01x06 - The Evil Twin

[bunniefuu]

My name is Avery Ryan. I was a victim of cyber crime.

Like you, I posted on social media, checked my bank account balance online, even kept the confidential files of my psychological practice on my computer. Then I was hacked, and as a result, one of my patients was m*rder*d.

My investigation into her death led me to the FBI, where I joined a team of cyber experts to wage a w*r against a new breed of criminal hiding on the Deep Web... infiltrating our daily lives in ways we never imagined... faceless... nameless... lurking inside our devices, just a keystroke away.

♪ ♪

Mr. Nelson, you're late.

(sighs) I'm sorry, Avery.

It's just that getting up early is something my body's not used to.

Okay, I feel you.

All right, I'll have a talk with my body, and we'll be here on time.

What you doing?

Oh, rescuing a spider.

Oh. Um... (laughs)

Yeah, do not come near me. Look. Look, I'm-I'm serious. (groans)

Brody Nelson, don't tell me you're afraid of a little spider?

A little spider?

Avery, look at the size of that thing. That's not...

Uh-oh. Where...? (stammering)

Why are you looking on the ground?

I dropped it.

You dropped it.

Avery...

Your bag...

Well...

Aah! (laughing)

(shouting)

Well, spiders don't like it when you're late.

Sifter: So your plane's on the tarmac at National, and you're scheduled to leave in an hour for New York City.

The Kirkendahl Hotel believes that their computer network has been hacked.

That connects every location worldwide.

This is the Kirkendahl file.

What do we got?

Three days ago, the hotel's computer intrusion detection system went off, sent an alert from their East Side property.

And they had their I.T. team take a look at it?

It appeared to be a glitch, happens all the time.

They reset the system, it happened again.

There's evidence of a remote cyber intrusion.

Kirkendahl's Wi-Fi has been compromised.

That means the hackers could have access to the corporate computers and the guests' personal devices.

And they probably discovered a vulnerable protocol, used a root kit to gain access.

Nah, that's doing it the hard way.

There's a known exploit in the authentication credential.

You should know that, right?

Of course I know that.

Okay, well...

Why wouldn't I know that?

Guys? Guys? You spilled water on your keyboard.

Then I saw a spider.

It's not like I did it on purpose.

Whatever. Let's just reign in our intellect here.

That hotel is right next to the U.N.

A lot of high-profile people stay there.

Diplomats, dignitaries, celebrities.

Yeah, and the U.N. is back in session in two days.

We could be looking at a dark hotel scenario here.

Hackers targeting the guests.

Yeah, or an att*ck against the Kirkendahl Corporation itself.

Either way, documents could be released.

E-mails, texts, sensitive information that could embarrass or expose some very important people.

Well, I've got a meeting coming up with the FBI Director.

I'll tell him my team is on it, and that none of that will happen.

Enjoy your flight.

Woman: At the suggestion of our in-house technical support team, we shut down the Wi-Fi.

Has any employee or guest reported any strange e-mails, or any evidence of their individual devices being hacked?

No.

What about pop-up alerts instructing them to update a file or a program?

I don't know. Those pop-ups appear all the time, even on my home computer.

Well, it's one of the ways that devices are hacked.

A free download or product upgrade that looks like it's authentic.

But instead of it being the actual product, it's the delivery of malware-- malicious software.

Mundo: And once someone opens it, the code gets released into the computer like a virus, and the hacker takes over.

It's like the hacker's lurking inside the device.

When a guest logs on to your Wi-Fi, the hacker is able to see their room number, the last name on their account, even get their passwords.

But-but we-we shut down the Wi-Fi, so that should protect us, right?

Mundo: Depends.

I mean, some malware is programmed to lay in wait for six hours, six days, six months or more.

Should-should we be copying and deleting documents?

No. Despite the definition of the word “delete,” in the cyber world, almost anything can be recovered.

Agent Ryan, as in-house counsel for the Kirkendahl Corporation, I can't stress enough the importance of privacy here.

It is something that we guarantee to our board members, our employees and our guests.

There must be something that we can do.

Many of our guests use aliases when checking in, but their real names and home addresses are in our files.

Some engage in activity that we keep very confidential, and I'm talking about more than just ordering an adult movie.

