Flash Squad

Flash Squad
Season	2
Number	17
Writer	Scotty McKnight
Director	Howard Deutch
Original Airdate	March 9, 2016
Navigation
Previous Episode: 5 Deadly Sins
Next Episode: Legacy

Flash Squad is the seventeenth episode in Season Two of CSI: Cyber.

Synopsis

Users of a traffic app are being rerouted to remote locations and robbed by masked women.

Plot

Supercookie - code that secretly tracks a person's Internet activity.

In Los Angeles, California, a young woman glams herself up, presumably for a night on the town. However, she soon gets into the backseat of a car and comes face-to-face with two women wearing darkened visors over their faces. The woman joins her friends and dons a similar visor. They're then seen holding a man at gunpoint. The man is shot; from the sound of things, this wasn't part of the plan.

With Nelson and Raven working from headquarters, the rest of the team heads to Los Angeles. A navigation app, Freelane, has been hacked and is guiding users to remote locations instead of their desired destinations. The company's I.T. department recently flagged a number of intrusions into the network, and the initial belief was that one of the employees was responsible. However, an inside job is ruled out when it's determined than an outside intrusion forced the algorithm that calculates the most efficient route to malfunction.

Police reports show that five users, all in L.A., were led to remote locations and robbed at gunpoint by three women wearing masks. A connection was found between the Freelane app and the robberies, which is why the Cyber team has been called in. Another intrusion has been detected, but there have been no reports of other robberies. The CEO of Freelane refuses to alert the users that they should avoid any unfamiliar routes. He explains that the benefit of Freelane is that it's crowdsourced navigation, with users providing real-time updates to other users regarding traffic accidents, lane closures, etc. User responses then help the algorithm narrow down the options for the fastest route.

The intrusions onto the network all trace back to the same IP address in Syria, an obvious dead end for the team. Soon, the most recent person to get rerouted is identified as a Joel Matthews; his cell phone stopped moving right in the middle of his route and has been there for hours. The team rushes to the scene and finds Joel lying on the ground with a female victim; Joel is dead, but the female is still alive. A mask from one of the robbers lays nearby.

Avery watches a video of the three masked women celebrating in their newfound wealth. The women call themselves the "Flash Squad," and social media has turned them into online celebrities with thousands of followers. According to police reports, the items the women are flaunting were reported stolen, confirming that they're responsible for the thefts. A sourcing of the video traces back to the same Syrian IP address that originated the Freelane hack, so the women appear to be hackers as well as thieves (and murderers).

There's no wallet or ID found for either Joel or the female victim; both were likely taken by the Flash Squad. Russell notes that while the robbery fits the Flash Squad's M.O., murder doesn't. Black paint transfer on the back of Joel's car indicates that it was rear-ended by a black SUV; this also fits the M.O.'s of the previous robberies. Elijah notices that the adjacent train crossing has had its gates down the entire time they've been at the scene; however, there's been no sign of any trains.

Raven finds that the hacker used malicious code to hack into the Freelane app on Joel's phone. From this, they gained access to the entire phone, including Joel's credit card accounts and GPS. The moment he accessed the app, the hackers had complete control over the device. It's determined that the Flash Squad is targeting Freelane users who make purchases at high-end stores. They then use the app to direct the users to a secluded spot and rob them. There's just one problem: Joel didn't have a lot of money in his bank accounts. His FriendAgenda page shows that he was actually picking up a donation for a charity auction at the children's hospital where he worked.

At the scene, Krumitz discovers that Joel's cell phone is actually communicating with the train crossing; as the phone approached the tracks, the gate dropped and trapped him. Evidence suggests that the signal box was tampered with, and a cellular antenna is found inside. Since the last two robberies took place at train crossings, the thought is that the Flash Squad rerouted their victims via the Freelane app and trapped them by manipulating the signals.

One of the Flash Squad trio is shown getting a call from another member of the group. The young woman is shocked to hear that the female victim is still alive and warns "Sophia" that she's an accomplice in all of this.

