CSI: Cyber (2015) s02e12 Episode Script
Going Viral
(whistling) (classical music playing) MALE OPERATOR: 911.
What is your emergency? MAN: I just witnessed a hit and run.
FEMALE OPERATOR: 911.
What is your emergency? WOMAN: My apartment building's on fire.
There are people still inside! FEMALE OPERATOR: 911.
What's your emergency? CHILD: How many people WOMAN: I hear screams! MALE OPERATOR: 911.
What is your emergency? I need to get to a hospital.
I'm five months pregnant.
I'm feeling sharp, stabbing pains.
(gasping) It's too soon for contractions.
I'm at 249 West McCoy Street.
Hello? Hello? MALE OPERATOR: 911.
What is your emergency? I need help.
I need an ambulance.
I think my wife is having a heart attack.
She's collapsed.
What-what do I do? Hello? Are you-- are you there? Hello! Help! Honey, sweetheart, stay with me.
Hold on, sweetheart, hold on.
Hello? Hello? Hello? Hello? Someone help, please! I need help! Help! Help! MALE OPERATOR: 911.
What is your emergency? We need an ambulance.
A man's fallen from a scaffolding, but we can't tell if he's alive.
There's blood everywhere and he isn't moving.
Hello? Can you hear me? Are you there? Are you there? Hello, hello? Sweeney, hold on.
Can you hear me? Hello? It's coming down! Watch out! Look out! (shouting) Go, go! Something's wrong with my phone! Someone call 911! MALE OPERATOR 2: This is 911.
What is your emergency? FEMALE OPERATOR: What is your emergency? We've been flooded with reports of people having issues calling 911 from cell phones.
They say they connect to an operator, but then the call drops off and their phone freezes in call mode.
What makes you think that this is a cyber intrusion and not a malfunction of the New York City 911 system? Well, we've checked and double-checked.
There's no evidence of a mechanical malfunction.
Our IT guys believe it's a hack within our system that affects incoming cell phone calls.
Anyone who places a call from a land line doesn't experience the problem.
Have you ruled out issues with cell service providers? They've all confirmed that cell towers in the city are properly functioning and all other wireless phone traffic is normal.
So it only happens when someone calls 911? When someone calls 911 from a cell phone.
Not getting help when you want it? That's terrifying.
RYAN: The mayor and Homeland Security are concerned that this could be a well-crafted precursor to a terrorist attack.
Raven says the first reports of dropped 911 calls came in around Complaints were made to local precincts and cell service providers.
My operators noticed a decrease in call volume about the same time.
But none have reported being abruptly disconnected or dropped from a call.
OPERATOR: Excuse me, Clayton? Sorry.
Will you excuse me a moment? RAVEN: According to my stats, there's definitely something going on.
Well, I've compared the number of 911 calls from yesterday at this hour to those received this morning.
Huge decrease in cell phone calls.
On a typical day, the call center would get 24,000 calls, And this morning, cellular calls went down to 30%.
RUSSELL: So there are some cell phones out there that are connecting to 911 and completing the call.
Right? Yeah, but the strange thing is, is that most of the calls are made from devices outside of Manhattan, in the Boroughs.
KRUMITZ: We plugged into the 911 system.
No evidence of malfunctions or indicators of compromise.
Yeah, no known vulnerability, no malware, not a trace of digital dust that indicates a hack.
I mean, these boxes are squeaky clean.
So there's nothing here that can tell us what's going on.
Okay, so that means the problem has to be internal to the cell phones.
They're all different models and brands, in different locations all over the city.
Not to mention that they all have different service providers.
Other than them being cell phones, I mean, they have no connection to each other.
RUSSELL: Yeah, except they all dropped 911 calls, right? We need to get ahold of one of those phones.
I might be able to help with you that.
I have the latest incident reports.
There was an accident at a construction site not far from here.
The foreman called for paramedics.
Same thing happened.
Dropped call.
There's a possibility we can get that phone.
FOREMAN: Yeah, that's my cell number and I'm the site foreman.
I called 911 when the scaffolding collapsed.
Sweeney dropped from the third floor.
And there were two others who also dialed 911? Yeah, Henderson and Joe Lavelle.
Just like me, they reached the operator, and then the phones froze and nobody was on the other end.
Is there a way to get in touch with them? I'd like to take a look at their devices.
Yeah, I can, uh, I can get you their home number.
This is crazy.
That kid was only Bled to death because I couldn't get the paramedics here in time.
And now, two more of my guys are in the hospital in critical condition.
I hope you can figure this out.
You know, on jobs like this, something happens every day on these sites.
I need to know that my guys can get help when they need it.
Excuse me.
(indistinct chatter) NELSON: Eric O'Brian's phone is infected with malware.
I mean, it's gonna take time to reverse-engineer the code and figure out exactly what it does to a cell.
Nah, forget the code.
I cloned his device to a known-good test phone.
Let's just call 911 and see what happens.
All right.
MALE OPERATOR: My name is Daniel Krumitz.
I'm an agent with the FBI.
Operator, if you wouldn't mind standing up and waving for me? your emergency? How 'bout counting to ten? Hello? You there? Nope.
Okay.
Already gone.
That lasted about three seconds.
Hey, look, maybe he thought you were a prank caller and hung up.
You know, you don't exactly sound like an FBI agent.
An operator isn't gonna hang up that quickly.
They're required to make sure there's no real emergency, regardless of what the caller says.
So maybe you didn't reach an operator at all.
Remember, operators haven't been reporting dropped calls, only people dialing in on cell phones have.
Hmm.
This test phone's still active.
It's frozen; I'm locked out.
That's the hacker's plan.
When you attempt to dial 911, you won't get a chance to do it again.
Or use a cell at all.
It'll force you to find a land line or a pay phone.
A pay phone? And who uses a land line anymore? Yeah.
I don't even have one in my apartment.
I don't have one, either.
Oh, look.
Krummy, check this, right? I got a timestamp indicating the moment the malware infected Eric O'Brian's phone, right? And just seconds before that, his cell phone connected to a Wi-Fi network.
So that router could be the source of the infection.
Mm-hmm.
You got a location? Yeah.
Two seconds.
And tah-dah.
All right, I got it.
I'm driving.
Let's go.
What exactly does an FBI agent sound like? Smooth, Krummy.
Sturdy.
Gotta sound like you just finished the Ironman.
I'm out of breath? No, man.
You gotta be tough.
You know, like a like a bad-ass.
(tough voice): Daniel Krumitz, FBI.
(deeper voice): Dan Daniel Krumitz, FBI.
(indistinct chatter) The router that Eric's phone connected to isn't here.
MUNDO: You're sure you got the right location? NELSON: I'm positive.
Well, maybe our hacker removed the device.
Wanted it to remain undetected.
Wait, wait, guys, it just showed up.
And now it's gone.
That means it's moving.
Wait, guys, it's back up again.
Signal's getting stronger.
Real strong.
WOMAN: Is it coming? WOMAN 2: Oh, thank you.
That's it, right there.
That's why the signal's moving.
Free Wi-Fi.
Stop that bus! I'll call Avery and D.
B.
! Let's see what's on the bus's router.
Okay, same malware on Eric O'Brian's phone.
But that's not the interesting part.
Nelson.
No.
Uh-uh.
It it can't be.
I know, right? But it is, though, look.
Guys, guys.
Hey, hey.
Can we use words that actually mean something? (laughs) KRUMITZ: It's like this, okay? I have the flu.
I sneeze.
If you're close enough to me, you get the flu.
That's what this is.
It's an airborne computer virus.
It it lives.
What do you mean, âit lives,â Krumitz? NELSON: It was programmed to spread like a real virus.
It jumps from unsecured router to unsecured router within 150 feet.
So it infects any wireless access point that's not password protected? And even the ones that use a default password from the manufacturer.
So this bus has been, like, âsneezingâ all over town.
Every unsecured router in its path has been infected? KRUMITZ: And whenever a Wi-Fi enabled phone connects to one of these infected routers, it gets the virus.
Malware automatically jumps onto it.
RYAN: It's contagious.
I've never seen anything in the wild like this before.
Can the virus jump from phone to phone? No.
