CSI: Cyber (2015) s02e05 Episode Script
Hack E.R.
(siren wailing, overlapping chatter) Multiple gunshot wounds.
BP's 84/53 and dropping.
MAN: Prep the trauma team, let's get him in the O.
R.
right now.
(indistinct conversations) (music playing) WOMAN: What's going on? WOMAN 2: What's happening? (excited chattering) DISTORTED MALE VOICE: Greetings, City Mercy.
You have played God long enough.
We are Grey Ruin and have taken control of your hospital and its devices.
Pay us $5 million, or four hours from now, another patient dies.
They said "another patient.
" Does that mean they've killed someone? I want every bed checked.
Notify hospital security and Dallas Police.
Stay calm, everybody, we're handling this.
(excited chattering continues) MAN: We've got 20 more patients to check in maternity.
MAN 2: Checking ophthalmology.
WOMAN: Cardio ward is good.
MAN 3: 413 through 427, all patients are alive.
WOMAN 2: Checking oncology.
WOMAN 3: Everyone in ICU is fine.
MAN 4: West Wing is clear.
Someone check neuro.
MAN 5: Last patient to check into ortho.
WOMAN 4: Okay, that's it for the East Wing.
Hey, what's going on? What is this? We're taking care of it, sir.
Right now, my concern is your wife, Mr.
Mullen.
Code blue! MULLEN: What do you mean "code blue"? Step back, sir.
Please keep him back.
Lindsey? What's wrong? Okay, charge it to 200.
Lindsey! Clear.
MULLEN: She just has a broken leg.
DOCTOR: Pulse! MULLEN: What are you doing? Again, 250 this time.
What are you doing to her?! Clear! Pulse.
MULLEN: Why are they doing that? What's wrong with her? MULLEN: Lindsey! Dr.
Marks.
Dr.
Marks.
Dr.
Marks, she's gone.
MULLEN: No.
No! This can't be happening.
WOMAN (over P.
A.
): Staff administrator to nuclear medicine.
Staff administrator to nuclear medicine.
Miss Ryan? Yes.
Hi, uh, I hope I'm not bothering you.
I don't I don't have your number and What can I help you with? I've actually been wanting to talk to you for a really long time.
I-I reached out to your Hus your ex-husband, uh, Mr.
Michaels.
He gave me this address.
He said he was gonna call you.
(cell phone rings) What is this about exactly? Oh, uh, maybe he forgot.
Maybe this was a bad idea.
I have to take this call-- just be one second.
Elijah? MUNDO: Hacker collective just took over a Dallas hospital.
There's one death.
All right.
We're downloading at CTOC.
I'll be right up.
Excuse me, Agent Ryan.
The young woman you were just with wanted me to give you this.
Thank you.
Welcome.
(beeps) Lindsey Mullen died half an hour ago of cardiac arrest at City Mercy Hospital in Dallas.
Her drug pump malfunctioned.
I spoke with some hospital techs.
Nothing indicates that the pump itself was faulty.
So, it sounds like a hack.
RUSSELL: So we think the hacker collective Grey Ruin intruded into Lindsey Mullen's drug pump and then forced it to administer a lethal dose of morphine.
We might be looking for a bigger intrusion.
The pump was controlled by a computer in the hospital's network.
And it's possible the targets hacked the whole system.
And they threaten to kill again.
In four hours.
Despite what the hacker says on the video, I don't think Grey Ruin is responsible.
It's just not their style.
You're right.
Grey Ruin is not a collective known for publically claiming responsibility.
Or committing a murder.
I mean, these guys don't care about anything but showing off their skills.
Well, remotely controlling our victim's drug pump shows a lot of skill.
Not as much as you'd think.
Scary truth-- most medical devices are less secure than your smartphone.
RYAN: The bottom line is-- someone found a way to remotely kill a patient.
This is looking like technology-facilitated murder.
We need to get into that hospital, find all the devices that are vulnerable.
Elijah, Krumitz, you're staying here, working from CTOC.
Everyone else, let's move.
We got four hours till our hackers try to kill again.
Um, Avery.
I'm trained to be in the field.
Elijah Um you broke FBI protocol.
I saw you beat a suspect that was incapacitated.
He was a pedophile.
He lured those kids to that house.
I'm not excusing his actions, Elijah.
But you jeopardize our entire case when you let your emotions cloud your judgment.
You need some time.
You're staying here in Washington.
Let's go! MARKS: As chief of staff, I've authorized rescheduling appointments and routine surgeries.
We've diverted ambulances and incoming patients to other local hospitals.
Any patients that are not in need of immediate medical assistance should be moved out of the hospital.
Those that remain should be relocated to a secure floor so we can focus on protecting them.
We can move them to the ICU.
What exactly is happening here? Well, we believe that the hackers injected malware into the hospital computer system.
And they may have control over all of your networked medical devices.
How many patients do you have hooked up to devices on your system? Roughly 175.
How fast can you get them off-line? Uh I don't know.
Uh, there's federal regulations I have to get by.
FDA, OSHA, the ACA, and the video has locked us out of our network.
Dr.
Marks, all patients on infusion pumps are off-network.
MARKS: Thank you, Dr.
Luca.
Keep me updated on the rest.
The hospital board has agreed to pay the ransom.
I strongly advise against that.
Why? Grey Ruin just released a new statement online, claiming this is not their work.
And we believe them.
It is not their M.
O.
to kill people and demand money.
RUSSELL: No, it's more likely it's somebody with a personal vendetta, somebody who's pretending to be Grey Ruin.
And we'll know that once we analyze the drug pump.
RYAN: We need a list.
Employees, patients, anyone who could have a motive to hurt the hospital.
We've got two hours.
Okay.
All right, let's see.
All right.
Yeah, I'm not finding any prints.
So this must be a remote hack.
If our target left any digital evidence, my program will find it.
When drug pumps connect to the hospital's network over Wi-Fi, allows the medical staff to remotely monitor their patients.
The pumps have built-in safeguards that prevent lethal doses.
Unfortunately, the hackers removed these safeguards, which allowed them to kill Lindsey Mullen.
The scariest part is-- the pump doesn't authenticate who has access to it.
So once the target was in the hospital network, they could do whatever they wanted to the drug pump.
Yep.
Check this out.
Oxygen 101, pulse 85.
Right? No change.
See? The target wrote code that manipulated the display that showed Lindsey Mullen's vitals.
So the heart rate monitor works over Wi-Fi as well.
Yep.
But the thing I don't get is if the target wanted Lindsey dead, why would he mess with her heart rate monitor? Because it takes at least five minutes for morphine to cause cardiac arrest.
Target needed that time to kill her.
Target hacked her heart rate monitor, kept her heartbeat steady so that the medical staff would not be alerted and come save her.
Guaranteed her death.
Have to irrigate his wound, stat.
Raven? Excuse me.
I can't get in this.
WOMAN (over P.
A.
): Critical care bypass status.
All personnel, we are on critical care bypass status.
RAMIREZ: D.
B.
Hey.
D.
B.
, I fixed it for you.
There you go.
Thank you.
WOMAN (over P.
A.
): Dr.
Sim to the ICU, stat.
MULLEN: I heard some of the nurses whispering.
Someone did this on purpose? My team and I are looking into it, Mr.
Mullen.
We went rafting.
Lindsey went overboard.
Uh, she broke her leg.
No surgery? No.
It was a minor injury.
Why would someone do this to her? We're still investigating exactly what happened here.
I-I know it's no consolation to you, but Lindsey was not the target.
I-I'm sorry.
I wish that there was more I could tell you right now.
This doesn't seem real.
You come to a hospital to get better, not to die.
We finally found enough nurses to manually pump oxygen.
We can take patients off of network ventilators.
Don't do it-- I found a kill switch hidden in the source code of the ventilators.
If you take the ventilator patients off of the network, it'll send a shockwave to all the medical devices and power to the entire hospital will be cut.
Including the backup generators.
That will kill any patient relying on a ventilator to breathe for them.
Uh, manually pumping oxygen won't matter.
