01x12 - Bit By Bit

[bunniefuu]

My name is Avery Ryan. I was a victim of cyber crime. Like you, I posted on social media, checked my bank account balance online, even kept the confidential files of my psychological practice on my computer. Then I was hacked, and as a result, one of my patients was m*rder*d. My investigation into her death led me to the FBI, where I joined a team of cyber experts to wage a w*r against a new breed of criminal hiding on the Deep Web... infiltrating our daily lives in ways we never imagined... faceless... nameless... lurking inside our devices, just a keystroke away.

(panting)

Danny...

Ryan: It's all right. It's...

Come... come join me and your brother.

Reporter: Good evening, Detroit.

This is your eye in the sky.

It appears a portion of the downtown area is experiencing a power outage.

Reporter 2: Traffic in the area is at an absolute standstill.

Reporter 3: Police are on the scene to manage any outbreaks of v*olence or looting.

However, thus far only a handful of minor incidents have been reported.

I've got 25 blocks of downtown Detroit in the dark.

Backup systems are completely unresponsive.

You guys sure this is a case for the FBI?

We're FBI Cyber, this is exactly our kind of case.

From what we can tell, you're experiencing a cyber intrusion.

Your power grid's been hacked.

Reporter: We just got an update from Detroit River Electric, and they're still working on the power outage in the downtown area.

Uh...

The smart grid allows for complete control of the city's entire power supply from this room.

Right now, someone else is in control.

Ramirez: SCADA systems like this should be impenetrable.

But someone remotely hacked in, then locked out every computer here by erasing the startup disk.

Even if you two successfully recover the disk and reboot the system you'll still have to counter-hack the target to get the power back on.

Yeah, we're halfway there already.

Ramirez: The odd thing about all this is the blackout affects only 25 blocks.

When I hacked the New Hampshire grid, I took out the whole state.

Oh, so we bragging now?

Ryan: No, no.

Raven's asking the right question.

Why limit this power outage to such a focused area?

A hacker's objective is usually to affect as many people as possible.

This was a precision att*ck.

There will be another phase to this outage.

He's using the SCADA att*ck as camouflage.

The faster we get those lights on, the sooner we will uncover what our target's true intentions are.

Nelson: Really?

The whole state of New Hampshire, huh?

(laughs)

I wanted a three-day weekend.

(chuckles)

Hey, by the way...

Yo.

...happy two-month anniversary.

We dating?

No, stupid.

Two months at the Cyber Crime Division.

You're officially in the family.

Don't mess up.

I want you to stick around.

Got a live feed to the Emergency Operation Bureau's incident map.

The blackout is affecting the central hub of the city, both the government and the financial districts.

Our target could be looking to hit the federal building, district court, city jail, baseball stadium, three banks or countless privately owned businesses.

Power outage is a great way to disable security alarms.

There are several incidents of traffic gridlock.

Whatever our hacker's doing, he's gonna want to make a getaway.

So let's focus on the buildings on the fringe of the blacked out area of the city.

Locations still in the dark but where the target won't get caught in the traffic jam caused by the blackout while trying to flee.

And let's rule out any area that borders the rail line.

It's a bad idea to cross the tracks and risk getting trapped behind a closed train crossing.

Hey, guys, we're back online!

We're back in control, but the lights still aren't on.

Yeah, that's gonna take a minute.

Our hacker's still active in the system.

Raven's writing a patch to seal the intrusion.

Wait a minute.

If he's still active in the system, that means he needs to maintain a live connection to the power station for some reason.

Nelson, can you inject malicious code into Raven's patch?

Infiltrate his laptop before you boot him off.

Tag him so we can track him.

Ryan: If he uses that computer again, we'll know where he is.

We may get a location and possibly his identity.

I want that power on and that hacker in handcuffs.

You got it boss, I'm on it.

(lock clunks)

Man: Yeah, Pa, power's still out.

I'm just gonna check out the store.

(door clunks)

Man: Hey!

Who the hell are you?!

