[2015] [Blackhat] English Transcripts

(1) An accident has
(2) been reported at Chai Wan Nuclear Power Station.
(3) Hathaway. Cell search. Hands behind you.
(4) Open 16.
(5) Go, go, go!
(6) Search everything.
(7) Get off that! Hey!
(8) Take him down!
(9) One, two, three, up!
(10) Stay strong, carnal.
(11) This was found in your cell.
(12) You added $900 to all your pals' commissary accounts
(13) in your cell block.
(14) Is this the attack tool?
(15) With it, you open up a terminal
(16) and that gives you a command line?
(17) That how you broke into the network and plussed-up the balances?
(18) No.
(19) I used it to call Santa in the North Pole
(20) and told him to do Christmas early this year.
(21) What do we know about this guy?
(22) His grandfather was a military commander
(23) in Shanghai in the '20s,
(24) in the '30s against the Japanese through the Civil War.
(25) His father became China's Undersecretary for Trade to the UN.
(26) He came with to New York.
(27) Bronx High School of Science, MIT.
(28) His sister's a network engineer in the private sector.
(29) She grow up in New York, too?
(30) No.
(31) He's a rising star in PLA's Cyber Defense section.
(32) Liaise with them?
(33) It's inviting them into the henhouse, Carol.
(34) Stanley, we go head-to-head with the Chinese
(35) on their cyber intrusion every day of the week.
(36) Not a bad idea to be face-to-face working with them, for once.
(37) You monitor very closely what they do and do not have access to.
(38) Okay?
(39) Okay? Send the code.
(40) Okay.
(41) Let's go somewhere we can talk. Hey, hey...
(42) English might be better. Come on.
(43) Tomorrow? I can't. It's impossible. Why not?
(44) I've got an optical-overlay network
(45) that's got to be up in 17 days.
(46) They sent me some code tonight.
(47) The black hat who hit the Chai Wan reactor.
(48) When I looked at the code, it was, uh...
(49) And?
(50) I have to have a network engineer with me I can trust.
(51) Really trust.
(52) Like, 100%.

(53) When do we leave?
(54) The meltdown in China and the run-up in soy yesterday
(55) was facilitated by the same RAT.
(56) How it got loaded in in the first place, we don't know.
(57) But, once inside, it de-cloaked and became what it really is.
(58) A remote access tool.
(59) A RAT.
(60) The RAT's job was to open a back door in our system and call home.
(61) The black hat then used his back door to inject a second part.
(62) It's payload.
(63) That is what rode up soy.
(64) Now that we're looking at the RAT and payload closely,
(65) we're thinking they were...
(66) Written by different authors.
(67) How we figured that out was through the coding in the RAT.
(68) Though several years old, it is lean, graceful.
(69) The payload's coding, on the other hand, feels frenetic, confused...
(70) Frenetic? Or overwritten?
(71) So, the question we're dealing with is...
(72) Is there somewhere we can talk?
(73) ...and if it is two, they may not be working in close proximity.
(74) Daniels is qualified in computer forensics.
(75) An intern could have written that report.
(76) Oh, really? And who do we need, if not Daniels?
(77) And "liaise" in "liaison group" implies mutuality.
(78) You don't like our boy, what ideas are you bringing to the dance?
(79) A man named Hathaway.
(80) He's a convicted hacker,
(81) serving 15 years in U.S.P. Canaan in Waymart, Pennsylvania.
(82) You telling me some hacker in prison
(83) is hitting our financial markets?
(84) No. But we want Hathaway on the team
(85) so he can help out the investigation.
(86) He hit four major banks,
(87) ran up $46 million in damages.
(88) And that's just what we know about.
(89) You want the DOJ to do anything other than laugh?
(90) Daniels said two authors wrote the virus.
(91) I don't know who wrote the second half, but the first half, the RAT,
(92) the remote access tool that Daniels called "lean and graceful"?
(93) One of the original authors is me.
(94) I co-wrote it,
(95) as a gag, years ago at MIT.
(96) And my roommate, the genius lead author?
(97) Nicholas Hathaway.
(98) That's right.
(99) The hacker found the RAT online and modified it.
(100) If we want to move around within this code
(101) looking for clues to the hacker's identity,
(102) we need it's lead architect.
(103) The reactor in China, I heard about,
(104) but the spike in soy futures...
(105) All right, I didn't know any of this.
(106) We don't get a lot of new news in here.