How many ventilator patients do you have on the network? Nine, most of them in comas.
Call CTOC, have Krumitz start working on a patch.
We've got another problem.
The computer virus spread outside the hospital.
(machine beeping) (flatline tones) She's dead.
Never seen the defibrillator do this before.
Something's wrong.
I know you've deceived me, now here's a surprise I know that you have, 'cause there's magic in my eyes I can see for miles and miles I can see for miles and miles I can see for miles and miles And miles Oh, yeah.
(indistinct radio transmission) WOMAN: Who's got the entry list? RAMIREZ: Yeah, the malware is sophisticated.
It spreads over Wi-Fi and Bluetooth.
I-I don't understand.
Your defibrillator has Bluetooth technology, allowing it to communicate with the hospital's computers, so the medical staff can quickly access your patient's heart rate data.
RUSSELL: When you entered the hospital, the malware leaped onto your defib from an infected device.
I uploaded a patient's vitals to the nurse's station.
Yes, I-I'll show you.
Right over here.
Oh, great.
Thank you.
We're gonna need to call radiology and have them send the scans right over to the maternity ward RAMIREZ: You're gonna need to get a new defibrillator.
Not from this hospital.
Were you able to get on the network? Yeah.
The video was easy to penetrate, But even though I'm in the network, I can't access the devices in the hospital.
And we can't take the network offline, right? Because of the kill switch in the ventilator.
This is the hospital's network, and you see all the grayed-out areas.
The malware shut down access to those departments.
Everything is blocked off.
I can't get into anything.
Well, our target owns this hospital.
I found a timestamp of the first sign of malware.
Our target injected this malware five months ago.
Hospital systems are complicated.
Probably took the target that long just to learn the system.
Can we quarantine the malware? I can write a script that will scrub it off the network.
But it's gonna take time.
We don't have time.
We've got just over an hour and a half before our target tries to kill again.
RUSSELL: Find out where Krumitz is on the kill switch.
No.
I'm in.
I'm in, they're dead! Okay, what do you got? Cracked your code in three seconds, man.
Come on.
Seriously.
Hey.
Okay, better.
But no.
Nine patients! That's how many people we have on networked ventilators right now, and they're all dead because your patches cannot stop the target's kill switch.
Our target is smart, but we are smarter, and we've got 87 minutes for brilliance.
Come on, guys! Let's see it! We getting anywhere with the suspects? It's a lot of upset nurses who lost their jobs to computers who can do the work for them.
Motive 101.
Great.
(monitor beeping rhythmically) (indistinct conversations) RUSSELL: Jules? FINLAY: There's only one person in the world who would dare to call me Jules.
Nobody calls me Diebenkorn around here.
It's "D.
B.
" Russell? You okay? Yes.
Sorry.
What did Elijah find? He compiled a list of suspects.
He's looking for criminal activity, records of threats Hopefully we'll get a lead.
We're running out of time, Avery.
We need to find another way.
(mumbling) Come on.
MAN (over P.
A.
): Surgery, pick up line 12.
(mumbling) Ah! Got it.
Lounge.
Ah! Whoo! Ooh, snap! Thomas Knight? Thee T-K.
Boy, you're supposed to be like the next LeBron.
I'm gonna be better than LeBron.
All right, I hear you.
All right.
What, you doing a little physical therapy after knee surgery? Finally getting out today.
What you doing to that TV? It's for an FBI investigation, that's all.
You're an FBI agent? Yep.
Kind of, yeah.
All right, bro, do your thing.
All right.
RUSSELL: Uh, sorry.
Hey, was that? T-K? Yep.
This TV is the origin of the malware? NELSON: Yeah, this is it.
RUSSELL: Wi-Fi enabled, built-in apps, games, video streaming services.
It's a smart TV.
NELSON: Connects to the same network as the medical devices.
The target used it to infect the entire hospital.
Tons of people have access to this room.
Doctors, nurses, patients, visitors.
That's a lot of potential suspects.
Maybe we can narrow it down.
Raven found a timestamp from when the malware first infected the system.
It was five months ago.
And we have an eyewitness.
I narrowed the list of people who had the motive to harm City Mercy and the means to pull this off.
Down to one guy? Mm-hmm.
Who's Artie Sneed? MUNDO: He's a security researcher from Baltimore.
Now, he was arrested last April for hacking a medical device supplier that sells to all major hospitals.
Did he work at City Mercy? Nope.
Never even been there.
And you believe this guy is behind this because? He's been calling hospitals all across the country, warning them that the medical devices have vulnerabilities.
Now, last year, he called City Mercy eight times, but the hospital just dismissed him as a whacko.
Well, he probably is.
Who makes that face in their driver's license photo? Where are you going? Baltimore.
I thought Avery grounded you.
She told me to stay in Washington.
Everybody knows Baltimore's just a suburb of the District.
Okay, here we go.
Let's hope my quarantine program works.
Not working.
Okay, give it time.
WOMAN: It's gone! WOMAN 2: Looks like they're coming back up.
Intake system is online.
Over here, too! EMR's back up! I'm in.
MAN: We're up over here, too.
(alarm sounding) Print this while you can! The lab results (overlapping chatter) (overlapping chatter) What's happening? RAMIREZ: Okay, strange commands are being sent to the computer in the MRI room.
RYAN: Which one of these computers controls the MRI? I've never seen it do this before.
I can't stop it! MARKS: I think they reversed the polarity of the magnet.
You okay? Yeah, are you? The MRI went crazy.
The target shut down the superconducting coils and turned it into a magnetic weapon.
I thought your program was supposed to wipe the malware from the system.
It was.
The target must have a back door somehow that we missed.
Where are you with the ventilators? In my ten years at the FBI, I have only failed once.
Today might be the second time.
This kill switch is impossible to crack.
There's no digital evidence on the MRI, either.
I don't get it.
All right.
What are they doing? The emergency lights, the MRI, the message.
It's all very dramatic.
This target has an ego.
They want us to know they are still in control.
Right.
So we kick them out of the network, they respond with the MRI hack.
But why? What-what do they want? I don't think they're after money.
I believe this target wants to create panic and chaos.
(phone beeps) That is their main goal.
Surveillance footage was a bust.
They dump it every four months.
Raven! Got anything? Okay.
Nelson's smart TV.
That is our best bet.
It is the origin of intrusion.
Our patient zero.
Okay, I'll check in with him.
We have less than an hour left before the next attack.
NELSON: It's a modchip.
This is a hardware hack? Yep.
These chips override the system's software.
Makes the device do whatever the hacker wants.
Which, in this case, is to push the malware to the entire hospital network.
I get that.
But what about the smart TV? It has its own hard drive, so why didn't the target just load his malware directly onto that? Why a modchip? Cloaking.
Made it invisible to my initial scan of the TV.
If I didn't take that TV apart, we would have missed it.
Can we trace the chip? No.
What about the TV itself? Well, City Mercy bought 180 TVs for the whole hospital about a year ago.
I tracked down the purchase order and ran the serial numbers.
This TV was not on the purchase order.
So five months ago, our target brought in this TV and swapped it out.
Another dead end.
No, wait.
Maybe not.
We can run this TV's serial number against consumer sales records, right? Because the manufacturers keep track of which retailers buy their units, right? Right.
Maybe this can lead to a name.
All right.
(dog barking) MAN: Rocky! Shut up, Rocky! cell phones, cars, the atomic bomb, cloning.
Andrew, think about it.
Why didn't we have this kind of technology during the Revolutionary War? No, Andrew, no! No.
The government can deny the truth all they want, but alien intervention is the only explanation for Artie Sneed.
Agent Mundo of the FBI.
It's time we had a chat about City Mercy.
I would never hurt anyone, Agent Mundo.
You have to believe me.
Why should I? You were arrested for hacking a medical device supplier.
SNEED: That was a misunderstanding.
All I did was swap some programs with Schmitty.
He's the one that hacked the supplier.
I just got caught with the code.
Schmitty? This guy I met on a Deep Web medical message board.
