CSI: Cyber (2015–2016): Season 2, Episode 12 - Going Viral - full transcript
An airborne computer virus is infecting cell phones and the team must find the hacker responsible, while D.B. meets a woman who sent him a text by mistake.
(whistling)
(classical music playing)
♪ ♪
♪ ♪
MALE OPERATOR:
911. What is your emergency?
MAN:
I just witnessed a hit and run.
FEMALE OPERATOR:
911. What is your emergency?
WOMAN: My apartment
building's on fire.
There are people still inside!
FEMALE OPERATOR:
911. What's your emergency?
CHILD:
How many people...
WOMAN:
I hear screams!
MALE OPERATOR:
911. What is your emergency?
I need to get to a hospital.
I'm five months pregnant.
I'm feeling sharp,
stabbing pains.
(gasping)
It's too soon for contractions.
I'm at 249 West McCoy Street.
Hello? Hello?
MALE OPERATOR:
911. What is your emergency?
I need help.
I need an ambulance.
I think my wife is
having a heart attack.
She's collapsed.
What-what do I do?
Hello?
Are you-- are you there?
Hello! Help!
Honey, sweetheart, stay with me.
Hold on, sweetheart, hold on.
Hello? Hello?
Hello? Hello?
Someone help, please!
I need help!
Help! Help!
MALE OPERATOR:
911. What is your emergency?
We need an ambulance.
A man's fallen
from a scaffolding,
but we can't tell if he's alive.
There's blood everywhere
and he isn't moving.
Hello? Can you hear me?
Are you there?
Are you there?
Hello, hello?
Sweeney, hold on.
Can you hear me?
Hello?
It's coming down!
Watch out! Look out!
(shouting)
Go, go!
Something's wrong with my phone!
Someone call 911!
MALE OPERATOR 2:
This is 911.
What is your emergency?
FEMALE OPERATOR:
911. What's your emergency?
What is your emergency?
We've been flooded with reports
of people having issues
calling 911 from cell phones.
They say they connect
to an operator, but then
the call drops off
and their phone
freezes in call mode.
What makes you think
that this is a cyber intrusion
and not a malfunction
of the New York City 911 system?
Well, we've checked
and double-checked.
There's no evidence
of a mechanical malfunction.
Our IT guys believe
it's a hack within our system
that affects
incoming cell phone calls.
Anyone who places a call
from a land line
doesn't experience the problem.
Have you ruled out issues
with cell service providers?
They've all confirmed
that cell towers in the city
are properly functioning
and all other wireless
phone traffic is normal.
So it only happens
when someone calls 911?
When someone calls 911
from a cell phone.
Not getting help
when you want it?
That's terrifying.
RYAN: The mayor and
Homeland Security are concerned
that this could be
a well-crafted precursor
to a terrorist attack.
Raven says the first reports
of dropped 911 calls
came in around
7:00 a.m. this morning.
Complaints were made
to local precincts
and cell service providers.
My operators noticed
a decrease in call volume
about the same time.
But none have reported
being abruptly disconnected
or dropped from a call.
OPERATOR:
Excuse me, Clayton?
Sorry. Will you
excuse me a moment?
RAVEN: According to my stats, there's
definitely something going on.
Well, I've compared
the number of 911 calls
from yesterday at this hour
to those received this morning.
Huge decrease
in cell phone calls.
On a typical day,
the call center
would get 24,000 calls,
70% from cell phones.
And this morning,
cellular calls went down to 30%.
RUSSELL: So there are
some cell phones out there
that are connecting to 911
and completing the call.
Right?
Yeah, but the strange thing is,
is that most
of the calls are made
from devices outside
of Manhattan, in the Boroughs.
KRUMITZ: We plugged
into the 911 system.
No evidence of malfunctions
or indicators of compromise.
Yeah, no known vulnerability,
no malware,
not a trace of digital dust
that indicates a hack.
I mean, these boxes
are squeaky clean.
So there's nothing here that
can tell us what's going on.
Okay, so that means
the problem has to be
internal to the cell phones.
They're all different
models and brands,
in different locations
all over the city.
Not to mention
that they all have
different service providers.
Other than them being
cell phones, I mean,
they have no connection
to each other.
RUSSELL:
Yeah, except they all
dropped 911 calls, right?
We need to get ahold
of one of those phones.
I might be able
to help with you that.
I have the latest
incident reports.
There was an accident
at a construction site
not far from here.
The foreman called
for paramedics.
Same thing happened.
Dropped call.
There's a possibility
we can get that phone.
♪ ♪
FOREMAN:
Yeah, that's my cell number
and I'm the site foreman.
I called 911 when
the scaffolding collapsed.
Sweeney dropped
from the third floor.
And there were two others
who also dialed 911?
Yeah, Henderson and Joe Lavelle.
Just like me,
they reached the operator,
and then the phones froze
and nobody was on the other end.
Is there a way
to get in touch with them?
I'd like to take a look
at their devices.
Yeah, I can, uh,
I can get you
their home number.
This is crazy.
That kid was only
20 years old.
Bled to death because I couldn't
get the paramedics here in time.
And now, two more of my guys
are in the hospital
in critical condition.
I hope you can figure this out.
You know,
on jobs like this,
something happens every day
on these sites.
I need to know that my guys
can get help when they need it.
Excuse me.
(indistinct chatter)
NELSON: Eric O'Brian's phone
is infected with malware.
I mean, it's gonna take time
to reverse-engineer the code
and figure out exactly
what it does to a cell.
Nah, forget the code.
I cloned his device
to a known-good test phone.
Let's just call 911
and see what happens.
All right.
MALE OPERATOR:
911. What is your emergency?
My name is
Daniel Krumitz.
I'm an agent
with the FBI.
Operator, if you
wouldn't mind
standing up and
waving for me?
911. What is
your emergency?
How 'bout counting to ten?
Hello? You there?
Nope. Okay.
Already gone.
That lasted about
three seconds.
Hey, look, maybe he thought you
were a prank caller and hung up.
You know, you don't exactly
sound like an FBI agent.
An operator isn't gonna
hang up that quickly.
They're required to make sure
there's no real emergency,
regardless of what
the caller says.
So maybe you didn't reach
an operator at all.
Remember, operators haven't been
reporting dropped calls,
only people dialing
in on cell phones have.
Hmm.
This test phone's
still active.
It's frozen;
I'm locked out.
That's the hacker's plan.
When you attempt
to dial 911,
you won't get a chance
to do it again.
Or use a cell at all.
It'll force you to find
a land line or a pay phone.
A pay phone?
And who uses
a land line anymore?
Yeah.
I don't even have one in my apartment.
I don't have one, either.
Oh, look.
Krummy, check this, right?
I got a timestamp
indicating the moment
the malware infected
Eric O'Brian's phone, right?
And just seconds
before that,
his cell phone connected
to a Wi-Fi network.
So that router
could be
the source of the infection.
Mm-hmm.
You got a location?
Yeah.
Two seconds.
And... tah-dah.
All right, I got it.
I'm driving.
Let's go.
What exactly does
an FBI agent sound like?
Smooth, Krummy. Sturdy.
Gotta sound like you just
finished the Ironman.
I'm out of breath?
No, man.
You gotta be tough.
You know, like a...
like a bad-ass.
(tough voice):
Daniel Krumitz, FBI.
(deeper voice):
Dan... Daniel Krumitz, FBI.
(indistinct chatter)
The router that Eric's phone
connected to isn't here.
MUNDO: You're sure you got
the right location?
NELSON: I'm positive.
Well, maybe our hacker
removed the device.
Wanted it to remain undetected.
Wait, wait, guys,
it just showed up.
And... now it's gone.
That means it's moving.
Wait, guys,
it's back up again.
Signal's getting stronger.
Real strong.
WOMAN: Is it coming?
WOMAN 2:
Oh, thank you.
That's it, right there.
That's why the signal's moving.
Free Wi-Fi. Stop that bus!
I'll call Avery and D.B.!
Let's see what's
on the bus's router.
Okay, same malware on
Eric O'Brian's phone.
But... that's not
the interesting part.
Nelson.
No. Uh-uh.
It... it can't be.
I know, right?
But it is, though, look.
Guys, guys.
Hey, hey. Can we use words
that actually mean something?
(laughs)
KRUMITZ:
It's like this, okay?
I have the flu. I sneeze.
If you're close enough to me,
you get the flu.
That's what this is.
It's an airborne computer virus.
It... it lives.
What do you mean,
“it lives,” Krumitz?
NELSON:
It was programmed to spread
like a real virus.
It jumps from unsecured router
to unsecured router
within 150 feet.
So it infects
any wireless access point
that's not password protected?
And even the ones that use
a default password
from the manufacturer.
So this bus has been, like,
“sneezing” all over town.
Every unsecured router
in its path has been infected?
KRUMITZ: And whenever
a Wi-Fi enabled phone connects
to one of these infected
routers, it gets the virus.
