CSI: Cyber (2015–2016): Season 1, Episode 9 - L0M1S - full transcript

My name is Avery Ryan.

I was a victim of cyber crime.

Like you, I posted
on social media,

checked my bank account
balance online,

even kept
the confidential files

of my psychological practice
on my computer.

Then I was hacked,
and as a result,

one of my patients
was murdered.

My investigation into her death
led me to the FBI,

where I joined a team
of cyber experts

to wage a war against
a new breed of criminal



hiding on the Deep Web...

infiltrating our daily lives
in ways we never imagined...

...faceless...

nameless...

lurking inside our devices,

just a keystroke away.

- We got another one.
- That's four and counting.

What the hell
is going on up there?

Hold on. Yes, I'm still here.

FAA has confirmed Wi-Fi is down
on four domestic flights,

all Monument Air.

Do they know why
this is happening?

They're still looking into it.

All right, I just spoke
to Liftoff Wireless.



They've been trying to restore
in-flight Internet access

on the planes,
but something is blocking them.

I'm here. Go.

Uh, we got a fifth.

No, no, make it six.

Same as the others.

All Monument Air. Looks like
some type of coordinated attack.

DHS is operating

at National Threat Level Yellow.

It hasn't jumped to orange yet.

Shouldn't we call
the president or someone?

I mean, we're talking planes.

Yeah, which is exactly why

we don't jump to conclusions.

We got to have some facts

before we suggest they start
upping the threat level.

No reports
of instrument malfunction.

Pilots are still able
to communicate

with the control tower.
Undercover air marshals

haven't detected any unusual
activity either.

What time did the Wi-Fi
go down on those flights?

Ten minutes after takeoff.

All right, that means
they were above 10,000 feet.

That's when the passengers
on Monument Air can connect

their electronic devices to
the in-flight wireless network.

Got another one.

Seven.

Eight.

- Nine.
- What the hell is this?

Okay, okay.
What is it, Krumitz?

Liftoff Wireless' server logs

show only one phone
on each plane

connected to the router and
caused Wi-Fi to go down.

That means nine passengers

on nine flights
shut off the Wi-Fi

from within the plane?

Sounds like
a coordinated attack to me.

Think all nine passengers
are working together?

Nelson, pull up
the flight routes.

The destination cities
are all different,

but they all originated

from Miami International.

I'm calling Homeland Security.

Secretary McKnight,
this is Simon Sifter,

Cyber Crime Division.

We've got a potential
national security threat.

I'm requesting
that you immediately ground

all Monument Air flights.

Yes, I am sure.
As you know,

shutting down
passenger communication

is a possible precursor
to hijacking.

I would like
all these flights redirected

to their nearest airports.

Monument Air Flight 417

is 300 miles outside of Miami.

That's the closest
and easiest to send back.

All right, I'll have that flight
routed back to Miami.

Krumitz, can you tell
specifically which phone

or passenger shut down the Wi-Fi?
I...

I mean, it's gonna
take some time,

- but yeah.
- Okay.

We need the names
and the seat numbers

for those passengers
with the phones,

and we need them now.

Let's go, Elijah.

Nelson.

♪ ♪

Okay, all right,
all right, got it.

All right, thanks, Krummy.

Okay, target's sitting
in 14C.

Plane is taxiing
to the gate right now.

Good, what about
the other flights?

Great.

Local Feds are detaining
the eight suspects

in the other cities now.

I-I just left for vacation.

Someone needs to tell me
what this is about.

Can you please call my husband?

This is crazy.

Excuse me. Excuse me.

Take your headphones
out, please.

How old are you?

16.
Have you been sitting there

the whole flight?
Yeah. Why?

Cuff her.

What did I do?
What's going on?

Stand up, place your hands
behind your back, please.

Willa?

Dad!

They won't let me leave.

What's going on here?

My daughter was going to visit

family in San Diego.

I don't get it.
Are you saying she's a suspect?

We're just trying to understand
what happened here, Mr. Hart.

Someone hacked
into the plane's router.

We traced that intrusion

back to Willa's phone.

What?

I mean, how is that possible?

Her cell phone serial number was
the last one

that logged on to the onboard
router before it crashed.

We ran that number through
every cell carrier's database

till it spit out a name.

Willa's name?

We matched that name
to the flight manifest.

It gave us a seat number.

Willa,

did you leave
your phone anywhere?

Did you bump your device
with anyone?

