looked for anything to help your investigation. 207 00:08:03,772 --> 00:08:05,602 JPB Pharmacy. 208 00:08:05,640 --> 00:08:06,880 We were on a monthly plan. 209 00:08:06,908 --> 00:08:08,978 They delivered that package yesterday. 210 00:08:09,010 --> 00:08:10,680 Hmm, no return address, 211 00:08:10,712 --> 00:08:12,242 but there is a return zip code. 212 00:08:15,917 --> 00:08:17,217 NELSON: This is what we got? 213 00:08:17,251 --> 00:08:19,951 562 I.P. addresses on a map? 214 00:08:19,988 --> 00:08:22,628 To hunt down one zip code on a postmark? 215 00:08:22,657 --> 00:08:24,857 Yep, Avery wants us to filter this down 216 00:08:24,893 --> 00:08:26,593 to the one machine that stamped this package 217 00:08:26,628 --> 00:08:28,298 by the time she lands in San Antonio. 218 00:08:28,329 --> 00:08:29,939 Okay. 219 00:08:29,964 --> 00:08:31,864 Tell you what. 220 00:08:31,900 --> 00:08:33,070 We'll take turns filtering the data. 221 00:08:33,101 --> 00:08:34,731 First one to get stumped 222 00:08:34,769 --> 00:08:36,639 takes the late shift for three weekends straight. 223 00:08:36,671 --> 00:08:38,301 Okay, I'll go first. 224 00:08:38,339 --> 00:08:40,909 Let's nix all the machines with I.P. addresses 225 00:08:40,942 --> 00:08:41,902 associated with big corporations. 226 00:08:41,943 --> 00:08:43,943 Executive assistants and guys in the mail room 227 00:08:43,978 --> 00:08:46,248 probably aren't counterfeit drug lords. 228 00:08:46,280 --> 00:08:49,290 218 gone. 229 00:08:49,317 --> 00:08:52,017 The machines record the weight and postage of each package. 230 00:08:52,053 --> 00:08:54,783 So let's just eliminate all the ones that only sent out letters. 231 00:08:59,928 --> 00:09:00,998 Bam. 232 00:09:01,029 --> 00:09:02,129 Beat that. Okay. 233 00:09:02,163 --> 00:09:03,933 Package cost $1.82. 234 00:09:03,965 --> 00:09:06,705 We just eliminate any machine that didn't record $1.82. 235 00:09:06,735 --> 00:09:08,235 Okay? 236 00:09:08,269 --> 00:09:10,909 Okay, big bro, let me run with that. 237 00:09:10,939 --> 00:09:13,009 The meter stamp also has a date, 238 00:09:13,041 --> 00:09:14,341 and since we already know the postage, 239 00:09:14,375 --> 00:09:16,075 $1.82. we can eliminate 240 00:09:16,110 --> 00:09:18,120 any machine that didn't record that amount 241 00:09:18,146 --> 00:09:19,076 on this same date. 242 00:09:19,113 --> 00:09:20,883 That's only four left. 243 00:09:20,915 --> 00:09:22,045 I got this. 244 00:09:22,083 --> 00:09:24,013 I got this, I got this. 245 00:09:25,019 --> 00:09:26,389 Package weighs 246 00:09:26,420 --> 00:09:27,990 5.3 ounces. 247 00:09:28,022 --> 00:09:30,922 Meter machine is accurate to a tenth of an ounce. 248 00:09:30,959 --> 00:09:32,199 So which of the remaining four machines sent out 249 00:09:32,226 --> 00:09:35,026 a package costing $1.82 weighing 5.3 ounces 250 00:09:35,063 --> 00:09:36,193 on this exact date? 251 00:09:36,230 --> 00:09:39,070 Mm-hmm. 252 00:09:41,269 --> 00:09:42,339 (grunts) 253 00:09:42,370 --> 00:09:43,340 Yeah! That's what 254 00:09:43,371 --> 00:09:44,531 I'm talking about. 255 00:09:44,572 --> 00:09:47,272 Go ahead and pull up that Internet service provider, man. 256 00:09:47,308 --> 00:09:49,178 Okay, I'm getting the hard location for the I.P. address now. 257 00:09:49,210 --> 00:09:50,420 Looks like you're gonna be 258 00:09:50,444 --> 00:09:51,874 enjoying the late shift, my friend. 259 00:09:51,913 --> 00:09:53,813 Who, me? Yeah, you. 260 00:09:53,848 --> 00:09:56,048 Uh-uh. Uh-huh. 261 00:09:56,084 --> 00:09:58,384 Oh, got an address. 262 00:09:58,419 --> 00:10:00,929 Avery, it's me. 263 00:10:00,955 --> 00:10:03,055 545 Oakland Way, San Antonio. 264 00:10:05,860 --> 00:10:07,870 * 265 00:10:16,204 --> 00:10:17,634 FBI! Open up! 266 00:10:23,211 --> 00:10:25,211 * 267 00:10:44,866 --> 00:10:47,006 RYAN: Show me your hands! 268 00:10:52,040 --> 00:10:54,050 Turn around slowly. 269 00:11:05,987 --> 00:11:08,757 RYAN: I have a theory, Paul. 270 00:11:08,790 --> 00:11:11,200 You tell me if I'm in the ballpark. 271 00:11:11,225 --> 00:11:14,195 You're involved with an illegal prescription drug ring, 272 00:11:14,228 --> 00:11:16,128 scamming people over the Internet. 273 00:11:16,164 --> 00:11:18,934 You're not the boss, you're just a middleman. 274 00:11:18,967 --> 00:11:22,907 You took this job not for the money, 275 00:11:22,937 --> 00:11:24,377 but because you need access 276 00:11:24,405 --> 00:11:26,235 to the same drugs you're distributing. 277 00:11:26,274 --> 00:11:28,744 I'm assuming Lindrexia? 278 00:11:28,777 --> 00:11:30,517 You have cancer? 279 00:11:30,544 --> 00:11:32,814 Oh, congratulations. 280 00:11:32,847 --> 00:11:34,147 You get a gold star. 281 00:11:34,182 --> 00:11:35,282 MUNDO: Paul, the drugs you're taking 282 00:11:35,316 --> 00:11:37,216 are counterfeit. 283 00:11:37,251 --> 00:11:38,881 They're full of toxic contaminants 284 00:11:38,920 --> 00:11:40,090 that are making you sicker. 285 00:11:40,121 --> 00:11:42,181 That's not true, I'm feeling better. 286 00:11:42,223 --> 00:11:44,423 That's because they're also laced with oxycodone. 287 00:11:44,458 --> 00:11:46,498 That's what's relieving your pain, 288 00:11:46,527 --> 00:11:47,897 making you feel euphoric. 289 00:11:49,297 --> 00:11:50,467 I'm getting better. 290 00:11:50,498 --> 00:11:51,498 I know I am. 291 00:11:53,434 --> 00:11:55,064 Have to be. 292 00:11:55,103 --> 00:11:57,103 How were you first contacted about this job? 293 00:11:57,138 --> 00:12:00,908 I met a guy on a cancer support chat group online. 