CSI: Cyber (2015–2016): Season 1, Episode 6 - The Evil Twin - full transcript
The team investigates the murder of a woman when all electronic devices indicate that she was alive for three days after her official time of death.
My name is Avery Ryan.
I was a victim of cyber crime.
Like you, I posted
on social media,
checked my bank account
balance online,
even kept
the confidential files
of my psychological practice
on my computer.
Then I was hacked,
and as a result,
one of my patients
was murdered.
My investigation into her death
led me to the FBI,
where I joined a team
of cyber experts
to wage a war against
a new breed of criminal
hiding on the Deep Web...
infiltrating our daily lives
in ways we never imagined...
...faceless...
nameless...
lurking inside our devices,
just a keystroke away.
♪ ♪
Mr. Nelson,
you're late.
I'm sorry, Avery.
It's just that getting up early
is something
my body's not used to.
Okay, I feel you.
All right, I'll have a talk
with my body,
and we'll be here on time.
What you doing?
Oh, rescuing a spider.
Oh. Um...
Yeah, do not come near me. Look.
Look, I'm-I'm serious.
Brody Nelson,
don't tell me you're afraid
of a little spider?
A little spider?
Avery, look at the size
of that thing. That's not...
Uh-oh. Where...?
Why are you looking
on the ground?
I dropped it.
You dropped it.
Avery...
Your bag...
Well...
Aah!
Well, spiders don't like it
when you're late.
So your plane's on the tarmac
at National, and you're
scheduled to leave
in an hour for
New York City.
The Kirkendahl
Hotel believes
that their computer
network has been hacked.
That connects every
location worldwide.
This is the Kirkendahl file.
What do we got?
Three days ago,
the hotel's computer intrusion
detection system
went off, sent an alert
from their East Side property.
And they had their
I.T. team take a look at it?
It appeared to be a glitch,
happens all the time.
They reset the system,
it happened again.
There's evidence
of a remote cyber intrusion.
Kirkendahl's
Wi-Fi has been compromised.
That means the hackers
could have access to
the corporate computers
and the guests'
personal devices.
And they probably discovered
a vulnerable protocol,
used a root kit to gain access.
Nah, that's doing
it the hard way.
There's a known exploit in the
authentication credential.
You should know that, right?
Of course I know that.
Okay, well...
Why wouldn't I know that?
Guys? Guys?
You spilled water on your keyboard.
Then I saw a spider.
It's not like I
did it on purpose.
Whatever.
Let's just reign in
our intellect here.
That hotel is
right next to the U.N.
A lot of high-profile people
stay there.
Diplomats, dignitaries,
celebrities.
Yeah, and the U.N. is back
in session in two days.
We could be looking
at a dark hotel scenario here.
Hackers targeting the guests.
Yeah, or an attack
against the Kirkendahl
Corporation itself.
Either way,
documents could be released.
E-mails, texts,
sensitive information
that could embarrass or expose
some very important people.
Well, I've got
a meeting coming up
with the FBI Director.
I'll tell him my team is on it,
and that none
of that will happen.
Enjoy your flight.
At the suggestion
of our in-house
technical support team,
we shut down the Wi-Fi.
Has any employee or guest
reported any strange e-mails,
or any evidence
of their individual
devices being hacked?
No.
What about pop-up alerts
instructing them
to update a file
or a program?
I don't know. Those pop-ups
appear all the time,
even on my home computer.
Well, it's one of the ways
that devices are hacked.
A free download
or product upgrade
that looks like it's authentic.
But instead of it being
the actual product,
it's the delivery of malware--
malicious software.
And once someone opens it,
the code gets released into
the computer like a virus,
and the hacker takes over.
It's like the hacker's
lurking inside the device.
When a guest logs on to
your Wi-Fi, the hacker is able
to see their room number,
the last name on their account,
even get their passwords.
But-but we-we shut down
the Wi-Fi,
so that should
protect us, right?
Depends.
I mean,
some malware is programmed
to lay in wait
for six hours, six days,
six months or more.
Should-should we be copying
and deleting documents?
No. Despite the definition
of the word “delete,”
in the cyber world, almost
anything can be recovered.
Agent Ryan, as in-house counsel
for the Kirkendahl Corporation,
I can't stress enough
the importance of privacy here.
It is something
that we guarantee
to our board members,
our employees and our guests.
There must be something
that we can do.
Many of our guests use aliases
when checking in,
but their real names and
home addresses are in our files.
Some engage in activity
that we keep very confidential,
and I'm talking about more than
just ordering an adult movie.
We-we send e-mails and texts
containing confidential
company information--
bonuses, salaries,
mergers.
Activity that will have
serious repercussions
if those communications
became public.
Pardon me.
Yes.
Say that again.
All right.
Our hotel
security footage has been wiped.
Lobby... entrances...
guest room corridors.
Everything recorded
in the past week.
Was the system connected
to the Wi-Fi?
Yes.
If your surveillance
footage was wiped,
I don't think
our hacker is interested
in these confidential files
that you're worried
about, Counselor.
Something else
is going on here.
Something happened here
at your hotel,
and someone is trying
to cover it up.
Ms. Foster?
This is the hotel manager.
Ms. Foster, your music
is disturbing other guests!
Ms. Foster?
Oh, geez.
Security. Call 911.
The victim is Adel Foster,
24 years old.
She checked into this
room five days ago alone.
Driver's license
lists her address as
East Rutherford,
New Jersey.
NYPD are reaching out to New
Jersey Police and her family.
Room's disorganized.
Bruises on her wrists.
Indicates... a struggle.
Most likely, a crime of passion.
Detectives canvassed
the hotel guests.
Nobody heard or saw anything.
Crime scene lifted
a few prints.
Most belonged to the victim,
the rest to housekeeping.
However,
I did find this
in the plumbing.
The victim's cell phone.
The target tried to destroy
it and then flush it.
Well, the water likely
corroded the connectors.
Data recovery is
gonna be tough.
The hotel invoice.
Looks like around
3:00 this morning,
she ordered a late-night
snack and a movie.
Behavior of an insomniac.
Food for one.
That indicates she was alone.
Wait a minute. This is strange.
What?
The medical examiner just established
approximate time of death.
Three nights ago.
What?
It's a hotel. How does
housekeeping not find the body?
Stranger than that,
according to the room invoice,
yesterday and the day before,
she ordered laundry,
room and spa services,
and a movie.
And this morning, breakfast.
Well, it looks like
Adel Foster was alive
for three days after she died.
♪ CSI Cyber 1x06 ♪
The Evil Twin
Original Air Date on April 15, 2015
♪ I know you've deceived me,
now here's a surprise ♪
♪ I know that you have, 'cause
there's magic in my eyes ♪
♪ I can see
for miles and miles ♪
♪ I can see for miles
and miles ♪
♪ I can see
for miles and miles ♪
♪ And miles... ♪
♪ Oh, yeah. ♪
== sync, corrected by elderman ==
@elder_man
Okay, Raven,
what have you got?
Data from the Kirkendahl Hotel's
computer system.
This is a blueprint layout
of a standard room.
We can see the
computer controls
and monitors pretty much
everything that happens.
All run by one central
software package
called the
“digital butler”"
And this explains
why nobody in that hotel
found Adel Foster's body
for three days?
We believe so.
We detected malware
on the hotel server.
It was sent to every employee
hidden inside a
party invitation.
So that's how it
breached the firewall.
Ah. And Troy fell.
