Ghost in the Machine


Ghost in the Machine

Season	1
Number	11
Writer	Richard Catalani, Carly Soteras
Director	Alex Zakrzewski
Original Airdate	May 12, 2015
Navigation
Previous Episode: Click Your Poison
Next Episode: Bit by Bit

Ghost in the Machine is the eleventh episode in Season One of CSI: Cyber.

Synopsis[]

After the death of a teenager, the cyber team hunt a killer who hacks into popular online games in order to convince vulnerable teenagers to deliver dark-web-purchased weapons.

Plot[]

Game transfer phenomena - when gamers believe they can mimic the physical abilities of their on-line avatar in the real world.

In Chicago, Illinois, 15-year-old Spencer Chapman finishes playing a video game with his friends. Upon exiting his house, he opens a package on his doorstep and stuffs its contents into his backpack. Using a GPS, he rides his bike to another house in the neighborhood, seemingly follows exact coordinates via footsteps, and disappears into a hedge. There, he opens the case he received and removes a drill. Suddenly, the homeowner catches him trespassing and startles him. A gunshot goes off, hitting Spencer in the chest and killing him.

It's revealed that Spencer was shot to death with a gun hidden inside the drill; it fired when he dropped the drill to the ground. The gun that shot him was a custom-built .22-caliber semiautomatic pistol with no serial number—the calling card of a person called "Trigger," a Deep Web arms dealer the team has been chasing for years. Trigger sells guns online to anyone willing to pay his price, disguising the weapons in various objects and tools to avoid detection from postal and mailing services. Every time the team gets close to catching him, he dumps his website, goes underground, and starts all over.

Spencer's parents are certain that he spent his weekly allowance on music, movies, and video games, not guns. They tell Avery that they always checked their son's online activity and had strict rules about the websites he was allowed to visit. However, upon processing Spencer's tablet, Krumitz discovers that he used a parental guidance app to hide what was actually on his tablet from his parents. He had given his parents an access code that only unlocked part of the tablet, allowing them to see what he wanted them to see. Spencer's cell phone shows that he followed the GPS coordinates to the house of Ramsey Scott, the man who heard the gunshot and found the body.

There appears to be no connection between Spencer and Ramsey; however, Ramsey's body is soon discovered with a gunshot to the head. Another cordless drill lays near the body. The conclusion is that Trigger was providing weapons for someone who clearly wanted Ramsey dead. Spencer was enlisted to do the deed; however, when he was accidentally killed, Trigger turned to someone else.

Krumitz and Nelson find no apparent connections between Spencer and Ramsey; they don't even have any apps in common. Furthermore, there's no digital evidence of Spencer buying a gun or even going on a Deep Web browser. While the electronic devices are clean, Raven alerts them to the fact that video game consoles have the same power and capabilities as computers.

The Game Vex logs show that Spencer spent at least six hours a day playing first-person shooters, mainly a game called Blacklight: Retribution. He was a top 50 player until he dropped several tiers in rank, possibly from his parents cutting his playing time. The in-game email account on the console shows that Spencer received a message from a user with the handle "Viper75." The message gave him the coordinates to Ramsey's house, including the number of paces he had to take to walk into the hedge. He was instructed to drop the "package" there, which turned out to be the gun. Viper75 was the one who purchased the gun on the Deep Web and sent it to Spencer with instructions on where to put it. Spencer wasn't there to shoot Ramsey; he was just a delivery boy. The questions now are why Viper75 would want Ramsey dead and why he would use a kid to deliver a gun.

Krumitz shows Avery and Elijah that gaming consoles contain something called a "swap space," where information is unintentionally stored. Data is constantly sent back and forth between the memory and the hard drive, including video and snippets of audio. Krumitz defrags the audio and plays it back, revealing Viper75's voice. A recorded conversation between the two about gaming strategy suddenly turned creepy when Viper75 asked Spencer questions about his dog and his parents' whereabouts.

Nelson and Raven discover that Spencer's avatar was hacked, which is what caused him to plummet down the leaderboards. Viper75 is the one who did the hacking, as his inventory on the date Spencer was hacked mirrors the inventory Spencer lost. A few days later, Viper75 sent Spencer some extremely rare items, allowing him to climb back up the leaderboard. However, it wasn't a gift—it was a trade for a favor. Viper75 used his in-game power over his team in the real world. Avery has them search for any gamers in Chicago who rocketed up the leaderboards like Spencer did.

Game Vex is uncooperative in granting access to Viper75's account. They only provide two things: Viper75 is using a VPN and he set up his account using a prepaid credit card. He's covering his tracks, which will make it impossible to identify him from his account. Avery catches Elijah up to speed, telling him that Viper75 emotionally bonded with Spencer and boosted his confidence. When Spencer got hacked, he turned to the one person he shouldn't have trusted. Viper75 willingly restocked Spencer's inventory and promised him a reward if he could complete a real-world mission.

Viper75 was choosing the best players in Chicago who were in the top 50 on the leaderboard. A player going by the handle "AC3" is identified as another target, as he fits Spencer's gaming profile. Nelson gets the user's IP address from his ToggleFly account, identifying the gamer as teenager Micah Gordon. Under interrogation, Micah calls Viper75 his "hero," much to his father's disbelief. He, too, was contacted after he lost all of his inventory and was soon tasked with a real-world mission. Micah admits that he was provided coordinates to the building where Ramsey Scott worked and instructed to deliver a package. When told that the package was a gun that was used to kill someone, Micah swears that he never opened it and didn't know what was inside. He adds that his in-game reward from Viper75 for completing the drop was a katana.

