01x09 - L0m1S

[bunniefuu]

My name is Avery Ryan. I was a victim of cyber crime.

Like you, I posted on social media, checked my bank account balance online, even kept the confidential files of my psychological practice on my computer. Then I was hacked, and as a result, one of my patients was m*rder*d.

My investigation into her death led me to the FBI, where I joined a team of cyber experts to wage a w*r against a new breed of criminal hiding on the Deep Web... infiltrating our daily lives in ways we never imagined... faceless... nameless... lurking inside our devices, just a keystroke away.

Krumitz: We got another one.

Nelson: That's four and counting.

What the hell is going on up there?

Hold on. Yes, I'm still here.

FAA has confirmed Wi-Fi is down on four domestic flights, all Monument Air.

Do they know why this is happening?

They're still looking into it.

All right, I just spoke to Liftoff Wireless.

They've been trying to restore in-flight Internet access on the planes, but something is blocking them.

I'm here. Go.

Uh, we got a fifth.

No, no, make it six.

Same as the others.

All Monument Air. Looks like some type of coordinated att*ck.

Ryan: DHS is operating at National thr*at Level Yellow.

It hasn't jumped to orange yet.

Shouldn't we call the president or someone?

I mean, we're talking planes.

Sifter: Yeah, which is exactly why we don't jump to conclusions.

We got to have some facts before we suggest they start upping the thr*at level.

No reports of instrument malfunction.

Pilots are still able to communicate with the control tower. Undercover air marshals haven't detected any unusual activity either.

What time did the Wi-Fi go down on those flights?

Ten minutes after takeoff.

All right, that means they were above 10,000 feet.

That's when the passengers on Monument Air can connect their electronic devices to the in-flight wireless network.

Got another one.

Seven.

Mundo: Eight.

Nine.

Sifter: What the hell is this?

Okay, okay. What is it, Krumitz?

Liftoff Wireless' server logs show only one phone on each plane connected to the router and caused Wi-Fi to go down.

Ryan: That means nine passengers on nine flights shut off the Wi-Fi from within the plane?

Sounds like a coordinated att*ck to me.

Think all nine passengers are working together?

Nelson, pull up the flight routes.

The destination cities are all different, but they all originated from Miami International.

I'm calling Homeland Security.

Secretary McKnight, this is Simon Sifter, Cyber Crime Division.

We've got a potential national security thr*at.

I'm requesting that you immediately ground all Monument Air flights.

Yes, I am sure. As you know, shutting down passenger communication is a possible precursor to hijacking.

I would like all these flights redirected to their nearest airports.

Monument Air Flight 417 is 300 miles outside of Miami.

That's the closest and easiest to send back.

All right, I'll have that flight routed back to Miami.

Krumitz, can you tell specifically which phone or passenger shut down the Wi-Fi?

I... I mean, it's gonna take some time, but yeah.

Ryan: Okay.

We need the names and the seat numbers for those passengers with the phones, and we need them now.

Let's go, Elijah.

Nelson.

♪ ♪

Okay, all right, all right, got it.

All right, thanks, Krummy.

Okay, target's sitting in 14C.

Plane is taxiing to the gate right now.

Good, what about the other flights?

Great.

Local Feds are detaining the eight suspects in the other cities now.

I-I just left for vacation.

Someone needs to tell me what this is about.

Can you please call my husband?

This is crazy.

Excuse me. Excuse me.

Take your headphones out, please.

How old are you?

16.

Have you been sitting there the whole flight?

Yeah. Why?

Cuff her.

What did I do? What's going on?

Stand up, place your hands behind your back, please.

Willa?

Dad!

They won't let me leave.

What's going on here?

My daughter was going to visit family in San Diego.

I don't get it. Are you saying she's a suspect?

We're just trying to understand what happened here, Mr. Hart.

Someone hacked into the plane's router.

We traced that intrusion back to Willa's phone.

What?

I mean, how is that possible?

Her cell phone serial number was the last one that logged on to the onboard router before it crashed.

We ran that number through every cell carrier's database till it spit out a name.

Willa's name?

We matched that name to the flight manifest.

It gave us a seat number.

Willa, did you leave your phone anywhere?

Did you bump your device with anyone?

Did you text or download anything?

Go ahead, sweetheart. Just answer her questions.