294 00:12:02,310 --> 00:12:04,820 Said he had access to black market Lindrexia 295 00:12:04,846 --> 00:12:06,146 and said I could have some 296 00:12:06,180 --> 00:12:07,820 if I helped him distribute it. 297 00:12:07,849 --> 00:12:09,989 Did you ever meet with him in person? 298 00:12:10,018 --> 00:12:11,288 No. Never. 299 00:12:11,319 --> 00:12:12,189 It was always a dead drop. 300 00:12:12,220 --> 00:12:14,490 No one was ever there. 301 00:12:14,522 --> 00:12:17,052 Lung cancer. 302 00:12:18,860 --> 00:12:20,170 Kicked it twice. 303 00:12:20,194 --> 00:12:22,494 It came back a third time. 304 00:12:22,530 --> 00:12:25,340 I asked my doctors for Lindrexia, 305 00:12:25,366 --> 00:12:27,506 and they said no. 306 00:12:27,535 --> 00:12:30,175 See, the thing is, it's a miracle drug, 307 00:12:30,204 --> 00:12:31,874 but that miracle's only approved 308 00:12:31,906 --> 00:12:34,206 for first and second-line patients. 309 00:12:34,242 --> 00:12:36,912 If you're a third-timer like me, 310 00:12:36,945 --> 00:12:39,175 well, you're crap out of luck. 311 00:12:39,213 --> 00:12:42,243 Doctors say I'm a lost cause. 312 00:12:42,283 --> 00:12:43,583 Well, it's not just phony Lindrexia 313 00:12:43,617 --> 00:12:45,257 that you're shipping out. 314 00:12:45,286 --> 00:12:46,386 There are nine other drugs, 315 00:12:46,420 --> 00:12:48,260 one of them a heart medication. 316 00:12:48,289 --> 00:12:49,259 Killed a man 317 00:12:49,290 --> 00:12:50,230 in Cleveland. 318 00:12:50,258 --> 00:12:53,098 Well, the packages I get are already sealed. 319 00:12:53,127 --> 00:12:56,027 My job is just to stamp 'em and ship 'em out. 320 00:12:56,064 --> 00:12:57,894 Well, this is, this is just supposed to be 321 00:12:57,932 --> 00:12:59,932 a way around the drug companies. 322 00:13:02,937 --> 00:13:05,077 I just wanted to help people. 323 00:13:07,976 --> 00:13:10,276 (crying): Just wanted to help people. 324 00:13:11,479 --> 00:13:13,489 And now you're telling me I killed a man? 325 00:13:15,649 --> 00:13:17,189 Guy who died? 326 00:13:18,386 --> 00:13:20,326 How old was he? 327 00:13:20,354 --> 00:13:22,184 He was about your age. 328 00:13:22,223 --> 00:13:24,093 Figures. 329 00:13:26,260 --> 00:13:28,100 Death always finds a way. 330 00:13:28,129 --> 00:13:31,239 (coughing) 331 00:13:31,265 --> 00:13:33,505 Are you okay, Paul? 332 00:13:33,534 --> 00:13:35,064 I'm fine. 333 00:13:35,103 --> 00:13:37,203 I'm gonna get you some water. 334 00:13:39,173 --> 00:13:41,173 I just need a minute. 335 00:13:53,687 --> 00:13:54,657 (thud) 336 00:13:54,688 --> 00:13:56,658 (glass shattering) 337 00:13:56,690 --> 00:13:58,200 No, no, no, no! 338 00:13:58,226 --> 00:13:59,156 No, no! We need some help in here! 339 00:13:59,193 --> 00:14:00,193 Someone get first aid! 340 00:14:00,228 --> 00:14:01,968 (cell phone dialing) Yeah, I need an ambulance. 341 00:14:01,996 --> 00:14:03,666 545 Oakland Way. 342 00:14:03,697 --> 00:14:05,337 PAUL: Ah... no... 343 00:14:05,366 --> 00:14:06,136 RYAN: Stay with me, Paul! 344 00:14:09,070 --> 00:14:10,480 Stay with me, Paul, stay with me. 345 00:14:10,504 --> 00:14:12,034 Paul, stay with me! 346 00:14:16,477 --> 00:14:22,617 * I know you've deceived me, now here's a surprise * 347 00:14:24,552 --> 00:14:30,292 * I know that you have, 'cause there's magic in my eyes * 348 00:14:30,324 --> 00:14:34,464 * I can see for miles and miles * 349 00:14:34,495 --> 00:14:37,995 * I can see for miles and miles * 350 00:14:38,032 --> 00:14:42,362 * I can see for miles and miles * 351 00:14:42,403 --> 00:14:46,033 * And miles... 352 00:14:46,074 --> 00:14:48,374 * Oh, yeah. 353 00:15:08,329 --> 00:15:11,039 (indistinct radio transmission) 354 00:15:17,638 --> 00:15:18,938 You okay? 355 00:15:19,773 --> 00:15:21,303 Yeah. 356 00:15:21,342 --> 00:15:23,672 Our target's a twisted son of a bitch. 357 00:15:23,711 --> 00:15:25,611 He's not just cheating sick people, 358 00:15:25,646 --> 00:15:27,546 he's using the most desperate ones to do his dirty work. 359 00:15:28,716 --> 00:15:30,516 Why hire a guy like Paul? 360 00:15:30,551 --> 00:15:32,251 Because he was hopeful. 361 00:15:32,286 --> 00:15:35,056 Paul wasn't doing it for the money. 362 00:15:35,089 --> 00:15:36,559 He wouldn't ask any questions. 363 00:15:36,590 --> 00:15:37,730 He just wanted to live. 364 00:15:37,758 --> 00:15:39,458 He just wanted everyone to live. 365 00:15:39,493 --> 00:15:42,193 Which tells me that our target is a sociopath, 366 00:15:42,230 --> 00:15:44,500 lacking empathy and remorse. 367 00:15:44,532 --> 00:15:47,002 He didn't care that Paul was a cancer victim; 368 00:15:47,035 --> 00:15:49,635 he just saw him as a pawn that could be manipulated 369 00:15:49,670 --> 00:15:51,640 and controlled. 370 00:15:51,672 --> 00:15:53,072 You still think our target's part of 371 00:15:53,107 --> 00:15:54,677 an organized crime ring? If he were, 372 00:15:54,708 --> 00:15:58,018 he'd have a member of his crew doing that job. 373 00:15:58,046 --> 00:16:01,686 Our target is running a much leaner operation. 374 00:16:03,551 --> 00:16:04,581 Yeah. 375 00:16:04,618 --> 00:16:07,458 So lean our only lead is on his way to the ICU. 376 00:16:07,488 --> 00:16:10,598 Well, maybe Paul's phone could do the talking. 377 00:16:15,329 --> 00:16:16,569 Paul mentioned something about a dead drop, 378 00:16:16,597 --> 00:16:18,497 where he was picking up the pills. 379 00:16:21,135 --> 00:16:23,405 I'll pull up his "Frequent Locations." 380 00:16:23,437 --> 00:16:24,407 Show me "Journey Mode." 381 00:16:25,539 --> 00:16:26,609 You're checking for a pattern. 382 00:16:26,640 --> 00:16:27,650 Yeah. 383 00:16:37,685 --> 00:16:39,515 There. 