1 00:00:20,614 --> 00:00:22,494 So what made you decide to leave, 2 00:00:22,574 --> 00:00:24,574 come to Moscow? 3 00:00:25,694 --> 00:00:29,094 Because I'm fed up with lying to the public 4 00:00:29,174 --> 00:00:33,414 about what's really going on at GCHQ where I work. 5 00:00:33,494 --> 00:00:37,054 I've done 50 years of service 6 00:00:37,134 --> 00:00:38,774 and I've had enough. 7 00:00:38,854 --> 00:00:42,494 It's time for me to stand up and say my piece. 8 00:00:46,648 --> 00:00:48,528 And I've had enough. 9 00:00:48,553 --> 00:00:51,913 It's time for me to stand up and say my piece. 10 00:00:52,698 --> 00:00:54,218 And what is that? 11 00:00:54,243 --> 00:00:56,243 You were friends, weren't you? 12 00:00:58,658 --> 00:01:00,658 Hi. Sorry? 13 00:01:00,683 --> 00:01:02,683 You were friends. 14 00:01:03,894 --> 00:01:05,414 Yeah. 15 00:01:05,494 --> 00:01:07,134 At least I thought so. 16 00:01:07,214 --> 00:01:09,214 So what are you looking for? 17 00:01:09,694 --> 00:01:11,454 I don't know. 18 00:01:11,534 --> 00:01:13,854 A clue, anything. 19 00:01:14,894 --> 00:01:17,094 I just can't believe he'd do this to us. 20 00:01:17,174 --> 00:01:19,454 "Us." 21 00:01:19,534 --> 00:01:20,854 He goes missing at the same time 22 00:01:20,934 --> 00:01:24,174 as the biggest leak in intelligence history. 23 00:01:24,254 --> 00:01:27,654 He turns up in Moscow and admits it on Russian television. 24 00:01:27,734 --> 00:01:29,854 I'd have thought that was enough evidence, 25 00:01:31,134 --> 00:01:33,134 even for you. 26 00:01:36,214 --> 00:01:37,550 You mean I should get back to work. 27 00:01:37,574 --> 00:01:38,814 That's OK, Saara. 28 00:01:38,894 --> 00:01:40,734 I think we all gave up hope a while back 29 00:01:40,814 --> 00:01:42,894 of you ever actually doing any work around here. 30 00:03:30,534 --> 00:03:33,814 Don't people hate having their grammar corrected? 31 00:03:33,894 --> 00:03:36,814 I mean, doesn't it just make everyone hate you? 32 00:03:36,894 --> 00:03:40,414 If we wrote code as sloppily as we write English, it would never run. 33 00:03:40,494 --> 00:03:42,494 Some things have to be right. 34 00:03:53,454 --> 00:03:55,454 Is that all you're having? 35 00:03:57,414 --> 00:03:59,254 I'm Muslim. 36 00:03:59,334 --> 00:04:01,334 They don't have anything halal here. 37 00:04:05,414 --> 00:04:07,494 They won't be very welcoming. 38 00:04:07,574 --> 00:04:09,494 - What's funny? 39 00:04:09,574 --> 00:04:11,414 No different to any other department here then? 40 00:04:11,494 --> 00:04:14,374 Different "from" any other department. 41 00:04:14,454 --> 00:04:16,494 It's "different from, compared with." 42 00:04:20,374 --> 00:04:22,894 No different "from" any other department. 43 00:04:22,974 --> 00:04:25,094 It's "different from, compared with." 44 00:04:28,334 --> 00:04:30,694 Different from, compared with. 45 00:04:33,374 --> 00:04:36,214 Different from, compared with. 46 00:04:36,294 --> 00:04:38,414 Different from, compared with. 47 00:04:38,494 --> 00:04:40,414 Different from, compared with. 48 00:04:40,494 --> 00:04:42,414 Different from, compared with. 49 00:04:42,494 --> 00:04:45,214 Different from, compared with. 50 00:04:45,294 --> 00:04:47,294 Different from, compared with. 51 00:04:48,974 --> 00:04:52,654 Because I'm fed up with lying to the public 52 00:04:52,734 --> 00:04:57,014 about what's really going on at GCHQ where I work. 53 00:04:57,094 --> 00:04:58,134 I've done... 54 00:05:01,294 --> 00:05:03,294 stand up and say my piece. 55 00:05:03,374 --> 00:05:05,094 And what is that? 56 00:05:05,174 --> 00:05:08,414 That we are no different to what we're always accusing you lot of. 57 00:05:08,494 --> 00:05:10,614 - Yes! - What is it? 58 00:05:10,694 --> 00:05:12,414 He said "different to." 59 00:05:12,494 --> 00:05:15,934 He would never say "different to." He would never make that mistake. 60 00:05:16,014 --> 00:05:18,014 It can't be him. 61 00:05:19,574 --> 00:05:21,974 What? Saara, wait. 62 00:05:36,894 --> 00:05:38,614 Where is he? 63 00:05:38,694 --> 00:05:40,814 Danny's on his way to London, Saara. 64 00:05:43,494 --> 00:05:45,494 Shit! 65 00:05:50,694 --> 00:05:52,694 Kathy? 66 00:05:55,494 --> 00:05:57,494 She's not here. 67 00:05:58,094 --> 00:06:00,094 Where is she? 68 00:06:00,774 --> 00:06:02,774 - She's gone. - What do you mean gone? 69 00:06:03,494 --> 00:06:05,494 What did you say to her? 70 00:06:09,014 --> 00:06:11,974 I didn't say anything. I came back and she was packing. 71 00:06:13,294 --> 00:06:15,294 She's been recalled to Maryland. 72 00:06:16,214 --> 00:06:17,414 Er... 73 00:06:17,494 --> 00:06:19,774 She flew about 25 minutes ago. She left you this. 74 00:06:38,814 --> 00:06:40,814 What's going on, Saara? 75 00:06:42,734 --> 00:06:44,734 And don't lie to me this time. 76 00:06:52,494 --> 00:06:54,614 You're in love with her, aren't you? 77 00:06:57,094 --> 00:06:59,094 Don't lie, please. 78 00:07:04,574 --> 00:07:06,574 I don't know. 79 00:07:08,374 --> 00:07:10,374 Maybe. 