1
00:00:01,540 --> 00:00:02,887
My name is Avery Ryan.
2
00:00:03,310 --> 00:00:04,822
I was a victim of cyber crime.
3
00:00:05,397 --> 00:00:07,936
Like you, I posted
on social media,
4
00:00:07,938 --> 00:00:10,749
checked my bank account
balance online,
5
00:00:10,751 --> 00:00:12,137
even kept
the confidential files
6
00:00:12,138 --> 00:00:14,817
of my psychological practice
on my computer.
7
00:00:16,124 --> 00:00:19,054
Then I was hacked,
and as a result,
8
00:00:19,056 --> 00:00:21,693
one of my patients
was murdered.
9
00:00:21,695 --> 00:00:24,071
My investigation into her death
led me to the FBI,
10
00:00:24,073 --> 00:00:26,914
where I joined a team
of cyber experts
11
00:00:26,916 --> 00:00:29,890
to wage a war against
a new breed of criminal
12
00:00:29,892 --> 00:00:32,829
hiding on the Deep Web...
13
00:00:32,831 --> 00:00:36,167
infiltrating our daily lives
in ways we never imagined...
14
00:00:37,534 --> 00:00:39,705
...faceless...
15
00:00:39,707 --> 00:00:41,443
nameless...
16
00:00:41,445 --> 00:00:43,081
lurking inside our devices,
17
00:00:43,083 --> 00:00:45,889
just a keystroke away.
18
00:01:17,575 --> 00:01:19,742
Danny...
19
00:01:19,744 --> 00:01:21,510
It's all right. It's...
20
00:01:21,512 --> 00:01:23,779
Come... come join me
and your brother.
21
00:01:45,369 --> 00:01:46,402
Good evening, Detroit.
22
00:01:46,404 --> 00:01:47,570
This is your eye in the sky.
23
00:01:47,572 --> 00:01:49,305
It appears a portion
of the downtown area
24
00:01:49,307 --> 00:01:51,106
is experiencing a power outage.
25
00:01:51,108 --> 00:01:54,210
Traffic in the area is
at an absolute standstill.
26
00:01:54,212 --> 00:01:56,512
Police are on the scene
to manage any outbreaks
27
00:01:56,514 --> 00:01:57,713
of violence or looting.
28
00:01:57,715 --> 00:01:59,482
However, thus far
only a handful
29
00:01:59,484 --> 00:02:02,451
of minor incidents
have been reported.
30
00:02:05,256 --> 00:02:07,189
I've got
25 blocks
31
00:02:07,191 --> 00:02:08,357
of downtown Detroit in the dark.
32
00:02:08,359 --> 00:02:10,092
Backup systems
are completely unresponsive.
33
00:02:10,094 --> 00:02:11,794
You guys sure this is
a case for the FBI?
34
00:02:11,796 --> 00:02:14,296
We're FBI Cyber, this is
exactly our kind of case.
35
00:02:14,298 --> 00:02:16,799
From what we can tell, you're
experiencing a cyber intrusion.
36
00:02:16,801 --> 00:02:19,134
Your power grid's
been hacked.
37
00:02:19,136 --> 00:02:22,004
We just got an update
from Detroit River Electric,
38
00:02:22,006 --> 00:02:23,772
and they're still working
on the power outage
39
00:02:23,774 --> 00:02:25,174
in the downtown area.
40
00:02:56,507 --> 00:02:57,606
Uh...
41
00:02:57,608 --> 00:02:59,141
The smart grid allows
for complete control
42
00:02:59,143 --> 00:03:01,010
of the city's entire power
supply from this room.
43
00:03:01,012 --> 00:03:02,411
Right now,
someone else is in control.
44
00:03:02,413 --> 00:03:04,580
SCADA systems like this
should be impenetrable.
45
00:03:04,582 --> 00:03:06,448
But someone remotely hacked in,
46
00:03:06,450 --> 00:03:07,883
then locked out
every computer here
47
00:03:07,885 --> 00:03:09,351
by erasing the startup disk.
48
00:03:09,353 --> 00:03:10,319
Even if you two successfully
49
00:03:10,321 --> 00:03:12,321
recover the disk
and reboot the system
50
00:03:12,323 --> 00:03:14,123
you'll still have
to counter-hack the target
51
00:03:14,125 --> 00:03:15,424
to get the power back on.
52
00:03:15,426 --> 00:03:16,959
Yeah, we're halfway
there already.
53
00:03:16,961 --> 00:03:19,094
The odd thing
about all this
54
00:03:19,096 --> 00:03:21,297
is the blackout affects
only 25 blocks.
55
00:03:21,299 --> 00:03:22,965
When I hacked
the New Hampshire grid,
56
00:03:22,967 --> 00:03:24,466
I took out the whole state.
57
00:03:24,468 --> 00:03:25,734
Oh, so we bragging now?
58
00:03:25,736 --> 00:03:26,835
No, no.
59
00:03:26,837 --> 00:03:28,037
Raven's asking
the right question.
60
00:03:28,039 --> 00:03:31,540
Why limit this power outage
to such a focused area?
61
00:03:31,542 --> 00:03:33,709
A hacker's objective
is usually
62
00:03:33,711 --> 00:03:35,444
to affect as many
people as possible.
63
00:03:35,446 --> 00:03:38,013
This was a precision attack.
64
00:03:38,015 --> 00:03:39,848
There will be another phase
to this outage.
65
00:03:39,850 --> 00:03:42,518
He's using the SCADA attack
as camouflage.
66
00:03:42,520 --> 00:03:44,720
The faster we get
those lights on,
67
00:03:44,722 --> 00:03:45,888
the sooner we will uncover
68
00:03:45,890 --> 00:03:47,456
what our target's
true intentions are.
69
00:03:49,961 --> 00:03:51,026
Really?
70
00:03:51,028 --> 00:03:52,761
The whole state
of New Hampshire, huh?
71
00:03:53,998 --> 00:03:55,631
I wanted a three-day weekend.
72
00:03:57,034 --> 00:03:58,834
Hey, by the way...
Yo.
73
00:03:58,836 --> 00:04:01,303
...happy two-month
anniversary.
74
00:04:01,305 --> 00:04:02,438
We dating?
75
00:04:02,440 --> 00:04:04,840
No, stupid.
76
00:04:04,842 --> 00:04:05,975
Two months
77
00:04:05,977 --> 00:04:07,610
at the Cyber Crime Division.
78
00:04:07,612 --> 00:04:09,612
You're officially
79
00:04:09,614 --> 00:04:10,779
in the family.
80
00:04:10,781 --> 00:04:12,114
Don't mess up.
81
00:04:12,116 --> 00:04:13,616
I want you to stick around.
82
00:04:19,890 --> 00:04:23,192
Got a live feed to the Emergency
Operation Bureau's incident map.
83
00:04:23,194 --> 00:04:24,693
The blackout is affecting
the central hub of the city,
84
00:04:24,695 --> 00:04:26,629
both the government and
the financial districts.
85
00:04:26,631 --> 00:04:28,497
Our target could be looking
to hit the federal building,
86
00:04:28,499 --> 00:04:30,933
district court,
city jail,
87
00:04:30,935 --> 00:04:32,267
baseball stadium,
three banks
88
00:04:32,269 --> 00:04:33,869
or countless privately
owned businesses.
89
00:04:33,871 --> 00:04:36,672
Power outage is a great way
to disable security alarms.
90
00:04:36,674 --> 00:04:38,107
There are several incidents
of traffic gridlock.
91
00:04:38,109 --> 00:04:41,010
Whatever our hacker's doing,
92
00:04:41,012 --> 00:04:41,944
he's gonna want
to make a getaway.
93
00:04:41,946 --> 00:04:43,712
So let's focus on the buildings
94
00:04:43,714 --> 00:04:46,081
on the fringe of the blacked out
area of the city.
95
00:04:46,083 --> 00:04:47,650
Locations still in the dark
96
00:04:47,652 --> 00:04:49,418
but where the target won't
get caught in the traffic jam
97
00:04:49,420 --> 00:04:51,420
caused by the blackout
while trying to flee.
98
00:04:51,422 --> 00:04:53,489
And let's rule out any area
that borders the rail line.
99
00:04:53,491 --> 00:04:56,325
It's a bad idea
to cross the tracks
100
00:04:56,327 --> 00:04:59,662
and risk getting trapped
behind a closed train crossing.
101
00:04:59,664 --> 00:05:01,463
Hey, guys, we're back online!
102
00:05:06,570 --> 00:05:07,836
We're back in control,
103
00:05:07,838 --> 00:05:09,204
but the lights still aren't on.
104
00:05:09,206 --> 00:05:10,873
Yeah, that's gonna
take a minute.
105
00:05:10,875 --> 00:05:12,574
Our hacker's still active
in the system.
106
00:05:12,576 --> 00:05:14,910
Raven's writing a patch
to seal the intrusion.
107
00:05:14,912 --> 00:05:16,111
Wait a minute.
108
00:05:16,113 --> 00:05:17,479
If he's still active
in the system,
109
00:05:17,481 --> 00:05:19,448
that means he needs to maintain
a live connection
110
00:05:19,450 --> 00:05:21,016
to the power station
for some reason.
111
00:05:21,018 --> 00:05:23,719
Nelson, can you inject malicious
code into Raven's patch?
112
00:05:23,721 --> 00:05:26,655
Infiltrate his laptop
before you boot him off.
