1
00:00:02,240 --> 00:00:04,600
This programme contains
some strong language

2
00:00:04,640 --> 00:00:07,056
I have decided to declare a state of emergency.
The Prime Minister has issued a statement.

3
00:00:07,080 --> 00:00:09,440
A foreign power is attempting to subvert

4
00:00:09,480 --> 00:00:11,840
our democracy and our elections

5
00:00:11,880 --> 00:00:14,080
and that power is Russia.

6
00:00:18,000 --> 00:00:21,960
Following the attack on the UK's
political institutions and telecoms,

7
00:00:22,000 --> 00:00:24,480
Russian FSB hackers are being blamed.

8
00:00:24,520 --> 00:00:26,840
This constitutes the cyber equivalent

9
00:00:26,880 --> 00:00:28,640
of an armed attack
on the United Kingdom.

10
00:00:29,720 --> 00:00:31,120
An act of war.

11
00:00:31,160 --> 00:00:34,280
It is vital that we do not react
as expected now.

12
00:00:34,320 --> 00:00:36,760
We need to hit back in a language
they understand.

13
00:00:47,760 --> 00:00:52,080
It was the FSB coder Vadim Trusov
you met in Harrogate, wasn't it?

14
00:00:52,120 --> 00:00:53,560
Yes.

15
00:00:53,600 --> 00:00:55,360
Have you had any more
contact with him?

16
00:00:55,400 --> 00:00:57,320
I understand you were
at college together.

17
00:01:03,000 --> 00:01:05,920
Stage three of the Russian attack
was a data scrape.

18
00:01:05,960 --> 00:01:10,440
All our own and the NSA's most
confidential material stolen.

19
00:01:10,480 --> 00:01:13,960
As of 20:00 hours today, Eastern Time,

20
00:01:14,000 --> 00:01:18,680
the NSA's intelligence sharing
arrangement with the UK is withdrawn

21
00:01:18,720 --> 00:01:20,640
for the foreseeable future.

22
00:01:27,760 --> 00:01:31,440
JSS is showing Russian aircraft
entering our airspace.

23
00:01:32,520 --> 00:01:34,720
It is possible we are under attack.

24
00:01:35,680 --> 00:01:38,200
I'm sending you something now -
two things.

25
00:01:38,240 --> 00:01:41,840
You can use them to trade with
the Americans to bring them back in.

26
00:01:41,880 --> 00:01:44,160
As soon as it happens,
Putin will back down.

27
00:01:44,200 --> 00:01:46,880
I put my life in your hands now, OK?

28
00:01:48,000 --> 00:01:51,120
If they find out I told you this,
they will kill me.

29
00:02:36,480 --> 00:02:38,760
RAF squadrons are airborne.

30
00:02:38,800 --> 00:02:41,880
They have a fix on
the unidentified aircraft.

31
00:02:41,920 --> 00:02:44,200
The Prime Minister is waiting for me.

32
00:02:44,240 --> 00:02:45,760
He's with the Chief of Staff.

33
00:02:45,800 --> 00:02:49,240
I will be advising him to order
an immediate retaliatory attack

34
00:02:49,280 --> 00:02:52,200
on the Russian military base
in Kaliningrad.

35
00:02:52,240 --> 00:02:54,040
It's a provocation.

36
00:02:54,080 --> 00:02:57,080
I agree. A squadron of Russian
aircraft over the UK

37
00:02:57,120 --> 00:02:58,680
is a provocation.

38
00:02:58,720 --> 00:03:00,480
An intolerable one.

39
00:03:00,520 --> 00:03:03,240
Vadim Trusov confirmed
that the Russians' intentions

40
00:03:03,280 --> 00:03:06,240
was to isolate us and then
provoke us into an act of war.

41
00:03:06,280 --> 00:03:08,600
If any of these aircraft exist at all,

42
00:03:08,640 --> 00:03:10,920
if they're Russian drones or missiles,

43
00:03:10,960 --> 00:03:12,440
they want us to fire on them.

44
00:03:12,480 --> 00:03:14,200
We are playing their game.

45
00:03:14,240 --> 00:03:16,240
Sorry, how could they fake this?

46
00:03:16,280 --> 00:03:19,040
Hacking Air Traffic Control,
faking air attacks,

47
00:03:19,080 --> 00:03:21,360
it's entirely in keeping with their MO.

48
00:03:21,400 --> 00:03:22,960
No, we cannot take the risk.

49
00:03:23,000 --> 00:03:26,120
We cannot do this without the
Americans being back on board!

50
00:03:26,160 --> 00:03:29,240
Defence Secretary, we have no doubt
the material Vadim Trusov

51
00:03:29,280 --> 00:03:31,600
leaked to us will encourage
the Americans

52
00:03:31,640 --> 00:03:34,280
to renew military and intelligence
alliances with us.

53
00:03:34,320 --> 00:03:35,960
Putin will back down.

54
00:03:36,000 --> 00:03:39,480
The director of the NSA, General
Perez, has confirmed in writing

55
00:03:39,520 --> 00:03:44,120
that all intelligence and military
alliances with the US are suspended.

56
00:03:44,160 --> 00:03:46,720
Perez hasn't seen the leaked material.

57
00:03:46,760 --> 00:03:49,080
The Prime Minister has tried
the President.

58
00:03:49,120 --> 00:03:52,240
He's at Camp David incommunicado
for the Middle East talks.

59
00:03:52,280 --> 00:03:54,880
RAF squadrons are minutes away
from intercep...

60
00:03:56,000 --> 00:03:58,320
Try and get him to stop
declaring war on Russia

61
00:03:58,360 --> 00:04:00,600
for the next five minutes.
..Russian aircraft.

62
00:04:04,720 --> 00:04:06,240
Sally.Encryption.

63
00:04:06,280 --> 00:04:09,240
They've managed to reset the
nuclear codes. Some good news.

64
00:04:09,280 --> 00:04:11,240
OK, send that to the Defence Secretary

65
00:04:11,280 --> 00:04:14,640
and then get me Michaela Jones on a
call in my office, now! Of course.

66
00:04:14,680 --> 00:04:17,480
Max, we need something to get
the Americans back on board.

67
00:04:17,520 --> 00:04:20,200
This Russian exploit you found
in the Trusov material...

68
00:04:20,240 --> 00:04:21,880
Phil found it, actually.

69
00:04:24,000 --> 00:04:26,440
It's malware breaching
the President's personal

70
00:04:26,480 --> 00:04:28,280
and domestic security.

71
00:04:28,320 --> 00:04:30,240
White House CCTV, everything.

72
00:04:31,320 --> 00:04:33,040
It's pretty ballsy.

73
00:04:33,080 --> 00:04:35,480
You can say that again.
Prep a secure link.

74
00:04:47,520 --> 00:04:49,840
Michaela's on the screen. Thank you.

75
00:04:49,880 --> 00:04:53,560
Michaela? Dan. Touched you've
taken the time out to call.

76
00:04:53,600 --> 00:04:56,680
Something up? You could say that, yes.

77
00:04:56,720 --> 00:04:58,400
What's this about, Dan?

78
00:04:59,520 --> 00:05:03,200
It's about not seeing 80 years
of intelligence sharing

79
00:05:03,240 --> 00:05:05,920
and collaboration go down the pan.

80
00:05:05,960 --> 00:05:07,960
I'm going to send you something

81
00:05:08,000 --> 00:05:10,920
and I really need you to get Perez
to join a call for me.

82
00:05:10,960 --> 00:05:12,720
OK. Leave it with me.