Phones can only get the virus if they're connected to one of the infected routers.
Well, at least these buses stay on the same route, right? It'll help us contain the infection.
RYAN: But ultimately, all the buses go back to home base.
And then this infection jumps from bus router to bus router.
And then bright and early this morning, all those buses went right back into the streets of Manhattan.
Increasing the number of people who won't get any help when they call 911.
This is an outbreak.
We're looking at an epidemic.
We need to find patient zero.
I know you've deceived me, now here's a surprise I know that you have, 'cause there's magic in my eyes I can see for miles and miles I can see for miles and miles I can see for miles and miles And miles Oh, yeah.
(indistinct chattering) The infected area has grown by 25% in the past two hours.
I've notified Port Authority and service providers.
All public routers are being disconnected from buses and ferries.
Have FBI communications get in touch with all of the New Jersey, Connecticut, Philadelphia news media outlets.
Make sure they're getting the word out that commuters should turn off their Wi-Fi and not try to connect to any free or open Wi-Fi sources.
And remind them: use their landlines when calling 911.
This virus will definitely cross state lines unless we're overly cautious.
Yep, a virus warning is already spreading through social media, and there's been a big surge in purchases of old-school telephones.
You're finally in style, D.
B.
(chuckles) Thanks very much.
Oh, hey, hold on a second.
Little, uh, social protocol.
Let's say you get a text clearly meant for somebody else, sent by someone you don't know.
Now, are you supposed to, uh, text 'em right back and say they got the wrong person? Kind of sounds like a personal text then.
Well, yeah, kind of.
Wh-Why would you just assume that? 'Cause if it was something like âI'm gonna be lateâ or âCall me,â then it's easy to text back.
You wouldn't give it a second thought.
But if suddenly you get dropped into the middle of someone else's drama What did the text say? Well, uh, none of your business.
(gasps) You answered my question.
I'll see you later.
Come on, D.
B.
It's got to be pretty juicy, huh? We'll talk about it when I get back to DC.
D.
B.
, you can't just (scoffs) Mayor Cavanaugh, there's no evidence to suggest that the 911 hack is a terrorist threat.
Well, that's a relief.
Do you know who's behind it? We have a profile of who we're looking for.
They're not part of a politically motivated group or collective.
They would have already claimed responsibility by now.
Our target is an individual who's celebrating his power to cripple the city.
He enjoys making people feel desperate, helpless.
There's a chance that he's tried something like this in the past on a smaller scale.
But this virus is an escalation.
He? It's most likely a man.
Women go about things like this in a less conspicuous way.
I was told you have a plan.
The malware is mimicking a biicalirus, so we're using CDC protocol.
We've identified how it's transmitted, we've begun the containment, we're informing the public.
My team is writing code, an antidote, that will cure all the infected phones and stop any new phones from acquiring it.
You are, Deputy Director Ryan, as impressive as I was told.
Which makes my next request a little uncomfortable.
(sighs) Brody Nelson.
He's one of my cyber investigators.
He's also the young man that hacked into the New York Stock Exchange, created havoc in the financial district.
And I understand that that tarnished your first term in the mayor's office.
This is not about me.
I am well aware of Brody Nelson's crimes.
He is serving his time.
I would prefer he were in prison and not writing code for anything having to do with my city.
Well, that is not your call, sir.
Did you know that eight-million-dollar transfer as a result of his financial hack was never accounted for? That young man knows where it is.
The mayor's just bent out of shape because their election's coming up.
(sighs) I did a terrible thing, D.
B.
Can't expect people to forget.
You know what? I'm just gonna image these devices and go back to DC with you.
It'll be easier for me to analyze the malware from Tear Down and work on the antidote.
Okay.
All right? Let me make this clear.
I don't want Brody Nelson working this case.
If Brody Nelson doesn't work on this case, then neither do I.
So you let me know.
REPORTER: The FBI has informed us of a malware virus affecting the 911 emergency system.
Wi-Fi has been discontinued.
We ask that you use a landline for all OPERATOR: This is an emergency.
Excuse me, I need to make What you got? I've infected these test phones with the virus.
It lies dormant until you dial 911, and this is what you hear.
MALE VOICE: 911.
What is your emergency? Hello.
Hello.
No one there.
That's because there was never anyone there.
It's a recorded voice.
There's an audio file hard-coded into the virus.
Now, these phone calls never make it to an actual 911 operator.
Just a recorded voice.
The hacker hijacked 911 and made the caller believe they were getting through.
Mm-hmm, and not only that.
Check this out.
(hums) MALE VOICE: 911.
What is your emergency? Say something.
Keep talking.
Hello, this is D.
B.
Russell.
Testing, one, two, three.
The phone is not frozen, it's recording everything I'm saying.
Right.
All right, so our target is a man who who gets off on hearing the fear and the panic of helpless people.
He's recording the callers and sending the audio somewhere.
And we don't know where? Nope.
The files are bouncing through proxy IPs.
It's a dead end.
(classical music plays) MALE VOICE: 911.
What is your emergency? WOMAN: Please help, someone just broke into my house.
He's strangling my husband.
I'm hiding in the closet.
Oh oh, God.
He's MALE VOICE: Try to stay calm, ma'am.
I'm showing your address is 754 Plymouth Way.
Is that correct? WOMAN: Yes, please hurry.
I-I can hear him in the kitchen.
(crying): I think my husband's dead.
MALE VOICE: Help is on the way.
WOMAN: Please hurry.
Where are you? Am I right or am I right? The voice of the 911 operator embedded in the malware sounds like a long-lost relative of T-Pain.
Who Pain? RAMIREZ: T-Pain.
He's the king of auto-tune.
Yeah.
And that is again? It's, like, when a recording artist alters the pitch of their voice when they sing off-key.
Or when they suck.
Well, if that's true and the voice was distorted, then we should be able to un-distort it.
I just made that word up.
All right, let's get to work here.
Play it again, Nelson.
All right.
MALE VOICE (slowly): 911.
What is your emer Okay, Raven, isolate one of the ringing phones in the background there.
And pull up the ringtone used by the 911 call center.
That'll be our baseline.
Right, once we match the ringtones, we'll have the real voice of our 911 operator.
Exactly.
Okay, I am adjusting the pitch and speed of the recording until the waveforms line up.
MALE VOICE: 911.
What is your emergency? Okay, here we have our real MALE VOICE: 911.
What is your emergency? Why would our target want to distort this voice? To disguise it.
This could be him.
Right? Our target.
I mean, why else would he do it? You think he works at a call center.
I don't know, it's just a theory.
Let's run this voice against all of the male dispatchers in the New York City call center database.
All right? Maybe we'll get lucky here, get an I.
D.
NELSON: Got him.
RYAN: Leo Finch.
Look at his profile.
He was fired from the call center exactly a year ago today.
Well, that's motive for revenge.
Let's see, he was fired for âfailure to properly dispatch emergency unitsâ" âpoor decision makingâ" ârefusal to follow protocolâ" Also looks like there were several instances of slow dispatch times and sending paramedics to the wrong address.
Delayed dispatch times suggests he wanted to keep the panicked callers on the line as long as possible.
He enjoyed hearing their desperation.
Their pleading made him feel powerful and in control.
Leo is an auditory voyeur.
Well, that's twisted.
Call Elijah.
Tell him there's a door he has to kick down.
Clear! Clear! Clear! All clear! Clear! MUNDO: Victims are Mary and Roger Ingram.
(sighs) Ligature marks around the neck and petechial hemorrhaging in the eyes suggest strangulation.
We have a time of death? MUNDO: According to the on-site coroner report, body temp puts TOD somewhere between 5:00 and 7:00 a.
m.
this morning.
Any signs of forced entry? No.
And nothing to suggest that Leo Finch lives here.
Police are canvassing the area right now, seeing if anybody recognizes Leo's photo.
MAN: Agent Mundo.
KRUMITZ: Looks like Mary tried to call for help.
She's still clenching this phone.
Cadaveric spasm.
It occurs in violent, intense deaths.
That's why her hand is clenched around the phone.
Battery's dead.
See if it has the virus.
Malware is exactly the same as all the others.
