CSI: Cyber (2015–2016): Season 2, Episode 16 - 5 Deadly Sins - full transcript
The team trails a vigilante killing the biggest offenders of objectionable posts on social media.
God bless you,
and thank you for tuning in.
(muffled grunting nearby)
Today...
I'm gonna talk to you
about resisting temptation.
Now, we all know
the story from the Bible
of David and Goliath.
(muffled grunting continues)
Champion of the Philistines
versus a much smaller,
weaker opponent,
who simply had the courage
to face him.
(muffled panting)
You see...
David already knew
he had the victory.
He had God on his side.
(muffled grunting)
Goliath can be like that sin
in your life that is
most difficult for you
to overcome, but you...
you can be like David.
With God on your side...
you can slay your giant
and live a life free from sin.
(muffled grunting)
The only question is:
Which sin is your Goliath?
(muffled panting)
♪ ♪
(phones ringing, beeping;
overlapping conversations)
WOMAN: Did you get this?
MAN: Yeah. What is it?
I don't follow this person.
You got this?
What is this?
What's going on?
Is there an AMBER Alert?
Nothing came up on my phone.
It's an alert from PicThread.
Ah. Well, that
explains it--
I don't do social media.
NELSON: “New post from:
Homestead Harrison”?
I don't follow anyone
named Homestead Harrison.
Neither do I.
RYAN: Well, it looks like
this guy sent an alert
to everyone here.
What the...? Raven, are
you seeing this photo?
No, it's not just everyone
in this room.
Every single user on PicThread
received this photo.
Is this a hoax?
No.
Lividity,
coloring in his fingertips,
purple suggests death, so...
either someone's paying
a lot of attention to detail,
or that guy's definitely dead.
Who posted this?
Um...
Aiden Harrison.
Profile says he lives in Boston.
Check it out.
This post is geo-tagged.
MUNDO:
You have to choose to show
your location on PicThread--
the app doesn't do it for you.
RYAN: So this Aiden Harrison--
he wanted us
to know where
this photo was taken.
NELSON: Geo-tag says
it's a church in Boston.
(sirens wailing, whooping)
♪ ♪
MUNDO: It's Aiden Harrison.
Looks like
he's been here a while.
Two or three days,
just from the...
looks and smell of it.
The church is
being renovated.
Bought the killer time
before he sent the photo.
(phone chimes)
Raven just got
a notification from VICAP.
He was reported missing a week ago.
MUNDO: Killer must have
hijacked his PicThread account.
Why wait to post this picture
till this morning?
And why post it at all?
This is a mess.
There's blood
and bodily fluids
on the ports,
soaked all the way
through to the keyboard.
I'm gonna take everything
back to CTOC,
see if I can retrieve some data.
RUSSELL:
Okey-dokey. (grunts)
Upsy-daisy.
(others groaning)
Oh, snap.
Well, first things first.
The guy's tongue
has been cut out.
Choked to death
on his own blood.
Is that a tattoo?
RUSSELL:
Yeah, it's a... QR code.
Could be a clue
from our killer.
(slow techno music playing)
♪ Way from me... ♪
♪ Way from me... ♪
♪ Way from me... ♪
♪ Way from me... ♪
♪ Way from me... ♪
♪ Way from me... ♪
♪ Way... ♪
(music ends)
(voice breaking):
He was a good man.
A good father.
A good husband.
Please keep us in your prayers.
Whoever did this
will have to stand before God
and be judged.
RUSSELL:
I can't imagine
losing a loved one
and then finding out about it
on social media
MUNDO: PicThread removed the photo,
but it's already gone viral--
it's all over the Internet.
Will be forever.
Raven, were you able
to establish how
that photo was sent to every user?
Well, it's weird.
Everyone-- and I mean
every PicThread subscriber--
was following Pastor Harrison.
RUSSELL:
I know preaching online
is like the pulpit
of the 21st century,
but that's insane--
that many followers?
MUNDO: Yeah, some
of the most popular
televangelists have only
four or five million.
RAMIREZ: Pastor Harrison's been using
social media for years.
And last week he had
80,000 followers
on PicThread, but today...
he has just over
200 million followers.
How is that possible?
I don't know yet.
It's got to be a hack.
Wait, look at this.
(rapidly keyboarding)
He recently started posting
about overturning laws
on gay marriage
and protesting abortion clinics.
So, that's interesting, right?
If you take a strong stance
against politicized topics,
it makes a bigger
splash online.
Recruit a hell of a lot
more followers that way.
Yeah, but a controversial post
can make people angry.
MUNDO:
Maybe even get you killed.
(typing)
What'd you find, Nelson?
Normal QR code.
Like the ones in all
the magazine ads-- only this one
is linked to a Web site
with a Swedish domain.
Check this out.
Now...
when I scan the QR code
that we found
on Pastor Harrison,
the image sensor on my phone
reads the data--
in this case, a Web address.
RYAN: So what's on the Web site
that that links to?
I have no idea.
I just know the address.
Well, maybe it's
a phishing site
or maybe it dumps malware
onto the network.
Yeah, but see, I'm thinking of
setting up a isolated connection
to scan the QR code, then we
can see what's on the site.
This phone will be
the only device
that's exposed.
Do it.
A'ight.
That's what I'm talkin' 'bout.
♪ ♪
Okay, so the only print
I could get off the laptop
belonged to Pastor Harrison.
Well, and before it was covered
in bloody guts and goo,
this was a brand-new laptop.
There's only one user-generated
file in the entire hard drive.
RUSSELL:
“If you can't say anything nice,
don't say anything at all.”
And this wasn't
copied and pasted-- look.
There's typos
in some of the lines--
gets worse as it goes.
When was this document created?
Time stamp says...
three days ago.
So that was after
Pastor Harrison
was reported missing.
So he was taped to the chair
and forced to type this
over and over again.
There's 10,000
lines here.
Even typing 60 words a minute,
that'd take... days.
Someone wanted
to teach him a lesson.
(overlapping conversations,
phones ringing and beeping)
Oh, really? I don't know.
All right,
let's find Avery.
MAN:
I don't know.
Whoa, have you seen this?
I don't know. How...
Whoa.
This can't be a coincidence.
We just got another photo.
Yeah, I saw.
Another staged murder sent
to everyone on PicThread?
As soon as
we scanned the QR code
and linked to the site,
this message appeared.
RUSSELL: “Some things are better
kept behind closed doors.”
Then everyone's
phone went off
with the new
PicThread alert.
So something we did
triggered the release?
So we're looking at one,
maybe two more victims here.
KRUMITZ: Hashtag
#Graphic Warning.
Same as the other photo.
So our target wants us to know
this is connected
to the last killing.
(scoffs)
This is like the Zodiac Killer
sending letters to the press.
RYAN: We've got a serial killer
who's taunting us
on social media.
♪ CSI Cyber 2x16 ♪
5 Deadly Sins
Original Air Date on March 6, 2016
♪ I know you've deceived me,
now here's a surprise ♪
♪ I know that you have, 'cause
there's magic in my eyes ♪
♪ I can see
for miles and miles ♪
♪ I can see for miles
and miles ♪
♪ I can see
for miles and miles ♪
♪ And miles... ♪
♪ Oh, yeah. ♪
My phone has been
ringing off the hook
about photos
on PicThread.
The president's own children
received them.
He called me himself
for answers.
I'm hoping you have some.
