1
00:00:14,320 --> 00:00:18,480
This programme contains
strong language.

2
00:00:20,040 --> 00:00:23,640
So, what made you decide
to leave and come to Moscow?

3
00:00:25,240 --> 00:00:29,416
Because I'm fed up with lying
to the public

4
00:00:29,440 --> 00:00:33,256
about what's really going
on at GCHQ, where I work.

5
00:00:33,280 --> 00:00:38,536
I've done 50 years of service
and I've had enough.

6
00:00:38,560 --> 00:00:42,080
It's time for me to stand up
and say my piece.

7
00:00:43,400 --> 00:00:46,136
50 years of services

8
00:00:46,160 --> 00:00:48,336
and I've had enough.

9
00:00:48,360 --> 00:00:51,376
It's time for me to stand up
and say my piece.

10
00:00:51,400 --> 00:00:53,976
And what is that?

11
00:00:54,000 --> 00:00:55,296
You were friends, weren't you?

12
00:00:55,320 --> 00:00:58,216
That we're no different to what
we're always accusing you lot of.

13
00:00:58,240 --> 00:01:00,336
Hi. Sorry?

14
00:01:00,360 --> 00:01:01,640
You were friends.

15
00:01:03,360 --> 00:01:05,600
Yeah. At least I thought so.

16
00:01:06,840 --> 00:01:09,256
So, what are you looking for?

17
00:01:09,280 --> 00:01:10,456
I don't know.

18
00:01:10,480 --> 00:01:14,336
A clue. Anything.

19
00:01:14,360 --> 00:01:16,536
I just can't believe he'd do this to us.

20
00:01:16,560 --> 00:01:17,560
Us?

21
00:01:19,120 --> 00:01:20,856
He goes missing at the same time

22
00:01:20,880 --> 00:01:24,016
as the biggest leak in intelligence history.

23
00:01:24,040 --> 00:01:25,336
He turns up in Moscow

24
00:01:25,360 --> 00:01:27,456
and admits it on Russian television.

25
00:01:27,480 --> 00:01:30,656
I'd have thought that was
enough evidence...

26
00:01:30,680 --> 00:01:31,720
even for you.

27
00:01:35,720 --> 00:01:37,096
You mean I should get back to work?

28
00:01:37,120 --> 00:01:38,856
That's OK, Saara.

29
00:01:38,880 --> 00:01:40,616
I think we all gave up hope a while back

30
00:01:40,640 --> 00:01:42,640
of you ever actually
doing any work around here.

31
00:02:30,560 --> 00:02:32,240
Can I take this chair?

32
00:03:30,280 --> 00:03:32,760
Don't people hate
having their grammar corrected?

33
00:03:33,960 --> 00:03:36,496
I mean, doesn't it just make
everyone hate you?

34
00:03:36,520 --> 00:03:39,216
If we wrote code as sloppily
as we write English,

35
00:03:39,240 --> 00:03:42,280
it would never run.
Some things have to be right.

36
00:03:53,000 --> 00:03:55,440
Is that all you're having?

37
00:03:56,960 --> 00:03:58,856
I'm Muslim.

38
00:03:58,880 --> 00:04:00,559
They don't have anything halal here.

39
00:04:05,040 --> 00:04:08,096
They won't be very welcoming.

40
00:04:08,120 --> 00:04:09,256
What's funny?

41
00:04:09,280 --> 00:04:11,696
No different to any other
department here, then?

42
00:04:11,720 --> 00:04:14,096
Different FROM any other department.

43
00:04:14,120 --> 00:04:16,360
It's "different from", "compared with".

44
00:04:20,000 --> 00:04:22,456
No different FROM any other
department.

45
00:04:22,480 --> 00:04:25,000
It's "different from", "compared with".

46
00:04:27,520 --> 00:04:29,680
Different from, compared with.

47
00:04:32,560 --> 00:04:35,160
Different from, compared with.

48
00:04:36,240 --> 00:04:44,240
Different from, compared with.

49
00:04:48,680 --> 00:04:51,576
Because I'm fed up with lying to

50
00:04:51,600 --> 00:04:56,656
the public about what's really
going on at GCHQ, where I work.

51
00:04:56,680 --> 00:04:59,240
I've done...

52
00:05:01,000 --> 00:05:02,736
stand up and say my piece.

53
00:05:02,760 --> 00:05:04,216
And what is that?

54
00:05:04,240 --> 00:05:07,896
That we are no different to what
we're always accusing you...

55
00:05:07,920 --> 00:05:10,096
Yes! What is it?

56
00:05:10,120 --> 00:05:13,296
He said "different to".
He would never say "different to".

57
00:05:13,320 --> 00:05:16,440
He would never make that mistake.
It can't be him.

58
00:05:19,160 --> 00:05:21,640
What? S-Saara, wait.

59
00:05:36,360 --> 00:05:38,256
Where is he?

60
00:05:38,280 --> 00:05:40,600
Danny's on his way to London, Saara.

61
00:05:42,920 --> 00:05:43,920
Shit.

62
00:05:50,240 --> 00:05:51,640
Kathy?

63
00:05:55,120 --> 00:05:57,656
She's not here.

64
00:05:57,680 --> 00:05:58,720
Where is she?

65
00:06:00,360 --> 00:06:03,216
She's gone. What do you mean, "gone"?

66
00:06:03,240 --> 00:06:04,360
What did you say to her?

67
00:06:08,800 --> 00:06:12,856
I didn't say anything.
I came back and she was packing.

68
00:06:12,880 --> 00:06:14,760
She's been recalled to Maryland.

69
00:06:17,200 --> 00:06:20,080
She flew about 25 minutes ago.
She left this.

70
00:06:38,240 --> 00:06:39,840
What's going on, Saara?

71
00:06:41,960 --> 00:06:43,640
Don't lie to me this time.

72
00:06:52,160 --> 00:06:53,680
You're in love with her, aren't you?

73
00:06:56,320 --> 00:06:57,400
Don't lie, please.

74
00:07:04,400 --> 00:07:06,120
I don't know.

75
00:07:07,960 --> 00:07:09,040
M-Maybe.

76
00:07:18,440 --> 00:07:19,960
Have you made love here?

77
00:07:27,160 --> 00:07:28,200
Yes.

78
00:07:37,440 --> 00:07:39,216
OK.