According to the call log, Mary tried to call 911 at 6:23 a.
m.
Please hurry, he's strangling my husband.
I think he killed him.
I can hear him coming.
Hello, is anyone there? Hello? Hello? (screams) MUNDO: Avery.
There's a basement apartment.
This is an odd setup.
Cheap furniture, egg carton acoustics, but very expensive speakers.
Found a laptop.
This is a Benning.
Leo has a $50,000 violin and lives in a cheap rental? It's funny-- some of the best coders are talented musicians.
Both highly technical, deal with complex numbers.
Clearly, Leo's obsession was sound.
KRUMITZ: I'm imaging Leo's computer.
He's over 200 audio files on his hard drive.
They're all 911 calls, and he's the operator.
RYAN: Leo is an addict.
The 911 calls are his drug.
It's like an arsonist getting a job as a firefighter or a pedophile who becomes a teacher.
Leo got his fix at work.
Until he was fired a year ago, and he was cut off from his drug and had to find a new way to feed his addiction.
The virus.
Whoa, Krumitz, get-- come here.
Is this what I think it is? That could be the original source code for the virus.
Okay, we've got something.
This computer connected to 26 bus routers at Port Authority at 11:00 p.
m.
last night.
That's 26 patient zeros.
This is not an experiment gone wrong.
This was a calculated attack.
No, Leo wanted to infect every corner of the city, and he wanted to do it fast.
RAMIREZ: 61 confirmed cases in New Jersey.
And 23 in Upstate New York.
Even with the news alerts and warnings, the virus has officially spread through the tristate area.
Well, the good news is the infection rate should slow down in the less densely populated areas.
Bad news? A complete quarantine looks impossible.
And local precincts are overrun with emergency calls and hospitals are flooded with walk-ins.
Some people are resorting to social media to announce their emergencies.
Nelson, we need that antidote.
How's it going? Krummy sent me the source code of the virus from Leo Finch's laptop.
Now that I can see exactly how the virus is written, it shouldn't take long to write a code to counteract it.
But the problem is how to push it to all the phones that need it.
Yeah, a software update through the vendors will take days.
Mm-hmm.
Wait a minute.
What about using something like the AMBER Alert, right? It sends push notifications to phones during child abductions.
It's instant, it's regional.
What do you think? I mean, AMBER Alerts are only designed to display alphanumeric text.
You can't use them to push code.
And there are regulations.
I mean, FTC, DOJ, FEMA.
Right.
Wait, wait, wait.
Are you saying it's impossible? I'm saying it's never been done before.
Right.
Well, there's a first time for everything.
You-you two were black hats, weren't you? The best.
Notorious.
Okay, so you'll hack it, right? And I'll take full responsibility.
Matter of fact, I will call Director Silver right now.
Work on the FCC, DOJ part of this thing.
All right, man said hack, let's hack.
Look at this.
A pair of pliers, some kind of metal pins and a bloody violin string.
I think we may be looking at the murder weapon.
(screaming) (both grunting) All right, well, whatever Leo's endgame is, if he left two bodies upstairs and a murder weapon in the wall, it's a pretty safe bet he's not coming back here anytime soon.
Guys, look at this.
It looks like these three 911 recordings were Leo's favorites.
They were played over a thousand times.
And he even put them on a separate playlist.
Here, listen to this.
FINCH: MAN: My buddy, he fell! It's bad; it's-it's real bad! We need an ambulance! Sir, what's your location? MAN: Construction site at Lexington and 12th! I don't think he's conscious.
FINCH: I'm dispatching paramedics now.
Calm down and describe what you see.
MAN: There's a lot of blood! He must've fallen 50 or 60 feet or something-- please hurry! There's blood all over his head! I'm pretty sure his legs are broken.
FINCH: All right, be careful not to move him.
Help is on the way.
Is this from today? Uh, no.
According to the metadata, this recording's from two years ago.
But what's strange is that it happened at the same time of day as the construction incident.
Scaffolding pins.
There's traces of paint and rust in the grooves of the pliers.
What happened at that construction site this morning was no accident.
MAN: All right, what do we got? (creaking) Help! Help! Play the next one.
FINCH: WOMAN: Please help.
Someone just broke into my house.
He's strangling my husband.
I'm hiding in a closet.
FINCH: Try to stay calm, ma'am.
I'm showing your address as 754 Plymouth Way.
Is that correct? WOMAN: Yes, please hurry! I can hear him in the kitchen.
Oh! I think my husband's dead.
FINCH: Help is on the way.
WOMAN: Why is this taking so long? Why is no one coming? This is very similar to the scene upstairs.
This is exactly what happened to Mary and Roger Ingram.
This is also another old recording and it happened at the same time as the murders this morning, 6:23 a.
m.
Listening is a deeply immersive experience.
FINCH: Sir, what's your location? MAN: Construction site at Lexington RYAN: Every time Leo listen to one of these recordings, he envisioned himself in the scene.
We need an ambulance.
RYAN: First, he's a witness.
can't tell if he's alive.
There's blood everywhere and he's not moving.
RYAN: Then he's the victim.
Please help.
Someone just broke into my house.
He's strangling my husband.
(creaks) RYAN: Now, Leo's the killer.
(woman gasps) No.
No, no! He's recreating his greatest hits.
(woman screams) KRUMITZ: Yeah, but what does the virus have to do with all this? And why today? RYAN: It's the anniversary of the day he was fired.
Look, Leo is a sadist who's aroused by the sound of fear.
The virus does everything that he needs.
The dropped calls delay the emergency responders, which maximizes the victims' panic.
Leo records the calls so he can enjoy them later.
It's his version of a serial killer taking a trophy.
Krumitz, didn't you say there were three recordings on that playlist? FINCH: BOY: Help! He's stabbing him.
He's stabbing my dad! FINCH: What's your name? Where are you? BOY: Dylan.
And I don't know where I am.
We just we left the game.
It's an alley.
FINCH: Help is on the way.
BOY: The man just left! I'm scared.
FINCH: It's okay, Dylan.
I need you to go to your dad Tell me what you see.
BOY: He's not moving! (whimpering) Leo mimicked the first two recordings on the playlist.
And this recording is of a man being stabbed in an alley in front of his son.
It happened at 8:53 at night.
This is his next move.
He's gonna kill again.
We need to stop Leo Finch.
MUNDO: Yeah, but how? There are thousands of alleys in New York City.
Okay, everybody, listen up.
We're basically looking for a-an alley in a haystack.
Leo's two copycat killings took place the same time of day as the original crimes, which means at approximately somebody is gonna get stabbed.
So let's get going on this.
All right? We've got just over an hour to find this Leo Finch before he finds his next victim.
D.
B.
, I figured out what the three 911 calls on Leo's playlist all have in common.
They all lasted over 20 minutes almost three times longer than your average 911 call.
The victims all died because Leo didn't dispatch the paramedics in time.
So he orchestrated their deaths.
NELSON: Just spoke to the NYPD.
They issued a BOLO for Leo.
And I sent them the antidote.
They'll push it to all cell phones in the area using AMBER Alerts.
Right.
So you guys figured out the, uh, alphanumeric problem, did you? We used a buffer overflow exploit, thank you very much.
NELSON: That's right.
It'll flood the phones with a specific sequence of text to force the NYPD home page to pop up.
Now, that home page will have a download for the antidote.
Basically, we're geniuses.
Exactly.
Basically.
Basically.
Do me a favor, though, will you? Call NYPD back, tell them to display a photo of Leo Finch with the antidote.
Might as well make the city our eyes and ears.
Uh yeah, uh I think you should do that.
Why is that? Might get a little pushback.
Apparently, they've been chatting with my pal the mayor.
Yeah, Nelson, this has nothing to do with your Stock Exchange hack, all right? Call them back, tell them to post the photo and the antidote.
Come on, buddy.
This is your hero moment.
You got this, Nelson.
Right, right.
My hero moment.
All right.
I just talked to the police chief.
He told me that you're using an AMBER Alert to send out an antidote written by Brody Nelson.
That's correct.
We'll have to verify that code before it goes out to the public.
I've hired a private security firm.
