Original subtitles

I need to talk to you. If it's about Vadim, I will talk to MI6,

but right now, I'm in the middle... It's not about Vadim.

It's something else. Saara has something for us, Charlie.

It's how the Russian malware got into our system.

Writers of the code had to have it

before it ever arrived at GCHQ.

In old money, a mole.

One of us.

Mr Makinde has seen fit to appoint me Foreign Secretary.

I am seconding a team from the Fourteenth Signal Regiment

and appointing their CO to the new post of Director of Rapid Reaction.

So they probably think you're the firing squad come for me.

Maybe we are.

Don't you ever dream of just jacking it all in?

Dream, perhaps, but if everyone thought like that...

There'd be no-one left to save the world.

Secret report on CCP activities in managed asset pools.

Let's give it our best shot, team.

Alex. They've had a sighting of Trusov.

If the FSB have got him, it can only be a matter of time.

The news on Vadim is not so good, I'm afraid.

What will they be doing to him?

This programme contains strong language

Sit.

Glass of wine.

Dinner.

Special occasion?

You're home, I'm home - that's rare enough these days.

You didn't! Taj Mahal.

I was just passing and...

"Chicken tikka masala for sir." BARBARA LAUGHS

"Jalfrezi for the lady."

PHONE RINGS Aw...

Sorry. Go on.

Yes. Danny Patrick?

Yes?

Maya Young, Deputy Head of Security.

We're on a secure line.

What's up?

I have Saara Parvin here.

She's been communicating with a third party

through a Discord server from the event management centre.

She says you'll vouch for her.

Let me speak to her.

It's me, Danny.

What's going on, Saara?

It's Vadim - he's alive.

Oh, that's great news. How is he? Where is he?

That's the thing - he says it wasn't Russia,

the attack, Stage 3, the data scrape -

or it was them but it wasn't for them.

Sorry, what wasn't? Who was it for?

Stage 3 was China. Vadim's in China.

Everything OK?

The growing military relationship between

China and Russia is a major concern for the West.

Trade between the two countries is at an all-time high.

Hostile nation states are waging a new kind of war,

launching cyber-attacks that are capable of crippling infrastructure,

causing chaos.

Presidents Xi and Putin have called for a new global order.

Welcome, Russian coders.

Welcome to China, welcome to Shenzhen.

As part of the no-limits partnership

as agreed by our gracious Presidents Xi and Putin,

you are our honoured guests.

DOOR SLIDES OPENS

I am Ming Liu, your translator. You'll call me Liu.

We speak English not because English is a superior language

but because English is the international language of coding.

Yin Technologies.

We are proud to be recognised in the West

as one of the most sophisticated,

significant and sustained cyber attackers in the world.

Yin Technologies is an independent, cyber-development enterprise.

We work from eight to six, lunch at midday.

You can of course work more if you so wish,

the job will be done quicker.

English, please.

Ming Liu,

I have three children, and my wife works.

No-one knows that I'm here, nor anyone's family.

We had to hand over all phones and all personal devices.

I'm sure your families will be informed

that you are engaged in important work for your nation.

This is the breaking and entering tool we built

for the attack on the UK.

As you are aware, in your recent exploit against the United Kingdom,

there were three stages to your attack,

and you are here to redesign your breaking and entering tool for us.

To break in where?

You only need to know what is essential to your job.

I will assign tasks tomorrow morning.

Now, you sleep.

We sleep here too?

Yes, for your comfort.

We have all the latest games...

MISHA SIGHS ...we will call out for food.

Otherwise, you have everything you need here -

clothing, bedding, toiletries, your welcome pack.

So we are prisoners?

You are our honoured guests.

VADIM SIGHS

VIDEO GAMES SOUND EFFECTS

Please check the menu for your food.

I will take your order after.

TEXT ALERT

I'm really glad it's you, Saara.

COMPUTER BEEPS

No-one else would use your login on the sandbox, right?

No.

And you'd never leave it unattended while you were logged on?

Never. Hm.

What about people working with you

while you're logged on?