Did you text
or download anything?

Go ahead, sweetheart.
Just answer

her questions.

I texted some friends,

but I do that all the time.

I was just listening to music
and playing Dots.

Hmm.

What's he doing?

Imaging your phone,
making a duplicate copy

of your device to determine
what killed the Wi-Fi.

Can I have it back?

Once we're done with it.
Right now I want you to tell me

everything that happened
before your flight took off.

My dad dropped me
at the curb.

I checked my bag,

went through security,

had a smoothie.

I bought it at Mango Mel's.

And then I waited at the gate
for my flight.

Does the name Audrey Monroe

mean anything to you?

How about Ken Galvin?

Margaret Sloane?

What do they have to do
with Willa?

Your daughter's phone's not the
only one that cut off the Wi-Fi.

It happened
on eight other flights.

Lee Yang?

Jason Hawking?

I don't know
any of these people.

Well, it's clear to me,
and it should be to you,

that my daughter didn't have
anything to do with this.

She's just a kid.

Mr. Hart, in my line of work,

“just a kid”
doesn't mean anything.

Hey, yo, E.

It's getting ugly
over there, man.

Yeah, well,
their flight's been grounded

and they haven't been given
an explanation.

You'd be angry, too.

Well, you're right.

So, I ran diagnostics
on the plane's router.

One device overloaded
the entire system.

It was
a denial-of-service attack.

Ladies and gentlemen,

at this time,
Liftoff Wireless' Wi-Fi service

is available
at a charge of $9.99

for the duration of the flight.

Thank you.

Willa's phone prevented
any other passenger's device

from connecting to the Wi-Fi.

Phones aren't supposed to send
that many data packets at once.

Yeah, unless a hacker

with some skills worked
their magic.

Uh-huh.

I'll go ahead and unplug
the router from the plane.

I'll send it back to CTOC.

Do that.
All right.

Anything from
our FBI field teams?

Well, they've interrogated

the other eight suspects.

They're all
from different cities.

They span multiple generations,

and they've all got
varying levels of technology,

and they all allege
they have no idea what happened.

Willa Hart said the same thing.

She has no clue
what's going on.

Field teams confiscated

our suspects' phones.

They're imaging them now.

Data should be here any minute.

So, Avery, I've made
a lot of moves here.

There are gonna be
a lot of questions.

So, from your end,
what does this look like?

I'm not sure yet,

but I'm not willing
to give up on the idea

that these people are connected.

I'm sorry, ma'am,
this one didn't work either.

Two of my credit cards
have been declined?

That's impossible.

No, I didn't buy ten laptops.

I don't even shop
at that store.

Avery, what's happening?

I'm not sure yet. Hold on.

Let me flip view.

It suddenly just got
very noisy in here.

Yeah, my credit card's
been denied.

What do you mean you don't
know what's going on?

It happened on your plane.

Are you seeing this?

All of my credit cards

cannot be maxed out.
How is that even possible?

All of these people
were passengers

on Willa Hart's flight.

Simon,

I know what this is.

This is a credit card heist.

Dozens of people
who got off that plane

are starting to receive alerts

that their credit cards
have been frozen.

Someone stole their information.

That's it, that's it, that's it.

'Cause a plane

is the one place where people
are held captive.

You can't connect

to the rest of the world
if the Wi-Fi is down.

The passengers wouldn't even
know that they'd been robbed

till they got off the plane
and connected to the Internet.

I don't believe this.

What?
This can't be right.

I've seen this before.

There it is again and again.

He uses
a unique signature

when writing code.

He?

What is it, Krumitz?

I know who did it.

Lomis.

Lomis is behind this,

and it's just the beginning.

♪ CSI Cyber 1x09 ♪
L0M1S
Original Air Date on April 29, 2015

♪ I know you've deceived me,
now here's a surprise ♪

♪ I know that you have, 'cause
there's magic in my eyes ♪

♪ I can see
for miles and miles ♪

♪ I can see for miles
and miles ♪

♪ I can see
for miles and miles ♪

♪ And miles... ♪

♪ Oh, yeah. ♪

== sync, corrected by elderman ==
@elder_man

I can't believe
this is Lomis.

He's like a hacker legend.

Came out of nowhere
a few years back.

Now, they say he's in his 30s,
good-looking,

comes from Estonia.

Sounds like
a little hacker envy, Nelson.

No.

Look, it's admiration.

Lomis lives up to his name.