79
00:07:39,240 --> 00:07:40,400
Where does that leave us?

80
00:07:44,000 --> 00:07:45,440
Do you still love me?

81
00:07:47,000 --> 00:07:49,760
Did you ever really... love me?

82
00:07:58,600 --> 00:08:01,120
Don't go, James, please. I'm sorry.

83
00:08:02,720 --> 00:08:04,120
I...

84
00:08:06,720 --> 00:08:10,336
I know you just lost your dad
and I know you're upset,

85
00:08:10,360 --> 00:08:14,016
and I know you say you can't
deal with your emotions.

86
00:08:14,040 --> 00:08:15,760
I've tried to make allowances.

87
00:08:17,200 --> 00:08:18,560
I really have.

88
00:08:21,040 --> 00:08:24,560
But when you crash into
people's lives, people get hurt.

89
00:08:26,440 --> 00:08:29,200
People who care about you.
People who love you.

90
00:08:34,800 --> 00:08:36,520
Just try and think about that?

91
00:08:54,800 --> 00:08:56,280
Fuck.

92
00:09:10,600 --> 00:09:12,000
Mark, welcome.

93
00:09:13,600 --> 00:09:16,896
Sorry I'm late. It's fine.

94
00:09:16,920 --> 00:09:18,696
I'm sure I don't need to tell you

95
00:09:18,720 --> 00:09:20,840
the effect of the Yeabsley leak is...

96
00:09:22,720 --> 00:09:23,760
devastating.

97
00:09:25,000 --> 00:09:27,496
Most of our tools have been
rendered nugatory

98
00:09:27,520 --> 00:09:30,936
and will have to be built again
from scratch.

99
00:09:30,960 --> 00:09:34,640
Our priority now is to keep
what little we do have left secure.

100
00:09:37,560 --> 00:09:40,856
As of 2000 hours today, Eastern Time,

101
00:09:40,880 --> 00:09:43,896
the NSA's intelligence-sharing
arrangement with the UK

102
00:09:43,920 --> 00:09:47,080
is withdrawn, for the foreseeable future.

103
00:09:48,680 --> 00:09:50,696
Er, Mark...

104
00:09:50,720 --> 00:09:54,136
signals cooperation between
our two countries...

105
00:09:54,160 --> 00:09:57,176
goes back 75 years and it plays a vital...

106
00:09:57,200 --> 00:10:01,120
This decision comes from the
Commander-in-chief personally...

107
00:10:02,640 --> 00:10:04,000
and is not open for discussion.

108
00:10:05,720 --> 00:10:08,296
The question we're all asking
ourselves here is why the hell

109
00:10:08,320 --> 00:10:10,776
you re-employed
a loose cannon like John Yeabsley

110
00:10:10,800 --> 00:10:12,280
in the first place.

111
00:10:29,600 --> 00:10:31,160
Hiya. Hi. You all right?

112
00:10:34,240 --> 00:10:36,296
Where do you want me, Sarge?

113
00:10:36,320 --> 00:10:37,896
Get yourself round the back.

114
00:10:37,920 --> 00:10:41,056
Make sure no press are trying
to get in through the garden.

115
00:10:41,080 --> 00:10:43,176
Hey. You're gonna need a mask, Sandy.

116
00:10:43,200 --> 00:10:45,320
I'm just going straight through,
thank you.

117
00:10:48,840 --> 00:10:50,440
Hiya.

118
00:11:04,920 --> 00:11:06,680
Sorry. Thanks.

119
00:11:44,960 --> 00:11:48,120
James, it's me again.

120
00:11:49,520 --> 00:11:51,376
Please call me back.

121
00:11:51,400 --> 00:11:53,216
I know you're angry.

122
00:11:53,240 --> 00:11:54,760
We need to talk.

123
00:11:59,840 --> 00:12:00,960
Come on.

124
00:12:02,040 --> 00:12:05,376
GCHQ intelligence analyst
John Yeabsley,

125
00:12:05,400 --> 00:12:09,216
seen yesterday on Russian TV
admitting responsibility

126
00:12:09,240 --> 00:12:12,016
for a massive leak of GCHQ secrets,

127
00:12:12,040 --> 00:12:15,856
could Not have been in Moscow
yesterday. Back to Dan.

128
00:12:15,880 --> 00:12:16,936
Yes!

129
00:12:16,960 --> 00:12:19,136
Yes, yes, yes. I knew it.

130
00:12:19,160 --> 00:12:21,616
I knew it... in light of what police
are saying here tonight,

131
00:12:21,640 --> 00:12:23,456
the interview shown yesterday
on Russian TV

132
00:12:23,480 --> 00:12:27,536
seems likely now, somehow,
to have been faked,

133
00:12:27,560 --> 00:12:29,736
as he was clearly already dead,
here in Cheltenham,

134
00:12:29,760 --> 00:12:32,760
when he was supposedly being taped
in Moscow.

135
00:12:54,440 --> 00:12:57,976
Dear. A mountain of code.

136
00:12:58,000 --> 00:13:02,256
Perhaps it will make you, er...
check your assumptions.

137
00:13:02,280 --> 00:13:04,160
Remember the Nigerian prince.

138
00:13:09,360 --> 00:13:11,616
If you find yourself scouring through

139
00:13:11,640 --> 00:13:15,176
thousands and thousands
of lines of code,

140
00:13:15,200 --> 00:13:17,816
that's probably...

141
00:13:17,840 --> 00:13:20,800
exactly what they're expecting you to do.

142
00:13:22,640 --> 00:13:24,176
Don't.

143
00:13:24,200 --> 00:13:28,360
Do something else, unexpected.

144
00:13:30,600 --> 00:13:35,000
You have to think outside the box.

145
00:13:39,080 --> 00:13:44,040
If you can't, then you have to
find someone... who can.

146
00:13:53,880 --> 00:13:55,336
Should I offer to help?

147
00:13:55,360 --> 00:13:57,296
No, she doesn't need any help.

148
00:13:57,320 --> 00:14:00,200
She knows exactly where
everything is. Don't you, dear?

149
00:14:07,840 --> 00:14:10,936
It's the first time we've had one
of Gabe's work friends to visit.

150
00:14:10,960 --> 00:14:12,656
Isn't it, Gabe?

151
00:14:12,680 --> 00:14:14,896
We'd almost given up hope.