Turns out, not everyone on the wire is trustworthy.
I mean, Schmitty, oh he's a bad dude.
Wrote a ton of code on how to hack infusion pumps.
Made money selling it online to script kiddies.
What, so you think Schmitty might be the one behind this hack? No, not possible.
He's rotting in jail as we speak.
But he probably sold his code to your hacker.
What are you doing with my devices? MUNDO: Confirming that you've never been to Texas and you had nothing to do with the City Mercy hack.
So you believe me? The Cellebrite doesn't lie.
So yeah, Artie, I believe you.
(exhales) Oh, good.
All I want to do is help people.
No one should have to end up like my poor Charlene did.
Charlene, she she was my wife and she died two years ago at a hospital.
Doctors couldn't explain what happened.
(sighs) And I've been trying to figure out, every day since, what it was.
I'm sorry.
Thanks.
MUNDO: Wait a minute.
You coded patches for the medical devices? I'm gonna need every single computer that contains that code.
Oh, of course.
But each subroutine is divided into separate depositories for pen testing.
It's a little jumbled.
You have to make sure that your techs understand that and know that before they try to assemble the code.
Are you saying you're the only person who knows how to piece it together? Well, that's not necessarily what I'm saying Artie, pack your patches.
You're gonna help us finish it back in D.
C.
At the FBI? The government? Yep.
Let me put some clothes on.
Uh, you know, Agent Mundo, I got some more laptops in the back bedroom there.
(door closes) Listen (panting) they're not gonna get us, Rocky.
I won't let them get us.
Don't worry, Rocky.
We're not gonna let them get us.
I won't let them get us.
Why are you running? You're not under arrest.
You have a very honest face, Agent Mundo.
Nice, clean cut.
I just don't trust the government! Get in the car, Artie.
No! No, thank you! (tires screech) Hey! Stay away from me! Get him, Rocky.
How are you doing on those ventilators? I'm trying.
My patch isn't working.
Krummy can't crack it, either! Yeah, and no hits on the TV serial number.
The hospital's board just tried to pay, but the transfer was rejected.
The routing number was for an off-shore account that didn't exist.
That's because this was never about the money.
Our target could do this in any hospital across the country-- why this one? This is personal.
Look, we've got 13 minutes left.
I'm open to an out-of-the-box solution.
Someone, anyone! (indistinct chatter) Did I die? (chuckles) (beeps) Is this heaven? (laughs) Oh, man, I can't wait to put this in Andrew's face! He's always bragging to me about that Millennium Falcon cockpit he built in his mom's house.
Ooh, hey! Can I take a selfie for my Instagram? Artie, no, come on.
Let's go.
Man, if anybody'd ever told me that this is where my tax dollars are going, I'd actually start Never mind.
Elijah, what's Driver's License Guy doing up here? Uh, long story.
He's here to help.
Hey, I'm Artie Sneed.
I heard you needed some help with the ventilators.
Uh Let's go.
The ventilators-- very, very, very tricky business.
You cannot patch them directly- no, no, no, no, no.
You have to respect the kill switch.
Always respect the kill switch! Artie, Artie, focus! We don't have a lot of time left, come on! Right, yes, uh, okay, let me see, where was I? Yes, uh Right, direct ventilator patches are off the table.
But we can protect how they connect to The network itself! Yes! That's genius! I'm thinking about it all wrong.
It's just like blocking a bridge.
You stop, then divert traffic.
Exactly! Code's good, Artie.
Needs a little loving here and some tweaking there.
I'm gonna adjust this subroutine and bam! (laughs) Did it work? I can't believe it.
Yes, it worked! It worked! Yes.
High five, my man! Yes.
Yeah.
Yeah, yeah, yeah.
Krumitz just sent us the patch! It's installing.
The patch should block our hacker's access.
RAMIREZ: Uh, wait a minute, Nelson.
Looks like the hacker's trying to get ahead of the patch.
RUSSELL: They're still trying to go for the ventilators.
Not on my watch.
Slow them down until the install's complete.
Look, if we can't stop the hack, can you manually vent all of the patients? Yeah, just a second.
Ambu bags and oxygen tanks are at every patient's bed.
And you have the nurses to do that? Yes! It's going to work, D.
B.
Ah, install's complete.
Krummy's patch is working.
We stopped the target's ventilator attack.
The status of the patients on ventilators? Safe.
The rest of the hospital? All the patients are alive and accounted for.
Deadline's passed.
(grunts) Okay, good work, guys, but listen.
Our target still has remote access to this network.
So let's find them, root them out and let's make an arrest.
NELSON: Krummy, I'm not detecting any rogue device.
They have to be hiding somewhere in the network.
Are you sure you've checked every router? Look, there's nothing here, Krumitz.
It's like they weren't even here.
Come on, beautiful, do we really have to do the whole wheelchair routine? Sorry, hospital policy.
Checking out, TK? Two minutes away from freedom.
All right, better kick some ass this year.
You know it.
(indistinct chatter) Memories of Julie Finlay? Clearly, you were a very good therapist.
And even better listener.
I know you and Julie were very close.
She was my best friend.
I spent months in a room just like this one, hoping she'd wake up and make some snide comment about my predictable choice in reading material.
She didn't share your love of literature? No.
Right before she was attacked, I-I lent her a copy of The Thin Man, my favorite crime novel.
She was the Nora to your Nick.
Mm-hmm.
I read it to her every weekend.
And I had this romantic notion that when I read that final sentence, her eyes would open.
But she died before I finished it.
(rapid beeping) Hey! Hey, she's crashing! Doctor NURSE: Watch out.
Back up.
We protected the ventilators.
How's this happening? The target isn't in the network.
I don't, I don't know what's going on.
Doctor? It was her heart.
She went critical, but she's stabilizing now.
So, it had nothing to do with the ventilator? No.
NURSE: I got a code blue! Code blue outside! Come on! Come on! Breathe! What happened? Don't know, he just collapsed after I wheeled him out here.
RUSSELL: TK? TK was perfectly healthy.
RYAN: Nelson? He wasn't even hooked up to anything.
This is murder, Avery.
(indistinct radio transmission) Tell them.
Uh, I had just started a new shift and I saw Thomas' medication schedule on my tablet.
It said it was time to give him his anti-inflammatory meds.
It was his normal routine, so I did.
Dorvatrin.
It's non-steroidal anti-inflammatory injection used to treat pain.
But according to Thomas' paper medical record, he was allergic to Dorvatrin.
All right, so, Thomas is allergic to Dorvatrin.
Someone altered his electronic medical record, prescribed him a medication he never should've been on.
We stopped the ventilator attack.
This is their counter.
Found a new way to keep to their deadline.
MAN: You tried to pay, but money does not solve your problems.
You are accountable for what you have done.
In one hour, we will kill again.
If we can't pay them off, how do we stop them? "You're accountable for what you've done.
" Our target wants revenge.
Look, they knew what time the nurse's shift would change, when they could alter Thomas' medical record.
And you would need pharmaceutical knowledge to know that Dorvatrin would send Thomas into anaphylactic shock, right? So, our target is a nurse or a doctor? Makes sense and how come they're two steps ahead of us every time we make a move? Because they're here in the hospital right now.
Lock it down! No one goes in or out! WOMAN: Lock it down! MAN: Lock it down! MAN 2: Locking it down.
Let's go.
(men shouting) The target couldn't have altered Thomas' medical record without leaving some type of digital trace.
We were so busy looking for the target's next attack on the network, we didn't even consider a simpler way to commit murder.
KRUMITZ: The target didn't even need to use the ventilators to kill; all he had to do was digitally prescribe the wrong drug.
And there's no dust in the nurse's computer! I have no idea how the hacker altered Thomas' electronic medical chart.
The pharmacy.
Who is that?! Who's who? The guy whispering sweet nothings in your ear.
Artie Sneed.
It's a pleasure.
Uh, look, doctors prescribe meds directly through a patient's EMR, then it routes through the hospital pharmacy.
The hacker probably changed it there.