Sure, but I'm always there.

Do you remember working with any Russian specialists

between these dates in 2022?

What, a three-month period two years ago?

I mean, during a surge,

I could log on to the sandbox seven times a day,

so, yeah, it's possible.

But none in particular?

Well, I'd need a particular time to be particular.

Even then, it's...

Sorry, what's this about?

I need to review your security status.

Sure, but...

Any changes in your circumstances since your last review?

How do you mean? Financial? Lovers?

Old friends who have come back into your life?

New friends?

Yeah. Yes.

There is actually something I... PHIL CLEARS THROAT

I should declare.

We only have Trusov's word for it that the Chinese are involved,

that he's even in China.

We've ignored Vadim before, to our cost.

How can she be sure it was him?

I told you, she asked him something only he would know.

OK, so it's him. Maybe they have him under duress,

or maybe they've been playing the long game with him,

and us, all along.

Fair conjecture, Danny.

All right, I accept that that's a possibility.

Which means we should treat the intel with the utmost caution.

I accept that it's a possibility but I don't buy it.

The FSB data Vadim leaked us, you've seen it -

there's no way that was a play.

He even gave us a back door into their system.

So, yes, I trust the source.

What evidence have we in the code?

It was a fair question, Danny.

We haven't seen any evidence of Chinese involvement in the code

because we weren't looking at them.

All right, if you've both had your say, moving forward,

what do we know about offensive cyber operations in Shenzhen?

APT10, one of the largest and longest-established...

It's an arm's length MSS operation -

Chinese Ministry of State Security -

and we would be unwise to ignore the intel.

If Russia and China are collaborating on cyber,

it represents a major threat to national security.

Danny and I will have to travel to London

to brief the Foreign Secretary.

We'll need to check through the malware code.

Would you please see to this personally, Lieutenant Colonel?

Sir, with due respect,

I'm Director of Rapid Reaction, not a reverse engineer.

Until such time as we can offer better proof of attribution,

China's possible involvement must stay between us.

Still, sir... For this, and other reasons I can't go into,

I kindly request that you look into this yourself.

Yes, sir.

You might want to check and see if we've seen any of the code before,

anything to link the data scrape back to the CCP.

One more thing, both of you.

This, all of this, is more important,

much more important, than your two bruised egos.

Wow.

And your friend Jules, he bankrolled it?

Yeah, his start-up did, yeah.

How?

Venture capital? I don't know.

My job was to design the game.

Destiny Doom Loop?

I write code, OK? I don't...

...come up with the names or do the deals.

Did Jules approach you, or you him?

I think he came to me. It's...

Is that important?

And there were no Russian connections,

his gaming company,

that you're aware of?

It's a dystopian, shoot-em-up game -

it's hardly divulging strap three intel.

And it's not against the rules to do a bit of moonlighting, OK?

Me and the other programmers,

we could earn ten times what we're earning here in the private sector.

Right.

Phil.

Have a look at investors going back three years

and check his personal accounts -

high street, crypto...

...et cetera.

Any big deposits.

KNOCKING

Sorry to interrupt.

You remember my deputy?

Maya Young.

Yes, we spoke on the phone.

Boss.

Any progress on our mole?

Sifting through the hay piece by piece.

Well, I don't want to make that stack any bigger but...

What?

That Russian connection you're looking for...

Yes?

...it might not, in fact, be Russian.

Yeah, it reads well.

Very well.

The ending, Calvin,

fair reflection of the original?

Yes, Barbara, I think so.

That's good. Good report, Lydia. Well done.

Oh, hello. Hello.

Well, if it's a lunch date you were hoping for,

I'm afraid today is team lunch.

Hey, is there somewhere we can talk a bit more privately?

What is it? The boys?

No, no, no, no. Just...

Yeah, sure.

So...?

I was wondering,

anything new or unusual coming through reports?

From China?

Well, all the time,

but if there was anything relating to you,

it would have been passed on.

Can you be more explicit? Mm, afraid not.

You come to me wanting answers

and I've got to come up with the questions?

