You're Angela Cassidy's son, right?
Your mother's still out there.
You sold secrets to the Russians,
and then you just disappeared.
I am not who you think I am.
I need your help.
I'm ordering you to cease and desist
in any more personal investigation.
I am working for the CIA. I never stopped.
You know the truth. We all do.
Mom, don't disappear on me again.
Let me help you.
Scott, forget about me.
I love you.
You said you put her in your backpack.
I did put her in my backpack,
but Piggy has a mind of her own.
Don't be such a baby, Mads.
I'll be quick. I promise.
We'll help you look.
Let's go. Let's go.
Come on. - Everyone has their price.
Papa's home.
Can we say hi?
Hold on.
10 million.
20.
You know your credentials are worth so much more.
No, he's on a work call.
Come on, guys. Let's go.
We gotta hurry.
Piggy, where are you?
Stay here.
I'll be right back.
Take it.
Whatever you want, I won't tell a soul.
- I can't run that risk. - No.
Please, please--my two boys.
- Ahh!
What's going on?
Come here. Come here.
If you come out right now, I won't hurt the boys.
Okay.
Open it!
- Morning. - Morning.
We've got a visitor.
Looks like he's having a rough day.
Where's Scott?
I called to give him a heads-up.
Haven't heard back yet.
Can I help you?
We're screwed.
We're 1,000% screwed.
Okay, back up.
- Who are you? - Adam Grayson, NSA.
I'm here because my boss thinks we can
put this genie back in the bottle,
but I am telling you now, there is--
- Slow down. - There is no slowing down.
Brian Lange, the bureau's NSA liaison,
is being read in as we speak.
This is a huge, and I mean absolutely massive,
catastrophic disaster. - What happened?
It's the biggest data breach the NSA has ever seen.
Brian!
Help!
Brian! Help!
Brian!
Help!
Stop, please! Stop!
Stop, no. Brian. Stop!
Brian!
No!
Lange.
Call Dutton. I'm off till Tuesday.
Okay.
Do me a favor. Next time, start with that.
I'll be there in an hour.
Carl Lassen, the founder of Digital Wall,
Europe's largest cybersecurity company.
Lassen was shot dead in his home
in Copenhagen yesterday afternoon.
Now, Digital Wall has the most robust
fiber-optic cable network in the world.
So all of the internet traffic that passes between Russia,
the Nordics, Western Europe, the U.S.,
it runs through these cables.
So we believe someone killed Lassen to get to that data.
I'm seeing Carl sold Digital Wall a year ago.
Yeah, when Carl cashed out, he kept his board seats
and security privileges.
The killer stole his password,
logged into Digital Wall's system.
What exactly was stolen?
Terabytes of top secret data.
Military vulnerabilities, proprietary NSA weapons.
Fortunately, we have a witness to the murder.
Brie Martindale, American, Carl's au pair.
Carl had a panic room in the house.
Brie got in there just in time with Carl's two kids.
Once the locks engaged, the cops are notified--
the killer boogied. - Where's Brie now?
Under DDIS protection.
Supervisory Special Agent Brian Lange,
the bureau's liaison to the NSA--
he's gonna meet us in Copenhagen.
He's done tours in both cyber and foreign counterintel.
Has anybody heard from Scott today?
Not since yesterday.
I mean, that is just odd-- him not showing up and no word?
- Do we wait for him? - No, we can't.
This case is too big.
I'll keep trying to reach him.
Okay.
Agent Lange.
You must be agent Vo.
This is Special Agent Andre Raines,
Megan Garretson from Europol.
You're Brian Lange.
You were ALAT in Scandinavia when
that online abuse ring in Norway got busted,
over 300 victims.
My colleague sang your praises.
Yeah, joint effort.
Where is Agent Forrester?
He's on his way.
We'll get set up at the DDIS station.
Great. Brian and I will cover here.
If that's okay.
After you.
Agent Vo, this is Agent Lorens Faber, DDIS.
Welcome to the Lassen residence, what we thought
was the most secure home in all of Denmark.
Electronic locks requiring both biometrics and pin codes,
security cameras covering every square inch
of the house.
How'd the killer disable them?
He didn't.
If he had, the police would have been alerted instantly.
He froze the cameras and looped the footage.
