1 00:03:48,039 --> 00:03:50,520 -Well done, Gabriel. 2 00:03:50,560 --> 00:03:53,400 I think that's the fastest it's ever been done. 3 00:03:53,439 --> 00:03:54,520 Congratulations. 4 00:04:43,160 --> 00:04:44,439 I like your pens. 5 00:04:45,639 --> 00:04:47,040 They are in spectrum order. 6 00:04:48,279 --> 00:04:50,160 And before you say that pink is in the wrong place, 7 00:04:50,199 --> 00:04:52,000 pink has nothing to do with red. 8 00:04:52,040 --> 00:04:54,120 It's actually white absent green. 9 00:04:58,399 --> 00:05:00,439 Well done on the challenge. 10 00:05:00,480 --> 00:05:02,639 They are obviously going to take you. 11 00:05:03,639 --> 00:05:06,040 You were incredibly fast. 12 00:05:06,079 --> 00:05:08,959 If we're going to talk, I should warn you, I'm not very good at noticing 13 00:05:09,000 --> 00:05:11,040 when people want to speak or change the subject. 14 00:05:11,079 --> 00:05:14,399 So, the conversation could last a half an hour or several days. 15 00:05:14,439 --> 00:05:15,560 It's OK. It's OK. 16 00:05:18,040 --> 00:05:19,519 I'm Saara, by the way. 17 00:05:23,040 --> 00:05:24,199 I'm Gabriel. 18 00:05:49,639 --> 00:05:52,120 -It's high time... -Hello, Ami. 19 00:05:53,040 --> 00:05:55,439 Oh, my God. What are you doing here? 20 00:05:56,959 --> 00:05:59,199 Why didn't you ring? Is everything OK? 21 00:05:59,240 --> 00:06:01,279 I'm fine. I was just passing. 22 00:06:01,319 --> 00:06:03,800 Just passing? What are you talking about? 23 00:06:03,839 --> 00:06:05,399 London's over an hour away. 24 00:06:06,639 --> 00:06:08,800 -You'll stay for some... -Where's Abu? 25 00:06:08,839 --> 00:06:11,160 Sorry. Is he still at work? 26 00:06:13,040 --> 00:06:14,199 He is in his den. 27 00:06:16,279 --> 00:06:17,519 He's off work again. 28 00:06:45,839 --> 00:06:46,839 Abu? 29 00:06:48,639 --> 00:06:49,639 Hey! 30 00:06:51,240 --> 00:06:54,319 So... have you heard? 31 00:06:54,839 --> 00:06:56,160 I got it. 32 00:06:56,199 --> 00:06:57,319 Ah. 33 00:06:59,600 --> 00:07:01,360 Ah, yes. 34 00:07:03,560 --> 00:07:06,879 You haven't told your mother? You know she wouldn't understand. 35 00:07:06,920 --> 00:07:08,079 Of course not. 36 00:07:08,120 --> 00:07:09,839 They don't know anything about it. 37 00:07:10,439 --> 00:07:11,480 Good. 38 00:07:12,439 --> 00:07:13,680 Come. Sit. Sit. 39 00:07:15,720 --> 00:07:18,600 Mum said you are off work again, Abu.Are you OK? 40 00:07:18,639 --> 00:07:21,560 I'm fine. I was a bit down, but I'm fine now. 41 00:07:21,600 --> 00:07:22,600 I'll be back on Monday. 42 00:07:24,040 --> 00:07:26,480 Down like last time? 43 00:07:26,519 --> 00:07:28,560 No, nothing like that. 44 00:07:28,600 --> 00:07:30,720 Anyway, when I see you, I feel better. 45 00:07:31,319 --> 00:07:32,639 How long can you stay? 46 00:07:34,519 --> 00:07:38,120 I'm sorry, Abu... I have to get back tonight. 47 00:07:38,160 --> 00:07:39,560 You have got classes in the morning. 48 00:07:40,160 --> 00:07:41,199 I'm really sorry. 49 00:07:41,240 --> 00:07:42,720 Oh, don't be ridiculous. 50 00:07:42,759 --> 00:07:44,199 Classes are important. 51 00:07:45,040 --> 00:07:46,759 But you have time for a quick game? 52 00:07:49,639 --> 00:07:51,399 -Of course. -Excellent! 53 00:08:03,279 --> 00:08:07,839 You do think it's OK, Abu, what I'm doing. 54 00:08:07,879 --> 00:08:12,519 Oh, this girl... You'll be spending a year learning to defend our country, 55 00:08:12,560 --> 00:08:15,160 and at the end, you go back to university. 56 00:08:16,079 --> 00:08:18,360 What could be wrong with that? Huh? 57 00:08:23,040 --> 00:08:24,519 Ha! 58 00:08:55,840 --> 00:08:58,440 Hey. You'll be brilliant. 59 00:09:31,759 --> 00:09:33,679 Yeah. 60 00:09:33,720 --> 00:09:37,039 We're in. Happy for us to move to the next step? 61 00:09:41,679 --> 00:09:44,639 -- Go. -- OK, let's get some resilience. 62 00:09:45,799 --> 00:09:46,799 They're inside. 63 00:09:46,840 --> 00:09:49,360 -They've broken in. -How? 64 00:09:49,399 --> 00:09:52,440 It doesn't matter how. We'll work it out later. Get going. 65 00:09:53,159 --> 00:09:54,840 I want them out. 66 00:09:54,879 --> 00:09:56,600 I told you this is a bad idea. 67 00:10:21,840 --> 00:10:25,200 We've accessed credentials for your Ops and Management system. 68 00:10:25,240 --> 00:10:26,519 -What? -OK to proceed? 69 00:10:27,639 --> 00:10:30,600 They've got the passwords. They're about to log in. 70 00:10:30,639 --> 00:10:31,639 Wait. 71 00:10:32,200 --> 00:10:33,200 Zahir? 72 00:10:35,360 --> 00:10:36,360 Zahir? 73 00:10:37,559 --> 00:10:40,039 I'm seeing red lights, Tahmid. What's going on? 74 00:10:42,200 --> 00:10:44,000 We're down. 75 00:10:44,039 --> 00:10:46,440 -What the fuck... 76 00:10:47,559 --> 00:10:48,639 What did you do? 77 00:10:49,879 --> 00:10:51,200 Er, nothing. 78 00:10:51,240 --> 00:10:53,519 We're just logging into the system now. 79 00:11:02,320 --> 00:11:03,320 Finn? 80 00:11:10,399 --> 00:11:12,320 Yeah, er, looks like the Internet. 81 00:11:12,360 --> 00:11:14,200 What do you mean, "the Internet"? 