Yeah, it was the Trojans
themselves
that opened up
their own city gates
and pulled
the wooden horse inside.
Just like the hotel employees
who opened the party invitation
and let in the malware.
While they blindly
celebrated victory,
their enemy lay in wait.
And Troy fell.
Our hacker had
access to the hotel's
main computer.
They found their way
to Adel's guest room records
and made it look
like she was alive and well
even though Adel Foster
was definitely dead.
Well, that would
explain the manicure,
the facial, ordering the movie,
even room service,
but what about housekeeping?
No one ever
entered the room.
Because the
“do not disturb” sign
is also controlled
by the computer system.
Exactly. Maids won't
enter when the light is on.
Hotels connect
physical devices and sensors
in the hotel rooms
to one central computer
to improve efficiency
and cut down cost--
controlling thermostats
and water temperature,
providing you with the ease
of ordering services
from the hotel channel
on your television.
From one computer,
they can control everything.
Right. It's why they
sometimes charge you
for the items in the
minibar just because
you move them.
Now, the pressure
sensor on the shelves
sends a message
to the computer telling
its product has been consumed.
But as we all know,
computers can be hacked.
I actually met the hat
who wrote the code.
Called it a hospitality hack.
All right, now, once
a hacker intrudes
the hotel computer
system, he has control
over room assignments,
check in, check out,
television,
thermostat...
Oh, my favorite: the
remote control curtains.
Check this out.
Wait...
Nelson, are you
really doing that?
Did you actually
hack this hotel from CTOC?
Yeah, that was me.
The point is if all
the conveniences are connected
through software
to one central computer,
once the hacker's
inside the system,
he can create orders
for room service,
housekeeping, laundry pickup...
And none of it really happened.
It just looks like it did.
And all activity is
recorded under the guest's name
and room number.
Which explains why a dead woman
can order room service
and a movie.
So as far as the hotel knew,
the minibar
was being restocked,
the laundry
was being picked up,
the maids were performing
turndown services.
A hacker can control
any guest's room 24/7.
This is a very sophisticated
cover-up of a murder.
We need to know more
about our victim, Adel Foster.
Her devices are on their way
to you now, Krumitz.
We need to find
this hospitality hacker.
You can't break into a system
this complex
without leaving some
digital dust behind.
We're on it.
All right, so we got
our victim's laptop,
tablet and destroyed cell.
Our killer has
a three-day head start.
Puts him right
where we want him.
He thinks
he got away with murder.
Which means he already
made a mistake
that will lead
us right to him.
We are gonna find Adel
Foster's murderer.
You know, I really could have
used these things two years ago.
But you know every time
Apple introduces a new device,
there's a new cord,
a new connector,
and then all the old stuff
is not compatible with
the new stuff, so then you...
you know, you got to go back,
buy all the new Apple products,
connect them and...
Dude, dude, really?
We're trying to work here.
Okay, well, then give me
something to do.
Here. Lay out all the
pieces of this cell phone.
Disassemble it,
remove the circuit board,
then scrub the resistor
jumper connections.
There's a toothbrush
and alcohol solution
right over there.
Oh, okay.
I see how you do.
New guy gets the poop phone.
What?
I happen to know that this was
the phone that was recovered
from the toilet
in the hotel room.
He's right.
That is the poop phone.
Really? You're gonna
encourage this?
And you're not even
that new anymore.
Okay, you know what, Nelson?
Fine. I will gladly
take the poop phone
if you just do me
one favor and stop talking.
Guys.
Okay, what, you in a bad
mood or something, Krummy?
You want to
talk about it?
Oh. You're having
girl problems.
Oh, my...
I knew it.
Raven, could you grab me
that pen over there
and stab me with it?
That would be awesome.
Guys, will you cut it out and come here.
You got no game.
I found something.
I have... I have game.
You guys.
I went back
to the employee party invitation
where the malware was embedded.
I couldn't find the information
on the computer that sent it.
The hacker anonymized it.
So, I responded yes. I got back
an auto-reply confirmation,
and guess what-- our hacker
forgot to anonymize that e-mail.
Pretty sure it's the same one
that sent the invitation.
And I got his I.P. address
on the computer.
Yeah! These guys never
think two steps ahead.
I love this job.
This is gonna
lead us right
to our hacker.
♪ ♪
Evan Wescott? Is
this your computer?
Yes. Why?
FBI.
You're under arrest
for computer fraud
in connection with the
murder of Adel Foster.
What? What are you
talking about? Hey, whoa.
Hold on a minute.
I don't even know who that is.
You got the wrong guy.
I didn't kill anybody.
We can do this the hard way,
or you can come quietly.
You hacked the Kirkendahl
Hotel's main computer, Evan.
We know this because the I.P.
address of the device used
led us back to your laptop.
That's impossible.
I don't even know how to do
- something like that.
- You created a backdoor
in the computer systems
and took control
of the hotel's
hospitality functions--
maid service,
room service, minibar.
You murdered Adel and activated
those services to make it look
like she was alive
three days after her death.
What? That's insane.
I didn't kill anybody.
Your cell phone
places you at the hotel
at the exact time
of Adel Foster's murder.
Your phone's location services
puts you in that hotel.
Location services?
The little program
that's always running
in the background
of your phone.
Logs everywhere you go.
Nifty little feature.
See the elevation listed
here? 29.7 meters.
That's roughly
seven floors.
Her body was found
in room 715.
Okay, I-I'm not a murderer.
Really?
'Cause you sure
sound like one
in the text that
you sent Adel.
We found that
on your phone.
These are not my text messages.
And I already told you,
I don't know anybody named Adel.
Are you sure you
never talked to her?
This is surveillance footage
from your bar, Evade,
on the night she
was murdered.
♪ ♪
I mean, 'cause that
sure as hell looks like her,
and that is definitely you.
Look, man, a lot of people
come into my club.
- And, yeah, I meet a lot of women.
- Yeah?
Well, this one was murdered
three days ago.
Where were you?
I was at the club.
I'm always at the club.
It's a pretty crowded place
at night.
Could easily step out for an
hour, and no one would miss you.
This is ridiculous.
I didn't do anything.
At first, I couldn't understand
why you went to all the trouble
to make it look like
Adel was still alive.
You wanted
to buy yourself time
to create an alibi.
The hotel hack.
And you certainly
can't deny
that you were
capable of doing it.
You were a computer
science major
at Kenniwick University.
Day one, nobody found the body.
Day two, no one came for you.
Day three,
you got comfortable.
You distanced yourself
from the murder.
You thought
there was no evidence
tying you to
the scene of the crime.
You got away with murder.
- Almost.
- No.
I didn't kill anybody.
I didn't do any of these things.
Evan...
your devices tell us
you're lying.
♪ ♪
Shane Tillman.
Adel is... er, was...
my girlfriend.
I don't understand
how this happened.
Doesn't the hotel
have security?
We're still investigating
the circumstances
surrounding
Adel's death.
You mean her murder.
When her cell kept
going to voicemail,
I called the-the hotel,
and she...
they said that she was
still checked in.
I thought that
she had lost her phone.
You know? I mean,
she does that a lot.
But I never thought...
...you know, that, um,
that she was dead.
You spoke to her the night
that she was killed.
Yeah, she seemed excited.
Talking a mile a minute.
Adel saved up money
for months for this trip.
You know, she had
a whole itinerary:
Coney Island, Statue of Liberty,
Empire State Building,
a couple of Broadway shows.
Why didn't you
go with her?