(107) The US government would like your technical advice on this.
(108) In exchange for that, we're going to furlough you right out of here.
(109) You sign that on the last page,
(110) and we'll get you processed.
(111) You'll wear an ankle bracelet
(112) and be accompanied by a US Marshal.
(113) Your computer access will be restricted.
(114) If you wanna study the whole document, you can go right ahead.
(115) I can come back in a month or two.
(116) No, I'm done.
(117) You didn't sign it.
(118) Yeah. Why would I sign it? Why?
(119) Because of the generosity of the Assistant US Attorney
(120) in granting you a furlough.
(121) Both you and the Assistant US Attorney
(122) can stick that document up your ass.
(123) I'm sorry?
(124) Why are you sorry?
(125) I insulted you. What are you sorry for? I'm not sorry.
(126) Don't think you're gonna... Hey.
(127) You wanna raise me up out of here,
(128) solve your trade exchange dilemma,
(129) and I get a furlough for a couple of weeks? You kidding me?
(130) You have any idea how much progress you're gonna make
(131) on a strike this complex without someone like me?
(132) Zero.
(133) This isn't a negotiation.
(134) I just made it one.
(135) You want me? You pass this upstairs.
(136) If my assistance results in the identification
(137) and the apprehension of the guy you're after,
(138) I want you to commute my sentence.
(139) If I come up empty, you toss my ass back in the can.
(140) Those are the terms.
(141) Guard.
(142) Interview's over.
(143) Barrett, how badly do you need this guy?
(144) It's so good to see you, bro.
(145) Not half as much as it is for me to see you.
(146) Let's get out of here.
(147) So, you planned to reunite with your friend from the moment you landed?
(148) It entered my mind.
(149) You okay?
(150) Yeah, I'm fine.
(151) Okay. Please keep them out of sight, if you can help it.
(152) See? He ripped off and repurposed our code.
(153) What the hell is this? What?
(154) The agreement was an approval and a presence for his computer access.
(155) I approved it. A DOJ approval.
(156) Now you're changing the goalposts?
(157) Hola, chica. You came to me.
(158) How am I supposed to do my work?
(159) On an abacus or something?
(160) "Chica"? Am I Hispanic?
(161) What the hell's going on?
(162) I advocated getting you over here.
(163) I pulled every string to get your convicted felon sprung, Mr. Chen.
(164) "Captain" Chen. And I didn't ask.
(165) I offered partnership, an equivalent,
(166) or we would do it on our own.
(167) Well, I'll be happy to bust him back to Canaan
(168) and put your ass on the first plane back to China.
(169) He apologizes.
(170) My brother misunderstood our arrangement, Special Agent.
(171) Look around.
(172) I have to run the morning backup.
(173) Your network is sitting behind deep packet inspection,
(174) intrusion protection.
(175) It's extensively firewalled.
(176) Exactly.
(177) So somebody had to physically enter this room and plug the virus in.
(178) We reviewed keycard scans and surveillance tapes.
(179) There was no unauthorized entry.
(180) Now, we're thinking about a routing weakness.
(181) That's too complicated. He wouldn't have done that.
(182) Yeah. Well, what you're proposing didn't happen.
(183) There's only one person who's authorized to access these terminals.
(184) Me.
(185) And my password is my thumbprint.
(186) May I?
(187) Sure.
(188) Can I have some approval now?
(189) All right. This is the code for our RAT.
(190) See, it's compact. It's slick.
(191) Under a meg. You would never have picked up on it.
(192) Ever leave that USB drive on your desk?
(193) I suppose so.
(194) Who works here who doesn't like you? Recently hired? Fired?
(195) No.
(196) Who?
(197) Lozano.
(198) His mother passed away. He left two weeks ago.
(199) John Lozano. He was only on the job for a month.
(200) He have access to your office? Yes.
(201) I'll pull his employment records.
(202) Everything will come up phony.
(203) Except this. You got his photo ID?
(204) Yeah.
(205) This section of his code right here is a mess.
(206) There's 25 lines, he's left text. It looks incomplete.
(207) Are they notes to himself?
(208) Dead-end ideas?
(209) Maybe he's still writing.
(210) Yeah, that's good.
(211) So if you've got the ability to move a commodity
(212) any way you want, what do you do?
(213) I play it out long and low-key. I do not do one big spike.
(214) Instead, I'd play it out month after month. Less risk of detection.
(215) Yeah, right. But our guy jacks soy 250% in a day.