Came and went without a trace.
Brie?
I'm Agent Vo. This is Agent Lange.
We're with the FBI.
Mads and Edvard-- where are they?
Don't worry. The boys are with their mom.
Can you tell us what you remember from yesterday?
We weren't even supposed to be home.
Me and the kids--
Carl asked me to get them out of the house in the morning.
Did he say why?
No, but he has been through a lot recently.
I read in his file that he just got divorced.
Is that what you're referring to?
It started before that.
After Carl sold his company,
he started going out a lot, partying.
What can you tell us about the ex-wife?
Was the separation amicable?
No. No, it wasn't amicable.
And then after Susanne left, he really started slipping.
I heard a woman's voice coming from his office
at 2:00 in the morning,
and nobody was allowed in there, not even me.
All right, I will ask our SIA back in Budapest
to try to pull that footage.
We're gonna need a list of everybody
who's been to the house recently, Carl's friends,
your friends, everybody, okay?
I wasn't allowed to have any guests.
U.S. embassy liaisons here to discuss Brie's situation.
Martin Russo.
I'm the embassy's political attaché.
Political attaché, huh?
That's a good one.
CIA.
Grayson should have told me Langley was involved.
He wasn't authorized to do so.
Look, if we're not fully read in, we cannot do our job.
Nobody's fully read in.
Not even the highest echelons of the Danish PET
knew Carl was our asset.
If our allies found out about this secret arrangement--
Marty, why don't you just tell us
what we're really walking into here?
This morning, the German chancellor received
a ransom demand of 5 million euros.
Now, we have confirmed intel that a vulnerability
in the MEGAL gas pipeline was part of the data
Carl's killer intercepted.
Germany refused to pay up.
30 minutes later, this happened.
It definitely wasn't a one-man show.
Pulling off an attack like that takes resources.
Have any state-sponsored groups claimed responsibility?
Not yet.
So we're all working the same case here.
How about we all agree to play our cards face up?
Cards face up?
This coming from Brian Lange.
That's rich.
Carl's ex-wife is here.
Well, how about this? Can you at least have Germany
send over everything they've got so far?
Because whoever killed Carl
knows that they hit a gold mine.
Great.
Brie!
Oh! Oh.
Hey, guys. It's okay. It's okay.
She can leave now.
I'll be looking at photo arrays
if you have more questions.
Thank you.
Okay, go pack your bags now.
Don't worry. You'll be leaving soon.
Okay, go, go.
Susanne, were you aware that your husband
kept his security privileges at Digital Wall
after he cashed out?
Of course I knew, but whether he actually remained sober
long enough to ever set foot back in the office,
I haven't a clue.
Ah, bad breakup, I take it?
Beklager.
That was the first word that Carl ever said to me.
It means "I'm sorry."
We were queuing for coffee, and he bumped into me by mistake.
And Danes never apologize for something
they do on accident, but--
but Carl said "beklager," because that was who he was.
He was overly polite and, uh, and sheepish.
And then he cashed out.
And he thought that becoming a billionaire
meant that he could loosen his tie.
As for me,
turns out I like sheepish.
This was from two weeks ago.
Do you recognize this woman in Carl's office?
No, he probably met her at the club.
What club?
You don't know, do you?
Swingers club.
Our DOA spent his whole life on the straight and narrow.
How does a guy like that end up at a club
where check your inhibitions at the door is a requirement?
I don't know, but it seems like a perfect place
to entrap a square like him.
Carl Lassen's autopsy just came in.
This guy partied harder than a frat boy in Ibiza.
The MDMA, that'll send your heart
shooting out of your ribcage.
And Lassen's phone, as requested.
Security freaks don't just hang their dirty laundry
out in the open.
Hidden apps.
And there we are-- the Velvet Room.
Looks like a membership app to that private swingers club.
Go in with our badges?
No, that's a surefire way to get people to clam up.
Undercover it is then.
♪ Sugar on my mind
That's the blonde from Carl's office.
I'm Samantha.
This is my partner Michael.
Mm, out-of-towners? Intriguing.
I'm Martine.
So how did you hear about the Velvet Room?
From friends.
We're members of the Luxe Castle in London.
In that case, let me show you around.
What Michael's too tactful to admit is,
we saw what happened to Carl Lassen on the telly.