82 00:11:14,240 --> 00:11:15,519 I think we are offline. 83 00:11:15,559 --> 00:11:16,639 Cannot be. 84 00:11:17,919 --> 00:11:19,639 Do you know what? Pull out now. 85 00:11:19,679 --> 00:11:22,360 -I want you completely disconnected from our estate. 86 00:11:24,480 --> 00:11:26,799 Hey, my line just went down. What's going on? 87 00:11:26,840 --> 00:11:28,240 You'd better get up here. 88 00:11:35,080 --> 00:11:36,440 Sorry to keep you waiting. 89 00:11:36,879 --> 00:11:38,200 I'm Max. 90 00:11:38,240 --> 00:11:39,360 Hi. 91 00:11:39,399 --> 00:11:41,159 Er, we're not shaking hands at the moment. 92 00:11:41,200 --> 00:11:44,200 Oh. Of course. Sorry. 93 00:11:44,840 --> 00:11:46,120 Welcome to GCHQ. 94 00:11:59,759 --> 00:12:00,960 Tell me. 95 00:12:01,000 --> 00:12:02,360 We have a serious problem. 96 00:12:02,399 --> 00:12:05,360 Your stress test just took down half our infrastructure. 97 00:12:05,399 --> 00:12:07,360 Whatever you did, you need to undo it right now, 98 00:12:07,399 --> 00:12:09,840 before it starts to impact on public safety. 99 00:12:09,879 --> 00:12:11,600 -Rich? -Can't be us, boss. 100 00:12:11,639 --> 00:12:13,840 We never got beyond the admin platform. 101 00:12:15,279 --> 00:12:16,279 OK. 102 00:12:26,279 --> 00:12:28,480 Sorry, I'm totally overdressed. 103 00:12:29,039 --> 00:12:30,519 Oh, don't worry. 104 00:12:30,559 --> 00:12:32,759 We all make that mistake on our first day. 105 00:12:33,840 --> 00:12:35,840 We're very glad to have you. 106 00:12:35,879 --> 00:12:39,039 As you can see, we're hideously male, stale and pale. 107 00:12:40,240 --> 00:12:41,240 Sorry? 108 00:12:42,039 --> 00:12:43,240 Old and white. 109 00:12:44,519 --> 00:12:45,600 Like me. 110 00:12:50,840 --> 00:12:52,639 I hope that's not why you picked me. 111 00:12:54,639 --> 00:12:56,240 Because I've got a brown face. 112 00:12:57,759 --> 00:12:58,759 No, of course not. 113 00:13:00,519 --> 00:13:01,799 Where are you going? 114 00:13:01,840 --> 00:13:03,039 We've been summoned. 115 00:13:06,000 --> 00:13:07,159 Why don't you come? 116 00:13:08,240 --> 00:13:10,039 You might find this interesting. 117 00:13:12,720 --> 00:13:16,840 Erm, BT Openreach provides the infrastructure for most of the UK's Internet. 118 00:13:16,879 --> 00:13:20,000 At 0907 this morning, whilst we were stress-testing their systems, 119 00:13:20,039 --> 00:13:23,240 they experienced a partial shutdown, impacting as far as we can tell, 120 00:13:23,279 --> 00:13:26,279 about 55% of Internet provision. 121 00:13:26,320 --> 00:13:29,000 Oh, Chrissie, have you met Max? He is our head of malware. 122 00:13:29,039 --> 00:13:30,279 Hi, how you doing? 123 00:13:30,320 --> 00:13:32,320 Now, erm, we're still checking, obviously, 124 00:13:32,360 --> 00:13:36,600 but so far it looks like National Grid's ICS is OK. 125 00:13:36,639 --> 00:13:37,799 Same with gas and water. 126 00:13:37,840 --> 00:13:39,000 Rail signalling is down... 127 00:13:39,039 --> 00:13:40,919 Are you sure it's OK for me to be here? 128 00:13:40,960 --> 00:13:42,399 -Why not? 129 00:13:42,440 --> 00:13:44,320 You're DV cleared, aren't you? 130 00:13:44,360 --> 00:13:46,000 Air Traffic Control is still up, 131 00:13:46,039 --> 00:13:47,919 but it seems most of the flights have stopped 132 00:13:47,960 --> 00:13:51,159 because they use the Internet to control aircraft on the ground. 133 00:13:51,200 --> 00:13:54,559 Er, online banking is down and some of their core comms are affected, 134 00:13:54,600 --> 00:13:57,159 so most of the cash machines are offline. 135 00:13:57,200 --> 00:13:59,080 What about smartphones? 136 00:13:59,120 --> 00:14:01,080 Sorry, Caroline Fitch, Number 10. 137 00:14:01,120 --> 00:14:03,240 Chrissie, can smartphones get online? 138 00:14:03,279 --> 00:14:05,679 Chrissie is head of security at BT. 139 00:14:05,720 --> 00:14:07,080 Yeah, as far as we can tell. 140 00:14:07,120 --> 00:14:09,399 But a lot of the systems, their access are affected, 141 00:14:09,440 --> 00:14:11,519 so there's not much they can do. 142 00:14:12,039 --> 00:14:13,360 Erm, 143 00:14:13,399 --> 00:14:15,360 some of the big email servers are down. 144 00:14:15,399 --> 00:14:19,799 There's no Zoom, no Teams, which has taken out all the new hospital appointments. 145 00:14:19,840 --> 00:14:21,320 Er, there's no online shopping. 146 00:14:21,360 --> 00:14:25,320 But, er, social media is unaffected, interestingly. 147 00:14:25,360 --> 00:14:27,240 All in all, quite cleverly targeted 148 00:14:27,279 --> 00:14:31,039 to cause significant disruption without actually putting that many lives at risk. 149 00:14:31,080 --> 00:14:32,759 So, it's a cyber attack? 150 00:14:32,799 --> 00:14:34,039 That's what you're saying? 151 00:14:34,080 --> 00:14:35,480 We think so. Yeah. 152 00:14:35,519 --> 00:14:38,240 Virgin was also affected, which rules out the stress test 153 00:14:38,279 --> 00:14:40,960 as the cause or any hardware problems within BT. 154 00:14:41,000 --> 00:14:44,159 That only leaves malware, and using the stress-test as a cover. 