1 00:03:56,485 --> 00:03:58,737 We'll dock in the Rotterdam boat terminal. 2 00:03:58,863 --> 00:04:01,574 Port side, long side, I'll pilot you in. 3 00:04:01,699 --> 00:04:03,909 Third mate, we'll guide you in. 4 00:04:24,180 --> 00:04:25,598 Yeah, he's just on board. 5 00:04:25,723 --> 00:04:28,183 It's the harbormaster, he wants to talk to you. 6 00:04:39,945 --> 00:04:42,614 - Sorry. You do not enter into Rotterdam. - Eh? 7 00:04:42,740 --> 00:04:44,992 - Your insurance has been revoked. - What? 8 00:04:45,117 --> 00:04:48,078 We received an automated notice, something to do with the value of your cargo. 9 00:04:48,204 --> 00:04:50,664 My cargo's the same cargo I run twice a month. 10 00:04:50,790 --> 00:04:53,250 '200,000 tons of soya beans.' 11 00:04:53,375 --> 00:04:55,919 'The value's changed. You're under-insured. 12 00:04:56,045 --> 00:04:58,464 'Put her in dead-slow and head for the anchorage.' 13 00:07:23,400 --> 00:07:26,945 Check any connections open to the internet. Wait... 14 00:07:28,656 --> 00:07:30,866 I'm FBI Special Agent Carol Barrett. 15 00:07:30,991 --> 00:07:34,035 Jeff Robichaud, IT Director. I'll be right with you... 16 00:07:35,120 --> 00:07:37,664 Frank, any luck on the IDS? 17 00:07:39,750 --> 00:07:44,250 So, Robichaud... how'd it get in? 18 00:07:48,884 --> 00:07:50,719 We don't know. 19 00:07:51,428 --> 00:07:54,472 Mr. Robichaud, someone's on I think you'll want to talk to. 20 00:07:54,598 --> 00:07:56,683 He's calling from China. 21 00:08:04,400 --> 00:08:08,737 We know your servers were hacked, and soy was driven up. 22 00:08:08,862 --> 00:08:11,155 We'd like to have a look at the code in the malware. 23 00:08:11,281 --> 00:08:13,950 "You're talking about something that isn't public knowledge here, 24 00:08:14,076 --> 00:08:15,202 'let alone in China.' 25 00:08:15,327 --> 00:08:19,414 Let's suppose you're right. Who's my first suspect? 26 00:08:19,540 --> 00:08:23,669 Listen, my country buys 58 million tons of soy annually. 27 00:08:23,794 --> 00:08:26,338 We're an importer. It's not a price we wanna see go up. 28 00:08:26,463 --> 00:08:29,841 Even if I buy that, why should we send the code to you? 29 00:08:30,926 --> 00:08:33,762 We're gonna get it anyway, but it'll take us longer on our own. 30 00:08:33,887 --> 00:08:37,640 Meanwhile, it's affecting food prices here, and drastically. 31 00:08:37,766 --> 00:08:42,266 "You have to move fast, because the breach questions your trading integrity. 32 00:08:43,355 --> 00:08:45,440 'We're both in the race and we wanna be quick.' 33 00:08:46,150 --> 00:08:49,778 Together, maybe we can get there faster, so if your side has any interest 34 00:08:49,903 --> 00:08:53,615 in partnering In some joint liaison group, well... 35 00:08:54,241 --> 00:08:56,451 'Well, we'd be willing to work with you.' 36 00:09:02,666 --> 00:09:04,751 What do we know about this guy? 37 00:09:05,544 --> 00:09:08,630 His grandfather was a military commander in Shanghai in the '20s, 38 00:09:08,756 --> 00:09:11,675 in the '30s against the Japanese through the Civil War. 39 00:09:11,800 --> 00:09:15,136 His father became China's Undersecretary for Trade to the UN. 40 00:09:15,262 --> 00:09:18,682 He came with to New York. Bronx High School of Science, MIT. 41 00:09:18,807 --> 00:09:20,892 His sister's a network engineer in the private sector. 42 00:09:21,018 --> 00:09:23,729 - She grow up in New York, too? - No. 43 00:09:24,313 --> 00:09:27,316 He's a rising star in PLA's Cyber Defense section. 44 00:09:27,441 --> 00:09:29,359 Liaise with them? 45 00:09:30,027 --> 00:09:32,612 It's inviting them into the henhouse, Carol. 46 00:09:32,738 --> 00:09:35,157 Stanley, we go head-to-head with the Chinese 47 00:09:35,282 --> 00:09:37,701 on their cyber intrusion every day of the week. 48 00:09:37,826 --> 00:09:42,038 Not a bad idea to be face-to-face working with them, for once. 49 00:09:43,415 --> 00:09:46,334 Drawbacks of giving up the code? 50 00:09:46,460 --> 00:09:49,379 None. It'll surface anyway. 51 00:09:52,674 --> 00:09:57,174 You monitor very closely what they do and do not have access to. OK? 52 00:10:02,101 --> 00:10:03,727 Send the code. 53 00:11:06,748 --> 00:11:09,000 Let's go somewhere we can talk. 54 00:11:18,343 --> 00:11:20,970 English might be better. Come on. 55 00:11:25,893 --> 00:11:29,187 Chicago? Tomorrow, it's impossible. 56 00:11:29,313 --> 00:11:30,939 - I can't. - Why not? 57 00:11:31,064 --> 00:11:34,442 I've got a network that's got to be up in 17 days. 58 00:11:34,568 --> 00:11:36,027 They sent me some code tonight. 59 00:11:36,153 --> 00:11:38,822 The black hat hit the Mercantile Trade Exchange in Chicago, 60 00:11:38,947 --> 00:11:41,991 rocketed soy through the roof, rode the run-up and... 61 00:11:42,117 --> 00:11:44,494 when I looked at the code, it was, er... 62 00:11:46,288 --> 00:11:47,706 And? 63 00:11:47,831 --> 00:11:51,167 I have to have a network engineer with me I can trust. 64 00:11:52,461 --> 00:11:54,087 Really trust. 65 00:11:55,505 --> 00:11:57,340 Like 100%. 66 00:12:10,312 --> 00:12:12,147 When do we leave? 67 00:12:23,325 --> 00:12:26,244 How it got loaded in in the first place, we don't know. 68 00:12:26,370 --> 00:12:28,663 But once it got in, here's how it cracked our firewall. 69 00:12:28,789 --> 00:12:33,289 It masqueraded as a software update, complete with a legit digital signature, 70 00:12:33,460 --> 00:12:37,960 and it became what it really is: a remote access tool, a RAT. 71 00:12:39,007 --> 00:12:42,635 The RAT's job was to open a back door in our system and call home. 72 00:12:42,761 --> 00:12:47,261 The black hat then used his back door to inject a second part: its payload. 73 00:12:49,559 --> 00:12:51,727 That is what rode up soy. 74 00:12:51,853 --> 00:12:54,105 Now that we're looking at the two programs closely, 75 00:12:54,231 --> 00:12:56,566 - we're thinking they were... - Written by different authors. 76 00:12:59,069 --> 00:13:02,238 How we figured that out was through the language in the RAT. 77 00:13:02,364 --> 00:13:05,367 Though several years old, it's lean, graceful. 78 00:13:05,492 --> 00:13:08,912 The payload's coding, on the other hand, feels frenetic, confused... 79 00:13:09,037 --> 00:13:11,330 Frenetic? Or overwritten? 80 00:13:13,375 --> 00:13:15,126 So, the question we're dealing with is... 81 00:13:15,252 --> 00:13:18,171 - Is there somewhere we can talk? - ...how many actors are we looking for? 82 00:13:18,297 --> 00:13:20,048 I guess it's two. 83 00:13:20,173 --> 00:13:24,673 And if it is two, they may not be working from the same area... 84 00:13:32,602 --> 00:13:35,229 Daniels is qualified in computer forensics. 85 00:13:35,355 --> 00:13:37,523 An intern could've written that report. 86 00:13:37,649 --> 00:13:40,568 The point is, we don't have time to pace ourselves by the slowest guy in the room. 87 00:13:40,694 --> 00:13:43,071 Oh, really? And who do we need if not Daniels? 