1 00:00:26,160 --> 00:00:28,079 So what made you decide to leave, 2 00:00:28,120 --> 00:00:29,440 come to Moscow? 3 00:00:31,239 --> 00:00:34,679 Because I'm fed up with lying to the public 4 00:00:34,719 --> 00:00:39,000 about what's really going on at GCHQ where I work. 5 00:00:39,039 --> 00:00:42,640 I've done 50 years of service 6 00:00:42,679 --> 00:00:44,359 and I've had enough. 7 00:00:44,399 --> 00:00:48,079 It's time for me to stand up and say my piece. 8 00:00:52,320 --> 00:00:54,240 ...and I've had enough. 9 00:00:54,280 --> 00:00:57,679 It's time for me to stand up and say my piece. 10 00:00:58,399 --> 00:00:59,960 And what is that? 11 00:01:00,000 --> 00:01:01,640 You were friends, weren't you? 12 00:01:04,400 --> 00:01:05,599 Hi. Sorry? 13 00:01:06,480 --> 00:01:07,599 You were friends. 14 00:01:09,439 --> 00:01:10,439 Yeah. 15 00:01:11,040 --> 00:01:12,719 At least I thought so. 16 00:01:12,760 --> 00:01:14,599 So what are you looking for? 17 00:01:15,239 --> 00:01:16,439 I don't know. 18 00:01:17,079 --> 00:01:19,439 A clue, anything. 19 00:01:20,439 --> 00:01:22,680 I just can't believe he'd do this to us. 20 00:01:22,719 --> 00:01:25,040 "Us." 21 00:01:25,079 --> 00:01:26,439 He goes missing at the same time 22 00:01:26,480 --> 00:01:29,760 as the biggest leak in intelligence history. 23 00:01:29,799 --> 00:01:33,239 He turns up in Moscow and admits it on Russian television. 24 00:01:33,280 --> 00:01:35,439 I'd have thought that was enough evidence, 25 00:01:36,680 --> 00:01:37,760 even for you. 26 00:01:41,760 --> 00:01:43,079 You mean I should get back to work. 27 00:01:43,120 --> 00:01:44,400 That's OK, Saara. 28 00:01:44,439 --> 00:01:46,319 I think we all gave up hope a while back 29 00:01:46,359 --> 00:01:48,480 of you ever actually doing any work around here. 30 00:03:36,080 --> 00:03:39,400 Don't people hate having their grammar corrected? 31 00:03:39,439 --> 00:03:42,400 I mean, doesn't it just make everyone hate you? 32 00:03:42,439 --> 00:03:46,000 If we wrote code as sloppily as we write English, it would never run. 33 00:03:46,039 --> 00:03:47,719 Some things have to be right. 34 00:03:59,000 --> 00:04:00,680 Is that all you're having? 35 00:04:02,960 --> 00:04:04,840 I'm Muslim. 36 00:04:04,879 --> 00:04:06,479 They don't have anything halal here. 37 00:04:10,960 --> 00:04:13,080 ...they won't be very welcoming. 38 00:04:13,120 --> 00:04:15,080 -What's funny? 39 00:04:15,120 --> 00:04:17,000 No different to any other department here then? 40 00:04:17,040 --> 00:04:19,959 Different "from" any other department. 41 00:04:20,000 --> 00:04:22,079 It's "different from, compared with." 42 00:04:25,920 --> 00:04:28,480 No different "from" any other department. 43 00:04:28,519 --> 00:04:30,680 It's "different from, compared with." 44 00:04:33,879 --> 00:04:36,279 Different from, compared with. 45 00:04:38,920 --> 00:04:41,800 Different from, compared with. 46 00:04:41,839 --> 00:04:44,000 Different from, compared with. 47 00:04:44,040 --> 00:04:46,000 Different from, compared with. 48 00:04:46,040 --> 00:04:48,000 Different from, compared with. 49 00:04:48,040 --> 00:04:50,800 Different from, compared with. 50 00:04:50,839 --> 00:04:52,839 Different from, compared with. 51 00:04:54,519 --> 00:04:58,240 ...because I'm fed up with lying to the public 52 00:04:58,279 --> 00:05:02,600 about what's really going on at GCHQ where I work. 53 00:05:02,639 --> 00:05:03,720 I've done... 54 00:05:06,839 --> 00:05:08,879 ...stand up and say my piece. 55 00:05:08,920 --> 00:05:10,680 And what is that? 56 00:05:10,720 --> 00:05:14,000 That we are no different to what we're always accusing you lot of. 57 00:05:14,040 --> 00:05:16,199 -Yes! -What is it? 58 00:05:16,240 --> 00:05:18,000 He said "different to." 59 00:05:18,040 --> 00:05:21,519 He would never say "different to." He would never make that mistake. 60 00:05:21,560 --> 00:05:22,680 It can't be him. 61 00:05:25,120 --> 00:05:27,560 What? Saara, wait. 62 00:05:42,439 --> 00:05:44,199 Where is he? 63 00:05:44,240 --> 00:05:46,399 Danny's on his way to London, Saara. 64 00:05:49,040 --> 00:05:50,240 Shit! 65 00:05:56,240 --> 00:05:57,319 Kathy? 66 00:06:01,040 --> 00:06:02,279 She's not here. 67 00:06:03,639 --> 00:06:04,639 Where is she? 68 00:06:06,319 --> 00:06:08,199 -She's gone. -What do you mean gone? 69 00:06:09,040 --> 00:06:10,360 What did you say to her? 70 00:06:14,560 --> 00:06:17,560 I didn't say anything. I came back and she was packing. 71 00:06:18,839 --> 00:06:20,800 She's been recalled to Maryland. 72 00:06:21,759 --> 00:06:23,000 Er... 73 00:06:23,040 --> 00:06:25,360 She flew about 25 minutes ago. She left you this. 74 00:06:44,360 --> 00:06:45,680 What's going on, Saara? 75 00:06:48,279 --> 00:06:50,079 And don't lie to me this time. 76 00:06:58,040 --> 00:07:00,199 You're in love with her, aren't you? 77 00:07:02,639 --> 00:07:03,759 Don't lie, please. 78 00:07:10,120 --> 00:07:11,560 I don't know. 79 00:07:13,920 --> 00:07:15,079 Maybe. 