Season 2
Number 8
Writer Craig O'Neill
Director Janice Cooke
Original Airdate November 22, 2015
Previous Episode: Corrupted Memory
Next Episode: iWitness

Python is the eighth episode in Season Two of CSI: Cyber.


Avery risks her life to capture the #1 criminal on the FBI Cyber's Most Wanted List who murdered her friend, an Interpol agent.


Shelf baby - a fake digital identity created and "raised" online by a hacker planning to use it to commit crimes.

Avery gets a call from her friend Rupert Flemming, an Interpol agent stationed overseas. Sounds of Rupert's screams echo out over the call, as we see him getting tortured with a power drill. The man torturing Rupert then addresses Avery by name and gives her a warning: stop chasing him or else more agents will be killed. Rupert's suffering soon ends with a gunshot.

Avery contacts Interpol agent Miguel Vega and informs him of Rupert's murder. At the scene in New York City, she immediately knows that this is the work of "Python," one of the most violent cyber drug dealers the Cyber team has ever encountered. Though most hackers stay behind their computers, Python is different; he has no problem hopping into the real world to kill whoever stands in his way. The thought is that Rupert stumbled onto something Python didn't want getting out, resulting in his torture and execution. Miguel relays that Rupert was meeting an informant, but he had no idea the case had to do with Python. The gun Python used was left at the scene with its serial number filed off, which fits the M.O.'s of his other six murders. Each gun was taken into evidence and stored in an FBI evidence locker; Russell asks to take a look at them.

There's no evidence that either Rupert's laptop or phone were hacked. Krumitz wonders if Python actually hacked Interpol itself. While a scan of their network also shows no intrusions, Krumitz notices a recent dip in the optical network light output. He explains to Raven that Interpol sends their data over fiberoptic cable, which carries data over long distances at light speed. The same amount of light that goes in one end always comes out the other—except for three days ago. He figures that Python put a tap on Interpol's dedicated fiberoptic line that connected the U.S. offices to the headquarters in Europe—"fiber tapping." Only a portion of the light-carrying data made it from Europe to the U.S. Krumitz believes that by measuring the travel time of the information before it dipped, he can pinpoint where the fiberoptic line was hacked.

GPS coordinates lead the team to a house in New Jersey. When recently-cut floorboards are removed in the living room, Python's underground fiber tap is discovered, complete with an exposed fiberoptic cable and a laptop. An analysis of the laptop shows that it was running sniffer software isolating Rupert's emails. Nelson runs decryption software and is able to access the emails Rupert was sending to his informant, who goes by the name "Darko." Darko had informed Rupert that he had something Python "didn't want him to have" and set up a meet. Two more emails reveal when and where the meet was supposed to take place; however, ten minutes after it was supposed to happen, Darko unexpectedly cancelled it. In another decrypted email, Darko said that he knew Python's real identity. Darko holds the key to the case, and he needs to be found before Python's trail goes cold.

Russell uses hydrochloric acid and an electrical current to remove the tool marks from the guns and uncover their serial numbers. The process yields only partial serial numbers, but he believes that if they get partials off of the other guns, they can run an urgent trace and get a lead on Python.

The president of Interpol orders the fiber tap to removed immediately, something Nelson thinks is a bad idea, as Python will know when the connection is disrupted. Avery believes they have an advantage since Python doesn't know they found the tap. She gets an idea, asking Miguel to send an email to Darko introducing himself as Rupert's partner and setting up a meeting. He'll then send back a fake email from Darko accepting the meeting and setting up a time and location. The hope is that Python will intercept the email and walk himself into a sting operation; however, he sees through the ruse and sends the Cyber division a threatening message asking for Darko—dead or alive.

Raven peruses the Deep Web and finds out that Darko was selling what hackers call "fullz"—full packages of personal information stolen from big corporate hacks. The website where he's selling them shows that one of his buyers is one of Elijah's confidential informants. Bernie Renard, aka "Fresh," is brought in for questioning. He refuses to give out any information about Darko, especially after Python's warning. Elijah threatens to have him arrested for his fullz business, but this doesn't seem to worry Bernie. Miguel takes a different approach, telling Bernie that he'll have him labeled a digital snitch and ruin his reputation on the Deep Web. Bernie again seems unfazed, but Miguel speaks French to him and threatens his life.

