Hack E.R.

Hack E.R.
Season	2
Number	5
Writer	Michael Brandon Guercio
Director	Eriq La Salle
Original Airdate	November 1, 2015
Navigation
Previous Episode: Red Crone
Next Episode: Gone in 6 Seconds

Hack E.R. is the fifth episode in Season Two of CSI: Cyber.

Synopsis

When a hacker takes control of all networked medical devices at a hospital in Dallas and threatens to kill one patient every hour if his demands aren't met, the Cyber team must find the source and figure out how they accessed an airtight security system.

Plot

Modchip - a computer chip that alters a device's software for deviant use.

City Mercy Hospital in Dallas, Texas receives a video threat from a hacker collective calling themselves "Grey Ruin." The group has taken control of the hospital and its devices. They demand $5 million or else "another patient" in the hospital will die in four hours.

The use of the words "another patient" sends the hospital staff scrambling to verify the patients' safety. Dr. Colleen Marks happens upon a patient lying in bed with a broken leg. Though the heart rate monitor next to the bed is showing vitals, Dr. Marks is unable to find one a pulse on the patient. CPR is unsuccessful, as the patient, Lindsey Mullen, is dead.

It turns out that Lindsey's drug pump malfunctioned; however, nothing was found to indicate that the pump itself was faulty. The thought is that Grey Ruin hacked the drug pump and forced it to administer a lethal dose of morphine. There might be a bigger intrusion at play, as the pump was controlled by the hospital's network. It's possible the collective hacked the whole system, but Raven believes otherwise, citing that Grey Ruin isn't known for publicly claiming responsibility for their actions or killing people. Even if Grey Ruin isn't responsible, someone found a way to remotely kill a patient.

Dr. Marks, who is also the hospital's Chief of Staff, is informed that the hackers injected malware into the hospital computer system, allowing them control over all networked medical devices. The hospital is doing the best they can to relocate patients to other floors or other hospitals entirely, and they've agreed to pay the $5 million ransom. Avery and Russell strongly advise against it, relaying that the intrusion doesn't line up with Grey Ruin's M.O. Furthermore, the collective released a statement online denying their involvement. Russell tells Dr. Marks that this likely the work of someone with a vendetta against the hospital who's pretending to be Grey Ruin.

In Lindsey's hospital room, Russell finds no fingerprints on the drug pump, confirming that this was a remote hack. Nelson notes that the medical staff can remotely monitor their patients over Wi-Fi and that the pumps have built-in safeguards that prevent lethal doses. However, the hacker removed the safeguard, which allowed them to kill Lindsey. To make matters worse, the pump doesn't authenticate who has access to it, so anyone connected to the hospital's network can do what they want with it. Nelson also determines that the target wrote code that manipulated the display on Lindsey's heart rate monitor. Because the morphine would've taken five minutes to cause cardiac arrest, the target manipulated the monitor and kept the heartbeat steady to prevent the staff from being alerted and trying to save her life.

Raven finds a kill switch hidden in the source code of the hospital ventilators. If the patients are taken off of the network, it'll send a shockwave to all of the medical devices. Power to the entire hospital will be cut, including the backup generators. Any patient requiring the use of a ventilator to breathe will die. It's soon learned that the computer virus has spread outside the hospital, as the defibrillator EMTs are attempting to use becomes inoperable, resulting in another patient's death.

The malware injected into the system spreads over Wi-Fi and Bluetooth. Since the defibrillator has Bluetooth technology that allows it to communicate to the hospital's computers, it became infected when it connected to the network. This would be why it didn't work for the EMTs in the ambulance outside.

Raven penetrates the Grey Ruin video that's blocking the hospital's computers, but she's still unable to access the devices. The malware shut down access to several departments, but the network can't be taken offline because of the kill switch in the ventilators. Raven determines that the malware was injected five months ago. Writing a script to scrub it off the network will take some time, so Krumitz is tasked with getting fellow hackers at headquarters to write patches to override the kill switch.

Nelson discovers that a television in the patient's lounge is the source of the malware. The smart TV is Wi-Fi enabled, and it connects to the same network as the medical devices. Someone with access to it used it to infect the entire hospital; however, tons of people have access to the room, including doctors, nurses, patients, and visitors. It's known that the malware was injected five months ago, which gives the team a timestamp. A security camera is spotted in the corner of the lounge; unfortunately, this lead is a bust, as the hospital dumps surveillance footage every four months.