(216) Mmm-hmm. It's flashy. He knows he's gonna bring down heat.
(217) Maybe he needs cash.
(218) Fast.
(219) He's got the money from the soy run-up.
(220) And he's busy writing code for what's next.
(221) I think the real hit is still to come.
(222) We have Lozano's photo.
(223) What's on his neck?
(224) Kid had tattoos.
(225) You have any routine surveillance tapes?
(226) Right there.
(227) Face of stone.
(228) Pollack. It's me.
(229) Can you have someone jump on the NCIC database?
(230) Search for Latino males under 30 with priors in,
(231) I don't know, anything like carding, identity theft,
(232) who were in West Texas prison gangs.
(233) Our cowboy has a tattoo on his shoulder. He's with Los Zapotecas.
(234) I'm sending you something right now.
(235) That's him in the bottom left.
(236) Alonzo Reyes. Did two years in Huntsville for carding.
(237) Paroled. Moved back to LA. I'll have LA pick him up.
(238) He's gonna monitor his home grid. I did.
(239) We got a better shot getting a first look at him ourselves.
(240) Isn't that why you brought me here?
(241) Okay?
(242) Yeah. Go ahead.
(243) That means you and me are on the money.
(244) Unless you think you can do that on your own, too.
(245) I do okay.
(246) You do, huh?
(247) Let's see how you handle the financial sector.
(248) Thanks, Stanley.
(249) My eye's on you.
(250) Where do you think I'm going?
(251) This guy is one step away from my "get out of jail free" card.
(252) So...
(253) How can I help?
(254) We want to see your trading records
(255) of your traders who took large profits from the soy run-up.
(256) You're requesting I turn over records
(257) to the FBI and a foreign power
(258) on thousands of private brokers and traders?
(259) Afraid I can't possibly accommodate you.
(260) You're gonna protect the person who manipulated your market?
(261) No. You're casting your net way too wide, Mr. Chen.
(262) You want to see my data,
(263) you come up with something a little more tangible.
(264) Something more in the way of probable cause
(265) than your hunch.
(266) Gary. May I call you Gary?
(267) How's this for tangible?
(268) In the next 15 seconds I call Laura Greer
(269) at the Commodities Trading Commission.
(270) And I say, "Laura, how you doing?
(271) "I'd like to launch an official investigation on one Gary Baker."
(272) So the headline,
(273) "M-Tech Official Investigated for Aiding and Abetting Cyber Criminals"
(274) leaks to CNN in the next 90
(275) so it makes the three o'clock news cycle,
(276) as well as the nightly news.
(277) That'd be good, too.
(278) Am I being tangible?
(279) Gary?
(280) Look around here. But I stay here with you. No take nothing.
(281) Hey, mi carnal?
(282) What happened to you?
(283) He has WRT hardware and an onion router.
(284) He can route encrypted data and stay anonymous with no IP address.
(285) Yeah, somebody must have told him how to set it up.
(286) She probably called 911.
(287) Who's the woman?
(288) It's the manager. Mrs. Novo.
(289) Here, let me see it.
(290) Here. Try it now.
(291) Barrett, this is Jessup.
(292) Mmm-hmm. Thanks, Jessup.
(293) Well, we better make following the money pay off,
(294) Reyes isn't. He's dead.
(295) Oh, great.
(296) Wait a minute.
(297) We've been looking for buyers of soy. Switch to sellers.
(298) Only our player would know exactly when to get out.
(299) Reyes got an email about a drop tonight.
(300) With no Reyes, we gotta find a new link to our main player.
(301) I'm gonna see who shows.
(302) You tell Jessup?
(303) No. They'll spot him 10 blocks away.
(304) You get into not enough for one day?
(305) Look, I play it my way, it works.
(306) It don't, at least I own it.
(307) I go, too.
(308) You look not so different from the pictures.
(309) What pictures?
(310) That my brother sent me before.
(311) Why you're in prison?
(312) Hmm.
(313) I was in a bar, I met some girl,
(314) and some guy got in my face about her.
(315) He started a fight and when it's over,
(316) he's in the hospital and I'm arrested.
(317) I wound up sentenced to 18 months at MCI-Norfolk.
(318) I traded academia for gladiator academy.
(319) Then what?
(320) Then I got out.
(321) I'm 22,
(322) and not a lot going on in Silicon Valley
(323) for an ex-con with no degree. So.
(324) Carding?
