% fortune -ae paul murphy

NCIS: Episode #140: Breakout

As regular readers know my favorite TV series is NCIS - but I wasn't terribly impressed with the recent two part "Legend" episode designed to test market a spinoff NCIS - OSP (Office of Special Projects), apparently to be set in Los Angeles.

What I liked least about it was the bare faced product placement for Microsoft's table top computing - really just an iPhone like gesture interface for large screens. In the lead up to this, McGee describes the OSP as having "cool toys", and in the actual program the whole gesture computing thing plays about the same role the Pentagon's 300 page daily targeting orders did in Vietnam: not even usable as toilet paper.

Of course whining about the technological illiteracy and financial mores of the TV entertainment industry is worse than than pointless - so in my continuing quest for humility, I thought it would be fun to produce sketches for my own NCIS script - one intended to set things right....

But first, a little external context setting - The introduction from a May 7/09 report by CNET's Elinor Mills

Report: Hackers broke into FAA air traffic control systems

Hackers have broken into the air traffic control mission-support systems of the U.S. Federal Aviation Administration several times in recent years, according to an Inspector General report sent to the FAA this week.

In February, hackers compromised an FAA public-facing computer and used it to gain access to personally identifiable information, such as Social Security numbers, on 48,000 current and former FAA employees, the report said.

Last year, hackers took control of FAA critical network servers and could have shut them down, which would have seriously disrupted the agency's mission-support network, the report said. Hackers took over FAA computers in Alaska, becoming "insiders," according to the report dated Monday.

Then, taking advantage of interconnected networks, hackers later stole an administrator's password in Oklahoma, installed "malicious codes" with the stolen password and compromised the FAA domain controller in the Western Pacific Region, giving them the access to more than 40,000 FAA user IDs, passwords, and other data used to control a portion of the mission-support network, the report said.

They use Wintel - and their security failed, gee, ya know, go figure.

So:

NCIS: Episode 140: Breakout

SCENE 1

(NCIS Headquarters, bullpen; Tony, seated, is on the phone, McGee is standing with Abby in animated conversation, Gibbs enters from stairway above accompanied by a low thirties, marginally overweight, 5'6" brunette).

Abby: Gibbs, Gibbs, have you heard from Ziva?

Gibbs: "No, Listen up, Ruth O'Brien is TDY DIA investigative services. With us.

Tony: (hanging up, turning, standing up) "Where's Gibbs? - oh, sorry Boss, Dead woman in our parking lot. South doors.

Gibbs, "Grab your gear, lets go; Abby tell Ducky"

Scene 2

Dr. Mallard squatting near face down corpse of late 20s woman wearing conservative office clothes, lying on grass beside a walkway, in plain view from the sidewalk but hidden from the parking lot by a large tree and from ground floor windows by bushes.

Tony is making sketches, McGee taking photos, Ruth is walking away toward the parking area, Gibbs stands beside Ducky. Jimmy is standing looking down at the back of the dead woman's head.

Ducky: "Let's turn her over"

(Jimmy helps - she has an NCIS badge on her shirt.)

Ducky "Margaret Anders, a civilian, worked for us - NCIS internal audit."

Gibbs: "What killed her, and when?"

Ducky: I'll know more later, but I'd say this poor girl suffered a severe blow to the back of the head - this contusion here (pointing where part of her scalp has been ripped away) - and then the killer put something around her neck - see the wide red mark all round (pointing) and strangled her. Took terrific strength to use something that wide - he may have, (Ducky rolls the body back over, lifts shirt from the bottom, we see bruising) yes, I think she was unconscious from the blow and he stood on her back to pull the noose tight while she died.

As to when, I'd say not more than twenty minutes ago; perhaps she had a 9:30 appointment in the building.

Ruth: (entering from the walkway) "Gibbs, no security coverage, that tree (pointing) blocks the camera for just this bit of the walkway.

Tony: I'm sorry, who are you again?

Ruth: "Ruth, Mr. Dinozzo; my name is Ruth, I'm filling in for Ziva.

Gibbs: "What can you tell me about the weapon?