I got called into work
last minute.
What do you do?
Some part-time stuff.
Operations and Safety
at the hospital,
and I work construction
on the weekends.
They were short on staff
and needed some extra help.
I was trying to save money
so we could go to Europe.
I think, uh...
I think she wanted to experience
New York this time on her own.
She loved the city.
Even though we were
in East Rutherford,
we didn't get
up here often.
I'm sorry. I, uh...
I just can't believe
she's gone.
All right. Every piece is
scrubbed, dried and connected.
Between that spider
this morning
and this phone, boy, I
could so use a hot shower.
Dude, man up.
It's time to Frankenstein
this thing.
We are gonna rebuild Adel's
phone and resurrect its memory.
You mean we
can do that?
We can actually get
data off of this thing?
Watch and learn, son.
This is how
the good guys do it.
Watch and learn.
♪ ♪
♪ ♪
You see what I'm seeing?
Yeah.
A problem.
So Krumitz was able
to pull some data
off Adel's phone, but the
threatening text messages
from Evan
aren't there.
Were they deleted?
They never existed.
So I double-checked with
Evan's service provider.
They have no record of the
calls or the texts either.
Which means Evan didn't send
or receive those texts.
So how did they get
on his phone?
So Elijah sent me everything
he pulled off
Evan Wescott's phone.
Those text message conversations
between Evan and Adel
were faked.
How can somebody fake a text
on another device?
Once you get a text message
into your phone,
it's added to
one long database.
If you're smart enough
and have the right software,
you can manipulate that file
and make it look
like you're getting text
messages from whoever you want.
Whenever you want.
Or to someone else's phone.
Mmm. “Happy New Year, Krumitz,
from your best pal, Sifter.”
Sent from your phone
January 1, 2016.
That is impressive.
And a little creepy.
Yeah.
Now, would you need
physical access to Evan's phone
to fake those text messages?
No. Plus, Evan's phone doesn't
even have the software necessary
to manipulate the database--
it had to be done remotely.
And that's not all.
GPS coordinates
that put Evan Wescott
in the hotel room
at the time of the murder...
Faked.
Faked.
His phone was hacked.
Yeah!
Oh...
Avery,
all of our digital evidence
is lying to us.
Is Krumitz sure
no mistake was made?
He's positive.
What about the
malware injected
into the hotel's
computer system?
It came from
Evan Wescott's computer.
But Krumitz doesn't believe
Evan is our hacker.
- He's sure?
- Yes.
And how many times have you
told me that Daniel Krumitz is
the best white hat
hacker ever?
Looks like Evan Wescott
is being framed for murder.
For someone to frame Evan,
they had to route the
intrusion through his laptop,
change the GPS,
and create those text messages.
Maybe he framed himself.
Clearly, you're new to this
and don't understand
the behavior of a criminal.
Other than yourself.
What I understand is I would do
anything not to go to prison.
Pretty risky to frame yourself.
It's working for Evan.
You believe he's innocent.
I believe in cyber evidence.
Okay, I'm not saying
the evidence is wrong.
I'm just saying his devices
could be manipulated by anybody.
Evidence doesn't point
to the identity of a hacker.
So what happened
when we caught you?
See, why you want
to get all personal?
What?
That's what I'm saying...
Guys? Guys?
Stop! Stop! Focus on the case!
Whatever, whatever.
Focus on the case.
Whoever hacked them,
gained access to
at least one
of Evan Wescott's devices.
Evan has full access
to all of his devices.
Physical access
is the easiest,
which is why I think it's Evan.
Physical access
is also the riskiest.
Nelson, just for a minute,
try to buy into the fact
that Adel's killer
might not be Evan Wescott.
The hacker behind this
had to have skills.
Evan has a computer
science degree.
I'm just saying!
All right, fine,
I'll, uh...
I'll play along.
The hacker could've easily
done this remotely.
If I'd done it,
I'd “war drive” him.
Pull up to his house.
Hack into his Wi-Fi,
plant everything
on his computer and phone
while he's still inside,
totally oblivious.
It's still too risky.
You're sitting
outside of his house.
What if somebody sees you?
Or your car?
The best way to do it is from
the safety of your own home.
All you have to do
is “spear phish” him--
a socially engineered attack.
Send Evan an e-mail
with a fake link
from his bank or something,
wait for him to click on it,
and then boom!
Full access to his laptop
and any device that connects
to it, like his phone!
Okay, so how you know he's gonna
click on it? And when?
Whoever did this
was short on time.
The best way to stay anonymous
and get instant access
to Evan's devices is
to wait for him
to connect to an open
Wi-Fi signal somewhere.
Anywhere they're advertising
free Wi-Fi is like a hacker's
virtual playground-- tons
of unexpected people unaware
that the person next to them
sharing the same connection
could be intruding
onto their devices
and stealing
all their information.
Or in Evan's case,
adding information.
Look, I still think
he could've done it himself.
I mean, that's just me.
Wi-Fi is the best option.
So... where was Evan hacked?
Well, according to his frequent
locations on Evan's phone,
he went to the gym
three or four times a week.
Most gyms have free Wi-Fi.
Restaurants, too.
I bet you he was
eating out every night.
You know, club owners
score mad dates.
How often is
he at Carla's Cafe?
Almost every day.
Well, according to the
network logs in Evan's laptop,
he connected
to the coffee shop's Wi-Fi
the morning after the murder.
You still think
it's a possibility
that he framed himself?
Yeah. I do.
All right.
So I spoke to the manager.
The surveillance cameras
are all dummies.
They're just there
as a crime deterrent.
They don't record
a damn thing.
But... the Wi-Fi went
down three days ago
at 10:32 a.m.
Now, according to Evan's laptop,
he was long gone at that time.
But not onto the cafe's router.
Maybe someone set up
an evil twin router.
And that's how he got hacked.
Now, my phone...
can give the illusion
of being a Wi-Fi signal,
same as a twin router.
All I have to do is activate
my own personal hot spot
from my device,
and I am open Wi-Fi.
I can even name it
anything I want.
Say we're
in Carla's Cafe, right?
Think I'll name
my new hot spot network...
“Carla's Cafe.”
Now, log on to the free Wi-Fi.
Which one? There are two.
Exactly.
The one I just created
and the real one.
I'm guessing
our target eliminated
the real Carla's Cafe Wi-Fi.
Evan came in,
logged on to
the decoy signal...
and the hacker
gained control of his device.
You just did all that
with your phone?
Just a few clicks of a button.
Now, I-I can't control
your device from my phone,
but our target had
an actual router.
He was able to push
any information he wanted
onto Evan's devices.
I mean, anytime
you log on to open Wi-Fi,
you leave yourself vulnerable.
Or in our case,
you become a murder suspect.
It can happen to anyone.
Looks like it just happened
to Evan Wescott.
Raven, I need you
to track down
the owner of an
evil twin router.
Right.
Nelson thinks
Evan framed himself.
That would be a smart move.
You don't really
believe that, do you?
Nelson thinks the
way hackers do.
But...
Evan has no motive.
And no definitive
connection to Adel Foster
other than a kiss;
and kisses rarely
get you convicted of murder.
You miss New York.
Yeah, feeling a
bit nostalgic.
I opened my first
practice in Manhattan.
Hung the shingle
on a brownstone
just like that one there.
Went from
analyzing minds to
analyzing cyber criminals.
Wasn't really a plan,
it just happened.
You ever think
about moving back?
No.
I only think about one thing.