(325) Yeah, that and I was in wholesaling internationally.
(326) I had an eight-year run, then the Feeb caught up with me.
(327) And I got 13 years.
(328) You have regrets?
(329) Regrets? No.
(330) The banks got hit for the losses, not people.
(331) I didn't burn people. I don't burn people.
(332) No.
(333) I mean, banks are chiseling everybody all the time, anyway.
(334) I don't feel sorry for banks, no.
(335) I mean, I'm sorry for what happened to you.
(336) Don't be. I'm not fishing for sympathy, here.
(337) I did the crime, I'm doing the time. Time isn't doing me.
(338) What's that mean?
(339) I do my own time, not the institution's.
(340) See, to hold on to who you are in there,
(341) you dedicate yourself to your program.
(342) You work out on your body and your mind.
(343) Open your eyes.
(344) What'd you say?
(345) You talk like you are still in prison.
(346) But you're not in prison.
(347) Get your thinking to where you are, not where you've been.
(348) What do you know about where I've been?
(349) No. Nothing.
(350) No, nothing. But...
(351) Okay, tell me, what is it I'm supposed to start seeing so fast?
(352) Where you are.
(353) What, Koreatown?
(354) This restaurant, this table? What?
(355) You'll be in the rapid stream of decision-making.
(356) Having to make intuitive choices.
(357) The people against you are high-speed, world-class dangers.
(358) To be genius coder to outsmart, out-think
(359) like my brother always said you could,
(360) you have to think about it clear.
(361) Not easy, I know.
(362) There's no transition time.
(363) But I believe you are a very strong man.
(364) Very smart man.
(365) Here, Chen.
(366) Three trades.
(367) Three different accounts. Large volumes.
(368) They all sell within minutes of each other.
(369) Just at the soft close, at 13:13 and 13:14.
(370) Timed perfectly when to dump.
(371) What's that?
(372) Bank accounts. Foreign. Same place, all three.
(373) Where?
(374) Hong Kong.
(375) You want your bill?
(376) You not order more, you give up table.
(377) You're really hurting for space, huh?
(378) Maybe our guy is no-show.
(379) What is it?
(380) Let's go.
(381) What's happening?
(382) Who are you?
(383) Why are you here?
(384) Who are you?
(385) Watch out!
(386) Ahhh!
(387) Hey, hey! Hey!
(388) And Reyes probably was killed.
(389) The email on his computer was bait.
(390) Whoever this is wanted to see if we were on Reyes' trail.
(391) We're burned.
(392) Could you track it to our guy's location?
(393) No, the video feed went through a proxy server in the Ukraine.
(394) Who knows where it bounces to off that?
(395) Yeah, and our players are foreign, too.
(396) What about the money?
(397) Three accounts, all in the same place.
(398) They took $74 million.
(399) We're going to follow the money.
(400) Where?
(401) Put my sister on.
(402) We're flying to China in the morning.
(403) My dad was a steel worker. Single father.
(404) He raised us on his own.
(405) Came to visit, twice.
(406) Then he got sick.
(407) I used to replay memories
(408) so I could stay oriented for when I got out.
(409) Captain Chen?
(410) Paul Wang, CNCERT.
(411) In here.
(412) What's the status?
(413) We're trying to restore coolant by pumping in sea water.
(414) I got more injured.
(415) Since it happened,
(416) was there any demand for money?
(417) No.
(418) Then it's not about extortion.
(419) Is he political? A terrorist attack? Any declaration?
(420) No claim. No statement.
(421) What does this guy want?
(422) What did the malware attack?
(423) Programmable Launch Controllers. PLCs.
(424) They tell the pumps to turn on, turn off,
(425) to cool the reactor.
(426) Any idea where the attack originated?
(427) I was tracking the malware when the core went.
(428) We had to evacuate.
(429) But if a machine failed,
(430) it should have saved the memory to a diagnostic file.
(431) Yeah, that's right. And in that memory dump may be your traces of code.
(432) Maybe even this guy's real IP address.
(433) But those servers are in the control room. Everything is still hot.
(434) We're fighting a meltdown.
(435) Chen Lien.
(436) Inspector Alex Trang, Hong Kong Police.
(437) Hathaway, US Marshal Mark Jessup.
(438) Hello.
(439) So, is this them?
(440) These the guys?
(441) Yeah.
(442) We got anything?
(443) Here they are.
(444) Johnny Li, Yan Lin, Samuel Wu.