384 00:16:39,553 --> 00:16:40,623 On the days that Paul left his house, 385 00:16:40,654 --> 00:16:42,624 he never left before noon. 386 00:16:42,656 --> 00:16:44,096 Looks like he averaged 387 00:16:44,125 --> 00:16:45,695 five or six stops. 388 00:16:45,726 --> 00:16:47,626 MUNDO: Except right here. Once a week, he'd leave 389 00:16:47,661 --> 00:16:48,721 the house, make one stop at 9:00 a.m., 390 00:16:48,762 --> 00:16:51,192 drive directly back. 391 00:16:52,233 --> 00:16:53,633 RYAN: That's got to be 392 00:16:53,667 --> 00:16:54,767 the address of the dead drop location. 393 00:16:54,802 --> 00:16:56,532 MUNDO: According to this schedule, 394 00:16:56,570 --> 00:16:57,540 next pickup's not for another three days. 395 00:16:57,571 --> 00:16:58,631 RYAN: We don't have time. 396 00:16:58,672 --> 00:17:01,442 We have to pull the traffic cam footage of the area. 397 00:17:01,475 --> 00:17:02,775 If Paul was picking up drugs, 398 00:17:02,810 --> 00:17:03,850 someone was dropping them off. 399 00:17:03,877 --> 00:17:05,217 Do you think this is where 400 00:17:05,246 --> 00:17:06,376 our target surfaced in the real world? 401 00:17:06,414 --> 00:17:09,114 There's only one way to find out. 402 00:17:13,687 --> 00:17:15,727 And you're sure about this? 403 00:17:15,756 --> 00:17:17,856 Yeah. My techs confirmed it today. 404 00:17:17,891 --> 00:17:20,221 It's an HTML injection on your site 405 00:17:20,261 --> 00:17:23,691 that's causing site visitors to access malicious ads. 406 00:17:25,666 --> 00:17:27,736 Well, my network security is top-notch. 407 00:17:27,768 --> 00:17:30,278 We'll have to look into this and make sure it's accurate. 408 00:17:30,304 --> 00:17:32,304 Marcus, 409 00:17:32,340 --> 00:17:34,250 all due respect-- it's accurate. 410 00:17:34,275 --> 00:17:36,145 Your security has gaping holes. 411 00:17:36,177 --> 00:17:38,777 Look, I'm here as a friend. 412 00:17:38,812 --> 00:17:39,842 I could have called, 413 00:17:39,880 --> 00:17:42,120 but I just felt this was something best explained 414 00:17:42,150 --> 00:17:43,320 in person. 415 00:17:43,351 --> 00:17:45,381 Well, pardon me if I hesitate to thank you. 416 00:17:45,419 --> 00:17:49,189 Look, I don't want ScrollMD to face any undo embarrassment, 417 00:17:49,223 --> 00:17:52,723 so just, please, take down the infected ads immediately 418 00:17:52,760 --> 00:17:54,800 and have your techs scrub your servers 419 00:17:54,828 --> 00:17:56,228 for any other malicious code. 420 00:17:56,264 --> 00:17:58,564 Sure, fine. 421 00:17:58,599 --> 00:17:59,769 Anything else? 422 00:17:59,800 --> 00:18:00,740 Uh, yeah, actually. 423 00:18:00,768 --> 00:18:02,308 Consider reaching out 424 00:18:02,336 --> 00:18:04,476 to the victim's wife, Jane Bruno. 425 00:18:04,505 --> 00:18:05,775 Extend your condolences. 426 00:18:05,806 --> 00:18:07,706 Most importantly, 427 00:18:07,741 --> 00:18:10,641 issue a public warning on your home page. 428 00:18:10,678 --> 00:18:12,778 That's the most efficient way of reaching people 429 00:18:12,813 --> 00:18:14,743 who might have these drugs currently sitting 430 00:18:14,782 --> 00:18:15,812 in their medicine cabinets. 431 00:18:15,849 --> 00:18:18,659 No, that's a step too far, Simon. 432 00:18:18,686 --> 00:18:19,716 Talk about embarrassment. 433 00:18:19,753 --> 00:18:22,883 A-A public warning saying that we were breached? 434 00:18:22,923 --> 00:18:25,553 It would create a PR nightmare for us. 435 00:18:25,593 --> 00:18:27,323 Not to mention it opens us up to liability. 436 00:18:27,361 --> 00:18:28,421 The widow could sue. 437 00:18:28,462 --> 00:18:30,262 I could lose millions in sponsors. 438 00:18:30,298 --> 00:18:32,168 A man died because of your Web site. 439 00:18:32,200 --> 00:18:34,470 And I feel badly about that. 440 00:18:34,502 --> 00:18:35,702 But ScrollMD was a victim, too. 441 00:18:35,736 --> 00:18:38,376 Our Web site was attacked. 442 00:18:38,406 --> 00:18:39,776 I can't issue that warning. 443 00:18:39,807 --> 00:18:41,507 You can't or you won't? 444 00:18:41,542 --> 00:18:42,842 (sighs) 445 00:18:42,876 --> 00:18:44,446 I won't. 446 00:18:52,320 --> 00:18:53,360 That one. 447 00:18:53,387 --> 00:18:55,427 It shows the entrance to the dead drop location. 448 00:18:55,456 --> 00:18:56,756 Take me back to the time of the last pickup. 449 00:18:56,790 --> 00:18:58,730 Okay. 450 00:19:05,366 --> 00:19:06,366 MUNDO: There's Paul. 451 00:19:06,400 --> 00:19:07,870 9:00 a.m. on the dot. 452 00:19:07,901 --> 00:19:09,061 Okay, take the footage back. 453 00:19:09,102 --> 00:19:11,802 We're looking for anyone else going in or out that door. 454 00:19:13,541 --> 00:19:14,971 There. Rewind that. 455 00:19:15,008 --> 00:19:17,778 Play that back. 456 00:19:19,947 --> 00:19:21,347 MUNDO: You gotta be kidding me. 457 00:19:21,382 --> 00:19:23,852 The target's using an IR LED array. 458 00:19:23,884 --> 00:19:26,514 Makes his license plate unreadable to cameras. 459 00:19:29,357 --> 00:19:30,757 Can we make an ID? 460 00:19:30,791 --> 00:19:31,921 Let's see here... 461 00:19:37,898 --> 00:19:38,868 No. 462 00:19:38,899 --> 00:19:41,909 Can't see his face. Too far away. 463 00:19:43,904 --> 00:19:44,834 What is it? 464 00:19:48,909 --> 00:19:50,819 Our target was driving a newer model SUV, 465 00:19:50,844 --> 00:19:52,574 probably equipped with Bluetooth. 466 00:19:52,613 --> 00:19:53,743 Phone, radio. 467 00:19:53,781 --> 00:19:55,541 MUNDO: All four tires give off Bluetooth signals 468 00:19:55,583 --> 00:19:56,713 to report when they're low on pressure. 469 00:19:56,750 --> 00:19:57,860 RYAN: What are you thinking? 470 00:19:57,885 --> 00:20:00,255 See that little white box right there? 