It's leetspeak
for “low missile.”

Flies under the radar.

He's only surfaced twice.

Both times at DefCon in Vegas.

That's it.

All right, over $400,000
have been stolen

in our credit card scam
and over 300 people

have reported theft.

There's no telling

when this is gonna end.

See?

Now that's what I call
traveling in style.

Sifter has connections
with the Coast Guard,

so Krumitz gets a free escort
from D.C. to Miami.

Nice ride, bro!

It's the only
way to fly!

Krumitz, you're sure
this is Lomis?

Every bone in my body
says I'm right.

This is how
he works.

When the Wi-Fi intrusion
on the planes

connected to the credit cards,
I knew it was him.

Sounds like a hunch.

And your obsession
with catching a guy

you've been chasing
for the last three years.

But it's not.

Before I left CTOC,

I found a connection

between the nine suspects
and Lomis.

I discovered a malicious script

buried deep in
the nine suspects' phones.

The code exploited
a vulnerability

in the operating system.

Yeah, that's his signature.

A custom code that gains
complete control over the OS

and suffocates the security
features like a boa constrictor.

Means he can do
whatever he wants

with any of the phones...

...steal your identity,

access personal info,

even attach malware.

It doesn't make
sense, though.

I mean, in the past,

Lomis robbed a New
York hedge fund,

the payroll

at San Francisco PD,

even went after
an NHL team.

- Now this?
- You're right. Credit cards

and planes doesn't really fit
his behavioral profile.

It's not what he does.

It's how he does it.

He starts with creating chaos

and it grows
into something bigger.

- That's what this is.
- If Lomis is the one behind

this credit
card heist,

it means that none of our
nine suspects even knew

the suspicious script
was on their phones.

Means Willa Hart and the rest
of the eight passengers

are all victims.

Call the FBI field teams,

have everyone we've
been holding released.

Nelson...
Yes?

Follow the credit card trail.

Look for any purchases
that stand out.

Okay.

Krumitz, check for the code

Lomis placed on the rest of
the victims' cell phones.

We're about to catch
a white whale.

No, that's done.

We alerted
the credit card companies

and it should be
a day or two, and ...

Yeah-- hey, Mike.

Gotta call you back.
Thanks.

Colin, I haven't had a chance
to congratulate you

on your
promotion yet.

Deputy director.
That's-that's big.

Thank you, Simon, but I'm not
here to talk about that.

The director just
called me to ask

why you grounded all Monument
Air flights out of Miami.

I managed to support
your decision,

despite the fact that I
knew nothing about it.

You should have
brought me up to speed.

There was no time
to bring you up to speed.

Cyber crime
moves fast here, Colin.

Regardless, you should have
consulted me first.

Look, I-I've always
had the authority

to kind of run my own division.

Wait, are you... you telling me
the rules have changed?

I'm telling you
I should have been told.

I don't want to lose sleep

worrying if you're gonna
keep me up to speed

on everything I need to know.

I grounded those planes
to save lives

and prevent a possible
national security threat, okay?

I had to make a tough,
split-second decision.

You cost an airline
millions of dollars.

W-What... what is this?

Are you... are you scolding me?

From now on,
you keep me in the loop.

You report to me.

I report to the director.

Understood.

♪ ♪

Yes!

What is it?

This is great.

I've been thinking
about this all wrong.

That doesn't
sound great.

No, it is.

Because I realized
that the code itself

is not going to help us
find Lomis.

I'm still waiting
on the “great” here, bud.

How the code got onto
the phones is the key.

That's a
pairing record.

Yep.
A history of the last device

a phone synced with.

All these phones paired
with the exact same device.

Bingo.

And all the time stamps
are within an hour

before our victims'
flights took off.

That means they picked up
Lomis' malicious script

somewhere in
this terminal.

There's at least
50 different ways

to infect a phone.

Lomis is clever.

He picked a place where he could
install his malicious script

on multiple victims' phones,
all at the same time.

We're looking for
a watering hole.

Maximize the
number of victims,

maximize the
credit card info.

Right there.

They plugged their phone
in to get a charge,

he stole
their data.

No, that charging station

is off the beaten path.

Infrequent traffic.

He would have chosen
a high-traffic station

for his victims.

That's our crime scene.

When someone plugs in
their phone to charge,

their info is being stolen.

This was juice jacking.

All right.

I'll call the airline,

get the passenger manifest
for every flight

that left the terminal
this morning.