Malware automatically
jumps onto it.
RYAN:
It's contagious.
I've never seen anything
in the wild
like this before.
Can the virus jump
from phone to phone?
No.
Phones can only
get the virus
if they're connected to
one of the infected routers.
Well, at least these buses
stay on the same route, right?
It'll help us
contain the infection.
RYAN: But ultimately,
all the buses
go back to home base.
And then this infection jumps
from bus router to bus router.
And then bright
and early this morning,
all those buses went right back
into the streets of Manhattan.
Increasing the number of people
who won't get any help
when they call 911.
This is an outbreak.
We're looking
at an epidemic.
We need to find patient zero.
♪ CSI Cyber 2x12 ♪
Going Viral
Original Air Date on January 31, 2016
♪ I know you've deceived me,
now here's a surprise ♪
♪ I know that you have, 'cause
there's magic in my eyes ♪
♪ I can see
for miles and miles ♪
♪ I can see for miles
and miles ♪
♪ I can see
for miles and miles ♪
♪ And miles... ♪
♪ Oh, yeah. ♪
(indistinct chattering)
The infected area has grown
by 25% in the past two hours.
I've notified Port Authority
and service providers.
All public routers
are being disconnected
from buses and ferries.
Have FBI communications
get in touch
with all of the New Jersey,
Connecticut,
Philadelphia news media outlets.
Make sure they're
getting the word out
that commuters should
turn off their Wi-Fi
and not try to connect
to any free or open
Wi-Fi sources.
And remind them: use their
landlines when calling 911.
This virus will definitely
cross state lines
unless we're overly cautious.
Yep, a virus warning is already
spreading through social media,
and there's been a big surge
in purchases
of old-school telephones.
You're finally in style, D.B.
(chuckles)
Thanks very much.
Oh, hey, hold on a second.
Little, uh, social protocol.
Let's say you get a text
clearly meant for somebody else,
sent by someone you don't know.
Now, are you supposed
to, uh, text 'em right back
and say they got
the wrong person?
Kind of sounds like
a personal text then.
Well, yeah, kind of.
Wh-Why would you
just assume that?
'Cause if it was something like
“I'm gonna be late”
or “Call me,”
then it's easy to text back.
You wouldn't give it
a second thought.
But if suddenly
you get dropped
into the middle
of someone else's drama...
What did the text say?
Well, uh, none of your business.
(gasps)
You answered my question.
I'll see you later.
Come on, D.B.
It's got to be
pretty juicy, huh?
We'll talk about it
when I get back to DC.
D.B., you can't just...
(scoffs)
Mayor Cavanaugh,
there's no evidence
to suggest that the 911 hack
is a terrorist threat.
Well, that's a relief.
Do you know who's behind it?
We have a profile of
who we're looking for.
They're not part of a
politically motivated
group or collective.
They would have already
claimed responsibility by now.
Our target is an individual
who's celebrating his
power to cripple the city.
He enjoys making people
feel desperate, helpless.
There's a chance that he's tried
something like this in the past
on a smaller scale.
But this virus is an escalation.
He?
It's most likely a man.
Women go about things like this
in a less conspicuous way.
I was told you have a plan.
The malware is mimicking
a biicalirus,
so we're using CDC protocol.
We've identified how
it's transmitted,
we've begun the containment,
we're informing the public.
My team is writing code,
an antidote,
that will cure all
the infected phones
and stop any new phones
from acquiring it.
You are, Deputy Director Ryan,
as impressive as I was told.
Which makes my next request
a little uncomfortable.
(sighs)
Brody Nelson.
He's one of my
cyber investigators.
He's also the young man
that hacked into
the New York Stock Exchange,
created havoc
in the financial district.
And I understand
that that tarnished
your first term
in the mayor's office.
This is not about me.
I am well aware
of Brody Nelson's crimes.
He is serving his time.
I would prefer he were in prison
and not writing code
for anything having
to do with my city.
Well, that is not
your call, sir.
Did you know that
eight-million-dollar transfer
as a result of his financial
hack was never accounted for?
That young man knows
where it is.
The mayor's just bent out of
shape because their election's
coming up.
(sighs)
I did a terrible thing, D.B.
Can't expect people to forget.
You know what?
I'm just gonna
image these devices
and go back to DC with you.
It'll be easier
for me to analyze
the malware from Tear Down
and work on the antidote.
Okay.
All right?
Let me make this clear.
I don't want Brody Nelson
working this case.
If Brody Nelson doesn't work on
this case, then neither do I.
So you let me know.
REPORTER: The FBI has informed
us of a malware virus
affecting the 911 emergency system.
...Wi-Fi has been discontinued.
We ask that you use
a landline for all...
OPERATOR:
911, what's your emergency?
This is an emergency.
Excuse me, I need to make...
What you got?
I've infected these test phones
with the virus.
It lies dormant
until you dial 911,
and this is what you hear.
MALE VOICE: 911.
What is your emergency?
Hello. Hello.
No one there.
That's because there was
never anyone there.
It's a recorded voice.
There's an audio file
hard-coded into the virus.
Now, these phone calls
never make it
to an actual 911 operator.
Just a recorded voice.
The hacker hijacked 911
and made the caller believe
they were getting through.
Mm-hmm, and not only that.
Check this out.
(hums)
MALE VOICE: 911.
What is your emergency?
Say something.
Keep talking.
Hello, this is D.B. Russell.
Testing, one, two, three.
The phone is not frozen, it's
recording everything I'm saying.
Right.
All right, so our
target is a man
who... who gets
off on hearing
the fear and the panic
of helpless people.
He's recording the callers and
sending the audio... somewhere.
And we don't know where?
Nope.
The files are bouncing
through proxy IPs.
It's a dead end.
(classical music plays)
MALE VOICE: 911.
What is your emergency?
WOMAN: Please help, someone
just broke into my house.
He's strangling my husband.
I'm hiding in the closet.
Oh... oh, God. He's...
MALE VOICE:
Try to stay calm, ma'am.
I'm showing your address
is 754 Plymouth Way.
Is that correct?
WOMAN:
Yes, please hurry.
I-I can hear him in the kitchen.
(crying):
I think my husband's dead.
MALE VOICE:
Help is on the way.
WOMAN: Please hurry.
Where are you?
Am I right or am I right?
The voice of the 911 operator
embedded in the malware
sounds like a long-lost
relative of T-Pain.
Who Pain?
RAMIREZ: T-Pain.
He's the king of auto-tune.
Yeah.
And that is again?
It's, like,
when a recording artist
alters the pitch of their voice
when they sing off-key.
Or when they suck.
Well, if that's true and
the voice was distorted,
then we should be able
to un-distort it.
I just made that word up. All
right, let's get to work here.
Play it again, Nelson.
All right.
MALE VOICE (slowly): 911.
What is your emer...
Okay, Raven, isolate
one of the ringing phones
in the background there.
And pull up the ringtone used
by the 911 call center.
That'll be our baseline.
Right, once we match
the ringtones,
we'll have the real voice
of our 911 operator.
Exactly.
Okay, I am adjusting
the pitch and speed
of the recording
until the waveforms line up.
MALE VOICE: 911.
What is your emergency?
Okay, here we have our real
911 operator's voice.
MALE VOICE: 911.
What is your emergency?
Why would our target want
to distort this voice?
To disguise it.
This could be him.
Right? Our target.
I mean, why else would he do it?
You think he works
at a call center.
I don't know,
it's just a theory.
Let's run this voice
against all
of the male dispatchers
in the New York City
call center database.
All right?
Maybe we'll get lucky here,
get an I.D.
NELSON:
Got him.
RYAN:
Leo Finch.
Look at his profile.
He was fired from the call
center exactly a year ago today.
Well, that's motive for revenge.
Let's see, he was fired for...
“failure to properly
dispatch emergency units”"
“poor decision making”"
“refusal to follow protocol”"
Also looks like there
were several instances
of slow dispatch times
and sending paramedics
to the wrong address.
Delayed dispatch times suggests
he wanted to keep
the panicked callers on the line
as long as possible.
He enjoyed hearing
their desperation.
Their pleading made him feel
powerful and in control.
Leo is an auditory voyeur.
Well, that's twisted.
Call Elijah.
Tell him there's a door
he has to kick down.
Clear!
Clear!
Clear!
All clear!
Clear!
MUNDO: Victims are
Mary and Roger Ingram. (sighs)
Ligature marks around the neck
and petechial hemorrhaging in
the eyes suggest strangulation.
We have a time of death?
MUNDO: According to
the on-site coroner report,
body temp puts TOD
somewhere between 5:00
and 7:00 a.m. this morning.
Any signs of forced entry?
No.
And nothing to suggest
that Leo Finch lives here.
Police are canvassing
the area right now,
seeing if anybody
recognizes Leo's photo.
MAN:
Agent Mundo.
KRUMITZ: Looks like Mary
tried to call for help.