Hey, do you guys ever use this big screen for movie night? Like, pay-per-view boxing? I know how to get it for nothing.
Okay, Krummy, who is he? Ask Elijah! Listen, what matters is that he knows what he's talking about.
He helped write the ventilator patch.
All right, checking the pharmacy now.
There it is! The command that changed Thomas' medical record came from a local router port! They didn't scrub the last hack? They weren't in the system long.
Must've been moving so fast they made a mistake! Wait.
The device is inside the hospital! Guys, I'm tracing it now! Excuse me! Let's see.
Avery, whoever's doing this is in the lower level of the hospital.
Go! Go! Go! (overlapping chatter) MAN: Come on, guys! Move! Move! Move! On my signal! MAN: Door's clear.
FBI! FBI! FBI! (gasps) Teresa! I heard a crash, I came to check it out.
Nurse was smashing the computer.
She attacked me.
Ran.
Did you see her face? No! (groans) She had red hair Teresa? Teresa? She couldn't have gotten far.
Okay, move out! We need to get her to surgery before she bleeds out.
Copy that.
Sublevel's clear.
No sign of her.
They're moving onto the upper floors.
Thanks.
I just rounded up all the nurses on duty.
No redheads.
She's gonna be okay.
Her wounds didn't puncture any vital organs.
What was she doing down here? Dr.
Luca works in radiology across the hall.
We have 25 minutes.
Do you guys have anything? Hard drive's covered in bleach.
Cleaning in the solution will take at least that long.
They we have to hope it's not corroded.
There has to be something you can do.
RUSSELL: So when when humans breathe, they inhale dust and pollen and other airborne microbes from the environment, right? So where they have been determines what's in their lungs.
That TV is like a living organism.
It needs to breathe to function, so it has this fan that keeps the unit from overheating by sucking in cooling air.
And then whatever particles are flying around get sucked in, too.
And they, uh, stick to the fan blades.
Oh, there you are.
Okay, all right.
So so after we sequence the DNA from this specimen, we can run it through the index of airborne microbes-- it's a nationwide database of where bacteria resides.
Our target dropped of that TV.
It's possible that the fan collected airborne microbes from where it lived five months ago? Exactly.
Cool, huh? (chuckles) By using the bacteria database, we can zero in on the TV's previous home to an area within a ten-mile radius.
Then we can cross-reference with addresses of all the hospital's employees.
(chuckling): Yeah.
(Russell mumbles) What do we got here? Bacterium-- Staphylococcus equorum.
Claviceps pusilla.
Okay, I'll plug these into the index of airborne microbes and send the results to CTOC.
MUNDO: Can't believe D.
B.
's fan thing actually worked.
I'll get on these addresses.
RYAN: Come on.
Where are we at, guys? Well, the search is only half done, but we're not finding any employees in this area.
It's possible this is gonna take us back to the Best Buy it was purchased at and not the actual MUNDO: Got it.
We've got an address.
Say hello to our target.
I'm just glad that you're okay.
Did they find her, the nurse? No.
I'm taking you over to the ICU until this is over.
It's safer there.
RYAN: It was all a charade.
What are you doing? "Doctor to the rescue," and you played that well.
What the hell are you talking about? After you released the fake Grey Ruin video, you helped Colleen while Lindsey Mullen died.
(flatline tones) You're accusing me? I had nothing to do with this.
You knew we were on to you when we stopped your ventilator hack, so you changed your plan.
You killed Thomas by altering his electronic medical record.
And then you tried desperately to save him.
Come on! Come on! Breathe! The EMR hack, that was creative.
You improvised that on the fly.
But that's where you made your mistake, because moving quickly, you forgot to anonymize your computer, which led us to you.
MAN: Go, go, go! Be ready, target may be armed.
Move, move, move! Come on, guys! Move, move, move! On my signal.
(cries out, grunting) Only a doctor can stab themselves six times and not have it be life-threatening.
You have nothing on me.
Are you sure about that, Doctor? Because we traced the infected modchip that you installed in the TV room to your home address.
Then we found proof on your laptop that five months ago, you purchased the exact malware used to hack City Mercy.
Lindsey Mullen.
Thomas Knight.
You killed innocent people today.
Why? been spent saving people.
People who had only hours to live.
People who had been told to say their final good-byes.
God had marked them for death, and I kept them on this earth.
Me, no one else.
And City Mercy got famous, made a name on my accomplishments, and what did I get? What did I get in return for my sacrifice? They handed the hospital that I had resurrected to her.
RUSSELL: "'Just as you and I will go on being us, "'and the Quinns will go on being the Quinns, "'murder doesn't round out anybody's life "except the murdered's and sometimes the murderer's.
' "'That may be,' Nora said.
'But it's all pretty unsatisfactory.
'" MAN (over P.
A.
): Dr.
Sim to the ICU.
Dr.
Sim to the ICU.
So many people love you-- your-your family, your friends, you know, people who people who feel an emptiness in their lives without you.
You know, so just remember them.
And don't ever stop fighting.
Good-bye, Jules.
You did good today, Artie.
Your wife would be proud.
Thank you.
Uh, hug, come on.
Give a hug.
After all we've been through, come on.
Come on.
(laughs) (camera shutter clicks) Okay.
All right.
Oh, hey! Don't I get, like, an FBI badge or something? I mean, after all, I did kind of save the day.
Okay, a gun? A flak jacket? A sticker? A sticker would be fine.
I'll take a sticker.
You should have called me, Elijah.
You understand that, right? Yeah.
I do.
I'm sorry.
You didn't think I'd trust your judgment? Honestly, no.
And, listen, given given some of my behavior recently, I wouldn't blame you.
All right, but the clock was ticking, and I did what I thought was right.
And I'd like to think that I was smart, not lucky, that it all worked out.
You were lucky.
And you would be smart not to do that again.
RUSSELL: I'm going home.
I'm tired.
Is that your daughter Hannah? (quietly): Yeah.
That's my baby.
Mm, my little girl.
(laughs) (laughs) She's with her friend Grace.
Grace's mom was Hannah's nanny.
They played together all the time.
They were practically inseparable.
But after the accident, Hannah died, I I guess I cut them out of my life.
Why'd you do that? Grace's mom was driving Hannah.
It was raining, it wasn't her fault.
Oh.
Grace left me this letter in the lobby today.
She wants to be in my life again.
I called her.
She's on her way over here now.
But I don't I don't think I can do this.
It's just (voice breaking): There's too many memories.
I Mm, oh, that's hard.
Boy, I don't know what I would do.
I'd You know, I know this is gonna sound silly, but do you remember the Greek myth about Theodous? He-he was a Greek god, like a distant brother to Apollo, or something like that.
Anyway, so Theodous is coming down from Mount Olympus with his firstborn son to go swimming in this beautiful river in the valley.
But his-his son doesn't know how, so Theodous entrusts him to this beautiful peasant woman.
But when he came back, Theodous was heartbroken to find out that the woman had lost his child.
I mean, it was an honest mistake.
But Theodous was heartbroken.
Time passed, he forgave her, and they even got married, and they had another son.
But every day, every single day, Theodous would remember his firstborn son.
But the love that he was getting back from his new family brought him joy, and he was heartbroken no more.
Hmm.
Hmm.
What do you think? (laughs) I think two things.
First, you completely made up that story, because you're a little rascal.
And two, you made me smile.
I want to thank you for that.
I'm glad.
Good night.
Good night.
GRACE: Hi.
RUSSELL: Hi.
(laughs) Grace.
Hi.
I'm so sorry I didn't recognize you this morning in the lobby.
Grace, you're so beautiful.
(laughs) You have your mom's smile.
I found these photos that I put in the letter while I was packing for college.
I found this one in the bottom of my drawer.
Made me think of you.
(laughs) Oh, my little ice cream monster! She always had ice cream on her shirt.
Yeah, she could never keep it on the cone 'cause she wanted to eat all of the chocolate chips first.
(laughs) How is your mom? She's good.
Yeah, she's real good.
I missed you a lot.
And Hannah.
Yeah, me, too.