We need to find everyone

who's carrying this malware
on their device.

Krumitz, I need you
to clear all the passengers

from this area.

Nelson, start removing
all the malicious

script from everyone's phone.

We need to shut this down now.

FBI!

Everyone unplug.

What? Hey.

My phone is dead.

Hey, don't unplug my phone.

It's dead.

Tell me something, sir.

Have you ever heard
of juice jacking?

No, and I don't care to.

You see
this cord?

It charges your phone, right?

Nice. Safe.

You think it's your friend.

But you see this connector
on the end?

Yeah. It's a USB plug.

Not exactly groundbreaking
stuff, guy.

Hmm.

Maybe this'll impress you.

Most people don't realize
that this cord has four ports.

Two for power,
which charge your phone,

and two for data,
which transfer--

yes,

you guessed it-- your data.

Now, what do
you think your phone

was doing just now, guy?

Charging.

Wrong.

Stealing your data.

You just wanted a charge,

and you had no idea

that a hacker had installed

a juice-jacking
device

that allows him to steal
your credit cards,

your photos, your videos,

everything on your phone.

Now, if you just go get in line

and talk to that

short gentleman
trying to pull off

the purple paisley tie,

he's gonna take
the malicious script

off your phone for you.

Problem solved.

Thank you.

Got it.

Patient zero.

Mm!

I need the north side of
the terminal cleared out.

No one goes
in or out.

This is a crime
scene now.

Excuse me, ma'am? Sir?

I need you to clear the area.

Pardon me, miss.

Ma'am?

The vic's name was
Rachel Carrington,

a grad student
at the University of Miami.

Worked here part time

to put herself through school.
What did she do here?

She was a credit card sales rep
for Monument Air.

She worked at the
charging station,

trying to get
people to sign up

for their new
Peak Miles card.

Local Feds just contacted
her family in Phoenix.

They're flying in now.

Did the coroner
determine the COD?

Preliminary report
is blunt force trauma.

They found traces of blood
in the women's restroom.

They haven't ruled it
a homicide yet,

but there are signs
of a struggle.

Honestly...

it's not
adding up for me.

Hackers aren't murderers.

Neither are robbers,

until something goes wrong

and they become
desperate.

We need to gain access

to the security footage
in the airport.

I'm on it.

Guys!

Guys, wait!
Wait.

Remember when Krumitz said

that Lomis likes
to start off with chaos

and then it grows
into something bigger?

Yeah?

Well, it just happened.

I was removing the malicious
script from the phone

and suddenly I got locked out.

Look at this.

“Hi, Chelsea.

“You're phone's been hijacked.

“What would
your fiancé Joey think

“if he saw you being
a dirty slut?

“Reply with a 14-digit
prepaid cash voucher

“for $250 in the next 24 hours,

this goes away.”

This is ransomware.

Krumitz said

the malicious script
is a custom code

that strangles
the operating system

and allows Lomis complete
control over all the phones.

Lomis just stepped up his game.

Now he's holding
the phones hostage.

We stopped his payday;
now he's retaliating.

Nelson, I need you

to get back to D.C.
Stay on top of

the stolen credit cards

and crack that ransomware.

Done. Um...

Is there gonna be
peanuts and pretzels

on the Coast Guard chopper?

Is this some kind of sick joke?
No.

It's completely frozen.

Someone put ransomware on it.

You mean

by charging my phone,
all this happened?

Yes.

A hacker took control of
your phone and locked you out

until you pay the amount
that he's demanding.

He has personal information.

He knows my fiancé's name.

Not only did he lock you out,

he accessed your personal data--

your messages,
phone calls, pictures.

What is he going to do with it?

Well, he's threatening
to release it

if you don't pay.

What did he find on that phone

you don't want
your fiancé to see?

Am I really expected to pay

$250,000 to
unlock my phone?

Senator, we don't suggest
you pay this ransom.

And when I don't?

Any number of
things can happen.

Could you try to be
a little more specific?

All right. As that text
you received threatens,

he will post all of
your personal information

on the Internet.

I just flew back

from a family trip to Miami

and simply charged my phone,

and now this happens?

What action are you taking?

We're working
some promising leads.

We've...

Really, gentlemen?

Really?

Our government
appropriates

a lot of money to
the Cyber Division,

and “promising leads”?

Is that the best you can do?

These things take time.

Time is not something I have.

19 hours from now,

the highly sensitive
government material

on this phone goes public.