113
00:05:26,657 --> 00:05:28,157
Tag him so we can track him.
114
00:05:28,159 --> 00:05:29,625
If he uses that computer again,
115
00:05:29,627 --> 00:05:30,926
we'll know where he is.
116
00:05:30,928 --> 00:05:33,996
We may get a location
and possibly his identity.
117
00:05:33,998 --> 00:05:35,564
I want that power on
118
00:05:35,566 --> 00:05:36,899
and that hacker
in handcuffs.
119
00:05:36,901 --> 00:05:38,367
You got it boss, I'm on it.
120
00:05:59,790 --> 00:06:01,824
Yeah, Pa,
power's still out.
121
00:06:01,826 --> 00:06:03,726
I'm just gonna
check out the store.
122
00:06:30,154 --> 00:06:31,186
Hey!
123
00:06:31,188 --> 00:06:32,387
Who the hell are you?!
124
00:06:49,907 --> 00:06:52,975
Police responded
to the security alarm,
125
00:06:52,977 --> 00:06:55,043
found the store owner's son,
126
00:06:55,045 --> 00:06:58,180
Benjamin Christos, shot dead.
127
00:06:58,182 --> 00:07:00,415
Single father, two children.
128
00:07:00,417 --> 00:07:01,950
Was he here when
the power went out,
129
00:07:01,952 --> 00:07:03,285
Detective Dorn?
130
00:07:03,287 --> 00:07:04,386
Store wasn't open today.
131
00:07:04,388 --> 00:07:05,954
We figured he came to
protect the property
132
00:07:05,956 --> 00:07:07,356
against possible
looters--
133
00:07:07,358 --> 00:07:08,590
interrupted
the robbery.
134
00:07:08,592 --> 00:07:10,659
It's an auto safe dialer.
135
00:07:10,661 --> 00:07:12,494
It cycles through
every possible combination
136
00:07:12,496 --> 00:07:13,962
till it lands
on the right one.
137
00:07:13,964 --> 00:07:15,898
All the thief
needed was time.
138
00:07:15,900 --> 00:07:17,332
Explains why
the computer maintained
139
00:07:17,334 --> 00:07:19,468
a live connection
to the power grid.
140
00:07:19,470 --> 00:07:20,702
Had to ensure
that the lights
141
00:07:20,704 --> 00:07:21,670
and the alarm systems
142
00:07:21,672 --> 00:07:22,838
stayed off.
143
00:07:22,840 --> 00:07:23,972
Looks like
the power outage
144
00:07:23,974 --> 00:07:25,474
was masking
a jewelry store robbery.
145
00:07:25,476 --> 00:07:28,343
Well, what did they take?
146
00:07:28,345 --> 00:07:30,579
From what we can tell,
147
00:07:30,581 --> 00:07:32,181
the thief left empty-handed.
148
00:07:32,183 --> 00:07:33,183
We do know
149
00:07:33,184 --> 00:07:35,050
most of the jewelry's
on consignment.
150
00:07:35,052 --> 00:07:36,198
The Christos
don't own it.
151
00:07:36,199 --> 00:07:37,157
That computer...
152
00:07:37,181 --> 00:07:39,189
It was in the vault
when first responders arrived.
153
00:07:39,190 --> 00:07:41,690
Why lock a computer
in a vault?
154
00:07:41,692 --> 00:07:44,526
Well, there's one way
to find out.
155
00:07:46,831 --> 00:07:48,263
Somebody went to
all this trouble--
156
00:07:48,265 --> 00:07:49,598
they even
killed a man--
157
00:07:49,600 --> 00:07:51,400
to leave with
absolutely nothing?
158
00:07:51,402 --> 00:07:52,501
I'm not buying it.
159
00:07:52,503 --> 00:07:53,969
All right.
160
00:07:53,971 --> 00:07:55,404
No modem installed,
no way to connect
161
00:07:55,406 --> 00:07:56,972
to the Internet.
162
00:07:56,974 --> 00:07:58,574
There's only
one thing on it.
163
00:07:58,576 --> 00:08:00,809
A bitcoin account
with a zero balance.
164
00:08:00,811 --> 00:08:03,011
This wasn't a jewel heist.
165
00:08:03,013 --> 00:08:05,047
This was a bitcoin heist.
166
00:08:05,049 --> 00:08:06,715
Ben came down
167
00:08:06,717 --> 00:08:08,550
to check on the store.
168
00:08:08,552 --> 00:08:10,619
The blackout...
169
00:08:10,621 --> 00:08:12,154
I should've come with him.
170
00:08:12,156 --> 00:08:14,456
But he talked me out of it.
171
00:08:14,458 --> 00:08:16,325
There was a computer
in the vault.
172
00:08:16,327 --> 00:08:17,860
It's the bitcoin computer.
173
00:08:17,862 --> 00:08:19,695
Benjamin's idea.
174
00:08:19,697 --> 00:08:22,364
I really don't understand it.
175
00:08:22,366 --> 00:08:24,466
But he was
so passionate.
176
00:08:24,468 --> 00:08:27,536
He said bitcoin was
the currency of the future.
177
00:08:27,538 --> 00:08:29,838
Ben was taking over
the family business
178
00:08:29,840 --> 00:08:34,109
and I promised I would
trust his judgment.
179
00:08:34,111 --> 00:08:36,311
But now...
180
00:08:36,313 --> 00:08:39,248
my son was killed
over... over this...
181
00:08:39,250 --> 00:08:41,116
this imaginary currency?
182
00:08:42,853 --> 00:08:44,853
Do you know
how many bitcoins you had?
183
00:08:46,624 --> 00:08:48,690
Almost half
a million dollars' worth.
184
00:08:48,692 --> 00:08:50,692
Most of our
retirement.
185
00:08:50,694 --> 00:08:53,695
In order to access
186
00:08:53,697 --> 00:08:55,030
and steal your bitcoin,
187
00:08:55,032 --> 00:08:56,932
the thief would have needed
the passkey to your account.
188
00:08:56,934 --> 00:09:00,669
And it was stored
on the computer in the vault.
189
00:09:00,671 --> 00:09:02,204
Who else knew it was there?
190
00:09:06,343 --> 00:09:07,376
Ellis, no.
191
00:09:07,378 --> 00:09:08,911
He wouldn't.
192
00:09:08,913 --> 00:09:10,178
Stephen.
193
00:09:10,180 --> 00:09:11,380
Our oldest son.
194
00:09:11,382 --> 00:09:14,416
He was supposed to take
over the business, but...
195
00:09:14,418 --> 00:09:17,319
Ben had so much more ambition.
196
00:09:17,321 --> 00:09:18,854
Drive.
197
00:09:18,856 --> 00:09:22,157
I-I begged them both
to run it together,
198
00:09:22,159 --> 00:09:24,660
but the boys didn't
see eye to eye.
199
00:09:24,662 --> 00:09:25,894
Thank you both.
200
00:09:26,697 --> 00:09:29,731
We'll be in touch.
201
00:09:32,002 --> 00:09:33,368
Bad blood between brothers.
202
00:09:33,370 --> 00:09:35,137
Half a million dollars
at stake.
203
00:09:35,139 --> 00:09:37,139
And Stephen would have known
that taking the bitcoin
204
00:09:37,141 --> 00:09:39,074
over of the jewelry
was hassle-free.
205
00:09:39,076 --> 00:09:41,143
Transfer it from one
account to another,
206
00:09:41,145 --> 00:09:42,644
it's... well,
almost untraceable.
207
00:09:42,646 --> 00:09:43,879
No serial numbers.
208
00:09:43,881 --> 00:09:44,813
Nothing to fence.
209
00:09:44,815 --> 00:09:46,048
Sounds like we
have to have
210
00:09:46,050 --> 00:09:48,283
a little chat with
Stephen Christos.
211
00:09:48,285 --> 00:09:50,085
When the power came back on,
212
00:09:50,087 --> 00:09:52,454
so did the jewelry store's
security camera.
213
00:09:59,430 --> 00:10:00,462
Is this Stephen?
214
00:10:00,464 --> 00:10:02,764
No.
215
00:10:02,766 --> 00:10:05,267
I have never seen that man
before in my life.
216
00:10:05,269 --> 00:10:06,868
Is this the man
who murdered our son?
217
00:10:06,870 --> 00:10:09,972
Took our grandchildren's
father from them?
218
00:10:09,974 --> 00:10:11,540
Now we have a face.
219
00:10:11,542 --> 00:10:14,209
We just need a name.
220
00:10:22,286 --> 00:10:25,587
So, no luck identifying
our bitcoin thief, huh?
221
00:10:25,589 --> 00:10:26,888
No, sir.
222
00:10:26,890 --> 00:10:28,290
Ran the facial recognition.
223
00:10:28,292 --> 00:10:29,758
Big dead end.
224
00:10:29,760 --> 00:10:31,159
Guy's not in the FBI database.
225
00:10:31,161 --> 00:10:34,062
But the bitcoins have
provided an interesting lead.
226
00:10:34,064 --> 00:10:37,933
The biggest misconception
about bitcoins
227
00:10:37,935 --> 00:10:38,967
is that it's anonymous.
228
00:10:38,969 --> 00:10:40,102
I mean, that's why it's
229
00:10:40,104 --> 00:10:41,703
the preferred currency
of the Deep Web.