Avery, I am I'm so sorry.
I'm so happy you're here.
BP's 84/53 and dropping.
MAN: Prep the trauma team, let's get him in the O.
R.
right now.
(indistinct conversations) (music playing) WOMAN: What's going on? WOMAN 2: What's happening? (excited chattering) DISTORTED MALE VOICE: Greetings, City Mercy.
You have played God long enough.
We are Grey Ruin and have taken control of your hospital and its devices.
Pay us $5 million, or four hours from now, another patient dies.
They said "another patient.
" Does that mean they've killed someone? I want every bed checked.
Notify hospital security and Dallas Police.
Stay calm, everybody, we're handling this.
(excited chattering continues) MAN: We've got 20 more patients to check in maternity.
MAN 2: Checking ophthalmology.
WOMAN: Cardio ward is good.
MAN 3: 413 through 427, all patients are alive.
WOMAN 2: Checking oncology.
WOMAN 3: Everyone in ICU is fine.
MAN 4: West Wing is clear.
Someone check neuro.
MAN 5: Last patient to check into ortho.
WOMAN 4: Okay, that's it for the East Wing.
Hey, what's going on? What is this? We're taking care of it, sir.
Right now, my concern is your wife, Mr.
Mullen.
Code blue! MULLEN: What do you mean "code blue"? Step back, sir.
Please keep him back.
Lindsey? What's wrong? Okay, charge it to 200.
Lindsey! Clear.
MULLEN: She just has a broken leg.
DOCTOR: Pulse! MULLEN: What are you doing? Again, 250 this time.
What are you doing to her?! Clear! Pulse.
MULLEN: Why are they doing that? What's wrong with her? MULLEN: Lindsey! Dr.
Marks.
Dr.
Marks.
Dr.
Marks, she's gone.
MULLEN: No.
No! This can't be happening.
WOMAN (over P.
A.
): Staff administrator to nuclear medicine.
Staff administrator to nuclear medicine.
Miss Ryan? Yes.
Hi, uh, I hope I'm not bothering you.
I don't I don't have your number and What can I help you with? I've actually been wanting to talk to you for a really long time.
I-I reached out to your Hus your ex-husband, uh, Mr.
Michaels.
He gave me this address.
He said he was gonna call you.
(cell phone rings) What is this about exactly? Oh, uh, maybe he forgot.
Maybe this was a bad idea.
I have to take this call-- just be one second.
Elijah? MUNDO: Hacker collective just took over a Dallas hospital.
There's one death.
All right.
We're downloading at CTOC.
I'll be right up.
Excuse me, Agent Ryan.
The young woman you were just with wanted me to give you this.
Thank you.
Welcome.
(beeps) Lindsey Mullen died half an hour ago of cardiac arrest at City Mercy Hospital in Dallas.
Her drug pump malfunctioned.
I spoke with some hospital techs.
Nothing indicates that the pump itself was faulty.
So, it sounds like a hack.
RUSSELL: So we think the hacker collective Grey Ruin intruded into Lindsey Mullen's drug pump and then forced it to administer a lethal dose of morphine.
We might be looking for a bigger intrusion.
The pump was controlled by a computer in the hospital's network.
And it's possible the targets hacked the whole system.
And they threaten to kill again.
In four hours.
Despite what the hacker says on the video, I don't think Grey Ruin is responsible.
It's just not their style.
You're right.
Grey Ruin is not a collective known for publically claiming responsibility.
Or committing a murder.
I mean, these guys don't care about anything but showing off their skills.
Well, remotely controlling our victim's drug pump shows a lot of skill.
Not as much as you'd think.
Scary truth-- most medical devices are less secure than your smartphone.
RYAN: The bottom line is-- someone found a way to remotely kill a patient.
This is looking like technology-facilitated murder.
We need to get into that hospital, find all the devices that are vulnerable.
Elijah, Krumitz, you're staying here, working from CTOC.
Everyone else, let's move.
We got four hours till our hackers try to kill again.
Um, Avery.
I'm trained to be in the field.
Elijah Um you broke FBI protocol.
I saw you beat a suspect that was incapacitated.
He was a pedophile.
He lured those kids to that house.
I'm not excusing his actions, Elijah.
But you jeopardize our entire case when you let your emotions cloud your judgment.
You need some time.
You're staying here in Washington.
Let's go! MARKS: As chief of staff, I've authorized rescheduling appointments and routine surgeries.
We've diverted ambulances and incoming patients to other local hospitals.
Any patients that are not in need of immediate medical assistance should be moved out of the hospital.
Those that remain should be relocated to a secure floor so we can focus on protecting them.
We can move them to the ICU.
What exactly is happening here? Well, we believe that the hackers injected malware into the hospital computer system.
And they may have control over all of your networked medical devices.
How many patients do you have hooked up to devices on your system? Roughly 175.
How fast can you get them off-line? Uh I don't know.
Uh, there's federal regulations I have to get by.
FDA, OSHA, the ACA, and the video has locked us out of our network.
Dr.
Marks, all patients on infusion pumps are off-network.
MARKS: Thank you, Dr.
Luca.
Keep me updated on the rest.
The hospital board has agreed to pay the ransom.
I strongly advise against that.
Why? Grey Ruin just released a new statement online, claiming this is not their work.
And we believe them.
It is not their M.
O.
to kill people and demand money.
RUSSELL: No, it's more likely it's somebody with a personal vendetta, somebody who's pretending to be Grey Ruin.
And we'll know that once we analyze the drug pump.
RYAN: We need a list.
Employees, patients, anyone who could have a motive to hurt the hospital.
We've got two hours.
Okay.
All right, let's see.
All right.
Yeah, I'm not finding any prints.
So this must be a remote hack.
If our target left any digital evidence, my program will find it.
When drug pumps connect to the hospital's network over Wi-Fi, allows the medical staff to remotely monitor their patients.
The pumps have built-in safeguards that prevent lethal doses.
Unfortunately, the hackers removed these safeguards, which allowed them to kill Lindsey Mullen.
The scariest part is-- the pump doesn't authenticate who has access to it.
So once the target was in the hospital network, they could do whatever they wanted to the drug pump.
Yep.
Check this out.
Oxygen 101, pulse 85.
Right? No change.
See? The target wrote code that manipulated the display that showed Lindsey Mullen's vitals.
So the heart rate monitor works over Wi-Fi as well.
Yep.
But the thing I don't get is if the target wanted Lindsey dead, why would he mess with her heart rate monitor? Because it takes at least five minutes for morphine to cause cardiac arrest.
Target needed that time to kill her.
Target hacked her heart rate monitor, kept her heartbeat steady so that the medical staff would not be alerted and come save her.
Guaranteed her death.
Have to irrigate his wound, stat.
Raven? Excuse me.
I can't get in this.
WOMAN (over P.
A.
): Critical care bypass status.
All personnel, we are on critical care bypass status.
RAMIREZ: D.
B.
Hey.
D.
B.
, I fixed it for you.
There you go.
Thank you.
WOMAN (over P.
A.
): Dr.
Sim to the ICU, stat.
MULLEN: I heard some of the nurses whispering.
Someone did this on purpose? My team and I are looking into it, Mr.
Mullen.
We went rafting.
Lindsey went overboard.
Uh, she broke her leg.
No surgery? No.
It was a minor injury.
Why would someone do this to her? We're still investigating exactly what happened here.
I-I know it's no consolation to you, but Lindsey was not the target.
I-I'm sorry.
I wish that there was more I could tell you right now.
This doesn't seem real.
You come to a hospital to get better, not to die.
We finally found enough nurses to manually pump oxygen.
We can take patients off of network ventilators.
Don't do it-- I found a kill switch hidden in the source code of the ventilators.
If you take the ventilator patients off of the network, it'll send a shockwave to all the medical devices and power to the entire hospital will be cut.
Including the backup generators.
That will kill any patient relying on a ventilator to breathe for them.
Uh, manually pumping oxygen won't matter.
How many ventilator patients do you have on the network? Nine, most of them in comas.