Catching the guy that
hacked and stole my files.
There isn't a morning where
I don't wake up wondering
if today's the day
that he's gonna
release private
patient information.
And the whole nightmare
will start all over again.
We'll catch him.
You know what I miss
about this place?
The Mets.
The Mets?
I would comment,
but you'd probably fire me.
But there is one question
I can't shake, Elijah.
Evan Wescott.
What about him?
Well, the beauty
of an open Wi-Fi hack
is its sheer randomness.
Our killer could've framed
anyone on his router
for Adel's murder.
You think the target
chose Evan specifically.
Adel went to Evan's club
the night of the murder.
And the next morning,
Evan ends up at Carla's Cafe
at the exact same time
as the evil twin router.
It feels personal.
Our target crafted
a murder for Evan.
Fabricated texts
and GPS data, linked
him to the hotel hack.
He set up Evan as a fall guy
for a reason, but why?
I identified the
router that was used
to hack Evan in Carla's Cafe.
The latest and greatest
in evil twin deception, huh?
Manufacturer gave me the big
box store where it was sold.
All right, from your smirk,
I'm guessing
it was purchased recently.
Mm-hmm.
Point of sale puts that
gentleman at the register.
He paid cash.
Get this to Avery and Elijah.
We've got him.
Look who was in Manhattan
the morning after Adel's murder.
Just got this from Raven.
Oh. The heartbroken boyfriend.
Shane Tillman, FBI!
He's not here.
I'm gonna image the hard drive,
send it to Nelson and Krumitz
to comb through the data.
Broken cup.
Damaged wall.
There was an argument.
Adel wasn't visiting New York.
She was running away from Shane.
You know, something struck
me as odd when I saw
the bruises on her wrist
at the crime scene.
Look. They're purple,
almost black.
If she'd gotten these during
the struggle the night
that she was killed, they'd
be pink or not even visible.
She got these before
the night she was killed.
Adel was leaving Shane.
He came home.
Stop it!
He pulled her things
out of her bag
to prevent her from leaving.
When she escaped,
he grabbed her wrists,
which caused the bruising.
Oh, God!
When she left,
he started drinking.
He followed her
to New York and
he killed her.
My God.
Even when women get the courage
to leave abusive relationships,
sometimes they still get killed.
So what's his next move?
Well, he's angry.
He's calculated.
He's got
nothing to lose.
And he's armed and dangerous.
I just hit a dead end.
Tillman's phone's
not showing a signal.
He must have turned it off.
There's no way to track him.
I'll see what we can do
with Tillman's laptop.
His recent online activity
should give us a glimpse
into his state of mind.
Yeah, browser history
has been cleared.
Yeah, well, clearing
your history may hide porn sites
from your girlfriend, but
it won't hide anything from me.
Browser artifacts are easily
recovered with the right tools.
Oh, check it out. Mostly
New York news affiliates.
He's following the Adel Foster
murder investigation.
You think he knows we're onto him?
Always assume
that the bad guys are two steps
ahead of you, Nelson.
That way, you're
prepared for anything,
and you're never
caught off guard.
Hey, man, he visited a
cell phone locating site?
I mean, what, he
lost his cell phone?
No, he wasn't looking
for his phone.
He was tracking
someone else. Look.
That area code is 212.
That's New York, not Jersey.
I'll call Elijah.
Elijah, Shane Tillman is using
a cell phone location
tracking site.
He's going after Evan Wescott!
♪ ♪
Whoa, whoa, whoa, hey.
Problem is with me.
Just let these people go.
Shut up!
This wouldn't be happening
if it wasn't for you.
You took her away from me.
Buddy, I think you got the wrong guy.
It was you! It was you!
I saw you with Adel
right here in this bar.
Look, man, just drop the gun,
and we can talk
about whatever it is that
you think may have happened.
No, I know what happened!
I know what happened!
You took her away from me.
Of course, you don't remember.
There's so many women,
aren't there?
You just have to have them all?
I needed a chance to explain,
to say I was sorry.
To say I was sorry.
But you...
you were all over her.
And I could see in her eyes,
she wasn't coming back to me.
Shane?
Stay where you are!
Stay where you are!
Or this isn't gonna end
the way you want it to.
Let her go and
put down the gun.
He killed my girlfriend,
and you did nothing.
You set him free.
At the count of three,
I'm gonna discharge this weapon.
You need to decide
what you're gonna
do. One, two...
Okay.
Okay.
Good.
Now kick it
towards me.
Stay right where you are.
W-Wait, don't do
that, don't do that.
I can't live without her!
Shane. Shane!
I got you!
Hang on!
I got you!
♪ ♪
Are you okay?
Yeah. Yeah.
We got him.
We're not done.
We still haven't put
Shane Tillman
in that hotel room
at the time of the murder.
We still have to prove
who killed Adel Foster.
Anything on Shane's phone?
I need to know what we've got
before I question him.
Well, nothing concrete.
I'm heading in now
for an update.
- Yeah!
- That's what I'm talking about!
We got it.
We found proof.
I'm gonna call you back.
Wh-What kind of proof
did you find?
Proof that Shane Tillman was
at the scene of the crime.
Proof that he murdered
Adel Foster?
If we're lucky, both.
It's called a motion
tracking chip.
Most new smartphones
have them,
but most people don't
know they exist.
It's a motion co-processor that
collects and stores motion data
on the phone's accelerometers,
gyroscopes and compasses.
All right, so
basically it just...
it records movement.
Yeah, it's how an exercise app
knows the difference
between when you're jogging
versus walking,
which direction
you're headed--
pretty much however
your phone's moving.
As the phone moves,
the motion tracking chip
records all of it.
It will detect a pitch,
a roll, a tilt--
every movement the phone makes.
Right, and it's always on.
And it's separate
from the main processor.
Let me get this right--
so if data were altered
on that device, it would
never cross your minds
to manipulate that file.
Exactly.
So we pulled all the data
off Shane's motion tracking
chip, and this is what we found.
So the one on the left is
the motion tracking chip
from Shane's phone; the one
on the right is Adele's.
Yeah, we synced both of them up
to the last time Adel's phone
moved before she was murdered.
Most people keep their
phones in their pants pockets.
Which means the phone
was recording their movement.
So if two people were fighting,
and we had both phones...
Right, we could
reenact the fight.
Yeah.
Who is he?!
Who is he?
Tell me who he is!
Leave me alone!
I'm not your
girlfriend anymore!
Adel?
Well, this not only puts
Shane Tillman in the room
at the time of the murder,
it proves that he killed her.
You covered your tracks
from every possible angle.
You wiped your phone
of any wrongdoing,
pushed all the evidence
to Evan's devices,
you even hacked the hotel,
wiped its security footage.
It was all very clever.
But you forgot
one thing.
One thing most people
don't know about--
your phone's
motion tracking chip.
Cyber-synchronized
offender and victim.
Records every
movement.
Proves you killed
your girlfriend.
What's this?
No!
No, no! You freed it?!
Oh, what?
Uh, there was a cup in
the middle of the floor.
Hey, welcome back.
Good job.
He has been preoccupied
with a little spider.
What is all that?
What?
Some compressed air.
I was gonna turn it over,
zap it, freeze it,
then I was gonna
set it free.
Aw.
Cryonic preservation?
I'm not hunting
that thing down again.
Okay, I will help you
look for your spider.
Thank you.
We'll find it,
and Elijah will arrest it.
Yeah.
Well, now I have to help.
Yeah.