471 00:20:01,455 --> 00:20:02,955 It's a Department of Transportation 472 00:20:02,990 --> 00:20:04,660 traffic monitoring system. 473 00:20:04,692 --> 00:20:07,792 Picks up Bluetooth signals to report traffic patterns. 474 00:20:07,828 --> 00:20:09,668 The D.O.T. keeps a record 475 00:20:09,697 --> 00:20:11,397 of every Bluetooth device it pairs with. 476 00:20:11,432 --> 00:20:13,402 That's our digital fingerprint. 477 00:20:13,434 --> 00:20:15,704 We match that to the SUV's VIN number, 478 00:20:15,736 --> 00:20:18,976 and we get the driver's ID and registration from the DMV. 479 00:20:19,006 --> 00:20:20,506 Yeah, only one problem-- 480 00:20:20,541 --> 00:20:22,571 the D.O.T. only keeps the data for 20 minutes. 481 00:20:22,610 --> 00:20:24,880 (chuckling): You really believe that? 482 00:20:29,483 --> 00:20:31,783 Bluetooth is a hacker's best friend. 483 00:20:31,819 --> 00:20:33,959 What time was the IR LED flash detected 484 00:20:33,987 --> 00:20:34,827 by the traffic cam? 485 00:20:34,855 --> 00:20:36,585 6:49 a.m. 486 00:20:36,624 --> 00:20:38,594 SIFTER: Can you put the newscast on the big screen? 487 00:20:38,626 --> 00:20:41,596 Okay, these are the Bluetooth devices that paired 488 00:20:41,629 --> 00:20:44,599 with the D.O.T. traffic box at the same time. 489 00:20:44,632 --> 00:20:47,032 170? We making another wager? 490 00:20:47,067 --> 00:20:49,007 Looks like it. 491 00:20:49,036 --> 00:20:51,876 You should be able to trust the Web sites you visit. 492 00:20:51,905 --> 00:20:53,805 They should be responsible 493 00:20:53,841 --> 00:20:57,311 for the content of the ads that are on their sites. 494 00:20:57,345 --> 00:21:01,315 My husband is dead because someone was negligent. 495 00:21:01,349 --> 00:21:03,989 Today I went to ScrollMD headquarters. 496 00:21:04,017 --> 00:21:05,617 No one would talk to me. 497 00:21:05,653 --> 00:21:07,453 They escorted me out. 498 00:21:07,488 --> 00:21:08,958 They say they're all about helping people, 499 00:21:08,989 --> 00:21:10,999 but all they care about is the bottom line. 500 00:21:13,494 --> 00:21:17,494 KRUMITZ: Hey, I've got something here. 501 00:21:17,531 --> 00:21:18,731 All right, talk to me. 502 00:21:18,766 --> 00:21:19,736 We just ran the VIN number 503 00:21:19,767 --> 00:21:20,737 of our target's SUV 504 00:21:20,768 --> 00:21:22,868 through the Texas DMV database and got a hit. 505 00:21:22,903 --> 00:21:24,003 All right, get Avery on the phone. 506 00:21:25,973 --> 00:21:27,843 Nelson, I've got a job for you. 507 00:21:27,875 --> 00:21:30,005 Come see me in my office after this. 508 00:21:30,043 --> 00:21:32,043 You don't want Krumitz to come, too? 509 00:21:32,079 --> 00:21:33,949 I mean, because we've been tag-teaming everything. 510 00:21:33,981 --> 00:21:35,381 Just you. 511 00:21:35,416 --> 00:21:36,546 KRUMITZ: Simon? 512 00:21:38,018 --> 00:21:38,988 Avery, 513 00:21:39,019 --> 00:21:41,759 we found the driver of the SUV. 514 00:21:41,789 --> 00:21:43,899 Target's name is Randall Fung. 515 00:22:06,647 --> 00:22:07,947 FBI! 516 00:22:07,981 --> 00:22:08,981 Go, go, go! 517 00:22:09,983 --> 00:22:11,013 My side's clear! 518 00:22:11,051 --> 00:22:12,911 Shooters come out. 519 00:22:12,953 --> 00:22:15,723 All clear, sir, totally clear! 520 00:22:16,724 --> 00:22:18,724 (glass shatters) 521 00:22:29,803 --> 00:22:31,103 FBI! 522 00:22:31,138 --> 00:22:32,778 Hands up, let me see your hands! 523 00:22:32,806 --> 00:22:33,946 FBI! Don't move! 524 00:22:33,974 --> 00:22:35,104 Get down, get down! On your knees! 525 00:22:35,142 --> 00:22:36,542 Do not move! 526 00:22:36,577 --> 00:22:38,047 (agent shouts indistinctly) 527 00:22:39,079 --> 00:22:40,619 Hands behind your back! 528 00:22:45,553 --> 00:22:46,953 Randall Fung, turn around. 529 00:22:46,987 --> 00:22:49,157 Hands behind your back. 530 00:22:56,930 --> 00:22:58,100 Mold. 531 00:22:58,131 --> 00:22:59,861 The aflatoxins. 532 00:22:59,900 --> 00:23:01,870 This is what's making the victims sick. 533 00:23:01,902 --> 00:23:03,062 I've seen some nasty-ass crap, 534 00:23:03,103 --> 00:23:04,773 but this is disgusting. 535 00:23:16,183 --> 00:23:18,813 You keep looking at the pills, not the computer. 536 00:23:18,852 --> 00:23:20,212 You know what that tells me? 537 00:23:20,253 --> 00:23:24,193 That you're a trained chemist, not a cyber criminal. 538 00:23:24,224 --> 00:23:26,624 Which means you're only half this operation. 539 00:23:26,660 --> 00:23:27,600 You're the pill cook. 540 00:23:27,628 --> 00:23:30,068 Randall, we got you on fraud, conspiracy, 541 00:23:30,097 --> 00:23:32,737 trafficking counterfeit goods, and a man died 542 00:23:32,766 --> 00:23:34,136 because of what you did. 543 00:23:34,167 --> 00:23:36,867 You're looking at murder and a hell of a lot of jail time 544 00:23:36,904 --> 00:23:38,974 unless you can tell us where your better half is. 545 00:23:39,006 --> 00:23:42,106 Now, if you talk, maybe we can make a deal. 546 00:23:46,647 --> 00:23:49,617 Bag the computers and devices and bring them back to D.C. 547 00:23:49,650 --> 00:23:51,920 We're still looking for the head of this snake. 548 00:24:08,602 --> 00:24:11,132 (car chirps) MARCUS: What the hell did you do, Simon? 549 00:24:11,171 --> 00:24:12,331 Wow, you seem a little upset, Marcus. 550 00:24:12,372 --> 00:24:16,242 Is this a discussion we should be having by my parking space? 551 00:24:16,276 --> 00:24:18,046 My entire Web site is down. 552 00:24:18,078 --> 00:24:19,818 Every time I text, try to get it back online, 553 00:24:19,847 --> 00:24:21,617 it crashes again. 