1 00:00:01,754 --> 00:00:03,234 My name is Avery Ryan. 2 00:00:03,415 --> 00:00:05,338 I was a victim of cyber crime. 3 00:00:05,697 --> 00:00:08,266 Like you, I posted on social media, 4 00:00:08,268 --> 00:00:11,007 checked my bank account balance online, 5 00:00:11,009 --> 00:00:13,081 even kept the confidential files 6 00:00:13,083 --> 00:00:15,746 of my psychological practice on my computer. 7 00:00:16,030 --> 00:00:18,970 Then I was hacked, and as a result, 8 00:00:18,972 --> 00:00:21,619 one of my patients was murdered. 9 00:00:21,621 --> 00:00:23,976 My investigation into her death led me to the FBI, 10 00:00:23,978 --> 00:00:26,855 where I joined a team of cyber experts 11 00:00:26,857 --> 00:00:29,851 to wage a war against a new breed of criminal 12 00:00:29,853 --> 00:00:32,757 hiding on the Deep Web... 13 00:00:32,759 --> 00:00:36,138 infiltrating our daily lives in ways we never imagined... 14 00:00:37,508 --> 00:00:39,682 ...faceless... 15 00:00:39,684 --> 00:00:41,856 nameless... 16 00:00:41,858 --> 00:00:43,522 lurking inside our devices, 17 00:00:43,524 --> 00:00:46,302 just a keystroke away. 18 00:00:52,450 --> 00:00:54,618 ♪ ♪ 19 00:01:22,240 --> 00:01:23,278 Mr. Nelson, 20 00:01:23,280 --> 00:01:25,215 you're late. 21 00:01:25,217 --> 00:01:26,952 I'm sorry, Avery. 22 00:01:26,954 --> 00:01:28,248 It's just that getting up early 23 00:01:28,250 --> 00:01:30,153 is something my body's not used to. 24 00:01:31,323 --> 00:01:32,490 Okay, I feel you. 25 00:01:32,492 --> 00:01:34,194 All right, I'll have a talk with my body, 26 00:01:34,196 --> 00:01:35,458 and we'll be here on time. 27 00:01:35,460 --> 00:01:36,659 What you doing? 28 00:01:36,661 --> 00:01:38,763 Oh, rescuing a spider. 29 00:01:38,765 --> 00:01:41,603 Oh. Um... 30 00:01:41,605 --> 00:01:44,205 Yeah, do not come near me. Look. Look, I'm-I'm serious. 31 00:01:44,207 --> 00:01:45,605 Brody Nelson, don't tell me you're afraid 32 00:01:45,607 --> 00:01:47,405 of a little spider? A little spider? 33 00:01:47,407 --> 00:01:49,278 Avery, look at the size of that thing. That's not... 34 00:01:49,280 --> 00:01:50,246 Uh-oh. Where...? 35 00:01:50,248 --> 00:01:51,782 Why are you looking on the ground? 36 00:01:51,784 --> 00:01:54,214 I dropped it. You dropped it. 37 00:01:54,216 --> 00:01:55,151 Avery... 38 00:01:55,153 --> 00:01:56,488 Your bag... Well... 39 00:01:56,490 --> 00:01:58,194 Aah! 40 00:01:59,493 --> 00:02:01,429 Well, spiders don't like it when you're late. 41 00:02:01,431 --> 00:02:03,333 So your plane's on the tarmac 42 00:02:03,335 --> 00:02:05,198 at National, and you're scheduled to leave 43 00:02:05,200 --> 00:02:07,270 in an hour for New York City. 44 00:02:07,272 --> 00:02:09,270 The Kirkendahl Hotel believes 45 00:02:09,272 --> 00:02:12,078 that their computer network has been hacked. 46 00:02:12,080 --> 00:02:13,374 That connects every location worldwide. 47 00:02:13,376 --> 00:02:15,045 This is the Kirkendahl file. What do we got? 48 00:02:15,047 --> 00:02:16,749 Three days ago, 49 00:02:16,751 --> 00:02:19,615 the hotel's computer intrusion detection system 50 00:02:19,617 --> 00:02:22,318 went off, sent an alert from their East Side property. 51 00:02:22,320 --> 00:02:24,487 And they had their I.T. team take a look at it? 52 00:02:24,489 --> 00:02:26,488 It appeared to be a glitch, happens all the time. 53 00:02:26,490 --> 00:02:28,728 They reset the system, it happened again. 54 00:02:28,730 --> 00:02:30,864 There's evidence of a remote cyber intrusion. 55 00:02:30,866 --> 00:02:33,367 Kirkendahl's Wi-Fi has been compromised. 56 00:02:33,369 --> 00:02:35,534 That means the hackers could have access to 57 00:02:35,536 --> 00:02:36,766 the corporate computers 58 00:02:36,768 --> 00:02:38,702 and the guests' personal devices. 59 00:02:38,704 --> 00:02:40,734 And they probably discovered a vulnerable protocol, 60 00:02:40,736 --> 00:02:42,636 used a root kit to gain access. 61 00:02:42,638 --> 00:02:44,106 Nah, that's doing it the hard way. 62 00:02:44,108 --> 00:02:46,675 There's a known exploit in the authentication credential. 63 00:02:46,677 --> 00:02:48,411 You should know that, right? Of course I know that. 64 00:02:48,413 --> 00:02:49,675 Okay, well... Why wouldn't I know that? 65 00:02:49,677 --> 00:02:51,978 Guys? Guys? You spilled water on your keyboard. 66 00:02:51,980 --> 00:02:53,145 Then I saw a spider. 67 00:02:53,147 --> 00:02:54,209 It's not like I did it on purpose. 68 00:02:54,211 --> 00:02:56,048 Whatever. Let's just reign in 69 00:02:56,050 --> 00:02:57,384 our intellect here. 70 00:02:57,386 --> 00:02:59,847 That hotel is right next to the U.N. 71 00:02:59,849 --> 00:03:01,383 A lot of high-profile people stay there. 72 00:03:01,385 --> 00:03:02,919 Diplomats, dignitaries, celebrities. 73 00:03:02,921 --> 00:03:05,287 Yeah, and the U.N. is back in session in two days. 74 00:03:05,289 --> 00:03:06,959 We could be looking at a dark hotel scenario here. 75 00:03:06,961 --> 00:03:09,189 Hackers targeting the guests. Yeah, or an attack 76 00:03:09,191 --> 00:03:10,356 against the Kirkendahl Corporation itself. 77 00:03:10,358 --> 00:03:12,858 Either way, documents could be released. 78 00:03:12,860 --> 00:03:15,625 E-mails, texts, sensitive information 79 00:03:15,627 --> 00:03:18,095 that could embarrass or expose some very important people. 80 00:03:18,097 --> 00:03:19,631 Well, I've got a meeting coming up 81 00:03:19,633 --> 00:03:20,861 with the FBI Director. 82 00:03:20,863 --> 00:03:22,365 I'll tell him my team is on it, 83 00:03:22,367 --> 00:03:24,795 and that none of that will happen. 84 00:03:24,797 --> 00:03:26,960 Enjoy your flight. 85 00:03:42,175 --> 00:03:43,876 At the suggestion of our in-house 86 00:03:43,878 --> 00:03:46,414 technical support team, we shut down the Wi-Fi. 87 00:03:46,416 --> 00:03:49,318 Has any employee or guest reported any strange e-mails, 88 00:03:49,320 --> 00:03:50,413 or any evidence 89 00:03:50,415 --> 00:03:51,781 of their individual devices being hacked? 90 00:03:51,783 --> 00:03:52,748 No. 91 00:03:52,750 --> 00:03:54,755 What about pop-up alerts instructing them 92 00:03:54,757 --> 00:03:57,091 to update a file or a program? 93 00:03:57,093 --> 00:03:58,755 I don't know. Those pop-ups appear all the time, 94 00:03:58,757 --> 00:04:00,459 even on my home computer. 95 00:04:00,461 --> 00:04:02,594 Well, it's one of the ways that devices are hacked. 96 00:04:02,596 --> 00:04:04,531 A free download or product upgrade 97 00:04:04,533 --> 00:04:06,130 that looks like it's authentic. 98 00:04:06,132 --> 00:04:08,800 But instead of it being the actual product, 99 00:04:08,802 --> 00:04:11,399 it's the delivery of malware-- malicious software. 100 00:04:11,401 --> 00:04:12,936 And once someone opens it, 101 00:04:12,938 --> 00:04:15,336 the code gets released into the computer like a virus, 102 00:04:15,338 --> 00:04:16,871 and the hacker takes over. 103 00:04:16,873 --> 00:04:18,902 It's like the hacker's lurking inside the device. 104 00:04:18,904 --> 00:04:20,971 When a guest logs on to your Wi-Fi, the hacker is able 105 00:04:20,973 --> 00:04:23,900 to see their room number, the last name on their account, 106 00:04:23,902 --> 00:04:25,131 even get their passwords. 107 00:04:25,133 --> 00:04:26,769 But-but we-we shut down the Wi-Fi, 108 00:04:26,771 --> 00:04:28,459 so that should protect us, right? 109 00:04:28,461 --> 00:04:29,329 Depends. 110 00:04:29,331 --> 00:04:30,560 I mean, 111 00:04:30,562 --> 00:04:32,557 some malware is programmed to lay in wait 112 00:04:32,559 --> 00:04:34,531 for six hours, six days, six months or more. 113 00:04:34,533 --> 00:04:37,161 Should-should we be copying and deleting documents? 