We-we send e-mails and texts containing confidential company information-- bonuses, salaries, mergers.

Activity that will have serious repercussions if those communications became public.

(phone ringing)

Pardon me.

Yes.

Say that again.

(sighs)

All right.

Our hotel security footage has been wiped.

Lobby... entrances... guest room corridors.

Everything recorded in the past week.

Was the system connected to the Wi-Fi?

Yes.

Ryan: If your surveillance footage was wiped, I don't think our hacker is interested in these confidential files that you're worried about, Counselor.

Something else is going on here.

Something happened here at your hotel, and someone is trying to cover it up.

(rock music playing loudly)

Man: Ms. Foster?

This is the hotel manager.

Ms. Foster, your music is disturbing other guests!

(music stops)

Ms. Foster?

Oh, geez.

Security. Call 911.

(camera clicking)

(indistinct police radio chatter)

(whimpering)

(camera clicking)

Mundo: The victim is Adel Foster,

24 years old.

She checked into this room five days ago alone.

Driver's license lists her address as East Rutherford, New Jersey.

NYPD are reaching out to New Jersey Police and her family.

Room's disorganized.

Bruises on her wrists.

Indicates... a struggle.

Most likely, a crime of passion.

Detectives canvassed the hotel guests.

Nobody heard or saw anything.

Crime scene lifted a few prints.

Most belonged to the victim, the rest to housekeeping.

However, I did find this in the plumbing.

The victim's cell phone.

The target tried to destroy it and then flush it.

Ryan: Well, the water likely corroded the connectors.

Data recovery is gonna be tough.

The hotel invoice.

Looks like around 3:00 this morning, she ordered a late-night snack and a movie.

Behavior of an insomniac.

Food for one. That indicates she was alone.

Mundo: Wait a minute. This is strange.

What?

The medical examiner just established approximate time of death.

Three nights ago.

What?

It's a hotel. How does housekeeping not find the body?

Stranger than that, according to the room invoice, yesterday and the day before, she ordered laundry, room and spa services, and a movie.

And this morning, breakfast.

Well, it looks like Adel Foster was alive for three days after she d*ed.

♪ CSI Cyber 1x06 ♪
The Evil Twin
Original Air Date on April 15, 2015

♪ I know you've deceived me, now here's a surprise ♪
♪ I know that you have, 'cause there's magic in my eyes ♪
♪ I can see for miles and miles ♪
♪ I can see for miles and miles ♪
♪ I can see for miles and miles ♪
♪ And miles... ♪
♪ Oh, yeah. ♪

Sifter: Okay, Raven, what have you got?

Data from the Kirkendahl Hotel's computer system.

This is a blueprint layout of a standard room.

We can see the computer controls and monitors pretty much everything that happens.

All run by one central software package called the “digital butler”"

And this explains why nobody in that hotel found Adel Foster's body for three days?

We believe so.

We detected malware on the hotel server.

It was sent to every employee hidden inside a party invitation.

So that's how it breached the firewall.

Ah. And Troy fell.

Yeah, it was the Trojans themselves that opened up their own city gates and pulled the wooden horse inside.

Just like the hotel employees who opened the party invitation and let in the malware.

While they blindly celebrated victory, their enemy lay in wait.

And Troy fell.

Krumitz: Our hacker had access to the hotel's main computer.

They found their way to Adel's guest room records and made it look like she was alive and well even though Adel Foster was definitely dead.

Well, that would explain the manicure, the facial, ordering the movie, even room service, but what about housekeeping?

No one ever entered the room.

Because the “do not disturb” sign is also controlled by the computer system.

Ramirez: Exactly. Maids won't enter when the light is on.

Hotels connect physical devices and sensors in the hotel rooms to one central computer to improve efficiency and cut down cost-- controlling thermostats and water temperature, providing you with the ease of ordering services from the hotel channel on your television.

From one computer, they can control everything.

Right. It's why they sometimes charge you for the items in the minibar just because you move them.

Now, the pressure sensor on the shelves sends a message to the computer telling its product has been consumed.

But as we all know, computers can be hacked.

I actually met the hat who wrote the code.

Called it a hospitality hack.

All right, now, once a hacker intrudes the hotel computer system, he has control over room assignments, check in, check out, television, thermostat...