Ducky: "Over an inch wide, maybe a belt - there might be trace, I'll know more when I get her home.

Gibbs: "Quickly Ducky - Tony, show Ruth the truck; McGee bring Abby, two minutes. (Gibbs follows walkway toward the building door; Tony, McGee and Ruth leave walking on the grass alongside the building, Palmer and Mallard stay with the body, Ducky watches Gibbs go, looks perplexed).

Scene 3

(in the parking garage, beside NCIS truck).

Abby and McGee arrive, join Tony and Ruth seen talking as we approach.

Tony: "Abby, meet Ruth, a nice jewish airforce Captain from Ireland - or maybe Idaho- she's sitting Ziva, temporary detached, to us, from defense intelligence. Worked with Gibbs before.

Abby: "hi, anybody know what this is about?

Gibbs (entering from behind the truck) "it's about our dead woman, she was coming to see me, said she wanted to turn herself in."

Tony: "For?"

Gibbs: "Don't know - but there's something you need to know - and nobody else, clear?

(Tony, McGee, Abby, all looking at Ruth, who says nothing) "Yes boss, nobody else

Gibbs: It's not over. somebody in NCIS is leaking information. Rivkin knew what we were doing before we did it - and not from Ziva. Last week an op none of you knew about went wrong - it was a test, Fornell set it up and a Chinese ship that should have gone north went west. Not coincidence.

Abby: "sooo, Ruth?"

Gibbs: "Yes, DIA outside review, I asked for Ruth - because it could have been one of us, maybe you Tony, or McGee.

Ruth: "The test was double blind. It's not Gibbs either."

Abby: "Of course not Gibbs, and not me - or Tony, or McGee - and not Ducky"

Gibbs: "Need to know, no slips: Ducky doesn't have need to know. Nobody else. Clear?

This is guy is smart, he covers his tracks, thinks things through -but Margaret surprised him, this time he had no time, had to improvise, and he's probably NCIS, one of us.

McGee, her office, find what she wanted to tell me - Ruth, Tony where she lived; Abby, Ducky might have weapon's trace, he thinks a belt might have been used.

Scene 4

Ducky, doing autopsy, "a healthy young woman, took care of yourself didn't you, my dear - I'm sorry I have to excise your skin like this, (cutting red skin from her neck) but it may help find who killed you - Mr. Palmer, did you know that "red neck" was used for over a hundred years to mean hard working farmers and only became a pejorative when a fellow named Joe Starobin, writing for the American Communist paper The Sunday Worker in 1947, used it in a memorable denunciation of FBI agent Robert Lamphere at the trial - for espionage- of one Mr. Eisler - yes, babyfaced, hardlipped, and the owner of a viciously flushing redneck, is how he described him - it just goes to show you how the press misconstructs the public's image of who the good guys are.

Ducky: (Shakes head, finishes cutting in silence, turns body over, and triumphantly peels off the whole loop): "to Abby please, Mr. Palmer."

(Palmer leaves with the skin in a jar, visibly relieved)

Ducky: "and now my dear, lets see what stuck where he struck"

Scene 5:

Bullpen

Gibbs: Tony?

Tony "got it boss, living above her means; place is neat, clean, clothes too expensive for her salary, Accounting student from Brigham Young, articling in NCIS internal audit, would have made CPA next year. No known boyfriend but takes the pill, and her bed got used.

Parents have been notified; mother's here tomorrow, father's a marine lieutenant Colonel doing his up and out working logistics support on Guam -that's her connection here- he'll get compassionate and be here day after tomorrow.

Ruth: "No outstanding debt, paid her student loans off last year, deposits, salary plus a regular $4,000 in cash every month since she started here; told the bank she sells cosmetics part time - nothing to support that - and no backtrack on the money. Rent is paid by post dated check - no negatives.

Gibbs: (to Tony) "Find him. (turns) McGee?