114 00:04:37,163 --> 00:04:39,125 No. Despite the definition of the word “delete,” 115 00:04:39,127 --> 00:04:41,425 in the cyber world, almost anything can be recovered. 116 00:04:41,427 --> 00:04:46,428 Agent Ryan, as in-house counsel for the Kirkendahl Corporation, 117 00:04:46,430 --> 00:04:49,360 I can't stress enough the importance of privacy here. 118 00:04:49,362 --> 00:04:51,022 It is something that we guarantee 119 00:04:51,024 --> 00:04:53,460 to our board members, our employees and our guests. 120 00:04:53,462 --> 00:04:55,555 There must be something that we can do. 121 00:04:55,557 --> 00:04:58,258 Many of our guests use aliases when checking in, 122 00:04:58,260 --> 00:05:01,223 but their real names and home addresses are in our files. 123 00:05:01,225 --> 00:05:04,598 Some engage in activity that we keep very confidential, 124 00:05:04,600 --> 00:05:06,963 and I'm talking about more than just ordering an adult movie. 125 00:05:06,965 --> 00:05:08,628 We-we send e-mails and texts 126 00:05:08,630 --> 00:05:11,235 containing confidential company information-- 127 00:05:11,237 --> 00:05:12,435 bonuses, salaries, 128 00:05:12,437 --> 00:05:13,834 mergers. 129 00:05:13,836 --> 00:05:15,832 Activity that will have serious repercussions 130 00:05:15,834 --> 00:05:17,870 if those communications became public. 131 00:05:17,872 --> 00:05:20,404 Pardon me. 132 00:05:20,406 --> 00:05:22,834 Yes. 133 00:05:22,836 --> 00:05:24,833 Say that again. 134 00:05:26,739 --> 00:05:27,905 All right. 135 00:05:27,907 --> 00:05:29,704 Our hotel 136 00:05:29,706 --> 00:05:30,872 security footage has been wiped. 137 00:05:30,874 --> 00:05:35,647 Lobby... entrances... guest room corridors. 138 00:05:35,649 --> 00:05:38,249 Everything recorded in the past week. 139 00:05:38,251 --> 00:05:39,921 Was the system connected to the Wi-Fi? 140 00:05:39,923 --> 00:05:42,089 Yes. 141 00:05:43,755 --> 00:05:45,824 If your surveillance footage was wiped, 142 00:05:45,826 --> 00:05:47,961 I don't think our hacker is interested 143 00:05:47,963 --> 00:05:49,530 in these confidential files 144 00:05:49,532 --> 00:05:50,730 that you're worried about, Counselor. 145 00:05:50,732 --> 00:05:52,931 Something else is going on here. 146 00:05:52,933 --> 00:05:55,466 Something happened here at your hotel, 147 00:05:55,468 --> 00:05:57,936 and someone is trying to cover it up. 148 00:05:57,938 --> 00:06:00,136 Ms. Foster? 149 00:06:01,980 --> 00:06:04,316 This is the hotel manager. 150 00:06:04,318 --> 00:06:07,886 Ms. Foster, your music is disturbing other guests! 151 00:06:32,406 --> 00:06:34,781 Ms. Foster? 152 00:06:34,783 --> 00:06:37,012 Oh, geez. 153 00:06:39,382 --> 00:06:41,580 Security. Call 911. 154 00:07:32,278 --> 00:07:34,443 The victim is Adel Foster, 155 00:07:34,445 --> 00:07:35,611 24 years old. 156 00:07:35,613 --> 00:07:38,145 She checked into this room five days ago alone. 157 00:07:38,147 --> 00:07:40,584 Driver's license lists her address as 158 00:07:40,586 --> 00:07:41,951 East Rutherford, New Jersey. 159 00:07:41,953 --> 00:07:44,245 NYPD are reaching out to New Jersey Police and her family. 160 00:07:44,247 --> 00:07:45,612 Room's disorganized. 161 00:07:45,614 --> 00:07:47,788 Bruises on her wrists. 162 00:07:47,790 --> 00:07:49,852 Indicates... a struggle. 163 00:07:49,854 --> 00:07:51,821 Most likely, a crime of passion. 164 00:07:51,823 --> 00:07:53,262 Detectives canvassed the hotel guests. 165 00:07:53,264 --> 00:07:55,030 Nobody heard or saw anything. 166 00:07:55,032 --> 00:07:56,360 Crime scene lifted a few prints. 167 00:07:56,362 --> 00:07:58,600 Most belonged to the victim, the rest to housekeeping. 168 00:07:58,602 --> 00:07:59,831 However, 169 00:07:59,833 --> 00:08:01,702 I did find this in the plumbing. 170 00:08:01,704 --> 00:08:03,734 The victim's cell phone. 171 00:08:07,575 --> 00:08:11,309 The target tried to destroy it and then flush it. 172 00:08:17,549 --> 00:08:22,479 Well, the water likely corroded the connectors. 173 00:08:22,481 --> 00:08:26,282 Data recovery is gonna be tough. 174 00:08:26,284 --> 00:08:27,914 The hotel invoice. 175 00:08:27,916 --> 00:08:29,914 Looks like around 3:00 this morning, 176 00:08:29,916 --> 00:08:31,922 she ordered a late-night snack and a movie. 177 00:08:31,924 --> 00:08:33,251 Behavior of an insomniac. 178 00:08:33,253 --> 00:08:37,125 Food for one. That indicates she was alone. 179 00:08:37,127 --> 00:08:39,764 Wait a minute. This is strange. 180 00:08:39,766 --> 00:08:42,470 What? The medical examiner just established 181 00:08:42,472 --> 00:08:43,998 approximate time of death. 182 00:08:44,000 --> 00:08:45,501 Three nights ago. 183 00:08:45,503 --> 00:08:46,941 What? 184 00:08:46,943 --> 00:08:48,670 It's a hotel. How does housekeeping not find the body? 185 00:08:48,672 --> 00:08:50,511 Stranger than that, 186 00:08:50,513 --> 00:08:52,377 according to the room invoice, 187 00:08:52,379 --> 00:08:56,080 yesterday and the day before, she ordered laundry, 188 00:08:56,082 --> 00:08:57,688 room and spa services, 189 00:08:57,690 --> 00:08:58,785 and a movie. 190 00:08:58,787 --> 00:09:01,089 And this morning, breakfast. 191 00:09:01,091 --> 00:09:03,993 Well, it looks like Adel Foster was alive 192 00:09:03,995 --> 00:09:06,330 for three days after she died. 193 00:09:06,411 --> 00:09:10,411 ♪ CSI Cyber 1x06 ♪ The Evil Twin Original Air Date on April 15, 2015 194 00:09:10,412 --> 00:09:16,208 ♪ I know you've deceived me, now here's a surprise ♪ 195 00:09:17,779 --> 00:09:23,591 ♪ I know that you have, 'cause there's magic in my eyes ♪ 196 00:09:23,593 --> 00:09:27,801 ♪ I can see for miles and miles ♪ 197 00:09:27,803 --> 00:09:31,107 ♪ I can see for miles and miles ♪ 198 00:09:31,109 --> 00:09:35,740 ♪ I can see for miles and miles ♪ 199 00:09:35,742 --> 00:09:39,211 ♪ And miles... ♪ 200 00:09:39,213 --> 00:09:41,779 ♪ Oh, yeah. ♪ 201 00:09:41,803 --> 00:09:48,303 == sync, corrected by elderman == @elder_man 202 00:09:56,606 --> 00:09:57,770 Okay, Raven, 203 00:09:57,771 --> 00:09:59,008 what have you got? 204 00:09:59,010 --> 00:10:01,009 Data from the Kirkendahl Hotel's computer system. 205 00:10:01,011 --> 00:10:02,345 This is a blueprint layout 206 00:10:02,347 --> 00:10:03,441 of a standard room. 207 00:10:03,443 --> 00:10:04,840 We can see the computer controls 208 00:10:04,842 --> 00:10:07,048 and monitors pretty much everything that happens. 209 00:10:07,050 --> 00:10:08,912 All run by one central software package 210 00:10:08,914 --> 00:10:10,479 called the “digital butler”" 211 00:10:10,481 --> 00:10:12,383 And this explains why nobody in that hotel 212 00:10:12,385 --> 00:10:14,319 found Adel Foster's body for three days? 213 00:10:14,321 --> 00:10:15,423 We believe so. 214 00:10:15,425 --> 00:10:17,888 We detected malware on the hotel server. 215 00:10:17,890 --> 00:10:19,728 It was sent to every employee 216 00:10:19,730 --> 00:10:21,295 hidden inside a party invitation. 217 00:10:21,297 --> 00:10:23,359 So that's how it breached the firewall. 218 00:10:23,361 --> 00:10:26,368 Ah. And Troy fell. 219 00:10:26,370 --> 00:10:27,968 Yeah, it was the Trojans themselves 220 00:10:27,970 --> 00:10:29,568 that opened up their own city gates 221 00:10:29,570 --> 00:10:31,240 and pulled the wooden horse inside. 222 00:10:31,242 --> 00:10:33,105 Just like the hotel employees 223 00:10:33,107 --> 00:10:35,241 who opened the party invitation and let in the malware. 