The Evil Twin


The Evil Twin

Season	1
Number	6
Writer	Pam Veasey
Director	Rob Bailey
Original Airdate	April 15, 2015
Navigation
Previous Episode: Crowd Sourced
Next Episode: URL, Interrupted

The Evil Twin is the sixth episode in Season One of CSI: Cyber.

Synopsis[]

Avery and her team investigate the murder of a woman whose electronic devices indicate that she was alive for three days after her official time of death.

Plot[]

Hospitality hack - hacking a hotel's computer network to prey on employees and guests.

In New York City, Elijah corners an unseen suspect on the roof of a high-rise apartment building. The suspect then gets onto the ledge and steps off backwards before Elijah can presumably save him.

Ten hours earlier, Elijah is informed that the Kirkendahl Hotel in New York has had their computer network hacked; the network connects every location worldwide. According to the file, the hotel's computer intrusion detection system went off three days ago. It occurred again after the system was reset, meaning they're looking at more than just a glitch.

There's evidence of a cyber intrusion, and the hotel's Wi-Fi has been compromised. This means that the hacker would have access to the corporate computers and the guests' personal devices. Elijah points out that the United Nations is headquartered next door, raising the stakes even more. The thought is that either the guests are being targeted or this is an attack against the Kirkendahl corporation; either way, documents could be released that could expose some very important people.

Avery and Elijah head to New York and speak with Elaine, the hotel's in-house lawyer. According to her, the hotel's Wi-Fi has been shut down and nobody has reported any suspicious activity on their electronic devices. She's also unaware as to whether anyone has clicked any pop-up alerts, which would deliver malware into the system and allow the hacker to see a guest's room number, last name, and passwords once they connected to the Wi-Fi. Elaine is informed that shutting down the Wi-Fi won't stop such an attack, as some programs are designed to lay it wait for extended periods of time. Deleting documents also won't help, as they'll still exist in the cyber world and can be obtained by hackers.

Elaine is rightfully concerned, as guests of the hotel have their names and addresses on file, despite some checking in under aliases. Some of those guests engage in activities they prefer to keep confidential, and hotel employees also send texts and emails containing confidential company information. Elaine soon gets a call alerting her that everything the hotel security system recorded in the last week has been wiped; the system was also connected to the Wi-Fi. From this, Avery concludes that the hacker isn't interested in the confidential files. Something happened at the hotel, and the hacker is trying to cover it up.

The hotel manager is then seen knocking on the door of guest Adel Foster, whose loud music is disturbing the neighboring guests. When he enters the room and shuts the music off, he finds signs of a struggle. Adel's bloodied body is soon found in the bathtub. She has a contusion on her forehead, and bruises on her wrists indicate a crime of passion. Her phone is found in the plumbing; the killer tried destroying the phone, then flushed it down the toilet. This will make data recovery tough, as the water likely corroded the connectors. The hotel's invoice shows that Adel has recently ordered food, spa services, laundry, and movies. However, when the medical examiner places her death at three days ago, questions arise. How did housekeeping never find the body? Furthermore, how can someone who's been dead for three days make all these charges and requests to the room?

Raven discovers that the hotel's computer system is run by one central software package called the "Digital Butler." Malware was detected on the server; it was sent to every employee hidden inside a party invitation. The hacker found their way into Adel's guest room records and made it look like she was alive days after she was already dead. Furthermore, nobody ever entered the room because the digital "Do Not Disturb" sign was enabled; the sign is also controlled by the computer system. Nelson demonstrates how hacking into the system can control everything from room assignments and check-ins/check-outs to things in the room, such as the television to the thermostat. The hacker created orders for various services to make it look like Adel was still alive. In other words, someone is finding a very sophisticated way to cover up a murder.

Raven goes back to the employee party invitation where the malware was embedded, discovering that the hacker forgot to anonymize the auto confirmation email after someone RSVP'd. The IP address is traced to Evan Wescott, who is arrested at the club where he works. While being detained, he claims to not know who Adel is, adding that he doesn't even know how to hack into someone's computer.

Under interrogation, Evan continues to maintain his innocence. However, the location services on his cell phone place him in the hotel at the time of Adel's murder. Furthermore, the elevation listed is roughly seven floors up, and Adele was staying in room 715. Text messages are recovered from Evan's phone that seem to show he and Adel had recently ended a relationship; however, he claims to not have sent the texts and once again says that he doesn't know anyone named Adel. Surveillance footage from the club seems to prove otherwise, as Evan was caught getting intimate with her on the night of her murder. He claims he never left the club that night and that he didn't kill anyone; however, his devices seem to tell a different story.

Avery speaks with Adel's distraught boyfriend, Shane. He says that Adele took the trip to New York alone while he worked his two part-time jobs. During the conversation, Avery notices bruises and scrapes on Shane's hand; she also tries to get a reading from him based on his mannerisms.