554 00:24:21,649 --> 00:24:24,959 Sounds like a distributed denial of service attack. 555 00:24:24,985 --> 00:24:27,215 Ah, those can take days, weeks to sort out. 556 00:24:27,254 --> 00:24:29,084 I can certainly have my team look into it. 557 00:24:29,122 --> 00:24:31,092 Your team? You son of a bitch. 558 00:24:31,124 --> 00:24:34,224 And I'm guessing you also had something to do 559 00:24:34,261 --> 00:24:36,261 with the media attack Carl Bruno's wife has been waging. 560 00:24:36,296 --> 00:24:38,796 Hey, look at that, you do know the victim's name. 561 00:24:38,832 --> 00:24:40,132 What do you want, Simon? 562 00:24:40,167 --> 00:24:41,807 Same thing Jane Bruno wants-- 563 00:24:41,835 --> 00:24:43,805 for you and ScrollMD to be held accountable. 564 00:24:43,837 --> 00:24:45,107 And maybe if you spoke with her 565 00:24:45,138 --> 00:24:47,108 instead of just escorting her out... 566 00:24:47,140 --> 00:24:49,150 I am not gonna negotiate with you. 567 00:24:49,176 --> 00:24:51,816 You know, Marcus, in the next few weeks, 568 00:24:51,845 --> 00:24:53,815 it's gonna be more than your site that's crashing. 569 00:24:53,847 --> 00:24:55,247 That's not a threat, that's reality. 570 00:24:55,282 --> 00:24:56,782 Who knows what's next? 571 00:24:56,817 --> 00:24:58,157 Dirty vaccines? 572 00:24:58,185 --> 00:24:59,755 Tainted antibiotics? 573 00:24:59,787 --> 00:25:02,757 Millions of people visit your site every month. 574 00:25:02,790 --> 00:25:03,930 And whether they get cured 575 00:25:03,957 --> 00:25:07,227 or they get killed might just depend on you. 576 00:25:27,214 --> 00:25:29,144 Look, I know they scrubbed these devices of mold and spores 577 00:25:29,182 --> 00:25:32,712 and whatnot, but, uh, I am starting to itch a little bit. 578 00:25:35,188 --> 00:25:36,158 Wait. 579 00:25:36,189 --> 00:25:37,899 Wait, w-wait. Hold up. 580 00:25:37,925 --> 00:25:39,725 Go back. 581 00:25:39,760 --> 00:25:41,270 Look familiar to you? 582 00:25:43,230 --> 00:25:46,040 Both Paul and Randall had the exact same online poker site 583 00:25:46,066 --> 00:25:47,336 bookmarked on their devices. 584 00:25:47,367 --> 00:25:48,767 Could be a coincidence. 585 00:25:48,802 --> 00:25:50,062 Yeah, we were thinking that, too. 586 00:25:50,103 --> 00:25:52,073 Until we checked the user history on both devices, 587 00:25:52,105 --> 00:25:53,575 we stopped thinking that. 588 00:25:55,075 --> 00:25:56,645 MUNDO: All right, for the last two months, 589 00:25:56,677 --> 00:25:57,747 both these guys logged on 590 00:25:57,778 --> 00:26:00,748 to the same poker site every Saturday. 591 00:26:00,781 --> 00:26:02,281 Were they playing each other? 592 00:26:02,315 --> 00:26:04,955 No, but look where they sat. 593 00:26:04,985 --> 00:26:06,985 MUNDO: A no-limit, heads-up table. 594 00:26:07,020 --> 00:26:09,030 Means they each played an opponent one-on-one. 595 00:26:18,832 --> 00:26:21,132 KRUMITZ: And for no more than three minutes. 596 00:26:21,168 --> 00:26:22,638 Three minutes? Mm-hmm. 597 00:26:22,670 --> 00:26:24,180 That's barely enough time to play one hand. 598 00:26:24,204 --> 00:26:26,174 True, but that's all they ever play. 599 00:26:26,206 --> 00:26:30,176 I mean, you log in, sit, play a hand, win, log out. 600 00:26:30,210 --> 00:26:32,650 (snaps) Paul and Randall weren't playing poker. 601 00:26:32,680 --> 00:26:35,650 They were getting paid for their services. 602 00:26:38,051 --> 00:26:41,051 This is how our target pays his crew. 603 00:26:54,167 --> 00:26:56,967 I bet this is also how our target washes his money. 604 00:26:57,004 --> 00:26:59,034 Hackers love using online poker to launder funds. 605 00:26:59,072 --> 00:27:00,372 It's hard to track. 606 00:27:00,407 --> 00:27:02,407 But not impossible. 607 00:27:15,088 --> 00:27:18,228 You still want to argue you're not a hypochondriac? 608 00:27:18,258 --> 00:27:20,228 This is not about me. 609 00:27:20,260 --> 00:27:22,900 Oh, my wife, she hates shots. 610 00:27:22,930 --> 00:27:25,270 And the doctor put her on these pills for the flu. 611 00:27:25,298 --> 00:27:27,838 A preventative measure because of her weakened immune system. 612 00:27:27,868 --> 00:27:30,338 I don't know, just being cautious, I guess. 613 00:27:30,370 --> 00:27:31,240 Did you really think 614 00:27:31,271 --> 00:27:33,901 Kathryn's doctor prescribed her phony meds? 615 00:27:33,941 --> 00:27:35,401 Hearing Jane Bruno's story, 616 00:27:35,442 --> 00:27:37,402 I mean, this could happen to anyone. 617 00:27:37,444 --> 00:27:40,314 Yesterday, I met an intelligent qualified doctor 618 00:27:40,347 --> 00:27:42,147 who fell down a slippery slope 619 00:27:42,182 --> 00:27:44,252 and ended up in the target's trap. 620 00:27:44,284 --> 00:27:47,014 There's a nationwide shortage of Doxaflu. 621 00:27:47,054 --> 00:27:48,324 Yeah, it's just hard to believe 622 00:27:48,355 --> 00:27:50,125 your only option was an online pharmacy. 623 00:27:50,157 --> 00:27:52,427 I have high-risk patients-- 624 00:27:52,459 --> 00:27:54,169 children, pregnant women, 625 00:27:54,194 --> 00:27:55,994 the elderly. 626 00:27:56,029 --> 00:27:58,099 I wanted to make sure that my patients were protected. 627 00:27:58,131 --> 00:28:01,361 Yeah, I mean, look, I know we need to be able 628 00:28:01,401 --> 00:28:05,171 to trust in certain things-- doctors, medicine. 629 00:28:05,205 --> 00:28:06,175 It's just hard when... 630 00:28:06,206 --> 00:28:09,246 When our target's taking advantage of that trust. 631 00:28:09,276 --> 00:28:12,246 And now, besides the nine pharmaceutical drugs 632 00:28:12,279 --> 00:28:13,919 our target was distributing, 633 00:28:13,947 --> 00:28:16,417 he's escalated to a common flu medication. 