224 00:10:35,243 --> 00:10:37,377 While they blindly celebrated victory, 225 00:10:37,379 --> 00:10:39,250 their enemy lay in wait. 226 00:10:39,252 --> 00:10:41,019 And Troy fell. 227 00:10:44,358 --> 00:10:45,820 Our hacker had 228 00:10:45,822 --> 00:10:48,158 access to the hotel's main computer. 229 00:10:48,160 --> 00:10:49,798 They found their way to Adel's guest room records 230 00:10:49,800 --> 00:10:51,567 and made it look like she was alive and well 231 00:10:51,569 --> 00:10:53,830 even though Adel Foster was definitely dead. 232 00:10:53,832 --> 00:10:55,598 Well, that would explain the manicure, 233 00:10:55,600 --> 00:10:57,807 the facial, ordering the movie, 234 00:10:57,809 --> 00:10:59,942 even room service, but what about housekeeping? 235 00:10:59,944 --> 00:11:01,406 No one ever entered the room. 236 00:11:01,408 --> 00:11:02,711 Because the “do not disturb” sign 237 00:11:02,713 --> 00:11:04,978 is also controlled by the computer system. 238 00:11:04,980 --> 00:11:08,052 Exactly. Maids won't enter when the light is on. 239 00:11:08,054 --> 00:11:10,756 Hotels connect physical devices and sensors 240 00:11:10,758 --> 00:11:12,989 in the hotel rooms to one central computer 241 00:11:12,991 --> 00:11:15,093 to improve efficiency and cut down cost-- 242 00:11:15,095 --> 00:11:17,396 controlling thermostats and water temperature, 243 00:11:17,398 --> 00:11:19,468 providing you with the ease of ordering services 244 00:11:19,470 --> 00:11:22,036 from the hotel channel on your television. 245 00:11:22,038 --> 00:11:24,433 From one computer, they can control everything. 246 00:11:24,435 --> 00:11:26,265 Right. It's why they sometimes charge you 247 00:11:26,267 --> 00:11:28,202 for the items in the minibar just because 248 00:11:28,204 --> 00:11:30,937 you move them. 249 00:11:30,939 --> 00:11:33,005 Now, the pressure sensor on the shelves 250 00:11:33,007 --> 00:11:34,340 sends a message to the computer telling 251 00:11:34,342 --> 00:11:37,739 its product has been consumed. 252 00:11:37,741 --> 00:11:40,508 But as we all know, computers can be hacked. 253 00:11:40,510 --> 00:11:42,719 I actually met the hat who wrote the code. 254 00:11:42,721 --> 00:11:45,623 Called it a hospitality hack. 255 00:11:45,625 --> 00:11:47,688 All right, now, once a hacker intrudes 256 00:11:47,690 --> 00:11:49,656 the hotel computer system, he has control 257 00:11:49,658 --> 00:11:51,958 over room assignments, check in, check out, 258 00:11:51,960 --> 00:11:54,326 television, 259 00:11:54,328 --> 00:11:56,230 thermostat... 260 00:11:56,232 --> 00:11:58,765 Oh, my favorite: the remote control curtains. 261 00:11:58,767 --> 00:12:00,468 Check this out. 262 00:12:02,070 --> 00:12:03,803 Wait... 263 00:12:03,805 --> 00:12:06,235 Nelson, are you really doing that? 264 00:12:06,237 --> 00:12:09,475 Did you actually hack this hotel from CTOC? 265 00:12:09,477 --> 00:12:10,939 Yeah, that was me. 266 00:12:10,941 --> 00:12:13,809 The point is if all the conveniences are connected 267 00:12:13,811 --> 00:12:15,842 through software to one central computer, 268 00:12:15,844 --> 00:12:17,913 once the hacker's inside the system, 269 00:12:17,915 --> 00:12:19,785 he can create orders for room service, 270 00:12:19,787 --> 00:12:21,514 housekeeping, laundry pickup... 271 00:12:21,516 --> 00:12:22,954 And none of it really happened. 272 00:12:22,956 --> 00:12:24,458 It just looks like it did. 273 00:12:24,460 --> 00:12:26,986 And all activity is recorded under the guest's name 274 00:12:26,988 --> 00:12:28,490 and room number. 275 00:12:28,492 --> 00:12:29,890 Which explains why a dead woman 276 00:12:29,892 --> 00:12:31,659 can order room service and a movie. 277 00:12:31,661 --> 00:12:33,467 So as far as the hotel knew, 278 00:12:33,469 --> 00:12:35,298 the minibar was being restocked, 279 00:12:35,300 --> 00:12:36,802 the laundry was being picked up, 280 00:12:36,804 --> 00:12:39,568 the maids were performing turndown services. 281 00:12:39,570 --> 00:12:42,733 A hacker can control any guest's room 24/7. 282 00:12:43,807 --> 00:12:46,542 This is a very sophisticated cover-up of a murder. 283 00:12:46,544 --> 00:12:49,111 We need to know more about our victim, Adel Foster. 284 00:12:49,113 --> 00:12:51,647 Her devices are on their way to you now, Krumitz. 285 00:12:51,649 --> 00:12:53,647 We need to find this hospitality hacker. 286 00:12:53,649 --> 00:12:55,679 You can't break into a system this complex 287 00:12:55,681 --> 00:12:57,654 without leaving some digital dust behind. 288 00:12:57,656 --> 00:13:00,189 We're on it. 289 00:13:00,191 --> 00:13:01,956 All right, so we got our victim's laptop, 290 00:13:01,958 --> 00:13:03,988 tablet and destroyed cell. 291 00:13:03,990 --> 00:13:05,755 Our killer has a three-day head start. 292 00:13:05,757 --> 00:13:07,552 Puts him right where we want him. 293 00:13:07,554 --> 00:13:09,788 He thinks he got away with murder. 294 00:13:09,790 --> 00:13:11,323 Which means he already made a mistake 295 00:13:11,325 --> 00:13:12,982 that will lead us right to him. 296 00:13:12,984 --> 00:13:15,683 We are gonna find Adel Foster's murderer. 297 00:13:19,692 --> 00:13:21,754 You know, I really could have 298 00:13:21,756 --> 00:13:23,457 used these things two years ago. 299 00:13:23,459 --> 00:13:25,593 But you know every time Apple introduces a new device, 300 00:13:25,595 --> 00:13:27,024 there's a new cord, a new connector, 301 00:13:27,026 --> 00:13:28,928 and then all the old stuff is not compatible with 302 00:13:28,930 --> 00:13:31,432 the new stuff, so then you... you know, you got to go back, 303 00:13:31,434 --> 00:13:33,497 buy all the new Apple products, connect them and... 304 00:13:33,499 --> 00:13:35,001 Dude, dude, really? 305 00:13:35,003 --> 00:13:36,105 We're trying to work here. 306 00:13:36,107 --> 00:13:37,769 Okay, well, then give me something to do. 307 00:13:37,771 --> 00:13:40,978 Here. Lay out all the pieces of this cell phone. 308 00:13:40,980 --> 00:13:42,442 Disassemble it, remove the circuit board, 309 00:13:42,444 --> 00:13:44,113 then scrub the resistor jumper connections. 310 00:13:44,115 --> 00:13:46,113 There's a toothbrush and alcohol solution 311 00:13:46,115 --> 00:13:48,377 right over there. Oh, okay. 312 00:13:48,379 --> 00:13:50,185 I see how you do. 313 00:13:50,187 --> 00:13:52,584 New guy gets the poop phone. What? 314 00:13:52,586 --> 00:13:54,584 I happen to know that this was the phone that was recovered 315 00:13:54,586 --> 00:13:56,120 from the toilet in the hotel room. 316 00:13:56,122 --> 00:13:58,024 He's right. 317 00:13:58,026 --> 00:13:59,527 That is the poop phone. 318 00:13:59,529 --> 00:14:01,358 Really? You're gonna encourage this? 319 00:14:01,360 --> 00:14:03,261 And you're not even that new anymore. 320 00:14:03,263 --> 00:14:04,525 Okay, you know what, Nelson? 321 00:14:04,527 --> 00:14:06,927 Fine. I will gladly take the poop phone 322 00:14:06,929 --> 00:14:08,934 if you just do me one favor and stop talking. 323 00:14:09,022 --> 00:14:09,933 Guys. 324 00:14:09,957 --> 00:14:10,673 Okay, what, you in a bad mood or something, Krummy? 325 00:14:10,674 --> 00:14:11,967 You want to talk about it? 326 00:14:11,969 --> 00:14:13,839 Oh. You're having girl problems. 327 00:14:13,841 --> 00:14:15,870 Oh, my... I knew it. 328 00:14:15,872 --> 00:14:17,741 Raven, could you grab me that pen over there 329 00:14:17,743 --> 00:14:19,341 and stab me with it? That would be awesome. 330 00:14:19,343 --> 00:14:21,373 Guys, will you cut it out and come here. You got no game. 331 00:14:21,375 --> 00:14:23,149 I found something. I have... I have game. 332 00:14:23,151 --> 00:14:24,412 You guys. 333 00:14:24,414 --> 00:14:26,181 I went back to the employee party invitation 334 00:14:26,183 --> 00:14:27,918 where the malware was embedded. 