She's still clenching
this phone.
Cadaveric spasm.
It occurs in violent,
intense deaths.
That's why her hand is
clenched around the phone.
Battery's dead.
See if it has the virus.
Malware is exactly the same
as all the others.
According to the call log, Mary
tried to call 911 at 6:23 a.m.
Please hurry,
he's strangling my husband.
I think he killed him.
I can hear him coming.
Hello, is anyone there?
Hello?
Hello?
(screams)
MUNDO:
Avery.
There's a basement apartment.
This is an odd setup.
Cheap furniture,
egg carton acoustics,
but very expensive speakers.
Found a laptop.
This is a Benning.
Leo has a $50,000 violin
and lives in a cheap rental?
It's funny--
some of the best coders
are talented musicians.
Both highly technical,
deal with complex numbers.
Clearly, Leo's obsession
was sound.
KRUMITZ:
I'm imaging Leo's computer.
He's over 200 audio files
on his hard drive.
They're all 911 calls,
and he's the operator.
RYAN:
Leo is an addict.
The 911 calls are his drug.
It's like an arsonist
getting a job as a firefighter
or a pedophile
who becomes a teacher.
Leo got his fix
at work.
Until he was fired a year ago,
and he was cut off from his drug
and had to find a new way
to feed his addiction.
The virus.
Whoa, Krumitz, get-- come here.
Is this what I think it is?
That could be
the original source code
for the virus.
Okay, we've got something.
This computer connected
to 26 bus routers
at Port Authority
at 11:00 p.m. last night.
That's 26 patient zeros.
This is not
an experiment gone wrong.
This was a calculated attack.
No, Leo wanted to infect
every corner of the city,
and he wanted to do it fast.
RAMIREZ: 61 confirmed cases
in New Jersey.
38 in Connecticut.
And 23 in Upstate New York.
Even with the news
alerts and warnings,
the virus has officially
spread through the
tristate area.
Well, the good news is the
infection rate should slow down
in the less densely
populated areas.
Bad news?
A complete quarantine
looks impossible.
And local precincts are overrun
with emergency calls
and hospitals are
flooded with walk-ins.
Some people are resorting
to social media
to announce
their emergencies.
Nelson,
we need that antidote.
How's it going?
Krummy sent me
the source code of the virus
from Leo Finch's laptop.
Now that I can see exactly
how the virus is written,
it shouldn't take long to write
a code to counteract it.
But the problem is
how to push it to all
the phones that need it.
Yeah, a software update through
the vendors will take days.
Mm-hmm.
Wait a minute.
What about using something
like the AMBER Alert, right?
It sends
push notifications to phones
during child abductions.
It's instant, it's regional.
What do you think?
I mean, AMBER Alerts
are only designed
to display alphanumeric text.
You can't use them
to push code.
And there are regulations.
I mean, FTC, DOJ, FEMA.
Right.
Wait, wait, wait.
Are you saying it's impossible?
I'm saying it's never been done before.
Right.
Well, there's a first
time for everything.
You-you two were black
hats, weren't you?
The best.
Notorious.
Okay, so you'll
hack it, right?
And I'll take full
responsibility.
Matter of fact, I will call
Director Silver right now.
Work on the FCC,
DOJ part of this thing.
All right, man said
hack, let's hack.
Look at this.
A pair of pliers,
some kind of metal pins
and a bloody violin string.
I think we may be looking
at the murder weapon.
(screaming)
(both grunting)
All right, well,
whatever Leo's endgame is,
if he left two bodies upstairs
and a murder weapon in the wall,
it's a pretty safe bet
he's not coming back here
anytime soon.
Guys, look at this.
It looks like these three 911
recordings were Leo's favorites.
They were played
over a thousand times.
And he even put them
on a separate playlist.
Here, listen to this.
FINCH:
911, what's your emergency?
MAN: My buddy, he fell!
It's bad; it's-it's real bad!
We need an ambulance!
Sir, what's your location?
MAN: Construction site
at Lexington and 12th!
I don't think he's conscious.
FINCH:
I'm dispatching paramedics now.
Calm down and describe
what you see.
MAN:
There's a lot of blood!
He must've fallen 50 or 60 feet
or something-- please hurry!
There's blood all over his head!
I'm pretty sure
his legs are broken.
FINCH: All right,
be careful not to move him.
Help is on the way.
Is this from today?
Uh, no.
According to the metadata,
this recording's
from two years ago.
But what's strange is that it
happened at the same time of day
as the construction
incident.
Scaffolding pins.
There's traces of paint and rust
in the grooves of the pliers.
What happened at that
construction site this morning
was no accident.
MAN: All right,
what do we got?
(creaking)
Help! Help!
Play the next one.
FINCH:
911, what's your emergency?
WOMAN:
Please help.
Someone just broke
into my house.
He's strangling my husband.
I'm hiding in a closet.
FINCH:
Try to stay calm, ma'am.
I'm showing your address
as 754 Plymouth Way.
Is that correct?
WOMAN:
Yes, please hurry!
I can hear him in the kitchen.
Oh! I think my husband's dead.
FINCH:
Help is on the way.
WOMAN:
Why is this taking so long?
Why is no one coming?
This is very similar
to the scene upstairs.
This is exactly what happened
to Mary and Roger Ingram.
This is also
another old recording
and it happened
at the same time
as the murders
this morning, 6:23 a.m.
Listening is
a deeply immersive experience.
FINCH:
Sir, what's your location?
MAN: Construction site
at Lexington...
RYAN: Every time Leo listen
to one of these recordings,
he envisioned himself
in the scene.
We need an ambulance.
RYAN: First, he's a witness.
...can't tell if he's alive.
There's blood everywhere
and he's not moving.
RYAN: Then he's the victim.
Please help.
Someone just broke
into my house.
He's strangling my husband.
(creaks)
RYAN:
Now, Leo's the killer.
(woman gasps)
No.
No, no!
He's recreating
his greatest hits.
(woman screams)
KRUMITZ: Yeah, but what does the virus
have to do with all this?
And why today?
RYAN:
It's the anniversary
of the day he was fired.
Look, Leo is a sadist
who's aroused
by the sound of fear.
The virus does
everything that he needs.
The dropped calls delay
the emergency responders,
which maximizes
the victims' panic.
Leo records the calls
so he can enjoy them later.
It's his version
of a serial killer
taking a trophy.
Krumitz, didn't
you say there were
three recordings
on that playlist?
FINCH:
911, what's your emergency?
BOY:
Help! He's stabbing him.
He's stabbing my dad!
FINCH:
What's your name? Where are you?
BOY: Dylan.
And I don't know where I am.
We just... we left the game.
It's an alley.
FINCH:
Help is on the way.
BOY:
The man just left!
I'm scared.
FINCH:
It's okay, Dylan.
I need you to go to your dad
Tell me what you see.
BOY: He's not moving!
(whimpering)
Leo mimicked the first two
recordings on the playlist.
And this recording
is of a man being stabbed in
an alley in front of his son.
It happened
at 8:53 at night.
This is his next move.
He's gonna kill again.
We need to stop Leo Finch.
MUNDO:
Yeah, but how?
There are thousands of alleys
in New York City.
♪ ♪
Okay, everybody, listen up.
We're basically looking
for a-an alley in a haystack.
Leo's two copycat killings
took place the same time
of day as the original crimes,
which means at approximately
8:53 tonight,
somebody is gonna get stabbed.
So let's get going on this.
All right?
We've got just over an hour
to find this Leo Finch
before he finds his next victim.
D.B., I figured out
what the three 911 calls
on Leo's playlist
all have in common.
They all lasted
over 20 minutes...
almost three times longer
than your average 911 call.
The victims all
died because Leo
didn't dispatch
the paramedics in time.
So he orchestrated their deaths.
NELSON:
Just spoke to the NYPD.
They issued a BOLO for Leo.
And I sent them the antidote.
They'll push it
to all cell phones in the area
using AMBER Alerts.
Right.
So you guys figured out the, uh,
alphanumeric problem,
did you?
We used a buffer
overflow exploit,
thank you very much.
NELSON: That's right.
It'll flood the phones
with a specific sequence of text
to force the NYPD home page
to pop up.
Now, that home page will have
a download for the antidote.
Basically, we're geniuses.
Exactly.
Basically.
Basically.
Do me a favor, though, will you?
Call NYPD back,
tell them to display
a photo of Leo Finch
with the antidote.
Might as well make the city
our eyes and ears.
Uh... yeah, uh...
I think you should do that.
Why is that?
Might get a little pushback.
Apparently, they've been
chatting with my pal the mayor.
Yeah, Nelson,
this has nothing to do
with your Stock Exchange hack,
all right?
Call them back,
tell them to post the photo
and the antidote.
Come on, buddy.
This is your hero moment.
You got this, Nelson.
Right, right.
My hero moment.
All right.
I just talked to
the police chief.