(445) Li just got out of prison two months ago.
(446) Yan and his mother are both junkies.
(447) Wu runs a chop shop.
(448) Hardly commodities speculators.
(449) They're fronts? Proxies?
(450) So how do they communicate?
(451) How do they connect up to our actor?
(452) They don't.
(453) Phones, the Internet.
(454) And we've been on them all day and all night.
(455) Nothing.
(456) If you were our player, right now,
(457) what would be your next move?
(458) I'd make my trail go cold.
(459) How? I'd cash out.
(460) Cash money doesn't leave a trail.
(461) Pick it up. Walk it anywhere you want.
(462) But the money hasn't moved yet.
(463) There's no activity in the accounts.
(464) Yeah, this is all too clean.
(465) I mean, there's got to be somebody between them,
(466) talking to them, instructing them, telling them what to do.
(467) There has to be someone in contact.
(468) It wouldn't be the main player. Too much exposure.
(469) A middle man?
(470) They didn't all fall by here by accident either.
(471) Where?
(472) Can I see this?
(473) Right there. Where's this?
(474) Yau Ma Tei.
(475) Great.
(476) OCTB.
(477) We're running a surveillance.
(478) On whom?
(479) Some Lebanese guy on our trafficker watch list.
(480) Why'd you let him in?
(481) Well, they want to see if he's talking to anybody homegrown.
(482) Why here?
(483) Every morning he comes here to meet someone.
(484) Run him down.
(485) Hmm.
(486) Elias Kassar.
(487) Fought with the Christian Phalangists
(488) in the Civil War, then disappeared.
(489) Popped up in the '90s with the paramilitaries in Colombia.
(490) Renting a house month-to-month in Shek O.
(491) Who's he meet?
(492) No one.
(493) No one ever shows.
(494) He texts.
(495) Is your phone an Android?
(496) Can I see it?
(497) Trang.
(498) Bluetooth transmitter.
(499) Short range. We would never pick it up.
(500) See, they don't come to meet him. They come to meet this.
(501) Kassar texts,
(502) Wu, Yan and Li walk by.
(503) The receivers in their pockets pick it up.
(504) They read it, delete it.
(505) Kassar never meets them, never sees them.
(506) No emails. No phones. No nothing.
(507) Slick.
(508) Can you crack it?
(509) In about a month.
(510) See, it's locked in GPG encryption.
(511) So, at least a 512-bit key.
(512) We pick him up, lean all over him.
(513) Or we let him ride and tail him to the main player.
(514) Ah, you don't have a choice.
(515) I mean, this guy's history. He ain't gonna roll.
(516) I think we let him ride.
(517) Yeah.
(518) Sunrise is in two hours.
(519) When this is over,
(520) what will you do?
(521) I don't know. Fix TVs, garage door openers.
(522) Are you still gonna like me if I'm fixing garage door openers?
(523) I don't know. Maybe.
(524) They're moving the money.
(525) All three accounts.
(526) Wire transfers to a Macau casino.
(527) They're cashing out.
(528) Surveillance? Nobody's moved.
(529) Kassar?
(530) We can't reach Yan's team in Shek O.
(531) We're going to Shek O. We're going to Shek O to pick up Kassar.
(532) Launch STU. Meet at the heliport.
(533) I'm going to pick up the mules.
(534) Let's talk about this.
(535) I'm not blind.
(536) I know the two of you are together.
(537) But look at it through my eyes and what do you see?
(538) "Hathaway. Been in prison. Damaged goods.
(539) "Not much to offer my sister,
(540) "and his future's not exactly guaranteed," is what I'd see.
(541) What else?
(542) "She deserves better," I'd think, if I was Chen.
(543) I've rarely seen her happier.
(544) But what if this fails?
(545) Nine more years in prison. What kind of life is that for her?
(546) Chen, it's Barrett.
(547) I hear you.
(548) The mules. We've got Li and Yan.
(549) And listen, we can't reach surveillance in Shek O.
(550) Come on. This way.
(551) Trang!
(552) Hold on, man! Hold on!
(553) Stay down!
(554) Go! Go!
(555) Come on.
(556) Elias! Elias, you coming?
(557) Come on! Come on!
(558) Don't wait! Drive the barge out of here!
(559) Wai. It's Paul Wang.
(560) We were able to restore the water above the fuel rods
(561) and stabilize the reactor.
(562) It's still hot, but we can get in.
(563) Nick! Mark!
(564) I still don't get it. What's he after?