Both photos were geo-tagged.
Local law enforcement
are on their way
to the second location.
We're not far behind.
And I understand
our Cyber Division
is responsible
for the second photo being released?
When that page loaded
here at CTOC, it ran a script
that automatically posted
the next photo to PicThread.
The target wanted the FBI to be
responsible for sending it out.
I promise you, this
will not happen again.
Good.
(indistinct chatter)
(elevator bell dings)
♪ ♪
Aw, come on,
you can't spare
an hour for your old man?
Dad, I'm so sorry. I...
You have to cancel
our lunch.
This case just
came in. It's...
I understand.
But, uh... can we
talk for a minute?
It's important.
Yeah. Yeah.
Um... come on.
You okay?
Still have cancer.
Chemo sucks.
Otherwise, I'm fine.
It's about you and Devon.
The other day, when
I was with Michelle,
she said...
“Mommy and Daddy
have been fighting”"
It's nothing for you to be...
Who's Nina?
Michelle mentioned her.
Nina is a bartender
at Conaghan's Pub.
Why? What did Michelle say
about Nina?
She heard her name
when you were fighting.
Are you having an affair?
Dad...
You can be honest
with me, son.
Come on.
No.
I'm trying
to make it work with Devon.
A few months ago,
I-I went to Conaghan's Pub
a couple times. Nina was
working there. We chatted.
Next thing I know,
she's become friends with Devon,
she's trying to come between us.
Oh, hey.
Hey.
Perfect timing. We were just
about to sit down for dinner.
This is my friend Nina,
from spin class.
She's gonna join us.
NINA:
Devon, this is so crazy.
Elijah and I actually
know each other.
He comes to my bar
all the time.
You see what's going on here?
You see what she started?
Elijah, is there something more
you want to tell me?
The woman is delusional.
And then, out of nowhere,
the other night, she texted me.
Devon saw the text
come through.
You know, it was a thing.
But it's fine. We're fine.
Hmm.
You sure?
Yeah.
Don't worry about it.
Dinner this weekend?
Why not tonight?
Flying to Boston.
♪ ♪
MUNDO: Nicole Hogan,
24 years old,
third-year
graduate student.
This is her place.
Photo was posted to her account.
Greg Roberts, 25.
He lives across town.
No PicThread account that we
could find. Initial body temp
suggests they haven't
been dead long.
Nine, ten hours at the most.
No rigor.
And look at this.
He's-he's clenching
the selfie stick.
So maybe a cadaveric spasm.
No, I'm wrong.
It's glued to his hand.
MUNDO:
The killer was kind enough
to leave us the camera.
RUSSELL:
Blood pool left a void,
suggesting that Nicole
was shot first at...
point-blank range.
RYAN: The shooter
needed the picture,
so Greg was held at gunpoint.
He dragged Nicole towards him,
was forced to take
a selfie.
And Greg was shot
in the head.
Splattered all over the wall.
MUNDO: Someone went through
an awful lot of trouble
to stage a photo
to post on PicThread.
RUSSELL:
For the second time,
right?
Pastor Harrison's murder
was staged also.
RYAN: Yeah, that's
what I don't get.
How are these victims
related to Pastor Harrison?
How are they connected?
RUSSELL:
Okay.
Got another QR code.
MUNDO:
There's your connection.
And maybe another victim.
(crying)
(pipe organ playing)
I'm so sorry
for your loss.
Thank you.
(crying)
(tapping keys)
KRUMITZ:
I did it.
I discovered how the photos
were blasted out
to over 200 million
PicThread users.
I found what's called
a force-follow bug attached
to Aiden Harrison's profile.
It's extra code
that forces anyone
that visits the pastor's page
to follow him automatically.
Then that code gets
copied to their profiles
and spreads to their followers
and so on and so forth.
It's like what happened with
MySpace all those years ago.
They had to shut down the site
to stop the bug from spreading.
This exploit is
much more complex
and grows way faster.
RUSSELL: So the more
Pastor Harrison posted,
the faster this
exploit spread.
KRUMITZ: Within 48 hours,
Aiden Harrison
was being followed
by everyone on PicThread.
And Nicole's profile
has the same code?
Yeah.
So can we search
for this bug on another
PicThread account?
Could lead us to our
next potential
victim.
We'd have to comb through
every account individually.
With over 200 million users,
I mean, that'd take...
Too long.
So the QR code
on Nicole's body
may be the only way
to find our next victim.
Dead or alive.
Nicole's QR code leads
to another Swedish site.
And we can't view the page
unless we link to it.
RYAN: Eh, we can't. Could send
out another gruesome photo
to every
PicThread user.
Yeah, well, I contacted
the Swedish hosting company,
but they're not
the most cooperative.
Kind of a...
Internet free speech
haven over there.
I'll call in
a favor and see
if I can get behind the site.
Raven, were you able to
find a connection between
Pastor Harrison and
Greg Roberts or Nicole Hogan?
Nothing we didn't already know.
Nicole Hogan and Pastor Harrison
are both on PicThread.
And Greg is on FriendAgenda
but barely ever posts.
What about e-mail or texts?
Nothing with
Pastor Harrison
but I did find texts
with Greg and Nicole.
They met
a few weeks ago,
and things started
to get flirty fast.
Nicole sent
naked photos
of herself.
Some of these photos were found
on Nicole's phone
at the crime scene.
Along with other photos
of Nicole
in bed
with various men.
RYAN: Like the photo the killer
posted of Greg and Nicole.
Yeah, they're called
sex selfies.
Yeah, it's a thing.
You know,
people take photos
during or after sex and...
just post 'em up on PicThread.
(chuckles)
N-No, I read... I read about it.
Online exhibitionism.
Whether for amusement or
sexual satisfaction, a lot of
people like playing porn star.
But if Nicole posted
these photos on PicThread,
they would've been removed
immediately.
Most social media sites have
very strict no nudity policies.
That's it, Raven.
That's the connection.
PicThread's content
abuse policy.
Nelson, can you pull up
the messages
the killer left us?
Mm-hmm.
(rapid keyboarding)
RYAN: “If you can't
say anything nice,
don't say anything at all.”
Pastor Harrison
was being punished
for saying something
that offended the target.
And Nicole Hogan was punished
for posting sex selfies.
RAMIREZ: “Some things
are better kept
behind closed doors”"
RYAN: Okay. Hate speech
and porn.
These are two of the five
main categories
of abuse on social media.
The FBI helped create the list
used by social media sites.
Hate speech, porn, violence,
drugs, and trolling.
Or as our killer
would call them, the Five
Deadly Sins of
Social Media.
♪ ♪
RYAN: We're looking at
a vigilante serial killer
in the Boston area,
who's targeting
PicThread users
who are violating
the content abuse policy.
The hashtag,
#GraphicWarning,
is trending. Message board
full of people talking
about the two photos.
RYAN: The target's getting
what he wants, exposure.
Which means we could be looking
at three more killings.
Well, hate speech
and porn are covered.
That leaves violence,
drugs, and trolling.
We have to figure out what's
next. We have to get ahead
of this before he kills again.
'Cause when he completes
these five categories,
our target
could disappear forever.
Well, according
to the PicThread activity log,
Pastor Harrison has had posts
removed for hate content,
and Nicole Hogan had posts
removed for violating
their sex and nudity clause.
RUSSELL:
So we're looking for
PicThread users
that have had posts removed
for-for violence, drugs,
and trolling.