Oh, my favorite: the remote control curtains.

Check this out.

Wait...

Nelson, are you really doing that?

Did you actually hack this hotel from CTOC?

Yeah, that was me.

The point is if all the conveniences are connected through software to one central computer, once the hacker's inside the system, he can create orders for room service, housekeeping, laundry pickup...

Ramirez: And none of it really happened.

It just looks like it did.

Mundo: And all activity is recorded under the guest's name and room number.

Which explains why a dead woman can order room service and a movie.

Ryan: So as far as the hotel knew, the minibar was being restocked, the laundry was being picked up, the maids were performing turndown services.

A hacker can control any guest's room 24/7.

This is a very sophisticated cover-up of a m*rder.

We need to know more about our victim, Adel Foster.

Her devices are on their way to you now, Krumitz.

We need to find this hospitality hacker.

You can't break into a system this complex without leaving some digital dust behind.

We're on it.

All right, so we got our victim's laptop, tablet and destroyed cell.

Our k*ller has a three-day head start.

Puts him right where we want him.

(chuckles) He thinks he got away with m*rder.

Which means he already made a mistake that will lead us right to him.

We are gonna find Adel Foster's m*rder*r.

Nelson: You know, I really could have used these things two years ago.

But you know every time Apple introduces a new device, there's a new cord, a new connector, and then all the old stuff is not compatible with the new stuff, so then you... you know, you got to go back, buy all the new Apple products, connect them and...

Dude, dude, really?

We're trying to work here.

Okay, well, then give me something to do.

Here. Lay out all the pieces of this cell phone.

Disassemble it, remove the circuit board, then scrub the resistor jumper connections.

There's a toothbrush and alcohol solution right over there.

Oh, okay.

I see how you do.

New guy gets the poop phone.

What?

I happen to know that this was the phone that was recovered from the toilet in the hotel room.

He's right.

That is the poop phone.

Really? You're gonna encourage this?

And you're not even that new anymore.

Okay, you know what, Nelson?

Fine. I will gladly take the poop phone if you just do me one favor and stop talking.

Guys.

Okay, what, you in a bad mood or something, Krummy?

You want to talk about it?

Oh. You're having girl problems.

Oh, my...

I knew it.

Raven, could you grab me that pen over there and s*ab me with it?

That would be awesome.

Guys, will you cut it out and come here.

You got no game.

I found something.

I have... I have game.

You guys.

I went back to the employee party invitation where the malware was embedded.

I couldn't find the information on the computer that sent it.

The hacker anonymized it.

So, I responded yes. I got back an auto-reply confirmation, and guess what-- our hacker forgot to anonymize that e-mail.

Pretty sure it's the same one that sent the invitation.

And I got his I.P. address on the computer.

Yeah! These guys never think two steps ahead.

I love this job.

This is gonna lead us right to our hacker.

♪ ♪

Evan Wescott? Is this your computer?

Yes. Why?

FBI.

You're under arrest for computer fraud in connection with the m*rder of Adel Foster.

What? What are you talking about? Hey, whoa.

Hold on a minute. I don't even know who that is.

You got the wrong guy. (grunts) I didn't k*ll anybody.

We can do this the hard way, or you can come quietly.

You hacked the Kirkendahl Hotel's main computer, Evan.

We know this because the I.P. address of the device used led us back to your laptop.

That's impossible. I don't even know how to do something like that.

Mundo: You created a backdoor in the computer systems and took control of the hotel's hospitality functions-- maid service, room service, minibar.

You m*rder*d Adel and activated those services to make it look like she was alive three days after her death.

What? That's insane. I didn't k*ll anybody.

Your cell phone places you at the hotel at the exact time of Adel Foster's m*rder.

Your phone's location services puts you in that hotel.

Location services?

Mundo: The little program that's always running in the background of your phone.

Logs everywhere you go.

Ryan: Nifty little feature.

See the elevation listed here? 29.7 meters.

That's roughly seven floors.

Her body was found in room 715.

Okay, I-I'm not a m*rder*r.

Mundo: Really?

'Cause you sure sound like one in the text that you sent Adel.

We found that on your phone.

These are not my text messages.

And I already told you, I don't know anybody named Adel.