The female victim is identified as 20-year-old Riley Van Lowe. Avery figures that the Flash Squad won't post a video of their latest robbery because murder wasn't part of the plan. Krumitz shows Avery and Elijah that the cellular antenna recovered is actually two parts: a microcell and an industrial radio. When installed, a microcontroller allows the two devices to talk to each other. Unfortunately, there's no forensic trace on the parts.

Nelson finds that most rail lines have something called Positive Train Control that prevents possible accidents by putting train controls online; this would allow the Flash Squad to hack into the system and take control of the crossing gate. Raven examines a photo of the cellular antenna and can immediately see that the device was homemade. Since the targets clearly had no knowledge of how to put the antenna together, the assumption is that they perused the Internet for assistance.

Anyone who searched for the components of the antenna is likely the target. Krumitz accesses the search history for the entire population of Los Angeles. Combined with the searches on the antenna parts and train terminology, filters are applied to narrow down the list of potential suspects (sex, age range, searches for celebrity gossip, watches). One person is identified, and the IP address is traced to an apartment in the city. When the apartment is searched, it becomes evident that it belongs to Riley Van Lowe; she's a member of the Flash Squad.

Jewelry seen in one of the trio's earlier videos is identified. Krumitz finds evidence on Riley's laptop that that proves it was the device used to shoot the Flash Squad videos. Furthermore, a standard soldering kit is found, proving that she's the Flash Squad's hardware hacker. Avery reassesses what happened the night of Joel's murder and questions why Riley was shot, as well. Joel is ruled out as the shooter, as there was no gunshot residue on his hands, while Riley's wound was determined to not be self-inflicted. Nevertheless, something happened that caused Riley to get shot; however, she's still unconscious in the hospital. The fear is that since Riley knows the details of what happened at the train crossing, her partners could seek her out and try to silence her permanently.

Sophia meets up with the young woman seen at the beginning of the episode. Their fear is that Riley is going to wake up and rat them out. The still unnamed woman blames Sophia for bringing Riley into the group and believes that their only option is to run. She holds Sophia at gunpoint to guarantee compliance. Meanwhile, Riley's brother is in disbelief that she would engage in criminal behavior. However, Avery shows him the video of the women and points out the ring Riley was wearing; he confirms that it's a family heirloom. He doesn't recognize any of the other voices in the video.

Riley's social media and email accounts show no mentions of the Flash Squad or anything that might identify the other members of the crew. There's also no proof on Riley's hard drive that she was responsible for the Freelane hack. Raven soon discovers that Riley has a second email account that's she's logged into every day. Curiously, there are no emails in the inbox and no deleted emails are recovered; however, there's one item in the draft folder.

It's determined that the Flash Squad was communicating through the email account; they shared login credentials, then composed messages and saved them as drafts. Past drafts are recovered; however, there are no mentions of any names or addresses that could help identify the other two members of the crew. Avery believes they can predict a pattern of behavior and speculate on what the next move will be. From the language used in the emails, she also determines who the leader is (Alpha); the other two members are identified as Beta and Omega.

Avery identifies Riley as the Omega based on the subservient language she used in her personal emails. Furthermore, email evidence shows that she was struggling to pay her tuition. Since her brother mentioned that she had a hard time making friends, the thought is that Riley killed two birds with one stone when she joined the group. The Beta is believed to be the coder, as she rerouted the Freelane app from her car. It would seem that the Alpha is just getting rich off the other members' hacking skills and intimidates them into doing her bidding. Since Omegas show fear, it's likely they could become a liability; this would be why Riley was shot.

A flashback shows the women holding Joel at gunpoint in preparation for the robbery. When Riley walked past him, he ripped her mask off. The leader, identified as "Madison," immediately shot Joel and ordered Riley to finish the job and steal the watches. In a panic, Riley whipped her phone out and was going to call the police. Madison then shot Riley to keep her quiet.

