Season 2
Number 18
Writer Pam Veasey
Director Eriq La Salle
Original Airdate March 13, 2016
Previous Episode: Flash Squad

Legacy is the eighteenth episode and Season Two finale of CSI: Cyber. It is also the show's series finale.


The Cyber team searches for the hacker responsible for the largest breach of highly classified data in history when millions of federal employee files are stolen.


Legacy footprints - a digital data trail you unintentionally leave online.

Five departments—the NSA, CIA, Homeland Security, Department of Defense, and the FBI—are sent emails explaining that the Federal Government Office of Personnel Management (OPM) has been hacked. Attached to each email is a PDF of the document government employees fill out when applying for top secret clearance. The form contains a wealth of personal information, including health and financial records. If the breach isn't contained, additional government documents could be compromised, including those that contain Social Security numbers and fingerprint records. No threats have been made and no person or group has claimed responsibility for the hack. Avery is alerted that if any of the country's foreign adversaries are involved, Congress will consider these actions an act of war.

The phones belonging to the five department heads are processed. It's found that the emails they received all originated from the same email address; furthermore, the IP address they were sent from appears to be legitimate. The hacker didn't even try to hide their identity, but they're clearly skilled enough to know how to evade intrusion detection to break into the OPM. A name and address from the service provider leads the team to a house in Arlington, Virginia. The residents are Robert and Margo Hazelton, and it's determined that their email accounts are the ones that sent the PDFs. Furthermore, they received over 150 messages offering a lot of money for the OPM files; selling the information to the wrong buyer could put the country's security in jeopardy.

Elijah and his SWAT team storm the Hazelton house, taking Robert and Margo by surprise. The computer downstairs tests clean, and the search progresses upstairs to the kids' rooms. In the room of 13-year-old Jake Hazelton, Krumitz finds a laptop soaking in a fish tank that had mineral oil added to it; the hard drive is missing. Jake is the one who hacked the OPM, meaning the U.S. Government's secrets are in the hands of a 13-year-old kid.

At an abandoned local gym, Jake meets a man training by himself. When asked, the man identifies himself as "Wizard," while Jake confirms that he's "Achilles." Jake pulls the hard drive out of his backpack and is taken aback when another man, "Echo," emerges from the back room.

Back in Jake's bedroom, Elijah observes that the mineral oil trail leads from the room to the garage, where Jake's bike is missing. Krumitz marvels at Jake's brilliance, explaining that the kid's laptop is overpowered, which would cause it to overheat. To compensate, Jake built a cooling system inside of the fish tank and filled up with mineral oil because it doesn't conduct electricity. Krumitz figures that Jake has more than one computer and likely backed up his hard drive. The home network shows a device connected labeled "JBC," which is assumed to be the backup computer. Elijah eventually finds the device hidden behind a dresser drawer.

The backup drive confirms that Jake was responsible for the OPM hack. Curiously, however, the vulnerability on the OPM site has been patched, and the thought is that Jake patched it himself. Evidence shows that Jake went into a hacker forum and reached out to a lot of people about the breach; he was then asked by various members to actually prove he was responsible. Krumitz, Nelson and Raven discuss whether Jake is a white hat (using hacking for good) or black hat (using hacking for evil). While Jake did the hacking and took the hard drive, he patched the vulnerability on the OPM site. He also sent proof that he did it to the government so they would know the system was vulnerable; Jake patched the intrusion after the emails were sent. Nelson and Raven believe Jake did the patching himself to make the drive even more valuable and that there's a reason he's on the run. Krumitz, however, believes Jake thought he was fixing a problem and is on the run because he's scared.

Russell speaks with Emma Hazelton, Jake's younger sister; she fears for her brother's safety, fearing that the "Wizard" hurt him. Network logs show that Jake received a message from "Wizard715" that encouraged him to "take the conversation offline." Activity would be untraceable in a hacker's private forum; however, the team comes up with the idea of using legacy footprints—digital evidence one leaves behind on the Internet and forgets about. The hope is that somewhere on the Internet, Wizard715 may have used the handle without anonymizing himself. The idea works, as someone with the email address Wizard715@fasttapsmail.com listed a phone number on Craigslist three years ago. A location is retrieved from the phone number.

The phone number leads Elijah and his SWAT team to the abandoned gym. They find Wizard lying on the ground and bleeding from a gunshot wound; Jake and Echo are nowhere to be found. Wizard tells Elijah that "Achilles" (Jake) ran off with the hard drive and that Echo chased after him; he fears that Echo will kill the boy for the drive.

Wizard, whose real name is Gerald Fenwick, dies in surgery. Blood and skin found under his fingernails are a match in CODIS to Jeffrey Stevens, aka Echo. Jake's bike was found in the gym, and his fingerprints place him at the scene. Wizard's laptop is also recovered, and it's learned that someone brokered a deal to sell the OPM documents to Russia. Avery believes that Jake and Echo aren't working together, as there's no evidence they communicated online. Since there were no signs of a struggle between Wizard and Jake, she guesses that Jake trusted Wizard enough to go to the abandoned gym by himself. From this, she deduces that Wizard had one plan, while Echo had another.