80 00:07:18,694 --> 00:07:20,694 Have you made love here? 81 00:07:27,694 --> 00:07:29,694 Yes. 82 00:07:37,694 --> 00:07:39,614 OK. 83 00:07:39,694 --> 00:07:41,774 Where does that leave us? 84 00:07:44,614 --> 00:07:46,614 Do you still love me? 85 00:07:47,374 --> 00:07:50,014 Did you ever really love me? 86 00:07:59,294 --> 00:08:01,694 Don't go, James, please. I'm sorry. 87 00:08:07,454 --> 00:08:09,414 I know you just lost your dad... 88 00:08:09,494 --> 00:08:10,854 and I know you're upset, 89 00:08:10,894 --> 00:08:13,614 and I know you say you can't deal with your emotions. 90 00:08:14,494 --> 00:08:16,294 I've tried to make allowances, 91 00:08:17,494 --> 00:08:19,494 I really have. 92 00:08:21,254 --> 00:08:24,934 But when you crash into people's lives, people get hurt. 93 00:08:27,014 --> 00:08:29,734 People who care about you. People who love you. 94 00:08:35,294 --> 00:08:36,974 Just try and think about that? 95 00:08:55,254 --> 00:08:57,254 Fuck. 96 00:09:10,654 --> 00:09:12,654 Ah, Mark, welcome. 97 00:09:13,934 --> 00:09:15,494 Sorry, I'm late. 98 00:09:15,574 --> 00:09:17,374 It's fine. 99 00:09:17,454 --> 00:09:21,254 I'm sure I don't need to tell you the effect of the Yeabsley leak is... 100 00:09:23,134 --> 00:09:25,094 devastating. 101 00:09:25,174 --> 00:09:27,814 Most of our tools have been rendered nugatory 102 00:09:27,894 --> 00:09:31,094 and will have to be built again from scratch. 103 00:09:31,174 --> 00:09:35,214 Our priority now is to keep what little we do have left secure. 104 00:09:37,934 --> 00:09:40,974 As of 2000 hours today, Eastern Time, 105 00:09:41,054 --> 00:09:45,094 the NSA's intelligence-sharing arrangement with the UK is withdrawn. 106 00:09:46,254 --> 00:09:48,254 For the foreseeable future. 107 00:09:49,094 --> 00:09:51,134 Er, Mark... 108 00:09:51,214 --> 00:09:54,694 It signals cooperation between our two countries, 109 00:09:54,774 --> 00:09:57,334 it goes back 75 years and it plays a vital... 110 00:09:57,414 --> 00:10:01,774 This decision comes from the commander-in-chief personally 111 00:10:02,854 --> 00:10:04,854 and is not open for discussion. 112 00:10:05,934 --> 00:10:07,974 The question we're all asking ourselves here is 113 00:10:08,054 --> 00:10:09,934 why the hell you re-employed a loose cannon 114 00:10:10,014 --> 00:10:12,014 like John Yeabsley in the first place? 115 00:10:29,734 --> 00:10:31,734 - Hi. - You all right? 116 00:10:34,574 --> 00:10:36,494 Where do you want me, Sarge? 117 00:10:36,574 --> 00:10:38,094 Er, get yourself round the back. 118 00:10:38,174 --> 00:10:40,494 Make sure no press are trying to get in through the garden. 119 00:10:41,174 --> 00:10:42,214 Hey. 120 00:10:42,294 --> 00:10:43,550 You're gonna need a mask, Sandy. 121 00:10:43,574 --> 00:10:45,774 Oh, I'm just going straight through, thank you. 122 00:10:50,134 --> 00:10:52,134 Hiya. 123 00:11:06,014 --> 00:11:08,014 Sorry. Thanks. 124 00:11:45,774 --> 00:11:48,534 James, it's me again. 125 00:11:49,814 --> 00:11:52,854 Please call me back. I know you're angry. 126 00:11:54,094 --> 00:11:55,214 We need to talk. 127 00:12:00,334 --> 00:12:02,334 Come on! 128 00:12:02,694 --> 00:12:05,654 GCHQ Intelligence Analyst, John Yeabsley, 129 00:12:05,734 --> 00:12:07,734 seen yesterday on Russian TV 130 00:12:07,814 --> 00:12:11,814 admitting responsibility for a massive leak of GCHQ secrets 131 00:12:11,894 --> 00:12:15,934 could not have been in Moscow yesterday. Back to Dan. 132 00:12:16,014 --> 00:12:17,374 - Yes! That's right, Alan... 133 00:12:17,414 --> 00:12:19,214 Yes, yes, yes! I knew it! 134 00:12:19,294 --> 00:12:20,950 In light of what the police are saying here tonight, 135 00:12:20,974 --> 00:12:25,614 the interview shown yesterday on Russian TV seems likely now 136 00:12:25,694 --> 00:12:28,014 somehow to have been faked. 137 00:12:28,094 --> 00:12:30,414 As he was clearly already dead, here in Cheltenham, 138 00:12:30,494 --> 00:12:33,054 when he was supposedly being taped in Moscow. 139 00:12:55,134 --> 00:12:56,534 Oh, dear... 140 00:12:56,614 --> 00:12:58,374 A mountain of code. 141 00:12:58,454 --> 00:13:02,734 Perhaps it will make you, er, check your assumptions. 142 00:13:02,814 --> 00:13:04,814 Remember the Nigerian prince. 143 00:13:09,694 --> 00:13:15,694 If you find yourself scouring through thousands and thousands of lines of code, 144 00:13:15,774 --> 00:13:21,294 that's probably exactly what they're expecting you to do. 145 00:13:23,374 --> 00:13:25,014 Don't. 146 00:13:25,094 --> 00:13:27,094 Do something else, 147 00:13:27,694 --> 00:13:29,694 unexpected. 148 00:13:31,534 --> 00:13:34,774 You have to think outside the box. 149 00:13:39,734 --> 00:13:44,094 If you can't, then you have to find someone who can. 150 00:13:54,414 --> 00:13:55,854 Should I offer to help? 151 00:13:55,934 --> 00:13:57,734 Oh, no, she doesn't need any help. 152 00:13:57,814 --> 00:13:59,654 She knows exactly where everything is. 153 00:13:59,734 --> 00:14:01,734 Don't you, dear? 154 00:14:09,094 --> 00:14:11,470 It's the first time we've had one of Gabe's work friends to visit. 155 00:14:11,494 --> 00:14:13,254 Isn't it, Gabe? 156 00:14:13,334 --> 00:14:15,374 We'd almost given up hope. 157 00:14:15,454 --> 00:14:16,734 Sorry? 