Senator, look,
all due respect...

I mean, you know better
than to keep

sensitive government documents
on a personal phone, so...

what exactly
are you worried about?

I have telephone numbers

and information of high-profile

colleagues
and friends.

I have photos of my husband
and my children on this phone.

Clearly, there's something else
on that phone

you don't want getting out.

You don't understand.

It can't get out.

What I have on this phone
is very personal.

It could ruin my career.

Senator, he's already got
what's on your phone.

So, what?

What, I cross my fingers
and hope for the best?

We are doing everything we can

to identify
and arrest the target.

You just don't get it.

People I care about
will be hurt.

I found something--
take a look at this.

Rachel Carrington helps this
sick woman to the bathroom.

And that's when
our juice jackers swoop in.

The sick woman was a
distraction to get Rachel away

from the charging bar.
Exactly.

Our juice jackers
have about a minute

to install their black box
before our sick lady returns.

Miraculously,

she doesn't look
so sick anymore.

Wait, stop.

Rewind that.

Do you have a camera angle from
the direction they're heading?

No, there's
a blind spot

between gates 213
and 214.

That's where the
bathrooms are, isn't it?

Yeah.

And where the airport police
reported finding blood.

So these three people
were working together.

The sick woman killed
Rachel Carrington.

Yeah, but the problem is--
how do we identify them?

Look at that.

This footage,
it's way too grainy.

That's a dead end.

Well, maybe not.

The black box
that they installed

had to get
through security, right?

Take a snapshot of that duffel.

To get that juice-jacking
device in the terminal,

somebody had to get it
through security.

Most people don't know
that TSA keeps

all X ray photos
for a week.

We can run our
duffel's snapshot

against all the images
in the TSA archives.

And based on the size, shape
and material of the device,

we should be able to figure out
when this came through.

Check all the bags
that went through security

two hours before the jackers
were spotted on surveillance.

Okay, we got it.

All right, hold on.

Even if we can get a visual
on who came in with it,

chances are pretty good
they used a fake I.D.

Well, that doesn't mean
we can't find them.

You can learn a lot
about somebody

by examining the contents
of their bag.

Krumitz, remove everything
that's blue.

It's metal like
our juice-jacking device.

Now, separate the
materials by colors.

We're looking for anything
plastic or biological.

Take away the biomaterials
in orange.

Focus on the
plastics in green.

Right there.

Do you see
that wizard hat?

That's the Warlocks.

The hacker collective.

Yeah.

Yeah, their symbol's
a wizard hat.

That's their badge.

It's like an all-access pass for
proving their gang affiliation.

That's Lomis' crew,
our juice jackers.

Krumitz, search all bags before
and after this image

for the same shape.

There. There's
two more badges.

That proves
that the two juice jackers

and the sick woman
are all involved.

All right, that's great,
but how do we find them?

Hacker collectives hide
themselves all around the world.

I mean, they could be anywhere.

My boy Nelson
coming through.

He just came up with a traceable
hit on the credit cards.

All right, looks like most
of the purchases were made

at brick and
mortar spots,

like high-end department stores
and electronic retailers.

You got computers,
laptops, handbags.

Goods that can easily
be sold for quick cash.

Yeah, except that Nelson just
found an odd online purchase.

No, that's
a server blade.

That is not something
you can buy

at your local
electronics store.

But I'm willing
to bet that's something

a hacker collective
is gonna want.

Big online purchase
with a stolen credit card?

Easily traceable?

That's a little sloppy
for Lomis, don't you think?

No, but we stopped
his payday.

He's scrambling, I mean,
that's when you make mistakes.

His mistake is our gain.

The clock is ticking--
we've got 14 hours left.

That purchase is gonna be linked
to an address-- find it.

FBI!

FBI!

Hands in the air!
Hands in the air!

On the ground now!

Get down! On the ground now!

Get on the floor!

Heads down!

He went out the back door.

FBI, freeze!

Crap!

I really thought
Lomis would be here.

We found traces of blood
underneath your fingernail.

DNA matched
Rachel Carrington.

You killed her.

No.

No, it was
an accident.

I was just supposed
to distract her.

Glad you're feeling better.

I really have to be
heading back, though.

Uh, wait.

Wh...
What are you...?

Once you realized she was dead,

you went back to your partners.

She was still breathing
when we left her.

I thought for sure someone
would find her immediately.