No, that's not necessary and we don't have the time.
We are chasing a killer, here.
I'm well aware of that, and I'm shocked that you would even trust a black hat with something this critical.
I've heard about your unconventional tactics, Deputy Director, but this is inappropriate and dangerous.
Mayor Cavanaugh, how many more lives are you willing to jeopardize? No one cares more about the citizens of this city than I do.
That's why I'm here.
Brody Nelson's antidote will save lives.
Now, I could go over your head with this, but I'm not sure that you could weather the political embarrassment.
If this goes sideways, it's on you.
(indistinct chatter, phone chimes) RAMIREZ: The public's responding to the AMBER Alert.
I've got multiple reports of Leo Finch at Madison and 140th.
Pellham Park.
That's Harlem.
Yeah, but we've got several sightings on the east side.
I mean, guy can't be in two places at once.
Dopplegangers? No.
No, we made a mistake.
Uh What do you mean? We sent the AMBER Alert to everyone.
Everyone.
Including Leo Finch.
Yeah, okay, all right.
Time to call Mom.
Let's get Avery on the phone.
Um, Avery.
We're striking out here.
It looks like Leo could be reporting false sightings.
So what do you think? Let's review everything we know about Leo Finch.
We know that he's meticulous about the details in his recreations.
The boy in the third that he and his dad were leaving a game.
MUNDO: The police report said Mets tickets were found in the dad's jacket pocket.
It was a baseball game.
Yeah, but it's not baseball season.
RYAN: Well, let's concentrate on another sporting event.
All right, here we go.
I got hockey in Manhattan, basketball in Brooklyn.
MUNDO: Which one fits our window? Both.
Let's compare them with the BOLO locations.
Okay, we've got six sightings of Leo around the arena in Manhattan, only one in Brooklyn.
RYAN: It's the hockey game.
Which ends in 15 minutes.
KRUMITZ: The original stabbing took place in an alley two blocks away from the stadium.
All right, how many alleys are there within that range of the arena? One second.
RAMIREZ: Three.
All right, well, this is a guy that sticks to details, right? Let's pull up some old crime scene photos, see if we can narrow it down to one.
Remember, Leo is a deviant audiophile.
It isn't about what we see, it's about what we hear.
Raven, pull up the original 911 recording of the alley stabbing.
Isolate the background sound.
Okay.
FINCH: 911.
What's your emergency? BOY: Help, he's stabbing him! He's stabbing my dad! FINCH: What's your name? Stop.
Go back.
(rumbling) That's an elevated train.
Pull up a subway map.
Look for any trains near the arena that go above ground.
RAMIREZ: Got it, it's the alley between West 4th and Bleeker.
Notify the arena.
I'll have 'em redirect crowds away from that alley, have NYPD clear the streets.
Let's go get Leo Finch.
(thunder crashing) (siren chirps) MUNDO: It's over, Leo! FBI! We have you surrounded! Got a visual on Leo, he is armed.
Drop the knife, Leo! Nobody's coming out of that arena.
We've sealed the exits, we've cleared the streets.
There's no one here for you to harm.
So drop the knife.
Drop it now.
They're mine! They're mine! You can't take them! Do not take one more step.
Give them back to me! They're all I have! MUNDO: Take one more step, and I will shoot! RYAN: Stand down, Elijah.
We confiscated his computer.
He's talking about the recordings he had saved on it.
MUNDO: He came here to kill someone.
He came to satisfy an addiction.
Leo's a junkie.
He came to get a fix.
We could still end this peacefully.
Krumitz, pull up the third recording on Leo's playlist.
We need to find a way to play it for Leo at the scene.
Okay, the squad cars all have P.
A.
systems with bullhorns.
Operator, this is Agent Daniel Krumitz.
Connect me to dispatch.
MAN: Hold your fire! KRUMITZ: Officer, I need you to turn on your P.
A.
system.
FINCH: 911.
What's your emergency? BOY: Help, he's stabbing him! He's stabbing my dad! FINCH: What's your name? Where are you? BOY: Dylan, I don't know where I am.
We just we left the game.
It's an alley.
FINCH: Help is on the way.
BOY: The man just left.
I'm scared.
FINCH: Hey, Dylan, I need you to go to your dad.
Tell me what you see.
BOY: He's not moving.
He was going for his knife.
Someone call 911.
I've been hurt.
I need help.
Nice code, brother.
Huh? You're gonna leave me hanging? My bad, bro.
(scoffs) That's old news, Nelson.
NELSON: Yeah, but not to the mayor of New York City.
I mean, all he saw was a black hat who brought down the stock exchange.
(scoffs) It's like no matter what I do right, I can't shake what I did wrong.
This is what pops up when I Google my name.
Look at this.
RYAN: Hey, come on.
You didn't have to come back to Washington.
You could have stayed in New York.
I know, but I was I was a distraction.
You had to go to bat for me.
It's not like anything Mayor Cavanaugh said wasn't true.
Really? You really took that eight million? Except for that, Krummy.
Hey, we cleared you of that long ago.
The fact remains you can't rewrite history, but you can make it.
And that is exactly what you did today.
Own that.
You should be very proud of yourself.
Thank you, Avery.
KRUMITZ: Eight million.
Oh, my God.
You can tell me.
I won't tell anybody.
Come on, you know where it is.
Let's go get it right now.
- I didn't steal it.
But I'm gonna find out who did.
And when I do I'm gonna put that bastard in prison.
Here, let me read this to you.
Okay.
"I'm taking a chance, hoping this is still your number.
"I know it's been two years.
But fingers crossed, "and divorce in the rearview Maybe"" Question mark.
"I'm at Le Petit Paris every night from 8:00 until they throw me out.
" And then she signs it: "Foolish Heart.
" So you got a new phone and her new number, and whoever had that number before you was supposed to get that text.
I-I know, I should have texted her right back when I got it, but I didn't, I-I waited.
But then I figured, you know, she would assume that her text hadn't gone through, right? Mm-hmm.
- And maybe that was better than letting her know that I, you know, a complete stranger, knew that she'd put herself out there.
And I just didn't want to embarrass her.
How do you know it's a her? Well, that's a good point.
Okay, end of conversation.
(laughs) No, wait a minute.
You fantasized about who it would be, D.
B.
No, I didn't, no, I didn't.
Yeah, you investigated it.
No, I did not investigate.
Yeah, you did.
I called the restaurant.
(gasps) See? - That's all.
I call (laughs) They said that a rather attractive woman came there every night the same time.
And I I knew that she was roughly in my age group.
Oh.
- "Foolish Heart"" That's a reference to a Steve Perry song.
That's a rock star before your time.
Anyway, this the whole text, it just you know, it seemed so brave and and honest, and I'm curious.
You hijacked another man's text.
Yes, I did.
(both laugh) So you're gonna meet her at the restaurant, or what? No.
No.
(indistinct chatter) (sighs) (inhales sharply) (ice rattling) Hi.
Hi.
(chuckles): Forgive me for asking, but are-are you here alone? Uh I am.
Yeah.
Of course.
Um sorry, no, I don't mean of course, I mean I have a confession to make.
Oh, really? Shouldn't I know your name before we jump right into the serious stuff? Yes, yeah.
Sorry.
Uh, D.
B.
Greer.
- Nice to meet you.
See, I, uh I received this today, and obviously, it was not meant for me.
I should have texted you right back, but I didn't, and I'm sorry.
Mmm.
Yeah.
Yeah, awkward.
No, not for me.
Because I didn't write that text.
(laughs): Really.
You're kidding.
Oh, boy.
(sighs) So (laughing): Oh Oh, man.
Well, shame on her.
- (laughs) Soliciting men via text.
So can I buy you a drink? Really? Seems like you could use one.
Shouldn't I know your last name before we jump into the serious stuff? Greer Latimore.
D.
B.
Russell.
Nice to meet you.
You, too.
Foolish heart - So, uh what do you do Greer Latimore? Former Secret Service.
Dabble in private investigations.
Foolish, foolish heart Nuh-uh.
Uh-huh.
Oh, boy.
What are you drinking? You've been wrong before Something manly.
(laughs) Okay.
Tequila.
Very manly.