He told me that you're
using an AMBER Alert
to send out an antidote
written by Brody Nelson.
That's correct.
We'll have to verify that code
before it goes out
to the public.
I've hired a private
security firm.
No, that's not necessary
and we don't have the time.
We are chasing a killer, here.
I'm well aware of that,
and I'm shocked
that you would even
trust a black hat
with something this critical.
I've heard about your
unconventional tactics,
Deputy Director,
but this is inappropriate
and dangerous.
Mayor Cavanaugh,
how many more lives
are you willing to jeopardize?
No one cares more
about the citizens
of this city than I do.
That's why I'm here.
Brody Nelson's antidote
will save lives.
Now, I could go
over your head with this,
but I'm not sure
that you could weather
the political embarrassment.
If this goes sideways,
it's on you.
♪
(indistinct chatter,
phone chimes)
RAMIREZ: The public's responding
to the AMBER Alert.
I've got multiple reports
of Leo Finch
at Madison and 140th.
Pellham Park.
That's Harlem.
Yeah, but we've got several
sightings on the east side.
I mean, guy can't be
in two places at once.
Dopplegangers?
No.
No, we made
a mistake. Uh...
What do you mean?
We sent the AMBER Alert
to everyone.
Everyone.
Including Leo Finch.
Yeah, okay, all right.
Time to call Mom.
Let's get Avery on the phone.
Um, Avery.
We're striking out here.
It looks like Leo could be
reporting false sightings.
So what do you think?
Let's review everything
we know about Leo Finch.
We know that
he's meticulous
about the details
in his recreations.
The boy in the third
911 call said
that he and his dad were leaving a game.
MUNDO: The police report said
Mets tickets were found
in the dad's jacket pocket.
It was a baseball game.
Yeah, but it's not
baseball season.
RYAN: Well, let's concentrate
on another sporting event.
All right, here we go.
I got hockey in Manhattan,
basketball in Brooklyn.
MUNDO: Which one fits our window?
Both.
Let's compare them
with the BOLO locations.
Okay, we've got
six sightings of Leo
around the arena in Manhattan,
only one in Brooklyn.
RYAN:
It's the hockey game.
Which ends in 15 minutes.
KRUMITZ: The original stabbing
took place in an alley
two blocks away
from the stadium.
All right, how many alleys
are there within that range
of the arena?
One second.
RAMIREZ:
Three.
All right, well, this is a guy
that sticks to details, right?
Let's pull up some old
crime scene photos,
see if we can narrow
it down to one.
Remember, Leo is a
deviant audiophile.
It isn't about what we see,
it's about what we hear.
Raven, pull up
the original 911 recording
of the alley stabbing.
Isolate the background sound.
Okay.
FINCH: 911.
What's your emergency?
BOY:
Help, he's stabbing him!
He's stabbing my dad!
FINCH:
What's your name?
Stop. Go back.
(rumbling)
That's an elevated train.
Pull up a subway map.
Look for any trains near
the arena that go above ground.
RAMIREZ: Got it, it's the alley
between West 4th and Bleeker.
Notify the arena.
I'll have 'em redirect crowds
away from that alley,
have NYPD clear
the streets.
Let's go get Leo Finch.
(thunder crashing)
(siren chirps)
MUNDO: It's over, Leo!
FBI!
We have you surrounded!
Got a visual on Leo,
he is armed.
Drop the knife, Leo!
Nobody's coming out
of that arena.
We've sealed the exits,
we've cleared the streets.
There's no one here
for you to harm.
So drop the knife.
Drop it now.
They're mine!
They're mine!
You can't take them!
Do not take one more step.
Give them back to me!
They're all I have!
MUNDO: Take one more step,
and I will shoot!
RYAN:
Stand down, Elijah.
We confiscated his computer.
He's talking about the
recordings he had saved on it.
MUNDO:
He came here to kill someone.
He came to satisfy an addiction.
Leo's a junkie.
He came to get a fix.
We could still
end this peacefully.
Krumitz, pull up the third
recording on Leo's playlist.
We need to find a way to play
it for Leo at the scene.
Okay, the squad cars all have
P.A. systems with bullhorns.
Operator, this is
Agent Daniel Krumitz.
Connect me to dispatch.
MAN:
Hold your fire!
KRUMITZ: Officer, I need you
to turn on your P.A. system.
FINCH: 911.
What's your emergency?
BOY: Help, he's stabbing him!
He's stabbing my dad!
FINCH: What's your name?
Where are you?
BOY: Dylan, I don't know
where I am.
We just... we left the game.
It's an alley.
FINCH:
Help is on the way.
BOY: The man just left.
I'm scared.
FINCH: Hey, Dylan, I need you
to go to your dad.
Tell me what you see.
BOY:
He's not moving.
He was going for his knife.
Someone call 911.
I've been hurt.
I need help.
♪
Nice code, brother. Huh?
You're gonna leave me hanging?
My bad, bro.
(scoffs)
That's old news, Nelson.
NELSON: Yeah, but not to the
mayor of New York City.
I mean, all he saw
was a black hat
who brought down
the stock exchange.
(scoffs) It's like
no matter what I do right,
I can't shake what I did wrong.
This is what pops up
when I Google my name.
Look at this.
RYAN:
Hey, come on.
You didn't have to come
back to Washington.
You could have stayed
in New York.
I know, but I was...
I was a distraction.
You had to go
to bat for me.
It's not like anything Mayor
Cavanaugh said wasn't true.
Really? You really
took that eight million?
Except for that, Krummy.
Hey, we cleared you
of that long ago.
The fact remains
you can't rewrite history,
but you can make it.
And that is exactly
what you did today.
Own that.
You should be
very proud of yourself.
Thank you, Avery.
KRUMITZ:
Eight million.
Oh, my God.
You can tell me.
I won't tell anybody.
Come on, you know where it is.
Let's go get it right now.
- I didn't steal it.
But I'm gonna find out
who did.
And when I do... I'm gonna put
that bastard in prison.
Here, let me read
this to you.
Okay.
"I'm taking a chance, hoping
this is still your number.
"I know it's been two years.
But fingers crossed,
"and divorce in the rearview...
Maybe""
Question mark.
"I'm at
Le Petit Paris
every night from 8:00
until they throw me out."
And then she signs it:
"Foolish Heart."
So you got a new phone
and her new number, and whoever
had that number before you
was supposed to get that text.
I-I know, I should have texted
her right back when I got it,
but I didn't, I-I waited.
But then I figured,
you know,
she would assume that her text
hadn't gone through, right?
Mm-hmm.
- And maybe that was better
than letting her know that I,
you know, a complete stranger,
knew that she'd...
put herself out there.
And I just didn't want
to embarrass her.
How do you know it's a her?
Well, that's a good point.
Okay, end of conversation.
(laughs)
No, wait a minute.
You fantasized about who it would be, D.B.
No, I didn't,
no, I didn't.
Yeah, you investigated it.
No, I did not investigate.
Yeah, you did.
I called the restaurant.
(gasps) See?
- That's all. I call... (laughs)
They said that
a rather attractive woman
came there every night
the same time.
And I... I knew
that she was roughly
in my age group.
Oh.
- "Foolish Heart""
That's a reference
to a Steve Perry song.
♪
That's a rock star
before your time.
Anyway, this...
the whole text, it just...
you know, it seemed
so brave and... and honest,
and... I'm curious.
You hijacked another man's text.
Yes, I did.
(both laugh)
So you're gonna meet her
at the restaurant,
or what?
No. No.
♪
(indistinct chatter)
(sighs)
(inhales sharply)
♪
(ice rattling)
Hi.
Hi.
(chuckles):
Forgive me for asking,
but are-are you...
here alone?
Uh...
I am.
Yeah. Of course.
Um... sorry, no,
I don't mean of course,
I mean...
I have a confession to make.
Oh, really?
Shouldn't I know your name
before we jump
right into the serious stuff?
Yes, yeah.
Sorry. Uh, D.B.
Greer.
- Nice to meet you.
See, I, uh...
I received this today,
and... obviously,
it was not meant for me.
I should have texted
you right back,
but I didn't, and I'm sorry.
Mmm.
Yeah. Yeah, awkward.
No, not for me.
Because I didn't write
that text.
(laughs): Really.
You're kidding.
Oh, boy. (sighs)
So...
(laughing):
Oh...
Oh, man.
Well, shame on her.
- (laughs)
Soliciting men via text.
So...
can I buy you a drink?
Really?
Seems like you could use one.
Shouldn't I know your last name
before we... jump into
the serious stuff?
Greer Latimore.
D.B. Russell.
Nice to meet you.
You, too.
♪ Foolish heart...
- So, uh...
what do you do...
Greer Latimore?
Former Secret Service.
Dabble in...
private investigations.
♪ Foolish, foolish heart...
Nuh-uh.
Uh-huh.
Oh, boy.
What are you drinking?
♪ You've been wrong before...
Something manly.
(laughs)
Okay.