155 00:14:44,200 --> 00:14:45,519 Can I jump in? 156 00:14:46,759 --> 00:14:48,720 Er, yeah, go ahead. 157 00:14:48,759 --> 00:14:53,159 Kathy is one of our analysts, on attachment from the NSA. 158 00:14:53,200 --> 00:14:55,679 So, the Russian bots are already retweeting, 159 00:14:55,720 --> 00:14:58,679 and it is mostly about how all the ATMs are down. 160 00:14:58,720 --> 00:15:02,200 Er, "Another fuck-up by this shit-for-brains government." 161 00:15:02,240 --> 00:15:05,639 "Just another scam by the elite to steal our money." 162 00:15:05,679 --> 00:15:07,879 "The bankers are screwing us over again." 163 00:15:07,919 --> 00:15:09,639 Yada-yada. 164 00:15:09,679 --> 00:15:12,440 It's a bit quick, don't you think? 165 00:15:14,559 --> 00:15:16,840 I mean, it's almost like they knew it was coming. 166 00:15:42,279 --> 00:15:43,279 Thanks. 167 00:15:54,799 --> 00:15:56,039 So is that it? 168 00:15:56,639 --> 00:15:57,919 The malware. 169 00:15:58,919 --> 00:15:59,919 Yep. 170 00:16:00,879 --> 00:16:02,200 Mind if I take a look? 171 00:17:25,880 --> 00:17:27,640 What's all this garbage? 172 00:17:32,240 --> 00:17:33,359 I don't understand. 173 00:17:34,319 --> 00:17:36,279 It's obfuscated. 174 00:17:36,319 --> 00:17:38,680 Some kind of FinFisher thing. 175 00:17:44,759 --> 00:17:47,039 -Hey. -It's, er, Kathy, right? 176 00:17:47,079 --> 00:17:50,240 Yeah. Erm, NSA would like to take a look at the code. 177 00:17:51,079 --> 00:17:53,000 Well, has Danny approved it? 178 00:17:53,680 --> 00:17:56,319 Well, he told me to update them. 179 00:17:56,359 --> 00:17:58,839 Yeah, but did he say that you could give them the code? 180 00:18:00,640 --> 00:18:02,839 So you want me to walk all the way back down the hall? 181 00:18:02,880 --> 00:18:04,440 -Really? -Absolutely. 182 00:18:05,680 --> 00:18:07,240 That's the way we do it here. 183 00:18:15,279 --> 00:18:17,839 You do know that they're only trying to help. 184 00:18:17,880 --> 00:18:20,119 We're on the same team, guys. 185 00:18:23,519 --> 00:18:25,200 51st State. 186 00:18:31,000 --> 00:18:33,599 -- You see these jumps? -- Mmhmm. 187 00:18:33,640 --> 00:18:35,640 They hop over the garbage. 188 00:18:35,680 --> 00:18:37,480 Oh, so it's never actually read. 189 00:18:37,519 --> 00:18:38,759 That's right. 190 00:18:40,480 --> 00:18:41,799 So what's it there for? 191 00:18:41,839 --> 00:18:44,240 To confuse the look of the code 192 00:18:44,279 --> 00:18:48,039 so the anti-virus software won't recognise it as malware. 193 00:18:48,920 --> 00:18:51,400 OK. How do we get around it? 194 00:18:52,880 --> 00:18:55,920 We find a reverser that locates all the garbage, 195 00:18:55,960 --> 00:18:58,920 and then we write a program to delete it. 196 00:18:58,960 --> 00:19:01,039 Is that what you're doing now? 197 00:19:01,079 --> 00:19:03,640 -Amongst other things. -Can I help? 198 00:19:04,000 --> 00:19:05,039 No. 199 00:19:08,839 --> 00:19:10,880 So what do you want me to do? 200 00:19:14,359 --> 00:19:16,359 We have a test environment. 201 00:19:16,920 --> 00:19:18,400 Do you mean a sandbox? 202 00:19:18,440 --> 00:19:21,200 Paste in the code and see if you can get it to run in there. 203 00:19:21,240 --> 00:19:24,480 It's isolated, so you can't do any harm. 204 00:19:24,519 --> 00:19:26,640 And we might learn something. 205 00:19:28,640 --> 00:19:30,839 I'd really prefer to help with the reversing. 206 00:19:38,839 --> 00:19:41,160 Danny. It's the Foreign Secretary. 207 00:19:43,880 --> 00:19:46,599 Well, can we schedule a conversation before then? 208 00:19:46,640 --> 00:19:47,799 Yes, I'd like that. 209 00:19:48,920 --> 00:19:49,920 Thanks. 210 00:19:51,839 --> 00:19:52,880 Elizabeth. 211 00:19:52,920 --> 00:19:54,319 How are you holding up? 212 00:19:54,359 --> 00:19:58,200 Er, I have had better days. And nights. 213 00:19:58,240 --> 00:20:00,279 Interesting timing, don't you think? 214 00:20:00,319 --> 00:20:02,440 Right in the middle of an election campaign. 215 00:20:02,480 --> 00:20:04,480 Yeah. Will it have much of an impact? 216 00:20:04,519 --> 00:20:06,359 People not being able to get online? 217 00:20:06,400 --> 00:20:10,000 Absolutely. Feeds straight into the populist agenda. 218 00:20:10,039 --> 00:20:12,920 The government's crap, can't organise a piss up in a brewery. 219 00:20:12,960 --> 00:20:15,200 Plus, Labour does most of its campaigning online, 220 00:20:15,240 --> 00:20:18,160 so the Internet going down looks very convenient for us. 221 00:20:18,200 --> 00:20:20,240 So now we're corrupt as well as incompetent. 222 00:20:21,400 --> 00:20:23,200 Anyway, where are we? 223 00:20:23,240 --> 00:20:27,160 Er, we are currently about 35% restored. 224 00:20:27,200 --> 00:20:28,759 It's not straightforward, unfortunately. 225 00:20:28,799 --> 00:20:32,559 There's a lot of anti-debugging tricks in the code, so. 226 00:20:32,599 --> 00:20:35,799 I imagine you're assuming it's Russia. 227 00:20:35,839 --> 00:20:41,480 Well, as you know, we try to avoid making attributions prematurely. 