Krumitz rebuilds Adele's phone and restores it to working condition; however, upon looking through her text messages, he finds a problem. The threatening text messages sent from Evan to Adel are nonexistent, something verified by Evan's service provider. Krumitz demonstrates to Simon that a sophisticated hacker can manipulate files and make it look like you're getting text messages from whoever you want whenever you want. The hacker wouldn't even need physical access to Evan's phone; furthermore, since Evan's phone doesn't have the software necessary to manipulate the database, the hacking had to have been done remotely. Even the GPS coordinates that placed Evan in the hotel at the time of the murder were faked. Evan's devices were hacked, which means it's unlikely he was the one who injected malware into the hotel's system. Someone is framing him for murder.

Krumitz, Nelson and Raven each hypothesize how the hacker could've gained access to Evan's devices. The conclusion is that the best way would be to wait for him to connect to an open Wi-Fi signal somewhere. He visits a coffee shop called Carla's Café almost every day, and the network logs on his laptop indicate that he connected to the shop's Wi-Fi the morning after the murder. Avery and Elijah go the café, where they learn that the Wi-Fi went down three days ago. Evan's laptop suggests that he was long gone by then, but Avery wonders if someone set up a twin router. Using his phone, Elijah demonstrates how easy it is to set up a fake Wi-Fi simply by opening up a personal hotspot and creating a realistic Wi-Fi name. The thought is that the target eliminated the real Wi-Fi, leaving just the fake one. Evan then logged onto the fake Wi-Fi, allowing the target to gain control of his device and push any information he wanted onto it. Elijah guesses that the target had his own router hidden somewhere, which would allow him to carry out these actions.

Nelson believes that Evan is framing himself; however, he has no motive and no definitive connection to Adel. Avery notes that the beauty of an open Wi-Fi hack is its sheer randomness. The killer could've framed anyone for Adel's murder, but he specifically chose Evan. It's no coincidence that Adel went to the club on the night of the murder and Evan ended up at the café at the same time as the twin router the following morning. The attack seems to be personal, as someone has gone to great lengths to link Evan to the hotel hack and frame him for murder.

Raven is able to identify the router used to hack the café and tracks its purchase to a big box store. The point of sale puts Adel's boyfriend, Shane Tillman, at the register. Shane is nowhere to be found when his New Jersey apartment is searched, but Avery is able to piece details together from the mess. She realizes that Adel was running away from Shane, not visiting New York on vacation. The discoloration of the bruises on her wrists indicate that she was in a long-term abusive relationship. When she got up the courage to leave, Shane started drinking. He then followed her to New York and killed her. When an opened box of cartridge cases is found under Shane's bed, it becomes clear what his next move is going to be.

Krumitz is able to recover the deleted search history from Shane's laptop. The history shows visits to New York news websites tracking Adel's murder investigation. This seems to indicate that he knows the police are onto him and he's trying to stay two steps ahead. Shane also visited a cell phone locating website; the area code he was looking up is a New York area code, meaning he's tracking someone else. Shane is actually tracking Evan Westcott, and he's soon seen tucking a gun into his waistband and entering the club where Evan works.

Shane holds Evan at gunpoint and blames him for taking Adel away. He recalls being in the club the night Adel and Evan shared a kiss; this sent Shane over the edge. Elijah and the SWAT team soon arrive. After briefly taking a woman hostage, Shane lets her go and disarms himself per Elijah's request. However, he creates a diversion by throwing a glass and runs up to the roof, where Elijah eventually confronts him. Believing he has nothing left, Shane gets on the ledge and steps backwards. Elijah is able to grab Shane's hand before he falls to his death and brings him back to safety. As Shane is arrested, tears start falling from his eyes.

Though Shane has been arrested, there still needs to be evidence that puts him in the hotel room at the time of Adel's murder. Krumitz, Nelson and Raven recover the motion tracking chip from Shane's phone, which collects and stores motion data. The data from both Shane's and Adel's phones are synced up to the last time Adel moved before she was murdered. Since most people keep their phones in their pants pockets, the phones were likely recording movements. The reenactment shows that Shane and Adel got into a fight, which ended when Adel fell backwards into the tub, hit her head, and died. Not only does this put Shane in the room at the time of the murder, it proves that he's a killer.

In interrogation, Shane is informed that he covered his tracks from every possible angle, but he forgot to manipulate the motion tracking chip. He's shown the reenactment that proves he's guilty of murdering his girlfriend.

Cast[]

Main Cast[]

Guest Cast[]

Justin Bruening as Evan Wescott
Heather McComb as Elaine
Kelly Albanese as Adel Foster
John Allsopp as Hotel Manager
Kristopher Higgins as Shane Tillman
Vanessa R. Flaherty as Elaine's Assistant
Kelly Richardson as Waitress
Alysson Da Silva as Civilian

Music[]

Rocky IV by IRN MNKY

< Crowd Sourced	CSI:Cyber Season 1	URL, Interrupted >
Kidnapping 2.0 • CMND:\Crash • Killer En Route • Fire Code • Crowd Sourced • The Evil Twin • URL, Interrupted • Selfie 2.0 • L0m1s • Click Your Poison • Ghost in the Machine • Bit by Bit • Family Secrets