CMND Crash
Season 1
Number 2
Writer Pam Veasey,
Craig O'Neill
Director Jeff T. Thomas
Original Airdate March 11, 2015
Previous Episode: Kidnapping 2.0
Next Episode: Killer En Route

CMND:\Crash is the second episode in Season One of CSI: Cyber.


A roller coaster crash in Richmond, Virginia is investigated and the team at the Cyber Crime Division reveals it was caused by someone who hacked into the ride's internal computer.


Black hat hacker - anyone who illegally breaches a device with malicious intent.

A roller coaster at the Thrill Country amusement park in Richmond, Virginia crashes, killing one woman and injuring 20 more, including two people who later die in the hospital. Moments before the crash, a man is seen remotely disengaging the brakes on the ride allowing the tragedy to occur. After the dust settles, the team learns that the brakes, the track, and the coaster cars were all functioning properly, which leaves one suspect—the coaster's computer. This would be why the Cyber unit was called in.

There were no ransom demands or public claims of responsibility, which means the person responsible wasn't motivated by any sort of notoriety. The 3D rendering of the track shows that there were over 100 fail-safes installed on the ride, all designed to stop the coaster at the first sign of an emergency. Avery notes that it's no coincidence that all of the fail-safes failed at the same time. The conclusion is that someone breached the coaster's computer and compromised the code.

At the scene, there's no physical evidence that suggests the coaster was tampered with. Krumitz connects to the coaster's diagnostics and makes a surprising discovery—the fail-safes never engaged because the coaster's computer never detected an emergency. There's no record of anything going wrong, and a pre-ride check showed proper functionality across the board.

Nelson soon reveals that rumors have been flying around amongst his inner circle of hackers. The speculation is that it would only be a matter of time before someone would create a source code allowing them to remote hack the coaster, override the fail-safes, and crash it. Krumitz squashes this theory, though, when he reveals that the computer wasn't remotely hacked. The park made it sure the computer didn't have Bluetooth or Wi-Fi so nobody could hack into it. Whoever is responsible did the hacking from the nearby control room. A security camera pointing in the wrong direction seems to be confirm this assessment; however, there are no signs of forced entry, and both the door locks and keycard reader are still intact.

Avery has Raven go back two days in the park's security log. On that day, a whopping 17 employees tried gaining entry to the control room in a one-minute span. Avery quickly concludes that this was a concerted effort to break in; the perpetrator didn't know which card would open the door, so he kept trying until he was successful. However, according to the park's incident reports, nobody reported their cards being lost or stolen. Avery points out that the target didn't have to steal the actual card, just the information. This was old-school card skimming, in which the perpetrator doctored the card readers to obtain employee information. He then captured the information onto a dummy device and made his own cards; this would be why nobody reported their cards stolen. The target hijacked the information to gain access to the control room, and Raven soon discovers that the same card was unsuccessfully swiped five consecutive times the week before. The person responsible for this action is Alex Davis, the park's former engineer who was fired two months ago.

Alex was previously spotted at the scene looking for a lost engagement ring, which he was using to propose to his girlfriend; unfortunately, she was one of the fatalities in the crash. Under interrogation, he denies sneaking into the park after he was fired in order to gain access to the control room. Avery asks him a question about the engagement ring in order to establish a baseline and make sure she's reading him correctly. From this, she deduces that Alex is innocent. She concludes someone knew Alex had access to the control room, but didn't know he had been fired. When the card didn't work, the perpetrator knew he needed to find any card that would open the door. Because something like this would take a lot of planning, Avery figures their target is smart, patient, and determined.

Krumitz discovers that someone slipped a single-board computer equipped with active Bluetooth into the coaster's computer. He demonstrates to Avery that anyone can add a bunch of single-board computers to a desired location and access them via cell phone. In other words, the phone controls the programmable logic controller (PLC). The scariest part is that a single-board computer like this can be found anywhere online for $50 with instructions on how to use it to one's advantage. Krumitz admits that his initial theory was wrong; the hacker only accessed the control room once to install the single-board computer. After that, he did everything remotely thanks to the Bluetooth radio attached to the board. While the park's computer was air-gapped (no Bluetooth, no Wi-Fi), the board the hacker plugged in wasn't. The Bluetooth radio on the board pairs with any device that knows its unique address within 60 feet, which means the target was amongst the crowd when the crash occurred.