Call CTOC, have Krumitz start working on a patch.
We've got another problem.
The computer virus spread outside the hospital.
(machine beeping) (flatline tones) She's dead.
Never seen the defibrillator do this before.
Something's wrong.
I know you've deceived me, now here's a surprise I know that you have, 'cause there's magic in my eyes I can see for miles and miles I can see for miles and miles I can see for miles and miles And miles Oh, yeah.
(indistinct radio transmission) WOMAN: Who's got the entry list? RAMIREZ: Yeah, the malware is sophisticated.
It spreads over Wi-Fi and Bluetooth.
I-I don't understand.
Your defibrillator has Bluetooth technology, allowing it to communicate with the hospital's computers, so the medical staff can quickly access your patient's heart rate data.
RUSSELL: When you entered the hospital, the malware leaped onto your defib from an infected device.
I uploaded a patient's vitals to the nurse's station.
Yes, I-I'll show you.
Right over here.
Oh, great.
Thank you.
We're gonna need to call radiology and have them send the scans right over to the maternity ward RAMIREZ: You're gonna need to get a new defibrillator.
Not from this hospital.
Were you able to get on the network? Yeah.
The video was easy to penetrate, But even though I'm in the network, I can't access the devices in the hospital.
And we can't take the network offline, right? Because of the kill switch in the ventilator.
This is the hospital's network, and you see all the grayed-out areas.
The malware shut down access to those departments.
Everything is blocked off.
I can't get into anything.
Well, our target owns this hospital.
I found a timestamp of the first sign of malware.
Our target injected this malware five months ago.
Hospital systems are complicated.
Probably took the target that long just to learn the system.
Can we quarantine the malware? I can write a script that will scrub it off the network.
But it's gonna take time.
We don't have time.
We've got just over an hour and a half before our target tries to kill again.
RUSSELL: Find out where Krumitz is on the kill switch.
No.
I'm in.
I'm in, they're dead! Okay, what do you got? Cracked your code in three seconds, man.
Come on.
Seriously.
Hey.
Okay, better.
But no.
Nine patients! That's how many people we have on networked ventilators right now, and they're all dead because your patches cannot stop the target's kill switch.
Our target is smart, but we are smarter, and we've got 87 minutes for brilliance.
Come on, guys! Let's see it! We getting anywhere with the suspects? It's a lot of upset nurses who lost their jobs to computers who can do the work for them.
Motive 101.
Great.
(monitor beeping rhythmically) (indistinct conversations) RUSSELL: Jules? FINLAY: There's only one person in the world who would dare to call me Jules.
Nobody calls me Diebenkorn around here.
It's "D.
B.
" Russell? You okay? Yes.
Sorry.
What did Elijah find? He compiled a list of suspects.
He's looking for criminal activity, records of threats Hopefully we'll get a lead.
We're running out of time, Avery.
We need to find another way.
(mumbling) Come on.
MAN (over P.
A.
): Surgery, pick up line 12.
(mumbling) Ah! Got it.
Lounge.
Ah! Whoo! Ooh, snap! Thomas Knight? Thee T-K.
Boy, you're supposed to be like the next LeBron.
I'm gonna be better than LeBron.
All right, I hear you.
All right.
What, you doing a little physical therapy after knee surgery? Finally getting out today.
What you doing to that TV? It's for an FBI investigation, that's all.
You're an FBI agent? Yep.
Kind of, yeah.
All right, bro, do your thing.
All right.
RUSSELL: Uh, sorry.
Hey, was that? T-K? Yep.
This TV is the origin of the malware? NELSON: Yeah, this is it.
RUSSELL: Wi-Fi enabled, built-in apps, games, video streaming services.
It's a smart TV.
NELSON: Connects to the same network as the medical devices.
The target used it to infect the entire hospital.
Tons of people have access to this room.
Doctors, nurses, patients, visitors.
That's a lot of potential suspects.
Maybe we can narrow it down.
Raven found a timestamp from when the malware first infected the system.
It was five months ago.
And we have an eyewitness.
I narrowed the list of people who had the motive to harm City Mercy and the means to pull this off.
Down to one guy? Mm-hmm.
Who's Artie Sneed? MUNDO: He's a security researcher from Baltimore.
Now, he was arrested last April for hacking a medical device supplier that sells to all major hospitals.
Did he work at City Mercy? Nope.
Never even been there.
And you believe this guy is behind this because? He's been calling hospitals all across the country, warning them that the medical devices have vulnerabilities.
Now, last year, he called City Mercy eight times, but the hospital just dismissed him as a whacko.
Well, he probably is.
Who makes that face in their driver's license photo? Where are you going? Baltimore.
I thought Avery grounded you.
She told me to stay in Washington.
Everybody knows Baltimore's just a suburb of the District.
Okay, here we go.
Let's hope my quarantine program works.
Not working.
Okay, give it time.
WOMAN: It's gone! WOMAN 2: Looks like they're coming back up.
Intake system is online.
Over here, too! EMR's back up! I'm in.
MAN: We're up over here, too.
(alarm sounding) Print this while you can! The lab results (overlapping chatter) (overlapping chatter) What's happening? RAMIREZ: Okay, strange commands are being sent to the computer in the MRI room.
RYAN: Which one of these computers controls the MRI? I've never seen it do this before.
I can't stop it! MARKS: I think they reversed the polarity of the magnet.
You okay? Yeah, are you? The MRI went crazy.
The target shut down the superconducting coils and turned it into a magnetic weapon.
I thought your program was supposed to wipe the malware from the system.
It was.
The target must have a back door somehow that we missed.
Where are you with the ventilators? In my ten years at the FBI, I have only failed once.
Today might be the second time.
This kill switch is impossible to crack.
There's no digital evidence on the MRI, either.
I don't get it.
All right.
What are they doing? The emergency lights, the MRI, the message.
It's all very dramatic.
This target has an ego.
They want us to know they are still in control.
Right.
So we kick them out of the network, they respond with the MRI hack.
But why? What-what do they want? I don't think they're after money.
I believe this target wants to create panic and chaos.
(phone beeps) That is their main goal.
Surveillance footage was a bust.
They dump it every four months.
Raven! Got anything? Okay.
Nelson's smart TV.
That is our best bet.
It is the origin of intrusion.
Our patient zero.
Okay, I'll check in with him.
We have less than an hour left before the next attack.
NELSON: It's a modchip.
This is a hardware hack? Yep.
These chips override the system's software.
Makes the device do whatever the hacker wants.
Which, in this case, is to push the malware to the entire hospital network.
I get that.
But what about the smart TV? It has its own hard drive, so why didn't the target just load his malware directly onto that? Why a modchip? Cloaking.
Made it invisible to my initial scan of the TV.
If I didn't take that TV apart, we would have missed it.
Can we trace the chip? No.
What about the TV itself? Well, City Mercy bought 180 TVs for the whole hospital about a year ago.
I tracked down the purchase order and ran the serial numbers.
This TV was not on the purchase order.
So five months ago, our target brought in this TV and swapped it out.
Another dead end.
No, wait.
Maybe not.
We can run this TV's serial number against consumer sales records, right? Because the manufacturers keep track of which retailers buy their units, right? Right.
Maybe this can lead to a name.
All right.
(dog barking) MAN: Rocky! Shut up, Rocky! cell phones, cars, the atomic bomb, cloning.
Andrew, think about it.
Why didn't we have this kind of technology during the Revolutionary War? No, Andrew, no! No.
The government can deny the truth all they want, but alien intervention is the only explanation for Artie Sneed.
Agent Mundo of the FBI.
It's time we had a chat about City Mercy.
I would never hurt anyone, Agent Mundo.
You have to believe me.
Why should I? You were arrested for hacking a medical device supplier.
SNEED: That was a misunderstanding.
All I did was swap some programs with Schmitty.
He's the one that hacked the supplier.
I just got caught with the code.
Schmitty? This guy I met on a Deep Web medical message board.
Turns out, not everyone on the wire is trustworthy.
I mean, Schmitty, oh he's a bad dude.