No, no. Not that I'm aware of.

Look, if they were after something in here, then what might that be?

They're in here? Not that we know of,

but if they were, what do you think they'd be looking for?

Well, I suppose speculation doesn't count as disclosure.

I believe not.

Everything.

I mean, they love data.

And, of course, anything in relation to Hong Kong,

Tibet, Uighurs, Taiwan,

but they're quiet on all that at present.

The main thing in relation to us is the trade deal.

But the Department of Trade and Industry or the Treasury,

they hold our significant economic data, not us.

There's much richer pickings there.

We're just security profiling their industries and state bodies.

Hardly worth the fallout of an attack

for them finding out what we know about them.

Now they're attacking us? I didn't say that.

I said it was hardly worth it.

David's going to be waiting for me.

Oh, well, sorry I couldn't be of more help.

You've been a lot of help. Thank you.

Take care.

See you later. OK.

RECORDING OF FEMALE VOICE SPEAKING MANDARIN

Barbara? Calvin, there's something I need to attend to.

Kids. Danny's gone to London.

Of course.

PHONE BUZZES

Roz.

We're just coming into London, what have you found?

I ran the code similarity searches on our holdings.

The interfaces between stages 2 and 3 have been seen before,

but not in Russian capability.

So the code is Chinese in origin?

Well, yeah, Chinese in origin,

but it does not prove that it is a Chinese attack.

The Russians could have used it as part of an attempt

to deflect us towards China.

All right, I'll talk to MI6 and our Five Eye partners

and see if they have anything to corroborate or contradict.

In the meantime,

would you write up a report, please? Thanks.

Alex, short notice,

but we're wondering if you might have any human intelligence

which speaks to something we're looking at?

PHONE BUZZES

Marston. Richard...

...bit of a heads up,

you're going to be hearing the recent attack

might not have been solely the work of the Russians.

PHONE RINGS

Oh, hi, Anne. Um...

Uh... sorry, yeah, too many things.

Look, Dan's been called away again

and we are up to our teeth in the department -

I don't suppose the boys could come to yours after school, could they?

Yes, of course, no problem. No, that's great.

Yeah. Everything all right with you?

No, no, everything's fine.

Yeah, sure. I'll give them some tea.

Oh, thank you.

All right. No worries. Bye.

OK, yeah. Bye, Barbara.

All right, bye.

Vadim Trusov, who we have good reason to believe

alerted us to the involvement of China state actors

in the recent malware attack APT10.

Lieutenant Colonel Cavendish confirmed

that the interface for the Stage 3 malware code originated

in the same Chinese Ministry of State Security-backed APT10.

There's been an increase in monitored traffic,

human and electronic, between the FSB in St Petersburg and Shenzhen -

it would support the theory of a partnership. Mm.

And despite growing political ties,

a collaboration between Russia and China on a cyber exploit is,

to date, unheard of.

But you can't be 100% sure.

Well, you can never be 100% sure when it comes to attribution

unless the one party admits to it.

However, there's a significant weight of evidence.

We have a high confidence.

Help me out with something.

They're in the middle of negotiating a huge -

excuse me, David -

a huge trade deal with us.

What exactly would their motive be?

The silent theft of big data is classic Chinese MO.

So, we can't be 100% sure

and we have no clear motive apart from their previous charge sheet?

When it was Russia, it demanded an equal and proportionate response.

MI6's thoughts?

The CCP's quest for big data

has been historically to tighten control of their own population

or for industrial espionage.

In short, for their own internal purposes.

China already wields power over our key technologies,

utilities, internet, social networks.

They have directly or indirectly bought the influence of...

Nonetheless, we can only advise government of the potential threats.

Thank you, Director GCHQ.

Sometimes, we must put our economic interests before...

Our principles?

Before suspected threats,

the aims of which are, at best,

unclear.

Danny, a word?

So, reports of Mr Trusov's demise were greatly exaggerated?

Yeah. Do you think you can get him out of China?

It's possible, but complicated,

and there seems a reluctance to ruffle CCP feathers.