83
00:05:12,760 --> 00:05:15,160
Thank you. I owe you one. I've got to go.

84
00:05:26,280 --> 00:05:29,040
Max, send that exploit over secure link

85
00:05:29,080 --> 00:05:31,960
to Michaela Jones at the NSA,
please. Yeah, on it.

86
00:05:32,000 --> 00:05:35,320
I need to talk to you. If it's
about Vadim, I will talk to MI6,

87
00:05:35,360 --> 00:05:37,720
but right now... It's not.
It's something else.

88
00:05:37,760 --> 00:05:40,360
I should have said earlier,
but with everything going on,

89
00:05:40,400 --> 00:05:41,720
and I had to check.

90
00:05:41,760 --> 00:05:44,560
Danny, I've just put General Perez
through to the comms room.

91
00:05:44,600 --> 00:05:47,320
All right, thank you, Sally.
Just wait here for me, Saara, OK?

92
00:05:57,280 --> 00:05:59,680
I trust you're not going to ask
for our help.

93
00:05:59,720 --> 00:06:01,200
Those days are over.

94
00:06:01,240 --> 00:06:02,680
Danny. Yeah...

95
00:06:02,720 --> 00:06:05,000
Thank you for taking the call, sir.

96
00:06:05,040 --> 00:06:09,680
Trusov leaked terabytes
of the FSB's cyber capabilities

97
00:06:09,720 --> 00:06:11,480
and top secret data.

98
00:06:11,520 --> 00:06:15,000
At a conservative estimate,
it will set the FSB back years,

99
00:06:15,040 --> 00:06:16,640
losing this stuff.

100
00:06:16,680 --> 00:06:20,200
Now, Michaela Jones is making
one particular cyber exploit

101
00:06:20,240 --> 00:06:21,960
available to you now.

102
00:06:23,280 --> 00:06:26,120
We need you to convey this
to the President.

103
00:06:26,160 --> 00:06:29,240
In return, we need the re-establishment

104
00:06:29,280 --> 00:06:31,600
of all intelligence sharing agreements

105
00:06:31,640 --> 00:06:33,920
and for the President to tell the Russians

106
00:06:33,960 --> 00:06:35,960
to withdraw from our airspace.

107
00:06:36,000 --> 00:06:40,320
We need this done immediately
or this war becomes real.

108
00:06:40,360 --> 00:06:41,720
What did you send him?

109
00:06:41,760 --> 00:06:44,520
Russian malware targeting
the President's own family.

110
00:06:45,960 --> 00:06:48,240
Thank you. We're on this now.

111
00:06:48,280 --> 00:06:51,640
You'll be hearing from us.
Please hold fire until you do.

112
00:06:56,240 --> 00:06:57,920
I hope this works.

113
00:06:57,960 --> 00:07:00,240
Defence Secretary...

114
00:07:00,280 --> 00:07:03,240
if I can take this opportunity,

115
00:07:03,280 --> 00:07:07,040
even if the special relationship
is indeed back up and running,

116
00:07:07,080 --> 00:07:09,480
we really need to be thinking
about next steps.

117
00:07:09,520 --> 00:07:12,040
Maybe not the time... How do we fix this?

118
00:07:12,080 --> 00:07:15,200
It's a huge clean up job
and my staff are on their knees

119
00:07:15,240 --> 00:07:17,120
after the last fortnight. Danny!

120
00:07:17,160 --> 00:07:19,920
The truth is, we are
desperately low on numbers

121
00:07:19,960 --> 00:07:22,720
of sufficiently skilled staff, sir.

122
00:07:22,760 --> 00:07:25,200
I can't overstate the importance
of us being ready

123
00:07:25,240 --> 00:07:27,640
should this happen again.
Last time I checked,

124
00:07:27,680 --> 00:07:30,240
GCHQ came under
the Foreign Secretary's authority.

125
00:07:30,280 --> 00:07:32,600
Well, since Elizabeth Kahn's resignation,

126
00:07:32,640 --> 00:07:34,640
there currently is no Foreign Secretary.

127
00:07:34,680 --> 00:07:37,240
Well, I will ask the Prime Minister
to bring it up with

128
00:07:37,280 --> 00:07:40,040
whomever he sees fit to appoint
to that august office.

129
00:07:43,960 --> 00:07:45,480
Shit.

130
00:07:49,960 --> 00:07:52,160
Christ, they're almost over London.

131
00:07:54,280 --> 00:07:57,120
I'm ordering a strike on Kaliningrad.

132
00:07:57,160 --> 00:08:00,200
Wait. Sir, if they're fake and we attack,

133
00:08:00,240 --> 00:08:02,000
we are the aggressor.

134
00:08:09,960 --> 00:08:11,480
It was fake.

135
00:08:11,520 --> 00:08:14,080
It was fake all along.
They're playing with us.

136
00:08:14,120 --> 00:08:15,520
Lucky.

137
00:08:15,560 --> 00:08:18,040
I don't like relying on luck.

138
00:08:19,640 --> 00:08:21,160
Gentlemen.

139
00:08:25,280 --> 00:08:27,640
Maybe the Americans are helping
after all.

140
00:08:33,240 --> 00:08:34,880
Danny. Yeah?

141
00:08:34,920 --> 00:08:37,960
With Marston,
you've got to pick your moment.

142
00:08:38,000 --> 00:08:40,560
We have a Cobra meeting
in London tomorrow morning.

143
00:08:40,600 --> 00:08:43,280
We can discuss next steps
with them then.

144
00:08:43,320 --> 00:08:45,040
Understood.

145
00:09:15,960 --> 00:09:18,240
I'm sorry, Saara. What was it?

146
00:09:18,280 --> 00:09:21,240
When we shut off the data scrape,
our sandbox computer,

147
00:09:21,280 --> 00:09:24,040
which the Russian malware
broke out of... What about it?

148
00:09:25,720 --> 00:09:27,200
What am I looking at?

149
00:09:27,240 --> 00:09:28,720
Yes, James.

150
00:09:28,760 --> 00:09:31,880
Good, good. Well, that's...
That's excellent news.

151
00:09:32,960 --> 00:09:34,880
Yes. Thank you so much.

152
00:09:36,240 --> 00:09:37,880
Jesus Christ.

153
00:09:41,280 --> 00:09:43,680
Charlie, I need you up in my office ASAP.

154
00:09:43,720 --> 00:09:45,200
Yes, ASAP.

155
00:09:45,240 --> 00:09:46,840
Thank you, buddy.

156
00:09:46,880 --> 00:09:48,160
Danny.

157
00:09:49,720 --> 00:09:51,920
Well, the President called Putin.

158
00:09:52,920 --> 00:09:56,720
Cease all action against the UK
or expect the full force

159
00:09:56,760 --> 00:10:00,160
of a combined NATO response
under Article 5.

160
00:10:01,240 --> 00:10:03,200
Putin has backed down.

161
00:10:03,240 --> 00:10:04,800
For now.

162
00:10:06,280 --> 00:10:09,240
That's good, David. No, that's excellent,

163
00:10:09,280 --> 00:10:12,160
and you're the one that got
the Americans back in the game...

164
00:10:13,240 --> 00:10:14,800
so what's wrong?

165
00:10:15,880 --> 00:10:18,080
I've had to call in Charlie Francis.

166
00:10:19,120 --> 00:10:20,440
OK.

167
00:10:20,480 --> 00:10:21,880
Saara.

168
00:10:24,240 --> 00:10:25,960
Come into my office.