335 00:14:27,920 --> 00:14:29,989 I couldn't find the information on the computer that sent it. 336 00:14:29,991 --> 00:14:31,557 The hacker anonymized it. 337 00:14:31,559 --> 00:14:34,860 So, I responded yes. I got back an auto-reply confirmation, 338 00:14:34,862 --> 00:14:38,358 and guess what-- our hacker forgot to anonymize that e-mail. 339 00:14:38,360 --> 00:14:41,464 Pretty sure it's the same one that sent the invitation. 340 00:14:41,466 --> 00:14:43,169 And I got his I.P. address on the computer. 341 00:14:43,171 --> 00:14:44,706 Yeah! These guys never think two steps ahead. 342 00:14:44,708 --> 00:14:46,578 I love this job. This is gonna 343 00:14:46,580 --> 00:14:48,209 lead us right to our hacker. 344 00:14:59,627 --> 00:15:02,900 ♪ ♪ 345 00:15:07,440 --> 00:15:09,477 Evan Wescott? Is this your computer? 346 00:15:09,479 --> 00:15:11,843 Yes. Why? FBI. 347 00:15:11,845 --> 00:15:13,610 You're under arrest for computer fraud 348 00:15:13,612 --> 00:15:15,778 in connection with the murder of Adel Foster. 349 00:15:15,780 --> 00:15:17,114 What? What are you talking about? Hey, whoa. 350 00:15:17,116 --> 00:15:19,180 Hold on a minute. I don't even know who that is. 351 00:15:19,182 --> 00:15:22,683 You got the wrong guy. I didn't kill anybody. 352 00:15:22,685 --> 00:15:26,088 We can do this the hard way, or you can come quietly. 353 00:15:32,058 --> 00:15:34,898 You hacked the Kirkendahl Hotel's main computer, Evan. 354 00:15:34,900 --> 00:15:38,102 We know this because the I.P. address of the device used 355 00:15:38,104 --> 00:15:39,973 led us back to your laptop. 356 00:15:39,975 --> 00:15:41,875 That's impossible. I don't even know how to do 357 00:15:41,877 --> 00:15:43,810 - something like that. - You created a backdoor 358 00:15:43,812 --> 00:15:45,137 in the computer systems and took control 359 00:15:45,139 --> 00:15:46,305 of the hotel's hospitality functions-- 360 00:15:46,307 --> 00:15:47,512 maid service, 361 00:15:47,514 --> 00:15:48,743 room service, minibar. 362 00:15:48,745 --> 00:15:49,975 You murdered Adel and activated 363 00:15:49,977 --> 00:15:51,246 those services to make it look 364 00:15:51,248 --> 00:15:54,276 like she was alive three days after her death. 365 00:15:54,278 --> 00:15:56,843 What? That's insane. I didn't kill anybody. 366 00:15:56,845 --> 00:15:58,681 Your cell phone places you at the hotel 367 00:15:58,683 --> 00:16:00,680 at the exact time of Adel Foster's murder. 368 00:16:00,682 --> 00:16:04,984 Your phone's location services puts you in that hotel. 369 00:16:04,986 --> 00:16:06,519 Location services? 370 00:16:06,521 --> 00:16:08,550 The little program that's always running 371 00:16:08,552 --> 00:16:10,620 in the background of your phone. 372 00:16:10,622 --> 00:16:12,291 Logs everywhere you go. 373 00:16:12,293 --> 00:16:14,260 Nifty little feature. 374 00:16:14,262 --> 00:16:17,997 See the elevation listed here? 29.7 meters. 375 00:16:17,999 --> 00:16:20,660 That's roughly seven floors. 376 00:16:20,662 --> 00:16:23,194 Her body was found in room 715. 377 00:16:23,196 --> 00:16:24,834 Okay, I-I'm not a murderer. 378 00:16:24,836 --> 00:16:25,834 Really? 379 00:16:25,836 --> 00:16:27,097 'Cause you sure sound like one 380 00:16:27,099 --> 00:16:29,072 in the text that you sent Adel. 381 00:16:29,074 --> 00:16:31,735 We found that on your phone. 382 00:16:32,937 --> 00:16:34,942 These are not my text messages. 383 00:16:34,944 --> 00:16:38,279 And I already told you, I don't know anybody named Adel. 384 00:16:38,281 --> 00:16:40,775 Are you sure you never talked to her? 385 00:16:40,777 --> 00:16:43,079 This is surveillance footage from your bar, Evade, 386 00:16:43,081 --> 00:16:44,318 on the night she was murdered. 387 00:16:44,320 --> 00:16:46,814 ♪ ♪ 388 00:16:57,400 --> 00:16:59,998 I mean, 'cause that sure as hell looks like her, 389 00:17:00,000 --> 00:17:02,428 and that is definitely you. 390 00:17:02,430 --> 00:17:05,300 Look, man, a lot of people come into my club. 391 00:17:05,302 --> 00:17:07,037 - And, yeah, I meet a lot of women. - Yeah? 392 00:17:07,039 --> 00:17:09,204 Well, this one was murdered three days ago. 393 00:17:10,277 --> 00:17:11,476 Where were you? 394 00:17:11,478 --> 00:17:13,509 I was at the club. 395 00:17:13,511 --> 00:17:15,109 I'm always at the club. 396 00:17:17,150 --> 00:17:18,948 It's a pretty crowded place at night. 397 00:17:18,950 --> 00:17:21,883 Could easily step out for an hour, and no one would miss you. 398 00:17:21,885 --> 00:17:24,017 This is ridiculous. I didn't do anything. 399 00:17:24,019 --> 00:17:26,215 At first, I couldn't understand why you went to all the trouble 400 00:17:26,217 --> 00:17:29,255 to make it look like Adel was still alive. 401 00:17:29,257 --> 00:17:31,486 You wanted to buy yourself time 402 00:17:31,488 --> 00:17:33,691 to create an alibi. The hotel hack. 403 00:17:33,693 --> 00:17:35,258 And you certainly can't deny 404 00:17:35,260 --> 00:17:36,888 that you were capable of doing it. 405 00:17:36,890 --> 00:17:39,086 You were a computer science major 406 00:17:39,088 --> 00:17:40,755 at Kenniwick University. 407 00:17:40,757 --> 00:17:42,418 Day one, nobody found the body. 408 00:17:42,420 --> 00:17:45,026 Day two, no one came for you. 409 00:17:45,028 --> 00:17:47,720 Day three, you got comfortable. 410 00:17:47,722 --> 00:17:49,055 You distanced yourself from the murder. 411 00:17:49,057 --> 00:17:50,095 You thought there was no evidence 412 00:17:50,097 --> 00:17:51,223 tying you to the scene of the crime. 413 00:17:51,225 --> 00:17:54,062 You got away with murder. 414 00:17:54,064 --> 00:17:55,397 - Almost. - No. 415 00:17:55,399 --> 00:17:56,661 I didn't kill anybody. 416 00:17:56,663 --> 00:17:58,132 I didn't do any of these things. 417 00:17:58,134 --> 00:17:59,564 Evan... 418 00:17:59,566 --> 00:18:03,266 your devices tell us you're lying. 419 00:18:10,853 --> 00:18:13,588 ♪ ♪ 420 00:18:42,079 --> 00:18:43,141 Shane Tillman. 421 00:18:43,143 --> 00:18:47,148 Adel is... er, was... my girlfriend. 422 00:18:47,150 --> 00:18:49,020 I don't understand how this happened. 423 00:18:49,022 --> 00:18:51,383 Doesn't the hotel have security? 424 00:18:51,434 --> 00:18:53,136 We're still investigating the circumstances 425 00:18:53,138 --> 00:18:54,200 surrounding Adel's death. 426 00:18:54,202 --> 00:18:55,568 You mean her murder. 427 00:18:57,378 --> 00:18:59,208 When her cell kept going to voicemail, 428 00:18:59,210 --> 00:19:00,471 I called the-the hotel, and she... 429 00:19:00,473 --> 00:19:02,142 they said that she was still checked in. 430 00:19:02,144 --> 00:19:04,573 I thought that she had lost her phone. 431 00:19:04,575 --> 00:19:06,611 You know? I mean, she does that a lot. 432 00:19:06,613 --> 00:19:08,777 But I never thought... 433 00:19:11,746 --> 00:19:13,879 ...you know, that, um, that she was dead. 434 00:19:13,881 --> 00:19:16,182 You spoke to her the night that she was killed. 435 00:19:16,184 --> 00:19:18,117 Yeah, she seemed excited. 436 00:19:18,119 --> 00:19:19,749 Talking a mile a minute. 437 00:19:21,054 --> 00:19:22,251 Adel saved up money 438 00:19:22,253 --> 00:19:24,017 for months for this trip. 439 00:19:24,019 --> 00:19:26,782 You know, she had a whole itinerary: 440 00:19:26,784 --> 00:19:30,188 Coney Island, Statue of Liberty, Empire State Building, 441 00:19:30,190 --> 00:19:31,619 a couple of Broadway shows. 442 00:19:31,621 --> 00:19:33,553 Why didn't you go with her? 443 00:19:35,353 --> 00:19:37,551 I got called into work last minute. 