80 00:07:24,240 --> 00:07:25,439 Have you made love here? 81 00:07:33,240 --> 00:07:34,240 Yes. 82 00:07:43,240 --> 00:07:44,360 OK. 83 00:07:45,240 --> 00:07:47,360 Where does that leave us? 84 00:07:50,160 --> 00:07:51,439 Do you still love me? 85 00:07:52,920 --> 00:07:55,600 Did you ever really love me? 86 00:08:04,839 --> 00:08:07,279 Don't go, James, please. I'm sorry. 87 00:08:13,000 --> 00:08:15,000 I know you just lost your dad... 88 00:08:15,040 --> 00:08:16,399 and I know you're upset, 89 00:08:16,439 --> 00:08:19,199 and I know you say you can't deal with your emotions. 90 00:08:20,040 --> 00:08:21,879 I've tried to make allowances, 91 00:08:23,040 --> 00:08:24,600 I really have. 92 00:08:26,800 --> 00:08:30,519 But when you crash into people's lives, people get hurt. 93 00:08:32,559 --> 00:08:35,320 People who care about you. People who love you. 94 00:08:40,840 --> 00:08:42,559 Just try and think about that? 95 00:09:00,799 --> 00:09:02,039 Fuck. 96 00:09:16,200 --> 00:09:18,200 Ah, Mark, welcome. 97 00:09:19,480 --> 00:09:20,480 Sorry, I'm late. 98 00:09:21,120 --> 00:09:22,960 It's fine. 99 00:09:23,000 --> 00:09:26,840 I'm sure I don't need to tell you the effect of the Yeabsley leak is... 100 00:09:28,679 --> 00:09:30,679 devastating. 101 00:09:30,720 --> 00:09:33,399 Most of our tools have been rendered nugatory 102 00:09:33,440 --> 00:09:36,679 and will have to be built again from scratch. 103 00:09:36,720 --> 00:09:40,799 Our priority now is to keep what little we do have left secure. 104 00:09:43,480 --> 00:09:46,559 As of 2000 hours today, Eastern Time, 105 00:09:46,600 --> 00:09:50,679 the NSA's intelligence-sharing arrangement with the UK is withdrawn. 106 00:09:51,799 --> 00:09:53,480 For the foreseeable future. 107 00:09:54,639 --> 00:09:56,720 Er, Mark... 108 00:09:56,759 --> 00:10:00,279 It signals cooperation between our two countries, 109 00:10:00,320 --> 00:10:02,919 it goes back 75 years and it plays a vital... 110 00:10:02,960 --> 00:10:07,360 This decision comes from the commander-in-chief personally 111 00:10:08,399 --> 00:10:10,039 and is not open for discussion. 112 00:10:11,480 --> 00:10:13,559 The question we're all asking ourselves here is 113 00:10:13,600 --> 00:10:15,519 why the hell you re-employed a loose cannon 114 00:10:15,559 --> 00:10:17,600 like John Yeabsley in the first place? 115 00:10:35,279 --> 00:10:36,519 -Hi. -You all right? 116 00:10:40,120 --> 00:10:42,080 Where do you want me, Sarge? 117 00:10:42,120 --> 00:10:43,679 Er, get yourself round the back. 118 00:10:43,720 --> 00:10:46,080 Make sure no press are trying to get in through the garden. 119 00:10:46,720 --> 00:10:47,799 Hey. 120 00:10:47,840 --> 00:10:49,080 You're gonna need a mask, Sandy. 121 00:10:49,120 --> 00:10:51,360 Oh, I'm just going straight through, thank you. 122 00:10:55,679 --> 00:10:56,720 Hiya. 123 00:11:11,559 --> 00:11:12,840 Sorry. Thanks. 124 00:11:51,320 --> 00:11:54,120 James, it's me again. 125 00:11:55,360 --> 00:11:58,440 Please call me back. I know you're angry. 126 00:11:59,639 --> 00:12:00,799 We need to talk. 127 00:12:05,879 --> 00:12:07,039 Come on! 128 00:12:08,240 --> 00:12:11,240 ...GCHQ Intelligence Analyst, John Yeabsley, 129 00:12:11,279 --> 00:12:13,320 seen yesterday on Russian TV 130 00:12:13,360 --> 00:12:17,399 admitting responsibility for a massive leak of GCHQ secrets 131 00:12:17,440 --> 00:12:21,519 could not have been in Moscow yesterday. Back to Dan. 132 00:12:21,559 --> 00:12:22,919 -Yes! -That's right, Alan... 133 00:12:22,960 --> 00:12:24,799 Yes, yes, yes! I knew it! 134 00:12:24,840 --> 00:12:26,480 ...in light of what the police are saying here tonight, 135 00:12:26,519 --> 00:12:31,200 the interview shown yesterday on Russian TV seems likely now 136 00:12:31,240 --> 00:12:33,600 somehow to have been faked. 137 00:12:33,639 --> 00:12:36,000 As he was clearly already dead, here in Cheltenham, 138 00:12:36,039 --> 00:12:38,639 when he was supposedly being taped in Moscow. 139 00:13:02,679 --> 00:13:04,120 Oh, dear... 140 00:13:04,159 --> 00:13:05,960 A mountain of code. 141 00:13:06,000 --> 00:13:10,320 Perhaps it will make you, er, check your assumptions. 142 00:13:10,360 --> 00:13:12,320 Remember the Nigerian prince. 143 00:13:17,240 --> 00:13:23,279 If you find yourself scouring through thousands and thousands of lines of code, 144 00:13:23,320 --> 00:13:28,879 that's probably exactly what they're expecting you to do. 145 00:13:30,919 --> 00:13:32,159 Don't. 146 00:13:32,639 --> 00:13:34,200 Do something else, 147 00:13:35,240 --> 00:13:36,519 unexpected. 148 00:13:39,080 --> 00:13:42,360 You have to think outside the box. 149 00:13:47,279 --> 00:13:51,679 If you can't, then you have to find someone who can. 150 00:14:01,960 --> 00:14:03,440 Should I offer to help? 151 00:14:03,480 --> 00:14:05,320 Oh, no, she doesn't need any help. 152 00:14:05,360 --> 00:14:07,240 She knows exactly where everything is. 153 00:14:07,279 --> 00:14:08,360 Don't you, dear? 154 00:14:16,639 --> 00:14:19,000 It's the first time we've had one of Gabe's work friends to visit. 155 00:14:19,039 --> 00:14:20,840 Isn't it, Gabe? 156 00:14:20,879 --> 00:14:22,279 We'd almost given up hope. 157 00:14:23,000 --> 00:14:24,320 Sorry? 