Michael worked with him a few years ago.
He was a nice chap.
Ah, so you're here out of morbid curiosity, then?
Oh, is that such a bad thing?
Carl was a bit of a mess, but he was magnanimous,
if you know what I mean.
I went to his house once.
Gorgeous mansion.
But enough about Carl.
Life is for the living.
Who is he?
We don't kiss and tell at the Velvet Room.
Martinis first.
Dessert later.
Hey, what's the rush?
Clean-cut, calloused knuckles,
and I saw you check the side exits the second you walked in.
I used to consult for the DDIS.
I know a Fed when I see one.
Then you should know walking away now just gives us
more PC to come find you later.
I'll give you this, but only because Carl was a friend.
Look into his ex-wife.
Carl screwed her over royally in the divorce.
From what I heard, she's the one who left him.
And he got his revenge, every kroner's worth.
Germany sent over the ransomware message
their chancellor received.
Whoever's pulling the strings left us a breadcrumb,
a signature hidden in the HTML code.
Oh, man, the Army of Shadows.
Who?
They're a hacker group--
supposedly responsible for the two largest
data breaches in history, each worth 200 mil.
- State-sponsored? - Independent.
No home base, no known members,
nobody even knows what country they're operating out of.
What makes this group so unique is that they have
operatives who specialize in social engineering,
exploiting people rather than software.
Maybe someone had a bone to pick with Carl
and sold him out?
Any word from that woman he was seeing at the Velvet Room?
Ran Martine through Europol's DBs.
Everything came back clean.
Now, Carl and Susanne's divorce was more interesting.
Intel came from Harald Bonnichsen,
also in cybersecurity--
consulted for DDIS back in the day.
What he said about Carl's ex-wife was spot on.
Yeah, Susanne didn't receive a cent
from Digital Wall's sale,
and she wasn't shy about calling Carl out.
This text was from six months ago.
"Go to hell, you cheap bastard."
Some, uh, increasingly vulgar insults followed.
Okay, so Carl screws Susanne over,
and now she wants her half of the cash out.
So then she sells the intel on Carl to this hacker group.
And not only does she get a massive payday,
but with Carl gone, the assets actually pass back to her
through the kids.
Maybe.
Excuse me.
The Hub just received an encrypted message
from the Army of Shadows.
It's an intake form from a Russian prison.
I just sent it to you.
- Scott's mom. - Yeah.
Vanessa Kincaide is one of her known aliases.
The hackers want us to drop the case
against them in exchange for her location.
If Scott finds out,
he would move heaven and Earth to find her.
Cam, they also sent this message directly to Scott.
And still no word?
Nothing. He's gone dark.
It's been 24 hours since any of us heard from Scott.
Do we loop in HQ or-- - Not yet.
I need you to get a copy of that file unredacted.
See what you can fish out of the NSA discreetly.
I'll try.
Thank you.
Everything good?
Yeah, yeah, just getting more dirt on the ex.
Are you ready?
I don't know if anybody's ever told you this,
but, uh, you have a terrible poker face.
Yeah, I should probably loop you in on this.
Well, my Russian isn't as sharp as it used to be,
but nowhere on this document
does it say the word "prisoner."
Miss Vanessa Kincaide could be an employee.
You know damn well that she's not.
Kincaide is an alias for Angela Cassidy,
a CIA agent who reported to you.
And now you don't seem to give a rat's ass
that she's been captured?
I'm focused on the current mission.
Yes or no, does the CIA know where Angela Cassidy is?
Intelligence ops are compartmentalized by design.
Don't give me that boilerplate BS, Marty.
There's a living, breathing human being chained up
in one of those compartments.
And now you don't seem to give a rat's ass
that she's been captured.
Look at you, Brian, caring.
I thought after what happened in Azerbaijan
you'd traded that emotion in for a new pair of skis.
Get in!
No!
Do you know where she is or not?
Cassidy is one person.
Four civilians died when that pipeline exploded.
And believe me, it's only a matter of time
until they stick a gun to our ribs.
Okay.
Is your head in the game or not?
Because I'm giving Langley an update in five minutes.
What do you want me to tell them?
Don't worry about me.
Selling Digital Wall should have made you
a multibillionaire, but instead you settled
for a fraction of what you were owed.