152
00:14:14,920 --> 00:14:16,016
Sorry?

153
00:14:16,040 --> 00:14:19,016
He was turned down by
so many employers before GCHQ.

154
00:14:19,040 --> 00:14:21,456
We moved here so we could look
after him.

155
00:14:21,480 --> 00:14:23,360
He can't live alone, obviously.

156
00:14:27,320 --> 00:14:30,776
I know you said you didn't want to
help me any more but I'm in trouble.

157
00:14:30,800 --> 00:14:31,800
What kind of trouble?

158
00:14:33,040 --> 00:14:36,600
What I'm saying is...
I've got GCHQ into trouble.

159
00:14:37,840 --> 00:14:39,920
OK, what I mean is...

160
00:14:41,000 --> 00:14:43,416
I didn't realise I was being used.

161
00:14:43,440 --> 00:14:45,576
I think there's
a third-stage malware, Gabriel,

162
00:14:45,600 --> 00:14:48,520
hidden inside the code. I need to find it.

163
00:14:50,160 --> 00:14:53,576
Someone tried to warn me about it,
that it was really dangerous, but...

164
00:14:53,600 --> 00:14:56,056
it's only now
I think I know what he meant.

165
00:14:56,080 --> 00:14:58,896
Who warned you?
That's not important now.

166
00:14:58,920 --> 00:15:01,216
There's been a massive leak of data
from GCHQ, right?

167
00:15:01,240 --> 00:15:03,216
Incredibly damaging.

168
00:15:03,240 --> 00:15:05,736
I think that's what the third stage does.

169
00:15:05,760 --> 00:15:08,376
I think there's some hidden part
of the original malware

170
00:15:08,400 --> 00:15:09,720
that was built to steal our data.

171
00:15:10,720 --> 00:15:12,656
But I can't find it.

172
00:15:12,680 --> 00:15:15,680
I've been back through the code
line by line. There's nothing.

173
00:15:20,120 --> 00:15:22,216
That's the puzzle, Gabriel.

174
00:15:22,240 --> 00:15:23,376
I'm asking if you'd...

175
00:15:23,400 --> 00:15:26,520
It's OK, Saara. I get it.

176
00:15:28,320 --> 00:15:30,056
Where are you going, Gabe?

177
00:15:30,080 --> 00:15:31,776
Sorry.

178
00:15:31,800 --> 00:15:33,320
But what about the curfew?

179
00:15:44,360 --> 00:15:46,720
It's obfuscated. You don't need to... Wait.

180
00:15:54,120 --> 00:15:56,816
I was just trying to say you don't
need to waste time on it.

181
00:15:56,840 --> 00:15:58,456
The original code's obfuscated.

182
00:15:58,480 --> 00:16:00,896
They included all this garbage
so that anti-virus software

183
00:16:00,920 --> 00:16:02,456
wouldn't recognise it as malware.

184
00:16:02,480 --> 00:16:03,816
How many lines of garbage?

185
00:16:03,840 --> 00:16:05,456
I don't know. Thousands?

186
00:16:05,480 --> 00:16:08,896
We stripped them out
so we could work on it.

187
00:16:08,920 --> 00:16:10,496
Tea? But before you stripped them out,

188
00:16:10,520 --> 00:16:12,736
you tried to get it to run in a sandbox.

189
00:16:12,760 --> 00:16:14,280
That's right. How did you know?

190
00:16:16,200 --> 00:16:18,096
What happened?

191
00:16:18,120 --> 00:16:20,136
Nothing. It didn't run.

192
00:16:20,160 --> 00:16:22,520
They designed it so that it...
I... think it did.

193
00:16:24,240 --> 00:16:28,056
It didn't, Gabriel.
I tried it again and again.

194
00:16:28,080 --> 00:16:29,656
It just sat there.

195
00:16:29,680 --> 00:16:31,320
I watched. Nothing happened.

196
00:16:32,960 --> 00:16:35,320
You need to learn to look at
the garbage in a different way.

197
00:16:36,520 --> 00:16:38,696
It's all about patterns.

198
00:16:38,720 --> 00:16:41,016
Finding the code
hidden within the garbage.

199
00:16:41,040 --> 00:16:43,776
But in this case,
it's more complicated than normal.

200
00:16:43,800 --> 00:16:46,296
Usually,
there'd be one character of code.

201
00:16:46,320 --> 00:16:48,856
And, say, five characters of garbage.

202
00:16:48,880 --> 00:16:50,976
In that case,
you just need to write a script

203
00:16:51,000 --> 00:16:52,456
to read one character in six.

204
00:16:52,480 --> 00:16:55,296
So you're saying it's not all garbage?

205
00:16:55,320 --> 00:16:56,840
Then...

206
00:16:58,160 --> 00:17:01,056
there's where the number of real
code and garbage characters vary

207
00:17:01,080 --> 00:17:04,256
according to a regular pattern.
Say one in four, then one in three,

208
00:17:04,280 --> 00:17:06,176
then one in two. And back up again.

209
00:17:06,200 --> 00:17:09,200
And that's what we've got here
in the BT code? No.

210
00:17:11,960 --> 00:17:13,776
This is more complicated.

211
00:17:13,800 --> 00:17:16,416
Here, there's no simple pattern.

212
00:17:16,440 --> 00:17:19,496
The code characters
and garbage characters vary

213
00:17:19,520 --> 00:17:20,656
according to an algorithm.

214
00:17:20,680 --> 00:17:23,376
So, we can't extract the hidden code
unless we know the algorithm?

215
00:17:23,400 --> 00:17:26,080
I've worked out the algorithm.
That's what took me the time.

216
00:17:33,960 --> 00:17:36,256
There's your third stage.

217
00:17:36,280 --> 00:17:38,720
Hidden inside of what you thought
was just garbage.

218
00:17:43,680 --> 00:17:45,160
That's a data scraper.

219
00:17:46,560 --> 00:17:47,840
That's how it mined our files.

220
00:17:50,920 --> 00:17:54,016
That must be the MAC address
of your sandbox.

221
00:17:54,040 --> 00:17:55,616
That's how it broke into our system.

222
00:17:55,640 --> 00:17:56,696
It can't be.

223
00:17:56,720 --> 00:17:57,896
Yes, I think so.

224
00:17:57,920 --> 00:17:59,976
But how could they possibly know that?