Are you sure you never talked to her?

This is surveillance footage from your bar, Evade, on the night she was m*rder*d.

♪ ♪

I mean, 'cause that sure as hell looks like her, and that is definitely you.

Look, man, a lot of people come into my club.

And, yeah, I meet a lot of women.

Mundo: Yeah?

Well, this one was m*rder*d three days ago.

Where were you?

I was at the club.

I'm always at the club.

It's a pretty crowded place at night.

Could easily step out for an hour, and no one would miss you.

This is ridiculous. I didn't do anything.

At first, I couldn't understand why you went to all the trouble to make it look like Adel was still alive.

Mundo: You wanted to buy yourself time to create an alibi.

The hotel hack.

And you certainly can't deny that you were capable of doing it.

You were a computer science major at Kenniwick University.

Day one, nobody found the body.

Day two, no one came for you.

Mundo: Day three, you got comfortable.

You distanced yourself from the m*rder.

You thought there was no evidence tying you to the scene of the crime.

You got away with m*rder.

Almost.

Evan: No.

I didn't k*ll anybody.

I didn't do any of these things.

Evan... your devices tell us you're lying.

♪ ♪

Man: Shane Tillman.

Adel is... er, was... my girlfriend.

I don't understand how this happened.

Doesn't the hotel have security?

We're still investigating the circumstances surrounding Adel's death.

You mean her m*rder.

When her cell kept going to voicemail, I called the-the hotel, and she... they said that she was still checked in.

I thought that she had lost her phone.

You know? I mean, she does that a lot.

But I never thought...

...you know, that, um, that she was dead.

You spoke to her the night that she was k*lled.

Yeah, she seemed excited.

Talking a mile a minute.

(sniffles)

Adel saved up money for months for this trip.

You know, she had a whole itinerary: Coney Island, Statue of Liberty, Empire State Building, a couple of Broadway shows.

Why didn't you go with her?

I got called into work last minute.

What do you do?

Some part-time stuff.

Operations and Safety at the hospital, and I work construction on the weekends.

They were short on staff and needed some extra help.

I was trying to save money so we could go to Europe.

I think, uh...

I think she wanted to experience New York this time on her own.

She loved the city.

Even though we were in East Rutherford, we didn't get up here often.

I'm sorry. I, uh...

I just can't believe she's gone.

All right. Every piece is scrubbed, dried and connected.

Between that spider this morning and this phone, boy, I could so use a hot shower.

Dude, man up.

It's time to Frankenstein this thing.

We are gonna rebuild Adel's phone and resurrect its memory.

You mean we can do that?

We can actually get data off of this thing?

Watch and learn, son.

This is how the good guys do it.

Watch and learn.

♪ ♪
♪ ♪

You see what I'm seeing?

Yeah.

A problem.

Mundo: So Krumitz was able to pull some data off Adel's phone, but the threatening text messages from Evan aren't there.

Were they deleted?

They never existed.

So I double-checked with Evan's service provider.

They have no record of the calls or the texts either.

Which means Evan didn't send or receive those texts.

So how did they get on his phone?

So Elijah sent me everything he pulled off Evan Wescott's phone.

Those text message conversations between Evan and Adel were faked.

How can somebody fake a text on another device?

Once you get a text message into your phone, it's added to one long database.

If you're smart enough and have the right software, you can manipulate that file and make it look like you're getting text messages from whoever you want.

Whenever you want.

Or to someone else's phone.

Mmm. “Happy New Year, Krumitz, from your best pal, Sifter.”

Sent from your phone January 1, 2016.

That is impressive.

And a little creepy.

Yeah.

Now, would you need physical access to Evan's phone to fake those text messages?

No. Plus, Evan's phone doesn't even have the software necessary to manipulate the database-- it had to be done remotely.

And that's not all. GPS coordinates that put Evan Wescott in the hotel room at the time of the m*rder...

Faked. Faked.

His phone was hacked.

Yeah!

Oh... (grunts)

Avery, all of our digital evidence is lying to us.

Is Krumitz sure no mistake was made?

He's positive.

What about the malware injected into the hotel's computer system?

It came from Evan Wescott's computer.

But Krumitz doesn't believe Evan is our hacker.

He's sure?