One of them
is our next victim.
Yeah, but if the posts
are removed,
how does the target know
they existed?
NELSON:
He could have a back door
into PicThread's system.
Removed files
remain on their servers.
Wait, wait.
Our target
wouldn't have to intrude
into PicThread's system
if he worked there.
♪ ♪
Worldwide, we employ
around 600 content moderators.
80 in this office.
30 or so working
any given shift,
monitoring the site 24/7.
And their only job
is to remove posts
that violate PicThread's
abuse standards?
An algorithm flags potential
infractions: decapitations,
animal torture,
sexual solicitation.
The posts flagged
by the algorithm are then sent
here for our moderators
to either ignore or remove.
RYAN:
200 million users.
Seems like a big job.
It's a tough job.
Social media should be
a safe place for everyone.
Nobody should have to see
what comes across these screens.
Like this photo, for example.
Who would post
such a thing?
This photo violates
our no trolling policy.
KRUMITZ:
I'm gonna get down to I.T.,
see if I can get a list
of employee devices.
Do your employees undergo
psychometric testing
to evaluate their mental health
before they're hired?
Yes.
We have a mandatory review
of each employee
on a monthly basis.
We have
our own counselor on call.
Even with the best counseling,
looking at profoundly disturbing
images all day
is bound to take its toll.
I'd like to see those
evaluations of your employees,
past and present.
Of course.
♪ ♪
WOMAN:
I've been having nightmares.
Bolting awake
in the middle of the night.
But I need this job
to pay for my tuition.
MAN (echoing): What's
the worst thing I've ever seen?
It's hard to pick just one.
I mean...
beheading videos
are never easy.
WOMAN (echoing):
Angry?
Why would I seem angry?
Maybe because I'm starving,
but I can't eat
because this job makes me
sick to my stomach.
You know what?
Forget this place. I quit.
MAN 2:
Do I like this job?
I don't know.
Does anybody ever really
like their job?
I guess I do.
Hours are good,
pay is decent.
I only live a few miles away.
(echoing):
It's a job.
These are all the flagged posts
from the Boston area
relating to drugs,
trolling and violence.
And if I'm completely honest,
I still don't understand
what trolling is.
Basically, trolls are jerks.
Most are just annoying,
but some can do real damage.
Bullying kids into
committing suicide,
or blackmailing people
they meet online.
So in a way, they do evoke the
trolls of Scandinavian folklore.
They're antisocial,
they're angry,
dimwitted creatures that make
life difficult for travelers.
Jerks.
Jerks.
Look at that.
There are, like, thousands
of flagged posts. Now, how
are we gonna sort through all
of that to find our next victim?
And these are only
from the last 24 hours.
I can't even imagine having to
review these photos all day,
every day.
Definitely would mess with your head.
Mm.
Hey D.B.?
Yeah.
Think I got something here.
Avery got
the Swedish hosting company
to send me the HTML
of the target's site.
Now, it's unregistered,
so the target can stay
anonymous.
But check this out.
Next message
from Nicole's QR code.
RUSSELL: “Your next dose
could be lethal.”
Okay, all right,
so the next sin
is drugs.
(siren blaring)
(laughter
and indistinct chatter)
♪ Your skin shivers ♪
♪ Your lips quiver... ♪
How you doing over here?
You need another one?
No.
I need you to stay away
from my son and his family.
I'm sorry?
Elijah and Devon have worked
hard to save their marriage,
and my granddaughter
is the most important thing
in the world to me.
You're Elijah's dad, Cal.
No more phone calls,
no late night texts.
You hear me?
Pretty girl like you,
plenty of options.
(hits hand on bar)
Stay away from my son.
(people gasping)
Oh, my God.
Somebody call 911!
(everyone talking at once)
WOMAN:
Don't move his head.
(techno music playing)
♪ Do you feel that? ♪
♪ Can you feel that? ♪
♪ Uh! ♪
♪ Do you feel that? ♪
♪ Can you feel that? ♪
Jared Atchley,
Agent Ryan, FBI.
I'm here investigating
the two images that
were posted yesterday.
Do you know which pictures
I'm talking about?
The dead bodies?
(wry laugh)
You're not asking me
if they're real.
You learn to tell
the difference after a while.
I see you've worked
here for two years.
That's impressive.
Is it?
Isn't it? Most people hit the
wall after three or four months.
I play a lot of chess.
Does looking at these images
make you feel...
anxiety, depressed...?
Not anymore.
This changes you.
The photos?
Seeing proof
of the infinite variety
of human depravity.
Wondering what secrets
my neighbors are hiding
on their hard drives.
This job won't kill you,
but it'll give you
a much darker view of humanity.
NELSON: Killer's site was created
by someone at PicThread.
Just find the device
in the building
that uploaded the files,
and boom,
we know who the target is.
I'm telling you,
I'm on the network
staring at the Mac address
of the device
that uploaded the files.
All right,
then what's the problem?
It's not on the list of
devices assigned to employees.
All right, so the target
has spoofed his Mac address
to stay hidden. All right.
Look, man, you may have to check
every device
in the building by hand.
I know his device
is here somewhere.
I just can't see it.
Hold up. All right,
you can't see it,
but could you hear it?
Says in your file
that last year, you were
arrested for domestic violence.
They consider roommates to be
in a domestic relationship.
And you remember that fondly?
No. I'm on probation
because my roommate
threw the first punch,
but he's the one
that ended up in the hospital.
Avery...
Excuse me.
We may have a way to figure
out who we're looking for.
What did you find, Daniel?
The device that the target
used is somewhere here,
and I can't track it, but
I can communicate with it.
I can send it an audio
file and then a script
play automatically
through the speakers.
Like a phone ringing.
Yeah.
Oh. Did you send the file yet?
No, I need your authorization.
You have it.
Daniel, do it, go.
Okay, okay, okay, okay.
Here we go.
(phone ringing)
Wait. Wait.
That's not it.
(phone ringing in distance)
Okay, it's this way. Come on.
(phone ringing in distance)
(phone continues ringing)
This is it.
This is where the target
uploaded the files from.
Okay.
Here we go.
The target was definitely
using this computer.
Now let's just see which of
the employees logs in from here.
RYAN: Sasha Boyd.
Social media should be
a safe place for everyone.
Nobody should have to see
what comes across these screens.
Call Security.
Sasha Boyd is our target.
Okay, we know
Sasha Boyd's our target.
What's her next move?
You see the Web address
within the HTML?
That's the next photo
Sasha embedded into the site,
so the next victim, having
something to do with the drugs,
will be in that photo.
Okay, so can we view the photo
without triggering the
site to send it to every
PicThread user?
No.
Well, then what are you
so excited about?
Well, because the photo is geo-tagged,
just like the others.
I can pull the metadata off
the photo without viewing it...
And get the location
of our next victim
without Sasha knowing.
Bam.
Our next location.
RUSSELL: Let's do it, then
get the coordinates to Elijah.
(sirens blaring)
(knocking loudly)
AGENT:
FBI! Open up!
We got a pulse.
Get the EMTs in here!
AGENT:
Clear.
AGENT 2:
Landing clear!
AGENT 3:
This room's clear!
Ryan Kilmer, 32-year-old
photographer and heroin addict.
Ryan was given a hot-shot--
a lethal dose of heroin,
left to overdose about an hour
before we got here.
How's he holding up?