Yeah, I can see that.

I suppose ruffling would be inevitable.

And a special op would need not only Marston's sign-off

but also the PM's.

If you can get your Vadim Trusov to find out

what the CCP were looking for in our data,

then not only would our masters

be bound to sanction the exfiltration,

but also to respond to China's involvement in the attack.

OK. And a word to the wise, Danny -

sometimes - well, most times -

it's not about managing the enemy,

it's about managing them.

See you, Danny. Alex.

Oh, and, Danny?

Love to Barbara.

DOOR SHUTS Hello?

Saara, can you get a message to Vadim?

RUSSIAN CHATTER

Hey, Liu,

I'm done here with recoding the search tool.

Have you run it?

No, because it needs to know what it's searching for.

I will run it. Please stand away from your terminal.

OK, just let me close a few windows.

It's good.

It's time to eat.

I will print out the menus.

DOOR SHUTS

Lunch.

Prime Minister Andrew Makinde continues

his landmark trade talks with China.

Critics say the Government is naive to hand China access.

Makinde should put down his begging bowl and

consider British national security.

You've been on that since dinner - what is it?

Ay-ay-ay-ay.

It's in the public realm, I suppose.

Marston allegedly taking bribes for the nuclear deal?

China again?

Your team worked on the inquiry, didn't they?

I couldn't possibly comment.

I get it - payback.

We made submissions - what they were, I can't tell you.

Why do you want to know?

Do you think the inquiry was a whitewash?

Come on, aren't they always?

You know what? I don't like Marston

and his "Rule Britannia" Empire politics but,

well, they couldn't find anything on him.

Hey.

Come here.

Morning, Charlotte. Morning.

Thanks for your help yesterday.

It's OK.

I enjoyed it.

A little bit, anyway.

What did they say?

Well, the Foreign Secretary didn't seem too surprised

at the mention of Chinese involvement.

I meant what I said about going behind people's backs.

Who went behind the Foreign Secretary to the NSA?

You're right,

but I've realised it wasn't the best move.

"Win a battle, lose the war," and all that.

You don't need to use military metaphors for my benefit.

All right. There's no harm in the Foreign Secretary being pre-briefed.

It allows him to consider a response.

I got a response, all right.

For someone so intent on action, he seems strangely reluctant

to consider even the smallest complaint to China.

I presume he'll downplay it to the Prime Minister.

Well, what do you suggest we do?

Well, we keep a skeleton team on the FSB

and your team tries to understand what China were after.

If we know that,

then the case for a considered response will be stronger.

OK.

Good morning, team. Morning, sir.

RECORDING OF FEMALE VOICE SPEAKING MANDARIN

Oh, Charlie.

What brings you up here?

I'd like to say it was social

but I need to talk to some of your team. Ah.

Well, we're on a bit of a surge here with the trade talks.

Internal security, Barbara.

So, who do you want to talk to?

Anyone who's had cause to go to Malware in the last two years or so.

Right. In that case, most of the team.

I was hoping you weren't going to say that. Mm.

I'll get Calvin to bring you the log.

You can have the small conference room. All right.

Ah.

What happened to you yesterday?

Were you with Checkpoint Charlie all that time?

Mm.

Did he find out you've been cheating the fantasy football?

Using an algorithm is not cheating.

I think it probably is.

What? I'm just saying.

Did I miss something yesterday?

No.

So what's the big deal?

There's no big deal.

Just, as your line manager in our non-hierarchical hierarchy,

I'm looking out for you.

Just checking in.

Consider yourself checked in.

ALL IN OFFICE GROAN

Wait, was that you?

I didn't do anything.

The back door into the FSB system Trusov left us,

they've closed it.

Fuck.

Which means... Which means they know we've been in there,

and they won't be long in figuring out how we got in. Oh, shit.

We'd better tell Danny.

Well, you'd better tell Danny.

You know, line manager and all that.

PHONE BEEPS

Hello? Saara, where are you?

Heading home. You need to get a message to Vadim.