444 00:19:37,553 --> 00:19:39,024 What do you do? 445 00:19:39,026 --> 00:19:41,425 Some part-time stuff. 446 00:19:41,427 --> 00:19:43,024 Operations and Safety at the hospital, 447 00:19:43,026 --> 00:19:44,464 and I work construction on the weekends. 448 00:19:44,466 --> 00:19:47,765 They were short on staff and needed some extra help. 449 00:19:47,767 --> 00:19:50,397 I was trying to save money so we could go to Europe. 450 00:19:52,197 --> 00:19:53,698 I think, uh... 451 00:19:53,700 --> 00:19:56,266 I think she wanted to experience New York this time on her own. 452 00:19:56,268 --> 00:19:57,905 She loved the city. 453 00:19:59,675 --> 00:20:01,408 Even though we were in East Rutherford, 454 00:20:01,410 --> 00:20:03,375 we didn't get up here often. 455 00:20:05,144 --> 00:20:07,310 I'm sorry. I, uh... 456 00:20:07,312 --> 00:20:08,845 I just can't believe 457 00:20:08,847 --> 00:20:10,675 she's gone. 458 00:20:10,677 --> 00:20:13,145 All right. Every piece is scrubbed, dried and connected. 459 00:20:13,147 --> 00:20:15,147 Between that spider this morning 460 00:20:15,149 --> 00:20:17,284 and this phone, boy, I could so use a hot shower. 461 00:20:17,286 --> 00:20:18,685 Dude, man up. 462 00:20:18,687 --> 00:20:20,085 It's time to Frankenstein this thing. 463 00:20:20,087 --> 00:20:22,523 We are gonna rebuild Adel's phone and resurrect its memory. 464 00:20:22,525 --> 00:20:23,722 You mean we can do that? 465 00:20:23,724 --> 00:20:25,623 We can actually get data off of this thing? 466 00:20:25,625 --> 00:20:27,287 Watch and learn, son. 467 00:20:27,289 --> 00:20:28,991 This is how the good guys do it. 468 00:20:28,993 --> 00:20:31,296 Watch and learn. 469 00:20:31,298 --> 00:20:33,526 ♪ ♪ 470 00:20:53,151 --> 00:20:55,687 ♪ ♪ 471 00:21:06,694 --> 00:21:08,627 You see what I'm seeing? 472 00:21:08,629 --> 00:21:09,731 Yeah. 473 00:21:09,733 --> 00:21:10,930 A problem. 474 00:21:10,932 --> 00:21:12,562 So Krumitz was able to pull some data 475 00:21:12,564 --> 00:21:14,864 off Adel's phone, but the threatening text messages 476 00:21:14,866 --> 00:21:16,167 from Evan aren't there. 477 00:21:16,169 --> 00:21:17,534 Were they deleted? 478 00:21:17,536 --> 00:21:18,862 They never existed. 479 00:21:18,864 --> 00:21:20,798 So I double-checked with Evan's service provider. 480 00:21:20,800 --> 00:21:22,902 They have no record of the calls or the texts either. 481 00:21:22,904 --> 00:21:25,869 Which means Evan didn't send or receive those texts. 482 00:21:25,871 --> 00:21:28,141 So how did they get on his phone? 483 00:21:28,143 --> 00:21:30,340 So Elijah sent me everything he pulled off 484 00:21:30,342 --> 00:21:31,876 Evan Wescott's phone. 485 00:21:31,878 --> 00:21:33,445 Those text message conversations 486 00:21:33,447 --> 00:21:35,582 between Evan and Adel were faked. 487 00:21:35,584 --> 00:21:37,918 How can somebody fake a text on another device? 488 00:21:37,920 --> 00:21:39,749 Once you get a text message into your phone, 489 00:21:39,751 --> 00:21:41,621 it's added to one long database. 490 00:21:41,623 --> 00:21:44,155 If you're smart enough and have the right software, 491 00:21:44,157 --> 00:21:46,459 you can manipulate that file and make it look 492 00:21:46,461 --> 00:21:49,426 like you're getting text messages from whoever you want. 493 00:21:49,428 --> 00:21:50,490 Whenever you want. 494 00:21:50,492 --> 00:21:53,729 Or to someone else's phone. 495 00:21:53,731 --> 00:21:57,230 Mmm. “Happy New Year, Krumitz, 496 00:21:57,232 --> 00:22:00,301 from your best pal, Sifter.” 497 00:22:00,303 --> 00:22:03,101 Sent from your phone January 1, 2016. 498 00:22:03,103 --> 00:22:04,005 That is impressive. 499 00:22:04,007 --> 00:22:07,234 And a little creepy. Yeah. 500 00:22:07,236 --> 00:22:08,873 Now, would you need physical access to Evan's phone 501 00:22:08,875 --> 00:22:10,473 to fake those text messages? 502 00:22:10,475 --> 00:22:13,607 No. Plus, Evan's phone doesn't even have the software necessary 503 00:22:13,609 --> 00:22:16,574 to manipulate the database-- it had to be done remotely. 504 00:22:16,576 --> 00:22:18,910 And that's not all. GPS coordinates 505 00:22:18,912 --> 00:22:20,478 that put Evan Wescott in the hotel room 506 00:22:20,480 --> 00:22:21,710 at the time of the murder... 507 00:22:21,712 --> 00:22:22,918 Faked. Faked. 508 00:22:22,920 --> 00:22:25,286 His phone was hacked. Yeah! 509 00:22:25,288 --> 00:22:26,382 Oh... 510 00:22:26,384 --> 00:22:28,591 Avery, 511 00:22:28,593 --> 00:22:31,326 all of our digital evidence is lying to us. 512 00:22:31,328 --> 00:22:33,294 Is Krumitz sure no mistake was made? 513 00:22:33,296 --> 00:22:34,158 He's positive. 514 00:22:34,160 --> 00:22:35,559 What about the malware injected 515 00:22:35,561 --> 00:22:37,798 into the hotel's computer system? 516 00:22:37,800 --> 00:22:39,597 It came from Evan Wescott's computer. 517 00:22:39,599 --> 00:22:41,797 But Krumitz doesn't believe Evan is our hacker. 518 00:22:41,799 --> 00:22:43,669 - He's sure? - Yes. 519 00:22:43,671 --> 00:22:45,869 And how many times have you told me that Daniel Krumitz is 520 00:22:45,871 --> 00:22:47,835 the best white hat hacker ever? 521 00:22:47,837 --> 00:22:52,074 Looks like Evan Wescott is being framed for murder. 522 00:23:01,413 --> 00:23:02,715 For someone to frame Evan, 523 00:23:02,717 --> 00:23:05,117 they had to route the intrusion through his laptop, 524 00:23:05,119 --> 00:23:07,023 change the GPS, and create those text messages. 525 00:23:07,025 --> 00:23:08,528 Maybe he framed himself. 526 00:23:08,530 --> 00:23:10,865 Clearly, you're new to this and don't understand 527 00:23:10,867 --> 00:23:13,432 the behavior of a criminal. Other than yourself. 528 00:23:13,434 --> 00:23:15,494 What I understand is I would do anything not to go to prison. 529 00:23:15,496 --> 00:23:16,863 Pretty risky to frame yourself. 530 00:23:16,887 --> 00:23:18,397 It's working for Evan. You believe he's innocent. 531 00:23:18,398 --> 00:23:19,731 I believe in cyber evidence. 532 00:23:19,733 --> 00:23:21,266 Okay, I'm not saying the evidence is wrong. 533 00:23:21,268 --> 00:23:23,664 I'm just saying his devices could be manipulated by anybody. 534 00:23:23,666 --> 00:23:25,599 Evidence doesn't point to the identity of a hacker. 535 00:23:25,601 --> 00:23:27,566 So what happened when we caught you? 536 00:23:27,568 --> 00:23:28,837 See, why you want to get all personal? 537 00:23:28,839 --> 00:23:30,133 What? That's what I'm saying... 538 00:23:30,135 --> 00:23:32,036 Guys? Guys? 539 00:23:32,038 --> 00:23:34,076 Stop! Stop! Focus on the case! Whatever, whatever. 540 00:23:34,078 --> 00:23:35,372 Focus on the case. 541 00:23:35,374 --> 00:23:36,971 Whoever hacked them, 542 00:23:36,973 --> 00:23:39,011 gained access to at least one 543 00:23:39,013 --> 00:23:40,346 of Evan Wescott's devices. 544 00:23:40,348 --> 00:23:41,947 Evan has full access to all of his devices. 545 00:23:41,949 --> 00:23:43,452 Physical access is the easiest, 546 00:23:43,454 --> 00:23:45,717 which is why I think it's Evan. Physical access 547 00:23:45,719 --> 00:23:47,054 is also the riskiest. 548 00:23:47,056 --> 00:23:48,390 Nelson, just for a minute, 549 00:23:48,392 --> 00:23:50,422 try to buy into the fact that Adel's killer 550 00:23:50,424 --> 00:23:51,494 might not be Evan Wescott. 551 00:23:51,496 --> 00:23:54,630 The hacker behind this had to have skills. 552 00:23:54,632 --> 00:23:56,660 Evan has a computer science degree. 553 00:23:56,662 --> 00:23:58,028 I'm just saying! 554 00:23:58,030 --> 00:24:00,363 All right, fine, I'll, uh... 555 00:24:00,365 --> 00:24:01,963 I'll play along. 