634 00:28:16,449 --> 00:28:18,359 He's expanding his business. 635 00:28:18,385 --> 00:28:21,255 Sounds to me like he's looking for a big payday 636 00:28:21,288 --> 00:28:22,758 so he can cash out and run. 637 00:28:22,790 --> 00:28:24,430 Yeah, how do we get to him before he does? 638 00:28:24,457 --> 00:28:27,197 So, based on your previous psychological profile 639 00:28:27,227 --> 00:28:29,867 of the target, can you build a physical description? 640 00:28:29,897 --> 00:28:31,367 Well, our target is most likely male 641 00:28:31,398 --> 00:28:35,068 based on his tech skills and his sociopathic tendencies. 642 00:28:35,102 --> 00:28:36,962 He sees people as dollar signs. 643 00:28:37,004 --> 00:28:40,074 He has no empathy, no conscience. 644 00:28:40,107 --> 00:28:41,807 Age range? 645 00:28:41,842 --> 00:28:43,342 Coders fall into one of four categories-- 646 00:28:43,376 --> 00:28:45,916 young adolescents, college students, professionals, 647 00:28:45,946 --> 00:28:49,086 or mature and reformed ex-virus writers. 648 00:28:49,116 --> 00:28:51,556 But our target is a professional. 649 00:28:51,584 --> 00:28:54,454 Which puts him in the early 20s to mid-40s range. 650 00:28:54,487 --> 00:28:56,357 He's made an art of blending in. 651 00:28:56,389 --> 00:28:58,059 Hiding in plain sight. 652 00:28:58,091 --> 00:29:00,221 He's average looking, inconspicuous. 653 00:29:00,260 --> 00:29:02,830 He won't wear his hair too long or too short. 654 00:29:02,863 --> 00:29:05,163 He's likely to have poor social skills. 655 00:29:05,198 --> 00:29:07,168 A recluse. 656 00:29:07,200 --> 00:29:09,170 He won't want to leave home unless he has to. 657 00:29:09,202 --> 00:29:11,332 He likes to live his life behind a computer screen. 658 00:29:11,371 --> 00:29:14,071 But if he does leave the house, he'll want to disguise himself. 659 00:29:14,107 --> 00:29:16,377 But nothing that draws too much attention. 660 00:29:16,409 --> 00:29:17,549 Glasses. 661 00:29:17,577 --> 00:29:18,977 With thick frames. 662 00:29:19,012 --> 00:29:20,472 He likes to have a barrier between himself 663 00:29:20,513 --> 00:29:22,513 and the rest of the world. 664 00:29:22,549 --> 00:29:24,059 It gives him a false sense of security. 665 00:29:24,084 --> 00:29:25,514 All right, what do we got? 666 00:29:25,552 --> 00:29:28,452 Male, 20s to 40s, glasses, hair medium length. 667 00:29:28,488 --> 00:29:30,258 That is not a whole lot to go on. 668 00:29:30,290 --> 00:29:31,260 It's enough. 669 00:29:31,291 --> 00:29:32,551 We will know him when we see him. 670 00:29:32,592 --> 00:29:34,462 Now we just have to give him a reason 671 00:29:34,494 --> 00:29:36,324 to pop out into the real world. 672 00:29:36,363 --> 00:29:37,523 How do you propose we do that? 673 00:29:37,564 --> 00:29:39,534 Money. 674 00:29:39,566 --> 00:29:41,066 I need $250,000. 675 00:29:41,101 --> 00:29:43,331 Uh, for what exactly, Avery? 676 00:29:43,370 --> 00:29:45,480 A little game of poker. 677 00:29:54,882 --> 00:29:56,342 All right, everybody, listen up. 678 00:29:56,383 --> 00:29:57,883 Time to put your game face on. 679 00:29:57,918 --> 00:29:59,558 Once our target 680 00:29:59,586 --> 00:30:00,486 receives a big payment, 681 00:30:00,520 --> 00:30:01,630 he's gonna launder it using 682 00:30:01,654 --> 00:30:03,124 the same online poker site 683 00:30:03,156 --> 00:30:04,296 he used to pay his crew. 684 00:30:04,324 --> 00:30:05,394 He's gonna be evasive, 685 00:30:05,425 --> 00:30:07,865 and he's gonna be fast, but we're gonna be faster. 686 00:30:07,895 --> 00:30:09,565 Avery, you sure this is a good idea? 687 00:30:09,596 --> 00:30:11,136 Our target's gonna know we're not a doctor's office. 688 00:30:11,164 --> 00:30:12,394 He's gonna trace that quarter mil 689 00:30:12,432 --> 00:30:13,492 right back to us. 690 00:30:13,533 --> 00:30:15,433 Our raid on his pill factory put him on the ropes. 691 00:30:15,468 --> 00:30:16,268 His operation is crippled. 692 00:30:16,303 --> 00:30:18,573 He's gonna want to cash out and run, 693 00:30:18,605 --> 00:30:20,535 even if he knows it's government coin. 694 00:30:20,573 --> 00:30:23,373 He's compulsive, overconfident and self-serving. 695 00:30:23,410 --> 00:30:25,380 He's always looking for his next big score. 696 00:30:25,412 --> 00:30:26,912 And you think he's gonna make a mistake? 697 00:30:26,947 --> 00:30:28,447 A mistake born of greed. 698 00:30:28,481 --> 00:30:31,211 He made a fortune preying on the weaknesses of others. 699 00:30:31,251 --> 00:30:32,381 And we're gonna catch him 700 00:30:32,419 --> 00:30:35,089 because his weakness is he's cocky. 701 00:30:35,122 --> 00:30:36,382 (grunts) 702 00:30:36,423 --> 00:30:38,523 Here goes nothing. 703 00:30:38,558 --> 00:30:41,968 We just bought $250,000 worth of drugs. 704 00:30:43,263 --> 00:30:44,393 Krumitz, you're up. 705 00:30:44,431 --> 00:30:46,231 Okay. 706 00:30:46,266 --> 00:30:49,106 Our target uses a Dollar Dispatch account 707 00:30:49,136 --> 00:30:50,336 for his pharmacy transactions. 708 00:30:50,370 --> 00:30:52,480 No previous history. 709 00:30:52,505 --> 00:30:53,605 It's a one-off account. 710 00:30:53,640 --> 00:30:55,580 NELSON: Uh-huh. 711 00:30:55,608 --> 00:30:56,608 There's our 250 Gs. 712 00:30:56,643 --> 00:30:59,573 KRUMITZ: Nobody freak out. It's about to disappear. 713 00:30:59,612 --> 00:31:01,442 NELSON: Our target is opening a new Dollar Dispatch account 714 00:31:01,481 --> 00:31:03,581 for every drug transaction. 715 00:31:03,616 --> 00:31:05,416 Nelson? All right. 