158 00:14:16,814 --> 00:14:19,934 He was turned down by so many employers before GCHQ. 159 00:14:20,014 --> 00:14:22,374 We moved here so we could look after him. 160 00:14:22,454 --> 00:14:24,454 He can't live alone, obviously. 161 00:14:27,934 --> 00:14:30,094 I know you said you didn't want to help me any more 162 00:14:30,174 --> 00:14:32,334 - but I'm in trouble. - What kind of trouble? 163 00:14:33,494 --> 00:14:35,134 What I'm saying is... 164 00:14:35,214 --> 00:14:37,214 I've got GCHQ into trouble. 165 00:14:38,334 --> 00:14:40,334 OK, what I mean is... 166 00:14:41,454 --> 00:14:43,774 I didn't realise I was being used. 167 00:14:43,854 --> 00:14:46,094 I think there's a third-stage malware, Gabriel, 168 00:14:46,174 --> 00:14:47,974 hidden inside the code. 169 00:14:48,054 --> 00:14:50,374 I need to find it. 170 00:14:50,454 --> 00:14:53,254 Someone tried to warn me about it, that it was really dangerous, 171 00:14:53,334 --> 00:14:56,374 but it's only now I think I know what he meant. 172 00:14:56,454 --> 00:14:59,174 - Who warned you? - That's not important now. 173 00:14:59,254 --> 00:15:02,134 There's been a massive leak of data from GCHQ, right? 174 00:15:02,214 --> 00:15:03,694 Incredibly damaging? 175 00:15:03,774 --> 00:15:06,054 I think that's what the third stage does. 176 00:15:06,134 --> 00:15:08,614 I think there's some hidden part of the original malware 177 00:15:08,694 --> 00:15:10,694 that was built to steal our data. 178 00:15:11,374 --> 00:15:13,054 But I can't find it. 179 00:15:13,134 --> 00:15:16,294 I've been back through the code line by line. There's nothing. 180 00:15:20,774 --> 00:15:22,894 That's the puzzle, Gabriel. 181 00:15:22,974 --> 00:15:26,974 - I'm asking if you'd... - It's OK, Saara. I get it. 182 00:15:28,774 --> 00:15:30,374 Where are you going, Gabe? 183 00:15:30,454 --> 00:15:32,254 Sorry. 184 00:15:32,334 --> 00:15:34,654 But what about the curfew? 185 00:15:44,814 --> 00:15:47,174 -It's obfuscated. You don't need to... Wait. 186 00:15:55,174 --> 00:15:57,614 I was just trying to say you don't need to waste time on it. 187 00:15:57,694 --> 00:15:59,174 The original code's obfuscated. 188 00:15:59,254 --> 00:16:01,535 They included all this garbage so that anti-virus software 189 00:16:01,614 --> 00:16:02,830 wouldn't recognise it as malware. 190 00:16:02,854 --> 00:16:04,374 How many lines of garbage? 191 00:16:04,454 --> 00:16:05,814 I don't know, thousands. 192 00:16:05,894 --> 00:16:07,974 We stripped them out so we could work on it. 193 00:16:09,254 --> 00:16:10,974 Tea? 194 00:16:11,054 --> 00:16:13,310 Before you stripped them out, you tried to get it to run in a sandbox. 195 00:16:13,334 --> 00:16:15,334 That's right. How did you know? 196 00:16:16,694 --> 00:16:18,574 What happened? 197 00:16:18,654 --> 00:16:20,734 Nothing. It didn't run. 198 00:16:20,814 --> 00:16:23,174 - They designed it so that it... - Oh, I think it did. 199 00:16:24,694 --> 00:16:28,454 It didn't, Gabriel. I tried it again and again. 200 00:16:28,534 --> 00:16:30,174 It just sat there. 201 00:16:30,254 --> 00:16:32,134 I watched. Nothing happened. 202 00:16:32,214 --> 00:16:35,654 You need to learn to look at the garbage in a different way. 203 00:16:37,574 --> 00:16:39,214 It's all about patterns. 204 00:16:39,294 --> 00:16:41,334 Finding the code, hidden within the garbage. 205 00:16:41,414 --> 00:16:42,534 But in this case... 206 00:16:42,614 --> 00:16:44,174 it's more complicated than normal. 207 00:16:44,254 --> 00:16:46,774 Usually, there'd be one character of code, 208 00:16:46,854 --> 00:16:49,134 and, say, five characters of garbage. 209 00:16:49,214 --> 00:16:53,014 In that case, you just need to write a script to read one character in six. 210 00:16:53,094 --> 00:16:55,174 So you're saying it's not all garbage? 211 00:16:56,294 --> 00:16:58,374 Then... 212 00:16:58,454 --> 00:17:01,030 there's where the number of real code and garbage characters vary 213 00:17:01,054 --> 00:17:02,734 according to a regular pattern. 214 00:17:02,814 --> 00:17:06,334 Say, one in four, then one in three, then one in two and back up again. 215 00:17:06,414 --> 00:17:08,774 And that's what we've got here in the BT code? 216 00:17:09,294 --> 00:17:10,934 No. 217 00:17:12,654 --> 00:17:14,254 This is more complicated. 218 00:17:14,334 --> 00:17:17,134 Here, there's no simple pattern. 219 00:17:17,214 --> 00:17:19,334 The code characters and garbage characters 220 00:17:19,414 --> 00:17:21,014 vary according to an algorithm. 221 00:17:21,094 --> 00:17:23,630 So, we can't extract the hidden code unless we know the algorithm? 222 00:17:23,654 --> 00:17:26,694 Oh, I've worked out the algorithm. That's what took me the time. 223 00:17:34,494 --> 00:17:36,894 There's your third stage. 224 00:17:36,974 --> 00:17:39,214 Hidden inside of what you thought was just garbage. 225 00:17:44,334 --> 00:17:48,334 That's a data scraper. That's how it mined our files. 226 00:17:51,294 --> 00:17:54,534 That must be the MAC address of your sandbox. 227 00:17:54,614 --> 00:17:56,110 That's how it broke out into our system. 