Tequila.
Very manly.
- Yes, yes.
♪ Foolish, foolish heart...
Excuse me.
(classical music playing)
♪ ♪
♪ ♪
MALE OPERATOR:
911. What is your emergency?
MAN:
I just witnessed a hit and run.
FEMALE OPERATOR:
911. What is your emergency?
WOMAN: My apartment
building's on fire.
There are people still inside!
FEMALE OPERATOR:
911. What's your emergency?
CHILD:
How many people...
WOMAN:
I hear screams!
MALE OPERATOR:
911. What is your emergency?
I need to get to a hospital.
I'm five months pregnant.
I'm feeling sharp,
stabbing pains.
(gasping)
It's too soon for contractions.
I'm at 249 West McCoy Street.
Hello? Hello?
MALE OPERATOR:
911. What is your emergency?
I need help.
I need an ambulance.
I think my wife is
having a heart attack.
She's collapsed.
What-what do I do?
Hello?
Are you-- are you there?
Hello! Help!
Honey, sweetheart, stay with me.
Hold on, sweetheart, hold on.
Hello? Hello?
Hello? Hello?
Someone help, please!
I need help!
Help! Help!
MALE OPERATOR:
911. What is your emergency?
We need an ambulance.
A man's fallen
from a scaffolding,
but we can't tell if he's alive.
There's blood everywhere
and he isn't moving.
Hello? Can you hear me?
Are you there?
Are you there?
Hello, hello?
Sweeney, hold on.
Can you hear me?
Hello?
It's coming down!
Watch out! Look out!
(shouting)
Go, go!
Something's wrong with my phone!
Someone call 911!
MALE OPERATOR 2:
This is 911.
What is your emergency?
FEMALE OPERATOR:
911. What's your emergency?
What is your emergency?
We've been flooded with reports
of people having issues
calling 911 from cell phones.
They say they connect
to an operator, but then
the call drops off
and their phone
freezes in call mode.
What makes you think
that this is a cyber intrusion
and not a malfunction
of the New York City 911 system?
Well, we've checked
and double-checked.
There's no evidence
of a mechanical malfunction.
Our IT guys believe
it's a hack within our system
that affects
incoming cell phone calls.
Anyone who places a call
from a land line
doesn't experience the problem.
Have you ruled out issues
with cell service providers?
They've all confirmed
that cell towers in the city
are properly functioning
and all other wireless
phone traffic is normal.
So it only happens
when someone calls 911?
When someone calls 911
from a cell phone.
Not getting help
when you want it?
That's terrifying.
RYAN: The mayor and
Homeland Security are concerned
that this could be
a well-crafted precursor
to a terrorist attack.
Raven says the first reports
of dropped 911 calls
came in around
7:00 a.m. this morning.
Complaints were made
to local precincts
and cell service providers.
My operators noticed
a decrease in call volume
about the same time.
But none have reported
being abruptly disconnected
or dropped from a call.
OPERATOR:
Excuse me, Clayton?
Sorry. Will you
excuse me a moment?
RAVEN: According to my stats, there's
definitely something going on.
Well, I've compared
the number of 911 calls
from yesterday at this hour
to those received this morning.
Huge decrease
in cell phone calls.
On a typical day,
the call center
would get 24,000 calls,
70% from cell phones.
And this morning,
cellular calls went down to 30%.
RUSSELL: So there are
some cell phones out there
that are connecting to 911
and completing the call.
Right?
Yeah, but the strange thing is,
is that most
of the calls are made
from devices outside
of Manhattan, in the Boroughs.
KRUMITZ: We plugged
into the 911 system.
No evidence of malfunctions
or indicators of compromise.
Yeah, no known vulnerability,
no malware,
not a trace of digital dust
that indicates a hack.
I mean, these boxes
are squeaky clean.
So there's nothing here that
can tell us what's going on.
Okay, so that means
the problem has to be
internal to the cell phones.
They're all different
models and brands,
in different locations
all over the city.
Not to mention
that they all have
different service providers.
Other than them being
cell phones, I mean,
they have no connection
to each other.
RUSSELL:
Yeah, except they all
dropped 911 calls, right?
We need to get ahold
of one of those phones.
I might be able
to help with you that.
I have the latest
incident reports.
There was an accident
at a construction site
not far from here.
The foreman called
for paramedics.
Same thing happened.
Dropped call.
There's a possibility
we can get that phone.
♪ ♪
FOREMAN:
Yeah, that's my cell number
and I'm the site foreman.
I called 911 when
the scaffolding collapsed.
Sweeney dropped
from the third floor.
And there were two others
who also dialed 911?
Yeah, Henderson and Joe Lavelle.
Just like me,
they reached the operator,
and then the phones froze
and nobody was on the other end.
Is there a way
to get in touch with them?
I'd like to take a look
at their devices.
Yeah, I can, uh,
I can get you
their home number.
This is crazy.
That kid was only
20 years old.
Bled to death because I couldn't
get the paramedics here in time.
And now, two more of my guys
are in the hospital
in critical condition.
I hope you can figure this out.
You know,
on jobs like this,
something happens every day
on these sites.
I need to know that my guys
can get help when they need it.
Excuse me.
(indistinct chatter)
NELSON: Eric O'Brian's phone
is infected with malware.
I mean, it's gonna take time
to reverse-engineer the code
and figure out exactly
what it does to a cell.
Nah, forget the code.
I cloned his device
to a known-good test phone.
Let's just call 911
and see what happens.
All right.
MALE OPERATOR:
911. What is your emergency?
My name is
Daniel Krumitz.
I'm an agent
with the FBI.
Operator, if you
wouldn't mind
standing up and
waving for me?
911. What is
your emergency?
How 'bout counting to ten?
Hello? You there?
Nope. Okay.
Already gone.
That lasted about
three seconds.
Hey, look, maybe he thought you
were a prank caller and hung up.
You know, you don't exactly
sound like an FBI agent.
An operator isn't gonna
hang up that quickly.
They're required to make sure
there's no real emergency,
regardless of what
the caller says.
So maybe you didn't reach
an operator at all.
Remember, operators haven't been
reporting dropped calls,
only people dialing
in on cell phones have.
Hmm.
This test phone's
still active.
It's frozen;
I'm locked out.
That's the hacker's plan.
When you attempt
to dial 911,
you won't get a chance
to do it again.
Or use a cell at all.
It'll force you to find
a land line or a pay phone.
A pay phone?
And who uses
a land line anymore?
Yeah.
I don't even have one in my apartment.
I don't have one, either.
Oh, look.
Krummy, check this, right?
I got a timestamp
indicating the moment
the malware infected
Eric O'Brian's phone, right?
And just seconds
before that,
his cell phone connected
to a Wi-Fi network.
So that router
could be
the source of the infection.
Mm-hmm.
You got a location?
Yeah.
Two seconds.
And... tah-dah.
All right, I got it.
I'm driving.
Let's go.
What exactly does
an FBI agent sound like?
Smooth, Krummy. Sturdy.
Gotta sound like you just
finished the Ironman.
I'm out of breath?
No, man.
You gotta be tough.
You know, like a...
like a bad-ass.
(tough voice):
Daniel Krumitz, FBI.
(deeper voice):
Dan... Daniel Krumitz, FBI.
(indistinct chatter)
The router that Eric's phone
connected to isn't here.
MUNDO: You're sure you got
the right location?
NELSON: I'm positive.
Well, maybe our hacker
removed the device.
Wanted it to remain undetected.
Wait, wait, guys,
it just showed up.
And... now it's gone.
That means it's moving.
Wait, guys,
it's back up again.
Signal's getting stronger.
Real strong.
WOMAN: Is it coming?
WOMAN 2:
Oh, thank you.
That's it, right there.
That's why the signal's moving.
Free Wi-Fi. Stop that bus!
I'll call Avery and D.B.!
Let's see what's
on the bus's router.
Okay, same malware on
Eric O'Brian's phone.
But... that's not
the interesting part.
Nelson.
No. Uh-uh.
It... it can't be.
I know, right?
But it is, though, look.
Guys, guys.
Hey, hey. Can we use words
that actually mean something?
(laughs)
KRUMITZ:
It's like this, okay?
I have the flu. I sneeze.
If you're close enough to me,
you get the flu.
That's what this is.
It's an airborne computer virus.
It... it lives.
What do you mean,
“it lives,” Krumitz?
NELSON:
It was programmed to spread
like a real virus.
It jumps from unsecured router
to unsecured router
within 150 feet.
So it infects
any wireless access point
that's not password protected?
And even the ones that use
a default password
from the manufacturer.
So this bus has been, like,
“sneezing” all over town.
Every unsecured router
in its path has been infected?
KRUMITZ: And whenever
a Wi-Fi enabled phone connects
to one of these infected
routers, it gets the virus.
Malware automatically
jumps onto it.
RYAN:
It's contagious.
I've never seen anything
in the wild
like this before.