158 00:14:24,360 --> 00:14:27,519 He was turned down by so many employers before GCHQ. 159 00:14:27,559 --> 00:14:29,960 We moved here so we could look after him. 160 00:14:30,000 --> 00:14:31,519 He can't live alone, obviously. 161 00:14:35,480 --> 00:14:37,679 I know you said you didn't want to help me any more 162 00:14:37,720 --> 00:14:39,919 -but I'm in trouble. -What kind of trouble? 163 00:14:41,039 --> 00:14:42,720 What I'm saying is... 164 00:14:42,759 --> 00:14:44,559 I've got GCHQ into trouble. 165 00:14:45,879 --> 00:14:47,759 OK, what I mean is... 166 00:14:49,000 --> 00:14:51,360 I didn't realise I was being used. 167 00:14:51,399 --> 00:14:53,679 I think there's a third-stage malware, Gabriel, 168 00:14:53,720 --> 00:14:55,559 hidden inside the code. 169 00:14:55,600 --> 00:14:57,960 I need to find it. 170 00:14:58,000 --> 00:15:00,840 Someone tried to warn me about it, that it was really dangerous, 171 00:15:00,879 --> 00:15:03,960 but it's only now I think I know what he meant. 172 00:15:04,000 --> 00:15:06,759 -Who warned you? -That's not important now. 173 00:15:06,799 --> 00:15:09,720 There's been a massive leak of data from GCHQ, right? 174 00:15:09,759 --> 00:15:11,279 Incredibly damaging? 175 00:15:11,320 --> 00:15:13,639 I think that's what the third stage does. 176 00:15:13,679 --> 00:15:16,200 I think there's some hidden part of the original malware 177 00:15:16,240 --> 00:15:18,159 that was built to steal our data. 178 00:15:18,919 --> 00:15:20,639 But I can't find it. 179 00:15:20,679 --> 00:15:23,879 I've been back through the code line by line. There's nothing. 180 00:15:28,320 --> 00:15:30,480 That's the puzzle, Gabriel. 181 00:15:30,519 --> 00:15:34,559 -I'm asking if you'd... -It's OK, Saara. I get it. 182 00:15:36,320 --> 00:15:37,960 Where are you going, Gabe? 183 00:15:38,000 --> 00:15:39,840 Sorry. 184 00:15:39,879 --> 00:15:42,240 But what about the curfew? 185 00:15:52,360 --> 00:15:54,759 -It's obfuscated. You don't need to... -Wait. 186 00:16:02,720 --> 00:16:05,200 I was just trying to say you don't need to waste time on it. 187 00:16:05,240 --> 00:16:06,759 The original code's obfuscated. 188 00:16:06,799 --> 00:16:09,120 They included all this garbage so that anti-virus software 189 00:16:09,159 --> 00:16:10,360 wouldn't recognise it as malware. 190 00:16:10,399 --> 00:16:11,960 How many lines of garbage? 191 00:16:12,000 --> 00:16:13,399 I don't know, thousands. 192 00:16:13,440 --> 00:16:15,559 We stripped them out so we could work on it. 193 00:16:16,799 --> 00:16:18,559 Tea? 194 00:16:18,600 --> 00:16:20,840 Before you stripped them out, you tried to get it to run in a sandbox. 195 00:16:20,879 --> 00:16:22,559 That's right. How did you know? 196 00:16:24,240 --> 00:16:25,440 What happened? 197 00:16:26,200 --> 00:16:28,320 Nothing. It didn't run. 198 00:16:28,360 --> 00:16:30,759 -They designed it so that it... -Oh, I think it did. 199 00:16:32,240 --> 00:16:36,039 It didn't, Gabriel. I tried it again and again. 200 00:16:36,080 --> 00:16:37,759 It just sat there. 201 00:16:37,799 --> 00:16:39,720 I watched. Nothing happened. 202 00:16:39,759 --> 00:16:43,240 You need to learn to look at the garbage in a different way. 203 00:16:45,120 --> 00:16:46,799 It's all about patterns. 204 00:16:46,840 --> 00:16:48,919 Finding the code, hidden within the garbage. 205 00:16:48,960 --> 00:16:50,120 But in this case... 206 00:16:50,159 --> 00:16:51,759 it's more complicated than normal. 207 00:16:51,799 --> 00:16:54,360 Usually, there'd be one character of code, 208 00:16:54,399 --> 00:16:56,720 and, say, five characters of garbage. 209 00:16:56,759 --> 00:17:00,600 In that case, you just need to write a script to read one character in six. 210 00:17:00,639 --> 00:17:02,759 So you're saying it's not all garbage? 211 00:17:03,840 --> 00:17:05,960 Then... 212 00:17:06,000 --> 00:17:08,559 ...there's where the number of real code and garbage characters vary 213 00:17:08,599 --> 00:17:10,319 according to a regular pattern. 214 00:17:10,359 --> 00:17:13,920 Say, one in four, then one in three, then one in two and back up again. 215 00:17:13,960 --> 00:17:16,359 And that's what we've got here in the BT code? 216 00:17:16,839 --> 00:17:18,200 No. 217 00:17:20,200 --> 00:17:21,839 This is more complicated. 218 00:17:21,880 --> 00:17:24,720 Here, there's no simple pattern. 219 00:17:24,759 --> 00:17:26,920 The code characters and garbage characters 220 00:17:26,960 --> 00:17:28,599 vary according to an algorithm. 221 00:17:28,640 --> 00:17:31,160 So, we can't extract the hidden code unless we know the algorithm? 222 00:17:31,200 --> 00:17:34,279 Oh, I've worked out the algorithm. That's what took me the time. 223 00:17:42,039 --> 00:17:44,480 There's your third stage. 224 00:17:44,519 --> 00:17:46,799 Hidden inside of what you thought was just garbage. 225 00:17:51,880 --> 00:17:55,920 That's a data scraper. That's how it mined our files. 226 00:17:58,839 --> 00:18:02,119 That must be the MAC address of your sandbox. 227 00:18:02,160 --> 00:18:03,640 That's how it broke out into our system. 