230
00:10:41,705 --> 00:10:44,506
It's used to fund
drug deals, hit men,
231
00:10:44,508 --> 00:10:47,843
human trafficking, but it's
not actually that anonymous.
232
00:10:47,845 --> 00:10:49,144
Is this a bitcoin lecture
233
00:10:49,146 --> 00:10:50,479
or did you make
an actually discovery here?
234
00:10:50,481 --> 00:10:52,247
Oh, right. Sorry.
235
00:10:52,249 --> 00:10:54,516
I accessed the block chain,
236
00:10:54,518 --> 00:10:57,319
which is a public ledger that
records every bitcoin spent.
237
00:10:57,321 --> 00:10:58,620
Every cent's accounted for--
where it came from
238
00:10:58,622 --> 00:11:00,155
and where it went.
239
00:11:00,157 --> 00:11:01,556
And each transaction is listed
240
00:11:01,558 --> 00:11:03,425
as a long sequence
of randomized numbers.
241
00:11:03,427 --> 00:11:04,393
Ah.
242
00:11:04,395 --> 00:11:06,228
So you can't tie
it to a person,
243
00:11:06,230 --> 00:11:08,330
but you can tie it
to an account, right?
244
00:11:08,332 --> 00:11:10,365
So, it's like
a stock market transaction.
245
00:11:10,367 --> 00:11:11,366
I mean, you can see
somebody bought
246
00:11:11,368 --> 00:11:12,834
200 shares
of a commodity.
247
00:11:12,836 --> 00:11:14,069
You just don't know who.
248
00:11:14,071 --> 00:11:15,670
Exactly!
249
00:11:15,672 --> 00:11:16,972
But if you know the amount
that you're looking for,
250
00:11:16,974 --> 00:11:18,840
you can find any
bitcoin transaction
251
00:11:18,842 --> 00:11:20,342
that's ever been made.
252
00:11:20,344 --> 00:11:21,576
Even when it's stolen,
253
00:11:21,578 --> 00:11:23,745
there is a record of
the bitcoin movement.
254
00:11:23,747 --> 00:11:24,980
All you need is the amount,
255
00:11:24,982 --> 00:11:28,250
date and time.
256
00:11:28,252 --> 00:11:29,651
So, this is last
night's robbery.
257
00:11:29,653 --> 00:11:30,986
What we're looking at
258
00:11:30,988 --> 00:11:32,421
is our thief's bitcoin account.
259
00:11:32,423 --> 00:11:34,156
1,208 bitcoins.
260
00:11:34,158 --> 00:11:36,992
As of today, worth just shy
261
00:11:36,994 --> 00:11:38,560
of 500,000 U.S. dollars.
262
00:11:38,562 --> 00:11:39,995
Now, of course,
the bitcoin market
263
00:11:39,997 --> 00:11:42,364
fluctuates so dramatically
264
00:11:42,366 --> 00:11:43,899
that this many bitcoins
could very be easily be worth
265
00:11:43,901 --> 00:11:46,368
over a million dollars
in the very near future.
266
00:11:46,370 --> 00:11:48,403
Explains why someone went
to such lengths to steal it.
267
00:11:48,405 --> 00:11:50,038
Mm-hmm.
268
00:11:50,040 --> 00:11:53,575
So, what digital dust can we
follow here to catch our thief?
269
00:11:53,577 --> 00:11:54,976
Well, every bitcoin account
is protected
270
00:11:54,978 --> 00:11:57,345
by a 64-character passkey.
271
00:11:57,347 --> 00:12:00,749
And if you have the passkey,
you can unlock the account.
272
00:12:00,751 --> 00:12:02,350
And whoever has the
passkey to this account
273
00:12:02,352 --> 00:12:04,553
is probably our killer.
274
00:12:08,492 --> 00:12:10,125
Well, that's odd.
275
00:12:10,127 --> 00:12:13,595
Our thief's bitcoin account is
protected by two passkeys.
276
00:12:13,597 --> 00:12:15,297
Typically, it's just the one.
277
00:12:15,299 --> 00:12:17,065
Yeah, it's like
a safe deposit box.
278
00:12:17,067 --> 00:12:19,501
It requires two
keys to open it.
279
00:12:19,503 --> 00:12:21,770
Which might just imply
280
00:12:21,772 --> 00:12:25,640
our bitcoin thief has
an accomplice.
281
00:12:25,642 --> 00:12:27,109
Hey, guys!
282
00:12:27,111 --> 00:12:29,044
The malicious track worked.
283
00:12:29,046 --> 00:12:31,379
I pinpointed the exact location
of the bitcoin thief's computer.
284
00:12:31,381 --> 00:12:32,781
This is Agent Elijah Mundo.
285
00:12:32,783 --> 00:12:36,418
I need a SWAT team
at 5280 Clinton Place.
286
00:13:08,986 --> 00:13:11,286
- Clear!
- Well, there's our thief.
287
00:13:11,288 --> 00:13:14,122
Looks like we're not
288
00:13:14,124 --> 00:13:16,391
the only ones interested
in stolen bitcoins.
289
00:13:17,340 --> 00:13:21,340
♪ CSI Cyber 1x12 ♪
Bit by Bit
Original Air Date on May 13, 2015
290
00:13:21,365 --> 00:13:27,802
♪ I know you've deceived me,
now here's a surprise ♪
291
00:13:29,373 --> 00:13:35,177
♪ I know that you have, 'cause
there's magic in my eyes ♪
292
00:13:35,179 --> 00:13:39,347
♪ I can see
for miles and miles ♪
293
00:13:39,349 --> 00:13:42,684
♪ I can see for miles
and miles ♪
294
00:13:42,686 --> 00:13:47,355
♪ I can see
for miles and miles ♪
295
00:13:47,357 --> 00:13:50,792
♪ And miles... ♪
296
00:13:50,794 --> 00:13:53,361
♪ Oh, yeah. ♪
297
00:13:53,385 --> 00:13:59,885
== sync, corrected by elderman ==
@elder_man
298
00:14:11,688 --> 00:14:13,288
All right. Thanks, bud.
299
00:14:13,290 --> 00:14:14,315
All right.
300
00:14:14,316 --> 00:14:16,325
Krumitz ran the name we got
off the victim's I.D.
301
00:14:16,383 --> 00:14:19,784
We are looking at the infamous
Brian Kramer.
302
00:14:19,785 --> 00:14:21,618
Apparently he made
a living robbing
303
00:14:21,620 --> 00:14:23,987
large bitcoin accounts he
found on the block chain.
304
00:14:23,989 --> 00:14:25,355
This was his fifth.
305
00:14:25,357 --> 00:14:26,657
Tracked charitable contributions
306
00:14:26,659 --> 00:14:29,927
from bitcoin accounts
to find his targets.
307
00:14:29,929 --> 00:14:31,028
Laceration
308
00:14:31,030 --> 00:14:32,563
of the throat looks like COD.
309
00:14:32,565 --> 00:14:33,797
He bled out, but over here,
310
00:14:33,799 --> 00:14:36,700
it looks like our
victim was sliced open.
311
00:14:36,702 --> 00:14:38,101
And patched up multiple times.
312
00:14:38,103 --> 00:14:41,572
He was tortured.
313
00:14:41,574 --> 00:14:43,974
Closed the wounds
with Super Glue.
314
00:14:43,976 --> 00:14:45,409
Battlefield first aid.
315
00:14:45,411 --> 00:14:48,779
It's commonly used by people
with military training.
316
00:14:48,781 --> 00:14:49,980
Torture the victim
and patch him up.
317
00:14:49,982 --> 00:14:51,815
Keep him live
long enough to talk.
318
00:14:51,817 --> 00:14:54,451
Detroit PD is still trying
to locate Stephen Christos.
319
00:14:54,453 --> 00:14:56,420
Hasn't answered calls
from his family.
320
00:14:56,422 --> 00:14:58,455
We can't wait this out.
Track his cell phone.
321
00:14:58,457 --> 00:14:59,723
Get a GPS location on him.
322
00:14:59,725 --> 00:15:00,824
Okay, got it.
323
00:15:00,826 --> 00:15:02,559
Hard drive's been removed.
324
00:15:02,561 --> 00:15:03,727
Whoever did that to him was
325
00:15:03,729 --> 00:15:05,596
definitely after
the stolen bitcoins.
326
00:15:05,598 --> 00:15:07,998
If they had the hard drive,
why torture him?
327
00:15:08,000 --> 00:15:10,500
'Cause the passkey wasn't
on the hard drive.
328
00:15:12,705 --> 00:15:15,272
Door was barricaded
by the dresser.
329
00:15:15,274 --> 00:15:16,873
Bought our victim a little time.
330
00:15:16,875 --> 00:15:18,308
Long enough for our thief
331
00:15:18,310 --> 00:15:20,577
to take the passkey
out of the computer.
332
00:15:20,579 --> 00:15:22,312
Bad guy breaks through the door.
333
00:15:22,314 --> 00:15:24,781
Tries to access
the bitcoin account, he can't.
334
00:15:24,783 --> 00:15:25,949
Tortures the thief
335
00:15:25,951 --> 00:15:27,751
for the passkey.
Sounds good.
336
00:15:27,753 --> 00:15:29,353
Unfortunately,
it's all speculation.
337
00:15:29,355 --> 00:15:31,288
The answers died
with his laptop.