McGee: "Working on it boss, so far - her PC has software on it that's not supposed to be there, patches external phone calls into our internal network. Looks like cell to skype - that's a telephone thing for PCs, lets you make video calls. We block it at the firewall, but an internal origin is invisible. (His phone rings) Debug Logs are off, so don't think we can trace where her calls went, but desktop logging was running on the server and it (phone rings) shows Skype running last at 3:12PM. Yesterday. Sorry, looks at phone, Abby's got something (picks up phone); Hi Abbs?

McGee: Listens: "Way to go Abbs!, (hangs up, looks at Gibbs) Abby says there were 182 desktops running at the time of that last skype call, from server logs. We keep a month of boot records, and should be able to narrow the list by dropping those not running when her skype program was active over that period.

Vance (on walkway, above): "Gibbs, you catch your parking lot killer yet?"

Gibbs: "Working on it"

Vance "Ziva still in Israel?" (looks meaningfully at Gibbs, walks away)

(The PC on Ziva's desk suddenly beeps, screen flashes)

Tony: (looks at Gibbs, nods) On it, boss

Ruth (pointing at PC), "How's it doing that, I didn't turn it on?"

Gibbs: McGee?

McGee: Remote on, it's mainly used at night: the server turns it on to backup the harddisk, turns it off to save power. It's beeping now for priority IM: hey, it's from Director Vance - says "Charles Sonderstrom".

Why send that? he was just here, oh oh, wait, that's not his PC address, it's not from him, I'll go check the server logs to see if I can find out where it came from.

Gibbs: Go. Tony, Ruth?

Tony: On it boss

Ruth: (sitting down at Ziva's desk and pushing the PC to the edge before picking up the phone) "You guys really have to use this stuff? I haven't, not since 95 or something; McGee could you show me how to get the browser and email working on this?

McGee: "The group servers are in the basement, I have to go - but here, let me show you (hunches down so he can reach her keyboard) office login is

Tony: "Ziva whined and qvetched about it all the time too; you guys at DIA, use Macs the way Mossad does?

Ruth: (Paying attention to McGee, and thus distracted) "I don't know what we use, Jerry calls them displays or something, from Sun or some name like that, I think.

McGee: (Standing up) "ok? I'll go over it in more detail with you later, gotta go, the boss wants answers - Abby, then downstairs (Leaves)

Scene 6

Gibbs and Tony are in what looks like a US Army motor pool assembly and maintenance facility. A lieutenant too old for the job stands off to one side. Gibbs is talking to a technical Sargent whose chest tag says "Sonderstrom".

Gibbs: "What were you doing in the naval yard at 8:30 this morning?

Charles: "Reporting to orders sir, or trying to - electronic work order this morning, yesterday's datum, report to Lt. Commander Taggart on USS Monmouth instanter. Lt. Ferguson (pointing) has the order, he wasn't in yet when I saw it, left it for him, burnt feet getting there before 10:30. Not in the yard at 8:30, got there about 10, sir.

But Commander Taggart wasn't there sir, and his XO denied the order, - sent me back here.

Ferguson: "That's right sir, this (waving a work order) was time stamped here at 8:52AM, today. I got in about 9 - found it on my desk.

Gibbs: "So what time did you get to the yard?

Charles: "I checked in at the gate sir, just after 10, I think. In both directions sir, I left the yard about forty minutes later. They'll have the records, sir.

Gibbs: (to Ferguson) "This has yesterday's action date - how could it not get to you until this morning?

Ferguson: "I don't know sir, our system usually works well - and I know Sargent Sonderstrom was here yesterday, he was working on armor attachment for that two four (pointing at 6 wheel, 5 ton truck).

Gibbs: "Sargent, how well did you know Margaret Anders?

Charles: "Marge? What's she got to do with this?

Gibbs: "how well did you know her?

Charles: "She's a neighbor at home, in my classes at Clark Fork JS, haven't seen her since joining up - more than five years now.

Gibbs: "So you didn't go to see her at the yard?

Charles: "At the yard sir? What's she doing there?

Tony: "Some one killed her, bashed her brains out in the parking lot

Charles: "Oh my god. (pause) Marge?. (Looks around vaguely, sits)

Gibbs: "Sargent: you went from the gate to the Monmouth, directly, is that right?