Before we got married, Carl made me sign a form
excluding Digital Wall from our joint assets
to protect me from future liabilities
in case the company ever went under.
Maybe I shouldn't have signed that document.
But you could have contested that document, but you didn't.
Well, Carl is the--
Carl was the father of my children,
and you're implying that I had him killed to what?
To add a few extra zeroes to my bank statement?
I have seen it happen before numerous times.
Say I fought harder,
I dragged the divorce on for longer.
Look what that money did to Carl.
That money destroyed him.
I'd like to talk to the boys now, if that's okay.
The last thing they need is some stranger
peppering them with questions.
Their father just died.
That is right, and I think they'd wanna help
find out who killed him.
Edvard, Mads, my name is Cameron.
And I just wanted to say that I am very sorry
about what happened to your dad.
It is not fair.
I can't imagine what you guys must be feeling.
Is it okay if I ask you some questions?
I heard your dad made a lot of new friends recently.
Did you ever meet any of them?
Nobody ever came to the house.
That's not true.
I saw Aksel this one time.
He was visiting Brie.
Who's Aksel?
Brie's special friend.
Security systems been messed with a handful of times.
And whoever did it used the same technique
as Carl's killer.
Any clips of the secret boyfriend approaching
the house from the driveway? - No.
Aksel and Brie must have carefully
planned his every visit.
There's no way he parked on the property--too risky.
How about the closest main street?
A couple neighbors surrendered
door cam footage to the DDIS.
Crosscheck that against any instances
when the cameras went down. - Mm-hmm.
Fort Meade needed that visual on Aksel yesterday.
What's our ETA?
We're working on it.
I'm sorry.
Deputy director just chewed me out,
said I should have flagged that Carl system's
been compromised before.
Amanda, got that visual for you.
Same guy every time.
It's gotta be Aksel.
Thank you, Kyle. Send this to Cameron.
Hey.
How'd it go?
Oh, not great, actually.
Listen, has Forrester ever disappeared like this before?
No.
Alcohol problems?
Is he promiscuous? - No.
Scott wouldn't just up and leave
without a damn good reason.
I'm sorry, if any of us went MIA,
he would do everything to find us.
Yeah, well, he might be looking for you as a civilian,
because career-wise, he's got one foot
on the banana peel and the other on a roller skate.
I should let Andre and Megan know.
Don't.
They need to stay on point.
You recognize him?
You lied to us.
You've been messing with Carl's security system for months.
I--I was afraid to say.
Look, I knew how it would look.
Lying to us about Aksel is a federal offense.
Now, we're not required to press charges,
but we will if you continue to cover up for him.
No, there's nothing to cover up, okay?
Carl was out every night bringing back god knows who
from that club and damn near OD'ing
while his kids were asleep down the hall.
And he's got the nerve to tell me I can't have guests?
So you disabled Carl's security system?
- Yes. - Tell us about Aksel.
He's 28, grew up here.
He's a graphic designer.
And in no way is he involved in any of this.
Did he ever ask you to show him how
to access the security system?
Aksel's full name, where he lives,
what kind of car he drives, everything.
Aksel Blom, FBI, open up.
Hey, FBI--hey!
Hey!
Are you good?
Yeah.
Aksel was gearing up to do a runner.
Data might be hosed.
Clothes in the wardrobe still had tags in,
knives not a single nick.
Aksel probably didn't even really live there.
What about personal effects?
Uh, just this on the fridge.
The only reason this guy had an apartment
was to sell to Brie that he had a life.
If he was hooked up with the Army of Shadows,
he could be a sock puppet.
- A what? - Sock puppet.
It's a term hackers use to describe a persona
that only exists online.
This was in the waste bin.
Thanks, Freya.
Okay, the motherboard is still in decent condition.
Let's see what we can pull.
Aksel's banking details
tied to the apartment rental were made up.
Claire spoke with the landlord,
and Aksel always paid in cash.
Whoever this guy was, his prints weren't on any
of the DDIS or Europol systems.
How about dental records?
Faber is still trying to get a match for what
was left of his jaw, but that could take
a week, maybe longer. I'll check again.
Do you think Aksel killed Carl?
Brie saw the killer's face.
She would have ID'ed him from the jump.