Bernie finally relents, telling Miguel that Darko's real name is Teddy Frankle, a British ex-pat living in the U.S. illegally. Though there's no Interpol file on him, it's known that he works off the books at a Baltimore e-waste facility. It's also known that he gets his fullz by stealing personal information off of users' hard drives before they get recycled. If he happens to stumble upon the personal information of someone valuable, he then tries selling it back to them for a fee. The thought is that Darko tried running the scam on Python, which is how Python knows what Darko has. It's unknown how Darko ended up with Python's information; only Darko can give that answer. His whereabouts are unknown, as his apartment and workplace in Baltimore was raided and he was nowhere in sight. It's learned that Darko reached out to Bernie yesterday looking to unload a block of fullz for some quick cash, but he was turned down. The team needs to scour the Deep Web for any auction sites where fullz are sold in the hopes that Darko will turn up.

Krumitz and Russell recover the six partial serial numbers from the guns and get a list of possible matches from the system. Four of those matches belong to the same person: Henry Hayes, who has a New York address. His apartment is empty except for a computer and a webcam with a live feed set up. Avery and Elijah realize that Python has just made them. A message soon appears on the computer monitor: "You'll never catch me."

Henry's file only contains a Social Security number and a credit report. Avery deduces that Python created Henry Hayes as a "shelf baby"—a virtual identity created by a hacker. Elijah explains to Miguel that it's rather easy for a hacker to register a Social Security number, birth certificate, or medical records all in the name of someone who doesn't exist. The hacker than watches the false identity "grow" and supplies them with things like driver's licenses when they turn old enough. When the shelf baby turns 18, the hacker uses it as a throw-away identity to commit crimes. Henry's identity was rushed because Python needed to buy guns immediately, which explains the digital holes in Henry's life.

The video signal from the apartment is untraceable. Raven discovers that an anonymous seller just posted a massive block of fullz on a Deep Web auction site. The seller, who's likely Darko, has offered to deliver the fullz in person in return for cash. Raven exploits a bug on the auction site's messaging software, allowing the team to eavesdrop on all the messages sent between the seller and whoever places the winning bid. From this, the team sees that the deal will be going down at a Baltimore boat yard; Darko will be wearing a yellow backpack to make him identifiable to his buyer. The team is hopeful that Python is actually the one who bought the fullz and will show up in person to collect.

Darko is soon spotted arriving at the meeting spot. Before he can be arrested, he's hit in the chest by a sniper bullet. Several more shots ring out, and Elijah and his SWAT team swarm the location where they're coming from. They find that the sniper rifle is remotely controlled by a laptop; Python is nowhere in the vicinity. Before he succumbs to his injury, Darko tells Avery that Python's real name is located in his laptop. Back at headquarters, it's discovered that the laptop was infected with spyware, which is how Python knew where the meeting was being held. There appears to be nothing on the laptop regarding Python's real name.

The remote sniper rifle contains 12 different parts. They all have different serial numbers. were purchased by different people, and were used in different crimes; this includes the tripod, laptop, and ammunition. The thought is that these people could be members of Python's Deep Web criminal empire. Elijah tells Russell that Python runs a site called Squamata, which brings in over $30 million in drug revenue per year, a third of which is from college kids with easy access to the drugs.

Raven finds that the 12 people who purchased the sniper rifle parts all live at the same address, were born in the same hospital, and were delivered by the same doctor. These identities are all shelf babies, and their documents are flawlessly forged. The sniper rifle's remote commands were received through the Deep Web, making them untraceable and putting the team at another dead end.

Krumitz realizes that Python's name isn't in the laptop, it's in the laptop. He tells Nelson that extremely paranoid hackers hide the data they don't want found offline, which means the information is one of the laptop's parts. A chip is found hidden amongst the parts that traces to a Robert Corto, who has a New York address. Krumitz and Nelson believe that this is Python's real identity, as the chip also contains original source code from his Deep Web marketplace, Squamata. Their jubilation his short-lived, though, as Avery quickly determines that Robert is another shelf baby; he has the same address as the others. Krumitz wonders what else is on the chip, as Python wouldn't kill two people just to protect the identity of someone who doesn't exist. A large text file is found on the chip that appears to contain Python's journal entries from when he was younger. This is what he was after, as he was looking to erase a connection from his past. The hope is that the journal is the key to finding Python's real identity.