225
00:18:00,000 --> 00:18:01,896
A MAC address is like a fingerprint.

226
00:18:01,920 --> 00:18:03,456
How could someone in Russia

227
00:18:03,480 --> 00:18:07,376
know the address of a particular
computer at GCHQ? It's impossible.

228
00:18:07,400 --> 00:18:10,896
No, it's obvious. Obvious? How?

229
00:18:10,920 --> 00:18:12,600
Someone must have told them.

230
00:18:19,080 --> 00:18:21,336
OK. Even if that is true,

231
00:18:21,360 --> 00:18:23,616
it doesn't explain
how they got the data out.

232
00:18:23,640 --> 00:18:25,320
This malware doesn't communicate.

233
00:18:35,640 --> 00:18:37,320
It exfiltrates as email.

234
00:18:38,640 --> 00:18:41,136
The data goes out as attachments.

235
00:18:41,160 --> 00:18:45,696
The emails get lost in the flood of
all our other email traffic.

236
00:18:45,720 --> 00:18:47,160
No-one notices.

237
00:18:50,480 --> 00:18:53,376
They've moved on from NSA exploits,
by the way.

238
00:18:53,400 --> 00:18:54,816
Now they're taking our own stuff.

239
00:18:54,840 --> 00:18:57,336
What? The emails are still going out.

240
00:18:57,360 --> 00:18:58,920
What?!

241
00:19:44,960 --> 00:19:46,536
They must know what we're doing.

242
00:19:46,560 --> 00:19:49,576
Every time I cut a link to a domain,
they set up a new one.

243
00:19:49,600 --> 00:19:52,719
We're losing a massive amount
of data every second.

244
00:19:56,080 --> 00:19:57,696
The scraper you found in the garbage -

245
00:19:57,720 --> 00:20:01,256
can you shut it down,
stop all this at source?

246
00:20:01,280 --> 00:20:03,616
Of course. Then do it.

247
00:20:03,640 --> 00:20:04,720
Please.

248
00:20:32,080 --> 00:20:34,296
Is that it? Yes.

249
00:20:34,320 --> 00:20:35,336
You've stopped it?

250
00:20:35,360 --> 00:20:37,416
Of course.
Why do you sound so surprised?

251
00:20:37,440 --> 00:20:38,600
You're brilliant.

252
00:21:33,680 --> 00:21:35,440
I owe you an apology.

253
00:21:40,400 --> 00:21:42,720
You're right. You do.

254
00:21:45,600 --> 00:21:46,600
I'm sorry.

255
00:21:48,560 --> 00:21:50,400
What you did last night was amazing.

256
00:21:56,080 --> 00:21:57,776
As well as in Bradford,

257
00:21:57,800 --> 00:22:00,136
the central Mosque in Southall
was fire-bombed

258
00:22:00,160 --> 00:22:02,576
while a service was taking place.

259
00:22:02,600 --> 00:22:05,056
A spokesperson for
the Muslim Council of Britain

260
00:22:05,080 --> 00:22:09,376
blamed the attack, one of dozens
reported in the last 36 hours,

261
00:22:09,400 --> 00:22:11,016
on the breakdown in public order

262
00:22:11,040 --> 00:22:13,120
in the aftermath of the disputed election.

263
00:22:17,040 --> 00:22:18,600
What is it?

264
00:22:20,440 --> 00:22:21,920
They're attacking mosques again.

265
00:22:23,120 --> 00:22:25,000
My brother works at a mosque
in Swindon.

266
00:22:28,680 --> 00:22:30,640
Well, you should go.

267
00:22:39,560 --> 00:22:42,336
We read about it every day in the papers

268
00:22:42,360 --> 00:22:44,336
and on our phones,

269
00:22:44,360 --> 00:22:46,696
we hear about it on the radio,

270
00:22:46,720 --> 00:22:50,176
we speak about it every morning
with our neighbours,

271
00:22:50,200 --> 00:22:52,320
we watch it every night on the TV news.

272
00:22:54,560 --> 00:22:58,296
And, of course, when they're
attacking us in the streets,

273
00:22:58,320 --> 00:23:00,200
when they're burning our mosques...

274
00:23:01,800 --> 00:23:03,040
we want to strike back.

275
00:23:04,560 --> 00:23:06,096
Why wouldn't we?

276
00:23:06,120 --> 00:23:07,680
It's only human.

277
00:23:08,960 --> 00:23:12,400
It sounds easy, brothers and sisters...

278
00:23:13,760 --> 00:23:15,400
as do all the words of Shaytan.

279
00:23:16,760 --> 00:23:19,616
He speaks to us when we're angry.

280
00:23:19,640 --> 00:23:23,736
He fans the flames
of our completely reasonable anger,

281
00:23:23,760 --> 00:23:25,680
which comes from fear...

282
00:23:28,440 --> 00:23:30,560
and the desire to protect those we love.

283
00:23:32,960 --> 00:23:37,776
But we don't protect them,
brothers and sisters,

284
00:23:37,800 --> 00:23:41,496
by meeting violence with violence.

285
00:23:41,520 --> 00:23:44,856
Violence only breeds more violence,
more hatred.

286
00:23:44,880 --> 00:23:49,560
We hit back and they hit us again,
even harder.

287
00:23:51,960 --> 00:23:55,136
The way of Allah, Subhanahu wa-ta'ala,

288
00:23:55,160 --> 00:23:59,320
is the harder way,
the more courageous way.

289
00:24:01,040 --> 00:24:03,056
The voice of Shaytan rages in our ears,

290
00:24:03,080 --> 00:24:05,120
blasting out all other sound.

291
00:24:07,440 --> 00:24:11,520
You will hear the voice of Allah,
Subhanahu wa-ta'ala...

292
00:24:13,840 --> 00:24:15,960
when you are quiet...

293
00:24:17,280 --> 00:24:18,600
when you are at rest...

294
00:24:21,160 --> 00:24:22,760
when you are at peace.

295
00:24:31,640 --> 00:24:32,720
Saj?

296
00:24:59,680 --> 00:25:00,880
Hey, what's up?

297
00:25:02,360 --> 00:25:03,760
Shut the door. Yeah.

298
00:25:07,480 --> 00:25:09,056
What is it?

299
00:25:09,080 --> 00:25:12,056
I've just been speaking to
the Prime Minister.

