Spoilers for this episode.
Jack warns Heller that someone inside CTU leaked his location and arranged the ambush at Felsted Security. Heller plants false information about Jack working at an old CTU substation and monitors outgoing messages. Tony takes Jack and Audrey to his home, where they review the rescued footage. Jack learns that Tony's marriage to Michelle ended after his release from prison. The trap at CTU appears to identify Sarah, who is arrested and interrogated despite insisting she has been framed. Marianne continues communicating with Powell while making Sarah's apparently careless handling of the incriminating message sound plausible to the other analysts.
Edgar doubts the evidence against Sarah. He obtains Marianne's password through a false clearance update and discovers she used Sarah's system to send information outside CTU. Curtis pursues Marianne into the parking lot and arrests her, but a bomb in her car explodes as a CTU officer tries to impound it. Meanwhile, Dina receives treatment for her gunshot wound under a false explanation. Behrooz notices security and police gathering, and they escape the hospital. Jack identifies Audrey's suspect as Henry Powell and heads to his helicopter with Tony. They stop him leaving, but a sniper kills Powell before Jack can question him about the override.