With this information, Avery determines their target's motive. She tells Simon that the target likes to be up close and personal—a voyeur with a deviant interest in staging accidents for his own personal gratification (gore porn). Her belief is that the target was trying to impress somebody and guesses that there's an online forum somewhere that encourages violent urges. Encouragement and recognition lead to escalation, which means the target may strike again.

A drop of blood on the circuit board leads the team to Ronnie Sloane, a confidential informant working with the FBI. Agent Colin Vickner doesn’t want to give the man up, but he relents when Simon appeals to his sympathy—his own daughter just got married, and he can imagine how heartbreaking it would be to have lost her before she could take that step in her life. Elijah takes a small team to confront Ronnie, but he insists he had nothing to do with the crash. He just makes the circuit boards for people, and they pay him in cash. No names, addresses, or phone numbers are recorded, and he doesn’t ask questions.

At a dead end, Avery encourages Nelson to use his knowledge of the deep web to infiltrate a gore porn forum in an attempt to locate their killer. Nelson registers with a forum and convinces the administrator that he knows someone else so he can get his account approved. He finds photos from the crash, including a video filmed from the platform by a user going by the name "Otto"—this is where Otto was standing. However, he only killed three people, and the team realizes he was trying to impress the administrator in order to get access to a more exclusive section of the forum. Three deaths weren’t enough, so now he’s planning something bigger. A recent post by Otto indicates that his next attack will be a subway train.

Footage from the coaster crash is reviewed; however, there's nothing distinctive that identifies the target. The computer was likely controlled by a cell phone, something everyone at the park had in their hand. Elijah points out that the Bluetooth radio pulled from the board had to have been paired with something for the target to initiate the crash—the target's cell phone. Since every Bluetooth device has its own unique 12-character alphanumeric address, the target's Bluetooth address is now known.

Nelson hacks into the forum disguising himself as the administrator. He starts a conversation with the hacker and is able to find out that the targeted subway train is in Boston. However, the real administrator soon catches them and kicks them off the site. Knowing about Otto's pathological tendencies, Avery guesses that he'll be on the subway platform when the accident occurs. The question is which line is the target.

The team rushes to Boston to shut down the subway, but there’s one train that’s still moving, and it isn’t stopping at any of the platforms. Krumitz is able to regain control of the train and stop it at one of the platforms, but it’s only a temporary fix. Elijah and Nelson get some of the passengers off before the train drives away from the platform, and Elijah jumps onto the back of the train to try to stop it from inside. Nelson tells him to look for the train’s PLC, where the killer will have implanted his circuit board. It’s an older train, which means the PLC is on the bottom of the final car in the line. Elijah hangs out the back of the train to retrieve it, smashing it with the butt of his gun so the train can come to a stop.

Avery and Krumitz search for the killer, who was waiting on the final platform to watch the carnage when the train smashed into the wall at the end of the line. Since they know he uses Bluetooth to connect with his device, they have their own device to sniff out the Bluetooth signals until they can find the right one. They track his phone to the trashcan where it was discarded, and they have no idea which member of the crowd is the one they’re looking for. Avery uses her skills as a behavioral psychologist, noticing one man who is calm—he even smiles slightly as he makes his way with the rest of the crowd towards the exit. She takes him down and has him arrested. The target will be going away for a long time.


Main Cast[]

Guest Cast[]

  • Jason George as Colin Vickner
  • Joe Reegan as Alex Davis
  • McKenna Grace as Michelle Mundo
  • Christopher Douglas Reed as Ronnie Dalton
  • Alisa Allapach as Female Friend
  • Jarrod Crawford as Man
  • Kevin Austin as Ride Operator
  • Toni Romano-Cohen as Woman
  • Scott Cooper Ryan as Young Man
  • Noel Arthur as Officer
  • Anise Fuller as Mother
  • Daniele Lawson as Stephanie
  • Matthew R. Staley as Otto
  • Joanna Bennett as Sarah


  • While Ronnie, the FBI informant, is identified as Ronnie Sloane in the episode, the character's last name on IMDb is listed as "Dalton."

See Also[]

CSI:Cyber Season 1
Kidnapping 2.0CMND:\CrashKiller En RouteFire CodeCrowd SourcedThe Evil TwinURL, InterruptedSelfie 2.0L0m1sClick Your PoisonGhost in the MachineBit by BitFamily Secrets