Sifter: Yes.

And how many times have you told me that Daniel Krumitz is the best white hat hacker ever?

Looks like Evan Wescott is being framed for m*rder.

Krumitz: For someone to frame Evan, they had to route the intrusion through his laptop, change the GPS, and create those text messages.

Maybe he framed himself.

Clearly, you're new to this and don't understand the behavior of a criminal.

Other than yourself.

What I understand is I would do anything not to go to prison.

Pretty risky to frame yourself.

It's working for Evan.

You believe he's innocent.

I believe in cyber evidence.

Okay, I'm not saying the evidence is wrong.

I'm just saying his devices could be manipulated by anybody.

Evidence doesn't point to the identity of a hacker.

So what happened when we caught you?

See, why you want to get all personal?

What?

That's what I'm saying...

Guys? Guys?

(arguing continues)

Stop! Stop! Focus on the case!

Whatever, whatever.

Focus on the case.

Whoever hacked them, gained access to at least one of Evan Wescott's devices.

Evan has full access to all of his devices.

Physical access is the easiest, which is why I think it's Evan.

Physical access is also the riskiest.

Nelson, just for a minute, try to buy into the fact that Adel's k*ller might not be Evan Wescott.

The hacker behind this had to have skills.

Evan has a computer science degree.

(scoffs, groans) I'm just saying!

All right, fine, I'll, uh... I'll play along.

The hacker could've easily done this remotely.

If I'd done it, I'd “w*r drive” him.

Pull up to his house. Hack into his Wi-Fi, plant everything on his computer and phone while he's still inside, totally oblivious.

It's still too risky. You're sitting outside of his house. What if somebody sees you? Or your car?

The best way to do it is from the safety of your own home.

All you have to do is “spear phish” him-- a socially engineered att*ck. Send Evan an e-mail with a fake link from his bank or something, wait for him to click on it, and then boom! Full access to his laptop and any device that connects to it, like his phone!

Okay, so how you know he's gonna click on it? And when?

Whoever did this was short on time.

The best way to stay anonymous and get instant access to Evan's devices is to wait for him to connect to an open Wi-Fi signal somewhere.

Anywhere they're advertising free Wi-Fi is like a hacker's virtual playground-- tons of unexpected people unaware that the person next to them sharing the same connection could be intruding onto their devices and stealing all their information.

Or in Evan's case, adding information.

Look, I still think he could've done it himself.

I mean, that's just me.

Wi-Fi is the best option.

So... where was Evan hacked?

Well, according to his frequent locations on Evan's phone, he went to the gym three or four times a week.

Most gyms have free Wi-Fi. Restaurants, too.

I bet you he was eating out every night.

You know, club owners score mad dates.

How often is he at Carla's Cafe?

Ramirez: Almost every day.

Well, according to the network logs in Evan's laptop, he connected to the coffee shop's Wi-Fi the morning after the m*rder.

You still think it's a possibility that he framed himself?

Yeah. I do.

All right. So I spoke to the manager.

The surveillance cameras are all dummies.

They're just there as a crime deterrent.

They don't record a damn thing.

But... the Wi-Fi went down three days ago at 10:32 a.m.

Now, according to Evan's laptop, he was long gone at that time.

But not onto the cafe's router.

Maybe someone set up an evil twin router.

And that's how he got hacked.

Now, my phone... can give the illusion of being a Wi-Fi signal, same as a twin router.

All I have to do is activate my own personal hot spot from my device, and I am open Wi-Fi.

I can even name it anything I want.

Say we're in Carla's Cafe, right?

Think I'll name my new hot spot network...

“Carla's Cafe.”

Now, log on to the free Wi-Fi.

(laughs)

Which one? There are two.

Exactly.

The one I just created and the real one.

I'm guessing our target eliminated the real Carla's Cafe Wi-Fi.

Evan came in, logged on to the decoy signal... and the hacker gained control of his device.

You just did all that with your phone?

Just a few clicks of a button.

Now, I-I can't control your device from my phone, but our target had an actual router.

He was able to push any information he wanted onto Evan's devices.

I mean, anytime you log on to open Wi-Fi, you leave yourself vulnerable.

Or in our case, you become a m*rder suspect.

It can happen to anyone.