A flashback shows Jake arriving at the gym with the hard drive. Wizard plugged it in and was amazed to see that Jake pulled off the hack, retrieving everything from the OPM. He commended Jake for reaching out to the hacker community and vowed to give the information back to the the FBI so Jake could be hailed a genius and a hero. However, an incensed Echo saw this as a tremendous money-making opportunity and whipped out his gun. Wizard tried fighting Echo off while he told Jake to run. Jake took his hard drive, with Echo giving chase after he shot Wizard.

Nelson and Raven have trouble accessing Wizard's laptop, finding that it's equipped with a biometric lock and liveness detection. The scanner on the laptop considers three things: 1) the fingerprint being scanned is a match to the device's owner, 2) that it's human skin, and 3) that it has an active pulse. Russell gets the idea to gently peel off the skin from Wizard's thumb and affix it to his own gloved hand, which will trick the scanner into recognizing a live pulse. The plan works, as access is gained into the laptop.

Krumitz recovers private messages between Jake and Wizard from the laptop. The two have an ongoing conversation; however, since Wizard is dead, the team figures Echo stole his phone and is pretending to be him. They've set up a meeting time to exchange the hard drive, but no location is provided; the message just says to "meet where Wizard spent his summers as a kid."

Jake is spotted on surveillance footage in a café in Adams Morgan, a community in Washington, D.C. He's seen texting someone on his phone (likely Echo), but the phone is in airplane mode. Jake will be using hotspots to communicate via Wi-Fi; however, the team can't reach out to him unless they know what Wi-Fi network he's connected to. Geographic profiling narrows down Jake's possible location, and the team gets the idea to force Jake's phone onto a network. Noting that the phone will only connect to a network it already trusts, they rename every Wi-Fi network inside a three-mile radius to the one used at Jake's house.

Jake's phone connects to one of the Wi-Fi networks, but his precise location is still unknown. Russell calls him over the Internet, and Jake answers the phone believing that his mother is calling him. After Russell introduces himself and ensures Jake that he isn't in any trouble, he asks Jake for his location. Jake answers that he's at the "community" before he sees Echo approaching him from a distance. Gunshots are heard over the call, and Krumitz gets the idea to use the D.C. gun locator system, which gets the location of gunfire by using acoustic sensors. This leads the team to the Adams Morgan Community Pool. More gunshots are heard over the call. Echo catches up to Jake, shoots him in the shoulder, steals the hard drive, and kicks Jake's phone into the pool. Jake attempts to retrieve his phone, but he falls into the pool, seemingly unconscious.

Echo is on the run, but he doesn't get very far. When cornered and arrested by Elijah, Echo tells him that Jake is dead. Krumitz finds Jake floating in the pool and dives in to save him. Fortunately, Jake is still alive. Back at headquarters, Director Silver informs Avery that they can protect Jake under Responsible Disclosure. They know that Jake went to Wizard for help and that both parties wanted to do the right thing.

In a separate storyline, Elijah brings his father home from the hospital. They briefly talk about the Nina Moore situation before parting ways; unbeknownst to them, Nina is hiding behind a tree on the property.

Nina soon files a restraining order against Elijah, turning the tables. As Elijah leaves work, she confronts him in the parking garage and holds him at gunpoint. She claims that she just wanted to be his friend; however, he responded by pushing her away. Russell gets off the elevator, hears the argument, draws his gun, and confronts Nina. Gunshots are heard, and the team soon finds Russell bleeding from a gunshot wound, while Nina is dead. Russell loses consciousness, but is later shown to have survived the shooting. He's last seen in Paris having dinner with his new love, Greer.


Main Cast[]

Guest Cast[]

  • Gregg Henry as Calvin Mundo
  • Sean Blakemore as Director Silver
  • Molly Burnett as Nina Moore
  • Dallas Liu as Jake Hazelton
  • Brent Sexton as Andrew Michaels
  • Kelly Preston as Greer Latimore
  • Boo Arnold as Wallis Gardner
  • David Alexander as Rep of DOD
  • Henry Dittman as Rep of NSA
  • Jennifer Say Gan as Margo Hazelton
  • Bayani Ison as Robert Hazelton
  • Ariah Tsukada-Aka as Emma Hazelton
  • William Langan as Rep of CIA
  • Stefanie Sherk as Jessica Turing

Major Events[]

  • Russell resigns from his role, choosing instead to fly to Paris with the new love in his life, Greer Latimore.
    • However, before he can do so, he gets shot by bartender Nina Moore, who was stalking Elijah. He survives the shooting and ends up in Paris with Greer.
  • Four months after the case is solved, Nelson graduates from Quantico and becomes an official FBI agent.
  • With the Hacker-for-Hire program terminated, Raven works her last day at the Cyber Division. However, four months later, Avery rehires her as a consultant.


  • Due to the show being cancelled after Season Two, this is officially the last-ever episode of CSI: Cyber.
  • Sadly, this episode would end up being the last television appearance of Kelly Preston before her death in 2020.

See Also[]

CSI:Cyber Season 2
Why-FiHeart MeBrown Eyes, Blue EyesRed CroneHack E.R.Gone in 6 SecondsCorrupted MemoryPythoniWitnessShades of Grey404: Flight Not FoundGoing ViralThe Walking DeadFit-and-RunPython's Revenge5 Deadly SinsFlash SquadLegacy