IWitness

iWitness
Season	2
Number	9
Writer	Carly Soteras
Director	Paul Holahan
Original Airdate	December 13, 2015
Navigation
Previous Episode: Python
Next Episode: Shades of Grey

iWitness is the ninth episode in Season Two of CSI: Cyber.

Synopsis

The team investigates the murder of a hacker who was hired to delete an assault victim's comments from a confessional website.

Plot

Brute-force attack - attempting every possible password combination to crack into a protected device.

A hooded figure approaches a dead female body, pours gasoline on it, and lights a match. Both the victim and the phone she's holding are set ablaze. Avery gets an alert that the victim's fingerprints identify her as Quinn Elliott, aka "Queen of Hearts."

Quinn was a convicted hacker for hire who was a suspect in nine open cases. She was released from prison a year ago; however, her parole officer lost track of her and she's been off the grid ever since. The thought is that whoever Quinn hacked in the past has a motive for murder. There's one eyewitness to the murder: Quinn's phone, which digitally recorded her every move before death.

The data from the phone is downloaded. At approximately the time of her death, she accessed her virtual assistant; these may be the last words she ever sent. While Raven works on getting a subpoena from the phone manufacturer to recover what Quinn said, Nelson takes a look at what was in Quinn's phone. While the apps are rather generic, he sees that the Calculator app has a file size much bigger than the other apps. He realizes that this is a gatekeeper; entering the correct passcode will unlock a hidden partition in the phone. This "phone within a phone" would be the perfect place for a hacker to hide data.

The IMEI number from Quinn's phone is registered to a Lexie James; her driver's license photo matches Quinn's mug shot. "Lexie" had gotten married to a Louis James about nine months ago. A subpoena is obtained, allowing Raven to download Quinn's virtual assistant log. The last thing she asked the virtual assistant to do was "email photo 226." She was shot shortly after sending out her request.

"Photo 226" turns out to be something resembling a painted landscape. The caption at the bottom reads: "Drowning. yiElding. grasPing. scArRing. I gave in. I WON'T GIVE UP." Raven finds out that the post is from Miafina, a website where users post their deepest, darkest secrets, allowing anyone to read them. Elijah has Raven separate out the capitalized text; when rearranged, he sees that it spells "RAPED." Quinn appears to have been a rape victim. Her confession isn't on the website, but evidence suggests that she posted it at some point. If she was planning on confronting her attacker, it may have resulted in her death.

A distraught Louis James is informed that his wife was a convicted hacker who was living under an alias to avoid detection. He denies these allegations, believing that his wife wouldn't have kept any secrets from him. "Lexie" had also never mentioned anything about being sexually assaulted. Louis says that they were saving up money to buy a house and start a family. Before leaving, he advises Avery and her team to find his wife's killer and stop focusing on her other life.

Using a brute-force bot, which rapidly enters every possible passcode combination, Krumitz is able to crack into Quinn's hidden partition. The partition reveals a myriad of hacker tools, one of which is a ToggleFly exploit that could make her a lot of money if she sold it to another hacker. Logs show that Quinn logged into a coffee shop's open Wi-Fi network every day, likely in an effort to remain anonymous. One of the programs on the partition is a Shield Wallet, which hackers use to accept anonymous payments from their clients. The account has over $500,000 in it, and the last payment she received was for $25,000 eight days ago.

Curiously, the Miafina app is also hidden in the partition, and it appears she was hired to hack the site. She was able to find a backdoor that allowed her to find the real identity of every person posting their secrets. This would allow Quinn to earn a huge payday by blackmailing the users and threatening to reveal their real names; she could also hold the Miafina site hostage. However, she didn't do any of that, choosing instead to simply delete her own secret. Avery wonders if Quinn was hired to hack into the site and delete someone else's confession. It turns out that the original post was deleted eight days after it was first posted to the Miafina site. The confession was posted from the Paxton University campus, leading Avery to question whether a student was raped and Quinn was hired to silence her.