300
00:25:12,080 --> 00:25:16,416
Apparently, MI5's found some
compromising material

301
00:25:16,440 --> 00:25:18,519
on the Foreign Secretary's laptop.

302
00:25:21,440 --> 00:25:23,736
What kind of material?

303
00:25:23,760 --> 00:25:26,560
I'm not sure.
They're sending it over, the laptop.

304
00:25:28,280 --> 00:25:29,736
Inappropriate communications

305
00:25:29,760 --> 00:25:31,856
with someone inside
the Russian government -

306
00:25:31,880 --> 00:25:33,456
that's all I've been told.

307
00:25:33,480 --> 00:25:36,040
Highly prejudicial to national security.

308
00:25:37,760 --> 00:25:38,920
For fuck's sake.

309
00:25:39,920 --> 00:25:42,736
Surely even they must know
that's a Russian plant?

310
00:25:42,760 --> 00:25:45,216
I don't know.
It looks authentic, apparently.

311
00:25:45,240 --> 00:25:48,736
None of the usual signs of
crashing around inside a computer.

312
00:25:48,760 --> 00:25:52,440
If it's a plant, it's a clever one,
hard to prove.

313
00:25:54,440 --> 00:25:56,680
Anyway, she's had to resign.

314
00:26:02,120 --> 00:26:03,880
We're being played, aren't we?

315
00:26:05,600 --> 00:26:08,576
Have been. At every stage.

316
00:26:08,600 --> 00:26:10,800
Yeah. Yeah.

317
00:26:12,000 --> 00:26:15,056
And very convenient that we should
lose our best friend in government

318
00:26:15,080 --> 00:26:16,400
at this precise moment.

319
00:26:20,840 --> 00:26:22,840
Secretary of State for Defence.

320
00:26:26,760 --> 00:26:29,616
I said after the BT attack that,

321
00:26:29,640 --> 00:26:31,496
if we didn't respond robustly,

322
00:26:31,520 --> 00:26:34,296
we'd be hit again and we have been.

323
00:26:34,320 --> 00:26:38,600
Our election has been undermined and
our most sensitive secrets stolen.

324
00:26:40,040 --> 00:26:43,576
By any measure, this constitutes
the cyber equivalent

325
00:26:43,600 --> 00:26:46,000
of an armed attack on
the United Kingdom.

326
00:26:47,800 --> 00:26:49,400
An act of war.

327
00:26:53,280 --> 00:26:55,080
Head of operations, GCHQ.

328
00:26:58,800 --> 00:27:04,256
I'm not disagreeing
that a strong response is required

329
00:27:04,280 --> 00:27:06,776
but you should be aware that
if you decide upon

330
00:27:06,800 --> 00:27:11,320
a symmetric cyberattack,
it will be highly escalatory.

331
00:27:12,720 --> 00:27:16,256
Truth is, they've been one step
ahead of us, provoking us,

332
00:27:16,280 --> 00:27:18,496
anticipating how we'll react
at every stage.

333
00:27:18,520 --> 00:27:22,160
It's vital that we do not react
as expected now.

334
00:27:23,120 --> 00:27:25,816
We should be careful of empty gestures

335
00:27:25,840 --> 00:27:28,000
that have profound consequences.

336
00:27:29,280 --> 00:27:31,176
Empty gestures?

337
00:27:31,200 --> 00:27:35,240
Yes. Especially if there are other
motives for doing it.

338
00:27:37,400 --> 00:27:38,640
What other motives?

339
00:27:40,600 --> 00:27:42,056
Can I speak frankly?

340
00:27:42,080 --> 00:27:44,040
Of course.

341
00:27:46,480 --> 00:27:48,136
To shore up the position of a government

342
00:27:48,160 --> 00:27:50,416
whose legitimacy has been questioned.

343
00:27:50,440 --> 00:27:52,240
To distract attention.

344
00:27:54,320 --> 00:27:56,376
Is that what you think is going on here?

345
00:27:56,400 --> 00:27:59,616
With the greatest respect
to our colleague from GCHQ,

346
00:27:59,640 --> 00:28:00,976
Prime Minister,

347
00:28:01,000 --> 00:28:03,760
that is a completely
outrageous suggestion.

348
00:28:04,920 --> 00:28:08,216
This country has either faced
an attack amounting to

349
00:28:08,240 --> 00:28:10,696
an act of war or it hasn't.

350
00:28:10,720 --> 00:28:13,096
And if it has, it is our duty

351
00:28:13,120 --> 00:28:16,296
as the properly constituted
government to respond.

352
00:28:16,320 --> 00:28:18,416
It's nothing to do with legitimacy

353
00:28:18,440 --> 00:28:20,560
or any other political considerations.

354
00:28:26,120 --> 00:28:28,616
Can I just remind us that
the then Attorney General

355
00:28:28,640 --> 00:28:33,016
made our red lines absolutely clear
in his 2018 speech?

356
00:28:33,040 --> 00:28:35,776
Use of cyber to manipulate the
electoral system

357
00:28:35,800 --> 00:28:37,296
explicitly constitutes

358
00:28:37,320 --> 00:28:39,896
an intervention in our domestic affairs.

359
00:28:39,920 --> 00:28:41,976
If, after that speech, we do nothing,

360
00:28:42,000 --> 00:28:43,496
we are basically saying it's OK

361
00:28:43,520 --> 00:28:45,336
to just roll your tanks into London.

362
00:28:45,360 --> 00:28:47,216
Yes, I see your point.

363
00:28:47,240 --> 00:28:49,936
Of course, if we retaliate,

364
00:28:49,960 --> 00:28:51,256
we might expose some of

365
00:28:51,280 --> 00:28:53,136
the things we ourselves are doing,

366
00:28:53,160 --> 00:28:57,176
within Russia's critical
national infrastructure.

367
00:28:57,200 --> 00:28:58,976
Which would leave us open to

368
00:28:59,000 --> 00:29:01,776
the accusation of double standards.

369
00:29:01,800 --> 00:29:05,096
But if that is the way you wish
to go, Prime Minister,

370
00:29:05,120 --> 00:29:07,976
Danny can lay out some further options.

371
00:29:08,000 --> 00:29:10,576
We don't need your options.

372
00:29:10,600 --> 00:29:12,639
The Army will be taking
the lead this time.

373
00:29:14,080 --> 00:29:16,136
Good luck with that.