228 00:20:41,519 --> 00:20:42,839 Erm, anything in the code, 229 00:20:42,880 --> 00:20:45,599 which suggests a particular team could be a misdirection. 230 00:20:45,640 --> 00:20:47,599 And as soon as we point the finger, 231 00:20:47,640 --> 00:20:52,680 then there's pressure to retaliate and we're into tit-for-tat escalation. 232 00:20:52,720 --> 00:20:54,720 But what's your gut? 233 00:20:59,240 --> 00:21:02,160 That it's probably Russia, most likely FSB. 234 00:21:02,440 --> 00:21:03,759 OK. 235 00:21:03,799 --> 00:21:06,359 Because according to our embassy in Moscow, 236 00:21:06,400 --> 00:21:10,839 the lights have been flashing on and off in Putin's office for the last half hour. 237 00:21:10,880 --> 00:21:12,759 Really? 238 00:21:12,799 --> 00:21:15,400 -So that's nothing to do with you then? -No. 239 00:21:15,440 --> 00:21:19,000 But, erm, if it's true, then that's pretty funny. 240 00:21:19,039 --> 00:21:20,359 Yes, hysterical. 241 00:21:20,400 --> 00:21:22,839 As long as it's not us or anyone acting as our proxy, 242 00:21:22,880 --> 00:21:25,720 -can you check, please, Danny? -Yes. 243 00:21:43,240 --> 00:21:45,200 I don't understand. 244 00:21:45,240 --> 00:21:48,119 it ran inside BT's computers. Why won't it run here? 245 00:21:50,039 --> 00:21:54,079 You can write malware, so it knows when it's in a sandbox. 246 00:21:54,119 --> 00:21:56,839 It searches for normal computer activity. 247 00:21:56,880 --> 00:21:59,599 If it can't find any, it deactivates. 248 00:21:59,640 --> 00:22:01,240 Is there a workaround? 249 00:22:04,559 --> 00:22:07,000 You could paste in some Word documents, 250 00:22:07,519 --> 00:22:09,039 scroll around a bit. 251 00:22:09,079 --> 00:22:11,599 That could make it think that it's in a real environment, 252 00:22:11,640 --> 00:22:13,480 but it's not always a guarantee. 253 00:22:13,519 --> 00:22:14,839 Can I use this? 254 00:22:16,319 --> 00:22:18,039 Do you always change the subject like that? 255 00:22:19,480 --> 00:22:21,079 -Sorry, I... -Why do you need it? 256 00:22:21,119 --> 00:22:23,240 If there's something you don't understand, you can just ask me. 257 00:22:23,279 --> 00:22:24,720 It's not about work. 258 00:22:24,759 --> 00:22:26,480 I need to make an outside call. 259 00:22:26,519 --> 00:22:29,039 I didn't know they were going to take my phone off me at reception. 260 00:22:29,880 --> 00:22:32,880 Yeah, it's nine, and then the number. 261 00:22:33,960 --> 00:22:36,440 Paste in those Word documents, all right? 262 00:22:42,359 --> 00:22:44,720 Prime Minister, throughout this election campaign, 263 00:22:44,759 --> 00:22:46,160 you made a great deal of the fact 264 00:22:46,200 --> 00:22:48,079 that you are Britain's first Black Prime Minister 265 00:22:48,119 --> 00:22:50,599 and that you understand ordinary working people. 266 00:22:50,640 --> 00:22:54,240 But your father was an incredibly wealthy Nigerian businessman. 267 00:22:54,279 --> 00:22:57,680 and you spent your childhood in one of Britain's top public schools. 268 00:22:57,720 --> 00:22:59,640 Come on, Campbell, not that old chestnut. 269 00:22:59,680 --> 00:23:03,000 Look, I don't think that's what people are worrying about at all. 270 00:23:03,039 --> 00:23:06,799 -I think they're worrying about... -Isn't it, Prime Minister? 271 00:23:06,839 --> 00:23:09,039 This country's in the middle of the deepest recession... 272 00:23:09,079 --> 00:23:12,759 Hello, this is Ahmed. Please leave a message after the tone. 273 00:23:13,279 --> 00:23:14,720 Thank you. 274 00:23:22,559 --> 00:23:24,680 Hi, Abu.Er, it's me. 275 00:23:24,720 --> 00:23:27,119 Just checking in to see how you're feeling. 276 00:23:27,160 --> 00:23:31,720 You can't really ring me back here, but I'll try again later. 277 00:23:31,759 --> 00:23:34,680 -Love you. -I don't know what you're implying, Campbell, 278 00:23:34,720 --> 00:23:36,599 but I live here too, 279 00:23:36,640 --> 00:23:40,400 and this recession has nothing to do with Brexit, which is a huge success. 280 00:23:41,440 --> 00:23:42,640 Kathy, have you got a moment? 281 00:23:42,680 --> 00:23:44,119 Sure. What do you need? 282 00:23:44,160 --> 00:23:45,960 Er, the "Jolly Roger"? 283 00:23:47,200 --> 00:23:48,680 Jolly Roger. 284 00:23:54,640 --> 00:23:57,039 -"You've been Rogered." 285 00:23:57,079 --> 00:23:58,079 Subtle. 286 00:24:00,599 --> 00:24:02,200 Oh. 287 00:24:02,240 --> 00:24:05,680 He blames Russia for the attack and he says that he's retaliating. 288 00:24:05,720 --> 00:24:08,039 Calls himself "the patriotic hacker." 289 00:24:08,880 --> 00:24:11,079 Right. That's all we need. 290 00:24:11,119 --> 00:24:12,119 Yeah. 291 00:24:12,160 --> 00:24:13,920 This has nothing to do with any of you? 292 00:24:13,960 --> 00:24:16,599 -No. No. Not at all. Nothing. -No? No one's encouraged him? 293 00:24:16,640 --> 00:24:18,680 Well. 294 00:24:18,720 --> 00:24:20,279 How do you think he knows that it's Russia? 295 00:24:21,200 --> 00:24:23,519 He doesn't. He's just grandstanding. 