Uh, it was close,
but looks like he's gonna make it.
Good.
Sasha's like, what,
an hour ahead of us?
We'll keep you posted, Elijah.
All right, Ryan was part
of an online trend
known as the Junkies
of PicThread.
Users post photos
glamorizing their drug use.
RYAN: Sasha wanted
to teach him a lesson,
just like she did with Pastor
Harrison and Nicole Hogan.
She wanted to make examples
of them on social media.
Linking them all together with
the hashtag “Graphic Warning.”
I still can't believe
that Sasha's the target.
She seemed so normal, right?
Well, she must be
extremely damaged
from her time
as a content moderator.
You know,
in jobs like that,
it's not unusual
to have chronic PTSD.
It's similar to what
combat veterans experience.
It's very rare to have
a female serial killer.
They're usually
not this violent.
In her mind, she believes
that she's not doing this
for her own enjoyment.
She's a vigilante.
She really thinks
she's making the Internet safer.
So maybe that's
her Graphic Warning:
post photos like these,
you could be next.
♪ ♪
(panting)
SASHA: You went to
this boy's funeral
just to snap this photo.
Sometimes I wonder what
you people are thinking
when you post
stuff like this.
I really do.
Wh... What are
you gonna...
what are you
gonna do to me?
I'm teaching you a lesson, Toby.
I'm teaching
everyone a lesson.
What is this?
W-Why are you doing this?
Wha... Ah!
(screams, sobs)
Please...
P-Please...
Please, don't...
(screaming)
(gasping)
(sobbing)
(screams)
Huh?
Oh, you got that?
Oh, no.
I can't believe this is happening again.
I know!
All right, it wasn't me this time.
KRUMITZ: It's a photo of
our junkie, Ryan Kilmer.
Posted to his account.
We didn't scan the QR code,
so Sasha must have posted this.
What stopping her from
just posting the next photo?
Because there isn't one.
I got behind the site
from her last QR code,
and the next message is
“Please Don't Feed the Trolls,”
but... there's no photo.
Sasha's clues
have different themes,
but each one has
a signature photo.
So why doesn't this one
have a photo?
(phone buzzes)
Agent Mundo.
(sirens wailing in distance)
Yes, Cal Mundo is my father.
Why?
Hi.
Nina, what the hell
are you doing here?
Where's Devon?
They said my wife was here.
I had to tell 'em
I was your wife
so they'd let me stay
with your father.
Stay? Wha...
What were you doing with him
in the first place?
I saved
your father's life, Elijah.
He came to see me.
Why?
I don't know.
To talk, maybe?
I'm a pretty good listener.
Well, you used to
think so, anyway.
He said you
told him about me.
He was not very
friendly at first.
But then we started talking...
getting to know each other.
We were actually
having a really nice time.
And then, out of nowhere,
he just collapsed
and I had to give him CPR
until the paramedics came.
They said he might not have
made it had I not done that.
I'm sorry, Elijah.
I know how hard
this must be for you.
Nina, listen to me
very carefully.
I'm having you banned
from this hospital
and then I am filing
a restraining order.
If you call or text
or come within 50 feet
of anyone in my family--
anyone-- you will be arrested.
Do you understand?
I'm an agent with the FBI.
Don't test me.
I'm just trying to help you.
That's all I've ever
wanted to do-- I just...
I don't want your help!
I want you to leave.
Stay out of my life!
(sighs)
Well, we know that Sasha is in Boston.
RUSSELL: Right.
She's not gonna stop
until her message is complete.
Right, and we know
the next sin is Trolling.
But with no photo, that could
mean there's no victim yet.
Could be staging
her next murder as we speak.
Actually, that could be
how we find her.
Raven, uh,
log onto Sasha's
PicThread account.
Then click onto “followers”
and go to the “people
you may know” section.
Social media sites like
FriendAgenda and PicThread--
they use this,
uh, proximity-based
algorithm, right?
RAVEN: Right.
To determine who shows up
in this section.
They actually
suggest people
that you have
physically been around.
I downloaded the, uh,
PicThread app this morning
just to check it out.
Okay, so I have
zero followers, right?
So if I go to my
“people you may know” section,
(chuckling):
then...
(laughing): Oh...
Look at all of 'em.
And you, who are standing
right next to me,
are number one
on my list.
She was physically near
all of her victims while she was
staging their murders.
All right, so they would
show up in that section.
Yeah, already on it.
Pastor Harrison.
Nicole Hogan.
Ryan Kilmer.
So in order to figure out
who Sasha's
Trolling victim might be,
we need to...
All we need to do is cross-
reference the PicThread users
in the Boston area
who have been flagged
for trolling... with the users
of Sasha's
“people you may know.”
Toby Allen.
Sasha's
next victim.
You guys, his phone is on.
We have his location.
It's an abandoned theater.
And Sasha might be
right there with him.
Now, I'll only be gone
a couple of hours,
but it's very important
that you see every photo.
You can't miss one.
That's the job.
You look away for a
second and you can
miss something
that gets posted.
(muffled grunting)
Don't go anywhere, okay?
(grunting)
Toby, are you enjoying
those photos?
No!
RYAN:
Sasha, freeze! FBI!
Put the gun down!
Wow, I'm impressed.
How the hell did
you find me here?
We found Toby Allen.
He's now safely in our custody.
It's over, Sasha.
You will not harm
another innocent person.
Innocent?
A man preaching hate
instead of love?
A woman so full of herself
she documents everything,
no matter how indecent?
A heroin addict
glorifying his disease
and recruiting
other users?
And this one...
worst of all.
An Internet Troll
who taunts depressed teens
into committing suicide,
then posts doctored photos
mocking them
on their own memorial sites.
How sick is that?
It's wrong.
It's illegal and immoral.
But Sasha...
what you've done
is so much worse.
I have seen the worst images
flooding in.
All day.
Every day.
The solution...
isn't removing...
what gets posted.
It's preventing people
from violating
the five abuse standards
in the first place.
Sending a clear message
that such behavior
will not be tolerated!
Sasha...
what you saw was terrible.
You need help.
Drop that gun.
I can help you.
You're right.
You can help me.
By making sure
my message gets heard.
Sasha, no, no!
(gunshot)
(echoing): No!
(body thuds)
(indistinct police
radio communication)
MUNDO:
She's wearing a QR code.
Her plan was to die all along.
Kill Toby Allen,
then kill herself.
RYAN:
She was Violence.
Sasha posted gruesome
photos of her victims.
This was her fifth
and final message.
Well, if there are no more
bodies, what's the QR Code for?
Huh, that's weird.
What do you got?
Sasha's QR code
is a link to someone's
PicThread account.
Click on it.
KRUMITZ:
Avery, are you sure?
It could blast another photo.
It won't.
Whatever it links to
will be her final message.
All right.
(taps key)
RAVEN:
It's Sasha's profile.
RUSSELL: She posted something new
ten minutes ago.
How's that possible?
Could be time-released.
RUSSELL: “I died for you sins.
Keep social media clean.”
The press must have
leaked Sasha's name.
Check out those comments.
NELSON: Damn. People
are coming here to support her.
Calling the DOJ about getting
this profile taken down.
RUSSELL:
The last thing we need
are copycats.
(monitor beeping steadily)
I'm happy you came to see me
at the bar.
Even if you were so upset.
Gave me a chance
to see Elijah again.
Tragedy does really
bring people together.