Can the virus jump
from phone to phone?
No.
Phones can only
get the virus
if they're connected to
one of the infected routers.
Well, at least these buses
stay on the same route, right?
It'll help us
contain the infection.
RYAN: But ultimately,
all the buses
go back to home base.
And then this infection jumps
from bus router to bus router.
And then bright
and early this morning,
all those buses went right back
into the streets of Manhattan.
Increasing the number of people
who won't get any help
when they call 911.
This is an outbreak.
We're looking
at an epidemic.
We need to find patient zero.
♪ CSI Cyber 2x12 ♪
Going Viral
Original Air Date on January 31, 2016
♪ I know you've deceived me,
now here's a surprise ♪
♪ I know that you have, 'cause
there's magic in my eyes ♪
♪ I can see
for miles and miles ♪
♪ I can see for miles
and miles ♪
♪ I can see
for miles and miles ♪
♪ And miles... ♪
♪ Oh, yeah. ♪
(indistinct chattering)
The infected area has grown
by 25% in the past two hours.
I've notified Port Authority
and service providers.
All public routers
are being disconnected
from buses and ferries.
Have FBI communications
get in touch
with all of the New Jersey,
Connecticut,
Philadelphia news media outlets.
Make sure they're
getting the word out
that commuters should
turn off their Wi-Fi
and not try to connect
to any free or open
Wi-Fi sources.
And remind them: use their
landlines when calling 911.
This virus will definitely
cross state lines
unless we're overly cautious.
Yep, a virus warning is already
spreading through social media,
and there's been a big surge
in purchases
of old-school telephones.
You're finally in style, D.B.
(chuckles)
Thanks very much.
Oh, hey, hold on a second.
Little, uh, social protocol.
Let's say you get a text
clearly meant for somebody else,
sent by someone you don't know.
Now, are you supposed
to, uh, text 'em right back
and say they got
the wrong person?
Kind of sounds like
a personal text then.
Well, yeah, kind of.
Wh-Why would you
just assume that?
'Cause if it was something like
“I'm gonna be late”
or “Call me,”
then it's easy to text back.
You wouldn't give it
a second thought.
But if suddenly
you get dropped
into the middle
of someone else's drama...
What did the text say?
Well, uh, none of your business.
(gasps)
You answered my question.
I'll see you later.
Come on, D.B.
It's got to be
pretty juicy, huh?
We'll talk about it
when I get back to DC.
D.B., you can't just...
(scoffs)
Mayor Cavanaugh,
there's no evidence
to suggest that the 911 hack
is a terrorist threat.
Well, that's a relief.
Do you know who's behind it?
We have a profile of
who we're looking for.
They're not part of a
politically motivated
group or collective.
They would have already
claimed responsibility by now.
Our target is an individual
who's celebrating his
power to cripple the city.
He enjoys making people
feel desperate, helpless.
There's a chance that he's tried
something like this in the past
on a smaller scale.
But this virus is an escalation.
He?
It's most likely a man.
Women go about things like this
in a less conspicuous way.
I was told you have a plan.
The malware is mimicking
a biicalirus,
so we're using CDC protocol.
We've identified how
it's transmitted,
we've begun the containment,
we're informing the public.
My team is writing code,
an antidote,
that will cure all
the infected phones
and stop any new phones
from acquiring it.
You are, Deputy Director Ryan,
as impressive as I was told.
Which makes my next request
a little uncomfortable.
(sighs)
Brody Nelson.
He's one of my
cyber investigators.
He's also the young man
that hacked into
the New York Stock Exchange,
created havoc
in the financial district.
And I understand
that that tarnished
your first term
in the mayor's office.
This is not about me.
I am well aware
of Brody Nelson's crimes.
He is serving his time.
I would prefer he were in prison
and not writing code
for anything having
to do with my city.
Well, that is not
your call, sir.
Did you know that
eight-million-dollar transfer
as a result of his financial
hack was never accounted for?
That young man knows
where it is.
The mayor's just bent out of
shape because their election's
coming up.
(sighs)
I did a terrible thing, D.B.
Can't expect people to forget.
You know what?
I'm just gonna
image these devices
and go back to DC with you.
It'll be easier
for me to analyze
the malware from Tear Down
and work on the antidote.
Okay.
All right?
Let me make this clear.
I don't want Brody Nelson
working this case.
If Brody Nelson doesn't work on
this case, then neither do I.
So you let me know.
REPORTER: The FBI has informed
us of a malware virus
affecting the 911 emergency system.
...Wi-Fi has been discontinued.
We ask that you use
a landline for all...
OPERATOR:
911, what's your emergency?
This is an emergency.
Excuse me, I need to make...
What you got?
I've infected these test phones
with the virus.
It lies dormant
until you dial 911,
and this is what you hear.
MALE VOICE: 911.
What is your emergency?
Hello. Hello.
No one there.
That's because there was
never anyone there.
It's a recorded voice.
There's an audio file
hard-coded into the virus.
Now, these phone calls
never make it
to an actual 911 operator.
Just a recorded voice.
The hacker hijacked 911
and made the caller believe
they were getting through.
Mm-hmm, and not only that.
Check this out.
(hums)
MALE VOICE: 911.
What is your emergency?
Say something.
Keep talking.
Hello, this is D.B. Russell.
Testing, one, two, three.
The phone is not frozen, it's
recording everything I'm saying.
Right.
All right, so our
target is a man
who... who gets
off on hearing
the fear and the panic
of helpless people.
He's recording the callers and
sending the audio... somewhere.
And we don't know where?
Nope.
The files are bouncing
through proxy IPs.
It's a dead end.
(classical music plays)
MALE VOICE: 911.
What is your emergency?
WOMAN: Please help, someone
just broke into my house.
He's strangling my husband.
I'm hiding in the closet.
Oh... oh, God. He's...
MALE VOICE:
Try to stay calm, ma'am.
I'm showing your address
is 754 Plymouth Way.
Is that correct?
WOMAN:
Yes, please hurry.
I-I can hear him in the kitchen.
(crying):
I think my husband's dead.
MALE VOICE:
Help is on the way.
WOMAN: Please hurry.
Where are you?
Am I right or am I right?
The voice of the 911 operator
embedded in the malware
sounds like a long-lost
relative of T-Pain.
Who Pain?
RAMIREZ: T-Pain.
He's the king of auto-tune.
Yeah.
And that is again?
It's, like,
when a recording artist
alters the pitch of their voice
when they sing off-key.
Or when they suck.
Well, if that's true and
the voice was distorted,
then we should be able
to un-distort it.
I just made that word up. All
right, let's get to work here.
Play it again, Nelson.
All right.
MALE VOICE (slowly): 911.
What is your emer...
Okay, Raven, isolate
one of the ringing phones
in the background there.
And pull up the ringtone used
by the 911 call center.
That'll be our baseline.
Right, once we match
the ringtones,
we'll have the real voice
of our 911 operator.
Exactly.
Okay, I am adjusting
the pitch and speed
of the recording
until the waveforms line up.
MALE VOICE: 911.
What is your emergency?
Okay, here we have our real
911 operator's voice.
MALE VOICE: 911.
What is your emergency?
Why would our target want
to distort this voice?
To disguise it.
This could be him.
Right? Our target.
I mean, why else would he do it?
You think he works
at a call center.
I don't know,
it's just a theory.
Let's run this voice
against all
of the male dispatchers
in the New York City
call center database.
All right?
Maybe we'll get lucky here,
get an I.D.
NELSON:
Got him.
RYAN:
Leo Finch.
Look at his profile.
He was fired from the call
center exactly a year ago today.
Well, that's motive for revenge.
Let's see, he was fired for...
“failure to properly
dispatch emergency units”"
“poor decision making”"
“refusal to follow protocol”"
Also looks like there
were several instances
of slow dispatch times
and sending paramedics
to the wrong address.
Delayed dispatch times suggests
he wanted to keep
the panicked callers on the line
as long as possible.
He enjoyed hearing
their desperation.
Their pleading made him feel
powerful and in control.
Leo is an auditory voyeur.
Well, that's twisted.
Call Elijah.
Tell him there's a door
he has to kick down.
Clear!
Clear!
Clear!
All clear!
Clear!
MUNDO: Victims are
Mary and Roger Ingram. (sighs)
Ligature marks around the neck
and petechial hemorrhaging in
the eyes suggest strangulation.
We have a time of death?
MUNDO: According to
the on-site coroner report,
body temp puts TOD
somewhere between 5:00
and 7:00 a.m. this morning.
Any signs of forced entry?
No.
And nothing to suggest
that Leo Finch lives here.
Police are canvassing
the area right now,
seeing if anybody
recognizes Leo's photo.
MAN:
Agent Mundo.
KRUMITZ: Looks like Mary
tried to call for help.
She's still clenching
this phone.
Cadaveric spasm.
It occurs in violent,
intense deaths.