(grunts)

(body thuds to floor)

(alarm ringing)

Police responded to the security alarm, found the store owner's son, Benjamin Christos, sh*t dead.

Single father, two children.

Was he here when the power went out, Detective Dorn?

Dorn: Store wasn't open today.

We figured he came to protect the property against possible looters-- interrupted the robbery.

It's an auto safe dialer.

It cycles through every possible combination till it lands on the right one.

All the thief needed was time.

Explains why the computer maintained a live connection to the power grid.

Had to ensure that the lights and the alarm systems stayed off.

Looks like the power outage was masking a jewelry store robbery.

Well, what did they take?

Dorn: From what we can tell, the thief left empty-handed.

We do know most of the jewelry's on consignment.

The Christos don't own it.

That computer...

It was in the vault when first responders arrived.

Why lock a computer in a vault?

Well, there's one way to find out.

Ryan: Somebody went to all this trouble-- they even k*lled a man-- to leave with absolutely nothing?

I'm not buying it.

All right.

No modem installed, no way to connect to the Internet.

There's only one thing on it.

A bitcoin account with a zero balance.

This wasn't a jewel heist.

This was a bitcoin heist.

Woman: Ben came down to check on the store.

The blackout...

I should've come with him.

But he talked me out of it.

There was a computer in the vault.

It's the bitcoin computer.

Benjamin's idea.

I really don't understand it.

But he was so passionate.

He said bitcoin was the currency of the future.

Ben was taking over the family business and I promised I would trust his judgment.

But now... my son was k*lled over... over this... this imaginary currency?

(Tabitha sobs)

Do you know how many bitcoins you had?

Almost half a million dollars' worth.

Most of our retirement.

Mundo: In order to access and steal your bitcoin, the thief would have needed the passkey to your account.

And it was stored on the computer in the vault.

Who else knew it was there?

Ellis, no.

He wouldn't.

Stephen.

Our oldest son.

He was supposed to take over the business, but...

Ben had so much more ambition.

Drive.

I-I begged them both to run it together, but the boys didn't see eye to eye.

Ryan: Thank you both.

We'll be in touch.

Bad blood between brothers.

Half a million dollars at stake.

And Stephen would have known that taking the bitcoin over of the jewelry was hassle-free.

Transfer it from one account to another, it's... well, almost untraceable.

No serial numbers.

Nothing to fence.

Sounds like we have to have a little chat with Stephen Christos.

When the power came back on, so did the jewelry store's security camera.

Is this Stephen?

No.

I have never seen that man before in my life.

Is this the man who m*rder*d our son?

Took our grandchildren's father from them?

Now we have a face.

We just need a name.

So, no luck identifying our bitcoin thief, huh?

No, sir.

Ran the facial recognition.

Big dead end.

Guy's not in the FBI database.

But the bitcoins have provided an interesting lead.

The biggest misconception about bitcoins is that it's anonymous.

I mean, that's why it's the preferred currency of the Deep Web.

It's used to fund drug deals, hit men, human trafficking, but it's not actually that anonymous.

Is this a bitcoin lecture or did you make an actually discovery here?

Oh, right. Sorry.

I accessed the block chain, which is a public ledger that records every bitcoin spent.

Every cent's accounted for-- where it came from and where it went.

And each transaction is listed as a long sequence of randomized numbers.

Ah.

So you can't tie it to a person, but you can tie it to an account, right?

So, it's like a stock market transaction.

I mean, you can see somebody bought 200 shares of a commodity.

You just don't know who.

Exactly!

But if you know the amount that you're looking for, you can find any bitcoin transaction that's ever been made.

Even when it's stolen, there is a record of the bitcoin movement.

All you need is the amount, date and time.

So, this is last night's robbery.

What we're looking at is our thief's bitcoin account.

1,208 bitcoins.

As of today, worth just shy of 500,000 U.S. dollars.

Now, of course, the bitcoin market fluctuates so dramatically that this many bitcoins could very be easily be worth over a million dollars in the very near future.

Explains why someone went to such lengths to steal it.

Mm-hmm.