228 00:17:56,134 --> 00:17:58,414 It can't be. Yes, I think so. 229 00:17:58,494 --> 00:18:00,534 But how could they possibly know that? 230 00:18:00,614 --> 00:18:02,454 A MAC address is like a fingerprint. 231 00:18:02,534 --> 00:18:04,190 How could someone in Russia know the address 232 00:18:04,214 --> 00:18:07,974 of a particular computer at GCHQ? It's impossible. 233 00:18:08,054 --> 00:18:09,174 No, it's obvious. 234 00:18:09,254 --> 00:18:11,254 Obvious? How? 235 00:18:11,614 --> 00:18:13,614 Someone must have told them. 236 00:18:19,614 --> 00:18:21,854 OK, even if that is true, 237 00:18:21,934 --> 00:18:23,934 it doesn't explain how they got the data out. 238 00:18:24,014 --> 00:18:26,014 This malware doesn't communicate. 239 00:18:36,214 --> 00:18:38,214 It exfiltrates as email. 240 00:18:39,134 --> 00:18:41,374 The data goes out as attachments. 241 00:18:41,454 --> 00:18:44,974 The emails get lost in the flood of all our other email traffic. 242 00:18:46,494 --> 00:18:48,494 No one notices. 243 00:18:50,894 --> 00:18:53,734 They've moved on from NSA exploits, by the way. 244 00:18:53,814 --> 00:18:55,294 Now they're taking our own stuff. 245 00:18:55,374 --> 00:18:56,414 What? 246 00:18:56,494 --> 00:18:58,294 Your emails are still going out. 247 00:18:58,374 --> 00:19:00,374 What? 248 00:19:45,494 --> 00:19:46,894 They must know what we're doing. 249 00:19:46,974 --> 00:19:49,934 Every time I cut a link to a domain, they set up a new one. 250 00:19:50,014 --> 00:19:52,054 We're losing a massive amount of data 251 00:19:52,134 --> 00:19:54,134 every second. 252 00:19:56,654 --> 00:19:58,534 The scraper you found in the garbage. 253 00:19:58,614 --> 00:20:01,294 Can you can shut it down, stop all this at source? 254 00:20:01,374 --> 00:20:02,414 Of course. 255 00:20:02,494 --> 00:20:04,134 Then do it! 256 00:20:04,214 --> 00:20:06,214 Please. 257 00:20:32,814 --> 00:20:34,574 - Is that it? - Yes. 258 00:20:34,654 --> 00:20:35,734 You've stopped it? 259 00:20:35,814 --> 00:20:38,094 Of course. Why do you sound so surprised? 260 00:20:38,174 --> 00:20:39,534 You're brilliant. 261 00:21:34,454 --> 00:21:36,454 I owe you an apology. 262 00:21:41,254 --> 00:21:43,334 You're right, you do. 263 00:21:46,494 --> 00:21:48,494 I'm sorry. 264 00:21:49,174 --> 00:21:51,294 What you did last night was amazing. 265 00:21:57,134 --> 00:22:00,254 as well as in Bradford, the central Mosque in Southall 266 00:22:00,334 --> 00:22:03,174 was fire-bombed while a service was taking place. 267 00:22:03,254 --> 00:22:06,934 A spokesperson for the Muslim Council of Britain blamed the attack, 268 00:22:07,014 --> 00:22:09,774 one of dozens reported in the last 36 hours, 269 00:22:09,854 --> 00:22:14,854 on the breakdown in public order in the aftermath of the disputed election... 270 00:22:17,854 --> 00:22:19,854 What is it? 271 00:22:21,134 --> 00:22:23,654 They're attacking mosques again. 272 00:22:23,734 --> 00:22:26,014 My brother works at a mosque in Swindon. 273 00:22:29,534 --> 00:22:31,534 Well, you should go. 274 00:22:40,134 --> 00:22:44,094 We read about it everyday in the papers and on our phones, 275 00:22:45,134 --> 00:22:47,214 we hear about it on the radio, 276 00:22:47,294 --> 00:22:50,774 we speak about it every morning with our neighbours... 277 00:22:50,854 --> 00:22:53,334 we watch it every night on the TV news. 278 00:22:55,134 --> 00:22:58,974 And of course, when they're attacking us in the streets, 279 00:22:59,054 --> 00:23:01,094 when they're burning our mosques, 280 00:23:02,534 --> 00:23:04,534 we want to strike back. 281 00:23:05,334 --> 00:23:07,334 Why wouldn't we? 282 00:23:07,414 --> 00:23:09,614 It's only human. 283 00:23:09,694 --> 00:23:12,294 It sounds easy, brothers and sisters, 284 00:23:14,494 --> 00:23:16,494 as do all the words of Shaytan. 285 00:23:17,574 --> 00:23:20,254 He speaks to us when we're angry. 286 00:23:20,334 --> 00:23:23,694 He fans the flames of our completely reasonable anger 287 00:23:24,494 --> 00:23:26,814 which comes from fear 288 00:23:29,174 --> 00:23:31,694 and the desire to protect those we love. 289 00:23:33,734 --> 00:23:37,734 But we don't protect them, brothers and sisters, 290 00:23:38,694 --> 00:23:42,174 by meeting violence with violence. 291 00:23:42,254 --> 00:23:45,854 Violence only breeds more violence, more hatred. 292 00:23:45,934 --> 00:23:49,134 We hit back and they hit us again, 293 00:23:49,654 --> 00:23:51,654 even harder. 294 00:23:52,814 --> 00:23:56,134 The way of Allah, Subhanahu wa-ta'ala, 295 00:23:56,214 --> 00:24:01,574 is the harder way, the more courageous way. 296 00:24:01,654 --> 00:24:05,694 The voice of Shaytan rages in our ears, blasting out all other sound. 297 00:24:08,214 --> 00:24:12,774 You will hear the voice of Allah, Subhanahu wa-ta'ala, 298 00:24:14,414 --> 00:24:16,414 when you are quiet, 299 00:24:18,214 --> 00:24:20,214 when you are at rest, 300 00:24:21,854 --> 00:24:23,854 when you are at peace. 301 00:24:32,974 --> 00:24:34,974 Saj? 302 00:25:00,734 --> 00:25:02,734 Hello, sir. 303 00:25:03,054 --> 00:25:05,054 - Shut the door. - Yeah. 304 00:25:08,334 --> 00:25:09,774 What is it? 305 00:25:09,854 --> 00:25:12,654 I've just been speaking to the Prime Minister. 