- Yes, yes.
Foolish, foolish heart Excuse me.
What is your emergency? MAN: I just witnessed a hit and run.
FEMALE OPERATOR: 911.
What is your emergency? WOMAN: My apartment building's on fire.
There are people still inside! FEMALE OPERATOR: 911.
What's your emergency? CHILD: How many people WOMAN: I hear screams! MALE OPERATOR: 911.
What is your emergency? I need to get to a hospital.
I'm five months pregnant.
I'm feeling sharp, stabbing pains.
(gasping) It's too soon for contractions.
I'm at 249 West McCoy Street.
Hello? Hello? MALE OPERATOR: 911.
What is your emergency? I need help.
I need an ambulance.
I think my wife is having a heart attack.
She's collapsed.
What-what do I do? Hello? Are you-- are you there? Hello! Help! Honey, sweetheart, stay with me.
Hold on, sweetheart, hold on.
Hello? Hello? Hello? Hello? Someone help, please! I need help! Help! Help! MALE OPERATOR: 911.
What is your emergency? We need an ambulance.
A man's fallen from a scaffolding, but we can't tell if he's alive.
There's blood everywhere and he isn't moving.
Hello? Can you hear me? Are you there? Are you there? Hello, hello? Sweeney, hold on.
Can you hear me? Hello? It's coming down! Watch out! Look out! (shouting) Go, go! Something's wrong with my phone! Someone call 911! MALE OPERATOR 2: This is 911.
What is your emergency? FEMALE OPERATOR: What is your emergency? We've been flooded with reports of people having issues calling 911 from cell phones.
They say they connect to an operator, but then the call drops off and their phone freezes in call mode.
What makes you think that this is a cyber intrusion and not a malfunction of the New York City 911 system? Well, we've checked and double-checked.
There's no evidence of a mechanical malfunction.
Our IT guys believe it's a hack within our system that affects incoming cell phone calls.
Anyone who places a call from a land line doesn't experience the problem.
Have you ruled out issues with cell service providers? They've all confirmed that cell towers in the city are properly functioning and all other wireless phone traffic is normal.
So it only happens when someone calls 911? When someone calls 911 from a cell phone.
Not getting help when you want it? That's terrifying.
RYAN: The mayor and Homeland Security are concerned that this could be a well-crafted precursor to a terrorist attack.
Raven says the first reports of dropped 911 calls came in around Complaints were made to local precincts and cell service providers.
My operators noticed a decrease in call volume about the same time.
But none have reported being abruptly disconnected or dropped from a call.
OPERATOR: Excuse me, Clayton? Sorry.
Will you excuse me a moment? RAVEN: According to my stats, there's definitely something going on.
Well, I've compared the number of 911 calls from yesterday at this hour to those received this morning.
Huge decrease in cell phone calls.
On a typical day, the call center would get 24,000 calls, And this morning, cellular calls went down to 30%.
RUSSELL: So there are some cell phones out there that are connecting to 911 and completing the call.
Right? Yeah, but the strange thing is, is that most of the calls are made from devices outside of Manhattan, in the Boroughs.
KRUMITZ: We plugged into the 911 system.
No evidence of malfunctions or indicators of compromise.
Yeah, no known vulnerability, no malware, not a trace of digital dust that indicates a hack.
I mean, these boxes are squeaky clean.
So there's nothing here that can tell us what's going on.
Okay, so that means the problem has to be internal to the cell phones.
They're all different models and brands, in different locations all over the city.
Not to mention that they all have different service providers.
Other than them being cell phones, I mean, they have no connection to each other.
RUSSELL: Yeah, except they all dropped 911 calls, right? We need to get ahold of one of those phones.
I might be able to help with you that.
I have the latest incident reports.
There was an accident at a construction site not far from here.
The foreman called for paramedics.
Same thing happened.
Dropped call.
There's a possibility we can get that phone.
FOREMAN: Yeah, that's my cell number and I'm the site foreman.
I called 911 when the scaffolding collapsed.
Sweeney dropped from the third floor.
And there were two others who also dialed 911? Yeah, Henderson and Joe Lavelle.
Just like me, they reached the operator, and then the phones froze and nobody was on the other end.
Is there a way to get in touch with them? I'd like to take a look at their devices.
Yeah, I can, uh, I can get you their home number.
This is crazy.
That kid was only Bled to death because I couldn't get the paramedics here in time.
And now, two more of my guys are in the hospital in critical condition.
I hope you can figure this out.
You know, on jobs like this, something happens every day on these sites.
I need to know that my guys can get help when they need it.
Excuse me.
(indistinct chatter) NELSON: Eric O'Brian's phone is infected with malware.
I mean, it's gonna take time to reverse-engineer the code and figure out exactly what it does to a cell.
Nah, forget the code.
I cloned his device to a known-good test phone.
Let's just call 911 and see what happens.
All right.
MALE OPERATOR: My name is Daniel Krumitz.
I'm an agent with the FBI.
Operator, if you wouldn't mind standing up and waving for me? your emergency? How 'bout counting to ten? Hello? You there? Nope.
Okay.
Already gone.
That lasted about three seconds.
Hey, look, maybe he thought you were a prank caller and hung up.
You know, you don't exactly sound like an FBI agent.
An operator isn't gonna hang up that quickly.
They're required to make sure there's no real emergency, regardless of what the caller says.
So maybe you didn't reach an operator at all.
Remember, operators haven't been reporting dropped calls, only people dialing in on cell phones have.
Hmm.
This test phone's still active.
It's frozen; I'm locked out.
That's the hacker's plan.
When you attempt to dial 911, you won't get a chance to do it again.
Or use a cell at all.
It'll force you to find a land line or a pay phone.
A pay phone? And who uses a land line anymore? Yeah.
I don't even have one in my apartment.
I don't have one, either.
Oh, look.
Krummy, check this, right? I got a timestamp indicating the moment the malware infected Eric O'Brian's phone, right? And just seconds before that, his cell phone connected to a Wi-Fi network.
So that router could be the source of the infection.
Mm-hmm.
You got a location? Yeah.
Two seconds.
And tah-dah.
All right, I got it.
I'm driving.
Let's go.
What exactly does an FBI agent sound like? Smooth, Krummy.
Sturdy.
Gotta sound like you just finished the Ironman.
I'm out of breath? No, man.
You gotta be tough.
You know, like a like a bad-ass.
(tough voice): Daniel Krumitz, FBI.
(deeper voice): Dan Daniel Krumitz, FBI.
(indistinct chatter) The router that Eric's phone connected to isn't here.
MUNDO: You're sure you got the right location? NELSON: I'm positive.
Well, maybe our hacker removed the device.
Wanted it to remain undetected.
Wait, wait, guys, it just showed up.
And now it's gone.
That means it's moving.
Wait, guys, it's back up again.
Signal's getting stronger.
Real strong.
WOMAN: Is it coming? WOMAN 2: Oh, thank you.
That's it, right there.
That's why the signal's moving.
Free Wi-Fi.
Stop that bus! I'll call Avery and D.
B.
! Let's see what's on the bus's router.
Okay, same malware on Eric O'Brian's phone.
But that's not the interesting part.
Nelson.
No.
Uh-uh.
It it can't be.
I know, right? But it is, though, look.
Guys, guys.
Hey, hey.
Can we use words that actually mean something? (laughs) KRUMITZ: It's like this, okay? I have the flu.
I sneeze.
If you're close enough to me, you get the flu.
That's what this is.
It's an airborne computer virus.
It it lives.
What do you mean, âit lives,â Krumitz? NELSON: It was programmed to spread like a real virus.
It jumps from unsecured router to unsecured router within 150 feet.
So it infects any wireless access point that's not password protected? And even the ones that use a default password from the manufacturer.
So this bus has been, like, âsneezingâ all over town.
Every unsecured router in its path has been infected? KRUMITZ: And whenever a Wi-Fi enabled phone connects to one of these infected routers, it gets the virus.
Malware automatically jumps onto it.
RYAN: It's contagious.
I've never seen anything in the wild like this before.
Can the virus jump from phone to phone? No.
Phones can only get the virus if they're connected to one of the infected routers.