That's why her hand is
clenched around the phone.
Battery's dead.
See if it has the virus.
Malware is exactly the same
as all the others.
According to the call log, Mary
tried to call 911 at 6:23 a.m.
Please hurry,
he's strangling my husband.
I think he killed him.
I can hear him coming.
Hello, is anyone there?
Hello?
Hello?
(screams)
MUNDO:
Avery.
There's a basement apartment.
This is an odd setup.
Cheap furniture,
egg carton acoustics,
but very expensive speakers.
Found a laptop.
This is a Benning.
Leo has a $50,000 violin
and lives in a cheap rental?
It's funny--
some of the best coders
are talented musicians.
Both highly technical,
deal with complex numbers.
Clearly, Leo's obsession
was sound.
KRUMITZ:
I'm imaging Leo's computer.
He's over 200 audio files
on his hard drive.
They're all 911 calls,
and he's the operator.
RYAN:
Leo is an addict.
The 911 calls are his drug.
It's like an arsonist
getting a job as a firefighter
or a pedophile
who becomes a teacher.
Leo got his fix
at work.
Until he was fired a year ago,
and he was cut off from his drug
and had to find a new way
to feed his addiction.
The virus.
Whoa, Krumitz, get-- come here.
Is this what I think it is?
That could be
the original source code
for the virus.
Okay, we've got something.
This computer connected
to 26 bus routers
at Port Authority
at 11:00 p.m. last night.
That's 26 patient zeros.
This is not
an experiment gone wrong.
This was a calculated attack.
No, Leo wanted to infect
every corner of the city,
and he wanted to do it fast.
RAMIREZ: 61 confirmed cases
in New Jersey.
38 in Connecticut.
And 23 in Upstate New York.
Even with the news
alerts and warnings,
the virus has officially
spread through the
tristate area.
Well, the good news is the
infection rate should slow down
in the less densely
populated areas.
Bad news?
A complete quarantine
looks impossible.
And local precincts are overrun
with emergency calls
and hospitals are
flooded with walk-ins.
Some people are resorting
to social media
to announce
their emergencies.
Nelson,
we need that antidote.
How's it going?
Krummy sent me
the source code of the virus
from Leo Finch's laptop.
Now that I can see exactly
how the virus is written,
it shouldn't take long to write
a code to counteract it.
But the problem is
how to push it to all
the phones that need it.
Yeah, a software update through
the vendors will take days.
Mm-hmm.
Wait a minute.
What about using something
like the AMBER Alert, right?
It sends
push notifications to phones
during child abductions.
It's instant, it's regional.
What do you think?
I mean, AMBER Alerts
are only designed
to display alphanumeric text.
You can't use them
to push code.
And there are regulations.
I mean, FTC, DOJ, FEMA.
Right.
Wait, wait, wait.
Are you saying it's impossible?
I'm saying it's never been done before.
Right.
Well, there's a first
time for everything.
You-you two were black
hats, weren't you?
The best.
Notorious.
Okay, so you'll
hack it, right?
And I'll take full
responsibility.
Matter of fact, I will call
Director Silver right now.
Work on the FCC,
DOJ part of this thing.
All right, man said
hack, let's hack.
Look at this.
A pair of pliers,
some kind of metal pins
and a bloody violin string.
I think we may be looking
at the murder weapon.
(screaming)
(both grunting)
All right, well,
whatever Leo's endgame is,
if he left two bodies upstairs
and a murder weapon in the wall,
it's a pretty safe bet
he's not coming back here
anytime soon.
Guys, look at this.
It looks like these three 911
recordings were Leo's favorites.
They were played
over a thousand times.
And he even put them
on a separate playlist.
Here, listen to this.
FINCH:
911, what's your emergency?
MAN: My buddy, he fell!
It's bad; it's-it's real bad!
We need an ambulance!
Sir, what's your location?
MAN: Construction site
at Lexington and 12th!
I don't think he's conscious.
FINCH:
I'm dispatching paramedics now.
Calm down and describe
what you see.
MAN:
There's a lot of blood!
He must've fallen 50 or 60 feet
or something-- please hurry!
There's blood all over his head!
I'm pretty sure
his legs are broken.
FINCH: All right,
be careful not to move him.
Help is on the way.
Is this from today?
Uh, no.
According to the metadata,
this recording's
from two years ago.
But what's strange is that it
happened at the same time of day
as the construction
incident.
Scaffolding pins.
There's traces of paint and rust
in the grooves of the pliers.
What happened at that
construction site this morning
was no accident.
MAN: All right,
what do we got?
(creaking)
Help! Help!
Play the next one.
FINCH:
911, what's your emergency?
WOMAN:
Please help.
Someone just broke
into my house.
He's strangling my husband.
I'm hiding in a closet.
FINCH:
Try to stay calm, ma'am.
I'm showing your address
as 754 Plymouth Way.
Is that correct?
WOMAN:
Yes, please hurry!
I can hear him in the kitchen.
Oh! I think my husband's dead.
FINCH:
Help is on the way.
WOMAN:
Why is this taking so long?
Why is no one coming?
This is very similar
to the scene upstairs.
This is exactly what happened
to Mary and Roger Ingram.
This is also
another old recording
and it happened
at the same time
as the murders
this morning, 6:23 a.m.
Listening is
a deeply immersive experience.
FINCH:
Sir, what's your location?
MAN: Construction site
at Lexington...
RYAN: Every time Leo listen
to one of these recordings,
he envisioned himself
in the scene.
We need an ambulance.
RYAN: First, he's a witness.
...can't tell if he's alive.
There's blood everywhere
and he's not moving.
RYAN: Then he's the victim.
Please help.
Someone just broke
into my house.
He's strangling my husband.
(creaks)
RYAN:
Now, Leo's the killer.
(woman gasps)
No.
No, no!
He's recreating
his greatest hits.
(woman screams)
KRUMITZ: Yeah, but what does the virus
have to do with all this?
And why today?
RYAN:
It's the anniversary
of the day he was fired.
Look, Leo is a sadist
who's aroused
by the sound of fear.
The virus does
everything that he needs.
The dropped calls delay
the emergency responders,
which maximizes
the victims' panic.
Leo records the calls
so he can enjoy them later.
It's his version
of a serial killer
taking a trophy.
Krumitz, didn't
you say there were
three recordings
on that playlist?
FINCH:
911, what's your emergency?
BOY:
Help! He's stabbing him.
He's stabbing my dad!
FINCH:
What's your name? Where are you?
BOY: Dylan.
And I don't know where I am.
We just... we left the game.
It's an alley.
FINCH:
Help is on the way.
BOY:
The man just left!
I'm scared.
FINCH:
It's okay, Dylan.
I need you to go to your dad
Tell me what you see.
BOY: He's not moving!
(whimpering)
Leo mimicked the first two
recordings on the playlist.
And this recording
is of a man being stabbed in
an alley in front of his son.
It happened
at 8:53 at night.
This is his next move.
He's gonna kill again.
We need to stop Leo Finch.
MUNDO:
Yeah, but how?
There are thousands of alleys
in New York City.
♪ ♪
Okay, everybody, listen up.
We're basically looking
for a-an alley in a haystack.
Leo's two copycat killings
took place the same time
of day as the original crimes,
which means at approximately
8:53 tonight,
somebody is gonna get stabbed.
So let's get going on this.
All right?
We've got just over an hour
to find this Leo Finch
before he finds his next victim.
D.B., I figured out
what the three 911 calls
on Leo's playlist
all have in common.
They all lasted
over 20 minutes...
almost three times longer
than your average 911 call.
The victims all
died because Leo
didn't dispatch
the paramedics in time.
So he orchestrated their deaths.
NELSON:
Just spoke to the NYPD.
They issued a BOLO for Leo.
And I sent them the antidote.
They'll push it
to all cell phones in the area
using AMBER Alerts.
Right.
So you guys figured out the, uh,
alphanumeric problem,
did you?
We used a buffer
overflow exploit,
thank you very much.
NELSON: That's right.
It'll flood the phones
with a specific sequence of text
to force the NYPD home page
to pop up.
Now, that home page will have
a download for the antidote.
Basically, we're geniuses.
Exactly.
Basically.
Basically.
Do me a favor, though, will you?
Call NYPD back,
tell them to display
a photo of Leo Finch
with the antidote.
Might as well make the city
our eyes and ears.
Uh... yeah, uh...
I think you should do that.
Why is that?
Might get a little pushback.
Apparently, they've been
chatting with my pal the mayor.
Yeah, Nelson,
this has nothing to do
with your Stock Exchange hack,
all right?
Call them back,
tell them to post the photo
and the antidote.
Come on, buddy.
This is your hero moment.
You got this, Nelson.
Right, right.
My hero moment.
All right.
I just talked to
the police chief.
He told me that you're
using an AMBER Alert
to send out an antidote
written by Brody Nelson.
That's correct.
We'll have to verify that code
before it goes out
to the public.