338
00:15:31,290 --> 00:15:33,890
Not necessarily.
339
00:15:33,892 --> 00:15:36,493
Took the hard drive,
but not the RAM chip.
340
00:15:36,495 --> 00:15:38,195
Still might be a way
to get some answers.
341
00:15:38,197 --> 00:15:39,796
RAM keeps track of the programs
342
00:15:39,798 --> 00:15:41,098
your computer's running
while it's on.
343
00:15:41,100 --> 00:15:44,101
The moment the computer
loses power...
344
00:15:44,103 --> 00:15:45,502
the RAM starts to forget.
345
00:15:45,504 --> 00:15:47,004
Information decays.
346
00:15:47,006 --> 00:15:48,839
Freezing it...
347
00:15:49,441 --> 00:15:50,974
...stops the process.
348
00:15:52,344 --> 00:15:54,177
Most people don't go to a bar
349
00:15:54,179 --> 00:15:55,512
after they find out
350
00:15:55,514 --> 00:15:57,781
their brother's been murdered
and their family robbed.
351
00:15:57,783 --> 00:15:59,750
I needed a drink, okay?
352
00:15:59,752 --> 00:16:01,685
I would imagine so.
353
00:16:01,687 --> 00:16:03,687
What are you implying?
354
00:16:05,557 --> 00:16:07,357
Why don't you tell us
about these e-mails, Stephen?
355
00:16:07,359 --> 00:16:10,160
We accessed your phone.
356
00:16:10,162 --> 00:16:13,196
You got a call at 6:17
from your mother.
357
00:16:13,198 --> 00:16:14,231
She told you about the break-in
358
00:16:14,233 --> 00:16:15,666
and that your brother
had been murdered.
359
00:16:15,668 --> 00:16:17,534
Even though
360
00:16:17,536 --> 00:16:19,136
your brother was dead,
all you cared about
361
00:16:19,138 --> 00:16:20,804
was the money.
362
00:16:20,806 --> 00:16:22,306
'Cause the next thing you did
363
00:16:22,308 --> 00:16:23,507
was check the balance
364
00:16:23,509 --> 00:16:25,409
of the store's bitcoin account.
365
00:16:25,411 --> 00:16:27,344
You found it at zero.
366
00:16:27,346 --> 00:16:30,714
I knew those damn bitcoins
were a bad idea.
367
00:16:30,716 --> 00:16:32,516
Unregulated,
368
00:16:32,518 --> 00:16:34,318
uninsurable, I...
369
00:16:34,320 --> 00:16:35,852
tried to warn my parents
370
00:16:35,854 --> 00:16:37,721
and my brother--
I said bitcoins
371
00:16:37,723 --> 00:16:39,823
are too risky.
372
00:16:39,825 --> 00:16:41,258
If they get stolen,
they're gone.
373
00:16:41,260 --> 00:16:42,559
You can't get them back.
374
00:16:42,561 --> 00:16:45,062
But you tried to get them back.
375
00:16:45,064 --> 00:16:47,698
Four hours ago...
you contacted
376
00:16:47,700 --> 00:16:49,266
bounty hunters by e-mail
377
00:16:49,268 --> 00:16:52,369
and negotiated a price to
recover the stolen bitcoins.
378
00:16:52,371 --> 00:16:54,504
Did you really think bitcoin
bounty hunters were the answer
379
00:16:54,506 --> 00:16:55,706
to all your problems?
380
00:16:55,708 --> 00:16:57,174
You'll get the money back,
381
00:16:57,176 --> 00:16:59,576
then... you can take over.
382
00:16:59,578 --> 00:17:03,146
My parents had just lost a son!
383
00:17:03,148 --> 00:17:04,581
And now they were staring
at poverty.
384
00:17:04,583 --> 00:17:06,083
Did they tell you
they used their retirement
385
00:17:06,085 --> 00:17:07,884
to keep the business afloat?
386
00:17:07,886 --> 00:17:10,754
That my brother's bright idea
was to convert
387
00:17:10,756 --> 00:17:12,389
to bitcoin?! No.
388
00:17:12,391 --> 00:17:15,325
I'd imagine they didn't.
389
00:17:15,327 --> 00:17:18,428
After all the years
of hard work,
390
00:17:18,430 --> 00:17:20,964
all they gave up,
391
00:17:20,966 --> 00:17:22,899
the only thing
I could think to do
392
00:17:22,901 --> 00:17:25,001
was get the money back.
393
00:17:25,003 --> 00:17:26,370
For them.
394
00:17:26,372 --> 00:17:27,871
Not me.
395
00:17:27,873 --> 00:17:29,406
Look at that.
396
00:17:29,408 --> 00:17:30,774
You see that?
397
00:17:30,776 --> 00:17:33,777
That's the work
of the men you hired.
398
00:17:33,779 --> 00:17:37,013
Do they look like the kind
of men who give back money?
399
00:17:37,015 --> 00:17:39,716
We need information.
400
00:17:39,718 --> 00:17:41,518
All I have is a Web site.
401
00:17:41,520 --> 00:17:43,053
And I had an e-mail address.
402
00:17:43,055 --> 00:17:44,521
That's it.
403
00:17:44,523 --> 00:17:46,857
They said they would contact me.
404
00:17:46,859 --> 00:17:48,925
These are incredibly
dangerous men, Stephen.
405
00:17:48,927 --> 00:17:50,727
They lurk in the Deep Web.
406
00:17:50,729 --> 00:17:53,029
In a world you can't even
begin to imagine.
407
00:17:53,031 --> 00:17:55,399
They've already killed one man.
408
00:17:55,401 --> 00:17:58,702
You have started something
you can't undo.
409
00:18:00,939 --> 00:18:02,739
Bounty hunters' Web site
and e-mail address
410
00:18:02,741 --> 00:18:04,307
are a wild goose chase.
411
00:18:04,309 --> 00:18:05,442
Well, that's no surprise.
412
00:18:05,444 --> 00:18:06,777
These bounty hunters specialize
413
00:18:06,779 --> 00:18:08,044
in bitcoin retrieval.
414
00:18:08,046 --> 00:18:09,713
They think of themselves
as elites.
415
00:18:09,715 --> 00:18:11,915
They're skilled,
educated, tech-savvy.
416
00:18:11,917 --> 00:18:14,651
So we can't bet on them
making any mistakes.
417
00:18:14,653 --> 00:18:16,253
It gets worse.
Our bitcoin thief
418
00:18:16,255 --> 00:18:18,221
was no bozo, either.
419
00:18:18,223 --> 00:18:20,223
We got the results
from the degraded images
420
00:18:20,225 --> 00:18:22,659
we recovered from
the thief's computer RAM.
421
00:18:22,661 --> 00:18:24,461
This is
422
00:18:24,463 --> 00:18:26,196
a botnet-- a massive group
423
00:18:26,198 --> 00:18:28,498
of maliciously infected
personal computers--
424
00:18:28,500 --> 00:18:31,468
or bots-- from all around the
country harnessed together.
425
00:18:31,470 --> 00:18:34,538
Basically, it's a network
of computers used for evil.
426
00:18:34,540 --> 00:18:36,606
But the people who own
the computers have no idea
427
00:18:36,608 --> 00:18:38,308
that they're part
of an evil empire.
428
00:18:38,310 --> 00:18:40,644
After the computers
are infected, the hacker
429
00:18:40,646 --> 00:18:43,079
has full control over every
single computer on the network.
430
00:18:43,081 --> 00:18:44,281
That's roughly...
431
00:18:44,283 --> 00:18:45,482
20,000?
432
00:18:45,484 --> 00:18:48,051
Unsavory characters,
like our dead thief,
433
00:18:48,053 --> 00:18:51,121
rent out their botnets
to send spam e-mails,
434
00:18:51,123 --> 00:18:54,257
perform DDoS attacks,
mass identity theft.
435
00:18:54,259 --> 00:18:55,826
You know, all that
good illegal stuff.
436
00:18:55,828 --> 00:18:57,394
Can you tell if our thief
437
00:18:57,396 --> 00:18:59,296
connected to the botnet
before the bounty hunters
438
00:18:59,298 --> 00:19:01,698
broke down that motel room door?
439
00:19:01,700 --> 00:19:03,099
What?
440
00:19:03,101 --> 00:19:04,367
What?
441
00:19:04,369 --> 00:19:05,769
What is it, Krumitz?
442
00:19:05,771 --> 00:19:08,205
He sent two separate messages
to two separate computers
443
00:19:08,207 --> 00:19:09,873
somewhere in the botnet.
444
00:19:09,875 --> 00:19:11,341
It must've been the passkeys.
445
00:19:11,343 --> 00:19:13,009
Like a bank robber hiding
his stash until the heat
446
00:19:13,011 --> 00:19:15,178
dies down and he can
recover it and get away.
447
00:19:15,180 --> 00:19:17,781
Are you saying two random
computers-- two in 20,000--
448
00:19:17,783 --> 00:19:20,550
are secretly storing
the passkeys.
449
00:19:20,552 --> 00:19:22,085
And the owners don't know it.
450
00:19:22,087 --> 00:19:23,153
That's not the bad part.
451
00:19:23,155 --> 00:19:24,621
The RAM got us to the botnet.
452
00:19:24,623 --> 00:19:26,122
But it was far
too degraded to tell me
453
00:19:26,124 --> 00:19:27,457
which of these
two people have them.