88 00:13:43,196 --> 00:13:45,865 And "liaise" in "liaison group" implies mutuality. 89 00:13:45,991 --> 00:13:49,077 You don't like our boy, what ideas are you bringing to the dance? 90 00:13:49,202 --> 00:13:50,912 A man named Hathaway. 91 00:13:51,038 --> 00:13:55,000 He's a convicted hacker serving 15 years in USP Canaan in Waymart, Pennsylvania. 92 00:13:55,125 --> 00:13:59,625 You're telling me some hacker in prison is hitting our financial markets? 93 00:13:59,796 --> 00:14:03,966 No, but we want Hathaway on the team so he can help out the investigation. 94 00:14:08,722 --> 00:14:10,932 You must be kidding. 95 00:14:11,058 --> 00:14:15,270 He hit four major banks, ran up $46 million in damages. 96 00:14:15,395 --> 00:14:17,605 And that's just what we know about. 97 00:14:17,731 --> 00:14:20,942 You want the DOJ to do anything other than laugh? 98 00:14:26,114 --> 00:14:28,407 Daniels said two authors wrote the virus. 99 00:14:28,533 --> 00:14:31,661 I don't know who wrote the second half, but the first half, the RAT, 100 00:14:31,787 --> 00:14:35,373 the remote access tool that Daniels called "lean and graceful"? 101 00:14:36,333 --> 00:14:38,918 Well, one of the original authors is me. 102 00:14:39,544 --> 00:14:43,839 I co-wrote it... as a gag, years ago at MIT. 103 00:14:43,965 --> 00:14:47,760 And my roommate, the genius lead author? 104 00:14:47,886 --> 00:14:50,346 - Nicholas Hathaway. - That's right. 105 00:14:51,264 --> 00:14:54,475 The hacker found the RAT online and modified it. 106 00:14:55,227 --> 00:14:59,022 If we wanna move around within this code looking for clues to the hacker's identity, 107 00:14:59,147 --> 00:15:01,274 we need its lead architect. 108 00:15:39,938 --> 00:15:43,274 Hathaway! Hands behind you. 109 00:16:03,378 --> 00:16:04,796 Go, go, go! 110 00:16:09,968 --> 00:16:11,803 Search everything. 111 00:16:17,976 --> 00:16:20,228 - Get off that! - Hey! Take him down! 112 00:16:26,943 --> 00:16:28,986 One, two, three, up! 113 00:17:01,311 --> 00:17:03,354 A spike in soy futures. 114 00:17:05,232 --> 00:17:08,735 I didn't know any of this. We don't get a lot of new news in here. 115 00:17:08,860 --> 00:17:11,904 The US government would like your technical advice on this. 116 00:17:12,030 --> 00:17:15,992 In exchange for that, we're gonna furlough you right outta here. 117 00:17:16,117 --> 00:17:20,121 You sign that on the last page, and we'll get you processed. 118 00:17:23,124 --> 00:17:25,960 You'll wear an ankle bracelet and be accompanied by a US Marshal. 119 00:17:26,086 --> 00:17:28,630 Your computer access will be restricted. 120 00:17:28,755 --> 00:17:31,883 If you wanna study the whole document, you can go right ahead. 121 00:17:32,467 --> 00:17:34,802 I can come back in a month or two. 122 00:17:39,891 --> 00:17:41,851 No, I'm done. 123 00:17:44,729 --> 00:17:46,939 - You didn't sign it. - Yeah, why would I sign it? 124 00:17:47,065 --> 00:17:49,692 Why? Because of the generosity of the Assistant US Attorney 125 00:17:49,818 --> 00:17:51,194 in granting you a furlough. 126 00:17:51,319 --> 00:17:55,031 You and the Assistant US Attorney can stick that document up your ass. 127 00:17:55,156 --> 00:17:57,950 - I'm sorry? - Why are you sorry? 128 00:17:58,076 --> 00:18:00,745 I insulted you. What are you sorry for? I'm not sorry. 129 00:18:00,870 --> 00:18:02,705 - Don't think you're gonna... - Hey. 130 00:18:02,831 --> 00:18:06,793 You wanna raise me up outta here, solve your trade exchange dilemma, 131 00:18:06,918 --> 00:18:09,420 and I get a furlough for a couple of weeks? You kidding me? 132 00:18:09,546 --> 00:18:11,422 You have any idea how much progress you're gonna make 133 00:18:11,548 --> 00:18:14,425 on a strike this complex without someone like me? 134 00:18:14,551 --> 00:18:15,718 Zero. 135 00:18:15,844 --> 00:18:18,429 - This isn't a negotiation. - Well, I just made it one. 136 00:18:18,555 --> 00:18:21,099 You want me? You pass this upstairs. 137 00:18:21,224 --> 00:18:23,768 If my assistance results in the identification 138 00:18:23,893 --> 00:18:26,729 and the apprehension of the guy you're after, 139 00:18:26,855 --> 00:18:29,107 I want you to commute my sentence. 140 00:18:29,232 --> 00:18:32,360 If I come up empty, you toss my ass back in the can. 141 00:18:32,485 --> 00:18:35,070 Those are the terms. 142 00:18:35,196 --> 00:18:36,572 Guard. 143 00:18:36,698 --> 00:18:38,449 Interview's over. 144 00:18:47,125 --> 00:18:50,586 Barrett, how badly do you need this guy? 145 00:19:19,866 --> 00:19:22,243 It's so good to see you, bro. 146 00:19:27,248 --> 00:19:30,251 Not half as much as it is for me to see you. 147 00:19:34,422 --> 00:19:36,632 Let's get out of here. 148 00:20:11,084 --> 00:20:15,584 So you planned to reunite with your friend from the moment you landed? 149 00:20:15,964 --> 00:20:17,966 It entered my mind. 150 00:20:47,370 --> 00:20:49,288 You OK? 151 00:20:51,583 --> 00:20:53,585 Yeah, I'm fine. 152 00:21:00,842 --> 00:21:04,470 OK. Please keep them out of sight, if you can help it. 153 00:21:04,596 --> 00:21:06,848 There was a malware. 154 00:21:07,599 --> 00:21:09,976 See? He ripped off and repurposed our code. 155 00:21:11,853 --> 00:21:13,563 - What the hell is this? - What? 156 00:21:13,688 --> 00:21:16,899 The agreement was an approval and a presence for his computer access. 157 00:21:17,025 --> 00:21:18,943 - I approved it. - A DOJ approval. 158 00:21:19,068 --> 00:21:21,862 - Now you're changing the goalposts? - Hola, chica. You came to me. 159 00:21:21,988 --> 00:21:24,615 How am I supposed to do my work? On an abacus or something? 160 00:21:25,283 --> 00:21:29,120 - "Chica"? Am I Hispanic? - What the hell's going on? 161 00:21:29,245 --> 00:21:30,454 I advocated getting you over here. 162 00:21:30,580 --> 00:21:33,207 I pulled every string to get your convicted felon sprung, Mr. Chen. 163 00:21:33,333 --> 00:21:35,126 Captain Chen. And I didn't ask. 164 00:21:35,251 --> 00:21:38,420 I offered partnership, an equivalent, or we would do it on our own. 165 00:21:38,546 --> 00:21:40,673 Well, I'll be happy to bust him back to Canaan 166 00:21:40,799 --> 00:21:42,842 and put your ass on the first plane back to China... 167 00:21:42,967 --> 00:21:44,468 He apologizes. 168 00:21:44,594 --> 00:21:47,972 My brother misunderstood our arrangement, Special Agent. 169 00:22:02,654 --> 00:22:04,906 I have to run the morning backup. 170 00:22:10,495 --> 00:22:13,998 Your network is sitting behind deep packet inspection, 171 00:22:14,123 --> 00:22:18,293 intrusion protection, it's extensively firewalled. 172 00:22:18,419 --> 00:22:20,379 Exactly. 173 00:22:20,505 --> 00:22:24,342 So somebody had to physically enter this room and plug the virus in. 174 00:22:24,467 --> 00:22:26,552 We reviewed keycard scans and surveillance tapes. 175 00:22:26,678 --> 00:22:28,096 There was no unauthorized entry. 