Wrote a ton of code on how to hack infusion pumps.
Made money selling it online to script kiddies.
What, so you think Schmitty might be the one behind this hack? No, not possible.
He's rotting in jail as we speak.
But he probably sold his code to your hacker.
What are you doing with my devices? MUNDO: Confirming that you've never been to Texas and you had nothing to do with the City Mercy hack.
So you believe me? The Cellebrite doesn't lie.
So yeah, Artie, I believe you.
(exhales) Oh, good.
All I want to do is help people.
No one should have to end up like my poor Charlene did.
Charlene, she she was my wife and she died two years ago at a hospital.
Doctors couldn't explain what happened.
(sighs) And I've been trying to figure out, every day since, what it was.
I'm sorry.
Thanks.
MUNDO: Wait a minute.
You coded patches for the medical devices? I'm gonna need every single computer that contains that code.
Oh, of course.
But each subroutine is divided into separate depositories for pen testing.
It's a little jumbled.
You have to make sure that your techs understand that and know that before they try to assemble the code.
Are you saying you're the only person who knows how to piece it together? Well, that's not necessarily what I'm saying Artie, pack your patches.
You're gonna help us finish it back in D.
C.
At the FBI? The government? Yep.
Let me put some clothes on.
Uh, you know, Agent Mundo, I got some more laptops in the back bedroom there.
(door closes) Listen (panting) they're not gonna get us, Rocky.
I won't let them get us.
Don't worry, Rocky.
We're not gonna let them get us.
I won't let them get us.
Why are you running? You're not under arrest.
You have a very honest face, Agent Mundo.
Nice, clean cut.
I just don't trust the government! Get in the car, Artie.
No! No, thank you! (tires screech) Hey! Stay away from me! Get him, Rocky.
How are you doing on those ventilators? I'm trying.
My patch isn't working.
Krummy can't crack it, either! Yeah, and no hits on the TV serial number.
The hospital's board just tried to pay, but the transfer was rejected.
The routing number was for an off-shore account that didn't exist.
That's because this was never about the money.
Our target could do this in any hospital across the country-- why this one? This is personal.
Look, we've got 13 minutes left.
I'm open to an out-of-the-box solution.
Someone, anyone! (indistinct chatter) Did I die? (chuckles) (beeps) Is this heaven? (laughs) Oh, man, I can't wait to put this in Andrew's face! He's always bragging to me about that Millennium Falcon cockpit he built in his mom's house.
Ooh, hey! Can I take a selfie for my Instagram? Artie, no, come on.
Let's go.
Man, if anybody'd ever told me that this is where my tax dollars are going, I'd actually start Never mind.
Elijah, what's Driver's License Guy doing up here? Uh, long story.
He's here to help.
Hey, I'm Artie Sneed.
I heard you needed some help with the ventilators.
Uh Let's go.
The ventilators-- very, very, very tricky business.
You cannot patch them directly- no, no, no, no, no.
You have to respect the kill switch.
Always respect the kill switch! Artie, Artie, focus! We don't have a lot of time left, come on! Right, yes, uh, okay, let me see, where was I? Yes, uh Right, direct ventilator patches are off the table.
But we can protect how they connect to The network itself! Yes! That's genius! I'm thinking about it all wrong.
It's just like blocking a bridge.
You stop, then divert traffic.
Exactly! Code's good, Artie.
Needs a little loving here and some tweaking there.
I'm gonna adjust this subroutine and bam! (laughs) Did it work? I can't believe it.
Yes, it worked! It worked! Yes.
High five, my man! Yes.
Yeah.
Yeah, yeah, yeah.
Krumitz just sent us the patch! It's installing.
The patch should block our hacker's access.
RAMIREZ: Uh, wait a minute, Nelson.
Looks like the hacker's trying to get ahead of the patch.
RUSSELL: They're still trying to go for the ventilators.
Not on my watch.
Slow them down until the install's complete.
Look, if we can't stop the hack, can you manually vent all of the patients? Yeah, just a second.
Ambu bags and oxygen tanks are at every patient's bed.
And you have the nurses to do that? Yes! It's going to work, D.
B.
Ah, install's complete.
Krummy's patch is working.
We stopped the target's ventilator attack.
The status of the patients on ventilators? Safe.
The rest of the hospital? All the patients are alive and accounted for.
Deadline's passed.
(grunts) Okay, good work, guys, but listen.
Our target still has remote access to this network.
So let's find them, root them out and let's make an arrest.
NELSON: Krummy, I'm not detecting any rogue device.
They have to be hiding somewhere in the network.
Are you sure you've checked every router? Look, there's nothing here, Krumitz.
It's like they weren't even here.
Come on, beautiful, do we really have to do the whole wheelchair routine? Sorry, hospital policy.
Checking out, TK? Two minutes away from freedom.
All right, better kick some ass this year.
You know it.
(indistinct chatter) Memories of Julie Finlay? Clearly, you were a very good therapist.
And even better listener.
I know you and Julie were very close.
She was my best friend.
I spent months in a room just like this one, hoping she'd wake up and make some snide comment about my predictable choice in reading material.
She didn't share your love of literature? No.
Right before she was attacked, I-I lent her a copy of The Thin Man, my favorite crime novel.
She was the Nora to your Nick.
Mm-hmm.
I read it to her every weekend.
And I had this romantic notion that when I read that final sentence, her eyes would open.
But she died before I finished it.
(rapid beeping) Hey! Hey, she's crashing! Doctor NURSE: Watch out.
Back up.
We protected the ventilators.
How's this happening? The target isn't in the network.
I don't, I don't know what's going on.
Doctor? It was her heart.
She went critical, but she's stabilizing now.
So, it had nothing to do with the ventilator? No.
NURSE: I got a code blue! Code blue outside! Come on! Come on! Breathe! What happened? Don't know, he just collapsed after I wheeled him out here.
RUSSELL: TK? TK was perfectly healthy.
RYAN: Nelson? He wasn't even hooked up to anything.
This is murder, Avery.
(indistinct radio transmission) Tell them.
Uh, I had just started a new shift and I saw Thomas' medication schedule on my tablet.
It said it was time to give him his anti-inflammatory meds.
It was his normal routine, so I did.
Dorvatrin.
It's non-steroidal anti-inflammatory injection used to treat pain.
But according to Thomas' paper medical record, he was allergic to Dorvatrin.
All right, so, Thomas is allergic to Dorvatrin.
Someone altered his electronic medical record, prescribed him a medication he never should've been on.
We stopped the ventilator attack.
This is their counter.
Found a new way to keep to their deadline.
MAN: You tried to pay, but money does not solve your problems.
You are accountable for what you have done.
In one hour, we will kill again.
If we can't pay them off, how do we stop them? "You're accountable for what you've done.
" Our target wants revenge.
Look, they knew what time the nurse's shift would change, when they could alter Thomas' medical record.
And you would need pharmaceutical knowledge to know that Dorvatrin would send Thomas into anaphylactic shock, right? So, our target is a nurse or a doctor? Makes sense and how come they're two steps ahead of us every time we make a move? Because they're here in the hospital right now.
Lock it down! No one goes in or out! WOMAN: Lock it down! MAN: Lock it down! MAN 2: Locking it down.
Let's go.
(men shouting) The target couldn't have altered Thomas' medical record without leaving some type of digital trace.
We were so busy looking for the target's next attack on the network, we didn't even consider a simpler way to commit murder.
KRUMITZ: The target didn't even need to use the ventilators to kill; all he had to do was digitally prescribe the wrong drug.
And there's no dust in the nurse's computer! I have no idea how the hacker altered Thomas' electronic medical chart.
The pharmacy.
Who is that?! Who's who? The guy whispering sweet nothings in your ear.
Artie Sneed.
It's a pleasure.
Uh, look, doctors prescribe meds directly through a patient's EMR, then it routes through the hospital pharmacy.
The hacker probably changed it there.
Hey, do you guys ever use this big screen for movie night? Like, pay-per-view boxing? I know how to get it for nothing.