454
00:19:27,459 --> 00:19:29,893
But the bounty hunters have
the thief's hard drive.
455
00:19:29,895 --> 00:19:31,361
And that means
456
00:19:31,363 --> 00:19:33,697
they know which two people
have the passkeys.
457
00:19:33,699 --> 00:19:35,565
They have the digital
treasure map.
458
00:19:35,567 --> 00:19:38,935
So, two innocent people have
no idea what's coming to them.
459
00:19:38,937 --> 00:19:41,271
And we have no way
of warning them.
460
00:20:07,332 --> 00:20:08,772
Hey, what are you doing
in my house?!
461
00:20:17,743 --> 00:20:18,542
Hey!
462
00:20:23,348 --> 00:20:24,915
You get what we came for?
463
00:20:24,917 --> 00:20:27,050
Yeah, I got the passkey.
464
00:20:27,052 --> 00:20:30,253
One more passkey and
we're a half mil richer.
465
00:20:44,563 --> 00:20:45,729
You got Krumitz.
466
00:20:45,731 --> 00:20:46,897
Hold on, Krummy,
let me transfer you to CTOC.
467
00:20:46,899 --> 00:20:48,265
This came for you, Nelson.
468
00:20:48,267 --> 00:20:49,216
What's this?
469
00:20:49,217 --> 00:20:51,484
Don't know.
A judge won't typically hand out
470
00:20:51,486 --> 00:20:52,986
a warrant on the evidence
we have.
471
00:20:52,988 --> 00:20:54,287
The RAM was too degraded.
472
00:20:54,289 --> 00:20:56,723
But I pleaded my case and
got us into the server farm
473
00:20:56,725 --> 00:20:59,125
housing the botnet's
command and control server.
474
00:20:59,127 --> 00:21:00,693
I got Krumitz on the big screen.
475
00:21:00,695 --> 00:21:02,162
So, tell me we have names.
476
00:21:02,164 --> 00:21:04,497
Performing
a live acquisition now.
477
00:21:04,499 --> 00:21:06,766
We are seconds away from having
the same information
478
00:21:06,768 --> 00:21:08,568
the bounty hunters do.
479
00:21:08,570 --> 00:21:09,969
The server has a record
of every interaction
480
00:21:09,971 --> 00:21:11,104
the thieves made
with the botnet.
481
00:21:11,106 --> 00:21:12,172
If we don't catch
482
00:21:12,174 --> 00:21:14,674
our targets before they get
those passkeys,
483
00:21:14,676 --> 00:21:16,242
the Christos' savings
will be gone forever.
484
00:21:16,244 --> 00:21:17,911
Every cent they have.
485
00:21:17,913 --> 00:21:20,146
Every minute counts, and
we're behind already.
486
00:21:20,148 --> 00:21:22,448
Something's wrong here.
487
00:21:22,450 --> 00:21:24,450
Uh, hold on.
488
00:21:24,452 --> 00:21:25,885
What is it, Daniel?
489
00:21:29,858 --> 00:21:31,324
He's been disconnected.
490
00:21:31,326 --> 00:21:33,693
I need a win off
that server, Krumitz.
491
00:21:33,695 --> 00:21:35,395
The drive's
completely corrupted.
492
00:21:35,397 --> 00:21:38,064
From the look of it,
someone did this deliberately.
493
00:21:38,066 --> 00:21:40,066
The bounty hunters are covering
their tracks. Damn it.
494
00:21:40,068 --> 00:21:42,035
Deleted is recoverable,
but the drive
495
00:21:42,037 --> 00:21:44,070
is being overwritten;
everything is gone.
496
00:21:44,072 --> 00:21:45,238
I've been monitoring
497
00:21:45,240 --> 00:21:46,372
Stephen Christos'
e-mail activity.
498
00:21:46,374 --> 00:21:48,041
Bounty hunters
499
00:21:48,043 --> 00:21:49,409
just sent a new message.
500
00:21:49,411 --> 00:21:50,810
Due to unforeseen complications,
501
00:21:50,812 --> 00:21:53,112
they're upping their price.
502
00:21:53,114 --> 00:21:54,647
Unforeseen complications.
503
00:21:54,649 --> 00:21:56,149
That what they're calling murder
these days?
504
00:21:56,151 --> 00:21:57,250
They made a mistake.
505
00:21:57,252 --> 00:21:59,852
The computer they sent
this e-mail from
506
00:21:59,854 --> 00:22:02,021
had a parental control program
designed to go unnoticed.
507
00:22:02,023 --> 00:22:05,124
Bounty hunters would have no way
of knowing it was there.
508
00:22:05,126 --> 00:22:06,626
Parental controls are installed
509
00:22:06,628 --> 00:22:08,328
so parents can monitor
their children on the Internet.
510
00:22:08,330 --> 00:22:10,630
It tags everything coming in
and going out.
511
00:22:13,568 --> 00:22:14,801
Simon, if there's
parental controls,
512
00:22:14,803 --> 00:22:16,035
it means there's children there.
513
00:22:16,037 --> 00:22:17,136
Yeah, I hear you.
514
00:22:17,138 --> 00:22:19,973
Yes! Parental controls
came through.
515
00:22:19,975 --> 00:22:22,075
Just got a physical address
on the bounty hunters.
516
00:22:22,077 --> 00:22:23,743
Okay, I'll notify
the local authorities
517
00:22:23,745 --> 00:22:25,678
to move on the location
cautiously.
518
00:22:25,680 --> 00:22:27,814
Meanwhile,
let's get you on a plane.
519
00:22:37,092 --> 00:22:39,192
Normally I don't get home
from work this early.
520
00:22:39,194 --> 00:22:41,394
I'm just glad
my son wasn't home.
521
00:22:44,032 --> 00:22:46,466
Edward Gaines, found in
a bathtub bound and gagged.
522
00:22:46,468 --> 00:22:47,567
He suffered a laceration
523
00:22:47,569 --> 00:22:48,835
and a concussion.
524
00:22:48,837 --> 00:22:50,403
If the blow to the head
hadn't knocked him out,
525
00:22:50,405 --> 00:22:51,871
a bullet would've been next.
526
00:22:51,873 --> 00:22:53,706
Raven's pulling
traffic cam footage
527
00:22:53,708 --> 00:22:55,908
looking for faces based
on Edward's description.
528
00:22:55,910 --> 00:22:57,277
Did our targets get
what they came for?
529
00:22:57,279 --> 00:22:58,311
Yep.
530
00:22:58,313 --> 00:22:59,812
The e-mail that
Stephen Christos got
531
00:22:59,814 --> 00:23:01,714
was sent from this computer.
532
00:23:01,716 --> 00:23:03,850
The bounty hunters now have
the first passkey.
533
00:23:03,852 --> 00:23:06,352
Well, they're halfway
to their goal,
534
00:23:06,354 --> 00:23:08,454
and we're stuck at
the starting line.
535
00:23:08,456 --> 00:23:11,224
So what's our play?
536
00:23:11,226 --> 00:23:14,661
Do you remember how I fought
so hard to bring in Tobin?
537
00:23:14,663 --> 00:23:17,597
Yeah, the cyber division needed
someone who could work the cases
538
00:23:17,599 --> 00:23:20,633
like a hacker, work the
cases from the inside.
539
00:23:20,635 --> 00:23:22,335
We're gonna use
that same tactic.
540
00:23:22,337 --> 00:23:25,038
We're gonna work this case
from the inside.
541
00:23:41,456 --> 00:23:43,623
Mom and Pop.
542
00:23:57,772 --> 00:23:59,439
The mystery box?
543
00:23:59,441 --> 00:24:02,075
Yeah, uh,
544
00:24:02,077 --> 00:24:04,143
they gave me
all my devices back.
545
00:24:04,145 --> 00:24:05,712
From your arrest?
Yep.
546
00:24:05,714 --> 00:24:07,914
Look at you, probie no more.
547
00:24:09,184 --> 00:24:11,951
God, it took me six months
to get off my probation.
548
00:24:11,953 --> 00:24:13,119
Hmm.
549
00:24:13,121 --> 00:24:14,687
Who do you know?
Yeah, you know...
550
00:24:14,689 --> 00:24:16,222
We need to get
inside that botnet.
551
00:24:16,224 --> 00:24:18,057
Avery, the system is fried.
552
00:24:18,059 --> 00:24:19,726
Yes, but the botnet
still exists.
553
00:24:19,728 --> 00:24:21,394
So you're thinking
554
00:24:21,396 --> 00:24:22,895
we should join the botnet?
555
00:24:22,897 --> 00:24:25,231
Well, we can take
the botnet's malicious code
556
00:24:25,233 --> 00:24:26,432
off Mr. Gaines' laptop
557
00:24:26,434 --> 00:24:28,401
and infect one of ours
and we're in.
558
00:24:28,403 --> 00:24:29,602
Then we'll know
559
00:24:29,604 --> 00:24:30,803
what the bounty hunters know,
560
00:24:30,805 --> 00:24:32,338
and we'll have a chance
to get one step ahead.
561
00:24:32,340 --> 00:24:34,107
First time I ever wanted
a computer virus.
562
00:24:34,109 --> 00:24:35,341
I know what you mean.
563
00:24:36,044 --> 00:24:38,010
Let's see what we got.
564
00:24:40,281 --> 00:24:41,647
All right, we're in.