So, what digital dust can we follow here to catch our thief?

Well, every bitcoin account is protected by a 64-character passkey.

And if you have the passkey, you can unlock the account.

And whoever has the passkey to this account is probably our k*ller.

Well, that's odd.

Our thief's bitcoin account is protected by two passkeys.

Typically, it's just the one.

Yeah, it's like a safe deposit box.

It requires two keys to open it.

Which might just imply our bitcoin thief has an accomplice.

Hey, guys!

The malicious track worked.

I pinpointed the exact location of the bitcoin thief's computer.

This is Agent Elijah Mundo.

I need a SWAT team at 5280 Clinton Place.

(tires screech)

Man: Clear!

Mundo: Well, there's our thief.

(alarm ringing)

Ryan: Looks like we're not the only ones interested in stolen bitcoins.

♪ CSI Cyber 1x12 ♪
Bit by Bit
Original Air Date on May 13, 2015

♪ I know you've deceived me, now here's a surprise ♪
♪ I know that you have, 'cause there's magic in my eyes ♪
♪ I can see for miles and miles ♪
♪ I can see for miles and miles ♪
♪ I can see for miles and miles ♪
♪ And miles... ♪
♪ Oh, yeah. ♪

All right. Thanks, bud.

All right.

Krumitz ran the name we got off the victim's I.D.

We are looking at the infamous Brian Kramer.

Apparently he made a living robbing large bitcoin accounts he found on the block chain.

This was his fifth.

Tracked charitable contributions from bitcoin accounts to find his targets.

Laceration of the throat looks like COD.

He bled out, but over here, it looks like our victim was sliced open.

And patched up multiple times.

He was tortured.

Closed the wounds with Super Glue.

b*ttlefield first aid.

It's commonly used by people with m*llitary training.

t*rture the victim and patch him up.

Keep him live long enough to talk.

Detroit PD is still trying to locate Stephen Christos.

Hasn't answered calls from his family.

We can't wait this out. Track his cell phone.

Get a GPS location on him.

Okay, got it.

Hard drive's been removed.

Whoever did that to him was definitely after the stolen bitcoins.

If they had the hard drive, why t*rture him?

'Cause the passkey wasn't on the hard drive.

Door was barricaded by the dresser.

Bought our victim a little time.

Long enough for our thief to take the passkey out of the computer.

Bad guy breaks through the door.

Tries to access the bitcoin account, he can't.

Tortures the thief for the passkey.

Sounds good.

Unfortunately, it's all speculation.

The answers d*ed with his laptop.

Not necessarily.

Took the hard drive, but not the RAM chip.

Still might be a way to get some answers.

RAM keeps track of the programs your computer's running while it's on.

The moment the computer loses power...

the RAM starts to forget.

Information decays.

Freezing it...

...stops the process.

(laughs)

Mundo: Most people don't go to a bar after they find out their brother's been m*rder*d and their family robbed.

I needed a drink, okay?

I would imagine so.

What are you implying?

Why don't you tell us about these e-mails, Stephen?

We accessed your phone.

You got a call at 6:17 from your mother.

She told you about the break-in and that your brother had been m*rder*d.

Even though your brother was dead, all you cared about was the money.

Mundo: 'Cause the next thing you did was check the balance of the store's bitcoin account.

You found it at zero.

I knew those damn bitcoins were a bad idea.

Unregulated, uninsurable, I... tried to warn my parents and my brother-- I said bitcoins are too risky.

If they get stolen, they're gone.

You can't get them back.

But you tried to get them back.

Four hours ago... you contacted bounty hunters by e-mail and negotiated a price to recover the stolen bitcoins.

Did you really think bitcoin bounty hunters were the answer to all your problems?

You'll get the money back, then... you can take over.

My parents had just lost a son!

And now they were staring at poverty.

Did they tell you they used their retirement to keep the business afloat?

That my brother's bright idea was to convert to bitcoin?! No.

I'd imagine they didn't.

After all the years of hard work, all they gave up, the only thing I could think to do was get the money back.