716 00:31:05,452 --> 00:31:06,552 Here we go. So, our target's 717 00:31:06,586 --> 00:31:08,156 favorite online poker site. 718 00:31:08,188 --> 00:31:09,628 Now, we have full administrative privileges, 719 00:31:09,656 --> 00:31:11,456 which means we're like the pit boss. 720 00:31:11,491 --> 00:31:12,991 We can see whatever screen we want. 721 00:31:13,026 --> 00:31:14,396 Pull up the lobby. 722 00:31:14,427 --> 00:31:17,367 Go to the no limit, heads-up tables. 723 00:31:17,397 --> 00:31:19,537 The target should buy in for $250K. 724 00:31:23,036 --> 00:31:25,536 Wait for it. 725 00:31:43,323 --> 00:31:45,593 There he is! Phantom23. 726 00:31:45,625 --> 00:31:46,525 (group cheering) 727 00:31:49,396 --> 00:31:51,236 He's at table 26. 728 00:31:57,404 --> 00:31:59,234 He's going all in on that first hand. 729 00:32:03,676 --> 00:32:05,446 NELSON: He just folded 730 00:32:05,478 --> 00:32:06,518 on a full house. 731 00:32:06,546 --> 00:32:08,316 Remember, every time he loses, 732 00:32:08,348 --> 00:32:10,018 he's really losing to himself. 733 00:32:10,050 --> 00:32:12,360 With every hand, he's laundering the money one step further. 734 00:32:12,385 --> 00:32:14,225 Odyssey45 is just another handle 735 00:32:14,254 --> 00:32:15,654 he created for himself 736 00:32:15,688 --> 00:32:17,488 in the poker game. 737 00:32:22,695 --> 00:32:23,765 All right, he's on the move. 738 00:32:23,796 --> 00:32:25,396 Who's got eyes on Odyssey45? 739 00:32:25,432 --> 00:32:28,362 I do. He's at table 84. 740 00:32:28,401 --> 00:32:29,631 KRUMITZ: He's on the move again 741 00:32:29,669 --> 00:32:31,139 as Emerald62. 742 00:32:31,171 --> 00:32:32,331 There he is, table nine. 743 00:32:33,606 --> 00:32:35,476 Wait, he's not going all in anymore. 744 00:32:35,508 --> 00:32:36,308 He's only bidding half. 745 00:32:38,511 --> 00:32:39,711 RYAN: Sneaky sucker. He divided the money 746 00:32:39,746 --> 00:32:41,346 so it's harder to track. 747 00:32:41,381 --> 00:32:43,011 He's jumping tables again. 748 00:32:51,191 --> 00:32:54,621 NELSON: Damn it. Look, there's, like, four of them. 749 00:32:54,661 --> 00:32:56,721 Remember, he's playing against himself. 750 00:33:07,107 --> 00:33:09,107 KRUMITZ: He's playing at more tables. 751 00:33:10,710 --> 00:33:13,550 NELSON: That's six. 752 00:33:15,348 --> 00:33:16,648 Now eight. 753 00:33:16,683 --> 00:33:18,653 16. 754 00:33:18,685 --> 00:33:19,755 He's using an algorithm. 755 00:33:22,289 --> 00:33:23,589 Just stay with him. Just isolate 756 00:33:23,623 --> 00:33:24,653 the games our target's playing. 757 00:33:24,691 --> 00:33:26,121 He's moving too fast. 758 00:33:26,159 --> 00:33:27,359 Do not lose him. 759 00:33:27,394 --> 00:33:28,594 Wait, look at his bets. 760 00:33:28,628 --> 00:33:30,298 He's going all in again there and there. 761 00:33:30,330 --> 00:33:31,640 SIFTER: Yeah, he's recombining his laundered assets. 762 00:33:31,664 --> 00:33:34,334 He's getting ready to cash out. 763 00:33:40,140 --> 00:33:41,780 Look for a player who starts to dominate. 764 00:33:41,808 --> 00:33:42,808 I think I got him, Hydrus99. 765 00:33:42,842 --> 00:33:45,712 Earnings just climbed to $159,000. 766 00:33:45,745 --> 00:33:47,775 Krumitz, trace the bank account link to Hydrus99. 767 00:33:47,814 --> 00:33:50,184 He'll have to show at the bank in person 768 00:33:50,217 --> 00:33:51,857 to cash out. 769 00:33:51,884 --> 00:33:54,354 I can't. There's a, there's a separation of privileges 770 00:33:54,387 --> 00:33:55,787 on this server. 771 00:33:55,822 --> 00:33:56,622 It's like a traffic light system. 772 00:33:56,656 --> 00:33:58,226 Green's what the players can access, 773 00:33:58,258 --> 00:33:59,558 yellow's administrator access, 774 00:33:59,592 --> 00:34:00,722 and red's where the bank accounts are stored. 775 00:34:00,760 --> 00:34:01,730 NELSON: No, no, no, no. 776 00:34:01,761 --> 00:34:03,761 We should have access to both yellow and red. 777 00:34:03,796 --> 00:34:05,096 I specifically asked for it. 778 00:34:05,132 --> 00:34:07,792 I know, but I can't access the red. 779 00:34:07,834 --> 00:34:09,564 There's a whole extra layer of encryption. 780 00:34:09,602 --> 00:34:11,472 Wait, wait, wait. 781 00:34:11,504 --> 00:34:12,834 I think I can get in, but it's gonna have to authenticate me. 782 00:34:12,872 --> 00:34:14,502 It's gonna take some time. 783 00:34:14,541 --> 00:34:15,601 MUNDO: Time we don't have. 784 00:34:15,642 --> 00:34:17,642 He's up to $184,000. 785 00:34:24,484 --> 00:34:25,814 $202,000. 786 00:34:30,823 --> 00:34:32,393 Guys, come on, he hits 250, he's gone. 787 00:34:32,425 --> 00:34:33,655 Look, we don't have time. 788 00:34:33,693 --> 00:34:34,763 Look, we have to hack it. 789 00:34:34,794 --> 00:34:36,524 Just do it. There's a bridge 790 00:34:36,563 --> 00:34:37,593 between each zone. Krummy, 791 00:34:37,630 --> 00:34:39,840 we have to ride one of them from yellow to red. 792 00:34:39,866 --> 00:34:41,836 Yeah. 793 00:34:51,811 --> 00:34:53,471 MUNDO: He did it. 794 00:34:53,513 --> 00:34:54,683 He hit $250,000. 795 00:35:12,799 --> 00:35:15,809 Did we get it? 796 00:35:15,835 --> 00:35:18,735 Sorry, we, uh, we couldn't, um... 797 00:35:20,973 --> 00:35:22,803 MUNDO: Wait a minute. 798 00:35:22,842 --> 00:35:23,872 That's it? It's... 799 00:35:23,910 --> 00:35:25,650 He's gone? It's over? 800 00:35:41,794 --> 00:35:44,664 No. No. 801 00:35:44,697 --> 00:35:46,897 There still might be a trace of him in the system. 802 00:35:46,933 --> 00:35:47,793 What do you mean, Nelson? 803 00:35:47,834 --> 00:35:49,234 Because his winnings in the yellow zone 804 00:35:49,269 --> 00:35:50,069 still have to communicate 805 00:35:50,102 --> 00:35:51,432 with his bank account in the red zone. 806 00:35:51,471 --> 00:35:52,871 That's our bridge. 