176 00:22:28,221 --> 00:22:30,181 Now we're thinking about a routing weakness. 177 00:22:30,306 --> 00:22:32,099 That's too complicated. He wouldn't have done that. 178 00:22:32,225 --> 00:22:34,602 Yeah. Well, what you're proposing didn't happen. 179 00:22:34,727 --> 00:22:38,105 There's only one person who's authorized to access these terminals. 180 00:22:38,231 --> 00:22:40,983 Me. And my password is my thumbprint. 181 00:22:42,318 --> 00:22:45,904 Maybe you walked it in and infected your system unwittingly. 182 00:22:46,030 --> 00:22:48,365 I scan this routinely, it's dead clean. 183 00:23:18,104 --> 00:23:21,482 Right, this is the code for our RAT. It's compact, it's slick. 184 00:23:21,608 --> 00:23:23,484 Under a meg. You'd never have picked up on it. 185 00:23:23,610 --> 00:23:25,945 Ever leave that USB drive on your desk? 186 00:23:26,070 --> 00:23:27,196 I suppose so. 187 00:23:27,322 --> 00:23:30,408 Who works here who doesn't like you? Recently hired? Fired? 188 00:23:30,533 --> 00:23:31,951 No. 189 00:23:32,827 --> 00:23:35,704 - Who? - Lozano. 190 00:23:35,830 --> 00:23:37,748 His mother passed away. He left two weeks ago. 191 00:23:37,874 --> 00:23:40,293 John Lozano. He was only on the job for a month. 192 00:23:40,418 --> 00:23:42,420 - He had access to your office? - Yes. 193 00:23:42,545 --> 00:23:45,589 - I'll pull his employment records. - Everything will come up phony. 194 00:23:46,174 --> 00:23:49,260 Except this. You got his photo ID? 195 00:23:50,470 --> 00:23:51,888 Yeah. 196 00:23:52,013 --> 00:23:54,557 So he takes the RAT, injects it into your system, 197 00:23:54,682 --> 00:23:57,601 opens up a backdoor, down which he sends his payload. 198 00:23:57,727 --> 00:23:59,979 That jacks up soy futures. 199 00:24:00,104 --> 00:24:04,604 That's all very cool, but this section's code, right here, is a mess. 200 00:24:05,485 --> 00:24:09,985 There's 25 lines, he's left text, it looks incomplete. 201 00:24:10,531 --> 00:24:13,909 - Are they notes to himself? - Dead-end ideas? 202 00:24:14,744 --> 00:24:18,289 - Maybe he's still writing. - Yeah, that's good. 203 00:24:19,958 --> 00:24:23,211 If you've got the ability to move a commodity any way you want, what do you do? 204 00:24:23,336 --> 00:24:26,380 I play it out long and low-key. I do not do one big spike. 205 00:24:26,506 --> 00:24:29,550 Instead, I'd play it out month after month. Less risk of detection. 206 00:24:29,676 --> 00:24:34,097 Yeah, right. But our guy jacks soy 250% in a day. 207 00:24:34,222 --> 00:24:36,682 It's flashy. He knows he's gonna bring down heat. 208 00:24:36,808 --> 00:24:41,145 - He doesn't care why. - Maybe he needs cash. Fast. 209 00:24:41,980 --> 00:24:44,315 He's got some money from the soy run-up. 210 00:24:47,944 --> 00:24:51,197 And he's busy writing code for what's next. 211 00:24:57,954 --> 00:25:00,623 I think the real hit is still to come. 212 00:25:06,254 --> 00:25:08,631 We have Lozano's photo. 213 00:25:11,050 --> 00:25:12,885 What's on his neck? 214 00:25:13,011 --> 00:25:14,846 Kid had tattoos. 215 00:25:14,971 --> 00:25:17,473 You have any routine surveillance tapes? 216 00:25:22,812 --> 00:25:24,313 Right there. 217 00:25:33,531 --> 00:25:36,033 Face of Stone. 218 00:25:37,118 --> 00:25:38,911 - 'Pollack.' - If's me. 219 00:25:39,037 --> 00:25:41,456 Can you have someone jump on the NCAC database? 220 00:25:41,581 --> 00:25:45,543 Sort for Latino males under 30, with priors in... 221 00:25:46,419 --> 00:25:48,629 ...I don't know, anything like carding identity theft, 222 00:25:48,755 --> 00:25:51,841 who were in West Texas prison gangs. 223 00:25:51,966 --> 00:25:56,011 Our cowboy has a tattoo on his shoulder. He was with Los Zapatecos. 224 00:25:56,137 --> 00:25:58,973 'I'm sending you something right now.' 225 00:25:59,932 --> 00:26:02,100 That's him, in the bottom left. 226 00:26:05,021 --> 00:26:08,315 "Alonso Reyes. Did two years in Huntsville for carding. 227 00:26:08,441 --> 00:26:11,902 'Paroled. Moved back to LA. I'll have LA pick him up.' 228 00:26:12,028 --> 00:26:14,030 He's gonna monitor his home grid. I did. 229 00:26:14,864 --> 00:26:18,242 We got a better shot getting a first look at him ourselves. 230 00:26:20,203 --> 00:26:22,038 Isn't that why you brought me here? 231 00:26:23,790 --> 00:26:26,000 - OK? - 'Yeah, go ahead.' 232 00:26:27,418 --> 00:26:29,253 That means you and me are on the money. 233 00:26:29,378 --> 00:26:31,630 Unless you think you can do that on your own, too. 234 00:26:31,756 --> 00:26:33,758 - I do OK. - You do, huh? 235 00:26:33,883 --> 00:26:36,385 Let's see how you handle the financial sector. 236 00:26:37,637 --> 00:26:39,430 Thanks, Stanley. 237 00:26:55,279 --> 00:26:58,240 - My eyes are on you. - Where do you think I'm going? 238 00:26:58,366 --> 00:27:01,911 This guy's one step away from my "get out of jail free" card. 239 00:27:17,677 --> 00:27:20,638 So... how can I help? 240 00:27:20,763 --> 00:27:22,931 We'd like to see trading records for your traders 241 00:27:23,057 --> 00:27:25,934 who took large profits from the soy run-up. 242 00:27:29,605 --> 00:27:33,233 You're requesting I turn over records to the FBI and a foreign power 243 00:27:33,359 --> 00:27:36,362 on thousands of private brokers and traders? 244 00:27:36,487 --> 00:27:38,363 Afraid I can't possibly accommodate you. 245 00:27:38,489 --> 00:27:40,240 You'll protect the person who manipulated your market? 246 00:27:40,366 --> 00:27:43,077 No. You're casting your net way too wide, Mr. Chen. 247 00:27:43,202 --> 00:27:45,662 You want to see my data, you come up with something a little more tangible. 248 00:27:45,788 --> 00:27:49,541 Something more in the way of probable cause than your hunch. 249 00:27:53,838 --> 00:27:56,090 Gary... May I call you Gary? 250 00:27:57,175 --> 00:27:59,468 How's this for tangible? 251 00:27:59,594 --> 00:28:03,889 In the next 15 seconds, | call Laura Greer at the Commodities Trading Commission, 252 00:28:04,015 --> 00:28:05,641 and I say, "Laura, how you doing? 253 00:28:05,766 --> 00:28:09,770 "I'd like to launch an official investigation on one Gary Baker." 254 00:28:09,896 --> 00:28:13,149 So the headline, "M-Tech Official 255 00:28:13,274 --> 00:28:16,443 "Investigated for Aiding and Abetting Cyber Criminals” 256 00:28:16,569 --> 00:28:20,864 leaks to CNN in the next 90, so it makes the three o'clock news cycle, 257 00:28:20,990 --> 00:28:23,033 as well as the nightly news. 258 00:28:23,159 --> 00:28:24,994 That'd be good, too. 259 00:28:27,914 --> 00:28:29,957 Am I being tangible? 260 00:28:31,459 --> 00:28:32,960 Gary? 261 00:28:38,674 --> 00:28:40,300 Look around here. 262 00:28:40,426 --> 00:28:43,011 But I stay here with you. No take nothing. 263 00:28:43,137 --> 00:28:45,139 Yeah, you stay right with me. 264 00:28:58,736 --> 00:29:00,279 OK? Er... 265 00:29:22,593 --> 00:29:24,595 Hey, mi carnal? 