228 00:18:03,680 --> 00:18:06,000 -- It can't be. -- Yes, I think so. 229 00:18:06,039 --> 00:18:08,119 But how could they possibly know that? 230 00:18:08,160 --> 00:18:10,039 A MAC address is like a fingerprint. 231 00:18:10,079 --> 00:18:11,720 How could someone in Russia know the address 232 00:18:11,759 --> 00:18:15,559 of a particular computer at GCHQ? It's impossible. 233 00:18:15,599 --> 00:18:16,759 No, it's obvious. 234 00:18:16,799 --> 00:18:18,519 Obvious? How? 235 00:18:19,160 --> 00:18:20,960 Someone must have told them. 236 00:18:27,160 --> 00:18:29,440 OK, even if that is true, 237 00:18:29,480 --> 00:18:31,519 it doesn't explain how they got the data out. 238 00:18:31,559 --> 00:18:33,480 This malware doesn't communicate. 239 00:18:43,759 --> 00:18:45,440 It exfiltrates as email. 240 00:18:46,680 --> 00:18:48,960 The data goes out as attachments. 241 00:18:49,000 --> 00:18:52,559 The emails get lost in the flood of all our other email traffic. 242 00:18:54,039 --> 00:18:55,440 No one notices. 243 00:18:58,440 --> 00:19:01,319 They've moved on from NSA exploits, by the way. 244 00:19:01,359 --> 00:19:02,880 Now they're taking our own stuff. 245 00:19:02,920 --> 00:19:04,000 What? 246 00:19:04,039 --> 00:19:05,480 Your emails are still going out. 247 00:19:05,920 --> 00:19:06,960 What? 248 00:19:53,039 --> 00:19:54,480 They must know what we're doing. 249 00:19:54,519 --> 00:19:57,519 Every time I cut a link to a domain, they set up a new one. 250 00:19:57,559 --> 00:19:59,640 We're losing a massive amount of data 251 00:19:59,680 --> 00:20:00,759 every second. 252 00:20:04,200 --> 00:20:06,119 The scraper you found in the garbage. 253 00:20:06,160 --> 00:20:08,880 Can you can shut it down, stop all this at source? 254 00:20:08,920 --> 00:20:10,000 Of course. 255 00:20:10,039 --> 00:20:11,240 Then do it! 256 00:20:11,759 --> 00:20:12,799 Please. 257 00:20:40,359 --> 00:20:42,160 -Is that it? -Yes. 258 00:20:42,200 --> 00:20:43,319 You've stopped it? 259 00:20:43,359 --> 00:20:45,680 Of course. Why do you sound so surprised? 260 00:20:45,720 --> 00:20:47,119 You're brilliant. 261 00:21:44,000 --> 00:21:45,680 I owe you an apology. 262 00:21:50,799 --> 00:21:52,920 You're right, you do. 263 00:21:56,039 --> 00:21:57,359 I'm sorry. 264 00:21:58,720 --> 00:22:00,880 What you did last night was amazing. 265 00:22:06,680 --> 00:22:09,839 ...as well as in Bradford, the central Mosque in Southall 266 00:22:09,880 --> 00:22:12,759 was fire-bombed while a service was taking place. 267 00:22:12,799 --> 00:22:16,519 A spokesperson for the Muslim Council of Britain blamed the attack, 268 00:22:16,559 --> 00:22:19,359 one of dozens reported in the last 36 hours, 269 00:22:19,400 --> 00:22:24,440 on the breakdown in public order in the aftermath of the disputed election... 270 00:22:27,400 --> 00:22:28,680 What is it? 271 00:22:30,680 --> 00:22:33,240 They're attacking mosques again. 272 00:22:33,279 --> 00:22:35,599 My brother works at a mosque in Swindon. 273 00:22:39,079 --> 00:22:40,799 Well, you should go. 274 00:22:49,680 --> 00:22:53,680 We read about it everyday in the papers and on our phones, 275 00:22:54,680 --> 00:22:56,799 we hear about it on the radio, 276 00:22:56,839 --> 00:23:00,359 we speak about it every morning with our neighbours... 277 00:23:00,400 --> 00:23:02,920 we watch it every night on the TV news. 278 00:23:04,680 --> 00:23:08,559 And of course, when they're attacking us in the streets, 279 00:23:08,599 --> 00:23:10,680 when they're burning our mosques, 280 00:23:12,079 --> 00:23:13,640 we want to strike back. 281 00:23:14,880 --> 00:23:16,079 Why wouldn't we? 282 00:23:16,960 --> 00:23:18,359 It's only human. 283 00:23:19,240 --> 00:23:21,880 It sounds easy, brothers and sisters, 284 00:23:24,039 --> 00:23:26,039 as do all the words of Shaytan. 285 00:23:27,119 --> 00:23:29,839 He speaks to us when we're angry. 286 00:23:29,880 --> 00:23:33,279 He fans the flames of our completely reasonable anger 287 00:23:34,039 --> 00:23:36,400 which comes from fear 288 00:23:38,720 --> 00:23:41,279 and the desire to protect those we love. 289 00:23:43,279 --> 00:23:47,319 But we don't protect them, brothers and sisters, 290 00:23:48,240 --> 00:23:51,759 by meeting violence with violence. 291 00:23:51,799 --> 00:23:55,440 Violence only breeds more violence, more hatred. 292 00:23:55,480 --> 00:23:58,720 We hit back and they hit us again, 293 00:23:59,200 --> 00:24:00,480 even harder. 294 00:24:02,359 --> 00:24:05,720 The way of Allah, Subhanahu wa-ta'ala, 295 00:24:05,759 --> 00:24:11,160 is the harder way, the more courageous way. 296 00:24:11,200 --> 00:24:15,279 The voice of Shaytan rages in our ears, blasting out all other sound. 297 00:24:17,759 --> 00:24:22,359 You will hear the voice of Allah, Subhanahu wa-ta'ala, 298 00:24:23,960 --> 00:24:25,640 when you are quiet, 299 00:24:27,759 --> 00:24:29,319 when you are at rest, 300 00:24:31,400 --> 00:24:33,319 when you are at peace. 