I texted some friends, but I do that all the time.

I was just listening to music and playing Dots.

Hmm.

What's he doing?

Imaging your phone, making a duplicate copy of your device to determine what k*lled the Wi-Fi.

Can I have it back?

Once we're done with it. Right now I want you to tell me everything that happened before your flight took off.

My dad dropped me at the curb.

I checked my bag, went through security, had a smoothie.

I bought it at Mango Mel's.

And then I waited at the gate for my flight.

Does the name Audrey Monroe mean anything to you?

How about Ken Galvin?

Margaret Sloane?

What do they have to do with Willa?

Your daughter's phone's not the only one that cut off the Wi-Fi.

It happened on eight other flights.

Lee Yang?

Jason Hawking?

I don't know any of these people.

Well, it's clear to me, and it should be to you, that my daughter didn't have anything to do with this.

She's just a kid.

Mr. Hart, in my line of work, “just a kid” doesn't mean anything.

Hey, yo, E.

It's getting ugly over there, man.

Yeah, well, their flight's been grounded and they haven't been given an explanation.

You'd be angry, too.

Well, you're right.

So, I ran diagnostics on the plane's router.

One device overloaded the entire system.

It was a denial-of-service att*ck.

Pilot: Ladies and gentlemen, at this time, Liftoff Wireless' Wi-Fi service is available at a charge of $9.99 for the duration of the flight.

Thank you.

Nelson: Willa's phone prevented any other passenger's device from connecting to the Wi-Fi.

Phones aren't supposed to send that many data packets at once.

Yeah, unless a hacker with some skills worked their magic.

Uh-huh.

I'll go ahead and unplug the router from the plane.

I'll send it back to CTOC.

Do that.

All right.

Anything from our FBI field teams?

Sifter: Well, they've interrogated the other eight suspects.

They're all from different cities.

They span multiple generations, and they've all got varying levels of technology, and they all allege they have no idea what happened.

Willa Hart said the same thing.

She has no clue what's going on.

Field teams confiscated our suspects' phones.

They're imaging them now.

Data should be here any minute.

So, Avery, I've made a lot of moves here.

There are gonna be a lot of questions.

So, from your end, what does this look like?

I'm not sure yet, but I'm not willing to give up on the idea that these people are connected.

(register dings)

I'm sorry, ma'am, this one didn't work either.

Two of my credit cards have been declined?

That's impossible.

No, I didn't buy ten laptops.

I don't even shop at that store.

(phones ringing, overlapping chatter)

Avery, what's happening?

I'm not sure yet. Hold on.

Let me flip view.

(ringing, chattering)

It suddenly just got very noisy in here.

Yeah, my credit card's been denied.

What do you mean you don't know what's going on?

It happened on your plane.

Are you seeing this?

Man: All of my credit cards cannot be maxed out. How is that even possible?

All of these people were passengers on Willa Hart's flight.

Simon, I know what this is.

This is a credit card heist.

Dozens of people who got off that plane are starting to receive alerts that their credit cards have been frozen.

Someone stole their information.

That's it, that's it, that's it.

'Cause a plane is the one place where people are held c*ptive.

You can't connect to the rest of the world if the Wi-Fi is down.

The passengers wouldn't even know that they'd been robbed till they got off the plane and connected to the Internet.

I don't believe this.

What? This can't be right.

I've seen this before.

There it is again and again.

He uses a unique signature when writing code.

He?

What is it, Krumitz?

I know who did it.

Lomis.

Lomis is behind this, and it's just the beginning.

♪ CSI Cyber 1x09 ♪
L0M1S
Original Air Date on April 29, 2015

♪ I know you've deceived me, now here's a surprise ♪
♪ I know that you have, 'cause there's magic in my eyes ♪
♪ I can see for miles and miles ♪
♪ I can see for miles and miles ♪
♪ I can see for miles and miles ♪
♪ And miles... ♪
♪ Oh, yeah. ♪

I can't believe this is Lomis.

He's like a hacker legend.

Came out of nowhere a few years back.

Now, they say he's in his 30s, good-looking, comes from Estonia.

Sounds like a little hacker envy, Nelson.

No. (chuckles)

Look, it's admiration.

Lomis lives up to his name.

It's leetspeak for “low m*ssile.”

Flies under the radar.