Riley soon wakes up in the hospital and immediately asks for a lawyer. Krumitz determines that the Flash Squad used the same Syrian IP address for the Freelane hack, the videos, and the draft emails; in other words, they've left behind "digital dead ends." Avery realizes that the women want nothing more than to be famous and she vows to make that happen—this is how they're going to catch them.

Avery has a tabloid website post a fake video praising the Flash Squad. The assumption is that as soon as they see their names in the headline, they'll click the link. Upon doing so, a supercookie Krumitz embedded into the webpage will give the team the squad's real IP address. Thousands of people will visit the site; however, the supercookie will attach itself to a user's browser and spy on their web traffic. The hope is that the targets will be able to be identified based on the sites they visit after the link is clicked. While it's possible the women don't take the bait, Avery is sure that they won't be able to help themselves.

In their seedy motel room, Madison and Sophia discover that they're famous. Madison's joy is short-lived, however, as the video's announcer mentions scoring an exclusive interview with the group's "leader" after she's released from police custody. Despite knowing that Riley is awake, Madison is more concerned with her self-image in the public eye and incensed that someone else is thought to be the ringleader.

The embedded supercookie shows that after viewing the video, someone searched for the terms "Riley Van Lowe + leader." Since Riley's name was never released to the public, members of the Flash Squad would be the only ones with this information. The IP address leads the team to the motel; however, Madison and Sophia have just left.

Russell points out that the women are unaware that nobody knows their physical description. Since it's assumed Riley gave them up, it's possible every cop would have their photo; therefore, the women are likely to avoid law enforcement on their escape route. The team gets the idea to hack into the Freelane app themselves and report false police sightings; this will reroute the women into a trap. Sure enough, Madison and Sophia are soon cornered and arrested.

---

In a separate storyline, Nelson meets a man in a dark alley and pays him a lot of money for something that resembles a flash drive. He later tells Raven that he's found proof that the FBI obtained evidence unlawfully in his stock exchange hacking case. While he was never able to find the money that was stolen, he was alerted that a crucial piece of evidence the FBI used against him was outside the scope of a federal warrant. He plans to file a lawsuit against the FBI, but Raven warns him that Avery will defend the entire Cyber Division first before one of its employees.

After being informed of the lawsuit by Director Silver, Avery confronts Nelson. She warns him that going down this path will have serious consequences, including prison time if his plea deal is revoked. Director Silver interrupts the conversation and asks if Nelson if he's willing to drop the lawsuit. When Nelson answers in the negative, Director Silver surprisingly says that all charges against him will be dropped, making him a free man. Director Silver then tells Avery that he's terminating the "Hacker-for-Hire" program, which will put both Nelson and Raven out of jobs. Avery tries convincing him to change his mind, saying that hackers like Nelson are the only ones who can keep up with their enemies. However, Director Silver has already made up his mind.

Nelson gives Raven the good news, telling her that they're both free. However, Raven informs him that without the program, she's going to jail.

Cast

Main Cast

• Patricia Arquette as Avery Ryan
• James Van Der Beek as Elijah Mundo
• Charley Koontz as Daniel Krumitz
• Shad Moss as Brody Nelson
• Hayley Kiyoko as Raven Ramirez
• Ted Danson as D.B. Russell

Guest Cast

• Kelly Preston as Greer Latimore
• Shani Atias as Sophia
• Sean Blakemore as Director Silver
• Spencer Locke as Madison Brooks
• Gabriel Tigerman as Blake Jennings
• Allison Brown as Riley Van Lowe
• Edward Finlay as Joel Matthews
• Maurice Hall as Charity Board Member
• John Tague as Man
• Skyler Hart as Victor Van Lowe
• Barrett James as LAPD Officer

Music

• F**k Love by Iggy Azalea

See Also

• List of CSI: Cyber episodes
• CSI:Cyber Season 2
• Category:Images from Flash Squad