565
00:24:41,649 --> 00:24:43,516
Okay, now that you're connected
to the botnet,
566
00:24:43,518 --> 00:24:46,185
you should be able to break in
and send it commands.
567
00:24:47,889 --> 00:24:49,021
What?
568
00:24:49,023 --> 00:24:50,223
You don't think I pay attention
569
00:24:50,225 --> 00:24:51,891
when you guys geek out
with code speak?
570
00:24:51,893 --> 00:24:53,059
I never thought that.
571
00:24:53,061 --> 00:24:54,761
All right, Avery.
Ping this entire network.
572
00:24:54,763 --> 00:24:57,697
We are looking
for the two computers
573
00:24:57,699 --> 00:25:00,166
that have those passkeys.
574
00:25:02,103 --> 00:25:04,170
Okay, the D.C. I.P. address
575
00:25:04,172 --> 00:25:06,773
is Mr. Gaines' laptop
right here on this desk.
576
00:25:06,775 --> 00:25:08,908
The bounty hunters already took
the passkey off that one,
577
00:25:08,910 --> 00:25:11,043
- but the other one...
- Albuquerque, New Mexico.
578
00:25:11,045 --> 00:25:12,178
Mm-hmm.
Hey.
579
00:25:12,180 --> 00:25:14,480
All right.
Whoa, too slow.
580
00:25:14,482 --> 00:25:15,715
Yeah.
581
00:25:16,885 --> 00:25:18,651
Hang on.
582
00:25:18,653 --> 00:25:20,253
Nelson, this is a win;
this is when we celebrate
583
00:25:20,255 --> 00:25:21,387
and high-five our bosses.
584
00:25:21,389 --> 00:25:23,723
No, no, check out
that I.P. address.
585
00:25:23,725 --> 00:25:25,925
It's not static; it's dynamic.
586
00:25:25,927 --> 00:25:28,594
Every time a computer
with a dynamic I.P. turns on,
587
00:25:28,596 --> 00:25:30,363
it gets assigned
588
00:25:30,365 --> 00:25:31,497
a new I.P. address randomly
589
00:25:31,499 --> 00:25:33,433
from its
Internet service provider,
590
00:25:33,435 --> 00:25:35,168
but when it turns off,
the I.P. address
591
00:25:35,170 --> 00:25:37,170
will be randomly reassigned
to a different device.
592
00:25:37,172 --> 00:25:38,704
The bounty hunters are
still using
593
00:25:38,706 --> 00:25:40,673
the I.P. address they recovered
from that hard drive.
594
00:25:40,675 --> 00:25:42,375
There you go.
595
00:25:42,377 --> 00:25:43,743
The second passkey's
in Albuquerque,
596
00:25:43,745 --> 00:25:45,378
but the bounty hunters
don't know that.
597
00:25:45,380 --> 00:25:47,447
They're going
to the wrong location.
598
00:25:47,449 --> 00:25:49,048
Okay, I'll contact
the service provider,
599
00:25:49,050 --> 00:25:51,250
figure out the I.P. address
our bounty hunters are chasing,
600
00:25:51,252 --> 00:25:52,585
find out where they're headed.
601
00:25:52,587 --> 00:25:53,719
Work quickly.
602
00:25:53,721 --> 00:25:55,688
They retrieved
that first passkey.
603
00:25:55,690 --> 00:25:56,856
They still brutally beat
Edward Gaines.
604
00:25:56,858 --> 00:25:59,125
If they come up empty at
this next location,
605
00:25:59,127 --> 00:26:00,560
who knows what they'll do.
606
00:26:08,358 --> 00:26:10,292
Krumitz has plotted
the bounty hunters'
607
00:26:10,294 --> 00:26:11,793
final destination.
608
00:26:11,795 --> 00:26:13,228
Denver, Colorado.
609
00:26:13,230 --> 00:26:15,831
So there's gonna be a
plane waiting for you
610
00:26:15,833 --> 00:26:17,199
and your team on the tarmac.
611
00:26:17,201 --> 00:26:19,301
Hey, just got back the results
on the footage
612
00:26:19,303 --> 00:26:20,836
from the traffic cameras
near Edward Gaines' house,
613
00:26:20,838 --> 00:26:23,372
and I have security footage
from around the motel
614
00:26:23,374 --> 00:26:26,174
in Detroit where we found
our bitcoin thief.
615
00:26:26,176 --> 00:26:28,210
Cross-referenced
every face we found,
616
00:26:28,212 --> 00:26:30,646
looking for anyone in both
cities in the past 24 hours.
617
00:26:30,648 --> 00:26:32,781
I.D.'d two men
traveling together.
618
00:26:32,783 --> 00:26:36,218
Jeremy and Henry Spitz,
brothers, ex-military,
619
00:26:36,220 --> 00:26:38,920
both dishonorably
discharged, a long history
620
00:26:38,922 --> 00:26:40,822
of violent behavior
resulting in arrests.
621
00:26:40,824 --> 00:26:43,425
They fit the profile
of our bounty hunters.
622
00:26:43,427 --> 00:26:46,361
We need to expect unpredictable
explosive behavior.
623
00:26:46,363 --> 00:26:48,163
All right.
Put out a BOLO on the pair
624
00:26:48,165 --> 00:26:49,765
and inform the TSA.
If they're grounded,
625
00:26:49,767 --> 00:26:51,299
they're gonna be forced
to drive to Denver.
626
00:26:51,301 --> 00:26:52,668
That's gonna buy us some time.
627
00:26:52,670 --> 00:26:54,536
I'll take Raven to Albuquerque,
628
00:26:54,538 --> 00:26:57,339
and you're gonna need to find
that final bitcoin passkey.
629
00:26:57,341 --> 00:26:59,975
Let's set this trap.
630
00:27:14,158 --> 00:27:17,426
Hello, I'm Special Agent
Avery Ryan.
631
00:27:17,428 --> 00:27:18,627
I'm running this operation.
632
00:27:18,629 --> 00:27:19,795
Is everybody out of the house?
633
00:27:19,797 --> 00:27:21,196
Yes, our son's staying
634
00:27:21,198 --> 00:27:22,964
the night at a friend's.
635
00:27:22,966 --> 00:27:25,100
Hopefully this will
all be over by morning.
636
00:27:25,102 --> 00:27:27,335
This comes to an end here!
637
00:27:28,605 --> 00:27:29,905
This is our Appomattox.
638
00:27:29,907 --> 00:27:32,174
Appomattox, really?
639
00:27:32,176 --> 00:27:33,642
You're really gonna
compare this
640
00:27:33,644 --> 00:27:35,377
to the battle that ended
the Civil War?
641
00:27:35,379 --> 00:27:38,213
Yeah, why not?
642
00:27:38,215 --> 00:27:41,616
You have any idea how many men
died in that battle?
643
00:27:41,618 --> 00:27:43,852
Appomattox.
Step up your game, man.
644
00:27:51,495 --> 00:27:53,462
A dynamic what?
It's your I.P. address.
645
00:27:53,464 --> 00:27:54,763
If this is just
about my computer,
646
00:27:54,765 --> 00:27:56,398
I don't see why I have
to leave my home.
647
00:27:56,400 --> 00:27:58,500
Again, ma'am, this is an
ongoing investigation.
648
00:27:58,502 --> 00:28:00,435
I have told you
as much as I can.
649
00:28:00,437 --> 00:28:02,537
Now I would like to move you
into protective custody
650
00:28:02,539 --> 00:28:03,939
till we resolve all this.
651
00:28:03,941 --> 00:28:05,607
What's she doing
on my computer anyway?
652
00:28:05,609 --> 00:28:07,442
Removing something
worth killing for.
653
00:28:07,444 --> 00:28:09,044
Got the passkey.
654
00:28:09,046 --> 00:28:10,846
Sending it to the boys now.
655
00:28:16,086 --> 00:28:18,386
Well, that smile must mean
we're on schedule.
656
00:28:18,388 --> 00:28:20,555
Just got the final passkey
from Raven.
657
00:28:20,557 --> 00:28:21,656
Krumitz is finishing up inside.
658
00:28:21,658 --> 00:28:23,492
We're good to go.
659
00:28:23,494 --> 00:28:26,928
I know we're right in the middle
of something, but, uh,
660
00:28:26,930 --> 00:28:29,131
I just wanted to say thanks
661
00:28:29,133 --> 00:28:30,766
for getting me off probation.
662
00:28:30,768 --> 00:28:32,934
And giving me
all my devices back.
663
00:28:32,936 --> 00:28:34,903
They mean a lot to me.
664
00:28:34,905 --> 00:28:36,938
Got my tablet back today.
665
00:28:36,940 --> 00:28:38,940
You know, I had all
my photos in there
666
00:28:38,942 --> 00:28:41,042
and my family stuff.
667
00:28:41,044 --> 00:28:44,179
It was good to see
my parents again.
668
00:28:44,181 --> 00:28:46,782
I haven't seen them
since the trial.
669
00:28:46,784 --> 00:28:48,917
It's complicated.
670
00:28:49,853 --> 00:28:51,253
Well, Sifter and I spoke
to the judge.
671
00:28:51,255 --> 00:28:52,621
She agreed to lift
your probation.
672
00:28:52,623 --> 00:28:54,289
Wow, that's-that's crazy.
673
00:28:54,291 --> 00:28:55,857
I didn't,
I didn't even know he liked me.