169
00:10:30,720 --> 00:10:32,640
So, what's going on, Danny?

170
00:10:37,720 --> 00:10:40,400
Charlie. You're lucky you caught me.
I was just heading off.

171
00:10:41,920 --> 00:10:43,440
Or maybe not so lucky.

172
00:10:43,480 --> 00:10:46,040
Something tells me I'm
not getting home tonight.

173
00:10:46,080 --> 00:10:48,800
Saara, you know Charlie Francis,
Head of Security.

174
00:10:48,840 --> 00:10:53,160
Saara has something for us, Charlie.
And I'm afraid it is not good.

175
00:10:53,200 --> 00:10:54,960
How not good? For you to determine,

176
00:10:55,000 --> 00:10:58,160
but we think it could
be potentially disastrous.

177
00:10:58,200 --> 00:10:59,560
Right. It's how the Russian

178
00:10:59,600 --> 00:11:01,920
malware got into our systems
in the first place.

179
00:11:01,960 --> 00:11:05,360
If I understood correctly,
it was through a sandbox computer.

180
00:11:05,400 --> 00:11:08,040
They knew we'd put the malware
in there to analyse it.

181
00:11:08,080 --> 00:11:10,400
Yeah, but it could only
break out if it knew ahead

182
00:11:10,440 --> 00:11:13,120
of time which sandbox
it was going to be put into.

183
00:11:13,160 --> 00:11:17,120
OK. The Media Access Control.
The Mac address.

184
00:11:17,160 --> 00:11:21,200
It's a 12 digit alphanumeric
identifier unique to each computer.

185
00:11:21,240 --> 00:11:24,600
It was written into the third
stage Russian malware code.

186
00:11:24,640 --> 00:11:26,920
Meaning? The writers of the code

187
00:11:26,960 --> 00:11:29,480
had to have it
before it ever arrived at GCHQ.

188
00:11:29,520 --> 00:11:32,120
It's offline, high side.

189
00:11:33,240 --> 00:11:35,760
So the only way they could
have known is... A CI.

190
00:11:37,320 --> 00:11:38,680
In old money, a mole.

191
00:11:48,760 --> 00:11:49,760
One of us.

192
00:11:58,600 --> 00:12:01,320
Reports overnight
of further cyber attacks

193
00:12:01,360 --> 00:12:02,720
on the UK by Russia.

194
00:12:02,760 --> 00:12:05,880
Surely this begs the
question, are we safe?

195
00:12:05,920 --> 00:12:07,640
Do you think the Government
is doing enough

196
00:12:07,680 --> 00:12:10,000
to respond to these attacks?
What should.

197
00:12:10,040 --> 00:12:12,960
Prime Minister Andrew Makinde do
in the face of Putin's aggression?

198
00:12:13,000 --> 00:12:14,000
Give us a call.

199
00:12:51,000 --> 00:12:52,160
Hello, stranger.

200
00:12:55,960 --> 00:12:58,560
Barbara, my love.

201
00:12:59,840 --> 00:13:02,480
Charlie told me you didn't go
to France like we agreed.

202
00:13:04,200 --> 00:13:05,640
Well, if the world's going to end...

203
00:13:06,760 --> 00:13:08,200
I'd quite like to be with you.

204
00:13:12,320 --> 00:13:13,360
I'm glad you didn't go.

205
00:13:15,480 --> 00:13:16,560
It was a false alarm.

206
00:13:32,600 --> 00:13:34,080
Bad?

207
00:13:36,080 --> 00:13:39,440
How are the boys? Fine.

208
00:13:39,480 --> 00:13:40,480
Oblivious.

209
00:13:41,720 --> 00:13:43,960
It's one benefit of teenage hormones.

210
00:13:52,080 --> 00:13:55,360
What was it? You know I can't tell you.

211
00:13:57,800 --> 00:13:58,800
Three guesses.

212
00:14:00,480 --> 00:14:03,840
I'm tired, Barbara. You wanted us
packed off to France

213
00:14:03,880 --> 00:14:05,176
and I'm not even allowed to guess

214
00:14:05,200 --> 00:14:08,640
the reason why? It was
Russia, wasn't it?

215
00:14:09,760 --> 00:14:12,040
Well, the news made that quite clear.

216
00:14:12,080 --> 00:14:13,800
So guess one.

217
00:14:18,320 --> 00:14:20,600
They said there was a data breach.

218
00:14:20,640 --> 00:14:23,600
You can speculate all you like,
but I couldn't possibly say.

219
00:14:24,800 --> 00:14:26,680
Shit! How?

220
00:14:28,400 --> 00:14:32,680
Information possessed by...
..Virtue of your position.

221
00:14:38,440 --> 00:14:42,120
Three and out. But you will
tell me, Danny Patrick.

222
00:14:43,920 --> 00:14:45,400
I insist you tell me.

223
00:14:46,520 --> 00:14:48,720
Damn your insistence, Agent Napier.

224
00:14:49,720 --> 00:14:51,080
You'll never get it out of me.

225
00:15:00,920 --> 00:15:03,160
Don't you ever dream
of just jacking it all in?

226
00:15:05,440 --> 00:15:07,720
Dream, perhaps. But...

227
00:15:09,320 --> 00:15:11,160
if everyone thought like that...

228
00:15:11,200 --> 00:15:13,440
There'd be no-one left to save the world.

229
00:15:36,080 --> 00:15:39,080
Er, stay. I should at least say hi.

230
00:15:39,120 --> 00:15:40,720
They'll survive.

231
00:15:43,040 --> 00:15:46,000
I'll go and wake them up.
I'll do the drop before work.

232
00:15:48,120 --> 00:15:49,120
Right.

233
00:15:54,120 --> 00:15:55,120
Right. Come on.

234
00:16:17,560 --> 00:16:18,600
Mr Marston,

235
00:16:18,640 --> 00:16:21,520
how is it potential Russian
aircraft were allowed

236
00:16:21,560 --> 00:16:23,000
to fly so near to London?

237
00:16:23,040 --> 00:16:26,400
We knew all along
the attack was probably a fake.

238
00:16:26,440 --> 00:16:29,080
If we responded,
we would have been the aggressor.

239
00:16:29,120 --> 00:16:32,120
Cyber warfare is notoriously escalatory,

240
00:16:32,160 --> 00:16:34,480
and this is just the latest in a string

241
00:16:34,520 --> 00:16:37,840
of unacceptable Russian
provocations. That they could gain

242
00:16:37,880 --> 00:16:39,560
access to our radar systems is...

243
00:16:39,600 --> 00:16:43,560
of course, of serious concern,
and the PM and I are very clear

244
00:16:43,600 --> 00:16:46,760
that our cyber defences
must be strengthened.

245
00:16:46,800 --> 00:16:49,040
There's only so long we can
keep this to ourselves.

246
00:16:50,120 --> 00:16:51,160
Danny and I are to brief

247
00:16:51,200 --> 00:16:53,040
the Prime Minister and security directors.

248
00:16:53,080 --> 00:16:55,080
We should inform them about our mole.

249
00:16:55,120 --> 00:16:56,896
If we inform them,
then they're going to bring

250
00:16:56,920 --> 00:17:00,040
in external investigators
and work will be disrupted.

251
00:17:00,080 --> 00:17:02,120
And the mole will run to ground.

252
00:17:02,160 --> 00:17:05,240
We have a duty. We have a duty
to fix our entire network

253
00:17:05,280 --> 00:17:08,840
after this attack and find the
mole as quickly as possible.