301 00:24:42,519 --> 00:24:43,519 Saj? 302 00:25:10,279 --> 00:25:11,680 Hello, sir. 303 00:25:12,599 --> 00:25:13,920 -Shut the door. -Yeah. 304 00:25:17,880 --> 00:25:19,359 What is it? 305 00:25:19,400 --> 00:25:22,240 I've just been speaking to the Prime Minister. 306 00:25:22,279 --> 00:25:26,839 Apparently, MI5's found some compromising material 307 00:25:26,880 --> 00:25:28,839 ...on the Foreign Secretary's laptop. 308 00:25:31,880 --> 00:25:33,839 What kind of material? 309 00:25:33,880 --> 00:25:37,079 I'm not sure. They're sending it over, the laptop. 310 00:25:38,519 --> 00:25:40,799 Inappropriate communications with someone inside 311 00:25:40,839 --> 00:25:43,839 -the Russian government, that's all I've been told. 312 00:25:43,880 --> 00:25:46,720 "Highly prejudicial to national security." 313 00:25:47,480 --> 00:25:50,000 For fuck's sake. 314 00:25:50,039 --> 00:25:52,839 Surely even they must know that's a Russian plant? 315 00:25:52,880 --> 00:25:55,880 I don't know. It looks authentic, apparently. 316 00:25:55,920 --> 00:25:58,480 None of the usual signs of crashing around inside a computer. 317 00:25:58,519 --> 00:26:01,720 If it's a plant, it's a clever one, 318 00:26:01,759 --> 00:26:02,880 hard to prove. 319 00:26:04,519 --> 00:26:07,039 Anyway, she's had to resign. 320 00:26:12,359 --> 00:26:14,480 We're being played, aren't we? 321 00:26:15,640 --> 00:26:18,359 Have been. At every stage. 322 00:26:18,960 --> 00:26:22,640 Yeah. Yeah. 323 00:26:22,680 --> 00:26:25,400 And very convenient that we should lose our best friend in government 324 00:26:25,440 --> 00:26:26,720 at this precise moment. 325 00:26:31,599 --> 00:26:33,359 Secretary of State for Defence. 326 00:26:36,880 --> 00:26:41,680 I said after the BT attack that if we didn't respond robustly, 327 00:26:41,720 --> 00:26:44,279 we'd be hit again and we have been. 328 00:26:44,319 --> 00:26:50,400 Our election has been undermined and our most sensitive secrets stolen. 329 00:26:50,440 --> 00:26:53,680 By any measure, this constitutes the cyber equivalent 330 00:26:53,720 --> 00:26:56,319 of an armed attack on the United Kingdom. 331 00:26:58,200 --> 00:26:59,680 An act of war. 332 00:27:03,519 --> 00:27:05,640 Head of Operations, GCHQ. 333 00:27:09,160 --> 00:27:11,160 I'm not... 334 00:27:11,200 --> 00:27:14,519 disagreeing that a strong response is required 335 00:27:14,559 --> 00:27:17,200 but you should be aware that if you decide upon 336 00:27:17,240 --> 00:27:20,039 a symmetric cyber-attack, 337 00:27:20,079 --> 00:27:21,640 it will be highly escalatory. 338 00:27:22,640 --> 00:27:25,200 Truth is they've been one step ahead of us, 339 00:27:25,240 --> 00:27:26,519 provoking us, 340 00:27:26,559 --> 00:27:28,920 anticipating how we'll react at every stage. 341 00:27:28,960 --> 00:27:33,240 It's vital that we do not react as expected now. 342 00:27:33,279 --> 00:27:38,400 We should be careful of empty gestures that have profound consequences. 343 00:27:39,480 --> 00:27:41,400 Empty gestures? 344 00:27:41,440 --> 00:27:46,279 Yes. Especially if there are other motives for doing it. 345 00:27:47,640 --> 00:27:48,920 What other motives? 346 00:27:51,039 --> 00:27:52,400 Can I speak frankly? 347 00:27:53,240 --> 00:27:54,440 Of course. 348 00:27:56,759 --> 00:27:58,519 To shore up the position of a government 349 00:27:58,559 --> 00:28:00,440 whose legitimacy has been questioned. 350 00:28:00,480 --> 00:28:03,519 -To distract attention. 351 00:28:04,519 --> 00:28:06,640 Is that what you think is going on here? 352 00:28:06,680 --> 00:28:11,279 With the greatest respect to our colleague from GCHQ, Prime Minister, 353 00:28:11,319 --> 00:28:14,960 that is a completely outrageous suggestion. 354 00:28:15,000 --> 00:28:21,039 This country has either faced an attack amounting to an act of war or it hasn't. 355 00:28:21,079 --> 00:28:22,720 And if it has, 356 00:28:22,759 --> 00:28:26,799 it is our duty as the properly constituted government to respond. 357 00:28:26,839 --> 00:28:30,880 It's nothing to do with legitimacy or any other political considerations. 358 00:28:36,319 --> 00:28:38,839 Can I just remind us that the then Attorney General 359 00:28:38,880 --> 00:28:43,279 made our red lines absolutely clear in his 2018 speech. 360 00:28:43,319 --> 00:28:45,960 Use of cyber to manipulate the electoral system 361 00:28:46,000 --> 00:28:50,079 explicitly constitutes an intervention in our domestic affairs. 362 00:28:50,119 --> 00:28:52,160 If, after that speech, we do nothing, 363 00:28:52,200 --> 00:28:55,640 we are basically saying it's OK to just roll your tanks into London. 364 00:28:55,680 --> 00:28:57,880 Yes, I see your point. 365 00:28:57,920 --> 00:29:02,240 Of course, if we retaliate, we might expose some of the things 366 00:29:02,279 --> 00:29:03,480 we ourselves are doing, 367 00:29:03,519 --> 00:29:07,279 within Russia's critical national infrastructure. 368 00:29:07,319 --> 00:29:11,079 Which would leave us open to the accusation of double standards. 369 00:29:12,200 --> 00:29:14,720 But if that is the way you wish to go, 370 00:29:14,759 --> 00:29:18,480 Prime Minister, Danny can lay out some further options. 371 00:29:18,519 --> 00:29:20,680 We don't need your options. 