Raven is able to get the hospital computers back online by writing and executing a quarantine program. However, alarms soon ring out through the hospital, and it's seen that commands are being sent to the computer in the MRI room. It soon becomes evident that the target reversed the polarity of the magnet in the MRI machine. The computer in the adjacent room still has an image of Grey Ruin along with a message: "We're still here." Raven determines that the target shut down the superconducting coils in the machine and turned it into a magnetic weapon. The program she wrote was unsuccessful, as the target must have a backdoor hack that was overlooked. Back at headquarters, Krumitz and his team are having an extremely difficult time trying to override the kill switch.

Avery analyzes the target, believing them to be an egomaniac who's main goal seems to be creating panic and chaos. The team's best bet is the smart TV from the lounge, as it's the origin of the intrusion. Nelson opens the TV up and finds a modchip, which overrides the system's software and makes the device do whatever the hacker wants. The malware was loaded onto the modchip and not the TV for the purpose of cloaking it and making it invisible on initial scans. While the chip can't be traced, a purchase order shows that the hospital purchased 180 TVs about a year ago. The serial number of the TV in question isn't on the list, which means the target brought it from the outside and swapped it. Russell believes they can run the serial number against consumer sales records and find out who initially bought it.

Nine patients are hooked to the networked ventilators. Elijah goes through the list of possible suspects—all nurses who lost their jobs when computers made their jobs obsolete. In all, there are 20 suspects, and a check of their backgrounds will hopefully give the team a lead. Elijah narrows the list down to one person: Artie Sneed, a security researcher from Baltimore who was previously arrested for hacking a medical device supplier that sells to all major hospitals. Though Artie has never been to City Mercy, he called the hospital eight times in the last year to warn them that their medical devices had vulnerabilities. He was quickly dismissed by the hospital administration. Elijah heads to Baltimore despite being instructed by Avery to stay out of the field.

Elijah locates Artie and handcuffs him in his home. When told about his past hacking, he says that it was a misunderstanding—someone named "Schmitty" hacked the supplier, while he was caught with the code. Schmitty, a frequent visitor of a Deep Web medical message board, wrote a ton of code on how to hack infusion pumps and made money selling the code online. However, Artie doesn't believe that Schmitty is the one responsible for the hack at City Mercy, as he's currently in jail. It's more likely that Schmitty sold his code to the hacker. Elijah runs a program on Artie's computers and confirms that he's never been to Dallas; he's not the one behind the intrusion. Artie is released from the handcuffs and tells Elijah that he only wants to help people. His wife inexplicably died in a hospital two years ago, and he's spent every day trying to figure out what happened. As part of his process, Artie has coded patches for medical devices. Elijah instructs him to pack up all of his computers and come back to Washington, as he's needed to assist Krumitz in patching the kill switch on the ventilators. Artie, however, chooses to run, as he doesn't trust the government. Elijah catches up to him and enlists his help back at headquarters.

There are no hits on the TV's serial number, and attempts to pay the hackers are rejected, as the routing number was for an offshore account that doesn't exist. Avery tells Dr. Marks that the intrusion was never about the money. The target could've done this to any hospital in the country, but chose City Mercy specifically. This was a personal attack.

Artie is brought to headquarters to work with Krumitz. He realizes that while you can't patch the ventilators directly, you can protect how they connect to the network. The code Artie provides works, and Krumitz sends the patch to Raven. However, while the patch should block the hacker's access, it's discovered that the hacker is trying to get ahead of the patch and still go for the ventilators. The hacker is slowed down until the patch is complete, and the target's ventilator attack is stopped. As the four-hour deadline comes and goes, all patients in the hospital remain alive and accounted for.

The target still has remote access to the network and needs to identified before anything else happens. Nelson goes through the hospital and is unable to detect any rogue device, meaning the target is hiding somewhere in the network. Minutes later, basketball star Thomas Knight, who has been rehabbing in the hospital, collapses outside and dies. It's discovered that his medication schedule showed he was due for an injection of Dorvatrin, an non-steroidal, anti-inflammatory drug used to treat pain. According to his paper medical record, Thomas was allergic to Dorvatrin. Someone altered his electronic medical record and prescribed him a medication he never should've been on.

Since the ventilator attack was stopped, this is the target's counter; they've found a new way to keep their deadline. Another message soon comes in from Grey Ruin: "You tried to pay, but money does not solve your problems. You are accountable for what you have done. In one hour, we kill again." Avery analyzes the message and figures that the target wants revenge. Russell notes that they knew what time the nurse's shift would change and when they could alter Thomas' electronic medical record. They would also need pharmaceutical knowledge to know that Dorvatrin would send Thomas into anaphylactic shock. This leads to one conclusion: the target is a nurse or doctor who has been two steps ahead the whole time because they're in the hospital right now.