I had to wear a wig
to sneak in and see you.
I hope you still know
it's me, Nina.
Hey, Dad.
and thank you for tuning in.
(muffled grunting nearby)
Today...
I'm gonna talk to you
about resisting temptation.
Now, we all know
the story from the Bible
of David and Goliath.
(muffled grunting continues)
Champion of the Philistines
versus a much smaller,
weaker opponent,
who simply had the courage
to face him.
(muffled panting)
You see...
David already knew
he had the victory.
He had God on his side.
(muffled grunting)
Goliath can be like that sin
in your life that is
most difficult for you
to overcome, but you...
you can be like David.
With God on your side...
you can slay your giant
and live a life free from sin.
(muffled grunting)
The only question is:
Which sin is your Goliath?
(muffled panting)
♪ ♪
(phones ringing, beeping;
overlapping conversations)
WOMAN: Did you get this?
MAN: Yeah. What is it?
I don't follow this person.
You got this?
What is this?
What's going on?
Is there an AMBER Alert?
Nothing came up on my phone.
It's an alert from PicThread.
Ah. Well, that
explains it--
I don't do social media.
NELSON: “New post from:
Homestead Harrison”?
I don't follow anyone
named Homestead Harrison.
Neither do I.
RYAN: Well, it looks like
this guy sent an alert
to everyone here.
What the...? Raven, are
you seeing this photo?
No, it's not just everyone
in this room.
Every single user on PicThread
received this photo.
Is this a hoax?
No.
Lividity,
coloring in his fingertips,
purple suggests death, so...
either someone's paying
a lot of attention to detail,
or that guy's definitely dead.
Who posted this?
Um...
Aiden Harrison.
Profile says he lives in Boston.
Check it out.
This post is geo-tagged.
MUNDO:
You have to choose to show
your location on PicThread--
the app doesn't do it for you.
RYAN: So this Aiden Harrison--
he wanted us
to know where
this photo was taken.
NELSON: Geo-tag says
it's a church in Boston.
(sirens wailing, whooping)
♪ ♪
MUNDO: It's Aiden Harrison.
Looks like
he's been here a while.
Two or three days,
just from the...
looks and smell of it.
The church is
being renovated.
Bought the killer time
before he sent the photo.
(phone chimes)
Raven just got
a notification from VICAP.
He was reported missing a week ago.
MUNDO: Killer must have
hijacked his PicThread account.
Why wait to post this picture
till this morning?
And why post it at all?
This is a mess.
There's blood
and bodily fluids
on the ports,
soaked all the way
through to the keyboard.
I'm gonna take everything
back to CTOC,
see if I can retrieve some data.
RUSSELL:
Okey-dokey. (grunts)
Upsy-daisy.
(others groaning)
Oh, snap.
Well, first things first.
The guy's tongue
has been cut out.
Choked to death
on his own blood.
Is that a tattoo?
RUSSELL:
Yeah, it's a... QR code.
Could be a clue
from our killer.
(slow techno music playing)
♪ Way from me... ♪
♪ Way from me... ♪
♪ Way from me... ♪
♪ Way from me... ♪
♪ Way from me... ♪
♪ Way from me... ♪
♪ Way... ♪
(music ends)
(voice breaking):
He was a good man.
A good father.
A good husband.
Please keep us in your prayers.
Whoever did this
will have to stand before God
and be judged.
RUSSELL:
I can't imagine
losing a loved one
and then finding out about it
on social media
MUNDO: PicThread removed the photo,
but it's already gone viral--
it's all over the Internet.
Will be forever.
Raven, were you able
to establish how
that photo was sent to every user?
Well, it's weird.
Everyone-- and I mean
every PicThread subscriber--
was following Pastor Harrison.
RUSSELL:
I know preaching online
is like the pulpit
of the 21st century,
but that's insane--
that many followers?
MUNDO: Yeah, some
of the most popular
televangelists have only
four or five million.
RAMIREZ: Pastor Harrison's been using
social media for years.
And last week he had
80,000 followers
on PicThread, but today...
he has just over
200 million followers.
How is that possible?
I don't know yet.
It's got to be a hack.
Wait, look at this.
(rapidly keyboarding)
He recently started posting
about overturning laws
on gay marriage
and protesting abortion clinics.
So, that's interesting, right?
If you take a strong stance
against politicized topics,
it makes a bigger
splash online.
Recruit a hell of a lot
more followers that way.
Yeah, but a controversial post
can make people angry.
MUNDO:
Maybe even get you killed.
(typing)
What'd you find, Nelson?
Normal QR code.
Like the ones in all
the magazine ads-- only this one
is linked to a Web site
with a Swedish domain.
Check this out.
Now...
when I scan the QR code
that we found
on Pastor Harrison,
the image sensor on my phone
reads the data--
in this case, a Web address.
RYAN: So what's on the Web site
that that links to?
I have no idea.
I just know the address.
Well, maybe it's
a phishing site
or maybe it dumps malware
onto the network.
Yeah, but see, I'm thinking of
setting up a isolated connection
to scan the QR code, then we
can see what's on the site.
This phone will be
the only device
that's exposed.
Do it.
A'ight.
That's what I'm talkin' 'bout.
♪ ♪
Okay, so the only print
I could get off the laptop
belonged to Pastor Harrison.
Well, and before it was covered
in bloody guts and goo,
this was a brand-new laptop.
There's only one user-generated
file in the entire hard drive.
RUSSELL:
“If you can't say anything nice,
don't say anything at all.”
And this wasn't
copied and pasted-- look.
There's typos
in some of the lines--
gets worse as it goes.
When was this document created?
Time stamp says...
three days ago.
So that was after
Pastor Harrison
was reported missing.
So he was taped to the chair
and forced to type this
over and over again.
There's 10,000
lines here.
Even typing 60 words a minute,
that'd take... days.
Someone wanted
to teach him a lesson.
(overlapping conversations,
phones ringing and beeping)
Oh, really? I don't know.
All right,
let's find Avery.
MAN:
I don't know.
Whoa, have you seen this?
I don't know. How...
Whoa.
This can't be a coincidence.
We just got another photo.
Yeah, I saw.
Another staged murder sent
to everyone on PicThread?
As soon as
we scanned the QR code
and linked to the site,
this message appeared.
RUSSELL: “Some things are better
kept behind closed doors.”
Then everyone's
phone went off
with the new
PicThread alert.
So something we did
triggered the release?
So we're looking at one,
maybe two more victims here.
KRUMITZ: Hashtag
#Graphic Warning.
Same as the other photo.
So our target wants us to know
this is connected
to the last killing.
(scoffs)
This is like the Zodiac Killer
sending letters to the press.
RYAN: We've got a serial killer
who's taunting us
on social media.
♪ CSI Cyber 2x16 ♪
5 Deadly Sins
Original Air Date on March 6, 2016
♪ I know you've deceived me,
now here's a surprise ♪
♪ I know that you have, 'cause
there's magic in my eyes ♪
♪ I can see
for miles and miles ♪
♪ I can see for miles
and miles ♪
♪ I can see
for miles and miles ♪
♪ And miles... ♪
♪ Oh, yeah. ♪
My phone has been
ringing off the hook
about photos
on PicThread.
The president's own children
received them.
He called me himself
for answers.
I'm hoping you have some.
Both photos were geo-tagged.
Local law enforcement
are on their way
to the second location.
We're not far behind.