266 00:29:25,596 --> 00:29:27,598 What happened to you? 267 00:29:57,712 --> 00:30:01,924 He has WRT hardware and an Onion router. 268 00:30:02,675 --> 00:30:07,175 He can route encrypted data and stay anonymous with no IP address. 269 00:30:11,350 --> 00:30:13,810 Yeah, somebody must've told him how to set it up. 270 00:30:26,198 --> 00:30:28,700 She probably called 911. 271 00:30:44,300 --> 00:30:48,012 - Who's the woman? - It's the manager, Mrs. Novo. 272 00:30:48,137 --> 00:30:49,888 Let me see it. 273 00:30:58,939 --> 00:31:01,024 Here, try it now. 274 00:31:03,110 --> 00:31:07,155 Barrett, this is Jessup. 275 00:31:11,494 --> 00:31:14,955 Reyes got an email about a drop tonight. 276 00:31:16,123 --> 00:31:18,542 With no Reyes, we gotta find a new link to our main player. 277 00:31:18,667 --> 00:31:20,960 I'm gonna see who shows. 278 00:31:21,087 --> 00:31:23,005 Did you tell Jessup? 279 00:31:23,130 --> 00:31:25,757 No. They'll spot him ten blocks away. 280 00:31:30,554 --> 00:31:32,222 I go, too. 281 00:32:39,039 --> 00:32:42,167 Why... are you in prison? 282 00:32:57,099 --> 00:33:01,186 I was in a bar, I met some girl, and some guy got in my face about her. 283 00:33:01,312 --> 00:33:05,107 He started a fight, and when it's over, he's in the hospital and I'm arrested. 284 00:33:05,232 --> 00:33:09,069 I wound up sentenced to 18 months at MCI-Norfolk. 285 00:33:09,195 --> 00:33:12,281 I traded academia for gladiator academy. 286 00:33:15,284 --> 00:33:18,328 - Then what? - Then I got out. 287 00:33:18,454 --> 00:33:21,707 I'm 22, and not a lot going on in Silicon Valley 288 00:33:21,832 --> 00:33:23,583 for an ex-con with no degree. 289 00:33:23,709 --> 00:33:25,377 - So... - Carding? 290 00:33:25,503 --> 00:33:28,130 Yeah, that, and I was in wholesaling internationally. 291 00:33:28,255 --> 00:33:32,755 I had an eight-year run, then the Feeb caught up with me, and I got 13 years. 292 00:33:34,345 --> 00:33:36,180 You have regrets? 293 00:33:37,056 --> 00:33:40,142 Regrets? No. The banks got hit for the losses, not people. 294 00:33:40,267 --> 00:33:42,811 I didn't burn people. I don't burn people. 295 00:33:42,937 --> 00:33:45,356 I mean, banks are chiseling everybody all the time, anyway. 296 00:33:45,481 --> 00:33:47,274 I don't feel sorry for banks, no... 297 00:33:47,399 --> 00:33:49,984 I mean, I'm sorry for what happened to you. 298 00:33:50,110 --> 00:33:53,863 Well, you know, don't be. I'm not fishing for sympathy here. 299 00:33:53,989 --> 00:33:57,367 I did the crime, I'm doing the time, time isn't doing me. 300 00:33:57,493 --> 00:34:01,330 - What's that mean? - I do my own time, not the institution's. 301 00:34:01,455 --> 00:34:05,167 To hold onto who you are in there, you dedicate yourself to your program. 302 00:34:05,292 --> 00:34:08,128 You work out on your body and your mind. 303 00:34:16,262 --> 00:34:20,762 You talk like you are still in prison. But you're not in prison... 304 00:34:21,559 --> 00:34:23,519 What do you know about where I've been? 305 00:34:23,644 --> 00:34:25,687 - No, nothing. But... - No, nothing. 306 00:34:25,813 --> 00:34:28,690 Tell me, what is it I'm supposed to start seeing so fast? 307 00:34:28,816 --> 00:34:32,611 The people against you are high-speed, world-class dangerous. 308 00:34:32,736 --> 00:34:37,236 To be a genius coder, to outsmart, out-think like my brother always said you could, 309 00:34:38,492 --> 00:34:40,911 you have to think about it clear. 310 00:34:42,705 --> 00:34:46,834 Not easy, I know. There's no transition time. 311 00:34:46,959 --> 00:34:48,377 But... 312 00:34:50,129 --> 00:34:52,673 ...| believe you are a very strong man, very smart man. 313 00:35:09,857 --> 00:35:11,275 Here, Chen. 314 00:35:11,400 --> 00:35:13,652 Three trades. Three different accounts. Large volumes. 315 00:35:13,777 --> 00:35:18,277 They all sell within minutes of each other. Just at the soft close, at 13:13 and 13:14. 316 00:35:19,950 --> 00:35:21,952 Timed perfectly when to dump. 317 00:35:23,162 --> 00:35:24,830 What's that? 318 00:35:24,955 --> 00:35:28,083 Bank accounts. Foreign. 319 00:35:28,208 --> 00:35:31,878 Overseas. Same place, all three. 320 00:35:32,004 --> 00:35:33,547 What country? 321 00:35:34,715 --> 00:35:36,299 Hong Kong. 322 00:35:41,347 --> 00:35:44,600 You want your bill? You not order more, you give up table. 323 00:35:45,684 --> 00:35:48,228 You're really hurting for space, huh? 324 00:35:52,691 --> 00:35:55,026 Maybe our guy is a no-show. 325 00:36:26,141 --> 00:36:27,809 What is it? 326 00:38:50,244 --> 00:38:52,746 - Let's go. - What's happening? 327 00:38:55,374 --> 00:38:57,209 Who are you? 328 00:38:57,835 --> 00:39:01,004 Why are you here? Who are you? 329 00:39:24,862 --> 00:39:26,613 Watch out! 330 00:39:46,842 --> 00:39:48,593 Hey! 331 00:39:55,976 --> 00:40:00,188 And Reyes was killed. The email on his computer was bait. 332 00:40:00,314 --> 00:40:02,232 You and me, we're burned. 333 00:40:07,946 --> 00:40:11,532 "Whoever this is wanted to see if we were on Reyes' trail.' 334 00:40:12,534 --> 00:40:14,369 Could you track it to our guy's location? 335 00:40:15,037 --> 00:40:18,623 No, the video feed went through a proxy server in the Ukraine. 336 00:40:18,749 --> 00:40:20,876 Who knows where it bounces to off that? 337 00:40:21,001 --> 00:40:24,421 Yeah, and our players are foreign, too. 338 00:40:24,546 --> 00:40:26,965 "Three accounts, all in the same place.' 339 00:40:27,090 --> 00:40:30,843 They took $74 million. We're gonna follow the money. 340 00:40:30,969 --> 00:40:33,805 - 'Where?"' - Put my sister on. 341 00:40:47,486 --> 00:40:49,988 We're flying to Hong Kong in the morning. 342 00:42:46,313 --> 00:42:48,315 Clock the Suzuki? 343 00:42:48,440 --> 00:42:50,483 Yeah, I saw him. 344 00:42:50,609 --> 00:42:52,694 We'll see him again. 345 00:42:52,819 --> 00:42:55,905 Four cars behind is a black Toyota that was at the airport. 346 00:42:56,031 --> 00:43:00,035 Disappeared, now it's back. Someone's doing a revolving tail. 347 00:43:27,938 --> 00:43:30,607 - Hi. How may I help you? - Lien Chen. 348 00:43:30,732 --> 00:43:32,150 Sure. 349 00:43:34,277 --> 00:43:36,279 These are your room keys. 350 00:43:37,823 --> 00:43:41,117 - Anything else? - Access to a service elevator. 351 00:43:42,035 --> 00:43:43,453 Right this way. 352 00:45:26,097 --> 00:45:27,640 - You guys clean? - I think so. 353 00:45:27,766 --> 00:45:29,893 Definitely surveillance on us, right up to the Ritz Carlton. 354 00:45:30,018 --> 00:45:32,020 Welcome to our Ritz. 355 00:45:35,649 --> 00:45:38,735 Inspector Alex Trang, Hong Kong Police. 356 00:45:39,486 --> 00:45:41,946 Hathaway. US Marshal Mark Jessup. 357 00:45:44,699 --> 00:45:48,577 - Is this them? Are these the guys? - Yeah. 358 00:45:48,703 --> 00:45:50,287 We got anything? 359 00:45:51,915 --> 00:45:56,415 Here they are. Johnny Li, Yan Lin, Samuel Wu. 360 00:45:57,128 --> 00:45:59,130 Li just got out of prison two months ago. 361 00:45:59,256 --> 00:46:01,341 Yan and his mother are both junkies. 