Looks like it just happened to Evan Wescott.

Raven, I need you to track down the owner of an evil twin router.

(chuckles) Right.

Nelson thinks Evan framed himself.

That would be a smart move.

You don't really believe that, do you?

Nelson thinks the way hackers do.

But...

Evan has no motive.

And no definitive connection to Adel Foster other than a kiss; and kisses rarely get you convicted of m*rder.

You miss New York.

Yeah, feeling a bit nostalgic.

I opened my first practice in Manhattan.

Hung the shingle on a brownstone just like that one there.

Went from analyzing minds to analyzing cyber criminals.

Wasn't really a plan, it just happened.

You ever think about moving back?

No.

I only think about one thing.

Catching the guy that hacked and stole my files.

There isn't a morning where I don't wake up wondering if today's the day that he's gonna release private patient information.

And the whole nightmare will start all over again.

We'll catch him.

(sighs)

You know what I miss about this place?

The Mets.

The Mets? (laughs)

I would comment, but you'd probably fire me.

But there is one question I can't shake, Elijah.

Evan Wescott.

What about him?

Well, the beauty of an open Wi-Fi hack is its sheer randomness.

Our k*ller could've framed anyone on his router for Adel's m*rder.

You think the target chose Evan specifically.

Adel went to Evan's club the night of the m*rder.

And the next morning, Evan ends up at Carla's Cafe at the exact same time as the evil twin router.

It feels personal.

Our target crafted a m*rder for Evan.

Fabricated texts and GPS data, linked him to the hotel hack.

He set up Evan as a fall guy for a reason, but why?

I identified the router that was used to hack Evan in Carla's Cafe.

The latest and greatest in evil twin deception, huh?

Manufacturer gave me the big box store where it was sold.

All right, from your smirk, I'm guessing it was purchased recently.

Mm-hmm.

Point of sale puts that gentleman at the register.

He paid cash.

Get this to Avery and Elijah.

We've got him.

(tablet chimes)

Look who was in Manhattan the morning after Adel's m*rder.

Just got this from Raven.

Oh. The heartbroken boyfriend.

Mundo: Shane Tillman, FBI!

He's not here.

I'm gonna image the hard drive, send it to Nelson and Krumitz to comb through the data.

Ryan: Broken cup.

Damaged wall.

There was an argument.

Adel wasn't visiting New York.

She was running away from Shane.

You know, something struck me as odd when I saw the bruises on her wrist at the crime scene.

Look. They're purple, almost black.

If she'd gotten these during the struggle the night that she was k*lled, they'd be pink or not even visible.

She got these before the night she was k*lled.

Adel was leaving Shane.

He came home.

Stop it!

He pulled her things out of her bag to prevent her from leaving.

When she escaped, he grabbed her wrists, which caused the bruising.

(both grunting)

Oh, God! (groaning)

When she left, he started drinking.

He followed her to New York and he k*lled her.

My God.

Even when women get the courage to leave abusive relationships, sometimes they still get k*lled.

So what's his next move?

Well, he's angry.

He's calculated.

He's got nothing to lose.

And he's armed and dangerous.

Ramirez: I just hit a dead end.

Tillman's phone's not showing a signal.

He must have turned it off. There's no way to track him.

I'll see what we can do with Tillman's laptop.

His recent online activity should give us a glimpse into his state of mind.

Yeah, browser history has been cleared.

Yeah, well, clearing your history may hide p*rn sites from your girlfriend, but it won't hide anything from me.

Browser artifacts are easily recovered with the right tools.

Oh, check it out. Mostly New York news affiliates.

He's following the Adel Foster m*rder investigation.

You think he knows we're onto him?

Always assume that the bad guys are two steps ahead of you, Nelson.

That way, you're prepared for anything, and you're never caught off guard.

Hey, man, he visited a cell phone locating site?

I mean, what, he lost his cell phone?

No, he wasn't looking for his phone.

He was tracking someone else. Look.

That area code is 212.

That's New York, not Jersey.

Krumitz: I'll call Elijah.

Elijah, Shane Tillman is using a cell phone location tracking site.

He's going after Evan Wescott!

♪ ♪

Whoa, whoa, whoa, hey.

Problem is with me.

Just let these people go.