374
00:29:16,160 --> 00:29:17,656
What was that?

375
00:29:17,680 --> 00:29:18,816
Nothing.

376
00:29:18,840 --> 00:29:24,016
Good. Because Russia has effectively
declared war on this country.

377
00:29:24,040 --> 00:29:25,856
And we, those of us around this table,

378
00:29:25,880 --> 00:29:28,816
are charged with
the defence of this nation.

379
00:29:28,840 --> 00:29:31,080
I require your support to do so.

380
00:29:46,280 --> 00:29:47,400
David.

381
00:29:51,320 --> 00:29:53,656
I'm sending you a team
from the National Cyber Force.

382
00:29:53,680 --> 00:29:57,176
I want you to build them an attack,
targeting the Russian arms industry.

383
00:29:57,200 --> 00:29:59,136
And I want it done today.

384
00:29:59,160 --> 00:30:01,800
Can you do that?
Put them out of action?

385
00:30:04,520 --> 00:30:06,536
We can certainly try.

386
00:30:06,560 --> 00:30:10,336
It's time to show us what we've
been paying for at GCHQ.

387
00:30:10,360 --> 00:30:13,560
All this money we've spent. It's
time to show us what you can do.

388
00:30:23,560 --> 00:30:25,760
I'm sorry, Saj.

389
00:30:27,360 --> 00:30:28,360
You were right.

390
00:30:30,840 --> 00:30:34,000
I should've thought more carefully
before I took the job at GCHQ.

391
00:30:35,520 --> 00:30:38,296
About the consequences for our family.

392
00:30:38,320 --> 00:30:40,216
I over-reacted.

393
00:30:40,240 --> 00:30:42,320
No. You didn't.

394
00:30:44,240 --> 00:30:45,440
You were right.

395
00:30:47,000 --> 00:30:48,680
I shouldn't have gone there.

396
00:30:54,360 --> 00:30:55,720
I've made a mistake.

397
00:30:56,920 --> 00:30:58,800
At work. What mistake?

398
00:31:01,080 --> 00:31:02,760
I suppose you can't say?

399
00:31:09,920 --> 00:31:11,960
I did something... that...

400
00:31:13,200 --> 00:31:15,496
I thought was really clever.

401
00:31:15,520 --> 00:31:17,256
It wasn't.

402
00:31:17,280 --> 00:31:20,440
It was incredibly stupid and gullible.

403
00:31:22,320 --> 00:31:24,680
And it's allowed something terrible
to happen.

404
00:31:25,920 --> 00:31:27,896
Are you sure?

405
00:31:27,920 --> 00:31:30,280
Because you always think
everything's your fault.

406
00:31:32,400 --> 00:31:33,760
You have no idea.

407
00:31:43,760 --> 00:31:45,816
Anyway, Dad was my fault.

408
00:31:45,840 --> 00:31:48,080
What? How is that your fault?

409
00:31:49,680 --> 00:31:51,496
He killed himself.

410
00:31:51,520 --> 00:31:54,016
He killed himself because I went
away to uni and left him.

411
00:31:54,040 --> 00:31:56,336
No, Saar... He did. I abandoned him.

412
00:31:56,360 --> 00:31:58,936
No, that's not what happened,
Saar... Yeah, he killed himself.

413
00:31:58,960 --> 00:32:00,600
He didn't kill himself.

414
00:32:02,320 --> 00:32:04,936
I mean, sorry to ruin this
"I'm to blame for everything"

415
00:32:04,960 --> 00:32:07,296
thing you've got going, but no...

416
00:32:07,320 --> 00:32:08,536
he didn't kill himself.

417
00:32:08,560 --> 00:32:12,856
I mean, if you'd... come home
you'd know that.

418
00:32:12,880 --> 00:32:16,416
It was an accident.
A signalman made a mistake.

419
00:32:16,440 --> 00:32:19,840
He sent a goods train up a line that
was supposed to be out of service.

420
00:32:21,000 --> 00:32:22,816
Dad took a short cut across the track

421
00:32:22,840 --> 00:32:24,776
and the train hit him.

422
00:32:24,800 --> 00:32:26,960
It wasn't suicide.

423
00:32:30,280 --> 00:32:33,416
You're just saying that
because suicide is haram. No.

424
00:32:33,440 --> 00:32:36,800
I swear on Mum's life -
that's what happened.

425
00:32:38,800 --> 00:32:41,656
You may have behaved like a shit
not coming to see him

426
00:32:41,680 --> 00:32:43,680
but he didn't commit suicide.

427
00:32:57,880 --> 00:32:59,120
I liked your sermon.

428
00:33:00,600 --> 00:33:02,200
Thanks.

429
00:33:04,200 --> 00:33:05,560
I mean, I...

430
00:33:06,720 --> 00:33:09,120
I agreed with...
I agreed with everything you said.

431
00:33:21,520 --> 00:33:23,280
Do you think I should resign?

432
00:33:26,200 --> 00:33:27,920
That's up to you, but...

433
00:33:29,280 --> 00:33:32,776
we'd be losing the last real voice
of moderation around the table.

434
00:33:32,800 --> 00:33:36,336
There'd be nobody left
to protect the staff.

435
00:33:36,360 --> 00:33:39,160
Well, what about you? Me?!

436
00:33:40,760 --> 00:33:43,999
They'd sack me 15 seconds after
you're out the door.

437
00:33:46,840 --> 00:33:49,240
Sorry. They're ready.

438
00:33:51,040 --> 00:33:52,080
"They're ready."

439
00:33:57,640 --> 00:34:01,896
I told Barbara to take the kids,

440
00:34:01,920 --> 00:34:04,656
go and stay with her parents in France.

441
00:34:04,680 --> 00:34:06,640
You're joking. No, absolutely not.

442
00:34:08,240 --> 00:34:10,576
It's not that bad, is it?

443
00:34:10,600 --> 00:34:13,976
I don't know. But I'm pretty sure
this - us attacking them -

444
00:34:14,000 --> 00:34:16,456
it's exactly what they want us to do.

445
00:34:16,480 --> 00:34:18,000
You have to ask yourself why.

446
00:34:19,560 --> 00:34:21,720
Do you think I should get Freddie out?

447
00:34:24,880 --> 00:34:25,880
Maybe.

448
00:34:47,560 --> 00:34:49,056
Ready, boss.