(565) And Why this?
(566) Hey, what'd she say?
(567) Move fast.
(568) Wang!
(569) Wang! Hey!
(570) Take him! Both of you, get out of here!
(571) Hathaway...
(572) We were right.
(573) In the memory dump are the fragments of the malware.
(574) But it's corrupted.
(575) Maybe his IP address, but it's too full of holes.
(576) You know, when the Feeb team busted me in '07 and hit my door,
(577) I was flushing files.
(578) But when I came to trial,
(579) they retrieved all this data that should have been irretrievable.
(580) Black Widow. It's NSA software.
(581) Examines fragments and reconstructs originals
(582) within a couple of hours of supercomputing.
(583) Big cases like yours, they loan it to us.
(584) Rich, I need access to Black Widow.
(585) Sharing classified tech with the Chinese? Are you kidding?
(586) That's not even getting into Hathaway using it.
(587) We've committed to full cooperation, Rich.
(588) Yeah, well, you're Justice. We're NSA.
(589) If I wanted to, I can't. And I don't want to.
(590) An unequivocal "No."
(591) Okay, so how's it work? You give NSA the data, they run it, what?
(592) No, they have a remote login. We run it.
(593) You're not thinking.
(594) Come on. They got the keys to the kingdom.
(595) Our guy's address, maybe.
(596) Whatever he's cooking up next is right in there.
(597) Only, we can't read it.
(598) Let's go.
(599) My old correspondence with Donahue is here.
(600) But there's no way that login is still active.
(601) I'm not gonna use that login.
(602) Okay, Donahue, the NSA contact you were just talking with.
(603) If NSA discovers the intrusion...
(604) You sure you want to do this?
(605) FBI can't explain after the fact?
(606) You locate this guy, you're okay.
(607) You get discovered, you're dead meat.
(608) You know that, don't you?
(609) The NSA guy you were talking to,
(610) what's his supervisor's name?
(611) Ben Hitchens.
(612) Maybe it's better if the two of you and you
(613) aren't around for the next part so you can deny being here.
(614) How do you feel about this?
(615) Not good.
(616) It's worse for the guy in there.
(617) I'm surprised you went along.
(618) Washington didn't see Chai Wan.
(619) You asked him to change his password?
(620) When he downloaded the PDF...
(621) ...what he downloaded was the keylogger.
(622) Got it.
(623) Now, we wait.
(624) We're in.
(625) You can call me "chica" any time you want.
(626) This is our actor's home IP address. His home server.
(627) He's not in Mumbai, not in Minneapolis, not in Riga.
(628) He is in Jakarta.
(629) Can you crack the site?
(630) No.
(631) Intrarmour's a hosting company like a hotel or a Swiss bank,
(632) exclusively for black hat hackers, so it's bulletproof.
(633) His server's in there, but we can't crack the site.
(634) All right. So, the move is strictly low tech.
(635) As in...
(636) Go to Jakarta, burglarize the place,
(637) get our hands on his server.
(638) We don't have visas or badges that work in Indonesia.
(639) Can't FBI get us documented?
(640) After the NSA turndown, I'd stay away from D.C.
(641) Then I'll work my side of the house for entry.
(642) That'll take a face-to-face with my bosses.
(643) All right. All right.
(644) You getting anywhere?
(645) No. Not into the servers.
(646) But I got into lntrarmour's accounting.
(647) Look at this.
(648) Charges to our boy's account. Okay, so?
(649) Mmm. Look at this. $14, $17.
(650) Now, $16,400.
(651) Five times. Paid to SatelliteShot.
(652) SatelliteShot rents satellite time.
(653) What kind of shot? This kind.
(654) Hi-res scan.
(655) Of the coast of Malaysia.
(656) What's there?
(657) Nothing much.
(658) Why'd he scan there?
(659) Shit!
(660) This is Barrett.
(661) What the hell did you let go on there, Carol?
(662) Pollack?
(663) Do you know what your guy did?
(664) What are you talking about?
(665) Cut the crap.
(666) I'm talking about calls I got from the goddamn NSA and Defense.
(667) Our guy blew a reactor at Chai Wan.
(668) Don't you watch CNN?
(669) That's not the point.
(670) That's not the point.
(671) That's exactly the point.
(672) The guy we're working will drop the big hammer
(673) and not think twice about it.
(674) Come on, come on, come on. Don't evoke 9/11 on me.
(675) You didn't lose anyone there, Stanley.
