NCIS season 24 picks up nearly in the immediate aftermath of the season 23 finale as McGee arrives in a panic at the scene after hearing about the shootout between Torres and Mateo. He quickly confronts Torres over what has happened as Torres struggles to get a word in. He eventually explains that he didn’t shoot Mateo and Mateo didn’t shoot him, though he did shoot someone: former NCIS agent Anthony DiNozzo.
We flash back 12 hours as Tony is attempting to settle into his new satellite office for Salus, his cybersecurity company. A call comes through with a tip from a hacker contact of his named Boris, and Tony follows up, which leads him to Mateo.
In the present time, Tony tells him about hearing chatter and going to the drop, which was when he got shot by the kid making the drop, aka McGee’s son, who took off after shooting Tony. As they chat, Tony and McGee quickly fall back into their old banter as Tony gives him grief for not telling him about his secret son.
Torres admits to tailing Mateo, hoping it was nothing, but clearly his gut was correct. Tony brushes it off as McGee wonders what his son has gotten up to and assures him they’ll figure it out together. The trio heads to the NCIS office, and we learn that Ziva is in the Boston area with Talli, who has started boarding school, with Ziva working at a language school in the area to be close to Tali. Tony is feeling the spark of working a case again, but as they enter the bullpen, they’re thrown out by LaRoche, who makes it clear they’ve all broken protocol. As for why LaRoche is in HQ giving orders? Well, he's just been announced as the new NCIS director.
Knight and Parker bring Jimmy up to speed on LaRoche being named the new director and Mateo having stolen something from NCIS and now being on the run. They also drop the bomb on him that Tony is in town and is off working with McGee and Torres on the case after being kicked out of NCIS by LaRoche.
As Torres, Tony, and McGee begin working the case at Tony's satellite office, they learn that Mateo whipped his trail clean, but Tony suggests maybe he just thinks he does, as they could perhaps have Kasie follow the metadata in the site on the dark web that Mateo used, Elusive Dream, to track him down. McGee calls in the information to Kasie as LaRoche addresses the NCIS agents, and she manages to get a hit. It seems that Mateo stole SECNAV’s dossier, suggesting someone could be planning an attack on her.
Tony assures McGee that everything is going to work out as McGee spirals over Mateo’s actions, reminding him that kids can be unpredictable. Speaking of kids, it seems that SECNAV was not the target; her daughter was, and two men managed to abduct her at gunpoint at an ice rink.

LaRoche fires Parker in a major power play
SECNAV comes to see LaRoche and Parker to question them on her daughter’s abduction in hopes of getting an update. They inform her the people who took her daughter have requested a file be released, but it's from the old filing system, so they're chasing down the lead.
She asks about Tony’s read on the suspect as well as Torres since they were first on the scene. Parker covers for LaRoche, letting her know they’re on their way back from the field as she excuses herself to debrief her husband. Rather than appreciating his actions, LaRoche makes it clear that if he disobeys an order again, he’s done at NCIS.
Kasie manages to ping Mateo’s cell phone, so Parker and Knight head out to track him while Torres heads up for a briefing. Parker and Knight find Mateo at a dinner meeting with McGee, but before they can enter the diner, LaRoche arrives at the scene and goes to call in REACT. Parker and Knight prepare to head in, but he makes it clear this is not a discussion, as no agent is to go in that diner until REACT gives them the all clear.
In the diner, Mateo tells McGee he doesn’t know who these people are. When his mom went missing, he needed some help forging documents, and they called in a favor with the thread of hurting his mom if he didn’t get them the file they requested. Mateo is shocked to learn that SECNAV’s daughter has been kidnapped as he assures him that he left the gun at the drop.
Tony enters to give them a heads-up that LaRoche is calling in REACT, while Knight informs LaRoche and Parker that Kasie’s lead did not pan out. Just as the cavalry arrives, McGee escorts Mateo out before Tony comes to greet Parker and LaRoche. Upon learning that Parker disobeyed his order, LaRoche fires Parker on the spot.