296 00:24:23,559 --> 00:24:25,240 But this is all anyone's going to remember. 297 00:24:25,279 --> 00:24:27,480 When we come out with the official attribution, 298 00:24:27,519 --> 00:24:29,119 no-one's going to be listening. 299 00:24:30,599 --> 00:24:33,920 -All right, thanks, Kathy. -Oh, er, did you get my message? 300 00:24:33,960 --> 00:24:35,599 Er, no, I don't think I did? 301 00:24:35,640 --> 00:24:38,200 NSA's asked to see the malware code. Is that cool? 302 00:24:38,240 --> 00:24:39,640 Er, yeah. Why not? 303 00:24:40,480 --> 00:24:42,559 -Thanks. -So, what's the problem? 304 00:24:42,599 --> 00:24:44,599 -No, there's no problem. -OK. 305 00:24:44,640 --> 00:24:47,599 Almost certainly not the image party election managers 306 00:24:47,640 --> 00:24:49,559 wanted on your TV screens tonight. 307 00:24:49,599 --> 00:24:53,759 The Prime Minister being aggressively heckled while campaigning in Bristol. 308 00:24:53,799 --> 00:24:59,480 And, as a precaution, I'll be chairing a COBR meeting on Sunday at00 a.m. 309 00:24:59,519 --> 00:25:00,960 In the meantime... 310 00:25:01,000 --> 00:25:02,720 -In the meantime, 311 00:25:02,759 --> 00:25:07,319 in the face of this criminal and unprovoked cyber attack, 312 00:25:07,359 --> 00:25:11,559 I have instructed security forces to do whatever is necessary 313 00:25:11,599 --> 00:25:13,440 to find out who's responsible. 314 00:25:14,920 --> 00:25:19,079 To ensure your services and access to your bank account 315 00:25:19,119 --> 00:25:23,119 and your hard-earned savings are absolutely safe... 316 00:25:24,880 --> 00:25:26,759 Thank you. Thank you. 317 00:25:34,319 --> 00:25:35,720 Extraordinary scenes here. 318 00:25:35,759 --> 00:25:37,519 The Prime Minister has rarely been seen 319 00:25:37,559 --> 00:25:40,960 outside the Westminster bubble since, as a junior minister, 320 00:25:41,000 --> 00:25:43,640 not even in the Cabinet, he ousted Boris Johnson 321 00:25:43,680 --> 00:25:47,039 in a particularly bloody "palace coup" 15 months ago. 322 00:25:47,079 --> 00:25:51,039 But with the Conservatives running six points behind in the polls, 323 00:25:51,079 --> 00:25:53,799 this campaign is confronting him with a very real anger 324 00:25:53,839 --> 00:25:55,640 some feel about the economic crisis. 325 00:25:55,680 --> 00:26:00,400 And just how deep the disillusionment with authority in general now runs. 326 00:27:47,480 --> 00:27:48,640 Phil. 327 00:27:49,920 --> 00:27:51,759 I still couldn't get it to run in the sandbox, 328 00:27:51,799 --> 00:27:55,319 so I thought I'd take a look at the code itself. 329 00:27:55,359 --> 00:27:59,039 I hope you don't mind. I think I might've found something. 330 00:28:15,519 --> 00:28:17,720 Well, that's OK. We've all done it. 331 00:28:18,519 --> 00:28:20,200 Done what? 332 00:28:20,240 --> 00:28:22,039 Tried to reverse a library. 333 00:28:22,680 --> 00:28:25,000 It's boilerplate code. 334 00:28:25,039 --> 00:28:26,960 It's just there to avoid the coder having to write 335 00:28:27,000 --> 00:28:29,279 some common functions from scratch. 336 00:28:29,319 --> 00:28:31,160 It's the one that you don't need to bother reversing. 337 00:28:31,200 --> 00:28:33,079 I know what a library is. 338 00:28:33,119 --> 00:28:35,640 I think there's something else hidden in there. 339 00:28:45,119 --> 00:28:47,400 Probably thought we wouldn't bother checking. 340 00:29:05,759 --> 00:29:06,960 Saara found it. 341 00:29:07,000 --> 00:29:09,160 One of our work-experience students. 342 00:29:12,039 --> 00:29:13,200 Thanks. 343 00:29:18,480 --> 00:29:19,599 It's a dropper, right? 344 00:29:19,640 --> 00:29:21,519 Yeah. Tiny. 345 00:29:21,559 --> 00:29:24,039 That's why we missed it the first time round. 346 00:29:24,079 --> 00:29:26,000 -If you run it, it raises a flag. 347 00:29:26,039 --> 00:29:27,279 What's the flag? 348 00:29:28,519 --> 00:29:29,519 Saara? 349 00:29:32,079 --> 00:29:34,000 Er, a "like" 350 00:29:35,079 --> 00:29:37,759 on this Facebook page. 351 00:29:37,799 --> 00:29:41,039 I suppose someone somewhere must be monitoring it. 352 00:29:41,079 --> 00:29:43,079 It's a tripwire. 353 00:29:43,119 --> 00:29:44,279 If they see a "like" on the story, 354 00:29:44,319 --> 00:29:45,759 then they know we've downloaded the payload. 355 00:29:45,799 --> 00:29:48,119 I presume you've managed to pull it down without tripping it. 356 00:29:48,160 --> 00:29:49,559 -I think so. -And? 357 00:29:49,599 --> 00:29:52,200 I'm not sure yet. It's obfuscated like the last one. 358 00:30:01,880 --> 00:30:03,039 Danny. 359 00:30:03,079 --> 00:30:05,359 There's a second virus hidden inside the first. 360 00:30:05,400 --> 00:30:08,240 I think we should upgrade to a Level One attack. 361 00:30:08,279 --> 00:30:10,960 -Level One? Really? -Yeah, I think so. 362 00:30:11,000 --> 00:30:12,359 This degree of sophistication. 363 00:30:12,400 --> 00:30:14,160 And maybe we should call JSTAT, 364 00:30:14,200 --> 00:30:16,480 get them to raise the threat level to critical. 