He's only surfaced twice.

Both times at DefCon in Vegas.

That's it.

All right, over $400,000 have been stolen in our credit card scam and over 300 people have reported theft.

There's no telling when this is gonna end.

(Nelson whoops)

Nelson: See?

Now that's what I call traveling in style.

Ryan: Sifter has connections with the Coast Guard, so Krumitz gets a free escort from D.C. to Miami.

Nelson: Nice ride, bro!

It's the only way to fly!

Krumitz, you're sure this is Lomis?

Every bone in my body says I'm right.

This is how he works.

When the Wi-Fi intrusion on the planes connected to the credit cards, I knew it was him.

Sounds like a hunch.

And your obsession with catching a guy you've been chasing for the last three years.

But it's not.

Before I left CTOC, I found a connection between the nine suspects and Lomis.

I discovered a malicious script buried deep in the nine suspects' phones.

The code exploited a vulnerability in the operating system.

(beeping)

Nelson: Yeah, that's his signature.

A custom code that gains complete control over the OS and suffocates the security features like a boa constrictor.

Means he can do whatever he wants with any of the phones...

...steal your identity, access personal info, even attach malware.

It doesn't make sense, though.

I mean, in the past, Lomis robbed a New York hedge fund, the payroll at San Francisco PD, even went after an NHL team.

Now this?

Ryan: You're right. Credit cards and planes doesn't really fit his behavioral profile.

It's not what he does.

It's how he does it.

He starts with creating chaos and it grows into something bigger.

That's what this is.

Mundo: If Lomis is the one behind this credit card heist, it means that none of our nine suspects even knew the suspicious script was on their phones.

Means Willa Hart and the rest of the eight passengers are all victims.

Call the FBI field teams, have everyone we've been holding released.

Nelson...

Yes?

Follow the credit card trail.

Look for any purchases that stand out.

Okay.

Krumitz, check for the code Lomis placed on the rest of the victims' cell phones.

We're about to catch a white whale.

No, that's done.

We alerted the credit card companies and it should be a day or two, and ...

Yeah-- hey, Mike.

Gotta call you back.

Thanks.

Colin, I haven't had a chance to congratulate you on your promotion yet.

Deputy director.

That's-that's big.

Thank you, Simon, but I'm not here to talk about that.

The director just called me to ask why you grounded all Monument Air flights out of Miami.

I managed to support your decision, despite the fact that I knew nothing about it.

You should have brought me up to speed.

There was no time to bring you up to speed.

Cyber crime moves fast here, Colin.

Regardless, you should have consulted me first.

Look, I-I've always had the authority to kind of run my own division.

Wait, are you... you telling me the rules have changed?

I'm telling you I should have been told.

I don't want to lose sleep worrying if you're gonna keep me up to speed on everything I need to know.

I grounded those planes to save lives and prevent a possible national security thr*at, okay?

I had to make a tough, split-second decision.

You cost an airline millions of dollars.

W-What... what is this?

Are you... are you scolding me?

From now on, you keep me in the loop.

You report to me.

I report to the director.

Understood.

(door closes)

♪ ♪

Yes!

Ryan: What is it?

This is great.

I've been thinking about this all wrong.

That doesn't sound great.

No, it is.

Because I realized that the code itself is not going to help us find Lomis.

I'm still waiting on the “great” here, bud.

How the code got onto the phones is the key.

That's a pairing record.

Yep. A history of the last device a phone synced with.

All these phones paired with the exact same device.

Krumitz: Bingo.

And all the time stamps are within an hour before our victims' flights took off.

That means they picked up Lomis' malicious script somewhere in this terminal.

Nelson: There's at least 50 different ways to infect a phone.

Lomis is clever.

He picked a place where he could install his malicious script on multiple victims' phones, all at the same time.

We're looking for a watering hole.

Maximize the number of victims, maximize the credit card info.

Mundo: Right there.

They plugged their phone in to get a charge, he stole their data.

Ryan: No, that charging station is off the beaten path.

Infrequent traffic.

He would have chosen a high-traffic station for his victims.

Mundo: That's our crime scene.

Ryan: When someone plugs in their phone to charge, their info is being stolen.

This was juice jacking.

All right.

I'll call the airline, get the passenger manifest for every flight that left the terminal this morning.