The journal entries show that Python started isolating himself from family and friends early in his life. One reason may have been his psoriasis, a hereditary condition where skin falls off. Because of this condition, "Python" was one of the nicknames kids gave him.

Raven and Russell take a deeper look into the 12 shelf babies who purchased parts for the sniper rifle. They find that the 12 names were all taken from novels, as were the bits of background information created for them (street names, hospitals, etc.). There's only one name that doesn't match any known novel: Renetta Wilkerson. Avery believes that this person actually exists, noting that hackers can never completely walk away from their pasts. There are addresses for Renetta Wilkersons all over the country; however, a journal entry about a specific type of bird narrows the search down to the one who lives in Boulder, Colorado.

Renetta answers her door and confirms that she has a son named Dante, who she believes was abducted. Avery can see that she, too, suffers from psoriasis. She leads Avery to Dante's childhood bedroom, which is filled with video game consoles and spare computer parts. The only picture of Dante in the house is one on a milk carton from when he went missing. Avery's attention turns to a brand new computer in the living room. Renetta explains that she's constantly entering sweepstakes. Shortly after Dante disappeared, she actually won one, entitling her to a free computer with a yearly upgrade for life. Avery stares at the camera in the computer and gives Dante a message: "Call me."

Dante obliges, soon realizing that Avery and the FBI have infiltrated his mother's house. Avery pushes his buttons, zeroing in on the fact that he had no friends growing up and that he was still wetting the bed when he was a teenager. Dante congratulates her on her minor victory and vows to have his website back up and running tomorrow. "This is war," he threatens, before he hangs up and smashes his phone. Avery catches the slip-up, noting that the team doesn't know where the Squamata site is hosted and that them taking it down is already a foregone conclusion. She realizes that Dante is hosting the site somewhere in the house. Krumitz finds a server blade hidden in an old computer in Dante's bedroom. It's confirmed that this is the computer hosting Squamata. Suddenly, the files start to get deleted; Dante is deleting everything that connects him to the Deep Web. Avery responds by unplugging the computer and stopping the process.

With this, Dante's drug empire has been shut down; the Cyber team has a complete list of every supplier, distributor, and buyer who ever logged on. Krumitz informs Nelson and Raven that Dante was spying on his mother and learning her habits. When she was out of the house, he snuck in and installed the server blade.

The photo from the milk carton is put through age progression software, providing the team with a close approximation of what Dante looks like today. Avery updates the top ten most wanted list, adding Python's real name and age-progressed photo to the file. Miguel informs her that Interpol agents in eight different countries just hit Dante's biggest suppliers and distributors, resulting in the seizure of hundreds of kilos of narcotics and over 90 arrests.

While Dante's site has been taken down, Avery knows that he'll be back. She soon opens her laptop and finds a handprint in the middle of the screen. When dusted, the fingerprints match the ones pulled off of Dante's server blade—the print belongs to Dante Wilkerson himself. He was in Avery's office at some point, and she realizes that she passed him earlier. Dante was disguised as a maintenance man, and he had forged a badge to grant him access to Cyber's headquarters. With this kind of physical access, Avery realizes that Dante could've put something in the network that might not be found until it's too late. She orders that everything be swept—this is war.


Main Cast[]

Guest Cast[]

  • Veronica Cartwright as Renetta Wilkerson
  • Evan Jones as Python/Dante Wilkerson
  • Diogo Morgado as Miguel Vega
  • Julien Ari as Bernie Renard
  • Andrew Miller as Rupert Flemming
  • Allen Theosky Row as Drago/Teddy Frankie
  • Sam Towers as Jake


  • Python was first mentioned by Avery in the episode Why-Fi and would later appear in the episode Python's Revenge.

See Also[]

CSI:Cyber Season 2
Why-FiHeart MeBrown Eyes, Blue EyesRed CroneHack E.R.Gone in 6 SecondsCorrupted MemoryPythoniWitnessShades of Grey404: Flight Not FoundGoing ViralThe Walking DeadFit-and-RunPython's Revenge5 Deadly SinsFlash SquadLegacy