Shut up!

This wouldn't be happening if it wasn't for you.

You took her away from me.

Buddy, I think you got the wrong guy.

It was you! It was you!

I saw you with Adel right here in this bar.

Look, man, just drop the g*n, and we can talk about whatever it is that you think may have happened.

No, I know what happened! I know what happened!

(siren wailing)

You took her away from me.

Of course, you don't remember.

There's so many women, aren't there?

You just have to have them all?

I needed a chance to explain, to say I was sorry.

To say I was sorry.

But you... you were all over her.

And I could see in her eyes, she wasn't coming back to me.

Shane?

Stay where you are!

Stay where you are!

Or this isn't gonna end the way you want it to.

Let her go and put down the g*n.

He k*lled my girlfriend, and you did nothing.

You set him free.

At the count of three, I'm gonna discharge this w*apon.

You need to decide what you're gonna do. One, two...

Okay.

Okay.

Good.

Now kick it towards me.

Stay right where you are.

W-Wait, don't do that, don't do that.

I can't live without her!

Shane. Shane!

I got you!

Hang on!

I got you!

♪ ♪

Ryan: Are you okay?

Yeah. Yeah.

We got him.

We're not done.

We still haven't put Shane Tillman in that hotel room at the time of the m*rder.

We still have to prove who k*lled Adel Foster.

Anything on Shane's phone?

I need to know what we've got before I question him.

Sifter: Well, nothing concrete.

I'm heading in now for an update.

Krumitz: Yeah!

Nelson: That's what I'm talking about!

We got it.

We found proof.

(stammers)

I'm gonna call you back.

Wh-What kind of proof did you find?

Proof that Shane Tillman was at the scene of the crime.

Proof that he m*rder*d Adel Foster?

If we're lucky, both.

It's called a motion tracking chip.

Most new smartphones have them, but most people don't know they exist.

It's a motion co-processor that collects and stores motion data on the phone's accelerometers, gyroscopes and compasses.

All right, so basically it just... it records movement.

Yeah, it's how an exercise app knows the difference between when you're jogging versus walking, which direction you're headed-- pretty much however your phone's moving.

Krumitz: As the phone moves, the motion tracking chip records all of it.

It will detect a pitch, a roll, a tilt-- every movement the phone makes.

Right, and it's always on.

And it's separate from the main processor.

Let me get this right-- so if data were altered on that device, it would never cross your minds to manipulate that file.

Exactly. So we pulled all the data off Shane's motion tracking chip, and this is what we found.

So the one on the left is the motion tracking chip from Shane's phone; the one on the right is Adele's.

Yeah, we synced both of them up to the last time Adel's phone moved before she was m*rder*d.

Nelson: Most people keep their phones in their pants pockets.

Krumitz: Which means the phone was recording their movement.

So if two people were fighting, and we had both phones...

Sifter: Right, we could reenact the fight.

Nelson: Yeah.

Who is he?!

Who is he?

Tell me who he is! Leave me alone!

I'm not your girlfriend anymore!

Adel?

Well, this not only puts Shane Tillman in the room at the time of the m*rder, it proves that he k*lled her.

Avery: You covered your tracks from every possible angle.

You wiped your phone of any wrongdoing, pushed all the evidence to Evan's devices, you even hacked the hotel, wiped its security footage.

Ryan: It was all very clever.

But you forgot one thing.

One thing most people don't know about-- your phone's motion tracking chip.

Cyber-synchronized offender and victim.

Records every movement.

Proves you k*lled your girlfriend.

(sniffles)

What's this?

Nelson: No!

(Ryan stammers)

No, no! You freed it?!

Oh, what?

Uh, there was a cup in the middle of the floor.

Hey, welcome back.

Good job.

(grumbles)

He has been preoccupied with a little spider.

What is all that? (chuckles)

What?

Some compressed air.

I was gonna turn it over, zap it, freeze it, then I was gonna set it free.

Aw.

Cryonic preservation?

I'm not hunting that thing down again.

Okay, I will help you look for your spider.

Thank you.

We'll find it, and Elijah will arrest it.

Yeah.

Krumitz: Well, now I have to help.

Yeah. (shouts)

Why... why would y'all do that?

(laughter)

Why would y'all do that?!