We need to find everyone who's carrying this malware on their device.

Krumitz, I need you to clear all the passengers from this area.

Nelson, start removing all the malicious script from everyone's phone.

We need to shut this down now.

FBI!

Everyone unplug.

Man: What? Hey.

Woman: My phone is dead.

Hey, don't unplug my phone.

It's dead.

Tell me something, sir.

Have you ever heard of juice jacking?

No, and I don't care to.

You see this cord?

It charges your phone, right?

Nice. Safe.

You think it's your friend.

But you see this connector on the end?

Yeah. It's a USB plug.

Not exactly groundbreaking stuff, guy.

Hmm.

Maybe this'll impress you.

Most people don't realize that this cord has four ports.

Two for power, which charge your phone, and two for data, which transfer-- yes, you guessed it-- your data.

Now, what do you think your phone was doing just now, guy?

Charging.

Krumitz: Wrong.

Stealing your data.

You just wanted a charge, and you had no idea that a hacker had installed a juice-jacking device that allows him to steal your credit cards, your photos, your videos, everything on your phone.

Now, if you just go get in line and talk to that short gentleman trying to pull off the purple paisley tie, he's gonna take the malicious script off your phone for you.

Problem solved.

Thank you.

Got it.

Patient zero.

Mm!

I need the north side of the terminal cleared out.

No one goes in or out.

This is a crime scene now.

Excuse me, ma'am? Sir?

I need you to clear the area.

Pardon me, miss.

Ma'am?

(crowd talking excitedly)

Mundo: The vic's name was Rachel Carrington, a grad student at the University of Miami.

Worked here part time to put herself through school.

What did she do here?

She was a credit card sales rep for Monument Air.

She worked at the charging station, trying to get people to sign up for their new Peak Miles card.

Local Feds just contacted her family in Phoenix.

They're flying in now.

Did the coroner determine the COD?

Preliminary report is blunt force trauma.

They found traces of blood in the women's restroom.

They haven't ruled it a homicide yet, but there are signs of a struggle.

Honestly... it's not adding up for me.

Hackers aren't murderers.

Neither are robbers, until something goes wrong and they become desperate.

We need to gain access to the security footage in the airport.

I'm on it.

Guys!

Guys, wait! Wait.

Remember when Krumitz said that Lomis likes to start off with chaos and then it grows into something bigger?

Yeah?

Well, it just happened.

I was removing the malicious script from the phone and suddenly I got locked out.

Look at this.

Ryan: “Hi, Chelsea. You're phone's been h*jacked. What would your fiancé Joey think if he saw you being a dirty slut? Reply with a 14-digit prepaid cash voucher for $250 in the next 24 hours, this goes away.”

This is ransomware.

Krumitz said the malicious script is a custom code that strangles the operating system and allows Lomis complete control over all the phones.

Lomis just stepped up his game.

Now he's holding the phones hostage.

We stopped his payday; now he's retaliating.

Nelson, I need you to get back to D.C. Stay on top of the stolen credit cards and cr*ck that ransomware.

Done.

Um... Is there gonna be peanuts and pretzels on the Coast Guard chopper?

(laughs)

Is this some kind of sick joke?

No.

It's completely frozen.

Someone put ransomware on it.

You mean by charging my phone, all this happened?

Ryan: Yes. A hacker took control of your phone and locked you out until you pay the amount that he's demanding.

He has personal information.

He knows my fiancé's name.

Not only did he lock you out, he accessed your personal data-- your messages, phone calls, pictures.

What is he going to do with it?

Well, he's threatening to release it if you don't pay.

What did he find on that phone you don't want your fiancé to see?

Am I really expected to pay $250,000 to unlock my phone?

Senator, we don't suggest you pay this ransom.

And when I don't?

Any number of things can happen.

Could you try to be a little more specific?

All right. As that text you received threatens, he will post all of your personal information on the Internet.

Senator: I just flew back from a family trip to Miami and simply charged my phone, and now this happens?

What action are you taking?

We're working some promising leads.

We've... (scoffs)

Really, gentlemen?

Really?

Our government appropriates a lot of money to the Cyber Division, and “promising leads”?

Is that the best you can do?

These things take time.

Time is not something I have.

19 hours from now, the highly sensitive government material on this phone goes public.

Senator, look, all due respect...