556 00:24:01,965 --> 00:24:03,939 The hacker could've easily done this remotely. 557 00:24:03,941 --> 00:24:06,236 If I'd done it, I'd “war drive” him. 558 00:24:07,478 --> 00:24:10,309 Pull up to his house. 559 00:24:10,311 --> 00:24:11,711 Hack into his Wi-Fi, 560 00:24:11,713 --> 00:24:13,680 plant everything on his computer and phone 561 00:24:13,682 --> 00:24:17,825 while he's still inside, totally oblivious. 562 00:24:17,827 --> 00:24:19,256 It's still too risky. 563 00:24:19,258 --> 00:24:20,792 You're sitting outside of his house. 564 00:24:20,794 --> 00:24:22,528 What if somebody sees you? Or your car? 565 00:24:22,530 --> 00:24:25,558 The best way to do it is from the safety of your own home. 566 00:24:25,560 --> 00:24:27,229 All you have to do is “spear phish” him-- 567 00:24:27,231 --> 00:24:28,764 a socially engineered attack. 568 00:24:28,766 --> 00:24:30,764 Send Evan an e-mail with a fake link 569 00:24:30,766 --> 00:24:34,034 from his bank or something, wait for him to click on it, 570 00:24:34,036 --> 00:24:35,066 and then boom! 571 00:24:35,068 --> 00:24:37,001 Full access to his laptop 572 00:24:37,003 --> 00:24:40,337 and any device that connects to it, like his phone! 573 00:24:40,339 --> 00:24:42,840 Okay, so how you know he's gonna click on it? And when? 574 00:24:42,842 --> 00:24:44,777 Whoever did this was short on time. 575 00:24:44,779 --> 00:24:46,841 The best way to stay anonymous and get instant access 576 00:24:46,843 --> 00:24:48,513 to Evan's devices is to wait for him 577 00:24:48,515 --> 00:24:50,481 to connect to an open Wi-Fi signal somewhere. 578 00:24:50,483 --> 00:24:53,514 Anywhere they're advertising free Wi-Fi is like a hacker's 579 00:24:53,516 --> 00:24:56,324 virtual playground-- tons of unexpected people unaware 580 00:24:56,326 --> 00:24:58,493 that the person next to them sharing the same connection 581 00:24:58,495 --> 00:25:00,125 could be intruding onto their devices 582 00:25:00,127 --> 00:25:02,030 and stealing all their information. 583 00:25:02,032 --> 00:25:05,598 Or in Evan's case, adding information. 584 00:25:05,600 --> 00:25:07,205 Look, I still think he could've done it himself. 585 00:25:07,207 --> 00:25:08,172 I mean, that's just me. 586 00:25:08,174 --> 00:25:09,900 Wi-Fi is the best option. 587 00:25:09,902 --> 00:25:12,202 So... where was Evan hacked? 588 00:25:12,204 --> 00:25:13,872 Well, according to his frequent locations on Evan's phone, 589 00:25:13,874 --> 00:25:15,871 he went to the gym three or four times a week. 590 00:25:15,873 --> 00:25:17,342 Most gyms have free Wi-Fi. Restaurants, too. 591 00:25:17,344 --> 00:25:19,711 I bet you he was eating out every night. 592 00:25:19,713 --> 00:25:21,808 You know, club owners score mad dates. 593 00:25:21,810 --> 00:25:24,985 How often is he at Carla's Cafe? 594 00:25:25,820 --> 00:25:27,954 Almost every day. 595 00:25:29,756 --> 00:25:31,522 Well, according to the network logs in Evan's laptop, 596 00:25:31,524 --> 00:25:32,994 he connected to the coffee shop's Wi-Fi 597 00:25:32,996 --> 00:25:34,490 the morning after the murder. 598 00:25:34,492 --> 00:25:36,192 You still think it's a possibility 599 00:25:36,194 --> 00:25:37,464 that he framed himself? 600 00:25:37,466 --> 00:25:40,127 Yeah. I do. 601 00:25:47,370 --> 00:25:49,937 All right. So I spoke to the manager. 602 00:25:49,939 --> 00:25:51,146 The surveillance cameras are all dummies. 603 00:25:51,148 --> 00:25:52,810 They're just there as a crime deterrent. 604 00:25:52,812 --> 00:25:54,849 They don't record a damn thing. 605 00:25:54,851 --> 00:25:57,647 But... the Wi-Fi went down three days ago 606 00:25:57,649 --> 00:25:59,151 at 10:32 a.m. 607 00:25:59,153 --> 00:26:02,752 Now, according to Evan's laptop, he was long gone at that time. 608 00:26:02,754 --> 00:26:04,824 But not onto the cafe's router. 609 00:26:04,826 --> 00:26:08,327 Maybe someone set up an evil twin router. 610 00:26:08,329 --> 00:26:10,326 And that's how he got hacked. Now, my phone... 611 00:26:10,328 --> 00:26:12,389 can give the illusion of being a Wi-Fi signal, 612 00:26:12,391 --> 00:26:13,691 same as a twin router. 613 00:26:13,693 --> 00:26:16,528 All I have to do is activate my own personal hot spot 614 00:26:16,530 --> 00:26:19,492 from my device, and I am open Wi-Fi. 615 00:26:19,494 --> 00:26:21,491 I can even name it anything I want. 616 00:26:21,493 --> 00:26:24,291 Say we're in Carla's Cafe, right? 617 00:26:24,293 --> 00:26:27,959 Think I'll name my new hot spot network... 618 00:26:27,961 --> 00:26:29,756 “Carla's Cafe.” 619 00:26:29,758 --> 00:26:31,627 Now, log on to the free Wi-Fi. 620 00:26:35,438 --> 00:26:37,405 Which one? There are two. 621 00:26:37,407 --> 00:26:38,437 Exactly. 622 00:26:38,439 --> 00:26:40,573 The one I just created and the real one. 623 00:26:40,575 --> 00:26:42,846 I'm guessing our target eliminated 624 00:26:42,848 --> 00:26:44,943 the real Carla's Cafe Wi-Fi. 625 00:26:44,945 --> 00:26:46,615 Evan came in, 626 00:26:46,617 --> 00:26:49,585 logged on to the decoy signal... 627 00:26:49,587 --> 00:26:52,423 and the hacker gained control of his device. 628 00:26:52,425 --> 00:26:53,716 You just did all that with your phone? 629 00:26:53,718 --> 00:26:55,853 Just a few clicks of a button. 630 00:26:55,855 --> 00:26:59,527 Now, I-I can't control your device from my phone, 631 00:26:59,529 --> 00:27:01,760 but our target had an actual router. 632 00:27:01,762 --> 00:27:04,135 He was able to push any information he wanted 633 00:27:04,137 --> 00:27:07,030 onto Evan's devices. 634 00:27:07,032 --> 00:27:09,069 I mean, anytime you log on to open Wi-Fi, 635 00:27:09,071 --> 00:27:10,332 you leave yourself vulnerable. 636 00:27:10,334 --> 00:27:13,035 Or in our case, you become a murder suspect. 637 00:27:13,037 --> 00:27:14,267 It can happen to anyone. 638 00:27:14,269 --> 00:27:17,972 Looks like it just happened to Evan Wescott. 639 00:27:20,713 --> 00:27:22,384 Raven, I need you to track down 640 00:27:22,386 --> 00:27:24,721 the owner of an evil twin router. 641 00:27:34,867 --> 00:27:37,868 Right. 642 00:27:38,711 --> 00:27:40,036 Nelson thinks Evan framed himself. 643 00:27:40,038 --> 00:27:42,410 That would be a smart move. 644 00:27:42,412 --> 00:27:44,473 You don't really believe that, do you? 645 00:27:44,475 --> 00:27:46,272 Nelson thinks the way hackers do. 646 00:27:46,274 --> 00:27:47,742 But... 647 00:27:47,744 --> 00:27:49,741 Evan has no motive. 648 00:27:49,743 --> 00:27:52,445 And no definitive connection to Adel Foster 649 00:27:52,447 --> 00:27:54,845 other than a kiss; and kisses rarely 650 00:27:54,847 --> 00:27:56,550 get you convicted of murder. 651 00:28:00,223 --> 00:28:02,754 You miss New York. 652 00:28:02,756 --> 00:28:04,689 Yeah, feeling a bit nostalgic. 653 00:28:04,691 --> 00:28:07,792 I opened my first practice in Manhattan. 654 00:28:07,794 --> 00:28:09,519 Hung the shingle on a brownstone 655 00:28:09,521 --> 00:28:11,724 just like that one there. Went from 656 00:28:11,726 --> 00:28:14,258 analyzing minds to analyzing cyber criminals. 657 00:28:14,260 --> 00:28:16,961 Wasn't really a plan, it just happened. 658 00:28:16,963 --> 00:28:18,858 You ever think about moving back? 659 00:28:18,860 --> 00:28:20,361 No. 660 00:28:20,363 --> 00:28:22,530 I only think about one thing. 661 00:28:22,532 --> 00:28:25,404 Catching the guy that hacked and stole my files. 662 00:28:25,406 --> 00:28:27,710 There isn't a morning where I don't wake up wondering 663 00:28:27,712 --> 00:28:29,405 if today's the day that he's gonna 664 00:28:29,407 --> 00:28:31,476 release private patient information. 