Nelson is having trouble figuring out how the hacker changed Thomas' electronic medical chart, as he's unable to find any digital trace. While he teleconferences with Krumitz, Artie instructs him to check the hospital pharmacy, noting that prescribed medications are usually routed through there. Nelson searches there and is able to find that the command that changed Thomas' electronic medical record came from a local router port. The device is still in the hospital, and it's tracked to the building's lower level. There, Dr. Giana Luca is found bleeding after being stabbed by a pair of scissors. She claims that she caught a red-haired nurse smashing a computer and was then attacked.

A search of the surrounding areas turns up nobody fitting the nurse's description. Dr. Luca's condition is stable, as her wounds didn't puncture any vital organs. As to why she was in the room to begin with, Dr. Marks says that she worked in the Radiology lab across the hall. Russell observes a dust-covered fan in the room and comes up with an idea.

He explains to Avery that when humans breathe, they inhale dust, pollen, and other airborne microbes from the environment. The TV that was brought into the lounge has a fan that keeps the unit from overheating by sucking in cool air; whatever particles are flying around are also sucked in and stick to the fan blades. He sequences the DNA from the TV's fan and runs it through an index of airborne microbes. His assumption is that the fan collected the microbes from where it resided five months ago. By using the bacteria database, they can zero in on the TV's previous home to an area within a ten-mile radius. Two types of bacteria are identified.

The radius is cross-referenced with the addresses of the hospital's employees. From this, one target is identified: Dr. Giana Luca. Avery confronts her and notes that the doctor was present at both the deaths of Lindsey Mullen and Thomas Knight; she even tried "assisting" in both cases. When she hacked Thomas' electronic medical record, she forgot to anonymize her computer, leading the police right to her. Avery points out that only a doctor can stab themselves six times and not have the injuries be life-threatening. Dr. Luca denies her involvement, but she's informed that the infected modchip installed in the TV traces back to her home address. Furthermore, proof was found that five months ago, she purchased the exact malware used to hack City Mercy.

When asked why she did all of this, Dr. Luca says that she dedicated 23 years of her life to making the hospital one of the best in the country. However, instead of being recognized for her achievements, she was passed over for a promotion and Dr. Marks was made the Chief of Staff.

Back at headquarters, Artie is thanked for saving the day. Avery once again admonishes Elijah for not looping her in on the decision to enlist Artie's help. Elijah says that he believes he made the right decision, but he's warned not to do it again.

Cast

Main Cast

• Patricia Arquette as Avery Ryan
• James Van Der Beek as Elijah Mundo
• Charley Koontz as Daniel Krumitz
• Shad Moss as Brody Nelson
• Hayley Kiyoko as Raven Ramirez
• Ted Danson as D.B. Russell

Guest Cast

• Alisha Boe as Grace Clarke
• Marcus Giamatti as Artie Sneed
• Andrew Lukich as Mike Mullen
• Lauren Stamile as Dr. Colleen Marks
• Jessica Tuck as Dr. Giana Luca
• Natisha Anderson as Nurse #1
• Mark Atterberry as Male Doctor
• Huntington Daly as Crash Team Nurse
• Nancy De Mayo as FBI Agent
• Colleen Foy as Paramedica Mary
• Nathan Pelle as Thomas Knight
• Lucas Kwan Peterson as Young Male Nurse
• Craig Rhodes as Security Guard
• Katie Roberts as Nurse #2
• Michael Scovotti as ER Doctor

Notes

• Elijah is instructed to work the case from headquarters, as Avery pulled him out of the field after he beat an incapacitated suspect. This occurred in the previous episode Red Crone.
• Russell recalls past conversations with former CSI Julie Finlay (Finn). The dialogues are taken from the CSI: Crime Scene Investigation episode Seeing Red (Season 13), which was Finn's first appearance.

Trivia

• Lauren Stamile (Dr. Colleen Marks) also appeared in the CSI: Crime Scene Investigation episode Bad Blood (Season 15).
• This is the first of three appearances by Marcus Giamatti as Artie Sneed. Giamatti also appeared in episodes of CSI: Crime Scene Investigation (Lover's Lanes, Season 12) and CSI: Miami (Blood Lust, Season Nine).

See Also

• List of CSI: Cyber episodes
• CSI:Cyber Season 2
• Category:Images from Hack E.R.