Well, not if they were working together.
No, she told us how to find him.
I don't think she's involved.
These hackers knew exactly how extensive Carl's
security protocols would be, and they zeroed in
on his one vulnerability, Brie.
That was Russo.
The DOD just got hit with a ransom demand, 500 mil.
Have Grayson confirm the intel.
Russo already did. Al Udeid Air Base.
The hackers are threatening to leak a zero-day
that'll shut down its AMDR receptors.
Now, if that happens, all it'll take is one enemy
deploying one precision strike missile,
and 8,000 troops get pancaked in seconds.
- How much time have we got? - One hour.
One second.
Your colleague here recovered Aksel Blom's phone.
We have proof that he was paid to kill Lassen
along with clear instructions to keep the au pair
out of the equation.
Your American is exonerated.
She's free to go.
You think something's off.
All of Aksel's hard drives have been drilled through
with the precision of a robot doing brain surgery.
This phone is the only thing
that wasn't blitzed beyond repair.
Well, you caught him in the middle of his exit plans.
It's possible he wasn't finished destroying the phone.
So why'd he put it in the trash?
Look, we're being led down a path here.
Brie is a loose end.
They want us to let her go so they can
get rid of the only person who can ID the killer.
Offer Miss Martindale any protection you like,
but the DDIS has no reason to detain her any longer.
Wait a second, Agent Faber.
What if we give Carl's killer exactly what he wants?
Look, we know you never meant for anything bad
to happen to Carl.
And the DDIS is ready to take you home.
Okay.
But we really need your help.
Did you find Aksel?
He didn't make it.
What?
W-what happened?
It was an accident.
But, Brie, you should know that Aksel
wasn't who he said he was.
Well, then who was he then?
We don't know, and we may never find out.
I am sorry, but you got played.
Whatever you need, I'm in.
Thank you.
Well, I hope you have a safe flight home, Brie.
On behalf of the DDIS, I'd like
to apologize for any confusion regarding
your American's involvement in Lassen's murder.
Well, the FBI appreciates your cooperation.
Take Miss Martindale to the Lufthavnens Plads Hotel.
Your team's in position at the hotel?
I've got a tactical team inside
and snipers at the ready.
She'll be safe.
Ready?
Yep.
We've got company.
Cam. They're not waiting.
They're hitting us now.
ID'ed the mercenary
who attacked Smitty and Andre-- Afrim Kurti.
Any connection to the Army of Shadows?
As far as I can tell, he's a for-hire gunman
on the dark web.
Charges 100,000 euro a head.
I found the crypto transaction between Kurti
and whoever hired him.
I got the account number, but that wallet never
traded on the usual platforms.
There's no way of tracking the owner.
Pull up a blockchain explorer.
Grab all the transactions for that account.
Okay, one sec.
Got it.
Do a search for any duplicates.
- That filter doesn't exist. - Scoot over.
Repeat transactions are just ways to wash cash.
So once we pull the IP info for whatever's left...
The killer's local.
Grab all the tenants at this address
and crosscheck the list with Carl's emails and texts.
SikkerTech Security.
It's owned by Harald Bonnichsen.
Andre and Smitty already met him at the Velvet Room.
He emailed Carl asking him to invest.
The deal fell through at the last minute.
Send this to Cameron.
Sorry to interrupt.
You're probably gonna wanna hear this
in private, Harald.
You are under arrest for conspiracy to commit murder.
What?
You had Carl Lassen killed,
and then you tried to silence the witness.
Carl was a friend, a mentor.
Sure. But you envied him.
I mean, it makes sense.
You both had the same skill set.
I think maybe even yours were a little sharper, right?
I mean, considering that you were once a black hat hacker.
How did you come across that information?
The DDIS unsealed your file.
We know you weaseled your way
into a consulting deal to get out of jail time.
We traced your crypto payment to the hit men
that you hired to kill Brie.
The transaction's IP address just happened
to match SikkerTech's.
You really think I'd be so daft
to pay a hit man out of my own office and not use a VPN?
Dollar signs make people sloppy sometimes,
even someone in the Army of Shadows.
I'm being framed.
The Army is selling you the story you wanna hear.
Then tell us the truth.
Carl thought money would make him happy.
But instead, it made him obsolete.