LaRoche suspends McGee as the NCIS team tracks down the file the kidnappers requested
Back at the NCIS headquarters, LaRoche confronts McGee on his actions as McGee notes that he got a vehicle description and partial plate from the kidnappers. Rather than listening, LaRoche notes their only hope is finding the file the kidnappers want as Kasie enters. Turns out a physical copy of the file still exists, but there is no information on which archive the file has been stored in. He sends her away to track it down before informing McGee that he’s suspended pending further review.
Tony and Parker head down to meet with a man at the Department of Transportation for help with tracking down the plate off the record. Parker searches the database while Tony encourages him to consider that all new directors come with some growing pains, but Parker isn’t sold on the idea. The search results are in footage of the car Mateo described, but when they go to download the footage, it triggers an alarm.
Back at NCIS, Knight and Torres meet with Barbara down in the garage, who informs them that she’s in trouble, as a few years ago she failed to input a few ledgers, so it’s not in the system. She’s worried about losing her job if LaRoche finds out, as they assure her she has nothing to worry about. While she doesn’t have the ledger information in the system, she does have the physical ledger that can help.
LaRoche tracks down Parker and Tony, who try to cover their tracks by saying they're reviewing traffic cam footage as part of a case Tony's security firm is working on. He cuts Tony off as he shows him the video the kidnappers sent, making it clear NCIS now only has two hours before they kill SECNAV’s daughter. NCIS tracked down a copy of the file, and agents are on the way. LaRoche gets a call from SECNAV and hands the phone to Tony as she encourages him to leave the continent.
Knight and Torres head out to the warehouse where the file should be located and look through an old filing cabinet for the file. To their surprise, the file in question is a requisition form for office supplies from 60 years ago with no confidential information inside, adding to the mystery of why the kidnappers want the file.

Turns out LaRoche will not be taking over as Vance's replacement after all
Kasie tries to find some sort of hidden code in the file, but she can’t find any signs that there is more in the report than meets the eye. She informs McGee that she’s been trying to figure out a background sound in the kidnappers' video, which sounds familiar to him as well.
Upstairs, SECNAV presses LaRoche on why they haven’t released the file and his plan for getting her daughter back, but their conversation is cut short when Tony arrives. Tony and Parker managed to track down the kidnapper’s car to a harbor, which is when Kasie arrives and informs them McGee recognized the sound at a dock. LaRoche orders the team to head out to the location, but Tony feels like something is off and that the kidnappers are misdirecting them. They want NCIS to look at that trawler ship, but LaRoche does not listen and orders the team to search the trawler ship.
As LaRoche and his agents make their way to the ship, Tony heads out to the warehouse where Torres and Knight originally found the requested file. He’s taken at gunpoint by a pair of armed men. Tony commends them on their nod to the Goonies, which was a decoy leading them to the real treasure: the cabinet containing the file, which also happened to contain a collection of diamonds.
On the ship, there is no sign of SECNAV’s daughter. After getting the news, LaRoche calls in Knight and Torres, but neither answers the call.
Tony presses the men about how they found out about the cabinet, noting that they needed a big decoy to lead them to its location, which was why they took SECNAV’s daughter. After Tony hands over the diamonds, the man orders his partner to kill SECNAV’s daughter as he prepares to take aim at Tony. That’s when Knight and Torres enter to disarm the men, as Parker then comes in over the radio to inform them he found SECNAV’s daughter.
At NCIS, SECNAV reunites with her daughter as Tony informs McGee that the murder charges against Mateo were dropped. He's not sure what the future holds, though, as Tony encourages him to take the win for now. Their conversation is cut short when LaRoche calls over McGee and lays into him, Torres, and Knight as Tony sneaks out.
Tony heads to the makeshift office for his cybersecurity firm, where SECNAV is waiting for him.
She assures Tony that she made sure Parker and his team are still in charge, as she admits that she put the wrong person in the director’s chair. This case made it simple: the director of NCIS has to be willing to listen and challenge assumptions, and LaRoche is not that man: Tony is. She reminds him that Tony is two hours away and Ziva already told her he should have taken the job the first time it was offered. To Tony’s surprise, she already sent out a press release announcing him as the new NCIS director.
And just like that, we finally know how Tony will factor into the season ahead and who will replace Vance as the new NCIS director! It's going to be fun to see how Tony settles into this new role, but we're so ready for him to be back and Vance to be succeeded by a familiar face we all know and love!
NCIS airs Tuesdays at 8/7c on CBS.