362 00:46:01,466 --> 00:46:05,052 Wu runs a chop shop. Hardly commodities speculators. 363 00:46:06,054 --> 00:46:08,514 They are fronts. Proxies. 364 00:46:14,980 --> 00:46:18,066 So how do they communicate? How do they connect up to our actor? 365 00:46:18,191 --> 00:46:21,194 They don't. Phones, the internet. 366 00:46:21,319 --> 00:46:24,655 And we've been on them all day and all night. Nothing. 367 00:46:25,865 --> 00:46:29,285 If you were our player right now, what would be your next move? 368 00:46:29,411 --> 00:46:30,995 I'd make my trail go cold. 369 00:46:31,121 --> 00:46:32,539 - How? - I'd cash out. 370 00:46:32,664 --> 00:46:36,209 Cash money doesn't leave a trail. Pick it up, walk it anywhere you want. 371 00:46:36,334 --> 00:46:40,504 But the money hasn't moved yet. There's no activity in the accounts. 372 00:46:44,092 --> 00:46:45,551 Yeah, this is all too clean. 373 00:46:45,677 --> 00:46:47,553 There's gotta be somebody between them, 374 00:46:47,679 --> 00:46:49,931 talking to them, instructing them, telling them what to do. 375 00:46:50,056 --> 00:46:52,183 There has to be someone in contact. 376 00:46:52,309 --> 00:46:54,519 It wouldn't be the main player. Too much exposure. 377 00:46:54,644 --> 00:46:56,604 A middle man? 378 00:46:58,231 --> 00:47:00,316 They didn't all fall by here by accident either. 379 00:47:00,442 --> 00:47:02,944 - Where? - Can I see this? 380 00:47:10,160 --> 00:47:13,246 They overlap. 381 00:47:14,205 --> 00:47:16,415 Right there. Where's this? 382 00:47:18,168 --> 00:47:20,628 Yau Ma Tei. 383 00:47:30,889 --> 00:47:32,640 Great. 384 00:48:01,378 --> 00:48:03,671 OCTB. We're running a surveillance. 385 00:48:03,797 --> 00:48:05,131 On whom? 386 00:48:05,256 --> 00:48:08,050 Some Lebanese guy on our trafficker watch list. 387 00:48:08,176 --> 00:48:09,635 Why here? 388 00:48:10,387 --> 00:48:12,889 Every morning he comes here to meet someone. 389 00:48:13,014 --> 00:48:17,393 - Why'd you let him in? - See if he's about ready homegrown. 390 00:48:17,519 --> 00:48:19,771 Run him down. 391 00:48:26,903 --> 00:48:29,030 Elias Kassar. 392 00:48:29,155 --> 00:48:32,825 Fought with the Christian Phalangists in the Civil War, then disappeared. 393 00:48:32,951 --> 00:48:37,413 Popped up in the '90s with the paramilitaries in Colombia. 394 00:48:37,539 --> 00:48:40,291 Renting a house month-to-month in Shek O. 395 00:48:40,417 --> 00:48:42,168 Who does he meet? 396 00:48:42,293 --> 00:48:44,712 No one. No one ever shows. 397 00:48:45,880 --> 00:48:47,548 He texts. 398 00:49:30,884 --> 00:49:32,677 Is your phone an Android? 399 00:49:35,054 --> 00:49:36,638 Can I see it? 400 00:50:14,302 --> 00:50:15,720 Trang. 401 00:50:43,414 --> 00:50:47,914 Bluetooth transmitter. Short range, we would never pick it up. 402 00:50:50,129 --> 00:50:53,465 See, they don't come to meet him. They come to meet this. 403 00:50:53,591 --> 00:50:56,260 Kassar texts. Wu, Yan and Li walk by. 404 00:50:56,386 --> 00:50:59,847 The receivers in their pockets pick it up. They read it, delete it. 405 00:50:59,973 --> 00:51:01,724 Kassar never meets them, never sees them. 406 00:51:01,849 --> 00:51:04,518 No emails. No phones. No nothing. 407 00:51:04,644 --> 00:51:06,979 - Slick. - Can you crack it? 408 00:51:07,105 --> 00:51:10,608 In about a month. See, it's locked in GPG encryption. 409 00:51:12,026 --> 00:51:14,236 So, at least a 512-bit key. 410 00:51:15,113 --> 00:51:17,824 We pick him up, lean all over him. 411 00:51:17,949 --> 00:51:20,284 Or we let him ride and tail him to the main player. 412 00:51:20,410 --> 00:51:23,871 You don't have a choice. This guy's history, he ain't gonna roll. 413 00:51:26,708 --> 00:51:28,710 I think we let him ride. 414 00:51:35,967 --> 00:51:39,011 Put it back. Sunrise is in two hours. 415 00:52:04,162 --> 00:52:08,583 When this is over... what will you do? 416 00:52:12,128 --> 00:52:15,673 I don't know. Fix TVs, garage door openers. 417 00:52:16,841 --> 00:52:20,261 Are you still gonna like me if I'm fixing garage door openers? 418 00:52:23,222 --> 00:52:25,182 I don't know. Maybe. 419 00:54:01,320 --> 00:54:03,488 They're moving the money. 420 00:54:07,785 --> 00:54:10,537 All three accounts. 421 00:54:19,297 --> 00:54:23,342 - Wire transfers to a Macau casino. - They're cashing out. 422 00:54:23,468 --> 00:54:25,344 - Surveillance? - Nobody's moved. 423 00:54:25,470 --> 00:54:27,930 - Kassar? - We can't reach Yan's team in Shek O. 424 00:54:28,055 --> 00:54:30,348 We're going to Shek O to pick up Kassar. Pick up Kassar. 425 00:54:30,475 --> 00:54:33,269 Launch STU. Meet at the heliport. 426 00:54:33,394 --> 00:54:35,145 I'm gonna pick up the mules. 427 00:55:24,737 --> 00:55:26,989 Let's talk about this. 428 00:55:28,908 --> 00:55:31,744 But look at it through my eyes and what do you see? 429 00:55:33,871 --> 00:55:36,957 "Hathaway. Been in prison. Damaged goods. 430 00:55:37,083 --> 00:55:39,418 "Not much to offer my sister. 431 00:55:39,544 --> 00:55:42,880 "And his future's not exactly guaranteed," is what I'd see. 432 00:55:44,298 --> 00:55:46,383 But what if this fails? 433 00:55:46,509 --> 00:55:49,803 Nine more years in prison. What kind of life is that for her? 434 00:56:01,858 --> 00:56:04,277 - 'Chen, it's Barrett.' - I hear you. 435 00:56:04,402 --> 00:56:06,695 "The mules. We've got Li and Yan" 436 00:56:07,321 --> 00:56:10,157 And listen, we can't reach surveillance in Shek O. 437 00:57:39,497 --> 00:57:41,999 Come on, this way. 438 01:00:51,772 --> 01:00:53,231 Trang! 439 01:01:04,326 --> 01:01:06,995 Hold on, man! Hold on! 440 01:01:20,634 --> 01:01:22,469 Stay down! 441 01:03:34,935 --> 01:03:36,770 Go! Go! 442 01:03:37,646 --> 01:03:39,522 Come on. 443 01:03:42,026 --> 01:03:46,405 - Elias! Elias, you coming? - Give me the case. 444 01:03:46,530 --> 01:03:48,740 Come on! Come on! 445 01:03:49,950 --> 01:03:52,285 Don't wait! Drive the barge out of here! 446 01:03:52,870 --> 01:03:54,288 Come on. 447 01:05:02,106 --> 01:05:04,108 WATER TEMPERATURE 448 01:07:36,802 --> 01:07:40,013 Captain Chen! Paul Wang, CNCERT. 449 01:07:40,138 --> 01:07:42,640 - In here. - What's its status? 450 01:07:42,766 --> 01:07:44,434 We've restored cooling, but pumping in seawater. 451 01:07:49,565 --> 01:07:51,400 Your team in Beijing matched it. 452 01:07:51,525 --> 01:07:54,194 They injected the same RAT used in Chicago. 453 01:07:54,319 --> 01:07:56,654 He used the same RAT to get inside. 454 01:07:56,780 --> 01:07:59,365 Then he downloaded malware that hit the reactor. 455 01:08:00,450 --> 01:08:02,827 - Was there any demand for money? - No. 456 01:08:04,204 --> 01:08:07,916 No demand for money, then it's not about extortion. Is he political? 457 01:08:08,041 --> 01:08:11,794 - A terrorist attack? Any declaration? - No claim, no statement. 