It's clear that neither Spencer nor Micah knew what was in the packages; they were just the delivery boys. Viper75 then swooped in, took the gun, and killed Ramsey. Elijah discovers that they have a problem: some of the inventory that Micah received from Viper75 didn't come from Spencer. Since weapons and armor can't be created by gamers, Viper75 had to have gotten it from another player. Another gamer has been hacked, meaning someone else is being recruited to do Viper75's bidding. Soon thereafter, Raven finds that another user with the handle "GOLD3NB3AST" recently shot up the leaderboards using the katana Viper75 provided. This means another gun was just delivered and that someone else is going to be murdered—if it hasn't happened already.

Avery and Elijah head back to Chicago to track down Corey Smith, aka GOLD3NB3AST. The door to his apartment is answered by a girl; when she points out Corey, he immediately begins to run. Elijah chases Corey to the roof, where the teen proceeds to jump to an adjacent building. The jump doesn't go as planned, as he crashes through the roof and onto a car below, injuring himself badly. He laments that his jump failed, saying that he "makes them all the time" in his games. When asked where the package is, Corey says that Jessica, the girl who answered the door, is actually GOLD3NB3AST. Elijah heads back into the apartment, but Jessica is long gone; however, she's caught a short while later and arrested.

Corey later tells the paramedics that he ran because he had drugs. Elijah points out that the charge for drug paraphernalia is virtually nothing and questions why Corey would try to land such an impossible jump. Avery informs him that Corey had "Game Transfer Phenomenon" (GTP), where gamers believe they can perform gaming actions in the real world. Corey thought he could make the jump because he had done it so many times in the game.

Avery finds a shipping label in the apartment that matches the one on the box in Spencer's trash. Furthermore, Viper75 sent a message to Jessica that morning providing her with coordinates to Grant Park to deliver the package. Since she has the katana in her gaming inventory, she already made the exchange; the hope is that Viper75 is currently at the same location. Avery and Elijah head to the park and, using the latitude and longitude coordinates provided, find a drill case in a garbage can. Unfortunately, the drill inside has already been cracked open and the gun has been removed. Knowing that Viper75 likes to kill his victims as close as possible to the drop location, the assumption is that he's still in the park. Suddenly, a gunshot rings out, which sends the parkgoers scattering. The gun is found, but there's no body; it seems that Viper75 fired the gun as a distraction to aid in his escape.

With the hunt on for Jessica and Viper75, focus shifts to finding Trigger's location. Three postmarks from the three shipping boxes triangulate around the Tampa, Florida area, so Trigger must live somewhere in that area. Since the area is too large to search, Krumitz suggests that they force Trigger to come to them by attaching a "supercookie" to his IP address. This can be done by getting him to click on a link or open an email, which would then embed the supercookie in the operating system and track is every move. The team comes up with the idea of writing an article about Spencer being killed with a Deep Web gun hidden in a power drill, hoping that Trigger will click on the link to find out how much information the police have. Many will click the article, but only a few will go back into the Deep Web, making it easier to track Trigger.

The plan works, as one of the people who clicked on the article visits the Deep Web shortly afterwards. He accesses an anonymous website that sells guns, as well as the drill cases they're being shipped in. The site is actually Trigger's Deep Web marketplace. His IP address tracks him to the Tampa Public Library, where a team of federal agents takes Trigger down before he can leave the site and shut down his computer. The logs show that Viper75 paid for three guns shipped to the addresses of Spencer, Micah and Jessica. A fourth order was recently shipped and delivered to another Chicago address.

Raven retrieves all of the phone numbers that connected to cell towers near Grant Park at the time of the shooting. The tower dump gets the team a match, identifying the next target as a Kim Hawthorne. Viper75 is soon seen outside of Kim's apartment building retrieving a drill case and taking the gun hidden inside. Avery confronts him, informing him that the phone numbers that pinged a cell tower near the park and the ones in their current location have one number in common: Kim's.

It's revealed that Viper75's father died in prison while serving a 15-year term for felony bank robbery. Two of the witnesses at the trial were Ramsey Scott and Kim Hawthorne, who Viper75 blames for his father's death. He tries to shoot Avery with the gun but discovers that it's empty. A flashback shows Elijah getting to the case first and emptying the gun before placing the case back in its drop location. Attempted murder of a federal agent will be another charge added to Viper75's rap sheet. His attempt to flee goes nowhere, as he's quickly cornered by the police and arrested.

Cast[]

Main Cast[]

Guest Cast[]

Alexie Gilmore as Devon Atwood
Antonio Jaramillo as Viper75
René Ashton as Mrs. Chapman
Max Barakat as Spencer Chapman
Stephanie Drake as Jessica Pope
Dejon LaQuake as Micah Gordon
Sam Tan as Corey Smith
Mark Totty as Mr. Chapman
Karl T. Wright as Phil Gordon
Alysson Da Silva as Civilian
Chris Grabher as Trigger
Lisagaye Tomlinson as Jasmine Nelson

< Click Your Poison	CSI:Cyber Season 1	Bit by Bit >
Kidnapping 2.0 • CMND:\Crash • Killer En Route • Fire Code • Crowd Sourced • The Evil Twin • URL, Interrupted • Selfie 2.0 • L0m1s • Click Your Poison • Ghost in the Machine • Bit by Bit • Family Secrets