For them.

Not me.

Look at that.

You see that?

That's the work of the men you hired.

Do they look like the kind of men who give back money?

We need information.

All I have is a Web site.

And I had an e-mail address.

That's it.

They said they would contact me.

These are incredibly dangerous men, Stephen.

They lurk in the Deep Web.

In a world you can't even begin to imagine.

They've already k*lled one man.

You have started something you can't undo.

Krumitz: Bounty hunters' Web site and e-mail address are a wild goose chase.

Well, that's no surprise.

These bounty hunters specialize in bitcoin retrieval.

They think of themselves as elites.

They're skilled, educated, tech-savvy.

So we can't bet on them making any mistakes.

It gets worse. Our bitcoin thief was no bozo, either.

We got the results from the degraded images we recovered from the thief's computer RAM.

This is a botnet-- a massive group of maliciously infected personal computers-- or bots-- from all around the country harnessed together.

Basically, it's a network of computers used for evil.

But the people who own the computers have no idea that they're part of an evil empire.

After the computers are infected, the hacker has full control over every single computer on the network.

That's roughly...

20,000?

Unsavory characters, like our dead thief, rent out their botnets to send spam e-mails, perform DDoS att*cks, mass identity theft.

You know, all that good illegal stuff.

Ryan: Can you tell if our thief connected to the botnet before the bounty hunters broke down that motel room door?

What?

What?

What is it, Krumitz?

He sent two separate messages to two separate computers somewhere in the botnet.

Ryan: It must've been the passkeys.

Like a bank robber hiding his stash until the heat dies down and he can recover it and get away.

Are you saying two random computers-- two in 20,000-- are secretly storing the passkeys.

And the owners don't know it.

That's not the bad part.

The RAM got us to the botnet.

But it was far too degraded to tell me which of these two people have them.

But the bounty hunters have the thief's hard drive.

And that means they know which two people have the passkeys.

They have the digital treasure map.

So, two innocent people have no idea what's coming to them.

And we have no way of warning them.

Hey, what are you doing in my house?!

(grunting)

Hey!

(groans)

You get what we came for?

Yeah, I got the passkey.

One more passkey and we're a half mil richer.

(phone rings)

You got Krumitz.

Hold on, Krummy, let me transfer you to CTOC.

Man: This came for you, Nelson.

What's this?

Don't know.

A judge won't typically hand out a warrant on the evidence we have.

The RAM was too degraded.

But I pleaded my case and got us into the server farm housing the botnet's command and control server.

I got Krumitz on the big screen.

So, tell me we have names.

Performing a live acquisition now.

We are seconds away from having the same information the bounty hunters do.

The server has a record of every interaction the thieves made with the botnet.

If we don't catch our targets before they get those passkeys, the Christos' savings will be gone forever.

Every cent they have.

Every minute counts, and we're behind already.

Something's wrong here.

Uh, hold on.

What is it, Daniel?

(groans)

Nelson: He's been disconnected.

I need a win off that server, Krumitz.

The drive's completely corrupted.

From the look of it, someone did this deliberately.

The bounty hunters are covering their tracks. Damn it.

Deleted is recoverable, but the drive is being overwritten; everything is gone.

Ramirez: I've been monitoring Stephen Christos' e-mail activity.

Bounty hunters just sent a new message.

Due to unforeseen complications, they're upping their price.

Unforeseen complications.

That what they're calling m*rder these days?

Ramirez: They made a mistake.

The computer they sent this e-mail from had a parental control program designed to go unnoticed.

Bounty hunters would have no way of knowing it was there.

Parental controls are installed so parents can monitor their children on the Internet.

It tags everything coming in and going out.

Simon, if there's parental controls, it means there's children there.

Yeah, I hear you.

Yes! Parental controls came through.

Just got a physical address on the bounty hunters.

Okay, I'll notify the local authorities to move on the location cautiously.

Meanwhile, let's get you on a plane.

(indistinct radio transmission)

Man: Normally I don't get home from work this early.

I'm just glad my son wasn't home.