And I understand
our Cyber Division
is responsible
for the second photo being released?
When that page loaded
here at CTOC, it ran a script
that automatically posted
the next photo to PicThread.
The target wanted the FBI to be
responsible for sending it out.
I promise you, this
will not happen again.
Good.
(indistinct chatter)
(elevator bell dings)
♪ ♪
Aw, come on,
you can't spare
an hour for your old man?
Dad, I'm so sorry. I...
You have to cancel
our lunch.
This case just
came in. It's...
I understand.
But, uh... can we
talk for a minute?
It's important.
Yeah. Yeah.
Um... come on.
You okay?
Still have cancer.
Chemo sucks.
Otherwise, I'm fine.
It's about you and Devon.
The other day, when
I was with Michelle,
she said...
“Mommy and Daddy
have been fighting”"
It's nothing for you to be...
Who's Nina?
Michelle mentioned her.
Nina is a bartender
at Conaghan's Pub.
Why? What did Michelle say
about Nina?
She heard her name
when you were fighting.
Are you having an affair?
Dad...
You can be honest
with me, son.
Come on.
No.
I'm trying
to make it work with Devon.
A few months ago,
I-I went to Conaghan's Pub
a couple times. Nina was
working there. We chatted.
Next thing I know,
she's become friends with Devon,
she's trying to come between us.
Oh, hey.
Hey.
Perfect timing. We were just
about to sit down for dinner.
This is my friend Nina,
from spin class.
She's gonna join us.
NINA:
Devon, this is so crazy.
Elijah and I actually
know each other.
He comes to my bar
all the time.
You see what's going on here?
You see what she started?
Elijah, is there something more
you want to tell me?
The woman is delusional.
And then, out of nowhere,
the other night, she texted me.
Devon saw the text
come through.
You know, it was a thing.
But it's fine. We're fine.
Hmm.
You sure?
Yeah.
Don't worry about it.
Dinner this weekend?
Why not tonight?
Flying to Boston.
♪ ♪
MUNDO: Nicole Hogan,
24 years old,
third-year
graduate student.
This is her place.
Photo was posted to her account.
Greg Roberts, 25.
He lives across town.
No PicThread account that we
could find. Initial body temp
suggests they haven't
been dead long.
Nine, ten hours at the most.
No rigor.
And look at this.
He's-he's clenching
the selfie stick.
So maybe a cadaveric spasm.
No, I'm wrong.
It's glued to his hand.
MUNDO:
The killer was kind enough
to leave us the camera.
RUSSELL:
Blood pool left a void,
suggesting that Nicole
was shot first at...
point-blank range.
RYAN: The shooter
needed the picture,
so Greg was held at gunpoint.
He dragged Nicole towards him,
was forced to take
a selfie.
And Greg was shot
in the head.
Splattered all over the wall.
MUNDO: Someone went through
an awful lot of trouble
to stage a photo
to post on PicThread.
RUSSELL:
For the second time,
right?
Pastor Harrison's murder
was staged also.
RYAN: Yeah, that's
what I don't get.
How are these victims
related to Pastor Harrison?
How are they connected?
RUSSELL:
Okay.
Got another QR code.
MUNDO:
There's your connection.
And maybe another victim.
(crying)
(pipe organ playing)
I'm so sorry
for your loss.
Thank you.
(crying)
(tapping keys)
KRUMITZ:
I did it.
I discovered how the photos
were blasted out
to over 200 million
PicThread users.
I found what's called
a force-follow bug attached
to Aiden Harrison's profile.
It's extra code
that forces anyone
that visits the pastor's page
to follow him automatically.
Then that code gets
copied to their profiles
and spreads to their followers
and so on and so forth.
It's like what happened with
MySpace all those years ago.
They had to shut down the site
to stop the bug from spreading.
This exploit is
much more complex
and grows way faster.
RUSSELL: So the more
Pastor Harrison posted,
the faster this
exploit spread.
KRUMITZ: Within 48 hours,
Aiden Harrison
was being followed
by everyone on PicThread.
And Nicole's profile
has the same code?
Yeah.
So can we search
for this bug on another
PicThread account?
Could lead us to our
next potential
victim.
We'd have to comb through
every account individually.
With over 200 million users,
I mean, that'd take...
Too long.
So the QR code
on Nicole's body
may be the only way
to find our next victim.
Dead or alive.
Nicole's QR code leads
to another Swedish site.
And we can't view the page
unless we link to it.
RYAN: Eh, we can't. Could send
out another gruesome photo
to every
PicThread user.
Yeah, well, I contacted
the Swedish hosting company,
but they're not
the most cooperative.
Kind of a...
Internet free speech
haven over there.
I'll call in
a favor and see
if I can get behind the site.
Raven, were you able to
find a connection between
Pastor Harrison and
Greg Roberts or Nicole Hogan?
Nothing we didn't already know.
Nicole Hogan and Pastor Harrison
are both on PicThread.
And Greg is on FriendAgenda
but barely ever posts.
What about e-mail or texts?
Nothing with
Pastor Harrison
but I did find texts
with Greg and Nicole.
They met
a few weeks ago,
and things started
to get flirty fast.
Nicole sent
naked photos
of herself.
Some of these photos were found
on Nicole's phone
at the crime scene.
Along with other photos
of Nicole
in bed
with various men.
RYAN: Like the photo the killer
posted of Greg and Nicole.
Yeah, they're called
sex selfies.
Yeah, it's a thing.
You know,
people take photos
during or after sex and...
just post 'em up on PicThread.
(chuckles)
N-No, I read... I read about it.
Online exhibitionism.
Whether for amusement or
sexual satisfaction, a lot of
people like playing porn star.
But if Nicole posted
these photos on PicThread,
they would've been removed
immediately.
Most social media sites have
very strict no nudity policies.
That's it, Raven.
That's the connection.
PicThread's content
abuse policy.
Nelson, can you pull up
the messages
the killer left us?
Mm-hmm.
(rapid keyboarding)
RYAN: “If you can't
say anything nice,
don't say anything at all.”
Pastor Harrison
was being punished
for saying something
that offended the target.
And Nicole Hogan was punished
for posting sex selfies.
RAMIREZ: “Some things
are better kept
behind closed doors”"
RYAN: Okay. Hate speech
and porn.
These are two of the five
main categories
of abuse on social media.
The FBI helped create the list
used by social media sites.
Hate speech, porn, violence,
drugs, and trolling.
Or as our killer
would call them, the Five
Deadly Sins of
Social Media.
♪ ♪
RYAN: We're looking at
a vigilante serial killer
in the Boston area,
who's targeting
PicThread users
who are violating
the content abuse policy.
The hashtag,
#GraphicWarning,
is trending. Message board
full of people talking
about the two photos.
RYAN: The target's getting
what he wants, exposure.
Which means we could be looking
at three more killings.
Well, hate speech
and porn are covered.
That leaves violence,
drugs, and trolling.
We have to figure out what's
next. We have to get ahead
of this before he kills again.
'Cause when he completes
these five categories,
our target
could disappear forever.
Well, according
to the PicThread activity log,
Pastor Harrison has had posts
removed for hate content,
and Nicole Hogan had posts
removed for violating
their sex and nudity clause.
RUSSELL:
So we're looking for
PicThread users
that have had posts removed
for-for violence, drugs,
and trolling.
One of them
is our next victim.
Yeah, but if the posts
are removed,
how does the target know
they existed?