449
00:34:49,080 --> 00:34:51,216
OK, what happens now?

450
00:34:51,240 --> 00:34:53,736
You stand aside
and we press the button.

451
00:34:53,760 --> 00:34:55,456
That way it's covered by the rules of war

452
00:34:55,480 --> 00:34:56,840
and you don't end up in The Hague.

453
00:35:01,480 --> 00:35:02,760
OK, Finn. Up you get.

454
00:35:18,320 --> 00:35:20,599
Control-E.

455
00:35:30,120 --> 00:35:32,400
How long will it take to have an effect?

456
00:35:33,560 --> 00:35:34,840
No time at all.

457
00:35:36,360 --> 00:35:37,680
It's happening now.

458
00:36:04,520 --> 00:36:06,696
Is this real?

459
00:36:06,720 --> 00:36:08,336
Real?

460
00:36:08,360 --> 00:36:10,280
I doubt it.

461
00:36:42,600 --> 00:36:44,536
Danny, can I have a word with you?

462
00:36:44,560 --> 00:36:45,936
What is it?

463
00:36:45,960 --> 00:36:47,160
Private word.

464
00:36:55,960 --> 00:36:58,296
What is it? Our comms are down.

465
00:36:58,320 --> 00:37:00,216
Sorry? All our comms are down.

466
00:37:00,240 --> 00:37:01,736
I wanted to speak to you out here

467
00:37:01,760 --> 00:37:04,136
because I didn't want to create a panic.

468
00:37:04,160 --> 00:37:05,536
What, just Army comms?

469
00:37:05,560 --> 00:37:07,056
To be honest, we're not sure.

470
00:37:07,080 --> 00:37:10,096
I managed to get through to the MOD
on one of your landlines.

471
00:37:10,120 --> 00:37:13,336
They're requesting
that GCHQ help re-establish contact.

472
00:37:13,360 --> 00:37:15,640
With...? With UK Armed Forces.

473
00:37:17,320 --> 00:37:19,856
Sorry, Danny. The Defence Secretary
is on the line.

474
00:37:19,880 --> 00:37:20,936
Which channel?

475
00:37:20,960 --> 00:37:23,960
No, I mean he's actually
on the line. He's on the phone.

476
00:37:29,560 --> 00:37:31,056
Richard. We've just heard.

477
00:37:31,080 --> 00:37:32,096
Heard what?

478
00:37:32,120 --> 00:37:33,816
About your loss of comms.

479
00:37:33,840 --> 00:37:35,296
Not that.

480
00:37:35,320 --> 00:37:39,536
The nuclear submarine control system
is unresponsive.

481
00:37:39,560 --> 00:37:41,096
It may have been hacked.

482
00:37:41,120 --> 00:37:42,616
What?

483
00:37:42,640 --> 00:37:44,800
Are you... Are you absolutely sure?

484
00:37:45,920 --> 00:37:46,960
Richard?

485
00:37:48,000 --> 00:37:49,240
Richard?

486
00:37:52,640 --> 00:37:54,856
If there's anything
still working around here,

487
00:37:54,880 --> 00:37:59,000
try and get me NSA up on
the satellite, er, on this one. OK.

488
00:38:21,360 --> 00:38:24,439
I've decided to leave...

489
00:38:26,000 --> 00:38:27,040
OK.

490
00:38:31,040 --> 00:38:32,656
But if you've made a mess,

491
00:38:32,680 --> 00:38:35,416
don't leave before you've cleared it up.

492
00:38:35,440 --> 00:38:38,000
You should never leave someone else
to clear up your mess, Saar.

493
00:38:48,640 --> 00:38:49,920
Mitch.

494
00:38:51,160 --> 00:38:52,376
Danny.

495
00:38:52,400 --> 00:38:54,776
Look, I know you guys aren't talking
to us at the moment

496
00:38:54,800 --> 00:38:55,976
but I thought you should know

497
00:38:56,000 --> 00:38:59,296
somebody just hacked our
nuclear submarine control system.

498
00:38:59,320 --> 00:39:00,576
What? You're kidding?

499
00:39:00,600 --> 00:39:03,096
Plus... all of our military comms
are down.

500
00:39:03,120 --> 00:39:05,056
The Russians have just spent
the last two hours

501
00:39:05,080 --> 00:39:07,176
exaggerating the effect of
a very targeted attack

502
00:39:07,200 --> 00:39:08,416
on a couple or arms factories

503
00:39:08,440 --> 00:39:11,656
to make whatever it is they're doing
look like self-defence.

504
00:39:11,680 --> 00:39:14,456
And my guess is, they've been
planning this for a long time.

505
00:39:14,480 --> 00:39:16,496
Yeah, the problem is
we're seeing those images

506
00:39:16,520 --> 00:39:18,976
of hospital fires too, Danny...
Yeah, they're fakes, Mitch.

507
00:39:19,000 --> 00:39:20,960
Well, they look pretty real to us.

508
00:39:22,560 --> 00:39:24,896
I've gotta tell you,
there's not a lot of warm feelings

509
00:39:24,920 --> 00:39:26,520
towards you guys here at the moment.

510
00:39:29,440 --> 00:39:32,560
We could really do with
some help right now, Mitch.

511
00:39:35,040 --> 00:39:37,936
Next, please. Come on through.

512
00:39:37,960 --> 00:39:39,599
Arms up, please.

513
00:39:41,320 --> 00:39:42,760
You can't use that in here.

514
00:39:49,160 --> 00:39:51,736
You can't use that here. Turn it off, now.

515
00:39:51,760 --> 00:39:55,296
OK. But I've got to write this down.

516
00:39:55,320 --> 00:39:57,080
Have you got any paper?

517
00:41:29,840 --> 00:41:31,616
Saara, wait.

518
00:41:31,640 --> 00:41:33,536
I've got nothing to say to you.

519
00:41:33,560 --> 00:41:36,216
Please.
I think you're about to be attacked.

520
00:41:36,240 --> 00:41:38,976
The UK. I've got something
to give you that will stop it.

521
00:41:39,000 --> 00:41:41,056
I don't believe you, Vadim.

522
00:41:41,080 --> 00:41:43,576
It's just another provocation.

523
00:41:43,600 --> 00:41:45,856
Anyway, I thought you said
in Harrogate they'd kill you.