306 00:25:12,734 --> 00:25:17,254 Apparently, MI5's found some compromising material 307 00:25:17,334 --> 00:25:19,334 on the Foreign Secretary's laptop. 308 00:25:22,334 --> 00:25:24,254 What kind of material? 309 00:25:24,334 --> 00:25:27,494 I'm not sure. They're sending it over, the laptop. 310 00:25:28,974 --> 00:25:31,214 Inappropriate communications with someone inside 311 00:25:31,294 --> 00:25:34,254 - the Russian government, that's all I've been told. 312 00:25:34,334 --> 00:25:37,134 "Highly prejudicial to national security." 313 00:25:37,934 --> 00:25:40,414 For fuck's sake. 314 00:25:40,494 --> 00:25:43,254 Surely even they must know that's a Russian plant? 315 00:25:43,334 --> 00:25:46,294 I don't know. It looks authentic, apparently. 316 00:25:46,374 --> 00:25:48,894 None of the usual signs of crashing around inside a computer. 317 00:25:48,974 --> 00:25:52,134 If it's a plant, it's a clever one, 318 00:25:52,214 --> 00:25:54,214 hard to prove. 319 00:25:54,974 --> 00:25:57,454 Anyway, she's had to resign. 320 00:26:02,814 --> 00:26:04,894 We're being played, aren't we? 321 00:26:06,094 --> 00:26:08,774 Have been. At every stage. 322 00:26:09,414 --> 00:26:13,054 Yeah. Yeah. 323 00:26:13,134 --> 00:26:15,814 And very convenient that we should lose our best friend in government 324 00:26:15,894 --> 00:26:17,894 at this precise moment. 325 00:26:22,054 --> 00:26:24,054 Secretary of State for Defence. 326 00:26:27,334 --> 00:26:32,094 I said after the BT attack that if we didn't respond robustly, 327 00:26:32,174 --> 00:26:34,694 we'd be hit again and we have been. 328 00:26:34,774 --> 00:26:40,814 Our election has been undermined and our most sensitive secrets stolen. 329 00:26:40,894 --> 00:26:44,094 By any measure, this constitutes the cyber equivalent 330 00:26:44,174 --> 00:26:46,734 of an armed attack on the United Kingdom. 331 00:26:48,654 --> 00:26:50,654 An act of war. 332 00:26:53,974 --> 00:26:56,054 Head of Operations, GCHQ. 333 00:26:59,614 --> 00:27:01,574 I'm not... 334 00:27:01,654 --> 00:27:04,934 disagreeing that a strong response is required 335 00:27:05,014 --> 00:27:07,614 but you should be aware that if you decide upon 336 00:27:07,694 --> 00:27:10,454 a symmetric cyber-attack, 337 00:27:10,534 --> 00:27:12,534 it will be highly escalatory. 338 00:27:13,094 --> 00:27:15,614 Truth is they've been one step ahead of us, 339 00:27:15,694 --> 00:27:16,934 provoking us, 340 00:27:17,014 --> 00:27:19,334 anticipating how we'll react at every stage. 341 00:27:19,414 --> 00:27:23,654 It's vital that we do not react as expected now. 342 00:27:23,734 --> 00:27:28,814 We should be careful of empty gestures that have profound consequences. 343 00:27:29,934 --> 00:27:31,814 Empty gestures? 344 00:27:31,894 --> 00:27:36,694 Yes. Especially if there are other motives for doing it. 345 00:27:38,094 --> 00:27:40,094 What other motives? 346 00:27:41,494 --> 00:27:43,614 Can I speak frankly? 347 00:27:43,694 --> 00:27:45,694 Of course. 348 00:27:47,214 --> 00:27:48,934 To shore up the position of a government 349 00:27:49,014 --> 00:27:50,854 whose legitimacy has been questioned. 350 00:27:50,934 --> 00:27:53,934 - To distract attention. 351 00:27:54,974 --> 00:27:57,054 Is that what you think is going on here? 352 00:27:57,134 --> 00:28:01,694 With the greatest respect to our colleague from GCHQ, Prime Minister, 353 00:28:01,774 --> 00:28:05,374 that is a completely outrageous suggestion. 354 00:28:05,454 --> 00:28:11,454 This country has either faced an attack amounting to an act of war or it hasn't. 355 00:28:11,534 --> 00:28:13,134 And if it has, 356 00:28:13,214 --> 00:28:17,214 it is our duty as the properly constituted government to respond. 357 00:28:17,294 --> 00:28:21,294 It's nothing to do with legitimacy or any other political considerations. 358 00:28:26,774 --> 00:28:29,254 Can I just remind us that the then Attorney General 359 00:28:29,334 --> 00:28:33,694 made our red lines absolutely clear in his 2018 speech. 360 00:28:33,774 --> 00:28:36,374 Use of cyber to manipulate the electoral system 361 00:28:36,454 --> 00:28:40,494 explicitly constitutes an intervention in our domestic affairs. 362 00:28:40,574 --> 00:28:42,574 If, after that speech, we do nothing, 363 00:28:42,654 --> 00:28:46,054 we are basically saying it's OK to just roll your tanks into London. 364 00:28:46,134 --> 00:28:48,294 Yes, I see your point. 365 00:28:48,374 --> 00:28:52,654 Of course, if we retaliate, we might expose some of the things 366 00:28:52,734 --> 00:28:53,894 we ourselves are doing, 367 00:28:53,974 --> 00:28:57,694 within Russia's critical national infrastructure. 368 00:28:57,774 --> 00:29:01,494 Which would leave us open to the accusation of double standards. 369 00:29:02,654 --> 00:29:05,134 But if that is the way you wish to go, 370 00:29:05,214 --> 00:29:08,894 Prime Minister, Danny can lay out some further options. 371 00:29:08,974 --> 00:29:11,094 We don't need your options. 