Why... why would y'all do that?
Why would
y'all do that?!
== sync, corrected by elderman ==
@elder_man
I was a victim of cyber crime.
Like you, I posted
on social media,
checked my bank account
balance online,
even kept
the confidential files
of my psychological practice
on my computer.
Then I was hacked,
and as a result,
one of my patients
was murdered.
My investigation into her death
led me to the FBI,
where I joined a team
of cyber experts
to wage a war against
a new breed of criminal
hiding on the Deep Web...
infiltrating our daily lives
in ways we never imagined...
...faceless...
nameless...
lurking inside our devices,
just a keystroke away.
♪ ♪
Mr. Nelson,
you're late.
I'm sorry, Avery.
It's just that getting up early
is something
my body's not used to.
Okay, I feel you.
All right, I'll have a talk
with my body,
and we'll be here on time.
What you doing?
Oh, rescuing a spider.
Oh. Um...
Yeah, do not come near me. Look.
Look, I'm-I'm serious.
Brody Nelson,
don't tell me you're afraid
of a little spider?
A little spider?
Avery, look at the size
of that thing. That's not...
Uh-oh. Where...?
Why are you looking
on the ground?
I dropped it.
You dropped it.
Avery...
Your bag...
Well...
Aah!
Well, spiders don't like it
when you're late.
So your plane's on the tarmac
at National, and you're
scheduled to leave
in an hour for
New York City.
The Kirkendahl
Hotel believes
that their computer
network has been hacked.
That connects every
location worldwide.
This is the Kirkendahl file.
What do we got?
Three days ago,
the hotel's computer intrusion
detection system
went off, sent an alert
from their East Side property.
And they had their
I.T. team take a look at it?
It appeared to be a glitch,
happens all the time.
They reset the system,
it happened again.
There's evidence
of a remote cyber intrusion.
Kirkendahl's
Wi-Fi has been compromised.
That means the hackers
could have access to
the corporate computers
and the guests'
personal devices.
And they probably discovered
a vulnerable protocol,
used a root kit to gain access.
Nah, that's doing
it the hard way.
There's a known exploit in the
authentication credential.
You should know that, right?
Of course I know that.
Okay, well...
Why wouldn't I know that?
Guys? Guys?
You spilled water on your keyboard.
Then I saw a spider.
It's not like I
did it on purpose.
Whatever.
Let's just reign in
our intellect here.
That hotel is
right next to the U.N.
A lot of high-profile people
stay there.
Diplomats, dignitaries,
celebrities.
Yeah, and the U.N. is back
in session in two days.
We could be looking
at a dark hotel scenario here.
Hackers targeting the guests.
Yeah, or an attack
against the Kirkendahl
Corporation itself.
Either way,
documents could be released.
E-mails, texts,
sensitive information
that could embarrass or expose
some very important people.
Well, I've got
a meeting coming up
with the FBI Director.
I'll tell him my team is on it,
and that none
of that will happen.
Enjoy your flight.
At the suggestion
of our in-house
technical support team,
we shut down the Wi-Fi.
Has any employee or guest
reported any strange e-mails,
or any evidence
of their individual
devices being hacked?
No.
What about pop-up alerts
instructing them
to update a file
or a program?
I don't know. Those pop-ups
appear all the time,
even on my home computer.
Well, it's one of the ways
that devices are hacked.
A free download
or product upgrade
that looks like it's authentic.
But instead of it being
the actual product,
it's the delivery of malware--
malicious software.
And once someone opens it,
the code gets released into
the computer like a virus,
and the hacker takes over.
It's like the hacker's
lurking inside the device.
When a guest logs on to
your Wi-Fi, the hacker is able
to see their room number,
the last name on their account,
even get their passwords.
But-but we-we shut down
the Wi-Fi,
so that should
protect us, right?
Depends.
I mean,
some malware is programmed
to lay in wait
for six hours, six days,
six months or more.
Should-should we be copying
and deleting documents?
No. Despite the definition
of the word “delete,”
in the cyber world, almost
anything can be recovered.
Agent Ryan, as in-house counsel
for the Kirkendahl Corporation,
I can't stress enough
the importance of privacy here.
It is something
that we guarantee
to our board members,
our employees and our guests.
There must be something
that we can do.
Many of our guests use aliases
when checking in,
but their real names and
home addresses are in our files.
Some engage in activity
that we keep very confidential,
and I'm talking about more than
just ordering an adult movie.
We-we send e-mails and texts
containing confidential
company information--
bonuses, salaries,
mergers.
Activity that will have
serious repercussions
if those communications
became public.
Pardon me.
Yes.
Say that again.
All right.
Our hotel
security footage has been wiped.
Lobby... entrances...
guest room corridors.
Everything recorded
in the past week.
Was the system connected
to the Wi-Fi?
Yes.
If your surveillance
footage was wiped,
I don't think
our hacker is interested
in these confidential files
that you're worried
about, Counselor.
Something else
is going on here.
Something happened here
at your hotel,
and someone is trying
to cover it up.
Ms. Foster?
This is the hotel manager.
Ms. Foster, your music
is disturbing other guests!
Ms. Foster?
Oh, geez.
Security. Call 911.
The victim is Adel Foster,
24 years old.
She checked into this
room five days ago alone.
Driver's license
lists her address as
East Rutherford,
New Jersey.
NYPD are reaching out to New
Jersey Police and her family.
Room's disorganized.
Bruises on her wrists.
Indicates... a struggle.
Most likely, a crime of passion.
Detectives canvassed
the hotel guests.
Nobody heard or saw anything.
Crime scene lifted
a few prints.
Most belonged to the victim,
the rest to housekeeping.
However,
I did find this
in the plumbing.
The victim's cell phone.
The target tried to destroy
it and then flush it.
Well, the water likely
corroded the connectors.
Data recovery is
gonna be tough.
The hotel invoice.
Looks like around
3:00 this morning,
she ordered a late-night
snack and a movie.
Behavior of an insomniac.
Food for one.
That indicates she was alone.
Wait a minute. This is strange.
What?
The medical examiner just established
approximate time of death.
Three nights ago.
What?
It's a hotel. How does
housekeeping not find the body?
Stranger than that,
according to the room invoice,
yesterday and the day before,
she ordered laundry,
room and spa services,
and a movie.
And this morning, breakfast.
Well, it looks like
Adel Foster was alive
for three days after she died.
♪ CSI Cyber 1x06 ♪
The Evil Twin
Original Air Date on April 15, 2015
♪ I know you've deceived me,
now here's a surprise ♪
♪ I know that you have, 'cause
there's magic in my eyes ♪
♪ I can see
for miles and miles ♪
♪ I can see for miles
and miles ♪
♪ I can see
for miles and miles ♪
♪ And miles... ♪
♪ Oh, yeah. ♪
== sync, corrected by elderman ==
@elder_man
Okay, Raven,
what have you got?
Data from the Kirkendahl Hotel's
computer system.
This is a blueprint layout
of a standard room.
We can see the
computer controls
and monitors pretty much
everything that happens.
All run by one central
software package
called the
“digital butler”"
And this explains
why nobody in that hotel
found Adel Foster's body
for three days?
We believe so.
We detected malware
on the hotel server.
It was sent to every employee
hidden inside a
party invitation.
So that's how it
breached the firewall.
Ah. And Troy fell.
Yeah, it was the Trojans
themselves
that opened up
their own city gates
and pulled
the wooden horse inside.