254
00:17:08,880 --> 00:17:12,280
If we tell Marston, he'll use it
to break up GCHQ once and for all.

255
00:17:13,520 --> 00:17:14,720
There might be another option.

256
00:17:16,600 --> 00:17:19,880
The Event Management Centre
is the most secure unit in GCHQ.

257
00:17:19,920 --> 00:17:24,440
Every terminal has live tracking.
If you can find a pretext to move

258
00:17:24,480 --> 00:17:29,040
all those in malware who had
access to the sandbox there,

259
00:17:29,080 --> 00:17:30,160
I have the perfect

260
00:17:30,200 --> 00:17:33,320
person to monitor their
online behaviour remotely.

261
00:17:33,360 --> 00:17:38,760
This way, we might catch them
in the act and we keep working.

262
00:17:41,200 --> 00:17:42,200
All right.

263
00:17:50,800 --> 00:17:53,400
Richard. David.

264
00:17:53,440 --> 00:17:55,640
David. Alex. Defence Secretary.

265
00:17:57,200 --> 00:17:58,840
Alex.

266
00:17:58,880 --> 00:17:59,880
Danny.

267
00:18:02,400 --> 00:18:03,880
Are we expecting the Prime Minister?

268
00:18:05,000 --> 00:18:08,600
Director General MI5? No, it's just us.

269
00:18:10,600 --> 00:18:12,920
And it's no longer Defence Secretary.

270
00:18:12,960 --> 00:18:17,280
Mr Makinde has seen fit to
appoint me Foreign Secretary.

271
00:18:17,320 --> 00:18:18,840
So you report to me now.

272
00:18:19,960 --> 00:18:26,360
The Prime Minister wishes to pursue
a more robust foreign policy.

273
00:18:26,400 --> 00:18:28,720
And given the response
to the Russian attack,

274
00:18:28,760 --> 00:18:32,760
he has asked me to ensure
that there are no repeats of

275
00:18:32,800 --> 00:18:37,360
the failures of GCHQ
in the past few weeks.

276
00:18:37,400 --> 00:18:40,800
Three waves of unopposed
Russian cyber attacks

277
00:18:40,840 --> 00:18:42,520
and the loss of our and

278
00:18:42,560 --> 00:18:45,280
the NSA's most highly
confidential material.

279
00:18:47,920 --> 00:18:50,840
So we're going to do something
a little bit different.

280
00:18:50,880 --> 00:18:56,480
From now on, GCHQ and MI6
will be directly answerable to me.

281
00:18:57,840 --> 00:19:03,680
I would like to see this as
an opportunity to reset relations.

282
00:19:05,000 --> 00:19:09,520
I hope you do too. Of course,
Foreign Secretary.

283
00:19:09,560 --> 00:19:10,560
Good.

284
00:19:11,960 --> 00:19:12,960
Good.

285
00:19:15,440 --> 00:19:20,400
The search for a mole boils
down to two simple questions.

286
00:19:20,440 --> 00:19:24,920
Access and motive. We need to know
who had access to the computer

287
00:19:24,960 --> 00:19:26,200
and of those who did

288
00:19:26,240 --> 00:19:29,200
who had motive to pass
the Mac address to the Russians.

289
00:19:29,240 --> 00:19:31,880
The computer in question
served as a sandbox

290
00:19:31,920 --> 00:19:35,920
for the Malware department
for two years

291
00:19:35,960 --> 00:19:37,880
and two months
until the time of the attack.

292
00:19:37,920 --> 00:19:40,320
Anyone in Malware or IT
could have accessed the

293
00:19:40,360 --> 00:19:41,520
Mac address in that time.

294
00:19:41,560 --> 00:19:44,600
What about CCTV and logs?
They're cycled every few months.

295
00:19:44,640 --> 00:19:47,840
It would have taken six months at least

296
00:19:47,880 --> 00:19:50,400
to build it into that malware
and run the operation.

297
00:19:50,440 --> 00:19:52,400
So those who only logged in for

298
00:19:52,440 --> 00:19:54,800
the first time this year are off the hook.

299
00:19:54,840 --> 00:19:57,440
That includes you.

300
00:19:57,480 --> 00:20:01,160
But with thousands of log-ins
18 months before...

301
00:20:02,920 --> 00:20:05,200
it does mean we're looking
for a needle in a haystack.

302
00:20:05,240 --> 00:20:06,456
But there's a record of every time

303
00:20:06,480 --> 00:20:09,760
a Mac address is checked in the log files.

304
00:20:09,800 --> 00:20:11,800
Date and time stamped. So we just need

305
00:20:11,840 --> 00:20:16,400
to cross-reference those with
who was logged in at the time.

306
00:20:16,440 --> 00:20:19,720
In that case, it's lucky I had IT

307
00:20:19,760 --> 00:20:22,280
swap out the sandbox terminal
and bring it here.

308
00:20:37,800 --> 00:20:40,800
And the data of ours that was stolen?

309
00:20:40,840 --> 00:20:42,840
Well, I've asked our
Composite Signals side

310
00:20:42,880 --> 00:20:44,680
to work on a full inventory assessment.

311
00:20:46,000 --> 00:20:47,360
Nonetheless,

312
00:20:47,400 --> 00:20:50,480
Cyber Security remains
stretched to the limit.

313
00:20:52,480 --> 00:20:53,680
Is there any evidence

314
00:20:53,720 --> 00:20:56,440
that the Russians
are aware yet of their data loss?

315
00:20:56,480 --> 00:21:00,920
No. Trusov used UDP via Netcat.

316
00:21:02,840 --> 00:21:07,200
He bounced via satellite.
Several satellites, actually.

317
00:21:07,240 --> 00:21:09,600
We can trace the route back
because we know it's there.

318
00:21:09,640 --> 00:21:12,560
That gives us a back door into the FSB.

319
00:21:12,600 --> 00:21:14,280
Until they know there's a leak,

320
00:21:14,320 --> 00:21:16,040
they won't be able to discover the route.

321
00:21:16,080 --> 00:21:18,400
MI6 agents on the
ground confirm there's

322
00:21:18,440 --> 00:21:20,016
no clear evidence they're
aware of the leak.

323
00:21:20,040 --> 00:21:24,360
And while they are unaware, we can
basically see their every move.

324
00:21:24,400 --> 00:21:26,320
So the British public,

325
00:21:26,360 --> 00:21:28,880
who have seen ample evidence
of the Russian

326
00:21:28,920 --> 00:21:31,800
attack on our streets and on our news,

327
00:21:31,840 --> 00:21:37,400
they as yet have seen no sign
of any actual response from us.

328
00:21:37,440 --> 00:21:39,280
They no doubt think
the Russians have won.

329
00:21:42,200 --> 00:21:44,040
The Prime Minister has stated publicly

330
00:21:44,080 --> 00:21:46,880
that he will take equal
and proportionate action...

331
00:21:46,920 --> 00:21:51,320
Excuse me, Foreign Secretary.
A symmetric attack would

332
00:21:51,360 --> 00:21:54,680
be highly escalatory and unpredictable.

333
00:21:54,720 --> 00:21:57,080
In my opinion,
it would be completely unnecessary.

334
00:21:57,120 --> 00:22:00,440
We are assured by our
colleagues here and in the US

335
00:22:00,480 --> 00:22:03,800
that the opportunity to listen
in on the FSB is priceless.

336
00:22:03,840 --> 00:22:06,160
If we listen, we will listen robustly.

337
00:22:06,200 --> 00:22:09,360
If we respond, we will respond robustly.