Edward Gaines, found in a bathtub bound and gagged.

He suffered a laceration and a concussion.

If the blow to the head hadn't knocked him out, a b*llet would've been next.

Raven's pulling traffic cam footage looking for faces based on Edward's description.

Did our targets get what they came for?

Yep.

The e-mail that Stephen Christos got was sent from this computer.

The bounty hunters now have the first passkey.

Well, they're halfway to their goal, and we're stuck at the starting line.

(sighs) So what's our play?

Do you remember how I fought so hard to bring in Tobin?

Yeah, the cyber division needed someone who could work the cases like a hacker, work the cases from the inside.

We're gonna use that same tactic.

We're gonna work this case from the inside.

(chuckles)

Mom and Pop.

The mystery box?

Yeah, uh, (chuckles) they gave me all my devices back.

From your arrest?

Yep.

Look at you, probie no more.

(chuckles)

God, it took me six months to get off my probation.

Hmm.

Who do you know?

Yeah, you know...

We need to get inside that botnet.

Avery, the system is fried.

Yes, but the botnet still exists.

So you're thinking we should join the botnet?

Ramirez: Well, we can take the botnet's malicious code off Mr. Gaines' laptop and infect one of ours and we're in.

Then we'll know what the bounty hunters know, and we'll have a chance to get one step ahead.

First time I ever wanted a computer virus.

Ramirez: I know what you mean.

Krumitz: Let's see what we got.

All right, we're in.

Okay, now that you're connected to the botnet, you should be able to break in and send it commands.

(chuckles) What?

You don't think I pay attention when you guys geek out with code speak?

Krumitz: I never thought that.

All right, Avery. Ping this entire network.

We are looking for the two computers that have those passkeys.

Krumitz: Okay, the D.C. I.P. address is Mr. Gaines' laptop right here on this desk.

The bounty hunters already took the passkey off that one, but the other one...

Ramirez: Albuquerque, New Mexico.

Mm-hmm.

Hey.

All right.

Whoa, too slow.

Krumitz: Yeah.

(laughter)

Hang on.

Nelson, this is a win; this is when we celebrate and high-five our bosses.

No, no, check out that I.P. address.

It's not static; it's dynamic.

Every time a computer with a dynamic I.P. turns on, it gets assigned a new I.P. address randomly from its Internet service provider, but when it turns off, the I.P. address will be randomly reassigned to a different device.

The bounty hunters are still using the I.P. address they recovered from that hard drive.

There you go.

The second passkey's in Albuquerque, but the bounty hunters don't know that.

They're going to the wrong location.

Okay, I'll contact the service provider, figure out the I.P. address our bounty hunters are chasing, find out where they're headed.

Work quickly.

They retrieved that first passkey.

They still brutally b*at Edward Gaines.

If they come up empty at this next location, who knows what they'll do.

Krumitz has plotted the bounty hunters' final destination.

Denver, Colorado.

So there's gonna be a plane waiting for you and your team on the tarmac.

Hey, just got back the results on the footage from the traffic cameras near Edward Gaines' house, and I have security footage from around the motel in Detroit where we found our bitcoin thief.

Cross-referenced every face we found, looking for anyone in both cities in the past 24 hours.

I.D.'d two men traveling together.

Jeremy and Henry Spitz, brothers, ex-m*llitary, both dishonorably discharged, a long history of violent behavior resulting in arrests.

They fit the profile of our bounty hunters.

We need to expect unpredictable expl*sive behavior.

All right. Put out a BOLO on the pair and inform the TSA. If they're grounded, they're gonna be forced to drive to Denver.

That's gonna buy us some time.

I'll take Raven to Albuquerque, and you're gonna need to find that final bitcoin passkey.

Let's set this trap.

Hello, I'm Special Agent Avery Ryan.

I'm running this operation.

Is everybody out of the house?

Yes, our son's staying the night at a friend's.

Hopefully this will all be over by morning.

Nelson: This comes to an end here!

(grunting)

This is our Appomattox.

Appomattox, really?