Just like the hotel employees
who opened the party invitation
and let in the malware.
While they blindly
celebrated victory,
their enemy lay in wait.
And Troy fell.
Our hacker had
access to the hotel's
main computer.
They found their way
to Adel's guest room records
and made it look
like she was alive and well
even though Adel Foster
was definitely dead.
Well, that would
explain the manicure,
the facial, ordering the movie,
even room service,
but what about housekeeping?
No one ever
entered the room.
Because the
“do not disturb” sign
is also controlled
by the computer system.
Exactly. Maids won't
enter when the light is on.
Hotels connect
physical devices and sensors
in the hotel rooms
to one central computer
to improve efficiency
and cut down cost--
controlling thermostats
and water temperature,
providing you with the ease
of ordering services
from the hotel channel
on your television.
From one computer,
they can control everything.
Right. It's why they
sometimes charge you
for the items in the
minibar just because
you move them.
Now, the pressure
sensor on the shelves
sends a message
to the computer telling
its product has been consumed.
But as we all know,
computers can be hacked.
I actually met the hat
who wrote the code.
Called it a hospitality hack.
All right, now, once
a hacker intrudes
the hotel computer
system, he has control
over room assignments,
check in, check out,
television,
thermostat...
Oh, my favorite: the
remote control curtains.
Check this out.
Wait...
Nelson, are you
really doing that?
Did you actually
hack this hotel from CTOC?
Yeah, that was me.
The point is if all
the conveniences are connected
through software
to one central computer,
once the hacker's
inside the system,
he can create orders
for room service,
housekeeping, laundry pickup...
And none of it really happened.
It just looks like it did.
And all activity is
recorded under the guest's name
and room number.
Which explains why a dead woman
can order room service
and a movie.
So as far as the hotel knew,
the minibar
was being restocked,
the laundry
was being picked up,
the maids were performing
turndown services.
A hacker can control
any guest's room 24/7.
This is a very sophisticated
cover-up of a murder.
We need to know more
about our victim, Adel Foster.
Her devices are on their way
to you now, Krumitz.
We need to find
this hospitality hacker.
You can't break into a system
this complex
without leaving some
digital dust behind.
We're on it.
All right, so we got
our victim's laptop,
tablet and destroyed cell.
Our killer has
a three-day head start.
Puts him right
where we want him.
He thinks
he got away with murder.
Which means he already
made a mistake
that will lead
us right to him.
We are gonna find Adel
Foster's murderer.
You know, I really could have
used these things two years ago.
But you know every time
Apple introduces a new device,
there's a new cord,
a new connector,
and then all the old stuff
is not compatible with
the new stuff, so then you...
you know, you got to go back,
buy all the new Apple products,
connect them and...
Dude, dude, really?
We're trying to work here.
Okay, well, then give me
something to do.
Here. Lay out all the
pieces of this cell phone.
Disassemble it,
remove the circuit board,
then scrub the resistor
jumper connections.
There's a toothbrush
and alcohol solution
right over there.
Oh, okay.
I see how you do.
New guy gets the poop phone.
What?
I happen to know that this was
the phone that was recovered
from the toilet
in the hotel room.
He's right.
That is the poop phone.
Really? You're gonna
encourage this?
And you're not even
that new anymore.
Okay, you know what, Nelson?
Fine. I will gladly
take the poop phone
if you just do me
one favor and stop talking.
Guys.
Okay, what, you in a bad
mood or something, Krummy?
You want to
talk about it?
Oh. You're having
girl problems.
Oh, my...
I knew it.
Raven, could you grab me
that pen over there
and stab me with it?
That would be awesome.
Guys, will you cut it out and come here.
You got no game.
I found something.
I have... I have game.
You guys.
I went back
to the employee party invitation
where the malware was embedded.
I couldn't find the information
on the computer that sent it.
The hacker anonymized it.
So, I responded yes. I got back
an auto-reply confirmation,
and guess what-- our hacker
forgot to anonymize that e-mail.
Pretty sure it's the same one
that sent the invitation.
And I got his I.P. address
on the computer.
Yeah! These guys never
think two steps ahead.
I love this job.
This is gonna
lead us right
to our hacker.
♪ ♪
Evan Wescott? Is
this your computer?
Yes. Why?
FBI.
You're under arrest
for computer fraud
in connection with the
murder of Adel Foster.
What? What are you
talking about? Hey, whoa.
Hold on a minute.
I don't even know who that is.
You got the wrong guy.
I didn't kill anybody.
We can do this the hard way,
or you can come quietly.
You hacked the Kirkendahl
Hotel's main computer, Evan.
We know this because the I.P.
address of the device used
led us back to your laptop.
That's impossible.
I don't even know how to do
- something like that.
- You created a backdoor
in the computer systems
and took control
of the hotel's
hospitality functions--
maid service,
room service, minibar.
You murdered Adel and activated
those services to make it look
like she was alive
three days after her death.
What? That's insane.
I didn't kill anybody.
Your cell phone
places you at the hotel
at the exact time
of Adel Foster's murder.
Your phone's location services
puts you in that hotel.
Location services?
The little program
that's always running
in the background
of your phone.
Logs everywhere you go.
Nifty little feature.
See the elevation listed
here? 29.7 meters.
That's roughly
seven floors.
Her body was found
in room 715.
Okay, I-I'm not a murderer.
Really?
'Cause you sure
sound like one
in the text that
you sent Adel.
We found that
on your phone.
These are not my text messages.
And I already told you,
I don't know anybody named Adel.
Are you sure you
never talked to her?
This is surveillance footage
from your bar, Evade,
on the night she
was murdered.
♪ ♪
I mean, 'cause that
sure as hell looks like her,
and that is definitely you.
Look, man, a lot of people
come into my club.
- And, yeah, I meet a lot of women.
- Yeah?
Well, this one was murdered
three days ago.
Where were you?
I was at the club.
I'm always at the club.
It's a pretty crowded place
at night.
Could easily step out for an
hour, and no one would miss you.
This is ridiculous.
I didn't do anything.
At first, I couldn't understand
why you went to all the trouble
to make it look like
Adel was still alive.
You wanted
to buy yourself time
to create an alibi.
The hotel hack.
And you certainly
can't deny
that you were
capable of doing it.
You were a computer
science major
at Kenniwick University.
Day one, nobody found the body.
Day two, no one came for you.
Day three,
you got comfortable.
You distanced yourself
from the murder.
You thought
there was no evidence
tying you to
the scene of the crime.
You got away with murder.
- Almost.
- No.
I didn't kill anybody.
I didn't do any of these things.
Evan...
your devices tell us
you're lying.
♪ ♪
Shane Tillman.
Adel is... er, was...
my girlfriend.
I don't understand
how this happened.
Doesn't the hotel
have security?
We're still investigating
the circumstances
surrounding
Adel's death.
You mean her murder.
When her cell kept
going to voicemail,
I called the-the hotel,
and she...
they said that she was
still checked in.
I thought that
she had lost her phone.
You know? I mean,
she does that a lot.
But I never thought...
...you know, that, um,
that she was dead.
You spoke to her the night
that she was killed.
Yeah, she seemed excited.
Talking a mile a minute.
Adel saved up money
for months for this trip.
You know, she had
a whole itinerary:
Coney Island, Statue of Liberty,
Empire State Building,
a couple of Broadway shows.
Why didn't you
go with her?
I got called into work
last minute.
What do you do?
Some part-time stuff.
Operations and Safety
at the hospital,
and I work construction
on the weekends.