458 01:08:11,920 --> 01:08:13,755 What does this guy want? 459 01:08:16,216 --> 01:08:20,303 - What did the malware attack? - Programmable Logic Controllers. PLCs. 460 01:08:20,429 --> 01:08:24,015 They tell the pumps to turn on, turn off the reactor. 461 01:08:24,141 --> 01:08:26,184 He ran the pumps until they failed. 462 01:08:26,310 --> 01:08:28,854 The reactor got too hot, melted down. 463 01:08:29,980 --> 01:08:32,107 Any idea where the attack originated? 464 01:08:32,232 --> 01:08:36,732 I was tracking it when the core went. We had to evacuate the control room. 465 01:08:37,112 --> 01:08:41,612 But if a machine failed, it should have saved a memory to a diagnostic file. 466 01:08:41,950 --> 01:08:44,577 That's right, and in that memory dump maybe are traces of code, 467 01:08:44,703 --> 01:08:46,871 maybe this guy's real IP address. 468 01:08:46,997 --> 01:08:49,666 And you can't take a radioactive machine out of there. 469 01:08:50,417 --> 01:08:53,128 OK, what if we take in a shielded case? 470 01:08:53,253 --> 01:08:57,006 Carry the drive out that way, then clone it onto a clean drive? 471 01:09:03,847 --> 01:09:07,851 - I still don't get it. - He got 74 million. 472 01:09:07,976 --> 01:09:11,187 But why this? What's he after? 473 01:10:48,577 --> 01:10:50,996 - Wang! - Hey! 474 01:10:51,121 --> 01:10:53,164 Take him. Both of you, get out of here. 475 01:12:30,345 --> 01:12:34,845 We were right. In the memory dump are the fragments of the malware. 476 01:12:35,225 --> 01:12:37,018 But it's corrupted. 477 01:12:37,853 --> 01:12:41,773 Maybe his IP address, but it's too full of holes. 478 01:12:55,078 --> 01:12:58,247 You know, when the Feeb team busted me in '07 and hit my door, 479 01:12:58,373 --> 01:13:01,376 I was flushing files, but when I came to trial, 480 01:13:01,501 --> 01:13:05,588 they retrieved all this data that should've been irretrievable. 481 01:13:17,142 --> 01:13:19,686 Black Widow. It's NSA software. 482 01:13:20,770 --> 01:13:24,523 Examines fragments and reconstructs originals 483 01:13:24,649 --> 01:13:27,193 within a couple of hours of supercomputing. 484 01:13:28,028 --> 01:13:31,239 Big cases like yours, they loan it to us. 485 01:13:39,289 --> 01:13:43,001 'Rich, I need access to Black Widow.' 486 01:13:43,126 --> 01:13:46,087 Sharing classified tech with the Chinese? Are you kidding? 487 01:13:46,212 --> 01:13:48,130 That's not even getting into Hathaway using it. 488 01:13:48,256 --> 01:13:50,716 'We've committed to full cooperation, Rich.' 489 01:13:50,842 --> 01:13:52,927 Yeah, well, you're Justice. We're NSA. 490 01:13:53,053 --> 01:13:56,514 If I wanted to, I can't. And I don't want to. 491 01:13:57,807 --> 01:13:59,809 An unequivocal no. 492 01:14:05,273 --> 01:14:08,693 OK, so how does it work? You give NSA the data, they run it, what? 493 01:14:08,818 --> 01:14:11,904 No, they have a remote login. We run it. 494 01:14:12,030 --> 01:14:13,614 You're not thinking...? 495 01:14:13,740 --> 01:14:15,908 Come on. They got the keys to the kingdom. 496 01:14:16,034 --> 01:14:17,285 Our guy's address, maybe. 497 01:14:17,410 --> 01:14:20,496 Whatever he's cooking up next is right in there. 498 01:14:20,622 --> 01:14:22,957 Only, we can't read it. 499 01:14:23,083 --> 01:14:25,043 Let's go. 500 01:14:31,383 --> 01:14:34,469 My old correspondence with Donahue is here. 501 01:14:35,345 --> 01:14:37,347 But there's no way that login is still active. 502 01:14:37,472 --> 01:14:39,515 I'm not gonna use that login. 503 01:14:40,433 --> 01:14:42,768 OK, Donahue, the NSA contact you were just talking with... 504 01:14:42,894 --> 01:14:45,813 If NSA discovers the intrusion... 505 01:14:45,939 --> 01:14:49,609 - You sure you wanna do this? - FBI can't explain after the fact? 506 01:14:50,527 --> 01:14:52,529 You locate this guy, you're OK. 507 01:14:52,654 --> 01:14:54,947 You get discovered, you're dead meat. 508 01:14:55,782 --> 01:14:58,242 You know that, don't you? 509 01:15:14,509 --> 01:15:18,012 The NSA guy you were talking to, what's his supervisor's name? 510 01:15:20,724 --> 01:15:22,642 Ben Hitchens. 511 01:15:24,102 --> 01:15:27,188 Maybe it's better if the two of you and you aren't around for the next part 512 01:15:27,313 --> 01:15:29,523 so you can deny being here. 513 01:15:52,839 --> 01:15:55,967 - How do you feel about this? - Not good. 514 01:15:56,092 --> 01:15:58,302 It's worse for the guy in there. 515 01:15:59,262 --> 01:16:03,307 - I'm surprised you went along. - Washington didn't see Chai Wan. 516 01:16:37,884 --> 01:16:40,678 You asked him to change his password? 517 01:16:55,485 --> 01:16:57,528 When he downloaded the PDF... 518 01:16:58,822 --> 01:17:01,699 ...what he downloaded was the keylogger. 519 01:17:19,134 --> 01:17:20,552 Got it. 520 01:17:33,523 --> 01:17:36,692 Now we wait. 521 01:18:07,515 --> 01:18:09,141 We're in. 522 01:18:13,563 --> 01:18:16,649 You can call me chica any time you want. 523 01:18:23,990 --> 01:18:27,576 This is our actor's home server. 524 01:18:28,244 --> 01:18:31,622 He's not in Mumbai, not in Minneapolis, not in Riga. 525 01:18:31,748 --> 01:18:34,417 - He's in Jakarta. - Can you crack the site? 526 01:18:34,542 --> 01:18:38,254 No, Intrarmour's a hosting company like a hotel or a Swiss bank, 527 01:18:38,379 --> 01:18:41,965 exclusively for black hat hackers, so it's bulletproof. 528 01:18:42,091 --> 01:18:44,802 His server's in there, but we can't crack the site. 529 01:18:44,928 --> 01:18:47,722 - Alright, so the move is strictly low-tech. - As in...? 530 01:18:47,847 --> 01:18:52,101 Go to Jakarta, burglarize the place, get our hands on his server. 531 01:18:52,227 --> 01:18:55,063 We don't have visas or badges that work in Indonesia. 532 01:18:55,188 --> 01:18:56,856 Can't FBI get us documented? 533 01:18:56,981 --> 01:18:59,608 After the NSA turn down, I'd stay away from DC. 534 01:18:59,734 --> 01:19:01,736 Then I'll work my side of the house for entry. 535 01:19:01,861 --> 01:19:04,613 That'll take a face-to-face with my bosses. 536 01:19:05,531 --> 01:19:07,533 - Alright. - Alright. 537 01:19:18,419 --> 01:19:22,714 - You getting anywhere? - No. Not into the servers. 538 01:19:22,840 --> 01:19:27,340 But I got into Intrarmour"s accounting. Look at this. 539 01:19:28,763 --> 01:19:31,348 Charges to our boy's account. OK, so? 540 01:19:31,474 --> 01:19:34,810 Mmm... Look at this, $14, $17. 541 01:19:34,936 --> 01:19:37,647 Now, $16,400. 542 01:19:38,439 --> 01:19:42,025 Five times. Paid to SatelliteShot. 543 01:19:42,151 --> 01:19:44,403 SatelliteShot rents satellite time. 544 01:19:44,529 --> 01:19:47,615 - What kind of shot? - This kind... 545 01:19:48,616 --> 01:19:51,493 - Hi-res scan. - Off the coast of Malaysia. 546 01:19:51,619 --> 01:19:54,913 - What's there? - Nothing much. 547 01:19:55,873 --> 01:19:57,541 Why there? 548 01:21:51,864 --> 01:21:53,615 Shit! 549 01:22:02,417 --> 01:22:03,626 This is Barrett. 