Elijah gets the idea to use Quinn's backdoor to get a list of all confessions on the Miafina site tagged with Paxton University. He'll then reach out to campus security and cross-reference those confessions with reports of sexual assault on campus. This turns out to be a dead end, as nobody reported a sexual assault incident in the last year. Elijah wonders if the university is underreporting to keep their crime stats down.

Raven finds that the last word Quinn's phone learned was "SOT." It turns out that Quinn had recently started talking to someone with the handle "SOT515" on an encrypted messaging app. She was hired to delete the rape confession and locate and spy on the person who posted it: Shelby Lockhart. SOT515 appears to be a rapist looking for his victim. Their last conversation shows that Quinn quit working for SOT515 and threatened to tell the world what a "vile, disgusting human being" he was. This would give SOT515 motive to kill Quinn and keep her quiet. Quinn actually agreed to meet SOT515 in person, something hackers almost never do, as they prefer to remain anonymous. The team needs to find out why Quinn agreed to a real-world meeting.

It's confirmed that Quinn agreed to meet with SOT515 on the night of her murder. As for Shelby, her phone has been offline for a week and her FriendAgenda page also hasn't been updated recently. The operating theory is that SOT515 killed Quinn to keep her from exposing him, then went after Shelby. Searches of social media sites turn up nobody with the handle SOT515.

Avery focuses on the image behind Shelby's online confession. Figuring that the image could be just as revealing as the text, she has Raven enlarge the picture and rotate it 180 degrees. When boats are spotted, Avery realizes that "SOT5" stands for Spirit of the Five Mile, a row team race that happens once a year on the Five Mile River in Boston. As it turns out, the Paxton University row team won the race this year. When Raven scrolls through photos of the celebration party, she spots the photo used in the confession in the background.

Avery and Elijah head to the university with a warrant to search the crew team's electronic devices. However, Julian Perkins, the university's Athletic Director, cites that the Family Educational Rights and Privacy Act forbids them from accessing students' computers, tablets, or phones. The only way they can is if they obtain consent or probable cause for an arrest. Since no student is willing to give up their privacy, Avery and Elijah have to find another way in.

Avery tries appealing to Mason Lynne, Cyber's legal counsel; however, she's informed that obtaining university records is a slippery slope, as they contain student schedules and university emails. Mason tells her that they need to locate Shelby and have her file a complaint. Without her testimony, the Cyber team won't be able to get their hands on the crew members' devices.

Nelson notes that Quinn was paid to locate Shelby, which means there must be some digital trace that will lead the team to her. One of the apps on the hidden partition in Quinn's phone allowed her to spy on Shelby and clone her phone onto hers. Everything Shelby typed, Quinn saw. Furthermore, Quinn also injected targeted ads into Shelby's FriendAgenda feed for online sexual support groups. Quinn knew Shelby's secret, but she had to help from afar to prevent herself from being outed as a hacker. It's soon discovered that Quinn also injected spyware into Shelby's phone that forced it offline and disabled it. Quinn was stopping Shelby's rapist from being able to find her—she was acting as Shelby's guardian angel.

Shelby is located via the phone number on her new phone. In Wheeling, West Virginia, Avery speaks with Shelby and shows her the confession on the Miafina site. Shelby admits that she was raped by three members of the crew team at their victory party; however, she can't remember their faces. The only thing she remembers is the painting in the frat house she used as the background for her confession. She reported the incident to a school administrator, but was told that she didn't have a good case because she couldn't remember faces or names, because she was drunk, and because she didn't report it immediately. The administrator also advised Shelby not to go to the police, telling her that she could lose her scholarship if she falsely accused the crew team of rape. Shelby left school, and Avery is the first person she's told about the incident. Avery promises her that she's going to help her.