665 00:28:31,478 --> 00:28:33,347 And the whole nightmare will start all over again. 666 00:28:33,349 --> 00:28:35,178 We'll catch him. 667 00:28:37,084 --> 00:28:39,777 You know what I miss about this place? 668 00:28:39,779 --> 00:28:41,049 The Mets. 669 00:28:41,051 --> 00:28:43,279 The Mets? 670 00:28:44,320 --> 00:28:46,549 I would comment, but you'd probably fire me. 671 00:28:48,285 --> 00:28:50,586 But there is one question I can't shake, Elijah. 672 00:28:50,588 --> 00:28:51,952 Evan Wescott. 673 00:28:51,954 --> 00:28:53,318 What about him? 674 00:28:53,320 --> 00:28:55,148 Well, the beauty of an open Wi-Fi hack 675 00:28:55,150 --> 00:28:56,851 is its sheer randomness. 676 00:28:56,853 --> 00:29:00,353 Our killer could've framed anyone on his router 677 00:29:00,355 --> 00:29:02,184 for Adel's murder. 678 00:29:02,186 --> 00:29:04,488 You think the target chose Evan specifically. 679 00:29:04,490 --> 00:29:06,488 Adel went to Evan's club the night of the murder. 680 00:29:06,490 --> 00:29:08,655 And the next morning, Evan ends up at Carla's Cafe 681 00:29:08,657 --> 00:29:11,631 at the exact same time as the evil twin router. 682 00:29:11,633 --> 00:29:13,201 It feels personal. 683 00:29:13,203 --> 00:29:15,536 Our target crafted a murder for Evan. 684 00:29:15,538 --> 00:29:16,903 Fabricated texts 685 00:29:16,905 --> 00:29:20,605 and GPS data, linked him to the hotel hack. 686 00:29:20,607 --> 00:29:24,634 He set up Evan as a fall guy for a reason, but why? 687 00:29:26,940 --> 00:29:29,042 I identified the router that was used 688 00:29:29,044 --> 00:29:30,843 to hack Evan in Carla's Cafe. 689 00:29:30,845 --> 00:29:32,276 The latest and greatest 690 00:29:32,278 --> 00:29:34,083 in evil twin deception, huh? 691 00:29:34,085 --> 00:29:37,146 Manufacturer gave me the big box store where it was sold. 692 00:29:37,148 --> 00:29:38,680 All right, from your smirk, I'm guessing 693 00:29:38,682 --> 00:29:40,615 it was purchased recently. Mm-hmm. 694 00:29:40,617 --> 00:29:43,151 Point of sale puts that gentleman at the register. 695 00:29:43,153 --> 00:29:45,054 He paid cash. 696 00:29:45,056 --> 00:29:47,821 Get this to Avery and Elijah. 697 00:29:47,823 --> 00:29:49,221 We've got him. 698 00:29:51,357 --> 00:29:53,995 Look who was in Manhattan the morning after Adel's murder. 699 00:29:53,997 --> 00:29:56,331 Just got this from Raven. 700 00:29:56,333 --> 00:29:59,467 Oh. The heartbroken boyfriend. 701 00:30:04,573 --> 00:30:07,047 Shane Tillman, FBI! 702 00:30:15,061 --> 00:30:17,196 He's not here. 703 00:30:20,296 --> 00:30:21,999 I'm gonna image the hard drive, 704 00:30:22,001 --> 00:30:24,798 send it to Nelson and Krumitz to comb through the data. 705 00:30:24,800 --> 00:30:27,336 Broken cup. 706 00:30:29,578 --> 00:30:31,310 Damaged wall. 707 00:30:31,312 --> 00:30:32,741 There was an argument. 708 00:30:37,552 --> 00:30:39,182 Adel wasn't visiting New York. 709 00:30:39,184 --> 00:30:41,655 She was running away from Shane. 710 00:30:41,657 --> 00:30:43,760 You know, something struck me as odd when I saw 711 00:30:43,762 --> 00:30:46,362 the bruises on her wrist at the crime scene. 712 00:30:46,364 --> 00:30:49,160 Look. They're purple, almost black. 713 00:30:49,162 --> 00:30:51,232 If she'd gotten these during the struggle the night 714 00:30:51,234 --> 00:30:53,665 that she was killed, they'd be pink or not even visible. 715 00:30:53,667 --> 00:30:56,596 She got these before the night she was killed. 716 00:30:59,701 --> 00:31:03,001 Adel was leaving Shane. 717 00:31:03,003 --> 00:31:04,672 He came home. 718 00:31:08,644 --> 00:31:09,708 Stop it! 719 00:31:09,710 --> 00:31:11,212 He pulled her things out of her bag 720 00:31:11,214 --> 00:31:12,716 to prevent her from leaving. 721 00:31:12,718 --> 00:31:14,452 When she escaped, he grabbed her wrists, 722 00:31:14,454 --> 00:31:15,747 which caused the bruising. 723 00:31:17,157 --> 00:31:19,353 Oh, God! 724 00:31:23,720 --> 00:31:27,453 When she left, he started drinking. 725 00:31:27,455 --> 00:31:28,621 He followed her 726 00:31:28,623 --> 00:31:30,429 to New York and he killed her. 727 00:31:30,431 --> 00:31:33,795 My God. 728 00:31:33,797 --> 00:31:37,128 Even when women get the courage to leave abusive relationships, 729 00:31:37,130 --> 00:31:39,263 sometimes they still get killed. 730 00:31:39,265 --> 00:31:40,895 So what's his next move? 731 00:31:40,897 --> 00:31:43,230 Well, he's angry. 732 00:31:43,232 --> 00:31:44,703 He's calculated. 733 00:31:44,705 --> 00:31:46,199 He's got nothing to lose. 734 00:31:53,651 --> 00:31:56,081 And he's armed and dangerous. 735 00:31:56,083 --> 00:31:57,482 I just hit a dead end. 736 00:31:57,484 --> 00:31:59,417 Tillman's phone's not showing a signal. 737 00:31:59,419 --> 00:32:02,220 He must have turned it off. There's no way to track him. 738 00:32:02,222 --> 00:32:04,124 I'll see what we can do with Tillman's laptop. 739 00:32:04,126 --> 00:32:06,059 His recent online activity should give us a glimpse 740 00:32:06,061 --> 00:32:07,195 into his state of mind. 741 00:32:07,197 --> 00:32:08,627 Yeah, browser history has been cleared. 742 00:32:08,629 --> 00:32:10,667 Yeah, well, clearing your history may hide porn sites 743 00:32:10,669 --> 00:32:13,132 from your girlfriend, but it won't hide anything from me. 744 00:32:13,134 --> 00:32:16,742 Browser artifacts are easily recovered with the right tools. 745 00:32:16,744 --> 00:32:19,110 Oh, check it out. Mostly New York news affiliates. 746 00:32:19,112 --> 00:32:20,993 He's following the Adel Foster murder investigation. 747 00:32:20,994 --> 00:32:22,910 You think he knows we're onto him? Always assume 748 00:32:22,912 --> 00:32:24,614 that the bad guys are two steps ahead of you, Nelson. 749 00:32:24,616 --> 00:32:26,054 That way, you're prepared for anything, 750 00:32:26,056 --> 00:32:27,720 and you're never caught off guard. 751 00:32:27,722 --> 00:32:31,329 Hey, man, he visited a cell phone locating site? 752 00:32:31,331 --> 00:32:32,825 I mean, what, he lost his cell phone? 753 00:32:32,827 --> 00:32:34,697 No, he wasn't looking for his phone. 754 00:32:34,699 --> 00:32:36,601 He was tracking someone else. Look. 755 00:32:36,603 --> 00:32:38,097 That area code is 212. 756 00:32:38,099 --> 00:32:40,097 That's New York, not Jersey. 757 00:32:40,099 --> 00:32:42,169 I'll call Elijah. 758 00:32:42,171 --> 00:32:44,337 Elijah, Shane Tillman is using 759 00:32:44,339 --> 00:32:46,474 a cell phone location tracking site. 760 00:32:46,476 --> 00:32:48,147 He's going after Evan Wescott! 761 00:32:48,149 --> 00:32:50,348 ♪ ♪ 762 00:33:30,816 --> 00:33:32,050 Whoa, whoa, whoa, hey. 763 00:33:32,051 --> 00:33:33,417 Problem is with me. 764 00:33:33,419 --> 00:33:35,257 Just let these people go. Shut up! 765 00:33:35,259 --> 00:33:37,554 This wouldn't be happening if it wasn't for you. 766 00:33:37,556 --> 00:33:39,889 You took her away from me. Buddy, I think you got the wrong guy. 767 00:33:39,891 --> 00:33:41,896 It was you! It was you! 768 00:33:41,898 --> 00:33:44,895 I saw you with Adel right here in this bar. 769 00:33:53,508 --> 00:33:56,545 Look, man, just drop the gun, and we can talk 770 00:33:56,547 --> 00:33:59,380 about whatever it is that you think may have happened. 771 00:33:59,382 --> 00:34:01,885 No, I know what happened! I know what happened! 772 00:34:10,631 --> 00:34:12,526 You took her away from me. 773 00:34:12,528 --> 00:34:14,063 Of course, you don't remember. 774 00:34:14,065 --> 00:34:15,632 There's so many women, aren't there? 775 00:34:15,634 --> 00:34:16,872 You just have to have them all? 776 00:34:16,874 --> 00:34:19,871 I needed a chance to explain, to say I was sorry. 