NELSON:
He could have a back door
into PicThread's system.
Removed files
remain on their servers.
Wait, wait.
Our target
wouldn't have to intrude
into PicThread's system
if he worked there.
♪ ♪
Worldwide, we employ
around 600 content moderators.
80 in this office.
30 or so working
any given shift,
monitoring the site 24/7.
And their only job
is to remove posts
that violate PicThread's
abuse standards?
An algorithm flags potential
infractions: decapitations,
animal torture,
sexual solicitation.
The posts flagged
by the algorithm are then sent
here for our moderators
to either ignore or remove.
RYAN:
200 million users.
Seems like a big job.
It's a tough job.
Social media should be
a safe place for everyone.
Nobody should have to see
what comes across these screens.
Like this photo, for example.
Who would post
such a thing?
This photo violates
our no trolling policy.
KRUMITZ:
I'm gonna get down to I.T.,
see if I can get a list
of employee devices.
Do your employees undergo
psychometric testing
to evaluate their mental health
before they're hired?
Yes.
We have a mandatory review
of each employee
on a monthly basis.
We have
our own counselor on call.
Even with the best counseling,
looking at profoundly disturbing
images all day
is bound to take its toll.
I'd like to see those
evaluations of your employees,
past and present.
Of course.
♪ ♪
WOMAN:
I've been having nightmares.
Bolting awake
in the middle of the night.
But I need this job
to pay for my tuition.
MAN (echoing): What's
the worst thing I've ever seen?
It's hard to pick just one.
I mean...
beheading videos
are never easy.
WOMAN (echoing):
Angry?
Why would I seem angry?
Maybe because I'm starving,
but I can't eat
because this job makes me
sick to my stomach.
You know what?
Forget this place. I quit.
MAN 2:
Do I like this job?
I don't know.
Does anybody ever really
like their job?
I guess I do.
Hours are good,
pay is decent.
I only live a few miles away.
(echoing):
It's a job.
These are all the flagged posts
from the Boston area
relating to drugs,
trolling and violence.
And if I'm completely honest,
I still don't understand
what trolling is.
Basically, trolls are jerks.
Most are just annoying,
but some can do real damage.
Bullying kids into
committing suicide,
or blackmailing people
they meet online.
So in a way, they do evoke the
trolls of Scandinavian folklore.
They're antisocial,
they're angry,
dimwitted creatures that make
life difficult for travelers.
Jerks.
Jerks.
Look at that.
There are, like, thousands
of flagged posts. Now, how
are we gonna sort through all
of that to find our next victim?
And these are only
from the last 24 hours.
I can't even imagine having to
review these photos all day,
every day.
Definitely would mess with your head.
Mm.
Hey D.B.?
Yeah.
Think I got something here.
Avery got
the Swedish hosting company
to send me the HTML
of the target's site.
Now, it's unregistered,
so the target can stay
anonymous.
But check this out.
Next message
from Nicole's QR code.
RUSSELL: “Your next dose
could be lethal.”
Okay, all right,
so the next sin
is drugs.
(siren blaring)
(laughter
and indistinct chatter)
♪ Your skin shivers ♪
♪ Your lips quiver... ♪
How you doing over here?
You need another one?
No.
I need you to stay away
from my son and his family.
I'm sorry?
Elijah and Devon have worked
hard to save their marriage,
and my granddaughter
is the most important thing
in the world to me.
You're Elijah's dad, Cal.
No more phone calls,
no late night texts.
You hear me?
Pretty girl like you,
plenty of options.
(hits hand on bar)
Stay away from my son.
(people gasping)
Oh, my God.
Somebody call 911!
(everyone talking at once)
WOMAN:
Don't move his head.
(techno music playing)
♪ Do you feel that? ♪
♪ Can you feel that? ♪
♪ Uh! ♪
♪ Do you feel that? ♪
♪ Can you feel that? ♪
Jared Atchley,
Agent Ryan, FBI.
I'm here investigating
the two images that
were posted yesterday.
Do you know which pictures
I'm talking about?
The dead bodies?
(wry laugh)
You're not asking me
if they're real.
You learn to tell
the difference after a while.
I see you've worked
here for two years.
That's impressive.
Is it?
Isn't it? Most people hit the
wall after three or four months.
I play a lot of chess.
Does looking at these images
make you feel...
anxiety, depressed...?
Not anymore.
This changes you.
The photos?
Seeing proof
of the infinite variety
of human depravity.
Wondering what secrets
my neighbors are hiding
on their hard drives.
This job won't kill you,
but it'll give you
a much darker view of humanity.
NELSON: Killer's site was created
by someone at PicThread.
Just find the device
in the building
that uploaded the files,
and boom,
we know who the target is.
I'm telling you,
I'm on the network
staring at the Mac address
of the device
that uploaded the files.
All right,
then what's the problem?
It's not on the list of
devices assigned to employees.
All right, so the target
has spoofed his Mac address
to stay hidden. All right.
Look, man, you may have to check
every device
in the building by hand.
I know his device
is here somewhere.
I just can't see it.
Hold up. All right,
you can't see it,
but could you hear it?
Says in your file
that last year, you were
arrested for domestic violence.
They consider roommates to be
in a domestic relationship.
And you remember that fondly?
No. I'm on probation
because my roommate
threw the first punch,
but he's the one
that ended up in the hospital.
Avery...
Excuse me.
We may have a way to figure
out who we're looking for.
What did you find, Daniel?
The device that the target
used is somewhere here,
and I can't track it, but
I can communicate with it.
I can send it an audio
file and then a script
play automatically
through the speakers.
Like a phone ringing.
Yeah.
Oh. Did you send the file yet?
No, I need your authorization.
You have it.
Daniel, do it, go.
Okay, okay, okay, okay.
Here we go.
(phone ringing)
Wait. Wait.
That's not it.
(phone ringing in distance)
Okay, it's this way. Come on.
(phone ringing in distance)
(phone continues ringing)
This is it.
This is where the target
uploaded the files from.
Okay.
Here we go.
The target was definitely
using this computer.
Now let's just see which of
the employees logs in from here.
RYAN: Sasha Boyd.
Social media should be
a safe place for everyone.
Nobody should have to see
what comes across these screens.
Call Security.
Sasha Boyd is our target.
Okay, we know
Sasha Boyd's our target.
What's her next move?
You see the Web address
within the HTML?
That's the next photo
Sasha embedded into the site,
so the next victim, having
something to do with the drugs,
will be in that photo.
Okay, so can we view the photo
without triggering the
site to send it to every
PicThread user?
No.
Well, then what are you
so excited about?
Well, because the photo is geo-tagged,
just like the others.
I can pull the metadata off
the photo without viewing it...
And get the location
of our next victim
without Sasha knowing.
Bam.
Our next location.
RUSSELL: Let's do it, then
get the coordinates to Elijah.
(sirens blaring)
(knocking loudly)
AGENT:
FBI! Open up!
We got a pulse.
Get the EMTs in here!
AGENT:
Clear.
AGENT 2:
Landing clear!
AGENT 3:
This room's clear!
Ryan Kilmer, 32-year-old
photographer and heroin addict.
Ryan was given a hot-shot--
a lethal dose of heroin,
left to overdose about an hour
before we got here.
How's he holding up?
Uh, it was close,
but looks like he's gonna make it.
Good.
Sasha's like, what,
an hour ahead of us?
