‘The Grey Hat’, this week’s installment of Intelligence, written by Heidi Cole McAdams and directed by Tim Hunter, focuses on two very real threats that we face in modern society, hackers and nuclear disasters, and what happens when the two threats merged into one potentially deadly attack.
The episode opens with Lillian telling her team about blackouts that have suddenly started plunging the U.S. West Coast into darkness. When Riley questions what this has to do with CyberCom, Nelson explains that the Cyber Defense Division has determined that the blackouts are being caused by a sophisticated and destructive cyber worm that a hacker has unleashed inside of the power grid.
All signs seemingly point to Cortez, a legend in the hacker community who specializes in ‘hostage ware’ or ‘grey hat’ scams, where he installs a destructive worm into a corporation’s systems and then blackmails the corporation into paying him to stop the worm. Riley questions how attacking a power grid would fit Cortez’s usual M.O. and Nelson chalks it up to ego, the desire to prove he’s the best high-level hacker out there. Nelson quickly realizes, however, that Cortez has made an error — the security system for the power grid only allows access to local IP addresses; therefore the worm had to have originated in Los Angeles. Lillian has heard enough and, taking charge, dispatches Gabriel, Riley, and Nelson to L.A. to find this Cortez and stop the worm: “Everyone, this is the cyber attack we’ve all been afraid of. Millions of lives are affected and we may not have seen the worst yet.”
When Gabriel, Riley, and Nelson track down “Cortez”, aka Troy Ricksen, and show him what they believe to be his handiwork, we are presented with our first major plot twist. Troy informs them that it’s not his worm — someone has cloned it and the design is such that he can’t stop it. In fact, it won’t stop until it has found and attacked its target. Ready to “bust some heads” because someone has stolen his worm, Troy tells Gabriel, Nelson, and Riley that the power grid is not the worm’s actual target. Using a vivid analogy, he explains that the worm to a kitten playing with a ball of string while it’s roaming the power grid. Once it finds its true target, the worm will transform from a kitten to a tiger and attack. With assistance from Troy and Nelson, who make quite a team, I must say, Gabriel determines that a nuclear power plant in California is the worm’s target. Whoever cloned Troy’s worm has sold it to terrorists.
Back at CyberCommand, Lillian meets with the heads of the other DOJ agencies to decide the best course of action. While they are discussing their options, they receive a video broadcast from Torbin Salvi, the leader of the anti-nuclear terrorist organization, NSR. He is willing to abort their attack if his brother, Dominic Salvi, was arrested by the FBI for bombing a nuclear research facility in Moscow and killing 52 people, is released from U.S. custody rather than being extradited to Russia where he is expected to be executed for his crimes. If Dominic is not released, the NSR will unleash a nuclear disaster on the U.S. West Coast that will rival Chernobyl.
Once Gabriel and Riley realize how dire the situation is, they seek Troy’s help in doing whatever it takes to stop the worm. Troy, however, realizing who has stolen his worm, gives Gabriel and the team the slip and goes to confront the thief. Rather than “bust some heads”, he tells the thief that the two of them are going to do the right thing — they’re going to work together to stop that worm before anyone else gets killed. Troy sees just how high the stakes are when the terrorists show up and start shooting. Thankfully Gabriel has tracked the vehicle Troy stole and he and Riley are able to stop the attackers before they can harm Troy, although his friend isn’t so lucky. When Riley and Gabriel tell him that he has the ability to stop the worm with a biometric ‘kill switch’ of his that was also cloned, Troy tells them that he can stop the worm but he needs the “mother ship,” the computer that was used to originally launch the worm, to do so.