Going Viral
Season 2
Number 12
Writer Pam Veasey
Director Maja Vrvilo
Original Airdate January 31, 2016
Previous Episode: 404: Flight Not Found
Next Episode: The Walking Dead

Going Viral is the twelfth episode in Season Two of CSI: Cyber.


An airborne computer virus is infecting cell phones and the team must find the hacker responsible, while Russell meets a woman who sent him a text by mistake.


Default password - a simple password assigned by a device manufacturer that is easily hacked if left unchanged.

Various people in New York City attempt to call 911, but are met with a robotic voice instead. They can't relay their emergencies, nor are they even able to hang up the phone and attempt to redial.

Officer Clayton Carver relays to Avery and Russell that they've been flooded with reports of people having issues calling 911 from cell phones; the calls drop off and the phones freeze in call mode. It's believed that there's a hack in the system that's affecting incoming cell phone calls, as anyone who places a call from a landline doesn't experience the problem. There's no evidence of a mechanical malfunction, and issues with cell service providers are also ruled out. The fear is that this could be a precursor to a terrorist attack.

Raven compares the number of 911 calls from yesterday at around the same time; calls from cell phones have dropped a whopping 40%. There have still been some cell phones that are connecting to 911 and completing the call; however, the calls are coming from outside of Manhattan. Krumitz and Nelson find no evidence of malfunctions or indicators of compromise, and there's also no trace of digital dust that indicates a hack. It's determined that the problem has to be internal to the cell phones; however, there are various models and brands of cell phones all over the city that have different service providers. Officer Carver mentions that one of the dropped calls came from a nearby construction site, so the team may be able to recover the cell phone used.

Site foreman Eric O'Brien provides Elijah with the cell phone he used to call 911. Krumitz and Nelson test it, finding that the phone is infected with malware. Because it may take some time to reverse engineer the code, Krumitz comes up with another idea. He clones Eric's device onto a test phone and calls 911 himself. Like in the other cases, a robotic voice answers the call and the call goes dead. Krumitz is also unable to hang up, as the phone has frozen. The only way someone will be able to contact 911 after such an occurrence is to use a payphone or landline. Nelson recovers a timestamp from the exact moment Eric's cell phone was infected with the malware, finding that it connected to a Wi-Fi network just seconds before.

The router in question is traced to a New York City address; however, upon arriving at the spot, Krumitz and Nelson find nothing. While it's possible the hacker removed the device, the Wi-Fi signal randomly appears with various signal strengths. Elijah spots a city bus advertising free Wi-Fi and realizes that this is why the signal is constantly in motion. The bus is stopped and the router is removed; it contains the same malware that was on Eric's phone.

Krumitz and Nelson are amazed by what else they find. They determine that his is an "airborne computer virus" that jumps from one unsecured router to another that's within 150 feet. The virus infects any router that isn't password protected, as well as those using the default password from the manufacturer. Every unsecured router in the bus's path has been infected; whenever a phone connects to one of the infected routers, it gets the virus. Luckily, the virus can't jump from phone to phone; however, Avery points out that the buses eventually head back to home base. The infection will then jump from from bus router to bus router, and the virus will spread as the buses head back onto the streets the following morning. This will increase the number of people who won't be able to call 911. The team needs to find patient zero before things get even more out of hand.

With the infected area growing at an alarming rate, public routers have been disconnected from buses and ferries. Citizens of the tri-state area have been instructed to turn off the Wi-Fi off on their phones and avoid connecting to any free or open Wi-Fi sources. Furthermore, 911 calls should be made from landlines only.

Avery informs the mayor that the 911 hack doesn't appear to be a terrorist threat. She profiles the target as a man who's working on his own, as a group would've claimed responsibility by now. This person has likely tried something similar in the past on a much smaller scale and is now celebrating the fact that he has the power to cripple the city. She ensures the mayor that they're treating this case like an actual virus, identifying how it's transmitted and trying to contain it the best they can. The team is in the process of writing a code to stop any uninfected phones from acquiring the virus; however, the mayor wants Nelson kicked off the case for his past exploits, notably hacking the New York Stock Exchange. Avery defends Nelson and threatens to walk away from the case if Nelson isn't allowed to work it.

Nelson discovers that there's an audio file hard-coded into the virus, which plays a recorded voice when someone calls 911. The hacker has hijacked 911 and made the caller believe they were talking to an actual operator. It's also found that while the phone may be frozen, the caller's voice is still being recorded. This would seem to indicate that the target is someone who likes hearing the fear and panic of helpless people. The audio from the calls is being sent somewhere, but Nelson finds that the files are bouncing through proxy IPs, making this a dead end.

Russell believes that if the 911 voice is distorted, they can "undistort" it. By establishing baselines and adjusting the pitch and speed of the recording, the operator's real voice is identified. Russell works a hunch and has the voice run against all male dispatchers in the New York City call center database. The target is identified as Leo Finch, a former 911 call center operator who repeatedly failed at his job. One of his infractions was having delayed dispatch times, which Russell assumes was done on purpose so Leo could hear the panic in the callers' voices—an "auditory voyeur."

Elijah and his SWAT team storm Leo's residence and find two dead bodies (viewers had earlier seen Leo going about his daily routine with the victims already dead). The victims, identified as Mary and Roger Ingram, were both strangled to death. Mary died with her phone in her hand; Krumitz tests it and finds the same malware on it as the other phones. According to the call log, Mary called 911 to report that her husband was being strangled. The call went nowhere, and the killer soon found Mary and finished her off.