550 01:22:03,751 --> 01:22:06,754 'What the hell did you let go on there, Carol?" 551 01:22:07,839 --> 01:22:10,883 - Pollack? - 'Do you know what your guy did?' 552 01:22:11,008 --> 01:22:13,093 - What are you talking about? - 'Cut the crap.' 553 01:22:13,219 --> 01:22:16,055 I'm talking about calls I got from the goddamn NSA and Defense. 554 01:22:16,180 --> 01:22:18,932 Our guy blew a reactor at Chai Wan. 555 01:22:19,058 --> 01:22:21,518 - Don't you watch CNN? - That's not the point. 556 01:22:21,644 --> 01:22:23,812 That's exactly the point. 557 01:22:23,938 --> 01:22:27,232 The guy we're working will drop the big hammer and not think twice about it. 558 01:22:27,358 --> 01:22:29,651 Come on, come on, come on. Don't evoke 9/11 on me. 559 01:22:30,361 --> 01:22:32,988 You didn't lose anyone there, Stanley. 560 01:22:33,781 --> 01:22:36,658 Look, I'm under orders. Now so are you. 561 01:22:36,784 --> 01:22:39,203 Bring him in, Carol. Bring him in. 562 01:22:45,376 --> 01:22:47,127 What's going on? 563 01:22:49,464 --> 01:22:53,259 - Damn it! Hathaway's gone. - Hey. This says he's here. 564 01:22:53,384 --> 01:22:55,844 - He cut his bracelet? - He can't. It signals an alarm. 565 01:22:55,970 --> 01:22:58,305 - This says it's working. - Check your settings. 566 01:23:08,232 --> 01:23:10,234 He reset it to once every 24 hours. 567 01:23:10,359 --> 01:23:12,235 We haven't been tracking him since LA. 568 01:23:12,361 --> 01:23:15,072 - They're in Cheung Hau Street. - Shit. 569 01:23:21,537 --> 01:23:25,374 Hey. 570 01:23:32,965 --> 01:23:34,883 They're coming for you. 571 01:23:35,009 --> 01:23:36,844 They're coming for you because of Black Widow. 572 01:23:36,969 --> 01:23:38,387 That was fast. 573 01:23:38,513 --> 01:23:41,307 They want me to turn you in to the Americans. 574 01:23:41,432 --> 01:23:44,852 So, turn me in and walk away. Barrett and Jessup will back me up. 575 01:23:44,977 --> 01:23:49,477 NSA won't care. They think because of you, now we have Black Widow. 576 01:23:49,774 --> 01:23:51,609 You gotta run. 577 01:23:51,734 --> 01:23:55,028 - What, you're gonna refuse an order? - You escaped. 578 01:23:55,154 --> 01:23:59,283 - We reconnect in Jakarta. - No, your bosses can add two and two. 579 01:23:59,408 --> 01:24:02,035 So, what? I'm not turning you in. 580 01:24:03,412 --> 01:24:05,414 Do I go with you or Nick? 581 01:24:06,582 --> 01:24:07,916 - Neither. - What? 582 01:24:08,042 --> 01:24:11,045 - This doesn't involve you. - Who made that choice? 583 01:24:12,338 --> 01:24:14,131 He's right. 584 01:24:17,760 --> 01:24:21,388 I'm not sure there's any light at the end of this tunnel anymore. 585 01:24:25,726 --> 01:24:29,646 What did you do, Dawai? Remind him he owes you? 586 01:24:29,772 --> 01:24:33,650 - To get him to leave me behind? - Look, I ain't going back. 587 01:24:34,694 --> 01:24:37,196 You get it? And you're not going down that road. 588 01:24:39,365 --> 01:24:40,783 I decide what's for me! 589 01:24:40,908 --> 01:24:43,535 Yeah, well, I decide what's for me. I'm going, you're not. 590 01:24:43,661 --> 01:24:46,080 Right now, we need the hard drive. 591 01:24:54,338 --> 01:24:58,342 Here, you take the car. You may have to move faster. 592 01:25:00,219 --> 01:25:02,804 I'll bring the hard drive to Quarry Bay. 593 01:25:09,478 --> 01:25:11,521 He's in Kowloon. Right here. 594 01:25:12,565 --> 01:25:14,775 You're gonna take him into custody? 595 01:25:16,485 --> 01:25:18,945 - I follow orders. - Which orders? 596 01:25:19,071 --> 01:25:21,698 Stop the bad guys, or arrest Hathaway? 597 01:25:24,452 --> 01:25:28,080 I'm gonna ask you a personal question. Don't answer if you don't want to. 598 01:25:29,165 --> 01:25:31,292 Who did you lose in 9/11? 599 01:25:31,417 --> 01:25:33,043 My husband. 600 01:26:07,912 --> 01:26:12,082 - You gotta get rid of that thing. - We got a couple of hours. 601 01:26:25,304 --> 01:26:26,430 Hold it. Hold it. 602 01:26:27,556 --> 01:26:30,517 He's on the move again. He's in Hong Kong. Quarry Bay. 603 01:26:30,643 --> 01:26:32,227 - Where? - He's headed toward Quarry Bay. 604 01:27:01,716 --> 01:27:03,926 I thought you were going separately. 605 01:27:04,051 --> 01:27:07,095 Nick's taking a small plane. I'm flying commercial. 606 01:27:07,221 --> 01:27:09,223 Sister, go home. 607 01:27:14,770 --> 01:27:16,772 You did this. 608 01:27:26,574 --> 01:27:28,033 Alright, let's go. 609 01:27:29,118 --> 01:27:33,618 Lien! Lien! Hold up! Stop. 610 01:27:33,873 --> 01:27:35,249 - What? - Hold up. Hold up! Stop. 611 01:27:35,374 --> 01:27:36,833 - What? - Listen! 612 01:27:36,959 --> 01:27:38,961 I'm a fugitive now! 613 01:27:40,254 --> 01:27:42,798 They'll issue the warrant within hours. 614 01:27:46,594 --> 01:27:48,012 Hey... 615 01:27:50,765 --> 01:27:53,017 Would I take you where I'm going? 616 01:28:10,993 --> 01:28:13,245 Don't blame your brother. 617 01:28:58,082 --> 01:28:59,958 No! 618 01:29:14,056 --> 01:29:16,516 Go, go, go! 619 01:31:23,185 --> 01:31:26,438 Lien, can they get to the next stop before the train? 620 01:31:26,563 --> 01:31:29,357 Can they get to the next stop before the train? 621 01:31:31,527 --> 01:31:33,487 No, they can't. 622 01:31:34,571 --> 01:31:35,989 OK. 623 01:31:48,877 --> 01:31:51,462 Here's your passport. 624 01:32:36,884 --> 01:32:38,719 Perak, Malaysia. 625 01:35:36,438 --> 01:35:38,940 The coordinates are right here. 626 01:35:44,279 --> 01:35:47,365 Here, right here. He looked at this. 627 01:35:49,493 --> 01:35:53,413 He's got $74 million in cash, he's writing code. What for? 628 01:35:55,082 --> 01:35:57,334 What's here? 629 01:35:57,459 --> 01:36:01,463 You got Dean Palm Oil, Pera Limited Mining. 630 01:36:02,339 --> 01:36:04,674 Agriculture... Jesus. 631 01:36:47,050 --> 01:36:51,054 Hey, this pump! It's a Stasik pump! 632 01:37:01,106 --> 01:37:05,606 They use the same model Stasik water pumps as Chai Wan reactor. 633 01:37:06,945 --> 01:37:10,239 The same brand. Are they controlled by the same PLCs? 634 01:37:10,365 --> 01:37:13,159 - Yes. - What are they mining over there? 635 01:37:13,285 --> 01:37:16,288 Pera Limited... Mining tin. 636 01:37:16,413 --> 01:37:18,832 - Tin? - Malaysia is one of the biggest exporters. 637 01:37:18,957 --> 01:37:23,457 And there's four other tin mining operations in the next valley. 638 01:37:28,133 --> 01:37:30,301 This is a riverbed. 639 01:37:30,427 --> 01:37:32,929 They divert water with Stasik pumps. 640 01:37:34,973 --> 01:37:37,183 You know why Chai Wan reactor? 641 01:37:38,727 --> 01:37:41,187 We've been looking through the looking glass the wrong way. 642 01:37:41,313 --> 01:37:43,440 He didn't target the reactor to knock out the reactor. 643 01:37:43,565 --> 01:37:45,817 He targeted it to knock out the pumps. 644 01:37:45,942 --> 01:37:48,527 He was rehearsing. It was a rehearsal. 645 01:37:48,653 --> 01:37:51,197 Chai Wan was a rehearsal. 