338
00:22:12,320 --> 00:22:14,240
That is why I am seconding a team from

339
00:22:14,280 --> 00:22:18,040
the 14th Signal Regiment
and appointing their CEO,

340
00:22:18,080 --> 00:22:20,120
Lieutenant Colonel Cavendish,

341
00:22:20,160 --> 00:22:23,240
to the new post of
Director of Rapid Reaction.

342
00:22:27,680 --> 00:22:32,040
What's rapid reaction?
You want to attack Russia?

343
00:22:32,080 --> 00:22:34,320
You said you were short of expert staff.

344
00:22:35,600 --> 00:22:36,680
These are experts.

345
00:22:38,000 --> 00:22:40,280
Your minister is listening.

346
00:22:46,120 --> 00:22:47,200
Thank you, gentlemen.

347
00:22:56,600 --> 00:22:58,480
Danny.

348
00:22:58,520 --> 00:23:00,360
You're still Director of Operations.

349
00:23:00,400 --> 00:23:04,320
14th Signals? That's soldiers.
They'll be offensive cyber.

350
00:23:04,360 --> 00:23:05,520
And with their own director,

351
00:23:05,560 --> 00:23:07,016
they'll be free to act independently.

352
00:23:07,040 --> 00:23:09,360
And they'll still be answerable to me.

353
00:23:09,400 --> 00:23:11,720
Yeah, it's just the first shot, David.

354
00:23:11,760 --> 00:23:14,320
And with Marston as our boss now,
frankly,

355
00:23:14,360 --> 00:23:17,400
we are fucked. Everyone's on
edge because of the attack.

356
00:23:17,440 --> 00:23:20,640
When things calm down,
we'll find a way through.

357
00:23:20,680 --> 00:23:22,640
If Marston gets his way
and attacks the Russians,

358
00:23:22,680 --> 00:23:24,440
things are hardly going to calm down.

359
00:23:24,480 --> 00:23:26,720
Our new minister seems
to be gunning for you.

360
00:23:27,880 --> 00:23:30,880
I understand David passed you
the details for Vadim Trusov.

361
00:23:30,920 --> 00:23:34,360
We're working on a plan.
We'll take it to our new minister.

362
00:23:34,400 --> 00:23:38,320
Marston? We live in interesting times.

363
00:23:38,360 --> 00:23:39,760
Robust times at least.

364
00:23:41,520 --> 00:23:45,040
Yeah, well, thank you for Vadim.
We owe him.

365
00:23:45,080 --> 00:23:47,520
Must dash. Do give my best
to Barbara, Danny.

366
00:23:51,560 --> 00:23:52,560
Come on.

367
00:23:59,240 --> 00:24:01,280
A gap.

368
00:24:01,320 --> 00:24:04,880
I'm not sure I understand.
It's really quite simple.

369
00:24:04,920 --> 00:24:08,320
These are all the log-ins to
the sandbox over an 18-month period.

370
00:24:08,360 --> 00:24:11,520
The haystack. And this is a list

371
00:24:11,560 --> 00:24:14,120
of the Mac address log-ins between

372
00:24:14,160 --> 00:24:18,040
the 31st of July
and the 1st of November 2022.

373
00:24:18,080 --> 00:24:20,480
The records for the Mac address
log-ins are missing.

374
00:24:20,520 --> 00:24:21,520
You can see here...

375
00:24:22,800 --> 00:24:26,200
where they've been erased or removed.

376
00:24:26,240 --> 00:24:30,560
The FSB must have wiped them during
the attack to protect their mole.

377
00:24:30,600 --> 00:24:33,320
Well, at least we have those dates.

378
00:24:38,440 --> 00:24:40,360
It also rules out anyone from IT.

379
00:24:42,760 --> 00:24:45,360
IT check every computer
every few months.

380
00:24:45,400 --> 00:24:47,680
If it was one of them,
then they'd have cover.

381
00:24:47,720 --> 00:24:49,120
No need to wipe any records, so...

382
00:24:55,520 --> 00:24:58,480
Saara, tomorrow I want you back
with your malware colleagues.

383
00:24:58,520 --> 00:25:00,320
I'm moving you all to the EMC

384
00:25:00,360 --> 00:25:03,520
so I can personally oversee
the response to the FSB attack,

385
00:25:03,560 --> 00:25:06,200
and while we still have a back door
into their system,

386
00:25:06,240 --> 00:25:08,560
I want you to have a look
for the stolen Mac log-ins.

387
00:25:08,600 --> 00:25:13,160
OK? And before you ask, yes.
I've spoken to MI6 about Vadim.

388
00:25:13,200 --> 00:25:16,040
Thank you. I'll get started on
that straight away.

389
00:25:18,760 --> 00:25:22,160
If IT are ruled out, that means...

390
00:25:24,120 --> 00:25:25,920
It means it must be someone
from malware.

391
00:25:27,560 --> 00:25:28,560
From our team.

392
00:25:46,080 --> 00:25:49,200
Right, come on, come on.
Last chopper out of Saigon.

393
00:25:49,240 --> 00:25:51,120
Elliot!

394
00:25:51,160 --> 00:25:53,440
Come on, mate.
What have you been doing up there?

395
00:25:53,480 --> 00:25:55,360
He's been in the bathroom,

396
00:25:55,400 --> 00:25:57,000
making himself handsome like his dad.

397
00:25:58,680 --> 00:26:01,040
You're listening to This
Morning Britain, and we'll have.

398
00:26:01,080 --> 00:26:03,640
Prime Minister Andrew Makinde
with us at ten-past.

399
00:26:05,320 --> 00:26:07,320
Mr Putin can rest assured

400
00:26:07,360 --> 00:26:10,320
the UK's alliance with the US
is unbreakable,

401
00:26:10,360 --> 00:26:11,440
and we're unshakeable

402
00:26:11,480 --> 00:26:13,840
in our opposition
to his territorial ambitions.

403
00:26:13,880 --> 00:26:17,000
We will answer his recent attempts
to undermine our infrastructure

404
00:26:17,040 --> 00:26:18,760
in like and in kind.

405
00:26:18,800 --> 00:26:21,920
But what I really want to talk
about is China.

406
00:26:21,960 --> 00:26:26,320
For God's sake.
We are negotiating a trade deal.

407
00:26:26,360 --> 00:26:27,816
What about their human rights record?

408
00:26:27,840 --> 00:26:30,160
Exactly. Thank you. This is a deal

409
00:26:30,200 --> 00:26:33,600
that will herald a second golden age
in Sino-British relations.

410
00:26:33,640 --> 00:26:35,240
God help us all.

411
00:26:37,560 --> 00:26:41,200
Right, we have arrived
at the juvenile correction facility.

412
00:26:46,240 --> 00:26:48,560
Child locks, Mum. Yeah. I'll release you

413
00:26:48,600 --> 00:26:50,880
when you bid your parents adieu
in a civil manner.

414
00:26:50,920 --> 00:26:53,120
Bye, Mum. Bye, Dad. Love you.

415
00:26:57,680 --> 00:27:00,000
The UK Government
is now considering how

416
00:27:00,040 --> 00:27:03,480
to respond after one of the most
significant Russian cyber attacks...

417
00:27:03,520 --> 00:27:07,880
So... in recent history...
..Marston's mob arriving today?

418
00:27:07,920 --> 00:27:11,200
Concerns about the
growing threat of cyber warfare...

419
00:27:11,240 --> 00:27:12,640
Are you going to be back late?

420
00:27:13,880 --> 00:27:17,680
I have no idea. But if I am,
I'll get Charlie to give me a lift.