674
00:28:55,859 --> 00:28:57,526
No, he-he doesn't.
675
00:28:59,730 --> 00:29:01,296
We all set?
676
00:29:01,298 --> 00:29:03,598
Oh, yeah. We embedded
a decoy passkey
677
00:29:03,600 --> 00:29:05,066
on the computer in the home,
678
00:29:05,068 --> 00:29:06,735
one infected
with our own malicious code.
679
00:29:06,737 --> 00:29:08,937
So when the bounty hunters try
to use that passkey,
680
00:29:08,939 --> 00:29:10,172
it'll infect their computer
681
00:29:10,174 --> 00:29:11,439
and we'll have complete
control over it.
682
00:29:11,441 --> 00:29:12,841
Well, they're reckless
and greedy.
683
00:29:12,843 --> 00:29:14,209
They'll want
immediate gratification.
684
00:29:14,211 --> 00:29:15,510
We won't have to wait long.
685
00:29:15,512 --> 00:29:16,812
All right, but when
they plug in,
686
00:29:16,814 --> 00:29:18,313
we'll be able to steal
the first passkey back.
687
00:29:18,315 --> 00:29:19,347
Not just steal it.
688
00:29:19,349 --> 00:29:21,650
We have to prove
it was on their computer.
689
00:29:21,652 --> 00:29:24,586
That passkey is the only thing
that links those men
690
00:29:24,588 --> 00:29:26,254
to the murder
and the home invasion.
691
00:29:26,256 --> 00:29:27,889
It's what's gonna give us
a conviction.
692
00:29:27,891 --> 00:29:31,126
Don't worry. We'll be screen-
capturing the entire session.
693
00:29:34,565 --> 00:29:36,264
We lost the connection to
the Schaeffers' computer.
694
00:29:36,266 --> 00:29:38,600
He'll get it back online.
695
00:29:50,080 --> 00:29:51,813
Krumitz, what the hell
are you doing?
696
00:29:51,815 --> 00:29:53,114
Krumitz left his radio.
697
00:29:53,116 --> 00:29:54,950
We're having technical issues.
Avery, we just got word.
698
00:29:54,952 --> 00:29:56,552
SWAT's reporting
a suspicious looking SUV
699
00:29:56,553 --> 00:29:58,186
that just entered
the neighborhood.
700
00:29:58,188 --> 00:29:59,487
How long?
701
00:29:59,489 --> 00:30:00,555
Two minutes at most.
702
00:30:00,557 --> 00:30:01,857
Bring up
the home security cameras.
703
00:30:01,859 --> 00:30:03,258
I need eyes on the perimeter.
704
00:30:04,995 --> 00:30:07,195
We got it.
705
00:30:12,135 --> 00:30:14,269
We got a problem, Elijah.
706
00:30:27,217 --> 00:30:30,085
Danny, it's okay.
707
00:30:30,087 --> 00:30:33,455
Just come stand by me
and your brother.
708
00:30:43,867 --> 00:30:45,800
We'll do
anything you ask.
709
00:30:45,802 --> 00:30:48,136
Please, just don't...
710
00:30:48,138 --> 00:30:50,338
don't hurt my family.
711
00:31:01,269 --> 00:31:03,677
Just take what you want.
712
00:31:03,678 --> 00:31:06,012
No one's stopping you;
we're the only ones here.
713
00:31:06,014 --> 00:31:07,580
Check the back,
make sure we're alone.
714
00:31:16,991 --> 00:31:18,424
How'd he get here?
715
00:31:18,426 --> 00:31:21,527
He came for a
video game for his sleepover.
716
00:31:21,529 --> 00:31:22,828
Where's my mom and dad?
717
00:31:22,830 --> 00:31:24,463
It's okay, Jeffrey.
718
00:31:24,465 --> 00:31:26,699
Just do what
I tell you.
719
00:31:28,937 --> 00:31:30,870
All clear.
720
00:31:32,507 --> 00:31:34,307
You.
Me?
721
00:31:34,309 --> 00:31:36,842
You got a computer in here
somewhere-- take me to it.
722
00:31:36,844 --> 00:31:38,711
Danny, do what the
man tells you to do.
723
00:31:38,713 --> 00:31:40,179
Listen to your mother.
724
00:31:40,181 --> 00:31:41,781
She'll get you
out of this alive.
725
00:31:42,617 --> 00:31:44,083
It's, uh,
it's upstairs.
726
00:31:44,085 --> 00:31:45,618
Move.
727
00:31:55,430 --> 00:31:57,363
Have your men hold.
728
00:31:57,365 --> 00:31:59,699
I got two FBI agents
and an innocent in there.
729
00:31:59,701 --> 00:32:01,534
We storm the house at the wrong
time, somebody will get killed.
730
00:32:01,536 --> 00:32:02,935
How the hell did
that kid get in there?
731
00:32:02,937 --> 00:32:04,704
Avery just spotted him
coming in the back door
732
00:32:04,706 --> 00:32:06,272
through the security camera.
733
00:32:07,875 --> 00:32:09,775
I need more men in the back--
there's a hole in that fence.
734
00:32:09,777 --> 00:32:11,110
Fill it now.
735
00:32:11,112 --> 00:32:12,378
How we doing on your end?
736
00:32:12,380 --> 00:32:14,146
Trap's set--
those guys take the bait,
737
00:32:14,148 --> 00:32:15,815
we'll have them dead to rights.
738
00:32:15,817 --> 00:32:17,750
Jail for life, and some.
739
00:32:17,752 --> 00:32:19,785
Um, we've got a volatile
situation in there, Nelson.
740
00:32:19,787 --> 00:32:21,053
We can't wait long.
741
00:32:22,223 --> 00:32:24,423
Sit.
742
00:32:24,425 --> 00:32:26,993
Okay, you got it, but do
you mind lowering your gun?
743
00:32:29,364 --> 00:32:31,564
Open the
system's folder.
744
00:32:32,667 --> 00:32:35,668
Just give me a minute--
I-I'm not good with computers.
745
00:32:35,670 --> 00:32:37,003
Uh, here, here?
746
00:32:37,005 --> 00:32:38,437
Open it.
747
00:32:42,577 --> 00:32:44,610
Now utilities.
748
00:32:45,780 --> 00:32:47,313
Here?
749
00:32:49,951 --> 00:32:51,751
You see two, you moron?
750
00:32:51,753 --> 00:32:54,287
This is not good, man,
we're in trouble.
751
00:32:54,289 --> 00:32:56,022
Look, this guy's gonna go ahead
and miss the decoy file.
752
00:32:56,024 --> 00:32:57,390
He has Krumitz looking
in the wrong place.
753
00:32:57,392 --> 00:32:58,658
Nelson, these guys have
short tempers.
754
00:32:58,660 --> 00:32:59,825
Failure is not an option.
755
00:32:59,827 --> 00:33:00,860
Okay, look, uh...
756
00:33:00,862 --> 00:33:02,695
I have an idea.
757
00:33:10,071 --> 00:33:11,671
Open that folder
there, “Installers”"
758
00:33:13,975 --> 00:33:15,508
Uh...
759
00:33:17,812 --> 00:33:19,845
You clicked the wrong folder,
you idiot.
760
00:33:19,847 --> 00:33:22,448
Yes.
761
00:33:22,450 --> 00:33:25,151
No, I didn't. No, I didn't.
762
00:33:25,153 --> 00:33:26,619
Wait, wait, wait,
wait, is that it?
763
00:33:26,621 --> 00:33:27,987
Is that it?
Is that it?
764
00:33:28,990 --> 00:33:30,790
That's it.
765
00:33:30,792 --> 00:33:32,825
Good.
766
00:33:32,827 --> 00:33:34,994
Load it on this.
767
00:33:40,968 --> 00:33:43,302
These men'll be leaving
soon, honey.
768
00:33:43,304 --> 00:33:45,871
This will all
be over, I promise.
769
00:33:45,873 --> 00:33:47,707
I said no talking.
770
00:33:47,709 --> 00:33:49,175
Of course.
771
00:33:49,177 --> 00:33:51,010
I apologize.
772
00:34:01,189 --> 00:34:03,756
My son needs to go
to the restroom.
773
00:34:03,758 --> 00:34:05,758
Yeah, well...
774
00:34:05,760 --> 00:34:07,159
he can hold it.
775
00:34:07,161 --> 00:34:09,895
And shut up.
776
00:34:11,866 --> 00:34:14,667
Get over there.
777
00:34:14,669 --> 00:34:16,369
It's about time, man--
did you get it?
778
00:34:16,371 --> 00:34:18,237
I got it, calm down.
779
00:34:19,540 --> 00:34:21,574
This is taking too long, bro.
780
00:34:21,576 --> 00:34:23,909
We got to get out of here.
781
00:34:23,911 --> 00:34:25,711
Wait a second.
782
00:34:25,713 --> 00:34:28,047
It's payday.
783
00:34:34,789 --> 00:34:35,721
I'm in.
784
00:34:35,723 --> 00:34:36,856
I'm gonna go ahead
and deactivate
785
00:34:36,858 --> 00:34:38,524
these fools' Internet.
It's gonna buy me
786
00:34:38,526 --> 00:34:39,859
some time to find a passkey
787
00:34:39,861 --> 00:34:41,427
before they discover
we slipped them a decoy.