646 01:37:51,323 --> 01:37:53,992 He's gonna shut down these pumps and flood the tin mine, 647 01:37:54,117 --> 01:37:57,829 create a shortage in tin, tin prices will rise and shoot up. 648 01:37:58,497 --> 01:38:02,501 His $74 million from Chicago was to buy options on tin ore. 649 01:38:04,002 --> 01:38:06,796 And flood the tin mine, and the valleys, and the villages, 650 01:38:06,922 --> 01:38:09,007 village people, village dogs... 651 01:38:11,134 --> 01:38:13,261 That's what you're doing. 652 01:38:13,387 --> 01:38:15,722 Isn't it, you son of a bitch? 653 01:43:25,073 --> 01:43:29,243 Alright, look at this. A third version of his virus, running more PLCs. 654 01:43:31,663 --> 01:43:32,747 Fifty-three... 655 01:43:33,873 --> 01:43:36,000 Fifty-three PLCs. 656 01:43:36,876 --> 01:43:39,211 Five different tin mines. 657 01:43:39,337 --> 01:43:42,173 For which he's gonna flood five river valleys. 658 01:43:46,302 --> 01:43:48,429 Here's the money from Chicago. 659 01:43:48,555 --> 01:43:53,055 $73.6 million in cash, deposited into a local bank. 660 01:43:53,768 --> 01:43:56,145 Bank Sentra Agatis. 661 01:44:46,780 --> 01:44:48,406 To this address. 662 01:45:20,730 --> 01:45:21,939 Hello. 663 01:45:22,065 --> 01:45:23,775 Excuse me, I'm sorry. Can you speak English? 664 01:45:23,900 --> 01:45:25,234 - A little. - OK. 665 01:45:25,360 --> 01:45:29,860 I'm here to have a meeting with Mr. Jumbhari in five minutes. 666 01:45:30,782 --> 01:45:32,658 Go to the reception on the third floor. 667 01:45:32,784 --> 01:45:37,284 Ah, yeah, I know, but can you help me? My presentation got stained. 668 01:45:39,749 --> 01:45:42,960 Any chance, can you print me a new copy, please? 669 01:45:45,922 --> 01:45:49,216 Not supposed to, but... 670 01:47:07,962 --> 01:47:10,339 - So? - Home run. 671 01:48:32,922 --> 01:48:34,715 You got my message. 672 01:48:34,841 --> 01:48:39,220 Why are you here? What do you want? 673 01:48:39,345 --> 01:48:41,972 I'm not gonna talk to a fucking bag man. 674 01:48:42,098 --> 01:48:46,477 Here's the terms: phones only, no face-to-face. You got that? Good. 675 01:48:46,602 --> 01:48:49,980 'Next, your boss on the line with me in 15! 676 01:48:53,067 --> 01:48:54,526 That's not possible. 677 01:48:55,486 --> 01:48:59,323 I have $74 million of his money. You make it possible. 678 01:49:26,517 --> 01:49:27,726 Yeah? 679 01:49:31,147 --> 01:49:33,440 Your note said that you know me, but I don't know you. 680 01:49:33,566 --> 01:49:36,068 But that's not really true, is it, Hathaway? 681 01:49:36,194 --> 01:49:38,571 'Yeah? I know you.' 682 01:49:38,696 --> 01:49:42,700 Ah, you do? Well, that makes one of us. 683 01:49:42,825 --> 01:49:44,868 Because I don't even know me. 684 01:49:45,453 --> 01:49:48,080 Sometimes I wake up in the morning and I don't even know who I am. 685 01:49:48,623 --> 01:49:51,083 Where I am. In what country. 686 01:49:52,752 --> 01:49:54,712 'And you know me?' 687 01:49:55,713 --> 01:49:59,341 I know you, and all about everything you're doing. 688 01:49:59,467 --> 01:50:02,261 You found me. What do you want? 689 01:50:03,805 --> 01:50:05,848 I wanna be Casper the Ghost. 690 01:50:06,390 --> 01:50:08,975 Don't you have a job, working yourself out of prison? 691 01:50:10,311 --> 01:50:14,064 - It was kind of a bad fit. - You're looking for employment? 692 01:50:14,190 --> 01:50:16,150 'What do I want employment for?' 693 01:50:16,275 --> 01:50:19,528 - Oh, you want a piece? - That's right. 694 01:50:19,654 --> 01:50:23,741 To put yourself back into the game? You were never in the game. 695 01:50:23,866 --> 01:50:26,785 You're a glorified carder. A carder whose time is expired. 696 01:50:26,911 --> 01:50:29,121 Check your expiration date. Your shelf life is over. 697 01:50:29,247 --> 01:50:31,999 A glorified carder holding your $74 million. 698 01:50:32,125 --> 01:50:34,335 Last time. What do you want? 699 01:50:34,460 --> 01:50:37,713 I want 20% of the Malaysian tin ore hit. 700 01:50:37,839 --> 01:50:41,676 - 'For releasing my money?' - No, for renting you my code. 701 01:50:42,468 --> 01:50:45,512 Your code is like its author: failed potential. 702 01:50:45,638 --> 01:50:48,766 It's my action that gave that code you wrote meaning. 703 01:50:48,891 --> 01:50:51,393 What does it mean without a bankroll? 704 01:50:52,395 --> 01:50:55,398 You wanna be my partner? 705 01:50:55,523 --> 01:50:57,816 'It's 20%. You call it whatever you want.' 706 01:50:58,693 --> 01:51:02,238 - I meet my partners. - Well, I don't. 707 01:51:02,363 --> 01:51:05,032 And like I told your bag man, I don't wanna meet. 708 01:51:05,158 --> 01:51:07,785 'I don't give a fuck about what you want.' 709 01:51:08,494 --> 01:51:12,539 It's what I want when I make a deal, face-to-face. 710 01:51:13,499 --> 01:51:17,999 Because I can put together another bankroll, target another target. 711 01:51:18,379 --> 01:51:20,381 And if I stop thinking about you... 712 01:51:21,716 --> 01:51:23,759 ... I stop thinking about anything... 713 01:51:24,844 --> 01:51:28,639 ...it disappears, it vanishes, it ceases to exist. 714 01:51:32,935 --> 01:51:36,146 But you... You, I wanna meet. 715 01:51:37,190 --> 01:51:39,483 Or you can piss off and die, Ghostman. 716 01:51:47,700 --> 01:51:51,328 Alright, you and Kassar. Papua Square. Walk west. 717 01:51:51,454 --> 01:51:52,997 'Meet me in 45 718 01:51:53,497 --> 01:51:56,583 'It'll be packed. How am I supposed to find you?' 719 01:51:57,919 --> 01:52:00,046 'I find you.' 720 01:52:08,221 --> 01:52:11,349 OK. We're on. 721 01:52:31,160 --> 01:52:33,704 Emergency! Please! 722 01:53:32,263 --> 01:53:35,432 It's all about if I can get close in and fast enough. 723 01:56:44,538 --> 01:56:46,540 Step back, step back. Hands up, hands up. 724 01:56:46,665 --> 01:56:47,749 Hands up. 725 01:56:48,876 --> 01:56:52,254 Hands up. Turn around. Turn around! 726 01:57:06,018 --> 01:57:08,562 No one's ever gotten this close before. 727 01:58:06,912 --> 01:58:09,456 20% is too much, Hathaway. 728 01:58:09,582 --> 01:58:11,166 Are you talking points? 729 01:58:11,917 --> 01:58:14,210 Well, people die on this planet every day. 730 01:58:15,337 --> 01:58:18,006 What do you want me to do? Grieve? Because I knew him? 731 01:58:18,132 --> 01:58:20,259 He's not here anymore. 732 01:58:20,384 --> 01:58:23,678 - Where's my money? - It's not about money. 733 01:58:26,473 --> 01:58:30,685 It's not about zeroes or ones or code. 734 01:58:30,811 --> 01:58:32,562 And what's that tell you? 735 01:58:32,688 --> 01:58:37,188 Violence. I hire people to do sub-symbolic stuff. 736 01:58:37,651 --> 01:58:41,029 - You killed my friends. I do my own. - And do I care? 737 02:00:48,574 --> 02:00:51,743 - The Betadine. - Here. 738 02:01:07,718 --> 02:01:09,886 - I got it. - OK. 739 02:01:12,931 --> 02:01:14,515 - This one? - Yeah. 740 02:01:15,684 --> 02:01:18,311 That's good, that's good. OK.