421
00:27:17,720 --> 00:27:18,840
All right.

422
00:27:18,880 --> 00:27:20,600
They warned that if the UK launches

423
00:27:20,640 --> 00:27:23,840
offensive cyber operations,
Russia could retaliate

424
00:27:23,880 --> 00:27:26,160
with even more severe attacks.

425
00:27:26,200 --> 00:27:28,680
You know, don't give
that place everything, Danny.

426
00:27:28,720 --> 00:27:30,640
And impact citizens' everyday lives...

427
00:27:30,680 --> 00:27:32,920
Leave some for us?

428
00:27:32,960 --> 00:27:34,800
So, as tensions rise...

429
00:27:34,840 --> 00:27:37,520
I'll try... the Government faces a
difficult choice.

430
00:27:37,560 --> 00:27:40,600
How to protect national
security without escalating

431
00:27:40,640 --> 00:27:42,280
a dangerous cyber conflict?

432
00:27:46,240 --> 00:27:47,640
Ms Napier. Thank you.

433
00:27:47,680 --> 00:27:50,960
And you've got visitors, Mr Patrick. God.

434
00:27:51,000 --> 00:27:54,280
That must be them. Go on.

435
00:27:54,320 --> 00:27:56,960
Go be brilliant. I'll see you later.

436
00:28:07,600 --> 00:28:09,160
Good morning.

437
00:28:09,200 --> 00:28:11,880
Danny Patrick,
Director of Operations, GCHQ.

438
00:28:11,920 --> 00:28:13,056
Lieutenant Colonel Cavendish,

439
00:28:13,080 --> 00:28:17,640
14th Royal Signals and Director
of Rapid Reaction, GCHQ, it seems.

440
00:28:17,680 --> 00:28:18,680
Well, welcome.

441
00:28:21,800 --> 00:28:24,720
I thought you had quite a few
service personnel here.

442
00:28:24,760 --> 00:28:27,080
They only wear their
uniforms on Military Monday,

443
00:28:27,120 --> 00:28:28,936
so they probably think you're
the firing squad come for me.

444
00:28:28,960 --> 00:28:29,960
Maybe we are.

445
00:28:32,920 --> 00:28:34,600
Morning.

446
00:28:34,640 --> 00:28:35,640
Hi.

447
00:28:42,880 --> 00:28:45,200
In all my time as head of China Team,

448
00:28:45,240 --> 00:28:47,760
I've never seen such a fuss over
a trade deal.

449
00:28:47,800 --> 00:28:50,200
Thank you, Lydia.

450
00:28:52,840 --> 00:28:56,040
Economic and technical security reports.

451
00:28:56,080 --> 00:28:58,760
God, they must have every
asset reporting on this.

452
00:28:58,800 --> 00:29:00,680
And the Department of
Trade and Industry

453
00:29:00,720 --> 00:29:03,240
want it all translated
and synopsised by tomorrow.

454
00:29:03,280 --> 00:29:05,600
I know, I know.

455
00:29:05,640 --> 00:29:08,720
But it is our duty, our privilege,
our joy, no less, to serve.

456
00:29:08,760 --> 00:29:11,840
So, let's get to work. Calvin. Yes, ma'am.

457
00:29:11,880 --> 00:29:14,240
I've sent you each your allocation
to your desktop.

458
00:29:14,280 --> 00:29:17,040
I've printed yours out, ma'am,
as per. Thank you.

459
00:29:18,520 --> 00:29:21,480
"Secret report on the CCP activities
in managed asset pools."

460
00:29:21,520 --> 00:29:24,440
Hedge funds. My favourite.
Let's give it our best shot, team.

461
00:29:26,320 --> 00:29:28,960
Any idea why they moved us up here?

462
00:29:29,000 --> 00:29:30,000
No, he didn't say.

463
00:29:31,320 --> 00:29:34,480
Look, Phil. Soldier boys. Your wet dream.

464
00:29:34,520 --> 00:29:36,480
Yeah, some of us actually served, mate.

465
00:29:36,520 --> 00:29:38,800
GCO, Afghan. Yeah.

466
00:29:38,840 --> 00:29:42,080
Sat in a comms container
for three months playing Minecraft.

467
00:29:42,120 --> 00:29:43,960
The Event Management Centre

468
00:29:44,000 --> 00:29:48,320
or EMC, where we'll all be based.
Find a terminal.

469
00:29:48,360 --> 00:29:50,120
IT will set you up with log-ins.

470
00:29:50,160 --> 00:29:53,040
Yeah, we need to be accommodated
together in our own space.

471
00:29:53,080 --> 00:29:57,440
We'll just take that one. A hut.
Isn't that what you call it?

472
00:29:57,480 --> 00:30:00,080
Yeah... It's best
if all the reverse engineers,

473
00:30:00,120 --> 00:30:02,440
offensive cyber teams,
and analysts are in one space,

474
00:30:02,480 --> 00:30:05,360
so I can co-ordinate the response
to the FSB attack.

475
00:30:05,400 --> 00:30:07,696
I understand that you shall
co-ordinate the clean-up operation

476
00:30:07,720 --> 00:30:09,240
and damage assessment.

477
00:30:09,280 --> 00:30:13,640
I, as Director of Rapid Reaction,
shall co-ordinate said reaction.

478
00:30:13,680 --> 00:30:16,480
Whatever offensive operation
our minister orders.

479
00:30:16,520 --> 00:30:18,800
That conference room
looks sufficient for the time being.

480
00:30:23,280 --> 00:30:25,960
We also try to foster a culture of civility.

481
00:30:27,560 --> 00:30:29,200
Good morning, everyone.

482
00:30:29,240 --> 00:30:31,560
I would like to introduce you
to your new colleagues,

483
00:30:31,600 --> 00:30:33,920
joining us from the 14th Signal Regiment

484
00:30:33,960 --> 00:30:36,760
and our new Director of Rapid Reaction,

485
00:30:36,800 --> 00:30:39,800
Lieutenant Colonel Cavendish.
Roz, please.

486
00:30:39,840 --> 00:30:41,360
Thank you, Danny.

487
00:30:41,400 --> 00:30:43,320
Er, first, the uniforms.

488
00:30:43,360 --> 00:30:46,000
Don't worry.
Everyone gets it wrong first day.

489
00:30:47,880 --> 00:30:51,600
Yeah, I appreciate there's
a cultural difference here.

490
00:30:51,640 --> 00:30:53,880
You like to listen,
when you're not interrupting.

491
00:30:55,520 --> 00:30:57,800
We like to act.

492
00:30:57,840 --> 00:31:02,480
Hopefully, listening and acting
do not prove mutually exclusive.

493
00:31:02,520 --> 00:31:03,800
And the uniforms stay.

494
00:31:07,080 --> 00:31:08,160
As you were, troops.

495
00:31:11,240 --> 00:31:14,080
Max, Charlie Francis
from Security would like a word.

496
00:31:23,360 --> 00:31:25,880
OK, OK, let's crack on, shall we?
We've got a whole

497
00:31:25,920 --> 00:31:28,240
computer network to analyse
for vulnerabilities

498
00:31:28,280 --> 00:31:32,600
and damage and anything our Russian
visitors may have left behind.

499
00:31:32,640 --> 00:31:33,640
Let's have a good one.

500
00:31:47,320 --> 00:31:51,200
Just a routine security sift, Max.