The FSB know.

Shit. How?

We don't know. We just know they closed the door on us.

How did he get you the first link to the FSB?

Text message to my phone.

All right, well they might know about that as well.

Just get a message to him.

Tell him to get out of wherever he is and go off-grid.

The Russians know what he did, his life is in danger.

And you might want to do something about your phone as well.

Fuck.

BEEP

Where are you going?

If you don't let me go, they'll kill me.

Put it on - anti-facial recognition.

Make sure the design faces the front.

It pixelates the face.

State Security are on their way, the FSB are with them.

But the FSB know what I've done. They'll kill me.

I've been monitoring you.

Only I know you have been in contact with someone on the outside.

I am part of the democracy movement.

I love my country, but my country is not the CCP.

I think you feel similarly about your country and leadership.

I've disconnected the facial recognition, CCTV

and alarms in the service elevator.

You have three minutes to get to the basement and out.

This is the address of a friend in the movement.

Her name is Hai. Maybe she can help.

Go!

Thank you.

ALARM BLARES

GATE BEEPS

KNOCKING

Barbara. Thanks for waiting.

Well, I was here anyway -

China trade talks, riveting.

So...

...have you discovered anything interesting?

Only what a large department you've become.

Well, that's China for you.

Mm.

I had to go down to the cages to get your file.

My old MI6 file. CHARLIE CHUCKLES

I have my notes from your vetting interview here.

2015.

Well, there's nothing like going through your whole love life

with your husband's best friend.

We should begin.

I understand you've found a way

to launch our cyber offensive, Lieutenant Colonel. Yes, sir.

GCHQ reverse engineers

showed great ingenuity in re-establishing the comms.

I'm glad to hear it.

See? Making a difference already.

We await orders.

One last time, Foreign Secretary, I strongly urge you to reconsider.

Launching a cyber-attack against Russia could be seen

as a declaration of war.

Lieutenant Colonel Cavendish, the back door to the FSB has closed.

Deploy our response to Russia's attack.

Now, if you'll excuse me,

I am entertaining the German ambassador at the Royal Opera.

Die Walkure. Yes, sir.

Orders to deploy degrading effects.

Launch our cyber offensive.

You found the way back in -

would you like to do the honours?

Pleasure.

Bastards have caused us enough trouble.

Command Control E. HE TYPES

Boom!

So, no material change there either?

No, just a boring, suburban mum's existence.

You've never been boring, Barbara.

You're too kind, Charlie.

You've always been too kind.

No. No big windfalls,

no tall, dark strangers taking me aside.

Nothing much, in fact.

The Malware department -

you said you sometimes have call to go there.

Yeah. Most of us do.

Yet at no point are you signed in to the sandbox computer.

I'm not sure

I'd even have the clearance.

But I've never needed to.

I'm sure you've heard from others,

the reverse engineer finds a bit of Mandarin or Cantonese text,

whoever answers the call in my department sits with them

as they walk us through it, and we translate it on the hoof.

Do you answer the call often?

Not so much.

I'm less across contemporary and technical hacker slang

than my younger colleagues.

KNOCKING

Boss. You need to see this.

Give me a moment. Of course.

Barbara, sorry, I've kept you long enough.

Oh, we're done?

Yep, and you need to pick up the boys.

No, Anne picked them up, they're at yours.

Thank you, and sorry for keeping you again.

I think we've got him, but we need to double and triple-check this.

And it's definitely linked to Phil Draper? Aye.

Sorry.

I forgot my smartcard.

..and Chinese money, with access to the London markets.

Is that correct, Mr Marston?

The Prime Minister is working around the clock... Hello?

...on this trade deal with China.

Finance will be at its centre...

Where is everybody?

Fabian's asleep. Mum's upstairs too.

Finance, technology, manufacturing and, of course, security.

This trade deal with China...

Trust you?

How can I trust you?

PHONE RINGS

David.

I'm sorry to interrupt you at home

but I thought you should know first off...

...Charlie's found the mole.

Subtitles by Red Bee Media