(676) Look, I'm under orders. Now, so are you.
(677) Bring him in, Carol. Bring him in.
(678) What's going on?
(679) Damn it! Hathaway's gone.
(680) Hey. This says he's here.
(681) He cut his bracelet?
(682) He can't. It signals an alarm.
(683) This says it's working.
(684) Check your settings.
(685) He reset it to once every 24 hours.
(686) We haven't been tracking him since LA.
(687) They're at Cheung Hau Street.
(688) Shit.
(689) Hey.
(690) They're coming for you.
(691) They're coming for you because of Black Widow.
(692) That was fast.
(693) They want me to turn you over to the Americans.
(694) So, turn me in and walk away.
(695) And then, Barrett and Jessup will back me up.
(696) NSA won't care.
(697) They think because of you, now we have Black Widow.
(698) You have to run.
(699) What? You're gonna refuse an order?
(700) You escaped.
(701) We reconnect in Jakarta.
(702) Look, your bosses can add two and two.
(703) I'm not turning you in.
(704) Do I go with you or Nick?
(705) Neither.
(706) What? This doesn't involve you.
(707) Who made that choice?
(708) He's right.
(709) Look, I'm not sure there's any light at the end of this tunnel anymore.
(710) What did you do, Chen Dawai?
(711) Remind him he owes you?
(712) To get him to leave me behind?
(713) You're not going down that road.
(714) I decide what's for me!
(715) Yeah, well, I decide what's for me.
(716) I'm going. You're not.
(717) Right now, we need our data.
(718) Here. You take the car.
(719) You may have to move faster.
(720) I'll bring the hard drive to Quarry Bay.
(721) He's in Kowloon. Right here.
(722) You're gonna take him into custody?
(723) I follow orders.
(724) Which orders?
(725) Stop the bad guys, or arrest Hathaway?
(726) I'm gonna ask you a personal question.
(727) Don't answer if you don't want to.
(728) Who did you lose in 9/11?
(729) My husband.
(730) You got to get rid of that thing.
(731) We got a couple of hours.
(732) Hold it. Hold it.
(733) He's on the move again. He's in Hong Kong.
(734) Quarry Bay.
(735) Where? He's headed toward Quarry Bay.
(736) I thought you were going separately.
(737) Nick's taking a small plane.
(738) I'm flying commercial.
(739) Sister, go home.
(740) You did this.
(741) All right, let's go.
(742) Lien!
(743) Hold up! Stop.
(744) What? Hold up. Hold up!
(745) What? Stop.
(746) What? Listen!
(747) I'm a fugitive now!
(748) They'll issue the warrant within hours!
(749) Hey.
(750) Would I take you where I'm going?
(751) Don't blame your brother.
(752) No!
(753) Go, go, go!
(754) Barrett!
(755) Lien, can they get to the next stop
(756) before the train?
(757) Listen, we gotta grieve later, okay?
(758) We have to survive.
(759) Can they get to the next stop before the train?
(760) No, they can't.
(761) Okay, Okay.
(762) We're both going after them!
(763) We're both going.
(764) Yes, we are.
(765) We are.
(766) Perak, Malaysia.
(767) Coordinates are right here.
(768) Here. Right here. Looked at this.
(769) He's got $74 million in cash, he's writing code.
(770) What for?
(771) What's here?
(772) You got Dean Palm Oil, Pera Limited Mining.
(773) Agriculture... Jesus.
(774) Hey, this pump, it's a Stasik pump.
(775) They use the same model
(776) Stasik water pumps as Chai Wan reactor.
(777) The same brand. Are they controlled by the same PLCs?
(778) Yes.
(779) What are they mining over there?
(780) Pera Limited.
(781) Mining tin. Tin?
(782) Malaysia is one of the biggest exporters.
(783) And there's four other tin mining operations in the next valley.
(784) This is a riverbed.
(785) They divert water with Stasik pumps.
(786) You know why Chai Wan reactor?
(787) We've been looking through the looking glass the wrong way.
(788) He didn't target the reactor to knock out the reactor.
(789) He targeted it to knock out the pumps.
(790) He was rehearsing. It was a rehearsal.
(791) Chai Wan was a rehearsal.
(792) He's going to shut down these pumps and flood the tin mine,
(793) and the valleys, and the villages,
(794) village people, village dogs.
(795) Create a shortage in tin. Tin prices will rise and shoot up.