Well, at least these buses stay on the same route, right? It'll help us contain the infection.
RYAN: But ultimately, all the buses go back to home base.
And then this infection jumps from bus router to bus router.
And then bright and early this morning, all those buses went right back into the streets of Manhattan.
Increasing the number of people who won't get any help when they call 911.
This is an outbreak.
We're looking at an epidemic.
We need to find patient zero.
I know you've deceived me, now here's a surprise I know that you have, 'cause there's magic in my eyes I can see for miles and miles I can see for miles and miles I can see for miles and miles And miles Oh, yeah.
(indistinct chattering) The infected area has grown by 25% in the past two hours.
I've notified Port Authority and service providers.
All public routers are being disconnected from buses and ferries.
Have FBI communications get in touch with all of the New Jersey, Connecticut, Philadelphia news media outlets.
Make sure they're getting the word out that commuters should turn off their Wi-Fi and not try to connect to any free or open Wi-Fi sources.
And remind them: use their landlines when calling 911.
This virus will definitely cross state lines unless we're overly cautious.
Yep, a virus warning is already spreading through social media, and there's been a big surge in purchases of old-school telephones.
You're finally in style, D.
B.
(chuckles) Thanks very much.
Oh, hey, hold on a second.
Little, uh, social protocol.
Let's say you get a text clearly meant for somebody else, sent by someone you don't know.
Now, are you supposed to, uh, text 'em right back and say they got the wrong person? Kind of sounds like a personal text then.
Well, yeah, kind of.
Wh-Why would you just assume that? 'Cause if it was something like âI'm gonna be lateâ or âCall me,â then it's easy to text back.
You wouldn't give it a second thought.
But if suddenly you get dropped into the middle of someone else's drama What did the text say? Well, uh, none of your business.
(gasps) You answered my question.
I'll see you later.
Come on, D.
B.
It's got to be pretty juicy, huh? We'll talk about it when I get back to DC.
D.
B.
, you can't just (scoffs) Mayor Cavanaugh, there's no evidence to suggest that the 911 hack is a terrorist threat.
Well, that's a relief.
Do you know who's behind it? We have a profile of who we're looking for.
They're not part of a politically motivated group or collective.
They would have already claimed responsibility by now.
Our target is an individual who's celebrating his power to cripple the city.
He enjoys making people feel desperate, helpless.
There's a chance that he's tried something like this in the past on a smaller scale.
But this virus is an escalation.
He? It's most likely a man.
Women go about things like this in a less conspicuous way.
I was told you have a plan.
The malware is mimicking a biicalirus, so we're using CDC protocol.
We've identified how it's transmitted, we've begun the containment, we're informing the public.
My team is writing code, an antidote, that will cure all the infected phones and stop any new phones from acquiring it.
You are, Deputy Director Ryan, as impressive as I was told.
Which makes my next request a little uncomfortable.
(sighs) Brody Nelson.
He's one of my cyber investigators.
He's also the young man that hacked into the New York Stock Exchange, created havoc in the financial district.
And I understand that that tarnished your first term in the mayor's office.
This is not about me.
I am well aware of Brody Nelson's crimes.
He is serving his time.
I would prefer he were in prison and not writing code for anything having to do with my city.
Well, that is not your call, sir.
Did you know that eight-million-dollar transfer as a result of his financial hack was never accounted for? That young man knows where it is.
The mayor's just bent out of shape because their election's coming up.
(sighs) I did a terrible thing, D.
B.
Can't expect people to forget.
You know what? I'm just gonna image these devices and go back to DC with you.
It'll be easier for me to analyze the malware from Tear Down and work on the antidote.
Okay.
All right? Let me make this clear.
I don't want Brody Nelson working this case.
If Brody Nelson doesn't work on this case, then neither do I.
So you let me know.
REPORTER: The FBI has informed us of a malware virus affecting the 911 emergency system.
Wi-Fi has been discontinued.
We ask that you use a landline for all OPERATOR: This is an emergency.
Excuse me, I need to make What you got? I've infected these test phones with the virus.
It lies dormant until you dial 911, and this is what you hear.
MALE VOICE: 911.
What is your emergency? Hello.
Hello.
No one there.
That's because there was never anyone there.
It's a recorded voice.
There's an audio file hard-coded into the virus.
Now, these phone calls never make it to an actual 911 operator.
Just a recorded voice.
The hacker hijacked 911 and made the caller believe they were getting through.
Mm-hmm, and not only that.
Check this out.
(hums) MALE VOICE: 911.
What is your emergency? Say something.
Keep talking.
Hello, this is D.
B.
Russell.
Testing, one, two, three.
The phone is not frozen, it's recording everything I'm saying.
Right.
All right, so our target is a man who who gets off on hearing the fear and the panic of helpless people.
He's recording the callers and sending the audio somewhere.
And we don't know where? Nope.
The files are bouncing through proxy IPs.
It's a dead end.
(classical music plays) MALE VOICE: 911.
What is your emergency? WOMAN: Please help, someone just broke into my house.
He's strangling my husband.
I'm hiding in the closet.
Oh oh, God.
He's MALE VOICE: Try to stay calm, ma'am.
I'm showing your address is 754 Plymouth Way.
Is that correct? WOMAN: Yes, please hurry.
I-I can hear him in the kitchen.
(crying): I think my husband's dead.
MALE VOICE: Help is on the way.
WOMAN: Please hurry.
Where are you? Am I right or am I right? The voice of the 911 operator embedded in the malware sounds like a long-lost relative of T-Pain.
Who Pain? RAMIREZ: T-Pain.
He's the king of auto-tune.
Yeah.
And that is again? It's, like, when a recording artist alters the pitch of their voice when they sing off-key.
Or when they suck.
Well, if that's true and the voice was distorted, then we should be able to un-distort it.
I just made that word up.
All right, let's get to work here.
Play it again, Nelson.
All right.
MALE VOICE (slowly): 911.
What is your emer Okay, Raven, isolate one of the ringing phones in the background there.
And pull up the ringtone used by the 911 call center.
That'll be our baseline.
Right, once we match the ringtones, we'll have the real voice of our 911 operator.
Exactly.
Okay, I am adjusting the pitch and speed of the recording until the waveforms line up.
MALE VOICE: 911.
What is your emergency? Okay, here we have our real MALE VOICE: 911.
What is your emergency? Why would our target want to distort this voice? To disguise it.
This could be him.
Right? Our target.
I mean, why else would he do it? You think he works at a call center.
I don't know, it's just a theory.
Let's run this voice against all of the male dispatchers in the New York City call center database.
All right? Maybe we'll get lucky here, get an I.
D.
NELSON: Got him.
RYAN: Leo Finch.
Look at his profile.
He was fired from the call center exactly a year ago today.
Well, that's motive for revenge.
Let's see, he was fired for âfailure to properly dispatch emergency unitsâ" âpoor decision makingâ" ârefusal to follow protocolâ" Also looks like there were several instances of slow dispatch times and sending paramedics to the wrong address.
Delayed dispatch times suggests he wanted to keep the panicked callers on the line as long as possible.
He enjoyed hearing their desperation.
Their pleading made him feel powerful and in control.
Leo is an auditory voyeur.
Well, that's twisted.
Call Elijah.
Tell him there's a door he has to kick down.
Clear! Clear! Clear! All clear! Clear! MUNDO: Victims are Mary and Roger Ingram.
(sighs) Ligature marks around the neck and petechial hemorrhaging in the eyes suggest strangulation.
We have a time of death? MUNDO: According to the on-site coroner report, body temp puts TOD somewhere between 5:00 and 7:00 a.
m.
this morning.
Any signs of forced entry? No.
And nothing to suggest that Leo Finch lives here.
Police are canvassing the area right now, seeing if anybody recognizes Leo's photo.
MAN: Agent Mundo.
KRUMITZ: Looks like Mary tried to call for help.
She's still clenching this phone.
Cadaveric spasm.
It occurs in violent, intense deaths.
That's why her hand is clenched around the phone.
Battery's dead.
See if it has the virus.
Malware is exactly the same as all the others.
According to the call log, Mary tried to call 911 at 6:23 a.
m.