You're really gonna compare this to the battle that ended the Civil w*r?

(grunting) Yeah, why not?

You have any idea how many men d*ed in that battle?

Appomattox.

Step up your game, man.

A dynamic what?

It's your I.P. address.

If this is just about my computer, I don't see why I have to leave my home.

Again, ma'am, this is an ongoing investigation.

I have told you as much as I can.

Now I would like to move you into protective custody till we resolve all this.

What's she doing on my computer anyway?

Removing something worth k*lling for.

Got the passkey.

Sending it to the boys now.

Well, that smile must mean we're on schedule.

Just got the final passkey from Raven.

Krumitz is finishing up inside.

We're good to go.

I know we're right in the middle of something, but, uh, I just wanted to say thanks for getting me off probation.

And giving me all my devices back.

They mean a lot to me.

Got my tablet back today.

You know, I had all my photos in there and my family stuff.

It was good to see my parents again.

I haven't seen them since the trial.

It's complicated.

Well, Sifter and I spoke to the judge.

She agreed to lift your probation.

Wow, that's-that's crazy.

I didn't, I didn't even know he liked me.

(chuckling): No, he-he doesn't.

We all set?

Oh, yeah. We embedded a decoy passkey on the computer in the home, one infected with our own malicious code.

So when the bounty hunters try to use that passkey, it'll infect their computer and we'll have complete control over it.

Well, they're reckless and greedy.

They'll want immediate gratification.

We won't have to wait long.

All right, but when they plug in, we'll be able to steal the first passkey back.

Not just steal it.

We have to prove it was on their computer.

That passkey is the only thing that links those men to the m*rder and the home invasion.

It's what's gonna give us a conviction.

Don't worry. We'll be screen- capturing the entire session.

(Nelson groans)

We lost the connection to the Schaeffers' computer.

He'll get it back online.

(groans)

Krumitz, what the hell are you doing?

Ryan: Krumitz left his radio.

We're having technical issues.

Avery, we just got word.

SWAT's reporting a suspicious looking SUV that just entered the neighborhood.

How long?

Two minutes at most.

Bring up the home security cameras.

I need eyes on the perimeter.

We got it.

(groans)

Nelson: We got a problem, Elijah.

Danny, it's okay.

Just come stand by me and your brother.

We'll do anything you ask.

Please, just don't... don't hurt my family.

Just take what you want.

No one's stopping you; we're the only ones here.

Check the back, make sure we're alone.

(whispering): How'd he get here?

(whispering): He came for a video game for his sleepover.

Where's my mom and dad?

It's okay, Jeffrey.

Just do what I tell you.

Jeremy: All clear.

You.

Me?

You got a computer in here somewhere-- take me to it.

Danny, do what the man tells you to do.

Listen to your mother.

She'll get you out of this alive.

It's, uh, it's upstairs.

Move.

Have your men hold.

I got two FBI agents and an innocent in there.

We storm the house at the wrong time, somebody will get k*lled.

How the hell did that kid get in there?

Avery just spotted him coming in the back door through the security camera.

I need more men in the back-- there's a hole in that fence.

Fill it now.

How we doing on your end?

Trap's set-- those guys take the bait, we'll have them dead to rights.

Jail for life, and some.

Um, we've got a volatile situation in there, Nelson.

We can't wait long.

Henry: Sit.

Okay, you got it, but do you mind lowering your g*n?

Open the system's folder.

Just give me a minute-- I-I'm not good with computers.

Uh, here, here?

Open it.

Now utilities.

Here?

You see two, you moron?

Nelson: This is not good, man, we're in trouble.

Look, this guy's gonna go ahead and miss the decoy file.

He has Krumitz looking in the wrong place.

Nelson, these guys have short tempers.

Failure is not an option.

Okay, look, uh...

I have an idea.

Open that folder there, “Installers”"

(groans)

(keyboard clacking)

Uh...

You clicked the wrong folder, you idiot.

(sighs) Yes.

No, I didn't. No, I didn't.