I mean, you know better than to keep sensitive government documents on a personal phone, so... what exactly are you worried about?

Senator: I have telephone numbers and information of high-profile colleagues and friends.

I have photos of my husband and my children on this phone.

Clearly, there's something else on that phone you don't want getting out.

You don't understand.

It can't get out.

What I have on this phone is very personal.

It could ruin my career.

Senator, he's already got what's on your phone.

So, what?

What, I cross my fingers and hope for the best?

We are doing everything we can to identify and arrest the target.

You just don't get it.

People I care about will be hurt.

I found something-- take a look at this.

Rachel Carrington helps this sick woman to the bathroom.

And that's when our juice jackers swoop in.

The sick woman was a distraction to get Rachel away from the charging bar.

Exactly.

Our juice jackers have about a minute to install their black box before our sick lady returns.

Miraculously, she doesn't look so sick anymore.

Wait, stop.

Rewind that.

Do you have a camera angle from the direction they're heading?

No, there's a blind spot between gates 213 and 214.

That's where the bathrooms are, isn't it?

Yeah.

And where the airport police reported finding blood.

So these three people were working together.

The sick woman k*lled Rachel Carrington.

Yeah, but the problem is-- how do we identify them?

Look at that.

This footage, it's way too grainy.

That's a dead end.

Well, maybe not.

The black box that they installed had to get through security, right?

Take a snapshot of that duffel.

Ryan: To get that juice-jacking device in the terminal, somebody had to get it through security.

Most people don't know that TSA keeps all X ray photos for a week.

We can run our duffel's snapshot against all the images in the TSA archives.

And based on the size, shape and material of the device, we should be able to figure out when this came through.

Ryan: Check all the bags that went through security two hours before the jackers were spotted on surveillance.

Krumitz: Okay, we got it.

Mundo: All right, hold on.

Even if we can get a visual on who came in with it, chances are pretty good they used a fake I.D.

Ryan: Well, that doesn't mean we can't find them.

You can learn a lot about somebody by examining the contents of their bag.

Krumitz, remove everything that's blue.

It's metal like our juice-jacking device.

Now, separate the materials by colors.

We're looking for anything plastic or biological.

Take away the biomaterials in orange.

Focus on the plastics in green.

Right there.

Do you see that wizard hat?

That's the Warlocks.

Mundo: The hacker collective.

Krumitz: Yeah.

Yeah, their symbol's a wizard hat.

That's their badge.

It's like an all-access pass for proving their g*ng affiliation.

That's Lomis' crew, our juice jackers.

Krumitz, search all bags before and after this image for the same shape.

There. There's two more badges.

Krumitz: That proves that the two juice jackers and the sick woman are all involved.

All right, that's great, but how do we find them?

Hacker collectives hide (phone rings) themselves all around the world.

I mean, they could be anywhere.

My boy Nelson coming through.

He just came up with a traceable hit on the credit cards.

All right, looks like most of the purchases were made at brick and mortar spots, like high-end department stores and electronic retailers.

You got computers, laptops, handbags.

Goods that can easily be sold for quick cash.

Yeah, except that Nelson just found an odd online purchase.

Ryan: No, that's a server blade.

That is not something you can buy at your local electronics store.

But I'm willing to bet that's something a hacker collective is gonna want.

Mundo: Big online purchase with a stolen credit card?

Easily traceable?

That's a little sloppy for Lomis, don't you think?

No, but we stopped his payday.

He's scrambling, I mean, that's when you make mistakes.

His mistake is our gain.

The clock is ticking-- we've got 14 hours left.

That purchase is gonna be linked to an address-- find it.

FBI!

FBI!

Hands in the air! Hands in the air!

(indistinct shouting)

On the ground now!

Get down! On the ground now!

Get on the floor!

Heads down!

(indistinct shouting)

He went out the back door.

FBI, freeze!

Crap!

(both grunting)

I really thought Lomis would be here.

We found traces of blood underneath your fingernail.

DNA matched Rachel Carrington.

You k*lled her.

No.

No, it was an accident.

I was just supposed to distract her.

Carrington: Glad you're feeling better.

I really have to be heading back, though.

Uh, wait.

Wh... What are you...?

Mundo: Once you realized she was dead, you went back to your partners.

She was still breathing when we left her.

I thought for sure someone would find her immediately.