Please hurry, he's strangling my husband.
I think he killed him.
I can hear him coming.
Hello, is anyone there? Hello? Hello? (screams) MUNDO: Avery.
There's a basement apartment.
This is an odd setup.
Cheap furniture, egg carton acoustics, but very expensive speakers.
Found a laptop.
This is a Benning.
Leo has a $50,000 violin and lives in a cheap rental? It's funny-- some of the best coders are talented musicians.
Both highly technical, deal with complex numbers.
Clearly, Leo's obsession was sound.
KRUMITZ: I'm imaging Leo's computer.
He's over 200 audio files on his hard drive.
They're all 911 calls, and he's the operator.
RYAN: Leo is an addict.
The 911 calls are his drug.
It's like an arsonist getting a job as a firefighter or a pedophile who becomes a teacher.
Leo got his fix at work.
Until he was fired a year ago, and he was cut off from his drug and had to find a new way to feed his addiction.
The virus.
Whoa, Krumitz, get-- come here.
Is this what I think it is? That could be the original source code for the virus.
Okay, we've got something.
This computer connected to 26 bus routers at Port Authority at 11:00 p.
m.
last night.
That's 26 patient zeros.
This is not an experiment gone wrong.
This was a calculated attack.
No, Leo wanted to infect every corner of the city, and he wanted to do it fast.
RAMIREZ: 61 confirmed cases in New Jersey.
And 23 in Upstate New York.
Even with the news alerts and warnings, the virus has officially spread through the tristate area.
Well, the good news is the infection rate should slow down in the less densely populated areas.
Bad news? A complete quarantine looks impossible.
And local precincts are overrun with emergency calls and hospitals are flooded with walk-ins.
Some people are resorting to social media to announce their emergencies.
Nelson, we need that antidote.
How's it going? Krummy sent me the source code of the virus from Leo Finch's laptop.
Now that I can see exactly how the virus is written, it shouldn't take long to write a code to counteract it.
But the problem is how to push it to all the phones that need it.
Yeah, a software update through the vendors will take days.
Mm-hmm.
Wait a minute.
What about using something like the AMBER Alert, right? It sends push notifications to phones during child abductions.
It's instant, it's regional.
What do you think? I mean, AMBER Alerts are only designed to display alphanumeric text.
You can't use them to push code.
And there are regulations.
I mean, FTC, DOJ, FEMA.
Right.
Wait, wait, wait.
Are you saying it's impossible? I'm saying it's never been done before.
Right.
Well, there's a first time for everything.
You-you two were black hats, weren't you? The best.
Notorious.
Okay, so you'll hack it, right? And I'll take full responsibility.
Matter of fact, I will call Director Silver right now.
Work on the FCC, DOJ part of this thing.
All right, man said hack, let's hack.
Look at this.
A pair of pliers, some kind of metal pins and a bloody violin string.
I think we may be looking at the murder weapon.
(screaming) (both grunting) All right, well, whatever Leo's endgame is, if he left two bodies upstairs and a murder weapon in the wall, it's a pretty safe bet he's not coming back here anytime soon.
Guys, look at this.
It looks like these three 911 recordings were Leo's favorites.
They were played over a thousand times.
And he even put them on a separate playlist.
Here, listen to this.
FINCH: MAN: My buddy, he fell! It's bad; it's-it's real bad! We need an ambulance! Sir, what's your location? MAN: Construction site at Lexington and 12th! I don't think he's conscious.
FINCH: I'm dispatching paramedics now.
Calm down and describe what you see.
MAN: There's a lot of blood! He must've fallen 50 or 60 feet or something-- please hurry! There's blood all over his head! I'm pretty sure his legs are broken.
FINCH: All right, be careful not to move him.
Help is on the way.
Is this from today? Uh, no.
According to the metadata, this recording's from two years ago.
But what's strange is that it happened at the same time of day as the construction incident.
Scaffolding pins.
There's traces of paint and rust in the grooves of the pliers.
What happened at that construction site this morning was no accident.
MAN: All right, what do we got? (creaking) Help! Help! Play the next one.
FINCH: WOMAN: Please help.
Someone just broke into my house.
He's strangling my husband.
I'm hiding in a closet.
FINCH: Try to stay calm, ma'am.
I'm showing your address as 754 Plymouth Way.
Is that correct? WOMAN: Yes, please hurry! I can hear him in the kitchen.
Oh! I think my husband's dead.
FINCH: Help is on the way.
WOMAN: Why is this taking so long? Why is no one coming? This is very similar to the scene upstairs.
This is exactly what happened to Mary and Roger Ingram.
This is also another old recording and it happened at the same time as the murders this morning, 6:23 a.
m.
Listening is a deeply immersive experience.
FINCH: Sir, what's your location? MAN: Construction site at Lexington RYAN: Every time Leo listen to one of these recordings, he envisioned himself in the scene.
We need an ambulance.
RYAN: First, he's a witness.
can't tell if he's alive.
There's blood everywhere and he's not moving.
RYAN: Then he's the victim.
Please help.
Someone just broke into my house.
He's strangling my husband.
(creaks) RYAN: Now, Leo's the killer.
(woman gasps) No.
No, no! He's recreating his greatest hits.
(woman screams) KRUMITZ: Yeah, but what does the virus have to do with all this? And why today? RYAN: It's the anniversary of the day he was fired.
Look, Leo is a sadist who's aroused by the sound of fear.
The virus does everything that he needs.
The dropped calls delay the emergency responders, which maximizes the victims' panic.
Leo records the calls so he can enjoy them later.
It's his version of a serial killer taking a trophy.
Krumitz, didn't you say there were three recordings on that playlist? FINCH: BOY: Help! He's stabbing him.
He's stabbing my dad! FINCH: What's your name? Where are you? BOY: Dylan.
And I don't know where I am.
We just we left the game.
It's an alley.
FINCH: Help is on the way.
BOY: The man just left! I'm scared.
FINCH: It's okay, Dylan.
I need you to go to your dad Tell me what you see.
BOY: He's not moving! (whimpering) Leo mimicked the first two recordings on the playlist.
And this recording is of a man being stabbed in an alley in front of his son.
It happened at 8:53 at night.
This is his next move.
He's gonna kill again.
We need to stop Leo Finch.
MUNDO: Yeah, but how? There are thousands of alleys in New York City.
Okay, everybody, listen up.
We're basically looking for a-an alley in a haystack.
Leo's two copycat killings took place the same time of day as the original crimes, which means at approximately somebody is gonna get stabbed.
So let's get going on this.
All right? We've got just over an hour to find this Leo Finch before he finds his next victim.
D.
B.
, I figured out what the three 911 calls on Leo's playlist all have in common.
They all lasted over 20 minutes almost three times longer than your average 911 call.
The victims all died because Leo didn't dispatch the paramedics in time.
So he orchestrated their deaths.
NELSON: Just spoke to the NYPD.
They issued a BOLO for Leo.
And I sent them the antidote.
They'll push it to all cell phones in the area using AMBER Alerts.
Right.
So you guys figured out the, uh, alphanumeric problem, did you? We used a buffer overflow exploit, thank you very much.
NELSON: That's right.
It'll flood the phones with a specific sequence of text to force the NYPD home page to pop up.
Now, that home page will have a download for the antidote.
Basically, we're geniuses.
Exactly.
Basically.
Basically.
Do me a favor, though, will you? Call NYPD back, tell them to display a photo of Leo Finch with the antidote.
Might as well make the city our eyes and ears.
Uh yeah, uh I think you should do that.
Why is that? Might get a little pushback.
Apparently, they've been chatting with my pal the mayor.
Yeah, Nelson, this has nothing to do with your Stock Exchange hack, all right? Call them back, tell them to post the photo and the antidote.
Come on, buddy.
This is your hero moment.
You got this, Nelson.
Right, right.
My hero moment.
All right.
I just talked to the police chief.
He told me that you're using an AMBER Alert to send out an antidote written by Brody Nelson.
That's correct.
We'll have to verify that code before it goes out to the public.
I've hired a private security firm.
No, that's not necessary and we don't have the time.
We are chasing a killer, here.