We'll keep you posted, Elijah.
All right, Ryan was part
of an online trend
known as the Junkies
of PicThread.
Users post photos
glamorizing their drug use.
RYAN: Sasha wanted
to teach him a lesson,
just like she did with Pastor
Harrison and Nicole Hogan.
She wanted to make examples
of them on social media.
Linking them all together with
the hashtag “Graphic Warning.”
I still can't believe
that Sasha's the target.
She seemed so normal, right?
Well, she must be
extremely damaged
from her time
as a content moderator.
You know,
in jobs like that,
it's not unusual
to have chronic PTSD.
It's similar to what
combat veterans experience.
It's very rare to have
a female serial killer.
They're usually
not this violent.
In her mind, she believes
that she's not doing this
for her own enjoyment.
She's a vigilante.
She really thinks
she's making the Internet safer.
So maybe that's
her Graphic Warning:
post photos like these,
you could be next.
♪ ♪
(panting)
SASHA: You went to
this boy's funeral
just to snap this photo.
Sometimes I wonder what
you people are thinking
when you post
stuff like this.
I really do.
Wh... What are
you gonna...
what are you
gonna do to me?
I'm teaching you a lesson, Toby.
I'm teaching
everyone a lesson.
What is this?
W-Why are you doing this?
Wha... Ah!
(screams, sobs)
Please...
P-Please...
Please, don't...
(screaming)
(gasping)
(sobbing)
(screams)
Huh?
Oh, you got that?
Oh, no.
I can't believe this is happening again.
I know!
All right, it wasn't me this time.
KRUMITZ: It's a photo of
our junkie, Ryan Kilmer.
Posted to his account.
We didn't scan the QR code,
so Sasha must have posted this.
What stopping her from
just posting the next photo?
Because there isn't one.
I got behind the site
from her last QR code,
and the next message is
“Please Don't Feed the Trolls,”
but... there's no photo.
Sasha's clues
have different themes,
but each one has
a signature photo.
So why doesn't this one
have a photo?
(phone buzzes)
Agent Mundo.
(sirens wailing in distance)
Yes, Cal Mundo is my father.
Why?
Hi.
Nina, what the hell
are you doing here?
Where's Devon?
They said my wife was here.
I had to tell 'em
I was your wife
so they'd let me stay
with your father.
Stay? Wha...
What were you doing with him
in the first place?
I saved
your father's life, Elijah.
He came to see me.
Why?
I don't know.
To talk, maybe?
I'm a pretty good listener.
Well, you used to
think so, anyway.
He said you
told him about me.
He was not very
friendly at first.
But then we started talking...
getting to know each other.
We were actually
having a really nice time.
And then, out of nowhere,
he just collapsed
and I had to give him CPR
until the paramedics came.
They said he might not have
made it had I not done that.
I'm sorry, Elijah.
I know how hard
this must be for you.
Nina, listen to me
very carefully.
I'm having you banned
from this hospital
and then I am filing
a restraining order.
If you call or text
or come within 50 feet
of anyone in my family--
anyone-- you will be arrested.
Do you understand?
I'm an agent with the FBI.
Don't test me.
I'm just trying to help you.
That's all I've ever
wanted to do-- I just...
I don't want your help!
I want you to leave.
Stay out of my life!
(sighs)
Well, we know that Sasha is in Boston.
RUSSELL: Right.
She's not gonna stop
until her message is complete.
Right, and we know
the next sin is Trolling.
But with no photo, that could
mean there's no victim yet.
Could be staging
her next murder as we speak.
Actually, that could be
how we find her.
Raven, uh,
log onto Sasha's
PicThread account.
Then click onto “followers”
and go to the “people
you may know” section.
Social media sites like
FriendAgenda and PicThread--
they use this,
uh, proximity-based
algorithm, right?
RAVEN: Right.
To determine who shows up
in this section.
They actually
suggest people
that you have
physically been around.
I downloaded the, uh,
PicThread app this morning
just to check it out.
Okay, so I have
zero followers, right?
So if I go to my
“people you may know” section,
(chuckling):
then...
(laughing): Oh...
Look at all of 'em.
And you, who are standing
right next to me,
are number one
on my list.
She was physically near
all of her victims while she was
staging their murders.
All right, so they would
show up in that section.
Yeah, already on it.
Pastor Harrison.
Nicole Hogan.
Ryan Kilmer.
So in order to figure out
who Sasha's
Trolling victim might be,
we need to...
All we need to do is cross-
reference the PicThread users
in the Boston area
who have been flagged
for trolling... with the users
of Sasha's
“people you may know.”
Toby Allen.
Sasha's
next victim.
You guys, his phone is on.
We have his location.
It's an abandoned theater.
And Sasha might be
right there with him.
Now, I'll only be gone
a couple of hours,
but it's very important
that you see every photo.
You can't miss one.
That's the job.
You look away for a
second and you can
miss something
that gets posted.
(muffled grunting)
Don't go anywhere, okay?
(grunting)
Toby, are you enjoying
those photos?
No!
RYAN:
Sasha, freeze! FBI!
Put the gun down!
Wow, I'm impressed.
How the hell did
you find me here?
We found Toby Allen.
He's now safely in our custody.
It's over, Sasha.
You will not harm
another innocent person.
Innocent?
A man preaching hate
instead of love?
A woman so full of herself
she documents everything,
no matter how indecent?
A heroin addict
glorifying his disease
and recruiting
other users?
And this one...
worst of all.
An Internet Troll
who taunts depressed teens
into committing suicide,
then posts doctored photos
mocking them
on their own memorial sites.
How sick is that?
It's wrong.
It's illegal and immoral.
But Sasha...
what you've done
is so much worse.
I have seen the worst images
flooding in.
All day.
Every day.
The solution...
isn't removing...
what gets posted.
It's preventing people
from violating
the five abuse standards
in the first place.
Sending a clear message
that such behavior
will not be tolerated!
Sasha...
what you saw was terrible.
You need help.
Drop that gun.
I can help you.
You're right.
You can help me.
By making sure
my message gets heard.
Sasha, no, no!
(gunshot)
(echoing): No!
(body thuds)
(indistinct police
radio communication)
MUNDO:
She's wearing a QR code.
Her plan was to die all along.
Kill Toby Allen,
then kill herself.
RYAN:
She was Violence.
Sasha posted gruesome
photos of her victims.
This was her fifth
and final message.
Well, if there are no more
bodies, what's the QR Code for?
Huh, that's weird.
What do you got?
Sasha's QR code
is a link to someone's
PicThread account.
Click on it.
KRUMITZ:
Avery, are you sure?
It could blast another photo.
It won't.
Whatever it links to
will be her final message.
All right.
(taps key)
RAVEN:
It's Sasha's profile.
RUSSELL: She posted something new
ten minutes ago.
How's that possible?
Could be time-released.
RUSSELL: “I died for you sins.
Keep social media clean.”
The press must have
leaked Sasha's name.
Check out those comments.
NELSON: Damn. People
are coming here to support her.
Calling the DOJ about getting
this profile taken down.
RUSSELL:
The last thing we need
are copycats.
(monitor beeping steadily)
I'm happy you came to see me
at the bar.
Even if you were so upset.
Gave me a chance
to see Elijah again.
Tragedy does really
bring people together.
I had to wear a wig
to sneak in and see you.
I hope you still know
it's me, Nina.
Hey, Dad.