372 00:29:20,720 --> 00:29:22,960 The army will be taking the lead this time. 373 00:29:24,079 --> 00:29:25,359 Good luck with that. 374 00:29:26,680 --> 00:29:27,960 What was that? 375 00:29:28,000 --> 00:29:29,599 Nothing. 376 00:29:29,640 --> 00:29:34,240 Good, because Russia has effectively declared war on this country. 377 00:29:34,279 --> 00:29:36,240 And, we, those of us around this table 378 00:29:36,279 --> 00:29:39,160 are charged with the defence of this nation. 379 00:29:39,200 --> 00:29:41,519 I require your support to do so. 380 00:29:56,400 --> 00:29:57,640 David. 381 00:30:01,480 --> 00:30:03,839 I'm sending you a team from the National Cyber Force. 382 00:30:03,880 --> 00:30:07,440 I want you to build them an attack, targeting the Russian arms industry. 383 00:30:07,480 --> 00:30:10,480 And I want it done today. Can you do that? 384 00:30:11,079 --> 00:30:12,279 Put them out of action? 385 00:30:14,880 --> 00:30:17,000 We can certainly try. 386 00:30:17,039 --> 00:30:20,480 It's time to show us what we've been paying for at GCHQ. 387 00:30:20,519 --> 00:30:22,640 All this money we've spent, 388 00:30:22,680 --> 00:30:24,680 it's time to show us what you can do. 389 00:30:33,960 --> 00:30:36,039 I'm sorry, Saj. 390 00:30:37,440 --> 00:30:38,799 You were right. 391 00:30:41,079 --> 00:30:44,640 I should've thought more carefully before I took the job at GCHQ. 392 00:30:45,480 --> 00:30:48,279 About the consequences for our family. 393 00:30:49,000 --> 00:30:50,640 I over-reacted. 394 00:30:50,680 --> 00:30:52,799 No, you didn't. 395 00:30:54,720 --> 00:30:55,960 You were right. 396 00:30:57,319 --> 00:30:58,880 I shouldn't have gone there. 397 00:31:04,599 --> 00:31:07,880 I've made a mistake. At work. 398 00:31:07,920 --> 00:31:09,079 What mistake? 399 00:31:11,319 --> 00:31:12,920 I suppose you can't say? 400 00:31:20,079 --> 00:31:21,559 I did something... 401 00:31:23,200 --> 00:31:25,279 I thought was really clever. 402 00:31:25,880 --> 00:31:27,440 But it wasn't. 403 00:31:27,480 --> 00:31:30,599 It was incredibly stupid and gullible. 404 00:31:32,400 --> 00:31:34,839 And it's allowed something terrible to happen. 405 00:31:36,200 --> 00:31:38,160 Are you sure? 406 00:31:38,200 --> 00:31:40,680 Because you always think everything's your fault. 407 00:31:42,839 --> 00:31:44,279 You have no idea. 408 00:31:54,079 --> 00:31:56,160 Anyway, Dad was my fault. 409 00:31:56,200 --> 00:31:58,440 What? How is that your fault? 410 00:32:00,039 --> 00:32:01,799 He killed himself. 411 00:32:01,839 --> 00:32:04,240 He killed himself because I went away to uni and left him. 412 00:32:04,279 --> 00:32:05,680 -No, Saar... -He did. 413 00:32:05,720 --> 00:32:08,440 -I abandoned him. -No, that's not what happened, Saar. 414 00:32:08,480 --> 00:32:12,480 -Yeah, he killed himself. -He didn't kill himself. 415 00:32:12,519 --> 00:32:15,440 I mean sorry to ruin this "I'm to blame for everything" thing 416 00:32:15,480 --> 00:32:16,839 you've got going, but no, 417 00:32:17,519 --> 00:32:19,119 he didn't kill himself. 418 00:32:19,160 --> 00:32:21,559 If you'd come home, you'd know that. 419 00:32:23,119 --> 00:32:24,559 It was an accident. 420 00:32:24,599 --> 00:32:27,079 A signalman made a mistake. 421 00:32:27,119 --> 00:32:31,160 He sent a goods train up a line that was supposed to be out of service. 422 00:32:31,200 --> 00:32:34,799 Dad took a short cut across the track and the train hit him. 423 00:32:35,359 --> 00:32:36,880 It wasn't suicide. 424 00:32:40,400 --> 00:32:42,799 You're just saying that because suicide is haram. 425 00:32:42,839 --> 00:32:45,279 No, I swear on Mum's life. 426 00:32:46,200 --> 00:32:48,920 That's what happened. 427 00:32:48,960 --> 00:32:51,960 You may have behaved like a shit not coming to see him 428 00:32:52,000 --> 00:32:53,920 but he didn't commit suicide. 429 00:33:08,119 --> 00:33:09,480 I liked your sermon. 430 00:33:10,880 --> 00:33:11,880 Thanks. 431 00:33:14,279 --> 00:33:19,400 I mean, I... I agreed with... I agreed with everything you said. 432 00:33:31,920 --> 00:33:33,640 Do you think I should resign? 433 00:33:34,599 --> 00:33:35,720 Oh. 434 00:33:36,440 --> 00:33:39,119 That's up to you, 435 00:33:39,160 --> 00:33:42,839 but we'd be losing the last real voice of moderation around the table. 436 00:33:42,880 --> 00:33:46,480 There'd be nobody left to protect the staff. 437 00:33:46,519 --> 00:33:47,759 Well, what about you? 438 00:33:48,319 --> 00:33:49,640 Me? 439 00:33:50,799 --> 00:33:54,039 They'd sack me 15 seconds after you're out the door. 440 00:33:57,200 --> 00:33:59,480 Sorry, they're ready. 441 00:34:01,279 --> 00:34:02,480 They're ready. 442 00:34:08,159 --> 00:34:10,039 Um, 443 00:34:10,079 --> 00:34:13,960 I told Barbara to take the kids and go and stay with her parents in France. 444 00:34:14,800 --> 00:34:17,079 -You're joking. -No, absolutely not. 445 00:34:18,360 --> 00:34:20,760 Well, it's not that bad, is it? 446 00:34:20,800 --> 00:34:24,280 I don't know. But I'm pretty sure this, us attacking them, 447 00:34:24,320 --> 00:34:26,559 it's exactly what they want us to do. 448 00:34:26,599 --> 00:34:28,480 You have to ask yourself why. 449 00:34:29,800 --> 00:34:31,880 Do you think I should get Freddie out? 450 00:34:35,119 --> 00:34:36,360 Maybe. 