501
00:31:51,240 --> 00:31:52,320
Given the scare,

502
00:31:52,360 --> 00:31:55,560
those on high are jumpy
and have asked me to check

503
00:31:55,600 --> 00:31:59,360
that all security protocols
have been, and are being, followed.

504
00:32:00,760 --> 00:32:05,560
OK. No bother. Like all teams,
you run a hot-desk policy?

505
00:32:05,600 --> 00:32:08,840
All your programmers can log
in on any computer?

506
00:32:08,880 --> 00:32:13,200
This applies to all machines,
sandboxes included?

507
00:32:13,240 --> 00:32:14,280
Yeah.

508
00:32:15,760 --> 00:32:17,480
What happens
if you need to leave your desk?

509
00:32:19,360 --> 00:32:20,600
Well, then you log out.

510
00:32:22,600 --> 00:32:25,920
We're, we're pretty hot on that.
Even for a quick pee?

511
00:32:25,960 --> 00:32:27,800
You leave a machine logged in,

512
00:32:27,840 --> 00:32:30,520
and someone comes along
and doesn't know...

513
00:32:31,840 --> 00:32:35,400
accidentally wipes all your work.
Or, you know,

514
00:32:35,440 --> 00:32:39,920
spills coffee, whatever. So if
someone, while they're logged in...

515
00:32:41,080 --> 00:32:42,360
accessed something...

516
00:32:44,200 --> 00:32:46,440
Like what? Anything.

517
00:32:46,480 --> 00:32:48,160
Something on the system.

518
00:32:48,200 --> 00:32:51,120
It would pretty much have
to be through their own log-in?

519
00:32:51,160 --> 00:32:53,960
Yes, I'd have thought so.
Can you be 100% sure?

520
00:32:55,320 --> 00:32:58,080
Well, no, but... 99%.

521
00:33:00,360 --> 00:33:01,400
Is this about the attack?

522
00:33:01,440 --> 00:33:02,920
Just answer the questions, please.

523
00:33:19,720 --> 00:33:22,040
Alex. Danny. We've got the sign-off

524
00:33:22,080 --> 00:33:24,560
from Marston on
the Vadim Trusov exfiltration.

525
00:33:24,600 --> 00:33:25,880
That's good.

526
00:33:25,920 --> 00:33:29,440
But, I'm afraid we've had word from
Dutch intel.

527
00:33:29,480 --> 00:33:32,920
They've had a sighting of Trusov.
They've got a hack on the camera on

528
00:33:32,960 --> 00:33:34,920
the FSB entrance in Saint Petersburg.

529
00:33:34,960 --> 00:33:39,840
It's not good news.
Needless to say, if they have him,

530
00:33:39,880 --> 00:33:45,160
we can't proceed, and I imagine
Vadim Trusov is in grave danger.

531
00:33:45,200 --> 00:33:47,480
Does that mean they know
we're inside their system?

532
00:33:47,520 --> 00:33:48,720
There's no indication as yet.

533
00:33:48,760 --> 00:33:53,720
But if the FSB have got him,
it can only be a matter of time.

534
00:33:53,760 --> 00:33:54,760
OK.

535
00:34:13,960 --> 00:34:16,000
Where are they? Where's who?

536
00:34:16,040 --> 00:34:19,320
The soldiers in the FSB system.
I mean, this is all us.

537
00:34:19,360 --> 00:34:22,320
What are they doing? They're soldiers.

538
00:34:22,360 --> 00:34:25,360
They follow orders.
They don't ask questions.

539
00:34:25,400 --> 00:34:27,080
Maybe you should try it sometime.

540
00:34:28,520 --> 00:34:30,200
Right after my next sarcasm lesson?

541
00:35:19,800 --> 00:35:21,200
Looking for something?

542
00:35:25,560 --> 00:35:27,360
They're rigging the FSB
system to blow it up.

543
00:35:27,400 --> 00:35:29,360
Excuse me. If we blow the system,

544
00:35:29,400 --> 00:35:31,720
they'll find out how we got in
and trace it back to Vadim.

545
00:35:31,760 --> 00:35:34,000
Saara, go back to your station. Shall we?

546
00:35:51,760 --> 00:35:52,880
Come in, Danny.

547
00:35:59,080 --> 00:36:00,640
Lieutenant Colonel Cavendish.

548
00:36:00,680 --> 00:36:03,000
I'm so sorry I wasn't
able to greet you earlier.

549
00:36:05,520 --> 00:36:07,160
Problem?

550
00:36:07,200 --> 00:36:09,120
I am the Director of Operations.

551
00:36:09,160 --> 00:36:12,160
I answer to the Foreign Secretary.
I cannot answer to him

552
00:36:12,200 --> 00:36:15,280
if there are operations being
conducted behind my back.

553
00:36:15,320 --> 00:36:17,216
My operation was ordered by
the Foreign Secretary.

554
00:36:17,240 --> 00:36:20,400
It has not been conducted
behind your back, but in parallel.

555
00:36:20,440 --> 00:36:21,480
Operation?

556
00:36:21,520 --> 00:36:25,880
To mine and blow up the FSB system,
and the Russians will retaliate.

557
00:36:25,920 --> 00:36:27,560
It will end in World War III.

558
00:36:27,600 --> 00:36:30,600
To install a comprehensive
array of degrading effects

559
00:36:30,640 --> 00:36:33,840
to trigger as and when we receive
orders from our superiors.

560
00:36:33,880 --> 00:36:37,840
We cannot have two chains of command
in the one operations room.

561
00:36:37,880 --> 00:36:39,280
We don't.

562
00:36:39,320 --> 00:36:43,080
We have two parallel operations.

563
00:36:43,120 --> 00:36:46,200
Our political masters will decide
which one they wish to pursue.

564
00:36:49,200 --> 00:36:51,080
In that case, I'll get back to
what I was doing.

565
00:36:52,560 --> 00:36:54,160
Danny, a moment.

566
00:37:00,080 --> 00:37:02,840
I don't like it either but we cannot
control the Government.

567
00:37:02,880 --> 00:37:04,440
We can only advise.

568
00:37:04,480 --> 00:37:07,400
After the last few weeks,
Marston's going to be all over us.

569
00:37:07,440 --> 00:37:09,280
You heard him.

570
00:37:09,320 --> 00:37:11,560
We need to be seen to be running
a steady ship.

571
00:37:15,440 --> 00:37:17,120
And we need to find that mole.

572
00:37:29,320 --> 00:37:32,280
Sally, can you get me Michaela Jones
at the NSA, please?

573
00:37:32,320 --> 00:37:33,320
Of course.

574
00:37:36,920 --> 00:37:38,376
You're gonna let her do it,
aren't you? Sorry.

575
00:37:38,400 --> 00:37:39,680
What about Vadim?

576
00:37:39,720 --> 00:37:41,720
It won't take them long
to work out how we got in.

577
00:37:41,760 --> 00:37:44,880
They're not going to blow it up.
Not if I can help it.

578
00:37:44,920 --> 00:37:47,760
But the news on Vadim is...

579
00:37:47,800 --> 00:37:49,840
It's not so good, I'm afraid.

580
00:37:49,880 --> 00:37:53,120
Hacked CCTV footage shows Vadim
and other coders being led out of

581
00:37:53,160 --> 00:37:55,160
the FSB headquarters in St Petersburg.

582
00:37:55,200 --> 00:37:57,440
When? Same night he leaked
us the material.

583
00:37:58,760 --> 00:37:59,760
That's days ago.

584
00:38:07,680 --> 00:38:09,560
He's only there because he helped us.

585
00:38:11,440 --> 00:38:13,120
What will they be doing to him?