I've hired a private
security firm.
No, that's not necessary
and we don't have the time.
We are chasing a killer, here.
I'm well aware of that,
and I'm shocked
that you would even
trust a black hat
with something this critical.
I've heard about your
unconventional tactics,
Deputy Director,
but this is inappropriate
and dangerous.
Mayor Cavanaugh,
how many more lives
are you willing to jeopardize?
No one cares more
about the citizens
of this city than I do.
That's why I'm here.
Brody Nelson's antidote
will save lives.
Now, I could go
over your head with this,
but I'm not sure
that you could weather
the political embarrassment.
If this goes sideways,
it's on you.
♪
(indistinct chatter,
phone chimes)
RAMIREZ: The public's responding
to the AMBER Alert.
I've got multiple reports
of Leo Finch
at Madison and 140th.
Pellham Park.
That's Harlem.
Yeah, but we've got several
sightings on the east side.
I mean, guy can't be
in two places at once.
Dopplegangers?
No.
No, we made
a mistake. Uh...
What do you mean?
We sent the AMBER Alert
to everyone.
Everyone.
Including Leo Finch.
Yeah, okay, all right.
Time to call Mom.
Let's get Avery on the phone.
Um, Avery.
We're striking out here.
It looks like Leo could be
reporting false sightings.
So what do you think?
Let's review everything
we know about Leo Finch.
We know that
he's meticulous
about the details
in his recreations.
The boy in the third
911 call said
that he and his dad were leaving a game.
MUNDO: The police report said
Mets tickets were found
in the dad's jacket pocket.
It was a baseball game.
Yeah, but it's not
baseball season.
RYAN: Well, let's concentrate
on another sporting event.
All right, here we go.
I got hockey in Manhattan,
basketball in Brooklyn.
MUNDO: Which one fits our window?
Both.
Let's compare them
with the BOLO locations.
Okay, we've got
six sightings of Leo
around the arena in Manhattan,
only one in Brooklyn.
RYAN:
It's the hockey game.
Which ends in 15 minutes.
KRUMITZ: The original stabbing
took place in an alley
two blocks away
from the stadium.
All right, how many alleys
are there within that range
of the arena?
One second.
RAMIREZ:
Three.
All right, well, this is a guy
that sticks to details, right?
Let's pull up some old
crime scene photos,
see if we can narrow
it down to one.
Remember, Leo is a
deviant audiophile.
It isn't about what we see,
it's about what we hear.
Raven, pull up
the original 911 recording
of the alley stabbing.
Isolate the background sound.
Okay.
FINCH: 911.
What's your emergency?
BOY:
Help, he's stabbing him!
He's stabbing my dad!
FINCH:
What's your name?
Stop. Go back.
(rumbling)
That's an elevated train.
Pull up a subway map.
Look for any trains near
the arena that go above ground.
RAMIREZ: Got it, it's the alley
between West 4th and Bleeker.
Notify the arena.
I'll have 'em redirect crowds
away from that alley,
have NYPD clear
the streets.
Let's go get Leo Finch.
(thunder crashing)
(siren chirps)
MUNDO: It's over, Leo!
FBI!
We have you surrounded!
Got a visual on Leo,
he is armed.
Drop the knife, Leo!
Nobody's coming out
of that arena.
We've sealed the exits,
we've cleared the streets.
There's no one here
for you to harm.
So drop the knife.
Drop it now.
They're mine!
They're mine!
You can't take them!
Do not take one more step.
Give them back to me!
They're all I have!
MUNDO: Take one more step,
and I will shoot!
RYAN:
Stand down, Elijah.
We confiscated his computer.
He's talking about the
recordings he had saved on it.
MUNDO:
He came here to kill someone.
He came to satisfy an addiction.
Leo's a junkie.
He came to get a fix.
We could still
end this peacefully.
Krumitz, pull up the third
recording on Leo's playlist.
We need to find a way to play
it for Leo at the scene.
Okay, the squad cars all have
P.A. systems with bullhorns.
Operator, this is
Agent Daniel Krumitz.
Connect me to dispatch.
MAN:
Hold your fire!
KRUMITZ: Officer, I need you
to turn on your P.A. system.
FINCH: 911.
What's your emergency?
BOY: Help, he's stabbing him!
He's stabbing my dad!
FINCH: What's your name?
Where are you?
BOY: Dylan, I don't know
where I am.
We just... we left the game.
It's an alley.
FINCH:
Help is on the way.
BOY: The man just left.
I'm scared.
FINCH: Hey, Dylan, I need you
to go to your dad.
Tell me what you see.
BOY:
He's not moving.
He was going for his knife.
Someone call 911.
I've been hurt.
I need help.
♪
Nice code, brother. Huh?
You're gonna leave me hanging?
My bad, bro.
(scoffs)
That's old news, Nelson.
NELSON: Yeah, but not to the
mayor of New York City.
I mean, all he saw
was a black hat
who brought down
the stock exchange.
(scoffs) It's like
no matter what I do right,
I can't shake what I did wrong.
This is what pops up
when I Google my name.
Look at this.
RYAN:
Hey, come on.
You didn't have to come
back to Washington.
You could have stayed
in New York.
I know, but I was...
I was a distraction.
You had to go
to bat for me.
It's not like anything Mayor
Cavanaugh said wasn't true.
Really? You really
took that eight million?
Except for that, Krummy.
Hey, we cleared you
of that long ago.
The fact remains
you can't rewrite history,
but you can make it.
And that is exactly
what you did today.
Own that.
You should be
very proud of yourself.
Thank you, Avery.
KRUMITZ:
Eight million.
Oh, my God.
You can tell me.
I won't tell anybody.
Come on, you know where it is.
Let's go get it right now.
- I didn't steal it.
But I'm gonna find out
who did.
And when I do... I'm gonna put
that bastard in prison.
Here, let me read
this to you.
Okay.
"I'm taking a chance, hoping
this is still your number.
"I know it's been two years.
But fingers crossed,
"and divorce in the rearview...
Maybe""
Question mark.
"I'm at
Le Petit Paris
every night from 8:00
until they throw me out."
And then she signs it:
"Foolish Heart."
So you got a new phone
and her new number, and whoever
had that number before you
was supposed to get that text.
I-I know, I should have texted
her right back when I got it,
but I didn't, I-I waited.
But then I figured,
you know,
she would assume that her text
hadn't gone through, right?
Mm-hmm.
- And maybe that was better
than letting her know that I,
you know, a complete stranger,
knew that she'd...
put herself out there.
And I just didn't want
to embarrass her.
How do you know it's a her?
Well, that's a good point.
Okay, end of conversation.
(laughs)
No, wait a minute.
You fantasized about who it would be, D.B.
No, I didn't,
no, I didn't.
Yeah, you investigated it.
No, I did not investigate.
Yeah, you did.
I called the restaurant.
(gasps) See?
- That's all. I call... (laughs)
They said that
a rather attractive woman
came there every night
the same time.
And I... I knew
that she was roughly
in my age group.
Oh.
- "Foolish Heart""
That's a reference
to a Steve Perry song.
♪
That's a rock star
before your time.
Anyway, this...
the whole text, it just...
you know, it seemed
so brave and... and honest,
and... I'm curious.
You hijacked another man's text.
Yes, I did.
(both laugh)
So you're gonna meet her
at the restaurant,
or what?
No. No.
♪
(indistinct chatter)
(sighs)
(inhales sharply)
♪
(ice rattling)
Hi.
Hi.
(chuckles):
Forgive me for asking,
but are-are you...
here alone?
Uh...
I am.
Yeah. Of course.
Um... sorry, no,
I don't mean of course,
I mean...
I have a confession to make.
Oh, really?
Shouldn't I know your name
before we jump
right into the serious stuff?
Yes, yeah.
Sorry. Uh, D.B.
Greer.
- Nice to meet you.
See, I, uh...
I received this today,
and... obviously,
it was not meant for me.
I should have texted
you right back,
but I didn't, and I'm sorry.
Mmm.
Yeah. Yeah, awkward.
No, not for me.
Because I didn't write
that text.
(laughs): Really.
You're kidding.
Oh, boy. (sighs)
So...
(laughing):
Oh...
Oh, man.
Well, shame on her.
- (laughs)
Soliciting men via text.
So...
can I buy you a drink?
Really?
Seems like you could use one.
Shouldn't I know your last name
before we... jump into
the serious stuff?
Greer Latimore.
D.B. Russell.
Nice to meet you.
You, too.
♪ Foolish heart...
- So, uh...
what do you do...
Greer Latimore?
Former Secret Service.
Dabble in...
private investigations.
♪ Foolish, foolish heart...
Nuh-uh.
Uh-huh.
Oh, boy.
What are you drinking?
♪ You've been wrong before...
Something manly.
(laughs)
Okay.
Tequila.
Very manly.
- Yes, yes.
♪ Foolish, foolish heart...
Excuse me.