(796) His $74 million from Chicago was to buy options on tin ore.
(797) That's what you're doing. Isn't it, you son of a bitch?
(798) All right, look at this.
(799) A third version of his virus, running more PLCs.
(800) Fifty-three...
(801) Fifty-three PLCs.
(802) Five different tin mines.
(803) For which he's going to flood five river valleys.
(804) Here's the money from Chicago.
(805) 73.6 million in cash,
(806) deposited into a local bank.
(807) Bank Sentra Agatis.
(808) To this address.
(809) Hi. Hello.
(810) Excuse me, I'm sorry. Can you speak English?
(811) A little. Okay.
(812) I'm here to have a meeting with
(813) Mr. Jumhari in five minutes.
(814) Go to the reception on the third floor.
(815) Yeah, I know, but
(816) can you help me? My presentation got stained.
(817) Any chance, can you print me a new copy, please?
(818) Not supposed to, but...
(819) So?
(820) Home run.
(821) You got my message.
(822) Why are you here? You tell me, what do you want?
(823) I am not gonna talk to a fucking bagman.
(824) Here's the terms. Phones only. No face-to-face.
(825) You got that? Good.
(826) Next, your boss on the line with me in 15.
(827) That's not possible.
(828) I have $74 million of his money.
(829) You make it possible.
(830) Yeah.
(831) Your note said that you know me, but I don't know you.
(832) But that's not really true, is it, Hathaway?
(833) Yeah? I know you.
(834) Ah, you do?
(835) Well, that makes one of us.
(836) Sometimes I wake up in the morning
(837) and I don't even know who I am.
(838) Where I am. In what country.
(839) And you know me?
(840) I know you,
(841) and you're about money
(842) because it's your scoreboard in the virtual world.
(843) You found me.
(844) What do you want?
(845) I want to be Casper the Ghost.
(846) Don't you have a job, working yourself out of prison?
(847) It was kind of a bad fit.
(848) You're looking for employment?
(849) What do I want employment for?
(850) Oh, you want a piece?
(851) To put yourself back into the game?
(852) You were never in the game.
(853) You're a glorified carder.
(854) A carder whose time is expired.
(855) Check your expiration date. Your shelf life is over.
(856) A glorified carder holding your $74 million.
(857) Okay, last time. What do you want?
(858) I want 20% of the Malaysian tin ore hit.
(859) For releasing my money?
(860) No, for renting you my code.
(861) It's my action that gave that code you wrote meaning.
(862) What's it mean without a bankroll?
(863) You want to be my partner?
(864) It's 20%. You call it whatever you want.
(865) I meet my partners.
(866) Well, I don't.
(867) And like I told your bagman, I don't want to meet.
(868) I don't give a fuck about what you want.
(869) It's what I want when I make a deal, face-to-face.
(870) Because I can put together another bankroll. Target another target.
(871) And if I stop thinking about you,
(872) if I stop thinking about anything,
(873) it disappears. It vanishes. It ceases to exist.
(874) But you...
(875) You, I want to meet.
(876) Or you can piss off and die, Ghostman.
(877) All right, you and Kassar.
(878) I'll call you and tell you where.
(879) Sure.
(880) Okay. We're on.
(881) Emergency! Please.
(882) It's all about if I can get close enough fast enough.
(883) Hey, I told you. You and Kassar, alone.
(884) Five men, two floors below.
(885) The team two floors below.
(886) And two gunmen with them.
(887) And the two guys with you?
(888) Lose them. I'm changing the location.
(889) You and Kassar, Papua Square. Walk west. Meet me in two hours.
(890) It'll be packed. How am I supposed to find you?
(891) I find you.
(892) Step back. Hands up.
(893) Hands up, hands up.
(894) Hands up. Turn around.
(895) Turn around!
(896) No one's ever gotten this close before.
(897) 20% is too much, Hathaway.
(898) You talking points?
(899) Well, people die on this planet every day.
(900) What do you want me to do? Grieve? Because I knew him?
(901) He's not here anymore.
(902) Where's my money?
(903) Not about money.
(904) Not about zeroes or ones or code.
(905) And what's that tell you?
(906) Get out of the way!
(907) I'm a gamer.
(908) I hire people to do sub-symbolic stuff.
(909) You killed my friends. I do my own.
(910) And do I care?
(911) The Betadine.
(912) Here.
(913) I got it. Okay.
(914) This one? Yeah.
(915) That's good. It's good.
(916) Okay.