372 00:29:11,174 --> 00:29:13,374 The army will be taking the lead this time. 373 00:29:14,534 --> 00:29:16,534 Good luck with that. 374 00:29:17,134 --> 00:29:18,374 What was that? 375 00:29:18,454 --> 00:29:20,014 Nothing. 376 00:29:20,094 --> 00:29:24,654 Good, because Russia has effectively declared war on this country. 377 00:29:24,734 --> 00:29:26,654 And, we, those of us around this table 378 00:29:26,734 --> 00:29:29,574 are charged with the defence of this nation. 379 00:29:29,654 --> 00:29:31,934 I require your support to do so. 380 00:29:46,854 --> 00:29:48,854 David. 381 00:29:51,934 --> 00:29:54,254 I'm sending you a team from the National Cyber Force. 382 00:29:54,334 --> 00:29:57,854 I want you to build them an attack, targeting the Russian arms industry. 383 00:29:57,934 --> 00:30:00,894 And I want it done today. Can you do that? 384 00:30:01,534 --> 00:30:03,534 Put them out of action? 385 00:30:05,334 --> 00:30:07,414 We can certainly try. 386 00:30:07,494 --> 00:30:10,894 It's time to show us what we've been paying for at GCHQ. 387 00:30:10,974 --> 00:30:13,054 All this money we've spent, 388 00:30:13,134 --> 00:30:15,134 it's time to show us what you can do. 389 00:30:24,414 --> 00:30:26,454 I'm sorry, Saj. 390 00:30:27,894 --> 00:30:29,894 You were right. 391 00:30:31,534 --> 00:30:35,054 I should've thought more carefully before I took the job at GCHQ. 392 00:30:35,934 --> 00:30:38,694 About the consequences for our family. 393 00:30:39,454 --> 00:30:41,054 I over-reacted. 394 00:30:41,134 --> 00:30:43,214 No, you didn't. 395 00:30:45,174 --> 00:30:47,174 You were right. 396 00:30:47,774 --> 00:30:49,774 I shouldn't have gone there. 397 00:30:55,054 --> 00:30:58,294 I've made a mistake. At work. 398 00:30:58,374 --> 00:31:00,374 What mistake? 399 00:31:01,774 --> 00:31:03,774 I suppose you can't say? 400 00:31:10,534 --> 00:31:12,534 I did something... 401 00:31:13,654 --> 00:31:15,694 I thought was really clever. 402 00:31:16,334 --> 00:31:17,854 But it wasn't. 403 00:31:17,934 --> 00:31:21,014 It was incredibly stupid and gullible. 404 00:31:22,854 --> 00:31:25,254 And it's allowed something terrible to happen. 405 00:31:26,654 --> 00:31:28,574 Are you sure? 406 00:31:28,654 --> 00:31:31,094 Because you always think everything's your fault. 407 00:31:33,294 --> 00:31:35,294 You have no idea. 408 00:31:44,534 --> 00:31:46,574 Anyway, Dad was my fault. 409 00:31:46,654 --> 00:31:48,854 What? How is that your fault? 410 00:31:50,494 --> 00:31:52,214 He killed himself. 411 00:31:52,294 --> 00:31:54,654 He killed himself because I went away to uni and left him. 412 00:31:54,734 --> 00:31:56,094 - No, Saar... - He did. 413 00:31:56,174 --> 00:31:58,854 - I abandoned him. - No, that's not what happened, Saar. 414 00:31:58,934 --> 00:32:02,894 - Yeah, he killed himself. - He didn't kill himself. 415 00:32:02,974 --> 00:32:05,854 I mean sorry to ruin this "I'm to blame for everything" thing 416 00:32:05,934 --> 00:32:07,894 you've got going, but no, 417 00:32:07,974 --> 00:32:09,534 he didn't kill himself. 418 00:32:09,614 --> 00:32:11,974 If you'd come home, you'd know that. 419 00:32:13,574 --> 00:32:14,974 It was an accident. 420 00:32:15,054 --> 00:32:17,494 A signalman made a mistake. 421 00:32:17,574 --> 00:32:21,574 He sent a goods train up a line that was supposed to be out of service. 422 00:32:21,654 --> 00:32:25,214 Dad took a short cut across the track and the train hit him. 423 00:32:25,814 --> 00:32:27,814 It wasn't suicide. 424 00:32:30,854 --> 00:32:33,214 You're just saying that because suicide is haram. 425 00:32:33,294 --> 00:32:35,694 No, I swear on Mum's life. 426 00:32:36,654 --> 00:32:39,334 That's what happened. 427 00:32:39,414 --> 00:32:42,374 You may have behaved like a shit not coming to see him 428 00:32:42,454 --> 00:32:44,454 but he didn't commit suicide. 429 00:32:58,574 --> 00:33:00,574 I liked your sermon. 430 00:33:01,334 --> 00:33:03,334 Thanks. 431 00:33:04,734 --> 00:33:09,814 I mean, I... I agreed with... I agreed with everything you said. 432 00:33:22,374 --> 00:33:24,374 Do you think I should resign? 433 00:33:25,054 --> 00:33:26,814 Oh. 434 00:33:26,894 --> 00:33:29,534 That's up to you, 435 00:33:29,614 --> 00:33:33,254 but we'd be losing the last real voice of moderation around the table. 436 00:33:33,334 --> 00:33:36,894 There'd be nobody left to protect the staff. 437 00:33:36,974 --> 00:33:38,694 Well, what about you? 438 00:33:38,774 --> 00:33:40,774 Me? 439 00:33:41,254 --> 00:33:44,454 They'd sack me 15 seconds after you're out the door. 440 00:33:47,654 --> 00:33:49,894 Sorry, they're ready. 441 00:33:51,734 --> 00:33:53,734 They're ready. 442 00:33:58,614 --> 00:34:00,454 Um, 443 00:34:00,534 --> 00:34:04,374 I told Barbara to take the kids and go and stay with her parents in France. 444 00:34:05,254 --> 00:34:07,494 - You're joking. - No, absolutely not. 445 00:34:08,814 --> 00:34:11,174 Well, it's not that bad, is it? 446 00:34:11,254 --> 00:34:14,694 I don't know. But I'm pretty sure this, us attacking them, 447 00:34:14,774 --> 00:34:16,974 it's exactly what they want us to do. 448 00:34:17,054 --> 00:34:19,054 You have to ask yourself why. 449 00:34:20,254 --> 00:34:22,294 Do you think I should get Freddie out? 450 00:34:25,574 --> 00:34:27,574 Maybe. 