365 00:30:16,519 --> 00:30:18,359 We don't know what this new one does yet. 366 00:30:19,160 --> 00:30:21,119 OK, I'll call Number 10. 367 00:30:21,160 --> 00:30:23,559 Thanks. Right. Shut it down. 368 00:30:23,599 --> 00:30:26,000 OK, and find out what it was meant to do. Quick as you can. 369 00:30:26,039 --> 00:30:27,279 Yes. Got it. 370 00:30:28,960 --> 00:30:30,200 Well done, Saara. 371 00:30:37,119 --> 00:30:38,279 Excuse me. 372 00:30:49,079 --> 00:30:50,799 -Hi. -Where are you? 373 00:30:50,839 --> 00:30:52,160 Why didn't you call back? 374 00:30:52,200 --> 00:30:53,359 Why? What's wrong? 375 00:30:54,039 --> 00:30:55,799 Abu'shad an accident... 376 00:30:57,160 --> 00:30:58,319 on the tracks. 377 00:30:58,799 --> 00:30:59,839 What? 378 00:30:59,880 --> 00:31:01,160 He's in the hospital. 379 00:31:01,640 --> 00:31:03,000 You need to come. 380 00:31:03,400 --> 00:31:04,400 I can't. 381 00:31:04,960 --> 00:31:06,200 Not right now. 382 00:31:06,240 --> 00:31:08,720 -Just... -He's asking for you, Saar. 383 00:31:08,759 --> 00:31:10,359 You need to get back here. 384 00:31:10,400 --> 00:31:11,400 I will. 385 00:31:11,440 --> 00:31:13,319 I'll get a train as soon as this is done. 386 00:31:13,359 --> 00:31:16,039 -I'll be there soon. -Pass please, ma'am. 387 00:31:16,079 --> 00:31:18,119 Thought we'd lost you. Are you OK? 388 00:31:19,039 --> 00:31:20,200 My dad's not well. 389 00:31:21,519 --> 00:31:22,599 Do you need to go? 390 00:31:24,039 --> 00:31:25,200 No, it's OK. 391 00:31:32,119 --> 00:31:34,000 Plug in, they're about to start. 392 00:31:39,799 --> 00:31:40,799 Saara. 393 00:31:41,720 --> 00:31:43,039 Do you want to follow me? 394 00:31:43,400 --> 00:31:44,680 Go on, then. 395 00:31:44,720 --> 00:31:46,799 Leave it. You won't need it. 396 00:32:05,920 --> 00:32:07,200 Andy. 397 00:32:07,240 --> 00:32:09,519 Good to see you. We'll catch up after the meeting. 398 00:32:11,000 --> 00:32:12,599 Home Secretary, nice to see you. 399 00:32:17,799 --> 00:32:19,720 Do you wanna sit down? Sit there. 400 00:32:39,680 --> 00:32:42,559 As you all know, from the CRIP, we've located the malware 401 00:32:42,599 --> 00:32:46,039 within BT's systems and with some round the clock work, 402 00:32:46,079 --> 00:32:49,759 its code has been 70% reverse engineered. 403 00:32:49,799 --> 00:32:51,319 Based on what we've learned, 404 00:32:51,359 --> 00:32:53,480 I'm confident we can have most of the Internet 405 00:32:53,519 --> 00:32:55,759 back up and running by midnight tonight. 406 00:32:55,799 --> 00:32:57,599 Good. 407 00:32:57,640 --> 00:33:00,680 Er, as far as we can tell, this virus has never been seen in the wild before. 408 00:33:00,720 --> 00:33:04,079 Which means it was specially written to take down sections of the BT 409 00:33:04,119 --> 00:33:06,960 and Virgin infrastructures, which is quite a feat, 410 00:33:07,000 --> 00:33:09,359 considering the built-in safety features. 411 00:33:09,400 --> 00:33:12,599 Perhaps most notably, it doesn't seem to be communicating 412 00:33:12,640 --> 00:33:16,000 with any sort of home base, which is, erm, unusual. 413 00:33:16,039 --> 00:33:17,200 Really? 414 00:33:17,240 --> 00:33:20,240 Is that the most notable thing? 415 00:33:21,240 --> 00:33:23,200 Because I'd say, it's the devastating effect 416 00:33:23,240 --> 00:33:26,039 it's having on our economy, which is already in recession. 417 00:33:26,079 --> 00:33:28,200 And which I can tell you from personal experience, 418 00:33:28,240 --> 00:33:31,200 is going down with voters like a bucket of cold sick. 419 00:33:33,240 --> 00:33:35,599 It could have been worse, Prime Minister. 420 00:33:37,720 --> 00:33:38,960 How? 421 00:33:39,000 --> 00:33:41,400 Well, if the attack had happened on Monday morning, 422 00:33:42,160 --> 00:33:43,839 instead of on Friday. 423 00:33:43,880 --> 00:33:47,599 Which is, in fact, exactly what would have happened, Prime Minister, 424 00:33:47,640 --> 00:33:52,359 if it hadn't been for the sharp eyes of one of our work-experience students, 425 00:33:52,400 --> 00:33:54,359 who spotted something else, 426 00:33:55,119 --> 00:33:57,599 hidden inside the malware code. 427 00:33:58,599 --> 00:34:00,519 Danny. 428 00:34:00,559 --> 00:34:03,200 Yeah, at00 a.m. tomorrow morning, a second stage attack was set to activate, 429 00:34:03,240 --> 00:34:07,920 this time taking out the entire Internet with potentially catastrophic results. 430 00:34:07,960 --> 00:34:10,000 The whole country, including vital services, 431 00:34:10,039 --> 00:34:14,400 would have been left unable to get online, just as the Monday morning rush began. 432 00:34:14,440 --> 00:34:18,039 And this is the young student who spotted it. Stand up. 433 00:34:30,760 --> 00:34:32,440 Do we know who's responsible? 434 00:34:34,800 --> 00:34:36,000 For the attack? 435 00:34:37,159 --> 00:34:39,320 We're still working on that. 436 00:34:39,360 --> 00:34:41,760 Well, Jolly Roger seems to know judging by the way 437 00:34:41,800 --> 00:34:45,079 he's flashing the lights off and on in Putin's office. 