The man would show up at the Velvet Room
drunk out of his mind, blabbering about
his top secret security privileges.
He was practically begging to be hacked.
So I sold intel on Carl,
who he was, what his habits were,
how to get to the people that mattered to him
to exploit his security privileges.
But I did not kill him.
So who did?
Philip Baranza, a former member of UNC1151,
a Belarusian state-sponsored hacker group.
Harald is claiming that Baranza started the Army of Shadows.
So Baranza activates one of his operatives, Aksel,
to seduce Brie into giving him access
to Carl's security system.
Now, according to Harald, Baranza is operating
out of a vacant building in Knippelsbro.
What's our timeline?
Baranza's ransomware to the DOD goes live in 15.
So let's move.
Pull the trigger if you need to,
but remember, we need this guy alive.
FBI! Hands where I can see them!
I have something you want.
Scott Forrester.
Where are we at?
We secured all of Baranza's devices.
The data breach is 100% contained,
and the ransomware request to the DOD has been shut down.
I'd say we all earned our paycheck today, didn't we?
Do I turned Baranza over to Russo?
Not yet.
That's him.
I'll never forget those eyes,
the way he stared back at me after he shot Carl.
Thank you, Brie.
The DDIS will take you straight to the airport.
Your parents are waiting for you back in Baltimore.
It seems you're one man short.
I know where the Agent Forrester is
along with his mother, Angela Cassidy.
You can still save them, but you have to act now.
Cameron, get resituated.
I'll take care of this guy.
Trust me.
Well, you certainly got our attention, Mr. Baranza,
I'm all ears.
I can tell you where he's headed.
There is an encrypted file on my laptop.
Even the most skilled tech
will take roughly ten hours to decrypt it.
That file will self-destruct, and I am the only person
with the decryption keys, which I will gladly hand over,
but I want full immunity.
You've got five minutes.
How much time do we have?
Three minutes.
Okay, we're looking at three layers of solid 256 encryption.
I want every single station cycling through at least
a hundred keys a second.
I feel like I haven't been perfectly clear as to where
exactly it is you're headed.
So allow me to paint the picture.
No visitors. None.
23 hours a day in solitary.
Being alone doesn't scare me,
but time--
time is invaluable.
Got a match for the first layer.
Second one just cleared.
Kyle, how close are we?
Almost there.
Uncuff me.
Leave the door unlocked.
Nobody has to know how I got out.
But you should do it now
because that file will self-destruct
in one minute,
along with Angela Cassidy's location.
Come on, come on, come on, come on, come on, come on.
What happened? Where's the file?
Does anybody have a copy?
It looks like all instances self-deleted.
It's gotta be here somewhere.
Where are we at with the file?
It's gone.
I'm sorry, Cam.
We tried every trick.
I need to bring you both in on something.
It's regarding Scott.
I know Baranza intercepted those prison documents
in the data breach, and I know the NSA has access to them.
I need you to tell me where Angela Cassidy is being held.
Look, working for the NSA is like being
a tiny piece of a giant Jigsaw puzzle.
You have no idea what the larger picture is, just--
you have a specific role.
The company's loyalty can turn on a dime.
One minute, they're protecting you.
The next, they're scrubbing you from their files
like they did to Cassidy.
It's not my orders.
The secret booze drawer-- that's been restocked, yes?
Sure has.
Great working with you all.
Amanda.
It's been a pleasure.
We can explore backchannels,
try to get ahold of the original document.
No, if Russia gets wind that we are asking around,
they will make sure that Cassidy
is never seen again, for good, and Scott along with her.
I just got off a call with my friend in Operational Tech.
I had him comb through Forrester's phone remotely.
The encrypted message that Scott received
regarding Vanessa Kincaide, he opened it, accessed it.
He's gonna find his mom.
The Kremlin's got over 100 penitentiaries,
and those are just the ones we know about.
Where do we even start?
Tate, I got an update.
Grayson gave me two pieces of information,
Dagny Andersen and Oslo.
The Norwegian Minister of Foreign Affairs?
How's she involved in this?
Andersen has been trying to secure the release
of two Norwegian journalists who were imprisoned
six months ago by the Kremlin.
We're at your mercy right now, Brian.
So you can either help us find Scott and his mom
or you can deep-six this whole thing.