807 00:35:52,905 --> 00:35:54,805 We need to plant a bug in that line of communication. 808 00:35:54,841 --> 00:35:55,971 We can ride it into the red 809 00:35:56,008 --> 00:35:56,848 and straight into his bank account. 810 00:35:56,876 --> 00:35:59,276 RYAN: Infect the firewall with a virus. 811 00:36:20,267 --> 00:36:21,867 Yeah! Holy crap, we did it. 812 00:36:21,901 --> 00:36:23,261 (applause) 813 00:36:23,303 --> 00:36:24,833 The target's bank account 814 00:36:24,871 --> 00:36:26,931 is at Keymark Bank, Lexington, Kentucky. 815 00:36:26,973 --> 00:36:27,803 Yes. 816 00:36:29,041 --> 00:36:31,341 WOMAN: Nice work, Nelson. 817 00:36:31,378 --> 00:36:32,348 (laughter) 818 00:36:32,379 --> 00:36:34,689 Good work. 819 00:36:34,714 --> 00:36:36,244 It's after banking hours, 820 00:36:36,283 --> 00:36:38,753 which means our target can't cash out till the morning. 821 00:36:38,785 --> 00:36:40,255 Let's be there when he does. 822 00:36:54,301 --> 00:36:56,701 I'd like to close my account. 823 00:36:56,736 --> 00:36:57,706 Your account number? 824 00:37:03,776 --> 00:37:05,576 That's a lot of money. 825 00:37:05,612 --> 00:37:06,842 Looking to make a fresh start. 826 00:37:06,879 --> 00:37:09,589 I'd like that in a cashier's check. 827 00:37:34,841 --> 00:37:36,041 (gasps) 828 00:37:36,809 --> 00:37:38,049 (screams) 829 00:37:39,746 --> 00:37:40,876 (grunting) 830 00:37:42,349 --> 00:37:43,819 Okay, okay. 831 00:37:51,458 --> 00:37:53,058 Shawn Morris, 832 00:37:53,092 --> 00:37:56,592 looks like the last life you gambled away was yours. 833 00:38:19,952 --> 00:38:21,822 All right, hey! 834 00:38:21,854 --> 00:38:23,084 To an epic win today. 835 00:38:23,122 --> 00:38:24,452 Cheers! 836 00:38:24,491 --> 00:38:27,121 Cheers. SIFTER: Good work, people. 837 00:38:27,159 --> 00:38:29,099 All right, you know we made the same toast 838 00:38:29,128 --> 00:38:30,868 when we busted you, right? (chuckles) 839 00:38:30,897 --> 00:38:31,997 Oh, you just got to rub it in. 840 00:38:32,031 --> 00:38:34,561 Look, I'm nothing like the guy we arrested today, okay? 841 00:38:34,601 --> 00:38:36,061 Shawn Morris, guy's like a sociopath. 842 00:38:36,102 --> 00:38:37,402 Probably still lives in the basement 843 00:38:37,437 --> 00:38:38,877 with his parents, never been near a girl, 844 00:38:38,905 --> 00:38:40,105 and uses code for evil. 845 00:38:40,139 --> 00:38:41,949 And hacking the New York Stock Exchange was any different? 846 00:38:41,974 --> 00:38:42,974 It was. 847 00:38:43,009 --> 00:38:44,749 His code killed people; my code 848 00:38:44,777 --> 00:38:46,017 just made bankers and stockholders mad 849 00:38:46,045 --> 00:38:48,015 for a day or two. So, then he was a black hat 850 00:38:48,047 --> 00:38:50,117 with bad intentions, and you were what? 851 00:38:50,149 --> 00:38:51,759 An innovator. 852 00:38:51,784 --> 00:38:52,814 A revolutionary. 853 00:38:52,852 --> 00:38:53,952 Sounds like you're just a guy 854 00:38:53,986 --> 00:38:55,126 talking a whole bunch of smack. 855 00:38:55,154 --> 00:38:57,154 Smack! See, you got to know 856 00:38:57,189 --> 00:38:59,129 what it's like on the other side to know what I'm talking about. 857 00:38:59,158 --> 00:39:00,798 But don't get me wrong, it feels good to know 858 00:39:00,827 --> 00:39:03,667 that we did save lives by, you know, getting over a hundred 859 00:39:03,696 --> 00:39:05,136 contaminated drugs off the streets. 860 00:39:05,164 --> 00:39:07,594 Yep, stopped it before it became an epidemic. 861 00:39:07,634 --> 00:39:08,804 That's how we do, son. 862 00:39:08,835 --> 00:39:11,065 That's right, baby. Mm. 863 00:39:11,103 --> 00:39:12,403 Got to go. 864 00:39:12,439 --> 00:39:13,809 I got daddy duty. 865 00:39:13,840 --> 00:39:15,050 Good work. All right. 866 00:39:15,074 --> 00:39:16,974 Man's a superhero with a kid. 867 00:39:17,009 --> 00:39:19,019 (chuckles) Hey, I thought you drank everything 868 00:39:19,045 --> 00:39:21,115 in those 82-ounce cups. 869 00:39:21,147 --> 00:39:22,917 They're not that big. 870 00:39:23,883 --> 00:39:26,153 MARCUS: Today I am proud to announce 871 00:39:26,185 --> 00:39:28,825 that ScrollMD will be the first Web site 872 00:39:28,855 --> 00:39:31,525 of its kind to issue a public warning 873 00:39:31,558 --> 00:39:35,168 on its home page alerting users to the dangers 874 00:39:35,194 --> 00:39:37,064 of fraudulent online advertising. 875 00:39:37,096 --> 00:39:38,636 We will also lead 876 00:39:38,665 --> 00:39:40,665 an initiative in Congress 877 00:39:40,700 --> 00:39:43,640 to ensure that all health Web sites maintain 878 00:39:43,670 --> 00:39:44,640 a higher level of security. 879 00:39:44,671 --> 00:39:46,171 That was you, wasn't it? 880 00:39:46,205 --> 00:39:47,475 ANCHOR: We'll be following that story as it progresses... 881 00:39:47,507 --> 00:39:48,877 Well, I did apply 882 00:39:48,908 --> 00:39:50,648 a little pressure. 883 00:39:51,878 --> 00:39:53,178 And how is Kathryn? Is she still under the weather? 884 00:39:53,212 --> 00:39:54,882 I just texted her. 885 00:39:54,914 --> 00:39:57,714 She's-she's much better, thanks. Yeah, I may be 886 00:39:57,750 --> 00:39:59,120 coming down with the same thing she's got. 887 00:39:59,151 --> 00:40:00,151 I got kind of an itchy throat. 888 00:40:00,186 --> 00:40:02,056 You know? 889 00:40:02,088 --> 00:40:04,558 Oh, please, don't start. 890 00:40:04,591 --> 00:40:06,821 (chuckles) To our health. 891 00:40:06,859 --> 00:40:10,829 Captioning sponsored by CBS 892 00:40:10,863 --> 00:40:12,493 Captioned by Media Access Group at WGBH access.wgbh.org