438 00:34:46,639 --> 00:34:49,639 Perhaps we're relying on him for our cyber responses nowadays. 439 00:34:53,400 --> 00:34:55,800 I'm sorry to interrupt this happy moment, Prime Minister, 440 00:34:55,840 --> 00:34:58,800 but I'd be glad of some clarification, if that's OK. 441 00:35:00,480 --> 00:35:05,480 You say the second malware was spotted by this young woman. What's her name? 442 00:35:07,360 --> 00:35:08,679 Saara Parvin. 443 00:35:09,719 --> 00:35:11,000 And she's a student? 444 00:35:12,599 --> 00:35:14,039 Yes, that's right. 445 00:35:14,079 --> 00:35:15,800 And the rest of GCHQ just... 446 00:35:17,000 --> 00:35:18,320 missed it. 447 00:35:20,840 --> 00:35:23,639 I'm sorry. Is that something we're supposed to applaud? 448 00:35:26,599 --> 00:35:29,679 I mean, it's hardly reassuring, is it? 449 00:35:29,719 --> 00:35:32,559 If she hadn't been doing her work experience or whatever it was, 450 00:35:32,599 --> 00:35:35,559 the entire panoply of our cyber security apparatus 451 00:35:35,599 --> 00:35:37,840 would have missed an extremely dangerous attack, 452 00:35:37,880 --> 00:35:41,719 paralysing commercial life in this country for the second time in four days. 453 00:35:46,440 --> 00:35:48,679 If a student could find this thing and the rest of you didn't, 454 00:35:48,719 --> 00:35:51,239 how do we know there isn't something else hiding in there, 455 00:35:52,840 --> 00:35:56,400 waiting to go off at- 00 a.m. tomorrow? Or- 00 p.m. or whenever? 456 00:36:01,840 --> 00:36:04,760 I think you'd better go back and take another look, don't you? 457 00:36:06,039 --> 00:36:07,559 See what else you've missed. 458 00:36:09,440 --> 00:36:13,920 And let's have some options for an offensive cyber attack on Russia. 459 00:36:13,960 --> 00:36:16,559 I'd like to know what we could do to retaliate. 460 00:36:21,360 --> 00:36:22,840 OK. 461 00:36:22,880 --> 00:36:24,480 Get everybody back tonight. 462 00:36:25,320 --> 00:36:27,639 00 p.m., bring them all in. 463 00:37:00,760 --> 00:37:02,599 -Where have you been? -How is he? 464 00:37:02,639 --> 00:37:06,039 -Where have you been, Saara? -I got here as quickly as I could. 465 00:37:09,199 --> 00:37:10,360 What's happened? 466 00:37:11,760 --> 00:37:12,760 Tell me. 467 00:37:13,360 --> 00:37:14,960 Abudied. 468 00:37:15,000 --> 00:37:16,519 About half an hour ago. 469 00:37:21,239 --> 00:37:22,559 It's OK, Ami. 470 00:37:23,559 --> 00:37:24,559 It's OK. 471 00:38:06,079 --> 00:38:07,760 Are you sure you want to do this? 472 00:38:29,880 --> 00:38:31,679 What was he doing on the tracks? 473 00:38:33,079 --> 00:38:34,320 They're not sure. 474 00:38:34,360 --> 00:38:36,360 There's going to have to be an investigation. 475 00:40:03,760 --> 00:40:05,280 They're withholding his body. 476 00:40:05,320 --> 00:40:06,320 What? 477 00:40:06,360 --> 00:40:07,800 What? Why? 478 00:40:07,840 --> 00:40:10,280 -There's going to have to be a post mortem. 479 00:40:10,320 --> 00:40:11,800 So we can't bury him? 480 00:40:13,199 --> 00:40:15,840 The police won't let us. Not yet. 481 00:40:15,880 --> 00:40:17,840 Why? 482 00:40:17,880 --> 00:40:20,719 -Is it because it might be suicide? -Saara! 483 00:40:20,760 --> 00:40:22,400 -I'll get you some tea. -No! 484 00:40:23,159 --> 00:40:24,440 Saara can get it. 485 00:40:24,480 --> 00:40:26,599 Oh, it's fine, Ami. I'm not an invalid. 486 00:40:30,239 --> 00:40:31,679 Why don't you just go? 487 00:40:31,719 --> 00:40:33,360 -If you're in such a hurry... -Enough, Ami! 488 00:40:33,400 --> 00:40:34,840 Give her a break! 489 00:40:34,880 --> 00:40:37,039 -None of this is her fault. -No. 490 00:40:37,079 --> 00:40:38,880 I won't give her a break. 491 00:40:38,920 --> 00:40:41,320 Her father has just died and she shows nothing. 492 00:40:41,360 --> 00:40:43,719 She looks at her watch! 493 00:40:43,760 --> 00:40:45,639 All she ever thinks about is herself. 494 00:40:45,679 --> 00:40:46,840 Why are you so selfish? 495 00:40:46,880 --> 00:40:48,480 Tell me. Because I don't understand! 496 00:40:48,519 --> 00:40:50,440 -- That's not fair, Mum. -- I'm sorry, I can't do this. 497 00:40:50,480 --> 00:40:53,360 That's right, leave, like you always do! 498 00:41:01,360 --> 00:41:04,920 Right, for those of you that don't know, we've just returned from London 499 00:41:04,960 --> 00:41:09,119 where we were comprehensively beaten up at COBR. 500 00:41:09,159 --> 00:41:11,000 Erm... 501 00:41:11,039 --> 00:41:14,800 Yeah, but just because it was unpleasant doesn't mean it wasn't justified. 502 00:41:14,840 --> 00:41:17,519 There was a Level One attack on the Internet on Friday. 503 00:41:17,559 --> 00:41:22,920 And all of our focus has been on isolating the malware responsible and disabling it. 504 00:41:22,960 --> 00:41:25,719 With the pressure to get everything back up and running, 505 00:41:25,760 --> 00:41:27,920 it's hardly surprising that we weren't looking 506 00:41:27,960 --> 00:41:31,920 as carefully as we should for extra functionality in the code. 507 00:41:31,960 --> 00:41:35,960 Erm, the fact that it was one of our work-experience students that found it 508 00:41:36,000 --> 00:41:38,239 in a place we wouldn't ordinarily be looking, 509 00:41:38,280 --> 00:41:41,079 probably doesn't reflect that well on us, if I'm honest. 