777 00:34:19,873 --> 00:34:22,943 To say I was sorry. 778 00:34:22,945 --> 00:34:24,775 But you... you were all over her. 779 00:34:24,777 --> 00:34:27,247 And I could see in her eyes, she wasn't coming back to me. 780 00:34:27,249 --> 00:34:28,912 Shane? 781 00:34:29,851 --> 00:34:32,025 Stay where you are! 782 00:34:32,965 --> 00:34:35,071 Stay where you are! 783 00:34:35,073 --> 00:34:37,708 Or this isn't gonna end the way you want it to. 784 00:34:37,710 --> 00:34:40,080 Let her go and put down the gun. 785 00:34:40,082 --> 00:34:41,848 He killed my girlfriend, and you did nothing. 786 00:34:41,850 --> 00:34:43,186 You set him free. 787 00:34:43,188 --> 00:34:44,858 At the count of three, I'm gonna discharge this weapon. 788 00:34:44,860 --> 00:34:45,956 You need to decide 789 00:34:45,958 --> 00:34:48,061 what you're gonna do. One, two... 790 00:34:48,063 --> 00:34:49,662 Okay. 791 00:34:49,664 --> 00:34:51,470 Okay. 792 00:34:53,535 --> 00:34:54,468 Good. 793 00:34:54,470 --> 00:34:55,866 Now kick it towards me. 794 00:35:15,344 --> 00:35:16,815 Stay right where you are. 795 00:35:21,120 --> 00:35:23,212 W-Wait, don't do that, don't do that. 796 00:35:23,214 --> 00:35:25,218 I can't live without her! 797 00:35:25,220 --> 00:35:26,481 Shane. Shane! 798 00:35:29,523 --> 00:35:30,688 I got you! 799 00:35:30,690 --> 00:35:31,784 Hang on! 800 00:35:31,786 --> 00:35:33,119 I got you! 801 00:35:55,005 --> 00:35:57,274 ♪ ♪ 802 00:36:19,593 --> 00:36:20,928 Are you okay? 803 00:36:20,930 --> 00:36:23,600 Yeah. Yeah. 804 00:36:23,602 --> 00:36:24,801 We got him. 805 00:36:24,803 --> 00:36:26,433 We're not done. 806 00:36:26,435 --> 00:36:28,567 We still haven't put Shane Tillman 807 00:36:28,569 --> 00:36:30,733 in that hotel room at the time of the murder. 808 00:36:30,735 --> 00:36:33,269 We still have to prove who killed Adel Foster. 809 00:36:35,406 --> 00:36:37,004 Anything on Shane's phone? 810 00:36:37,006 --> 00:36:39,377 I need to know what we've got before I question him. 811 00:36:39,379 --> 00:36:40,376 Well, nothing concrete. 812 00:36:40,378 --> 00:36:42,142 I'm heading in now for an update. 813 00:36:42,144 --> 00:36:43,942 - Yeah! - That's what I'm talking about! 814 00:36:43,944 --> 00:36:45,310 We got it. 815 00:36:45,312 --> 00:36:47,044 We found proof. 816 00:36:50,076 --> 00:36:51,777 I'm gonna call you back. 817 00:36:51,779 --> 00:36:53,974 Wh-What kind of proof did you find? 818 00:36:53,976 --> 00:36:57,213 Proof that Shane Tillman was at the scene of the crime. 819 00:36:57,215 --> 00:36:59,382 Proof that he murdered Adel Foster? 820 00:36:59,384 --> 00:37:00,750 If we're lucky, both. 821 00:37:00,752 --> 00:37:02,422 It's called a motion tracking chip. 822 00:37:02,424 --> 00:37:03,717 Most new smartphones have them, 823 00:37:03,719 --> 00:37:05,219 but most people don't know they exist. 824 00:37:05,221 --> 00:37:08,155 It's a motion co-processor that collects and stores motion data 825 00:37:08,157 --> 00:37:11,195 on the phone's accelerometers, gyroscopes and compasses. 826 00:37:11,197 --> 00:37:12,490 All right, so basically it just... 827 00:37:12,492 --> 00:37:13,730 it records movement. 828 00:37:13,732 --> 00:37:15,728 Yeah, it's how an exercise app knows the difference 829 00:37:15,730 --> 00:37:17,264 between when you're jogging versus walking, 830 00:37:17,266 --> 00:37:19,431 which direction you're headed-- 831 00:37:19,433 --> 00:37:21,261 pretty much however your phone's moving. 832 00:37:21,263 --> 00:37:22,493 As the phone moves, 833 00:37:22,495 --> 00:37:24,901 the motion tracking chip records all of it. 834 00:37:24,903 --> 00:37:27,069 It will detect a pitch, a roll, a tilt-- 835 00:37:27,071 --> 00:37:28,901 every movement the phone makes. 836 00:37:28,903 --> 00:37:30,043 Right, and it's always on. 837 00:37:30,066 --> 00:37:31,307 And it's separate from the main processor. 838 00:37:31,308 --> 00:37:33,337 Let me get this right-- so if data were altered 839 00:37:33,339 --> 00:37:35,735 on that device, it would never cross your minds 840 00:37:35,737 --> 00:37:37,374 to manipulate that file. 841 00:37:37,376 --> 00:37:39,373 Exactly. So we pulled all the data 842 00:37:39,375 --> 00:37:43,476 off Shane's motion tracking chip, and this is what we found. 843 00:37:43,478 --> 00:37:45,347 So the one on the left is the motion tracking chip 844 00:37:45,349 --> 00:37:47,810 from Shane's phone; the one on the right is Adele's. 845 00:37:47,812 --> 00:37:49,378 Yeah, we synced both of them up 846 00:37:49,380 --> 00:37:51,915 to the last time Adel's phone moved before she was murdered. 847 00:37:57,987 --> 00:37:59,992 Most people keep their phones in their pants pockets. 848 00:37:59,994 --> 00:38:02,224 Which means the phone was recording their movement. 849 00:38:02,226 --> 00:38:05,561 So if two people were fighting, and we had both phones... 850 00:38:05,563 --> 00:38:06,833 Right, we could reenact the fight. 851 00:38:06,835 --> 00:38:08,433 Yeah. 852 00:38:26,107 --> 00:38:27,409 Who is he?! 853 00:38:27,411 --> 00:38:29,542 Who is he? 854 00:38:29,544 --> 00:38:31,368 Tell me who he is! Leave me alone! 855 00:38:31,370 --> 00:38:33,602 I'm not your girlfriend anymore! 856 00:38:51,139 --> 00:38:53,002 Adel? 857 00:39:02,577 --> 00:39:05,183 Well, this not only puts Shane Tillman in the room 858 00:39:05,185 --> 00:39:08,950 at the time of the murder, it proves that he killed her. 859 00:39:15,390 --> 00:39:18,153 You covered your tracks from every possible angle. 860 00:39:18,155 --> 00:39:20,121 You wiped your phone of any wrongdoing, 861 00:39:20,123 --> 00:39:22,058 pushed all the evidence to Evan's devices, 862 00:39:22,060 --> 00:39:25,361 you even hacked the hotel, wiped its security footage. 863 00:39:25,363 --> 00:39:27,360 It was all very clever. 864 00:39:27,362 --> 00:39:29,601 But you forgot one thing. 865 00:39:29,603 --> 00:39:31,601 One thing most people don't know about-- 866 00:39:31,603 --> 00:39:34,640 your phone's motion tracking chip. 867 00:39:36,570 --> 00:39:40,473 Cyber-synchronized offender and victim. 868 00:39:42,211 --> 00:39:45,017 Records every movement. 869 00:39:45,019 --> 00:39:47,817 Proves you killed your girlfriend. 870 00:40:04,540 --> 00:40:06,707 What's this? 871 00:40:09,613 --> 00:40:10,978 No! 872 00:40:11,876 --> 00:40:13,682 No, no! You freed it?! 873 00:40:13,684 --> 00:40:15,314 Oh, what? 874 00:40:15,316 --> 00:40:17,851 Uh, there was a cup in the middle of the floor. 875 00:40:17,853 --> 00:40:19,483 Hey, welcome back. 876 00:40:19,485 --> 00:40:20,819 Good job. 877 00:40:20,821 --> 00:40:23,691 He has been preoccupied with a little spider. 878 00:40:23,693 --> 00:40:25,427 What is all that? 879 00:40:25,429 --> 00:40:26,923 What? Some compressed air. 880 00:40:26,925 --> 00:40:28,691 I was gonna turn it over, zap it, freeze it, 881 00:40:28,693 --> 00:40:29,898 then I was gonna set it free. 882 00:40:29,900 --> 00:40:31,498 Aw. Cryonic preservation? 883 00:40:31,500 --> 00:40:33,436 I'm not hunting that thing down again. 884 00:40:33,438 --> 00:40:36,436 Okay, I will help you look for your spider. 885 00:40:36,438 --> 00:40:37,508 Thank you. 886 00:40:37,510 --> 00:40:38,508 We'll find it, 887 00:40:38,510 --> 00:40:39,876 and Elijah will arrest it. Yeah. 888 00:40:39,878 --> 00:40:41,108 Well, now I have to help. 889 00:40:41,110 --> 00:40:42,843 Yeah. 890 00:40:42,845 --> 00:40:44,746 Why... why would y'all do that? 891 00:40:44,748 --> 00:40:46,114 Why would y'all do that?! 892 00:40:49,183 --> 00:40:55,683 == sync, corrected by elderman == @elder_man