You made it look like she was sleeping so you could buy enough time to escape the crime scene.

No, I wanted to tell someone.

First man: But they wouldn't let me.

They were scared of what he would do to us.

Of what who would do to you?

Lomis? You said you'd never met him?

Second man: Online, man.

Where reputations matter.

He could destroy us.

He could ruin our cred.

You know what I can do?

Put you in jail for the next 25 years.

Who's collecting the phone-ransom money?

I didn't know about the phones being ransomed, I swear.

He hired us to install the box and clone the cards and buy the goods, that's it.

Oh, come on, there was a server blade.

What do you think that was for?

That server blade?

We didn't buy it.

Lomis did.

He sent it to us.

He set us up to take the fall.

You expect me to believe that?

He didn't even show up...

To collect his share of the take.

Who passes up on that much money?

I don't believe them.

They know where Lomis is, they have to.

No, they don't, Krumitz.

They've never met him.

Which is why your white whale never gets caught.

(laughs)

What is that?

Lomis is taunting me.

He knew I'd find the juice-jacking device, and he overrode the data with “Gotcha!” a bajillion times.

All right, well, if he overwrote the data, there's no way to retrieve what was there before.

Hence “Gotcha!”

Those the shredded phones?

Get on the floor!

Krumitz: Yep.

I figured they tried to destroy 'em because there's something on them they don't want me to find.

I'm recovering all of the salvageable pieces.

Anything?

No. Not yet.

Okay. I got your time stamp.

Come on.

Come on, come on, come on, come on.

Yes!

Did you just get his serial number?

Yep.

I got you now, Lomis.

I'm gonna track this serial number right down to your evil lair.

(trilling, beeping)

You got to be kidding me. It's untraceable.

Damn it!

When was the last time you slept?

Listen, man, I know it's hard, all right?

I do. Believe me. All right, I ever tell you about the... the sleeper cell I tracked in Kandahar?

117 degrees.

Dry heat.

It was the kind that-that chaps the inside of your mouth.

All right, between the four of us, we had half a canteen of water left.

We had been there for three days because I was obsessed.

I knew if I stayed on 'em, if I persevered, I'd find 'em.

I was wrong.

So you just quit?

You gave up?

No.

There's a big difference between quitting and just knowing when it's not your day.

We need you in CTOC.

When you're ready.

Did you catch them?

What do you think?

I had to wait a month, but... believe me, it was worth it.

Sifter: Okay, we only have two hours before our victims' private data is released on the Web.

How close are we to... anything?

The code's sophisticated.

We're getting there, but it's gonna take time.

Against orders, some people paid the ransom already.

Hey, guys, we got a problem.

What is it?

Lomis isn't waiting for the deadline.

He's releasing people's information right now.

And he started with the most powerful person first.

I thought the senator already paid.

Yeah, I thought she did, too.

Well, this will be the headline on every national newscast.

Got another one.

Ryan: Chelsea's photos were released to a revenge p*rn site.

Lomis isn't playing by the rules, which makes him very dangerous.

Krumitz: Guys! Guys!

I did it.

I finally found Lomis. I got an I.D.

How'd you find him?

Just like you said-- go back to the evidence.

So I took another look at the juice-jacking box.

Lomis made it impossible to recover any data off that thing.

You're right.

Except for one thing: time.

I know what time Lomis overwrote the data.

It was four hours before we even found the box at the airport.

That's around the time the first flights were taking off.

He had to plug directly into the charging station to steal everyone's data.

Lomis was there, in person.

Yeah-- I pulled the airport security footage four hours before we arrived.

(computer beeping)

Say hello to Lomis.

Okay, your point?

I mean, this doesn't prove anything.

Yeah, well, it's about to prove everything.

I don't even know what you're showing me.

Krumitz: Mr. Hart, we know the truth.

Hart: I'm telling you, you've got it wrong.

Ryan: We have evidence...

No!

I mean, Willa is a straight-A student.

She plays soccer, dance lessons, violin...

Krumitz: Yeah... and she also took first place in the Miami-Dade County high school chess tournament.

We get it-- she's a genius and you're a proud father.

This is insane.

All right, Willa's not a hacker.

And she's a good kid.

Maybe she is.

But maybe she's not.

I have a warrant for her tablet.