I'm well aware of that, and I'm shocked that you would even trust a black hat with something this critical.
I've heard about your unconventional tactics, Deputy Director, but this is inappropriate and dangerous.
Mayor Cavanaugh, how many more lives are you willing to jeopardize? No one cares more about the citizens of this city than I do.
That's why I'm here.
Brody Nelson's antidote will save lives.
Now, I could go over your head with this, but I'm not sure that you could weather the political embarrassment.
If this goes sideways, it's on you.
(indistinct chatter, phone chimes) RAMIREZ: The public's responding to the AMBER Alert.
I've got multiple reports of Leo Finch at Madison and 140th.
Pellham Park.
That's Harlem.
Yeah, but we've got several sightings on the east side.
I mean, guy can't be in two places at once.
Dopplegangers? No.
No, we made a mistake.
Uh What do you mean? We sent the AMBER Alert to everyone.
Everyone.
Including Leo Finch.
Yeah, okay, all right.
Time to call Mom.
Let's get Avery on the phone.
Um, Avery.
We're striking out here.
It looks like Leo could be reporting false sightings.
So what do you think? Let's review everything we know about Leo Finch.
We know that he's meticulous about the details in his recreations.
The boy in the third that he and his dad were leaving a game.
MUNDO: The police report said Mets tickets were found in the dad's jacket pocket.
It was a baseball game.
Yeah, but it's not baseball season.
RYAN: Well, let's concentrate on another sporting event.
All right, here we go.
I got hockey in Manhattan, basketball in Brooklyn.
MUNDO: Which one fits our window? Both.
Let's compare them with the BOLO locations.
Okay, we've got six sightings of Leo around the arena in Manhattan, only one in Brooklyn.
RYAN: It's the hockey game.
Which ends in 15 minutes.
KRUMITZ: The original stabbing took place in an alley two blocks away from the stadium.
All right, how many alleys are there within that range of the arena? One second.
RAMIREZ: Three.
All right, well, this is a guy that sticks to details, right? Let's pull up some old crime scene photos, see if we can narrow it down to one.
Remember, Leo is a deviant audiophile.
It isn't about what we see, it's about what we hear.
Raven, pull up the original 911 recording of the alley stabbing.
Isolate the background sound.
Okay.
FINCH: 911.
What's your emergency? BOY: Help, he's stabbing him! He's stabbing my dad! FINCH: What's your name? Stop.
Go back.
(rumbling) That's an elevated train.
Pull up a subway map.
Look for any trains near the arena that go above ground.
RAMIREZ: Got it, it's the alley between West 4th and Bleeker.
Notify the arena.
I'll have 'em redirect crowds away from that alley, have NYPD clear the streets.
Let's go get Leo Finch.
(thunder crashing) (siren chirps) MUNDO: It's over, Leo! FBI! We have you surrounded! Got a visual on Leo, he is armed.
Drop the knife, Leo! Nobody's coming out of that arena.
We've sealed the exits, we've cleared the streets.
There's no one here for you to harm.
So drop the knife.
Drop it now.
They're mine! They're mine! You can't take them! Do not take one more step.
Give them back to me! They're all I have! MUNDO: Take one more step, and I will shoot! RYAN: Stand down, Elijah.
We confiscated his computer.
He's talking about the recordings he had saved on it.
MUNDO: He came here to kill someone.
He came to satisfy an addiction.
Leo's a junkie.
He came to get a fix.
We could still end this peacefully.
Krumitz, pull up the third recording on Leo's playlist.
We need to find a way to play it for Leo at the scene.
Okay, the squad cars all have P.
A.
systems with bullhorns.
Operator, this is Agent Daniel Krumitz.
Connect me to dispatch.
MAN: Hold your fire! KRUMITZ: Officer, I need you to turn on your P.
A.
system.
FINCH: 911.
What's your emergency? BOY: Help, he's stabbing him! He's stabbing my dad! FINCH: What's your name? Where are you? BOY: Dylan, I don't know where I am.
We just we left the game.
It's an alley.
FINCH: Help is on the way.
BOY: The man just left.
I'm scared.
FINCH: Hey, Dylan, I need you to go to your dad.
Tell me what you see.
BOY: He's not moving.
He was going for his knife.
Someone call 911.
I've been hurt.
I need help.
Nice code, brother.
Huh? You're gonna leave me hanging? My bad, bro.
(scoffs) That's old news, Nelson.
NELSON: Yeah, but not to the mayor of New York City.
I mean, all he saw was a black hat who brought down the stock exchange.
(scoffs) It's like no matter what I do right, I can't shake what I did wrong.
This is what pops up when I Google my name.
Look at this.
RYAN: Hey, come on.
You didn't have to come back to Washington.
You could have stayed in New York.
I know, but I was I was a distraction.
You had to go to bat for me.
It's not like anything Mayor Cavanaugh said wasn't true.
Really? You really took that eight million? Except for that, Krummy.
Hey, we cleared you of that long ago.
The fact remains you can't rewrite history, but you can make it.
And that is exactly what you did today.
Own that.
You should be very proud of yourself.
Thank you, Avery.
KRUMITZ: Eight million.
Oh, my God.
You can tell me.
I won't tell anybody.
Come on, you know where it is.
Let's go get it right now.
- I didn't steal it.
But I'm gonna find out who did.
And when I do I'm gonna put that bastard in prison.
Here, let me read this to you.
Okay.
"I'm taking a chance, hoping this is still your number.
"I know it's been two years.
But fingers crossed, "and divorce in the rearview Maybe"" Question mark.
"I'm at Le Petit Paris every night from 8:00 until they throw me out.
" And then she signs it: "Foolish Heart.
" So you got a new phone and her new number, and whoever had that number before you was supposed to get that text.
I-I know, I should have texted her right back when I got it, but I didn't, I-I waited.
But then I figured, you know, she would assume that her text hadn't gone through, right? Mm-hmm.
- And maybe that was better than letting her know that I, you know, a complete stranger, knew that she'd put herself out there.
And I just didn't want to embarrass her.
How do you know it's a her? Well, that's a good point.
Okay, end of conversation.
(laughs) No, wait a minute.
You fantasized about who it would be, D.
B.
No, I didn't, no, I didn't.
Yeah, you investigated it.
No, I did not investigate.
Yeah, you did.
I called the restaurant.
(gasps) See? - That's all.
I call (laughs) They said that a rather attractive woman came there every night the same time.
And I I knew that she was roughly in my age group.
Oh.
- "Foolish Heart"" That's a reference to a Steve Perry song.
That's a rock star before your time.
Anyway, this the whole text, it just you know, it seemed so brave and and honest, and I'm curious.
You hijacked another man's text.
Yes, I did.
(both laugh) So you're gonna meet her at the restaurant, or what? No.
No.
(indistinct chatter) (sighs) (inhales sharply) (ice rattling) Hi.
Hi.
(chuckles): Forgive me for asking, but are-are you here alone? Uh I am.
Yeah.
Of course.
Um sorry, no, I don't mean of course, I mean I have a confession to make.
Oh, really? Shouldn't I know your name before we jump right into the serious stuff? Yes, yeah.
Sorry.
Uh, D.
B.
Greer.
- Nice to meet you.
See, I, uh I received this today, and obviously, it was not meant for me.
I should have texted you right back, but I didn't, and I'm sorry.
Mmm.
Yeah.
Yeah, awkward.
No, not for me.
Because I didn't write that text.
(laughs): Really.
You're kidding.
Oh, boy.
(sighs) So (laughing): Oh Oh, man.
Well, shame on her.
- (laughs) Soliciting men via text.
So can I buy you a drink? Really? Seems like you could use one.
Shouldn't I know your last name before we jump into the serious stuff? Greer Latimore.
D.
B.
Russell.
Nice to meet you.
You, too.
Foolish heart - So, uh what do you do Greer Latimore? Former Secret Service.
Dabble in private investigations.
Foolish, foolish heart Nuh-uh.
Uh-huh.
Oh, boy.
What are you drinking? You've been wrong before Something manly.
(laughs) Okay.
Tequila.
Very manly.
- Yes, yes.
Foolish, foolish heart Excuse me.