The house contains a basement apartment that appears to be where Leo lives. While the apartment looks rather cheap, Leo is in possession of high-priced speakers and an expensive violin. Krumitz images Leo's laptop and finds over 200 audio files on the hard drive, all 911 calls. The laptop also appears to contain the original source code for the virus, which shows that it connected to 26 bus routers at the Port Authority the night before. Avery realizes that this was a calculated attack and that Leo wanted to infect every corner of the city.

Despite the news alerts and warnings issued to the public, the virus has spread through the tri-state area. Nelson examines the source code Krumitz sent him and believes he can write a code to counteract it. However, the problem will be pushing the code to all the phones that need it, as a software update through the vendors could take days. Russell gets the idea to send out push notifications similar to how AMBER Alerts are broadcast. While AMBER Alerts can't be used to push code, Russell believes there's a first time for everything and enlists Nelson and Raven to get it done.

Back in the basement apartment, Elijah finds a hidden compartment in the wall that contains three items: a pair of pliers, metal pins, and a bloody violin string. The violin string is believed to be the murder weapon used on Mary and Roger Ingram. Krumitz digs deeper into Leo's laptop and finds three audio files that were played over a thousand times and even put on their own playlist. The first two calls involve a construction site and a home invasion, similar to what the team has already investigated; however, these calls were from two years ago.

Elijah realizes that the pliers and pins found in the secret wall compartment were used at the construction site; Leo sabotaged the scaffolding and staged the accident to mirror the previous 911 call. The second call on the playlist mirrors the scene upstairs. Both incidents have occurred at the same times as they did in the original calls. Avery deduces that Leo played the role of a witness in the first call and has since escalated to playing a victim and a killer—he's replaying his "greatest hits." Leo has picked this day because it's the anniversary of him being fired from his job as a 911 call center operator. The third call on the playlist is of a young boy calling 911 after his father was stabbed in an alley. Since Leo has mimicked the first two recordings, the assumption is that he's going to do it again. Stopping him will be tough, however, as there are hundreds of alleyways in New York City.

Nelson and Raven figure out what the three 911 calls on Leo's playlist have in common: they all lasted over 20 minutes, almost three times longer than the average 911 call. The victims in each case died because Leo didn't dispatch the paramedics in time—he orchestrated their deaths. Raven informs Russell that the "antidote" will be pushed to all cell phones in the area via AMBER Alerts, something she and Nelson were able to figure out. Nelson is instructed to call the NYPD and have them post a picture of Leo with the antidote, making the city their eyes and ears. He believes he'll get pushback from the mayor, something that's confirmed when the mayor expresses his outrage and concerns to Avery that Nelson is still involved with the case. Avery informs him that Nelson's antidote will save lives and vows to go over his head if she has to.

There are several Leo Finch sightings in various places, and Russell realizes that they made a mistake. When they sent out the AMBER Alert to everyone, they sent it to Leo, as well; he's the one reporting false sightings.

Avery reviews everything they know about Leo, including the fact that he's incredibly meticulous about re-creating the past 911 calls. Baseball tickets were found in the pocket of the last victim, and the team realizes that Leo will be targeting someone coming from a sporting event. Since the vast majority of the BOLO sightings were around Madison Square Garden, it's determined that Leo is zeroing in on the spectators from the hockey game. There are three alleyways near the stadium, but the original 911 recording of the stabbing reveals that there was an elevated train in the area. This narrows down the location to one specific alleyway.

As Leo makes his way to the alleyway, he's cornered by the FBI and the NYPD. He pulls out a knife and laments the fact that his potential victims were taken away from him. Avery is watching the interaction from a police body camera; she orders Elijah and his team to stand down, believing they can still end this peacefully. She has Krumitz bring up the third recording from Leo's playlist, and he sends it to police dispatch. The recording is played over the police car's P.A. system, causing Leo to drop his knife and fall to his knees. As an officer starts approaching, Leo goes to pick up his knife. The officer shoots Leo nonfatally, and Leo ironically asks for someone to call 911.


Main Cast[]

Guest Cast[]

  • Kelly Preston as Greer Latimore
  • David Burke as Clayton Carver
  • Chris Mulkey as Mayor Cavanaugh
  • Nikiva Dionne as Connie Abbott
  • Deborah Geffner as Mary Ingram
  • Hugh B. Holub as Darryl Ford
  • Mitch Miller as Leo Finch
  • David Salsa as Eric O'Brien
  • Maria Ayers as FBI Agent
  • Punnavith Koy as Police Officer
  • Skyyler Wilmenko as Bill Schweeny


  • Foolish Heart by Steve Perry


  • In his past life as a black hat, Nelson hacked into the New York Stock Exchange and allegedly stole $8 million. Though he was found guilty of the hacking, he tells Krumitz that he didn't steal any money; however, he vows to catch the person who did. This storyline is never pursued, possibly due to the early cancellation of the show.

See Also[]

CSI:Cyber Season 2
Why-FiHeart MeBrown Eyes, Blue EyesRed CroneHack E.R.Gone in 6 SecondsCorrupted MemoryPythoniWitnessShades of Grey404: Flight Not FoundGoing ViralThe Walking DeadFit-and-RunPython's Revenge5 Deadly SinsFlash SquadLegacy