Charles: (somewhat weakly): "ah, no sir, I got a bit lost, parked at the wrong end, and went toward the towers at first, then got a ride most of the way back to the Monmouth with a lifter.

Gibbs: "Did you get his name?

Charles: "No Sir, big man, black; old hand with the machine. Why was Marge there?

Gibbs: "She worked for us. We'll probably need to speak to you again - Mr. Ferguson, get Tony with your tech people: see if work orders with later dates came through the queue before this one - and check the alibi - cameras, gate MPs, find that driver. Find someone who saw him here this morning.

Tony "On it, boss."

Scene 7

Things are quiet, McGee is helping Ruth learn to use her PC - they're at Ziva's desk.

McGee: "Then you just login here

Ruth: "What, Again? we already logged in - twice, I think.

McGee: (patience obviously fading a bit) "that was for the network, and the email server, this is the maps server

Ruth: "And I can't keep my office docs open while doing this?

McGee: "No no, normally you can, this maps server is the exception, because once you log in it uses the office graphics interface to put labels and handles on the maps so you can manipulate them and if you've got docs open when it grabs it, something's likely to crash and burn, so just close them first, ok?

Ruth: (sighs) "ok (phone rings, she picks it up): "O'Brien?", "oh, hi Jerry" (listens) I'll ask you to talk to Special Agent McGee - he speaks your language. (Looks at McGee) "This is is Jerry Malins, runs our systems, he has an idea about tracing those skype calls to a desktop. (holds out phone)

McGee: (horrifed)" You mean you talked about a security matter to a help desk guy?

Ruth (hand over phone): "help Desk? we don't have anything like that, Jerry does everything, and he's cleared for everything.

McGee: "So he's head of IT for you guys?

Ruth: "Not all of DIA, no, he reports to somebody in Fort Bragg - just for us.

McGee: "That's what? about five people?

Ruth: "About 400 I think

McGee: "One guy, 400 people, sure, and you don't know how to use this stuff, what do you guys do, share an abacus? (Takes the phone) McGee: (Listens)

In the background Gibbs and Tony come in.

McGee: "Yes, IOS (listens) isn't the default 36 hours? I'm sure no one would have changed it - should work, great idea! I'm on it, right now, Thanks! (hands phone back).

Ruth: "Good news?

McGee: "Maybe, skype uses its own port and the main switch downstairs will have built up a routing table for it - if I can dump that and see expiry times it'll show exactly which PC the signals were routed to. (starts off toward the elevators)

Ruth: "McGee: I asked, Jerry said they're Sun Rays - single signon, and everything works, not (leaning back in the chair to swing her feet onto the desk) like this shh (we know what she's saying, but her feet hit the PC and we don't hear the word over the sound of the thing crashing to the floor.)

Gibbs (from behind her): I think we've all wanted to do that a few times.

End of part one: Fade to "TBC" -and a teaser for next season:

Scene 8

The basement conference room - beside the NCIS truck.

Present are Tony, Ruth, Abby, Gibbs, and McGee

Gibbs: McGee?

McGee: "It's Director Vance's office. The times match up only for redirection to his laptop.

Tony: "Sonderstrom's orders were dated yesterday, but came to the workflow machine this morning - after the murder - but nobody knows how.

Gibbs: "Could he have sent them himself, to explain his presence here?

Tony: "The Monmouth confirms his story, the gate times check out, the lift operator gets off at 11, confirmed the story by phone, will come in tomorrow. Not coincidence, but maybe somebody trailing a red herring for us?

Gibbs: Abby?

Abby: "there's no usable weapon's trace on the skin - just some polyethylene. If a belt was used, it got wrapped in plastic first. Ducky thinks the blow to her head came from something heavy, metal, and rectangular - like a very heavy buckle on a belt used as a whip - or a gun butt, probably wrapped in plastic too.

...


Paul Murphy wrote and published The Unix Guide to Defenestration. Murphy is a 25-year veteran of the I.T. consulting industry, specializing in Unix and Unix-related management issues.