451 00:34:57,719 --> 00:34:59,239 Ready, boss. 452 00:34:59,280 --> 00:35:01,360 OK, what happens now? 453 00:35:01,400 --> 00:35:03,960 You stand aside and we press the button. 454 00:35:04,000 --> 00:35:05,639 That way it's covered by the "rules of war" 455 00:35:05,679 --> 00:35:07,760 and you don't end up in the Hague. 456 00:35:11,480 --> 00:35:13,039 OK, Finn. Up you get. 457 00:35:28,639 --> 00:35:30,320 Control-E. 458 00:35:40,760 --> 00:35:42,679 How long will it take to have an effect? 459 00:35:43,880 --> 00:35:45,360 No time at all. 460 00:35:46,719 --> 00:35:48,000 It's happening now. 461 00:36:17,599 --> 00:36:18,840 Is this real? 462 00:36:19,440 --> 00:36:21,679 Real? I doubt it. 463 00:36:55,159 --> 00:36:57,239 Danny? Can I have a word with you? 464 00:36:57,280 --> 00:36:59,679 -What is it? -A private word. 465 00:37:08,599 --> 00:37:10,840 -What is it? -Our comms are down. 466 00:37:10,880 --> 00:37:12,679 -Sorry? -All our comms are down. 467 00:37:12,719 --> 00:37:16,599 I wanted to speak to you out here because I didn't want to create a panic. 468 00:37:16,639 --> 00:37:19,559 -What, just army comms... -To be honest, we're not sure. 469 00:37:19,599 --> 00:37:22,679 I managed to get through to the MOD on one of your landlines. 470 00:37:22,719 --> 00:37:26,199 They're requesting that GCHQ help re-establish contact. 471 00:37:26,239 --> 00:37:28,599 -With... -With UK Armed Forces. 472 00:37:29,559 --> 00:37:30,880 Sorry, Danny. 473 00:37:30,920 --> 00:37:32,360 The Defence Secretary is on the line. 474 00:37:32,400 --> 00:37:33,800 Which channel? 475 00:37:33,840 --> 00:37:36,639 No, I mean he's actually on the line. He's on the phone. 476 00:37:42,000 --> 00:37:43,440 Richard. We've just heard. 477 00:37:43,480 --> 00:37:44,599 Heard what? 478 00:37:44,639 --> 00:37:46,559 About your loss of comms. 479 00:37:46,599 --> 00:37:52,000 Not that. The nuclear submarine control system is unresponsive. 480 00:37:52,039 --> 00:37:53,679 It may have been hacked. 481 00:37:53,719 --> 00:37:55,239 What? 482 00:37:55,280 --> 00:37:57,400 Are you... Are you absolutely sure? 483 00:37:58,760 --> 00:37:59,800 Richard? 484 00:38:00,800 --> 00:38:01,880 Richard? 485 00:38:05,599 --> 00:38:07,239 If there's anything still working around here, 486 00:38:07,280 --> 00:38:09,559 try and get me NSA up on the satellite... 487 00:38:09,599 --> 00:38:11,199 -...on this one. -OK. 488 00:38:33,599 --> 00:38:35,199 I've decided to leave. 489 00:38:36,800 --> 00:38:38,039 GCHQ. 490 00:38:39,159 --> 00:38:40,159 OK. 491 00:38:43,400 --> 00:38:45,239 But if you've made a mess, 492 00:38:45,280 --> 00:38:48,000 don't leave before you've cleared it up. 493 00:38:48,039 --> 00:38:50,599 You should never leave someone else to clear up your mess, Saar. 494 00:39:01,719 --> 00:39:02,760 Mitch. 495 00:39:03,800 --> 00:39:05,199 Danny. 496 00:39:05,239 --> 00:39:07,159 Look, I know you guys aren't talking to us at the moment 497 00:39:07,199 --> 00:39:08,960 but I thought you should know somebody just hacked 498 00:39:09,000 --> 00:39:10,840 our nuclear submarine control system. 499 00:39:12,000 --> 00:39:13,159 What? You're kidding? 500 00:39:13,199 --> 00:39:15,599 Plus all of our military comms are down. 501 00:39:15,639 --> 00:39:17,559 The Russians have just spent the last two hours 502 00:39:17,599 --> 00:39:19,639 exaggerating the effect of a very targeted attack 503 00:39:19,679 --> 00:39:21,519 on a couple of arms factories to make 504 00:39:21,559 --> 00:39:24,000 whatever it is they're doing look like self-defence. 505 00:39:24,039 --> 00:39:26,679 And my guess is, they've been planning this for a long time. 506 00:39:26,719 --> 00:39:30,360 Yeah, the problem is we're seeing those images of hospital fires too, Danny... 507 00:39:30,400 --> 00:39:31,639 Yeah, they're fakes, Mitch. 508 00:39:31,679 --> 00:39:34,039 -Well, they look pretty real to us. 509 00:39:35,119 --> 00:39:37,039 I've gotta tell you, 510 00:39:37,079 --> 00:39:39,079 there's not a lot of warm feelings towards you guys here at the moment. 511 00:39:41,960 --> 00:39:45,119 We really could do with some help right now, Mitch. 512 00:39:54,239 --> 00:39:55,440 You can't use that in here. 513 00:40:01,599 --> 00:40:04,159 You can't use that here. Turn it off, now. 514 00:40:04,199 --> 00:40:06,800 OK, but I've got to write this down. 515 00:40:08,000 --> 00:40:09,679 Have you got any paper? 516 00:41:42,719 --> 00:41:43,840 Saara, wait. 517 00:41:44,559 --> 00:41:46,159 I've got nothing to say to you. 518 00:41:46,199 --> 00:41:47,360 Please. 519 00:41:47,400 --> 00:41:48,840 I think you're about to be attacked. 520 00:41:48,880 --> 00:41:50,119 The UK. 521 00:41:50,159 --> 00:41:51,960 I've got something to give you that will stop it. 522 00:41:52,000 --> 00:41:53,559 I don't believe you, Vadim. 523 00:41:53,599 --> 00:41:55,960 It's just another provocation. 