They were short on staff
and needed some extra help.
I was trying to save money
so we could go to Europe.
I think, uh...
I think she wanted to experience
New York this time on her own.
She loved the city.
Even though we were
in East Rutherford,
we didn't get
up here often.
I'm sorry. I, uh...
I just can't believe
she's gone.
All right. Every piece is
scrubbed, dried and connected.
Between that spider
this morning
and this phone, boy, I
could so use a hot shower.
Dude, man up.
It's time to Frankenstein
this thing.
We are gonna rebuild Adel's
phone and resurrect its memory.
You mean we
can do that?
We can actually get
data off of this thing?
Watch and learn, son.
This is how
the good guys do it.
Watch and learn.
♪ ♪
♪ ♪
You see what I'm seeing?
Yeah.
A problem.
So Krumitz was able
to pull some data
off Adel's phone, but the
threatening text messages
from Evan
aren't there.
Were they deleted?
They never existed.
So I double-checked with
Evan's service provider.
They have no record of the
calls or the texts either.
Which means Evan didn't send
or receive those texts.
So how did they get
on his phone?
So Elijah sent me everything
he pulled off
Evan Wescott's phone.
Those text message conversations
between Evan and Adel
were faked.
How can somebody fake a text
on another device?
Once you get a text message
into your phone,
it's added to
one long database.
If you're smart enough
and have the right software,
you can manipulate that file
and make it look
like you're getting text
messages from whoever you want.
Whenever you want.
Or to someone else's phone.
Mmm. “Happy New Year, Krumitz,
from your best pal, Sifter.”
Sent from your phone
January 1, 2016.
That is impressive.
And a little creepy.
Yeah.
Now, would you need
physical access to Evan's phone
to fake those text messages?
No. Plus, Evan's phone doesn't
even have the software necessary
to manipulate the database--
it had to be done remotely.
And that's not all.
GPS coordinates
that put Evan Wescott
in the hotel room
at the time of the murder...
Faked.
Faked.
His phone was hacked.
Yeah!
Oh...
Avery,
all of our digital evidence
is lying to us.
Is Krumitz sure
no mistake was made?
He's positive.
What about the
malware injected
into the hotel's
computer system?
It came from
Evan Wescott's computer.
But Krumitz doesn't believe
Evan is our hacker.
- He's sure?
- Yes.
And how many times have you
told me that Daniel Krumitz is
the best white hat
hacker ever?
Looks like Evan Wescott
is being framed for murder.
For someone to frame Evan,
they had to route the
intrusion through his laptop,
change the GPS,
and create those text messages.
Maybe he framed himself.
Clearly, you're new to this
and don't understand
the behavior of a criminal.
Other than yourself.
What I understand is I would do
anything not to go to prison.
Pretty risky to frame yourself.
It's working for Evan.
You believe he's innocent.
I believe in cyber evidence.
Okay, I'm not saying
the evidence is wrong.
I'm just saying his devices
could be manipulated by anybody.
Evidence doesn't point
to the identity of a hacker.
So what happened
when we caught you?
See, why you want
to get all personal?
What?
That's what I'm saying...
Guys? Guys?
Stop! Stop! Focus on the case!
Whatever, whatever.
Focus on the case.
Whoever hacked them,
gained access to
at least one
of Evan Wescott's devices.
Evan has full access
to all of his devices.
Physical access
is the easiest,
which is why I think it's Evan.
Physical access
is also the riskiest.
Nelson, just for a minute,
try to buy into the fact
that Adel's killer
might not be Evan Wescott.
The hacker behind this
had to have skills.
Evan has a computer
science degree.
I'm just saying!
All right, fine,
I'll, uh...
I'll play along.
The hacker could've easily
done this remotely.
If I'd done it,
I'd “war drive” him.
Pull up to his house.
Hack into his Wi-Fi,
plant everything
on his computer and phone
while he's still inside,
totally oblivious.
It's still too risky.
You're sitting
outside of his house.
What if somebody sees you?
Or your car?
The best way to do it is from
the safety of your own home.
All you have to do
is “spear phish” him--
a socially engineered attack.
Send Evan an e-mail
with a fake link
from his bank or something,
wait for him to click on it,
and then boom!
Full access to his laptop
and any device that connects
to it, like his phone!
Okay, so how you know he's gonna
click on it? And when?
Whoever did this
was short on time.
The best way to stay anonymous
and get instant access
to Evan's devices is
to wait for him
to connect to an open
Wi-Fi signal somewhere.
Anywhere they're advertising
free Wi-Fi is like a hacker's
virtual playground-- tons
of unexpected people unaware
that the person next to them
sharing the same connection
could be intruding
onto their devices
and stealing
all their information.
Or in Evan's case,
adding information.
Look, I still think
he could've done it himself.
I mean, that's just me.
Wi-Fi is the best option.
So... where was Evan hacked?
Well, according to his frequent
locations on Evan's phone,
he went to the gym
three or four times a week.
Most gyms have free Wi-Fi.
Restaurants, too.
I bet you he was
eating out every night.
You know, club owners
score mad dates.
How often is
he at Carla's Cafe?
Almost every day.
Well, according to the
network logs in Evan's laptop,
he connected
to the coffee shop's Wi-Fi
the morning after the murder.
You still think
it's a possibility
that he framed himself?
Yeah. I do.
All right.
So I spoke to the manager.
The surveillance cameras
are all dummies.
They're just there
as a crime deterrent.
They don't record
a damn thing.
But... the Wi-Fi went
down three days ago
at 10:32 a.m.
Now, according to Evan's laptop,
he was long gone at that time.
But not onto the cafe's router.
Maybe someone set up
an evil twin router.
And that's how he got hacked.
Now, my phone...
can give the illusion
of being a Wi-Fi signal,
same as a twin router.
All I have to do is activate
my own personal hot spot
from my device,
and I am open Wi-Fi.
I can even name it
anything I want.
Say we're
in Carla's Cafe, right?
Think I'll name
my new hot spot network...
“Carla's Cafe.”
Now, log on to the free Wi-Fi.
Which one? There are two.
Exactly.
The one I just created
and the real one.
I'm guessing
our target eliminated
the real Carla's Cafe Wi-Fi.
Evan came in,
logged on to
the decoy signal...
and the hacker
gained control of his device.
You just did all that
with your phone?
Just a few clicks of a button.
Now, I-I can't control
your device from my phone,
but our target had
an actual router.
He was able to push
any information he wanted
onto Evan's devices.
I mean, anytime
you log on to open Wi-Fi,
you leave yourself vulnerable.
Or in our case,
you become a murder suspect.
It can happen to anyone.
Looks like it just happened
to Evan Wescott.
Raven, I need you
to track down
the owner of an
evil twin router.
Right.
Nelson thinks
Evan framed himself.
That would be a smart move.
You don't really
believe that, do you?
Nelson thinks the
way hackers do.
But...
Evan has no motive.
And no definitive
connection to Adel Foster
other than a kiss;
and kisses rarely
get you convicted of murder.
You miss New York.
Yeah, feeling a
bit nostalgic.
I opened my first
practice in Manhattan.
Hung the shingle
on a brownstone
just like that one there.
Went from
analyzing minds to
analyzing cyber criminals.
Wasn't really a plan,
it just happened.
You ever think
about moving back?
No.
I only think about one thing.
Catching the guy that
hacked and stole my files.
There isn't a morning where
I don't wake up wondering
if today's the day
that he's gonna
release private
patient information.