510 00:41:41,119 --> 00:41:44,320 Certainly not in the opinion of some of the members of COBR, anyway. 511 00:41:46,079 --> 00:41:49,079 So we're going to be going back over the malware code line by line. 512 00:41:49,119 --> 00:41:51,280 -Let's see what else is hiding in there. 513 00:41:51,320 --> 00:41:54,199 It's a big task and it's urgent. 514 00:41:54,239 --> 00:41:56,639 We cannot afford to be caught out again. 515 00:41:57,599 --> 00:41:59,199 Malware will be leading this. 516 00:41:59,239 --> 00:42:01,239 And some of you will be reassigned for a bit to help out. 517 00:42:01,280 --> 00:42:03,760 -And shifts will be extended again, 518 00:42:03,800 --> 00:42:05,480 I'm afraid, until this gets sorted. 519 00:42:05,519 --> 00:42:07,320 OK. Sorry about that. Let's get to it. 520 00:42:14,199 --> 00:42:15,360 Saara? 521 00:42:17,039 --> 00:42:20,000 Hey, listen, I'm sorry about what I put you through at COBR today. 522 00:42:20,039 --> 00:42:21,360 I didn't see that coming. 523 00:42:22,880 --> 00:42:25,800 You should go home. You look exhausted. 524 00:42:25,840 --> 00:42:27,519 No, I'm fine, honestly. 525 00:42:27,559 --> 00:42:29,760 No, I'm serious, Saara. You look terrible. 526 00:42:31,000 --> 00:42:32,039 I can't. 527 00:42:32,079 --> 00:42:33,719 Everyone else is working. 528 00:42:33,760 --> 00:42:35,320 Go home. OK? 529 00:42:35,360 --> 00:42:36,719 You did a really good job today. 530 00:42:36,760 --> 00:42:39,440 And it will still be here in the morning, I promise you. 531 00:43:04,039 --> 00:43:08,000 A completely illegal and irresponsible attack, 532 00:43:08,039 --> 00:43:09,639 which could have been far worse 533 00:43:09,679 --> 00:43:12,039 if it hadn't been for the carefully prepared strategies 534 00:43:12,079 --> 00:43:15,119 -we brought into play on Friday. 535 00:43:15,159 --> 00:43:18,119 Everything will be fully back up and running by midnight. 536 00:43:18,159 --> 00:43:21,079 In fact, many services have already been restored. 537 00:43:21,119 --> 00:43:24,480 All our online banking, all our major transport links. 538 00:43:27,280 --> 00:43:31,400 Our allies around the world have been quick to condemn this outrageous attack 539 00:43:31,440 --> 00:43:34,840 on UK's sovereignty and to offer their support, 540 00:43:34,880 --> 00:43:36,880 -countries like the United States... -Hey. 541 00:43:36,920 --> 00:43:39,599 ...countries like France, Spain, Germany and many others, 542 00:43:39,639 --> 00:43:41,440 which believe in and are prepared to stand... 543 00:43:41,480 --> 00:43:44,159 What incredible timing for your first day. 544 00:43:45,559 --> 00:43:47,440 I thought they'd never let you out. 545 00:43:48,199 --> 00:43:49,519 How was it? 546 00:43:55,960 --> 00:43:57,760 What is it? What's wrong? 547 00:44:01,639 --> 00:44:02,639 Saar? 548 00:44:08,320 --> 00:44:10,000 My father died this evening. 549 00:44:16,079 --> 00:44:17,719 I am so sorry, Saar. 550 00:44:17,760 --> 00:44:18,760 What? 551 00:44:20,440 --> 00:44:22,039 When? When? What happened? 552 00:44:26,559 --> 00:44:27,960 You're probably hungry. 553 00:44:38,239 --> 00:44:42,000 Countries like the United States. Countries like France, Spain, Germany 554 00:44:42,039 --> 00:44:45,760 and many others, which believe in and are prepared to stand up 555 00:44:46,480 --> 00:44:48,119 for the rule of law, 556 00:44:48,159 --> 00:44:51,159 and I can assure you that we will respond to the attack 557 00:44:51,199 --> 00:44:52,519 within the law 558 00:44:52,559 --> 00:44:55,360 and at a time and in a manner of our choosing. 559 00:44:57,239 --> 00:44:58,920 The rules based International... 560 00:45:02,760 --> 00:45:04,880 -Hi. -You watching? 561 00:45:05,280 --> 00:45:07,119 Yeah. 562 00:45:07,159 --> 00:45:10,360 And how are we getting on with his options? 563 00:45:10,400 --> 00:45:13,480 Er, we're not. It's a really bad idea. 564 00:45:13,519 --> 00:45:15,159 We have to do this, Danny. 565 00:45:15,199 --> 00:45:16,719 Right. 566 00:45:16,760 --> 00:45:20,000 And to hell with the escalation? Because that's where this leads. 567 00:45:20,039 --> 00:45:21,159 You know that. 568 00:45:26,119 --> 00:45:27,119 OK. 569 00:45:36,519 --> 00:45:37,760 Finn, get up here. 570 00:45:38,159 --> 00:45:39,360 Yes, boss. 571 00:45:41,440 --> 00:45:46,000 ...which we have to do it in the world, can claim a similar legitimacy. 572 00:45:46,039 --> 00:45:49,239 But just because this is a democracy, it doesn't mean we are weak. 573 00:45:49,280 --> 00:45:52,440 Or lack the will or the capability to defend ourselves. 574 00:45:52,480 --> 00:45:57,519 And we will defend ourselves with all the force available to us, 575 00:45:57,559 --> 00:45:59,360 within the law. 576 00:46:00,480 --> 00:46:01,639 Thank you.