If it's clean, she's innocent.

And exactly the daughter you believe her to be.

Why would she do this?

(door opens)

Dad, whose car is that in the driveway?

Krumitz: Belongs to the Federal Bureau of Investigation.

Hello, Lomis.

It's nice to meet you.

I've been waiting a long time for this.

Gotcha.

Everything about you is unexpected.

We bought your disguise.

We actually thought you were a 35-year-old man from Eastern Europe.

Very clever.

You went through all the trouble of stealing credit card information and never collected your take.

You were the mastermind behind the whole plan.

Stole all those credit card numbers but never met up with your accomplices to get paid.

Ryan: But, then again, you couldn't.

A 16-year-old girl couldn't show up at a hacker's house to collect.

You would've blown your cover.

So then you ransomed all the phones, and we thought you were gonna get paid that way.

But then you began releasing the ransomed data anyway.

Senator Finnis tried to pay you.

But, to our surprise, you denied payment.

Because it wasn't about the money.

I have to know.

What was this about? Why did you do it?

Did you even think about the consequences?

Senator Finnis, Michael Young, Victoria Fields, Simone Taylor-- you ruined their lives today.

Look, this isn't a joke, Willa. Tell us why.

Why did you do it?

Because I wanted to.

I was bored. I did it because I could.

Vickner: You saw this, right?

Sifter: Oh, yeah.

It's a shame.

The senator's husband and children learning her sexual preference from the front page of a paper, it's...

Yeah, well, privacy is a myth.

Personal info is the new commodity.

I, uh... I understand three other people had their information released.

Well, Lomis had access to 300 phones and whatever was on them.

We got her.

I mean, we confiscated all of her devices.

She had plenty of time to make copies and distribute them to anyone.

And what they do with it... only time will tell.

What's this?

That's me keeping you in the loop.

I-I still can't believe that she's just a teenager.

So, Colin...

Yeah.

Can I be honest with you?

I was a little pissed off I didn't get that promotion.

I was.

I just felt I was the best man for the job.

So did I.

I mean-- think that I was the best man for the job.

Look, I'll-I'll admit it-- there's not a whole lot that I know about what you and your people do.

That's not an enviable position.

You're not gonna try and hug me now, are you?

No. In fact, my job practically guarantees I am gonna be a constant pain in your ass.

But listen, I'm the least of your worries.

Tomorrow's criminal.

That is who you're gonna lose sleep over.

Good night.

Good night.

What's that?

Postcard.

From Lomis?

Sent the moment the prosecutor released her from custody.

It's not fair.

She gets to walk because she happens to be 16, but she is a criminal.

But she's a cyber criminal.

And we both know that sentencing guidelines make it very difficult to prosecute if they're under 21.

It's like we're encouraging kids to become black hats.

Well, maybe one day that law will change.

But today... you need to be very grateful that we couldn't prosecute.

Now, did you intend to break the law or was that accidental?

'Cause I really want to believe you had no idea that what you were doing was illegal.

I know you paid off the ransomed phone via text.

And with that payment you bundled a Remote Access Trojan.

That's illegal.

You took control of Lomis' desktop computer and you snapped a picture.

Krumitz: Guys. Guys.

I did it.

I finally found Lomis. I got an I.D.

How'd you know?

You told me.

Krumitz: And she also took first place in the Miami-Dade County high school chess tournament. We get it-- she's a genius and you're a proud father.

You couldn't know she was a chess champion unless you were in her bedroom, and I knew that you weren't. So I accessed your Bureau files and I found that photo.

Without my authorization and a judge's subpoena, you broke the law when you took that photo.

It was a digital search without a warrant.

I couldn't let Lomis win again.

And I know this sounds insane, but I...

I needed to justify your decision to hire me.

Your belief in me.

I started at the FBI pushing a mail cart.

And I would've been there forever, but you found me.

I hadn't been in CTOC ten minutes before I realized how dedicated you were.

And watching you love your job made me love my job.

And made me never want to let you down.

I didn't know what else to do.

That is no excuse.

What if Lomis was a 35-year-old man?

I know. He would have walked.

And I would've been forced to turn you in.

Today's your lucky day.

Your mistake is not sending you to prison.

It's dying here with me.

But I want you to think about something.

Does victory really taste so sweet when you haven't earned it honestly?