524
00:41:45,880 --> 00:41:48,576
I don't care any more.
I don't care what happens to me.

525
00:41:48,600 --> 00:41:50,120
This is too important.

526
00:41:51,480 --> 00:41:52,760
Look at this.

527
00:42:06,600 --> 00:42:07,976
What is that?

528
00:42:08,000 --> 00:42:10,600
It's you. At your desk in GCHQ.

529
00:42:28,320 --> 00:42:30,816
OK. You hacked the CCTV.

530
00:42:30,840 --> 00:42:32,896
So what? What does that prove?

531
00:42:32,920 --> 00:42:35,816
Saara, please. There isn't much time.

532
00:42:35,840 --> 00:42:37,856
You have to trust me.

533
00:42:37,880 --> 00:42:39,840
You have to think outside the box.

534
00:42:41,280 --> 00:42:42,936
What?

535
00:42:42,960 --> 00:42:44,280
What did you say?

536
00:42:51,280 --> 00:42:54,416
JSSO's showing unidentified aircraft
entering our airspace

537
00:42:54,440 --> 00:42:56,296
and none of the other systems are
showing it.

538
00:42:56,320 --> 00:42:58,136
The RAF don't seem
to have been scrambled yet.

539
00:42:58,160 --> 00:43:00,376
But it is possible we are under attack.

540
00:43:00,400 --> 00:43:02,496
But it's just another hack,
isn't it? Fake news?

541
00:43:02,520 --> 00:43:06,536
What if it's real this time,
you know, like crying wolf?

542
00:43:06,560 --> 00:43:08,656
How can we take that chance?

543
00:43:08,680 --> 00:43:10,816
What, an invasion? Why not?

544
00:43:10,840 --> 00:43:13,976
We've been underestimating Putin
for ten years.

545
00:43:14,000 --> 00:43:16,656
All the way through we've been
asking, what's the bigger picture?

546
00:43:16,680 --> 00:43:19,216
The one thing we've never considered
is that he might just

547
00:43:19,240 --> 00:43:21,736
be insane enough
to have territorial ambitions.

548
00:43:21,760 --> 00:43:24,256
What if this whole thing is about
separating us

549
00:43:24,280 --> 00:43:25,776
from Europe and the Americans

550
00:43:25,800 --> 00:43:28,600
so that when this moment came,
we'd be alone?

551
00:43:30,640 --> 00:43:31,856
Not now, Saara.

552
00:43:31,880 --> 00:43:35,400
Danny, you absolutely HAVE
to come and see this. Right now.

553
00:43:37,280 --> 00:43:40,296
It's the CCTV - so what?
Saara, I don't have time for this.

554
00:43:40,320 --> 00:43:43,376
You have to turn it off. Please.

555
00:43:43,400 --> 00:43:46,080
I can't show you what I've got
to show you until you turn it off.

556
00:43:49,080 --> 00:43:50,360
Shut down the CCTV.

557
00:43:51,440 --> 00:43:53,096
Really?

558
00:43:53,120 --> 00:43:54,520
Yeah. Do it.

559
00:43:59,080 --> 00:44:00,976
They hacked the system.

560
00:44:01,000 --> 00:44:02,976
The FSB were watching
everything we're doing.

561
00:44:03,000 --> 00:44:05,656
They can't. It's air-gapped.

562
00:44:05,680 --> 00:44:07,096
How do you know?

563
00:44:07,120 --> 00:44:09,400
Cos I've just been inside their computer.

564
00:44:14,280 --> 00:44:17,376
I'm sending you something now.
Two things.

565
00:44:17,400 --> 00:44:19,536
You can use them
to trade with the Americans,

566
00:44:19,560 --> 00:44:20,896
to bring them back in.

567
00:44:20,920 --> 00:44:23,760
As soon as that happens,
Putin will back down.

568
00:44:28,120 --> 00:44:30,176
During this first phase,

569
00:44:30,200 --> 00:44:34,736
we are degrading the capability
and resolve of our enemy,

570
00:44:34,760 --> 00:44:37,776
as well as discrediting his institutions

571
00:44:37,800 --> 00:44:41,896
and leadership with espionage,
assassination,

572
00:44:41,920 --> 00:44:45,136
manipulation of social media,
cyberattacks,

573
00:44:45,160 --> 00:44:46,456
faking of imagery,

574
00:44:46,480 --> 00:44:49,296
all with the aim of
creating disillusionment,

575
00:44:49,320 --> 00:44:51,720
confusion and, and... And chaos.

576
00:44:52,920 --> 00:44:55,776
By the time war is openly declared,

577
00:44:55,800 --> 00:44:57,216
the enemy's ability... War?

578
00:44:57,240 --> 00:45:00,096
To defend himself will be
significantly reduced... Danny?

579
00:45:00,120 --> 00:45:02,016
We're receiving a data dump.

580
00:45:02,040 --> 00:45:03,376
Where from?

581
00:45:03,400 --> 00:45:04,400
Russia.

582
00:45:08,120 --> 00:45:09,160
OK, let's go.

583
00:45:10,960 --> 00:45:14,576
Strategic situation. His relationships

584
00:45:14,600 --> 00:45:18,400
with his allies are
fatally undermined, one by one.

585
00:45:21,640 --> 00:45:24,880
It's mostly code. There's terabytes of it.

586
00:45:27,040 --> 00:45:30,480
I think it's the FSB's
offensive cyber exploits.

587
00:45:34,040 --> 00:45:35,200
My God!

588
00:45:36,360 --> 00:45:38,000
This puts us back in the game.

589
00:45:45,680 --> 00:45:48,536
So, how... How this all is to be achieved?

590
00:45:48,560 --> 00:45:53,896
How do you ensure that,
the final phase, the war is won?

591
00:45:53,920 --> 00:45:57,216
The war is won using a technique

592
00:45:57,240 --> 00:46:00,096
called reflexive control.

593
00:46:00,120 --> 00:46:03,056
This is the predetermining

594
00:46:03,080 --> 00:46:06,216
the enemy's behaviour
in Russia's favour.

595
00:46:06,240 --> 00:46:09,800
We define our ultimate objective.

596
00:46:14,560 --> 00:46:16,376
We define our ultimate objective -

597
00:46:16,400 --> 00:46:18,400
the total defeat of our enemy.

598
00:46:46,600 --> 00:46:49,720
Subtitles by Red Bee Media