451 00:34:48,174 --> 00:34:49,654 Ready, boss. 452 00:34:49,734 --> 00:34:51,774 OK, what happens now? 453 00:34:51,854 --> 00:34:54,374 You stand aside and we press the button. 454 00:34:54,454 --> 00:34:56,110 That way it's covered by the "rules of war" 455 00:34:56,134 --> 00:34:58,174 and you don't end up in the Hague. 456 00:35:01,934 --> 00:35:03,934 OK, Finn. Up you get. 457 00:35:19,094 --> 00:35:21,094 Control-E. 458 00:35:31,214 --> 00:35:33,374 How long will it take to have an effect? 459 00:35:34,334 --> 00:35:36,334 No time at all. 460 00:35:37,174 --> 00:35:39,174 It's happening now. 461 00:36:06,054 --> 00:36:07,814 Is this real? 462 00:36:07,894 --> 00:36:10,094 Real? I doubt it. 463 00:36:43,614 --> 00:36:45,654 Danny? Can I have a word with you? 464 00:36:45,734 --> 00:36:48,094 - What is it? - A private word. 465 00:36:57,054 --> 00:36:59,254 - What is it? - Our comms are down. 466 00:36:59,334 --> 00:37:01,094 - Sorry? - All our comms are down. 467 00:37:01,174 --> 00:37:05,014 I wanted to speak to you out here because I didn't want to create a panic. 468 00:37:05,094 --> 00:37:07,974 - What, just army comms... - To be honest, we're not sure. 469 00:37:08,054 --> 00:37:11,094 I managed to get through to the MOD on one of your landlines. 470 00:37:11,174 --> 00:37:14,614 They're requesting that GCHQ help re-establish contact. 471 00:37:14,694 --> 00:37:17,014 - With... - With UK Armed Forces. 472 00:37:18,014 --> 00:37:19,294 Sorry, Danny. 473 00:37:19,374 --> 00:37:20,814 The Defence Secretary is on the line. 474 00:37:20,854 --> 00:37:22,214 Which channel? 475 00:37:22,294 --> 00:37:25,054 No, I mean he's actually on the line. He's on the phone. 476 00:37:30,454 --> 00:37:31,854 Richard. We've just heard. 477 00:37:31,934 --> 00:37:33,014 Heard what? 478 00:37:33,094 --> 00:37:34,894 About your loss of comms. 479 00:37:34,974 --> 00:37:40,414 Not that. The nuclear submarine control system is unresponsive. 480 00:37:40,494 --> 00:37:42,094 It may have been hacked. 481 00:37:42,174 --> 00:37:43,654 What? 482 00:37:43,734 --> 00:37:45,814 Are you... Are you absolutely sure? 483 00:37:47,214 --> 00:37:49,174 Richard? 484 00:37:49,254 --> 00:37:51,254 Richard? 485 00:37:54,054 --> 00:37:55,710 If there's anything still working around here, 486 00:37:55,734 --> 00:37:57,974 try and get me NSA up on the satellite... 487 00:37:58,054 --> 00:38:00,054 - on this one. - OK. 488 00:38:22,054 --> 00:38:24,054 I've decided to leave. 489 00:38:25,254 --> 00:38:27,254 GCHQ. 490 00:38:27,614 --> 00:38:29,614 OK. 491 00:38:31,854 --> 00:38:33,654 But if you've made a mess, 492 00:38:33,734 --> 00:38:36,414 don't leave before you've cleared it up. 493 00:38:36,494 --> 00:38:39,014 You should never leave someone else to clear up your mess, Saar. 494 00:38:50,174 --> 00:38:52,174 Mitch. 495 00:38:52,254 --> 00:38:53,614 Danny. 496 00:38:53,694 --> 00:38:55,630 Look, I know you guys aren't talking to us at the moment 497 00:38:55,654 --> 00:38:57,430 but I thought you should know somebody just hacked 498 00:38:57,454 --> 00:38:59,454 our nuclear submarine control system. 499 00:39:00,454 --> 00:39:01,574 What? You're kidding? 500 00:39:01,654 --> 00:39:04,014 Plus all of our military comms are down. 501 00:39:04,094 --> 00:39:05,974 The Russians have just spent the last two hours 502 00:39:06,054 --> 00:39:08,054 exaggerating the effect of a very targeted attack 503 00:39:08,134 --> 00:39:09,934 on a couple of arms factories to make 504 00:39:10,014 --> 00:39:12,414 whatever it is they're doing look like self-defence. 505 00:39:12,494 --> 00:39:15,094 And my guess is, they've been planning this for a long time. 506 00:39:15,174 --> 00:39:18,774 Yeah, the problem is we're seeing those images of hospital fires too, Danny... 507 00:39:18,854 --> 00:39:20,054 Yeah, they're fakes, Mitch. 508 00:39:20,134 --> 00:39:22,454 - Well, they look pretty real to us. 509 00:39:23,574 --> 00:39:25,454 I've gotta tell you, 510 00:39:25,534 --> 00:39:28,295 there's not a lot of warm feelings towards you guys here at the moment. 511 00:39:30,414 --> 00:39:33,534 We really could do with some help right now, Mitch. 512 00:39:42,694 --> 00:39:44,694 You can't use that in here. 513 00:39:50,054 --> 00:39:52,574 You can't use that here. Turn it off, now. 514 00:39:52,654 --> 00:39:55,214 OK, but I've got to write this down. 515 00:39:56,454 --> 00:39:58,454 Have you got any paper? 516 00:41:31,174 --> 00:41:32,934 Saara, wait. 517 00:41:33,014 --> 00:41:34,574 I've got nothing to say to you. 518 00:41:34,654 --> 00:41:35,774 Please. 519 00:41:35,854 --> 00:41:37,254 I think you're about to be attacked. 520 00:41:37,334 --> 00:41:38,534 The UK. 521 00:41:38,614 --> 00:41:40,430 I've got something to give you that will stop it. 522 00:41:40,454 --> 00:41:41,974 I don't believe you, Vadim. 523 00:41:42,054 --> 00:41:44,374 It's just another provocation. 