Avery files a Title IX complaint against Paxton University, which requires a school to maintain a campus free of sexual discrimination and violence. She tells Mason that the university broke the law when they dissuaded Shelby from filing a sexual assault complaint and threatened to revoke her scholarship. If the university is found guilty, they could lose their federal funding. Avery lists herself as the complainant, telling Mason that Shelby shouldn't have to fight a battle that shouldn't even be one to begin with. She then realizes that there were hundreds of students at the party and hopes that one of them will have the courage to stand up for Shelby.

Avery gets a tip that the party was video recorded by student and crew member Carter Harris. When questioned, he knows that his phone can't be looked at without his consent; however, Avery and Elijah convince him to do the right thing. Carter was ordered by the rapists to delete the footage from his phone. He admits that he was video recording the party and accidentally walked in on the rape. The three rapists are identified as crew members Pete Winthrop, Finn Thompson, and Thatcher Bell. Finn had recognized the painting when he was searching for secrets on Miafina, and he made everyone swear to keep their mouths shut. After all, a rape charge would destroy their hopes of competing in the Olympics.

Krumitz is able to recover the deleted video from the phone and confirm the identities. Pete, Finn, and Thatcher are placed under arrest for aggravated sexual abuse; however, a search of their phones shows that none of them are SOT515. Since someone hired Quinn to cover up the rape, the thought is that the three rapists went to that same person for help. It's known that Shelby's confession was posted on the last day of midterms. Pete, Finn, and Thatcher would've asked for help in person, which means their phones would've been in the same location at once for an extended period of time. The date and location line up with one suspect: Athletic Director Julian Perkins.

Avery confronts Julian in his office and accuses him of being SOT515. Pete, Finn, and Thatcher approached him with their problem, and when Shelby couldn't be located, Julian hired Quinn to track her down. However, when Quinn went rogue, Julian realized that he would lose everything—the money and prestige the crew's win brought the university, as well as his job. He asked Quinn to meet with him in person and work out a deal. Julian denies this and claims to not know who Quinn is, but Avery reveals that before she was murdered, Quinn accessed the video camera app in her phone. She was planning on recording the meeting to expose Julian, and while she knew he was capable of covering up rape, she didn't know he was capable of murder. Julian is placed under arrest.

Shelby tells Avery that she's afraid to go back to school, as she thinks people will hate her for getting the crew team suspended. Avery ensures her that none of this was her fault and that by coming forward, she'll be protecting every other young woman on campus. In fact, she's exposing an ugly truth that occurs on campuses all over the country. Shelby will still need to go through trial and testify, and Avery tells her that she'll be there with her every step of the way.

Louis James comes to headquarters once more. Nelson informs him that "Lexie" was a hero who died protecting the young woman she was hired to hack. He and Raven show Louis a Miafina post from "Lexie" in which she announced she was giving up her hacker life, choosing to spend it with her husband instead. They give Louis a flash drive with the zero-day exploit for ToggleFly "Lexie" was working on, which they explain is worth a lot of money.

Cast

Main Cast

• Patricia Arquette as Avery Ryan
• James Van Der Beek as Elijah Mundo
• Charley Koontz as Daniel Krumitz
• Shad Moss as Brody Nelson
• Hayley Kiyoko as Raven Ramirez
• Ted Danson as D.B. Russell (credited only)

Guest Cast

• Alex Ashbaugh as Louis James
• Alisha Boe as Grace Clarke
• Christopher Cousins as Mason Lynne
• Rob Estes as Julian Perkins
• Mary Mouser as Shelby Lockhart
• Justin Prentice as Carter Harris
• Dahlia DaCosta as Coroner
• Michelle DeFraites as Young Woman
• Christopher Foley as Finn Thompson
• Lauren Shaw as Quinn Elliot / Lexie James

Notes

• Ted Danson (Russell) is credited but does not appear in the episode.

Trivia

• Rob Estes (Julian Perkins) also appeared in the CSI: Crime Scene Investigation episode Merchants of Menace (Season 15).

See Also

• List of CSI: Cyber episodes
• CSI:Cyber Season 2
• Category:Images from IWitness