788
00:34:41,429 --> 00:34:43,629
Things are getting tense
in there, Nelson,
789
00:34:43,631 --> 00:34:45,564
we can't wait long.
I'm trying-- I know, I know.
790
00:34:47,235 --> 00:34:49,068
What the hell
is taking so long?
791
00:34:52,907 --> 00:34:54,073
Damn signal.
792
00:34:54,075 --> 00:34:55,141
What?
793
00:34:55,143 --> 00:34:57,076
Wi-Fi isn't working--
give me a sec.
794
00:34:57,078 --> 00:34:58,477
Running a diagnostic.
795
00:35:01,616 --> 00:35:03,716
Now what?
796
00:35:07,355 --> 00:35:09,488
We got an intrusion.
797
00:35:09,490 --> 00:35:11,023
Son of a...
798
00:35:13,528 --> 00:35:15,594
Shut that kid up
and start talking.
799
00:35:15,596 --> 00:35:17,696
We're running
out of time, Nelson.
800
00:35:17,698 --> 00:35:18,998
I know, I know.
801
00:35:19,000 --> 00:35:20,866
Look, just-just wait, okay?
802
00:35:21,669 --> 00:35:23,736
Can't wait any longer.
803
00:35:23,738 --> 00:35:25,538
I knew it.
804
00:35:25,540 --> 00:35:27,106
There's no way
these two are family.
805
00:35:27,108 --> 00:35:28,040
Look at that picture.
806
00:35:28,042 --> 00:35:30,109
That's the kid,
all right.
807
00:35:30,111 --> 00:35:31,777
But who the hell are these two?
808
00:35:32,547 --> 00:35:34,180
Something
ain't right here.
809
00:35:35,249 --> 00:35:36,582
Talk.
810
00:35:36,584 --> 00:35:37,850
Or die.
811
00:35:40,421 --> 00:35:42,021
FBI!
812
00:35:42,023 --> 00:35:43,222
Get down.
813
00:35:43,224 --> 00:35:45,424
Down on the ground! FBI!
Drop it now!
814
00:35:47,528 --> 00:35:48,828
Your hands where I can see them!
815
00:35:48,830 --> 00:35:49,995
Don't move!
816
00:35:54,135 --> 00:35:55,801
Everybody okay?
817
00:35:55,803 --> 00:35:56,769
You okay?
818
00:35:56,771 --> 00:35:57,937
Yeah.
819
00:35:59,474 --> 00:36:00,940
Clear!
820
00:36:00,942 --> 00:36:01,942
He'll live.
821
00:36:01,943 --> 00:36:02,943
Entry clear!
822
00:36:02,944 --> 00:36:03,976
Encrypted.
823
00:36:03,978 --> 00:36:05,344
We'll never get in.
824
00:36:05,346 --> 00:36:06,445
Did Nelson get the file?
825
00:36:06,447 --> 00:36:08,214
I don't know--
couldn't wait.
826
00:36:08,216 --> 00:36:10,015
Nelson.
827
00:36:10,017 --> 00:36:11,517
Did you get
the passkey?
828
00:36:11,519 --> 00:36:13,285
Repeat-- did you
get the passkey?
829
00:36:13,287 --> 00:36:14,954
Oh, yeah, we got it.
830
00:36:14,956 --> 00:36:16,822
Those fools are going down.
831
00:36:26,467 --> 00:36:28,434
Okay.
832
00:36:28,436 --> 00:36:30,102
Bitcoins are back
in your account.
833
00:36:30,104 --> 00:36:32,171
Though you should
change your passkey.
834
00:36:32,173 --> 00:36:34,473
I won't need to.
835
00:36:34,475 --> 00:36:36,675
Getting out
of the bitcoin business.
836
00:36:39,013 --> 00:36:42,314
In fact,
we're selling the store.
837
00:36:43,751 --> 00:36:45,117
It's time.
838
00:36:45,119 --> 00:36:46,685
Thank you.
839
00:36:50,024 --> 00:36:51,257
Pop.
840
00:36:55,463 --> 00:36:57,830
I'm sorry.
841
00:37:04,171 --> 00:37:06,939
Promise me you'll
stay close to home.
842
00:37:06,941 --> 00:37:09,141
Always.
843
00:37:21,889 --> 00:37:23,255
You ever get sleep?
844
00:37:24,358 --> 00:37:26,692
You have any idea how much
paperwork is required
845
00:37:26,694 --> 00:37:28,761
after you discharge a
government-issued firearm?
846
00:37:28,763 --> 00:37:31,764
You know, I heard you handled
yourself pretty well.
847
00:37:31,766 --> 00:37:33,766
Came face-to-face
with an armed killer,
848
00:37:33,768 --> 00:37:35,768
heard you took him down,
no hesitation.
849
00:37:35,770 --> 00:37:38,370
Come on, man,
you got some skills.
850
00:37:38,372 --> 00:37:40,005
Standard FBI training.
851
00:37:40,007 --> 00:37:41,607
“Standard FBI training.”
852
00:37:41,609 --> 00:37:42,575
No, n-n-no.
853
00:37:42,577 --> 00:37:43,909
You?
854
00:37:43,911 --> 00:37:45,978
You are
the real deal, bro.
855
00:37:45,980 --> 00:37:47,279
Well, I did what
I had to do.
856
00:37:47,281 --> 00:37:49,014
You know, a man with
a gun in your face,
857
00:37:49,016 --> 00:37:49,915
kid in the room,
858
00:37:49,917 --> 00:37:51,250
bad guy's got
to go down.
859
00:37:51,252 --> 00:37:53,118
Even if it was
only a flesh wound.
860
00:37:53,120 --> 00:37:55,154
I mean, really, it's just
instinct at that point.
861
00:37:55,156 --> 00:37:57,957
You know, training takes
over, muscle memory kicks in.
862
00:37:57,959 --> 00:37:59,858
And when that guy
made a move on me,
863
00:37:59,860 --> 00:38:01,794
his gun taking aim,
864
00:38:01,796 --> 00:38:04,597
bayonet inches
from this face...
865
00:38:04,599 --> 00:38:05,931
Whose bayonet?
866
00:38:05,933 --> 00:38:07,967
...I could smell
the gunpowder residue.
867
00:38:07,969 --> 00:38:09,702
Appomattox, Nelson.
868
00:38:09,704 --> 00:38:11,637
Appomattox.
869
00:38:11,639 --> 00:38:13,339
Hey.
Yo.
870
00:38:13,341 --> 00:38:15,908
All I knew was--
it was on.
871
00:38:15,910 --> 00:38:18,210
Him or me.
872
00:38:18,212 --> 00:38:20,479
And it wasn't gonna
be me.
873
00:38:20,481 --> 00:38:21,481
That's right, baby.
874
00:38:21,482 --> 00:38:22,648
That's why you here.
875
00:38:24,452 --> 00:38:26,652
Daniel Krumitz
coming through.
876
00:38:39,900 --> 00:38:41,200
Hey.
877
00:38:41,202 --> 00:38:44,536
♪ Sweetly touching my emotions ♪
878
00:38:44,538 --> 00:38:46,105
♪ I wanna stop ♪
879
00:38:47,041 --> 00:38:48,474
♪ And thank you, baby ♪
880
00:38:48,476 --> 00:38:51,176
♪ I just wanna stop ♪
881
00:38:51,178 --> 00:38:53,245
♪ And thank you, baby ♪
882
00:38:55,116 --> 00:38:57,583
♪ How sweet it is ♪
883
00:38:57,585 --> 00:39:00,285
♪ To be loved by you... ♪
884
00:39:00,287 --> 00:39:01,387
No, you didn't.
885
00:39:01,389 --> 00:39:03,055
Yes, I did.
886
00:39:05,726 --> 00:39:07,693
You know, uh...
887
00:39:07,695 --> 00:39:09,328
it's my mother's
favorite song.
888
00:39:09,330 --> 00:39:11,330
Me and my pops used
to sing it to her
889
00:39:11,332 --> 00:39:13,065
every year on
her birthday.
890
00:39:13,067 --> 00:39:15,601
Call your parents,
Brody Nelson.
891
00:39:16,604 --> 00:39:18,604
Can't.
892
00:39:18,606 --> 00:39:21,306
It's just not
the same anymore.
893
00:39:21,308 --> 00:39:24,677
I embarrassed them,
went to jail.
894
00:39:24,679 --> 00:39:26,879
Just not the son they
thought they raised.
895
00:39:26,881 --> 00:39:29,248
Call them anyway.
896
00:39:29,250 --> 00:39:31,383
Why do I get the feeling
that giving my stuff back
897
00:39:31,385 --> 00:39:33,252
is a part of one of
your master plans
898
00:39:33,254 --> 00:39:35,320
that Elijah's always
talking about?
899
00:39:35,322 --> 00:39:37,389
I don't know.
900
00:39:44,065 --> 00:39:49,001
♪ How sweet it is
to be loved by you. ♪
901
00:40:00,748 --> 00:40:01,814
Hello.
902
00:40:01,816 --> 00:40:04,183
Hey, Dad?
903
00:40:04,185 --> 00:40:05,684
Hey, it's Brody.
904
00:40:08,422 --> 00:40:11,123
Yeah, no, it-it's me,
Pop, it's me.
905
00:40:42,482 --> 00:40:48,982
== sync, corrected by elderman ==
@elder_man
9999
00:00:0,500 --> 00:00:2,00
www.tvsubtitles.net