And the whole nightmare
will start all over again.
We'll catch him.
You know what I miss
about this place?
The Mets.
The Mets?
I would comment,
but you'd probably fire me.
But there is one question
I can't shake, Elijah.
Evan Wescott.
What about him?
Well, the beauty
of an open Wi-Fi hack
is its sheer randomness.
Our killer could've framed
anyone on his router
for Adel's murder.
You think the target
chose Evan specifically.
Adel went to Evan's club
the night of the murder.
And the next morning,
Evan ends up at Carla's Cafe
at the exact same time
as the evil twin router.
It feels personal.
Our target crafted
a murder for Evan.
Fabricated texts
and GPS data, linked
him to the hotel hack.
He set up Evan as a fall guy
for a reason, but why?
I identified the
router that was used
to hack Evan in Carla's Cafe.
The latest and greatest
in evil twin deception, huh?
Manufacturer gave me the big
box store where it was sold.
All right, from your smirk,
I'm guessing
it was purchased recently.
Mm-hmm.
Point of sale puts that
gentleman at the register.
He paid cash.
Get this to Avery and Elijah.
We've got him.
Look who was in Manhattan
the morning after Adel's murder.
Just got this from Raven.
Oh. The heartbroken boyfriend.
Shane Tillman, FBI!
He's not here.
I'm gonna image the hard drive,
send it to Nelson and Krumitz
to comb through the data.
Broken cup.
Damaged wall.
There was an argument.
Adel wasn't visiting New York.
She was running away from Shane.
You know, something struck
me as odd when I saw
the bruises on her wrist
at the crime scene.
Look. They're purple,
almost black.
If she'd gotten these during
the struggle the night
that she was killed, they'd
be pink or not even visible.
She got these before
the night she was killed.
Adel was leaving Shane.
He came home.
Stop it!
He pulled her things
out of her bag
to prevent her from leaving.
When she escaped,
he grabbed her wrists,
which caused the bruising.
Oh, God!
When she left,
he started drinking.
He followed her
to New York and
he killed her.
My God.
Even when women get the courage
to leave abusive relationships,
sometimes they still get killed.
So what's his next move?
Well, he's angry.
He's calculated.
He's got
nothing to lose.
And he's armed and dangerous.
I just hit a dead end.
Tillman's phone's
not showing a signal.
He must have turned it off.
There's no way to track him.
I'll see what we can do
with Tillman's laptop.
His recent online activity
should give us a glimpse
into his state of mind.
Yeah, browser history
has been cleared.
Yeah, well, clearing
your history may hide porn sites
from your girlfriend, but
it won't hide anything from me.
Browser artifacts are easily
recovered with the right tools.
Oh, check it out. Mostly
New York news affiliates.
He's following the Adel Foster
murder investigation.
You think he knows we're onto him?
Always assume
that the bad guys are two steps
ahead of you, Nelson.
That way, you're
prepared for anything,
and you're never
caught off guard.
Hey, man, he visited a
cell phone locating site?
I mean, what, he
lost his cell phone?
No, he wasn't looking
for his phone.
He was tracking
someone else. Look.
That area code is 212.
That's New York, not Jersey.
I'll call Elijah.
Elijah, Shane Tillman is using
a cell phone location
tracking site.
He's going after Evan Wescott!
♪ ♪
Whoa, whoa, whoa, hey.
Problem is with me.
Just let these people go.
Shut up!
This wouldn't be happening
if it wasn't for you.
You took her away from me.
Buddy, I think you got the wrong guy.
It was you! It was you!
I saw you with Adel
right here in this bar.
Look, man, just drop the gun,
and we can talk
about whatever it is that
you think may have happened.
No, I know what happened!
I know what happened!
You took her away from me.
Of course, you don't remember.
There's so many women,
aren't there?
You just have to have them all?
I needed a chance to explain,
to say I was sorry.
To say I was sorry.
But you...
you were all over her.
And I could see in her eyes,
she wasn't coming back to me.
Shane?
Stay where you are!
Stay where you are!
Or this isn't gonna end
the way you want it to.
Let her go and
put down the gun.
He killed my girlfriend,
and you did nothing.
You set him free.
At the count of three,
I'm gonna discharge this weapon.
You need to decide
what you're gonna
do. One, two...
Okay.
Okay.
Good.
Now kick it
towards me.
Stay right where you are.
W-Wait, don't do
that, don't do that.
I can't live without her!
Shane. Shane!
I got you!
Hang on!
I got you!
♪ ♪
Are you okay?
Yeah. Yeah.
We got him.
We're not done.
We still haven't put
Shane Tillman
in that hotel room
at the time of the murder.
We still have to prove
who killed Adel Foster.
Anything on Shane's phone?
I need to know what we've got
before I question him.
Well, nothing concrete.
I'm heading in now
for an update.
- Yeah!
- That's what I'm talking about!
We got it.
We found proof.
I'm gonna call you back.
Wh-What kind of proof
did you find?
Proof that Shane Tillman was
at the scene of the crime.
Proof that he murdered
Adel Foster?
If we're lucky, both.
It's called a motion
tracking chip.
Most new smartphones
have them,
but most people don't
know they exist.
It's a motion co-processor that
collects and stores motion data
on the phone's accelerometers,
gyroscopes and compasses.
All right, so
basically it just...
it records movement.
Yeah, it's how an exercise app
knows the difference
between when you're jogging
versus walking,
which direction
you're headed--
pretty much however
your phone's moving.
As the phone moves,
the motion tracking chip
records all of it.
It will detect a pitch,
a roll, a tilt--
every movement the phone makes.
Right, and it's always on.
And it's separate
from the main processor.
Let me get this right--
so if data were altered
on that device, it would
never cross your minds
to manipulate that file.
Exactly.
So we pulled all the data
off Shane's motion tracking
chip, and this is what we found.
So the one on the left is
the motion tracking chip
from Shane's phone; the one
on the right is Adele's.
Yeah, we synced both of them up
to the last time Adel's phone
moved before she was murdered.
Most people keep their
phones in their pants pockets.
Which means the phone
was recording their movement.
So if two people were fighting,
and we had both phones...
Right, we could
reenact the fight.
Yeah.
Who is he?!
Who is he?
Tell me who he is!
Leave me alone!
I'm not your
girlfriend anymore!
Adel?
Well, this not only puts
Shane Tillman in the room
at the time of the murder,
it proves that he killed her.
You covered your tracks
from every possible angle.
You wiped your phone
of any wrongdoing,
pushed all the evidence
to Evan's devices,
you even hacked the hotel,
wiped its security footage.
It was all very clever.
But you forgot
one thing.
One thing most people
don't know about--
your phone's
motion tracking chip.
Cyber-synchronized
offender and victim.
Records every
movement.
Proves you killed
your girlfriend.
What's this?
No!
No, no! You freed it?!
Oh, what?
Uh, there was a cup in
the middle of the floor.
Hey, welcome back.
Good job.
He has been preoccupied
with a little spider.
What is all that?
What?
Some compressed air.
I was gonna turn it over,
zap it, freeze it,
then I was gonna
set it free.
Aw.
Cryonic preservation?
I'm not hunting
that thing down again.
Okay, I will help you
look for your spider.
Thank you.
We'll find it,
and Elijah will arrest it.
Yeah.
Well, now I have to help.
Yeah.
Why... why would y'all do that?
Why would
y'all do that?!
== sync, corrected by elderman ==
@elder_man