524 00:41:44,454 --> 00:41:46,630 Anyway, I thought you said in Harrogate they'd kill you. 525 00:41:46,654 --> 00:41:47,734 I don't care any more. 526 00:41:47,814 --> 00:41:49,574 I don't care what happens to me. 527 00:41:49,654 --> 00:41:51,654 This is too important. 528 00:41:52,614 --> 00:41:54,614 Look at this. 529 00:42:07,734 --> 00:42:08,854 What is that? 530 00:42:08,934 --> 00:42:11,894 It's you. At your desk in GCHQ. 531 00:42:29,094 --> 00:42:32,174 OK, you hacked the CCTV. 532 00:42:32,254 --> 00:42:34,174 So what? What does that prove? 533 00:42:34,254 --> 00:42:37,214 Saara, please. There isn't much time. 534 00:42:37,294 --> 00:42:40,934 You have to trust me. You have to think outside the box. 535 00:42:42,134 --> 00:42:45,214 What? What did you say? 536 00:42:52,214 --> 00:42:55,734 JSSO's showing unidentified aircraft entering our airspace. 537 00:42:55,814 --> 00:42:57,350 None of the other systems are showing it 538 00:42:57,374 --> 00:42:59,230 and the RAF doesn't seem to have been scrambled yet. 539 00:42:59,254 --> 00:43:01,134 But it is possible we are under attack. 540 00:43:01,214 --> 00:43:03,294 It's just another hack, isn't it? Fake news? 541 00:43:03,374 --> 00:43:07,134 But what if it's real this time, you know, like crying wolf? 542 00:43:07,214 --> 00:43:09,534 How can we take that chance? 543 00:43:09,614 --> 00:43:11,774 - What, an invasion? - Why not? 544 00:43:11,854 --> 00:43:14,614 We've been underestimating Putin for ten years. 545 00:43:14,694 --> 00:43:17,654 All the way through we've been asking what's the bigger picture. 546 00:43:17,734 --> 00:43:20,774 The one thing we've never considered is that he might just be insane enough 547 00:43:20,854 --> 00:43:23,214 to have territorial ambitions. 548 00:43:23,294 --> 00:43:25,654 What if this whole thing is about separating us from Europe 549 00:43:25,734 --> 00:43:29,854 and the Americans so that when this moment came, we'd be alone? 550 00:43:31,454 --> 00:43:33,054 Not now, Saara. 551 00:43:33,134 --> 00:43:36,894 Danny, you absolutely have to come and see this. Right now! 552 00:43:38,214 --> 00:43:41,374 It's the CCTV, so what? Saara, I don't have time for this. 553 00:43:41,454 --> 00:43:43,054 You have to turn it off. 554 00:43:43,134 --> 00:43:44,694 Please. 555 00:43:44,774 --> 00:43:47,294 I can't show you what I've got to show you until you turn it off. 556 00:43:50,054 --> 00:43:52,054 Shut down the CCTV. 557 00:43:52,374 --> 00:43:54,374 Really? 558 00:43:54,454 --> 00:43:56,454 Yeah. Do it. 559 00:44:00,054 --> 00:44:01,894 They hacked the system. 560 00:44:01,974 --> 00:44:03,894 The FSB were watching everything we're doing. 561 00:44:03,974 --> 00:44:08,374 They can't. It's air-gapped. How do you know? 562 00:44:08,454 --> 00:44:10,814 Because I've just been inside their computer. 563 00:44:15,214 --> 00:44:18,254 I'm sending you something now. Two things. 564 00:44:18,334 --> 00:44:20,414 You can use them to trade with the Americans, 565 00:44:20,494 --> 00:44:21,974 to bring them back in. 566 00:44:22,054 --> 00:44:24,574 As soon as that happens, Putin will back down. 567 00:44:29,534 --> 00:44:31,134 During this first phase, 568 00:44:31,214 --> 00:44:35,734 we are degrading the capability and resolve of our enemy 569 00:44:35,814 --> 00:44:38,094 as well as discrediting 570 00:44:38,174 --> 00:44:41,174 his institutions and leadership with espionage, 571 00:44:41,254 --> 00:44:44,854 assassination, er, manipulation of social media, 572 00:44:44,934 --> 00:44:47,694 cyber attacks, faking of imagery... 573 00:44:47,774 --> 00:44:49,974 all with the aim of creating disillusionment, 574 00:44:50,054 --> 00:44:52,214 confusion and chaos. 575 00:44:53,694 --> 00:44:57,174 Er, by the time war is openly declared, 576 00:44:57,254 --> 00:44:59,374 - the enemy's ability to defend himself... - War? 577 00:44:59,454 --> 00:45:01,390 will be significantly reduced... Danny? 578 00:45:01,414 --> 00:45:04,374 - We're receiving a data dump. - Where from? 579 00:45:04,454 --> 00:45:06,454 Russia. 580 00:45:08,174 --> 00:45:10,814 In the next phase, we engineer... - OK, let's go. 581 00:45:10,894 --> 00:45:13,574 Er, our enemy's strategic situation. 582 00:45:13,654 --> 00:45:19,414 His, er, relationships with his allies are fatally undermined, one by one. 583 00:45:22,454 --> 00:45:25,894 It's mostly code. There's terabytes of it. 584 00:45:27,974 --> 00:45:31,374 I think it's the FSB's offensive cyber exploits. 585 00:45:35,014 --> 00:45:37,174 My God! 586 00:45:37,254 --> 00:45:39,374 This puts us back in the game. 587 00:45:46,494 --> 00:45:49,694 So how is all this to be achieved? 588 00:45:49,774 --> 00:45:54,614 How do you ensure that, er, the final phase, the war is won? 589 00:45:54,694 --> 00:46:01,334 The war is won using a technique called Reflexive Control. 590 00:46:01,414 --> 00:46:03,094 This is, er, the... 591 00:46:03,174 --> 00:46:07,254 Predetermining the enemy's behaviour in Russia's favour. 592 00:46:07,334 --> 00:46:10,854 We define our ultimate objective... 593 00:46:14,774 --> 00:46:19,614 We define our ultimate objective, the total defeat of our enemy.