524 00:41:56,000 --> 00:41:58,159 Anyway, I thought you said in Harrogate they'd kill you. 525 00:41:58,199 --> 00:41:59,320 I don't care any more. 526 00:41:59,360 --> 00:42:01,159 I don't care what happens to me. 527 00:42:01,199 --> 00:42:02,719 This is too important. 528 00:42:04,159 --> 00:42:05,440 Look at this. 529 00:42:19,280 --> 00:42:20,440 What is that? 530 00:42:20,480 --> 00:42:23,480 It's you. At your desk in GCHQ. 531 00:42:40,639 --> 00:42:43,760 OK, you hacked the CCTV. 532 00:42:43,800 --> 00:42:45,760 So what? What does that prove? 533 00:42:45,800 --> 00:42:48,800 Saara, please. There isn't much time. 534 00:42:48,840 --> 00:42:52,519 You have to trust me. You have to think outside the box. 535 00:42:53,679 --> 00:42:56,800 What? What did you say? 536 00:43:03,760 --> 00:43:07,320 JSSO's showing unidentified aircraft entering our airspace. 537 00:43:07,360 --> 00:43:08,880 None of the other systems are showing it 538 00:43:08,920 --> 00:43:10,760 and the RAF doesn't seem to have been scrambled yet. 539 00:43:10,800 --> 00:43:12,719 But it is possible we are under attack. 540 00:43:12,760 --> 00:43:14,880 It's just another hack, isn't it? Fake news? 541 00:43:14,920 --> 00:43:18,719 But what if it's real this time, you know, like crying wolf? 542 00:43:18,760 --> 00:43:21,119 How can we take that chance? 543 00:43:21,159 --> 00:43:23,360 -What, an invasion? -Why not? 544 00:43:23,400 --> 00:43:26,199 We've been underestimating Putin for ten years. 545 00:43:26,239 --> 00:43:29,239 All the way through we've been asking what's the bigger picture. 546 00:43:29,280 --> 00:43:32,360 The one thing we've never considered is that he might just be insane enough 547 00:43:32,400 --> 00:43:34,800 to have territorial ambitions. 548 00:43:34,840 --> 00:43:37,239 What if this whole thing is about separating us from Europe 549 00:43:37,280 --> 00:43:41,440 and the Americans so that when this moment came, we'd be alone? 550 00:43:43,000 --> 00:43:44,639 Not now, Saara. 551 00:43:44,679 --> 00:43:48,480 Danny, you absolutely have to come and see this. Right now! 552 00:43:49,760 --> 00:43:52,960 It's the CCTV, so what? Saara, I don't have time for this. 553 00:43:53,000 --> 00:43:54,639 You have to turn it off. 554 00:43:54,679 --> 00:43:56,280 Please. 555 00:43:56,320 --> 00:43:58,639 I can't show you what I've got to show you until you turn it off. 556 00:44:01,599 --> 00:44:03,119 Shut down the CCTV. 557 00:44:03,920 --> 00:44:04,920 Really? 558 00:44:06,000 --> 00:44:07,039 Yeah. Do it. 559 00:44:11,599 --> 00:44:13,480 They hacked the system. 560 00:44:13,519 --> 00:44:15,480 The FSB were watching everything we're doing. 561 00:44:15,519 --> 00:44:19,960 They can't. It's air-gapped. How do you know? 562 00:44:20,000 --> 00:44:22,400 Because I've just been inside their computer. 563 00:44:26,760 --> 00:44:29,840 I'm sending you something now. Two things. 564 00:44:29,880 --> 00:44:32,000 You can use them to trade with the Americans, 565 00:44:32,039 --> 00:44:33,559 to bring them back in. 566 00:44:33,599 --> 00:44:36,159 As soon as that happens, Putin will back down. 567 00:44:41,079 --> 00:44:42,719 During this first phase, 568 00:44:42,760 --> 00:44:47,320 we are degrading the capability and resolve of our enemy 569 00:44:47,360 --> 00:44:49,679 as well as discrediting 570 00:44:49,719 --> 00:44:52,760 his institutions and leadership with espionage, 571 00:44:52,800 --> 00:44:56,440 assassination, er, manipulation of social media, 572 00:44:56,480 --> 00:44:59,280 cyber attacks, faking of imagery... 573 00:44:59,320 --> 00:45:01,559 all with the aim of creating disillusionment, 574 00:45:01,599 --> 00:45:03,800 confusion and chaos. 575 00:45:05,239 --> 00:45:08,760 Er, by the time war is openly declared, 576 00:45:08,800 --> 00:45:10,960 -the enemy's ability to defend himself... -War? 577 00:45:11,000 --> 00:45:12,920 -- ...will be significantly reduced... -- Danny? 578 00:45:12,960 --> 00:45:15,960 -We're receiving a data dump. -Where from? 579 00:45:16,000 --> 00:45:17,880 Russia. 580 00:45:19,719 --> 00:45:22,400 -In the next phase, we engineer... -OK, let's go. 581 00:45:22,440 --> 00:45:25,159 ...er, our enemy's strategic situation. 582 00:45:25,199 --> 00:45:31,000 His, er, relationships with his allies are fatally undermined, one by one. 583 00:45:34,000 --> 00:45:37,480 It's mostly code. There's terabytes of it. 584 00:45:39,519 --> 00:45:42,960 I think it's the FSB's offensive cyber exploits. 585 00:45:46,559 --> 00:45:47,800 My God! 586 00:45:48,800 --> 00:45:50,960 This puts us back in the game. 587 00:45:58,039 --> 00:46:01,280 So how is all this to be achieved? 588 00:46:01,320 --> 00:46:06,199 How do you ensure that, er, the final phase, the war is won? 589 00:46:06,239 --> 00:46:12,920 The war is won using a technique called Reflexive Control. 590 00:46:12,960 --> 00:46:14,679 This is, er, the... 591 00:46:14,719 --> 00:46:18,840 Predetermining the enemy's behaviour in Russia's favour. 592 00:46:18,880 --> 00:46:22,440 We define our ultimate objective... 593 00:46:26,320 --> 00:46:31,199 We define our ultimate objective, the total defeat of our enemy.