You made it look
like she was sleeping

so you could buy enough time
to escape the crime scene.

No, I wanted to tell someone.

But they wouldn't let me.

They were scared of
what he would do to us.

Of what who
would do to you?

Lomis? You said
you'd never met him?

Online, man.

Where reputations matter.

He could destroy us.

He could ruin
our cred.

You know
what I can do?

Put you in jail
for the next 25 years.

Who's collecting
the phone-ransom money?

I didn't know about the phones
being ransomed, I swear.

He hired us

to install the box
and clone the cards

and buy the goods, that's it.

Oh, come on,
there was a server blade.

What do you think
that was for?

That server blade?

We didn't buy it.

Lomis did.

He sent it to us.

He set us up to take the fall.

You expect me to believe that?

He didn't even show up...

To collect his share
of the take.

Who passes up
on that much money?

I don't believe them.

They know where Lomis is,
they have to.

No, they don't,
Krumitz.

They've never met him.

Which is why your white
whale never gets caught.

What is that?

Lomis is taunting me.

He knew I'd find the
juice-jacking device,

and he overrode the data with
“Gotcha!” a bajillion times.

All right, well,
if he overwrote the data,

there's no way to retrieve
what was there before.

Hence “Gotcha!”

Those the shredded phones?

Get on the floor!

Yep.

I figured they tried to destroy 'em
because there's something on them

they don't want me to find.

I'm recovering all of
the salvageable pieces.

Anything?

No. Not yet.

Okay. I got your time stamp.

Come on.

Come on, come on,
come on, come on.

Yes!

Did you just get his serial number?
Yep.

I got you now, Lomis.

I'm gonna track
this serial number

right down
to your evil lair.

You got to be kidding me.
It's untraceable.

Damn it!

When was the last time
you slept?

Listen, man, I know
it's hard, all right?

I do. Believe me. All right,
I ever tell you about the...

the sleeper cell I
tracked in Kandahar?

117 degrees.

Dry heat.

It was the kind that-that chaps
the inside of your mouth.

All right,
between the four of us,

we had half a canteen
of water left.

We had been there for three days
because I was obsessed.

I knew if I stayed on 'em,
if I persevered,

I'd find 'em.

I was wrong.

So you just quit?

You gave up?

No.

There's a big difference
between quitting

and just knowing
when it's not your day.

We need you in CTOC.

When you're ready.

Did you catch them?

What do you think?

I had to wait
a month, but...

believe me, it was worth it.

Okay, we only have two hours

before our victims' private
data is released on the Web.

How close are we
to... anything?

The code's sophisticated.

We're getting there,
but it's gonna take time.

Against orders, some people
paid the ransom already.

Hey, guys, we got a problem.

What is it?

Lomis isn't waiting
for the deadline.

He's releasing
people's information right now.

And he started with
the most powerful person first.

I thought
the senator already paid.

Yeah, I thought
she did, too.

Well, this will be the headline
on every national newscast.

Got another one.

Chelsea's photos were released

to a revenge porn site.

Lomis isn't
playing by the rules,

which makes him very dangerous.

Guys! Guys!

I did it.

I finally found Lomis.
I got an I.D.

How'd you find him?

Just like you said--
go back to the evidence.

So I took another look
at the juice-jacking box.

Lomis made it impossible to
recover any data off that thing.

You're right.

Except for one thing: time.

I know what time Lomis
overwrote the data.

It was four hours before we even
found the box at the airport.

That's around the time
the first flights were taking off.

He had to plug directly
into the charging station

to steal everyone's data.

Lomis was there, in person.

Yeah-- I pulled the
airport security footage

four hours before
we arrived.

Say hello to Lomis.

Okay, your point?

I mean,
this doesn't prove anything.

Yeah, well, it's about
to prove everything.

I don't even know
what you're showing me.

Mr. Hart, we know the truth.

I'm telling you,
you've got it wrong.

We have evidence...
No!

I mean, Willa is
a straight-A student.

She plays soccer,
dance lessons, violin...

Yeah...

and she also took first place
in the Miami-Dade County

high school chess
tournament.

We get it--
she's a genius

and you're a proud father.

This is insane.

All right, Willa's
not a hacker.

And she's a good kid.

Maybe she is.

But maybe she's not.

I have a warrant
for her tablet.

If it's clean,
she's innocent.

And exactly the daughter
you believe her to be.

Why would
she do this?

Dad, whose car is that
in the driveway?