586
00:38:13,160 --> 00:38:15,880
I don't know, Saara. I don't know.

587
00:38:15,920 --> 00:38:17,160
MI6 believe that as long

588
00:38:17,200 --> 00:38:19,216
as Vadim is in the hands
of the Russian authorities...

589
00:38:19,240 --> 00:38:21,920
They need to get him out.
..they won't be able to help him.

590
00:38:23,520 --> 00:38:24,520
I'm sorry, Saara.

591
00:38:27,160 --> 00:38:28,200
This is all my fault.

592
00:38:45,920 --> 00:38:48,400
That's Michaela for you.
Thank you, Sally.

593
00:38:48,440 --> 00:38:50,320
Michaela.Dan.

594
00:38:50,360 --> 00:38:52,280
We have a problem with
Richard Marston.

595
00:38:53,480 --> 00:38:55,080
He's been moved to Foreign, hasn't he?

596
00:38:55,120 --> 00:38:57,440
Yeah. He's playing nice,
as nice as he can.

597
00:38:57,480 --> 00:39:01,040
But he's determined to live out his
Churchillian fantasies.

598
00:39:01,080 --> 00:39:04,680
So he's sent in his own dirty tricks
team to blow up the FSB system.

599
00:39:04,720 --> 00:39:07,960
Shit. Greatest listening
opportunity we've ever had

600
00:39:08,000 --> 00:39:10,960
and he wants to piss it up the wall
for the sake of his own ego.

601
00:39:11,000 --> 00:39:13,000
How soon before his finger gets itchy?

602
00:39:13,040 --> 00:39:15,560
I don't know, but my guess is not long.

603
00:39:17,320 --> 00:39:19,000
I'll talk to Perez. Thank you.

604
00:39:48,280 --> 00:39:51,440
I'd like to work on the
offensive cyber with you.

605
00:39:51,480 --> 00:39:53,376
I don't want to imagine
what they're doing to Vadim.

606
00:39:53,400 --> 00:39:54,880
I just want to hurt them back.

607
00:39:56,160 --> 00:39:57,320
I'm good at this.

608
00:40:03,520 --> 00:40:04,840
Yeah, start on the comms code.

609
00:40:06,400 --> 00:40:07,880
Then... we'll see.

610
00:40:09,440 --> 00:40:10,640
I'll be watching.

611
00:40:46,760 --> 00:40:48,560
Come in.

612
00:40:53,560 --> 00:40:55,840
You're working with them now, are you?

613
00:40:55,880 --> 00:40:57,240
You told me to look

614
00:40:57,280 --> 00:41:00,560
for our missing Mac log-in data
in the FSB system.

615
00:41:00,600 --> 00:41:02,560
Otherwise she'd see me in there.

616
00:41:02,600 --> 00:41:04,120
I'm impressed.

617
00:41:04,160 --> 00:41:05,840
And?

618
00:41:05,880 --> 00:41:08,640
Nothing. Not even a trace.
And there's no sign

619
00:41:08,680 --> 00:41:11,280
of any data they stole
from us in their system.

620
00:41:11,320 --> 00:41:13,760
Sorry, Saara, I've got to take this.

621
00:41:17,120 --> 00:41:18,480
General Perez, sir.

622
00:41:20,560 --> 00:41:21,680
You have two minutes.

623
00:41:21,720 --> 00:41:23,480
I appreciate I'm speaking out of turn,

624
00:41:23,520 --> 00:41:26,360
but I felt you should
know our listening operation against

625
00:41:26,400 --> 00:41:29,520
the FSB is in danger,
and not from the Russians.

626
00:41:32,920 --> 00:41:34,360
Night, Dave. See you.

627
00:41:57,680 --> 00:41:58,680
Pub?

628
00:42:00,320 --> 00:42:02,520
Thanks. I don't really do pubs.

629
00:42:11,120 --> 00:42:13,480
So, what did old
Checkpoint Charlie want?

630
00:42:13,520 --> 00:42:15,240
Just routine, he said.

631
00:42:15,280 --> 00:42:17,760
But he was asking a lot of questions
about our sandboxes.

632
00:42:17,800 --> 00:42:20,720
Really? Phil? Changed your mind?

633
00:42:20,760 --> 00:42:23,520
Do you know a game called
End of Daze?

634
00:42:23,560 --> 00:42:28,680
Yeah, it's... Horizon Zero Dawn
with a touch of Zelda.

635
00:42:28,720 --> 00:42:31,240
Phil's Mr Gamer.
The rougher the dystopia,

636
00:42:31,280 --> 00:42:32,840
the more he enjoys it.

637
00:42:32,880 --> 00:42:35,120
I just need to know how to get into
the Discord chat.

638
00:42:36,480 --> 00:42:38,680
Well... You'll be sorry you asked.

639
00:42:40,600 --> 00:42:42,640
Let's see.

640
00:42:42,680 --> 00:42:46,240
Yeah. You need to switch those around.

641
00:42:46,280 --> 00:42:50,760
I swear, if one of
you ever goes behind my back to

642
00:42:50,800 --> 00:42:52,200
the Yanks like that again,

643
00:42:52,240 --> 00:42:54,840
I will see to it
that you're charged with treason.

644
00:42:57,880 --> 00:43:01,120
If I may, Foreign Secretary,
to function effectively

645
00:43:01,160 --> 00:43:04,520
as a government
intelligence gathering institution,

646
00:43:04,560 --> 00:43:07,480
there can be no going
behind anyone's back.

647
00:43:07,520 --> 00:43:10,040
I had hoped this could be a new
beginning.

648
00:43:10,080 --> 00:43:14,360
He means that we understand fully
and unequivocally.

649
00:43:16,960 --> 00:43:18,280
Just to be clear,

650
00:43:18,320 --> 00:43:21,800
we're not triggering the degrading
effects.

651
00:43:21,840 --> 00:43:25,160
That is correct, Lieutenant Colonel,
we are not triggering them...

652
00:43:27,000 --> 00:43:28,120
yet.

653
00:43:46,160 --> 00:43:48,120
How are the interviews going?

654
00:43:49,240 --> 00:43:50,360
Nothing jumping out.

655
00:43:52,000 --> 00:43:54,800
They're a pretty clean bunch,
your coders.

656
00:43:54,840 --> 00:43:57,280
They just busted their guts
turning this thing around.

657
00:43:58,440 --> 00:44:00,040
For one of them to be the cause of it...

658
00:44:01,720 --> 00:44:03,320
Man, that'd just break my heart.

659
00:44:04,720 --> 00:44:05,720
I pity them.

660
00:44:07,640 --> 00:44:09,360
Nobody wakes up in the morning
and says,

661
00:44:09,400 --> 00:44:11,040
"Today I'm going to betray"

662
00:44:11,080 --> 00:44:14,680
"my colleagues,
my friends, my family, my country."

663
00:44:16,080 --> 00:44:18,040
Sometimes they're believers,

664
00:44:18,080 --> 00:44:19,640
but usually they've been got to.

665
00:44:21,680 --> 00:44:24,320
Love, sex, blackmail.

666
00:44:26,000 --> 00:44:29,080
By the time we get to them, they're
in the worst place in the world.

667
00:44:30,680 --> 00:44:32,960
But don't worry, Dan. We'll find the mole.

668
00:44:35,280 --> 00:44:36,520
Clock's ticking.

669
00:46:49,760 --> 00:46:50,960
What are you doing?

670
00:47:34,040 --> 00:47:37,000
Subtitles by Red Bee Media