Okay, Krummy, who is he? Ask Elijah! Listen, what matters is that he knows what he's talking about.
He helped write the ventilator patch.
All right, checking the pharmacy now.
There it is! The command that changed Thomas' medical record came from a local router port! They didn't scrub the last hack? They weren't in the system long.
Must've been moving so fast they made a mistake! Wait.
The device is inside the hospital! Guys, I'm tracing it now! Excuse me! Let's see.
Avery, whoever's doing this is in the lower level of the hospital.
Go! Go! Go! (overlapping chatter) MAN: Come on, guys! Move! Move! Move! On my signal! MAN: Door's clear.
FBI! FBI! FBI! (gasps) Teresa! I heard a crash, I came to check it out.
Nurse was smashing the computer.
She attacked me.
Ran.
Did you see her face? No! (groans) She had red hair Teresa? Teresa? She couldn't have gotten far.
Okay, move out! We need to get her to surgery before she bleeds out.
Copy that.
Sublevel's clear.
No sign of her.
They're moving onto the upper floors.
Thanks.
I just rounded up all the nurses on duty.
No redheads.
She's gonna be okay.
Her wounds didn't puncture any vital organs.
What was she doing down here? Dr.
Luca works in radiology across the hall.
We have 25 minutes.
Do you guys have anything? Hard drive's covered in bleach.
Cleaning in the solution will take at least that long.
They we have to hope it's not corroded.
There has to be something you can do.
RUSSELL: So when when humans breathe, they inhale dust and pollen and other airborne microbes from the environment, right? So where they have been determines what's in their lungs.
That TV is like a living organism.
It needs to breathe to function, so it has this fan that keeps the unit from overheating by sucking in cooling air.
And then whatever particles are flying around get sucked in, too.
And they, uh, stick to the fan blades.
Oh, there you are.
Okay, all right.
So so after we sequence the DNA from this specimen, we can run it through the index of airborne microbes-- it's a nationwide database of where bacteria resides.
Our target dropped of that TV.
It's possible that the fan collected airborne microbes from where it lived five months ago? Exactly.
Cool, huh? (chuckles) By using the bacteria database, we can zero in on the TV's previous home to an area within a ten-mile radius.
Then we can cross-reference with addresses of all the hospital's employees.
(chuckling): Yeah.
(Russell mumbles) What do we got here? Bacterium-- Staphylococcus equorum.
Claviceps pusilla.
Okay, I'll plug these into the index of airborne microbes and send the results to CTOC.
MUNDO: Can't believe D.
B.
's fan thing actually worked.
I'll get on these addresses.
RYAN: Come on.
Where are we at, guys? Well, the search is only half done, but we're not finding any employees in this area.
It's possible this is gonna take us back to the Best Buy it was purchased at and not the actual MUNDO: Got it.
We've got an address.
Say hello to our target.
I'm just glad that you're okay.
Did they find her, the nurse? No.
I'm taking you over to the ICU until this is over.
It's safer there.
RYAN: It was all a charade.
What are you doing? "Doctor to the rescue," and you played that well.
What the hell are you talking about? After you released the fake Grey Ruin video, you helped Colleen while Lindsey Mullen died.
(flatline tones) You're accusing me? I had nothing to do with this.
You knew we were on to you when we stopped your ventilator hack, so you changed your plan.
You killed Thomas by altering his electronic medical record.
And then you tried desperately to save him.
Come on! Come on! Breathe! The EMR hack, that was creative.
You improvised that on the fly.
But that's where you made your mistake, because moving quickly, you forgot to anonymize your computer, which led us to you.
MAN: Go, go, go! Be ready, target may be armed.
Move, move, move! Come on, guys! Move, move, move! On my signal.
(cries out, grunting) Only a doctor can stab themselves six times and not have it be life-threatening.
You have nothing on me.
Are you sure about that, Doctor? Because we traced the infected modchip that you installed in the TV room to your home address.
Then we found proof on your laptop that five months ago, you purchased the exact malware used to hack City Mercy.
Lindsey Mullen.
Thomas Knight.
You killed innocent people today.
Why? been spent saving people.
People who had only hours to live.
People who had been told to say their final good-byes.
God had marked them for death, and I kept them on this earth.
Me, no one else.
And City Mercy got famous, made a name on my accomplishments, and what did I get? What did I get in return for my sacrifice? They handed the hospital that I had resurrected to her.
RUSSELL: "'Just as you and I will go on being us, "'and the Quinns will go on being the Quinns, "'murder doesn't round out anybody's life "except the murdered's and sometimes the murderer's.
' "'That may be,' Nora said.
'But it's all pretty unsatisfactory.
'" MAN (over P.
A.
): Dr.
Sim to the ICU.
Dr.
Sim to the ICU.
So many people love you-- your-your family, your friends, you know, people who people who feel an emptiness in their lives without you.
You know, so just remember them.
And don't ever stop fighting.
Good-bye, Jules.
You did good today, Artie.
Your wife would be proud.
Thank you.
Uh, hug, come on.
Give a hug.
After all we've been through, come on.
Come on.
(laughs) (camera shutter clicks) Okay.
All right.
Oh, hey! Don't I get, like, an FBI badge or something? I mean, after all, I did kind of save the day.
Okay, a gun? A flak jacket? A sticker? A sticker would be fine.
I'll take a sticker.
You should have called me, Elijah.
You understand that, right? Yeah.
I do.
I'm sorry.
You didn't think I'd trust your judgment? Honestly, no.
And, listen, given given some of my behavior recently, I wouldn't blame you.
All right, but the clock was ticking, and I did what I thought was right.
And I'd like to think that I was smart, not lucky, that it all worked out.
You were lucky.
And you would be smart not to do that again.
RUSSELL: I'm going home.
I'm tired.
Is that your daughter Hannah? (quietly): Yeah.
That's my baby.
Mm, my little girl.
(laughs) (laughs) She's with her friend Grace.
Grace's mom was Hannah's nanny.
They played together all the time.
They were practically inseparable.
But after the accident, Hannah died, I I guess I cut them out of my life.
Why'd you do that? Grace's mom was driving Hannah.
It was raining, it wasn't her fault.
Oh.
Grace left me this letter in the lobby today.
She wants to be in my life again.
I called her.
She's on her way over here now.
But I don't I don't think I can do this.
It's just (voice breaking): There's too many memories.
I Mm, oh, that's hard.
Boy, I don't know what I would do.
I'd You know, I know this is gonna sound silly, but do you remember the Greek myth about Theodous? He-he was a Greek god, like a distant brother to Apollo, or something like that.
Anyway, so Theodous is coming down from Mount Olympus with his firstborn son to go swimming in this beautiful river in the valley.
But his-his son doesn't know how, so Theodous entrusts him to this beautiful peasant woman.
But when he came back, Theodous was heartbroken to find out that the woman had lost his child.
I mean, it was an honest mistake.
But Theodous was heartbroken.
Time passed, he forgave her, and they even got married, and they had another son.
But every day, every single day, Theodous would remember his firstborn son.
But the love that he was getting back from his new family brought him joy, and he was heartbroken no more.
Hmm.
Hmm.
What do you think? (laughs) I think two things.
First, you completely made up that story, because you're a little rascal.
And two, you made me smile.
I want to thank you for that.
I'm glad.
Good night.
Good night.
GRACE: Hi.
RUSSELL: Hi.
(laughs) Grace.
Hi.
I'm so sorry I didn't recognize you this morning in the lobby.
Grace, you're so beautiful.
(laughs) You have your mom's smile.
I found these photos that I put in the letter while I was packing for college.
I found this one in the bottom of my drawer.
Made me think of you.
(laughs) Oh, my little ice cream monster! She always had ice cream on her shirt.
Yeah, she could never keep it on the cone 'cause she wanted to eat all of the chocolate chips first.
(laughs) How is your mom? She's good.
Yeah, she's real good.
I missed you a lot.
And Hannah.
Yeah, me, too.
Avery, I am I'm so sorry.
I'm so happy you're here.