Belongs to the
Federal Bureau of Investigation.

Hello, Lomis.

It's nice to meet you.

I've been waiting
a long time for this.

Gotcha.

Everything about you
is unexpected.

We bought your disguise.

We actually
thought you were

a 35-year-old man
from Eastern Europe.

Very clever.
You went through all the trouble

of stealing
credit card information

and never collected your take.

You were the mastermind
behind the whole plan.

Stole all those credit card
numbers but never met up

with your accomplices
to get paid.

But, then again, you couldn't.

A 16-year-old girl
couldn't show up

at a hacker's house to collect.

You would've blown
your cover.

So then you ransomed
all the phones,

and we thought you were
gonna get paid that way.

But then you began releasing
the ransomed data anyway.

Senator Finnis
tried to pay you.

But, to our surprise,
you denied payment.

Because it wasn't
about the money.

I have to know.

What was this about? Why

did you do it?

Did you even

think about
the consequences?

Senator Finnis,
Michael Young,

Victoria Fields,

Simone Taylor-- you ruined
their lives today.

Look, this
isn't a joke,

Willa. Tell us why.

Why did you do it?

Because I wanted to.

I was bored.
I did it because I could.

You saw this, right?

Oh, yeah.

It's a shame.

The senator's husband
and children learning her

sexual preference from the
front page of a paper, it's...

Yeah, well,
privacy is a myth.

Personal info is
the new commodity.

I, uh... I understand
three other people

had their information released.

Well, Lomis had access
to 300 phones

and whatever was on them.

We got her.

I mean, we confiscated
all of her devices.

She had plenty of time
to make copies

and distribute them to anyone.

And what they do with it...

only time will tell.

What's this?

That's me keeping
you in the loop.

I-I still can't believe
that she's just a teenager.

So, Colin...
Yeah.

Can I be honest
with you?

I was a little pissed off
I didn't get that promotion.

I was.

I just felt I was

the best man
for the job.

So did I.

I mean-- think that I was
the best man for the job.

Look, I'll-I'll
admit it--

there's not a whole lot
that I know

about what you
and your people do.

That's not an enviable position.
You're not gonna

try and hug me now, are you?

No. In fact, my job
practically guarantees

I am gonna be a constant

pain in your ass.

But listen, I'm the least
of your worries.

Tomorrow's criminal.

That is who you're
gonna lose sleep over.

Good night.

Good night.

What's that?

Postcard.

From Lomis?

Sent the moment the prosecutor
released her from custody.

It's not fair.

She gets to walk
because

she happens to be 16,
but she is a criminal.

But she's a cyber criminal.

And we both know that
sentencing guidelines

make it very difficult
to prosecute

if they're under 21.

It's like we're
encouraging kids

to become black hats.

Well, maybe one day
that law will change.

But today...

you need to be very grateful
that we couldn't

prosecute.
Now, did you

intend to break the law
or was that accidental?

'Cause I really want to believe

you had no idea that what
you were doing was illegal.

I know you paid off
the ransomed phone via text.

And with that payment you
bundled a Remote Access Trojan.

That's illegal.

You took control
of Lomis' desktop computer

and you snapped a picture.

Guys. Guys.

I did it.

I finally found Lomis.
I got an I.D.

How'd you know?

You told me.

And she also took first place

in the Miami-Dade County
high school chess

tournament. We get it--
she's a genius

and you're a proud father.

You couldn't know
she was a chess champion

unless you were
in her bedroom,

and I knew
that you weren't. So I

accessed your Bureau files
and I found that photo.

Without my
authorization

and a judge's
subpoena,

you broke the law
when you took that photo.

It was a digital search
without a warrant.

I couldn't let Lomis win again.

And I know
this sounds insane,

but I...

I needed to justify your
decision to hire me.

Your belief in me.

I started at the FBI
pushing a mail cart.

And I would've been there
forever, but you found me.

I hadn't been
in CTOC ten minutes

before I realized
how dedicated you were.

And watching you

love your job

made me love my job.

And made me never
want to let you down.

I didn't know what else to do.

That is no excuse.

What if Lomis
was a 35-year-old man?

I know. He would have walked.

And I would've been
forced to turn you in.

Today's your lucky day.

Your mistake is not
sending you to prison.

It's dying here with me.

But I want you
to think about something.

Does victory
really taste so sweet

when you haven't
earned it honestly?

== sync, corrected by elderman ==
@elder_man