Wait, wait, wait, wait, is that it?

Is that it? Is that it?

Henry: That's it.

Good.

Load it on this.

These men'll be leaving soon, honey.

This will all be over, I promise.

I said no talking.

Of course.

I apologize.

My son needs to go to the restroom.

Yeah, well... he can hold it.

And shut up.

Get over there.

It's about time, man-- did you get it?

I got it, calm down.

Jeremy: This is taking too long, bro.

We got to get out of here.

Wait a second.

It's payday.

I'm in.

I'm gonna go ahead and deactivate these fools' Internet. It's gonna buy me some time to find a passkey before they discover we slipped them a decoy.

Things are getting tense in there, Nelson, we can't wait long.

I'm trying-- I know, I know.

What the hell is taking so long?

Damn signal.

What?

Wi-Fi isn't working-- give me a sec.

Running a diagnostic.

Now what?

We got an intrusion.

Son of a...

(Jeffrey whimpers)

Shut that kid up and start talking.

We're running out of time, Nelson.

I know, I know.

Look, just-just wait, okay?

Can't wait any longer.

Jeremy: I knew it.

There's no way these two are family.

Look at that picture.

That's the kid, all right.

But who the hell are these two?

Henry: Something ain't right here.

Talk.

Or die.

FBI!

Get down.

Down on the ground! FBI! Drop it now!

Your hands where I can see them!

Don't move!

Everybody okay?

You okay?

Yeah.

Clear!

He'll live.

Man: Entry clear!

Encrypted.

We'll never get in.

Did Nelson get the file?

I don't know-- couldn't wait.

Nelson.

Did you get the passkey?

Repeat-- did you get the passkey?

Oh, yeah, we got it.

Those fools are going down.

Okay.

Bitcoins are back in your account.

Though you should change your passkey.

I won't need to.

Getting out of the bitcoin business.

In fact, we're selling the store.

It's time.

Thank you.

(door closes)

Pop.

I'm sorry.

Ellis: Promise me you'll stay close to home.

Stephen: Always.

You ever get sleep?

You have any idea how much paperwork is required after you discharge a government-issued firearm?

You know, I heard you handled yourself pretty well.

Came face-to-face with an armed k*ller, heard you took him down, no hesitation.

Come on, man, you got some skills.

Standard FBI training.

(mocking): “Standard FBI training.”

No, n-n-no.

You?

You are the real deal, bro.

Well, I did what I had to do.

You know, a man with a g*n in your face, kid in the room, bad guy's got to go down.

Even if it was only a flesh wound.

I mean, really, it's just instinct at that point.

You know, training takes over, muscle memory kicks in.

And when that guy made a move on me, his g*n taking aim, bayonet inches from this face...

Whose bayonet?

...I could smell the gunpowder residue.

Appomattox, Nelson.

Appomattox.

Hey.

Yo.

All I knew was-- it was on.

Him or me.

And it wasn't gonna be me.

That's right, baby.

That's why you here.

(grunts)

Daniel Krumitz coming through.

Hey.

♪ Sweetly touching my emotions ♪
♪ I wanna stop ♪

(Nelson grunts)

♪ And thank you, baby ♪
♪ I just wanna stop ♪
♪ And thank you, baby ♪

(imitates music)

Ryan and Nelson: ♪ How sweet it is ♪
♪ To be loved by you... ♪

No, you didn't.

Yes, I did.

(chuckles)

You know, uh... it's my mother's favorite song.

Me and my pops used to sing it to her every year on her birthday.

Call your parents, Brody Nelson.

(sighs) Can't.

It's just not the same anymore.

I embarrassed them, went to jail.

Just not the son they thought they raised.

Call them anyway.

Why do I get the feeling that giving my stuff back is a part of one of your master plans that Elijah's always talking about?

I don't know.

(scoffs)

Ryan: ♪ How sweet it is to be loved by you. ♪

(dialing)

(line ringing)

Man: Hello.

Hey, Dad?

Hey, it's Brody.

Yeah, no, it-it's me, Pop, it's me.