Original subtitles

A symmetric attack would be highly escalatory

and unpredictable.

Lieutenant Colonel Cavendish,

deploy our response to Russia's attack.

No-one else would use your login on the sandbox?

And there were no Russian connections? His gaming company?

Welcome, Russian coders.

You are here to re-design your breaking and entering tool for us.

I'm done here with recoding the search tool.

I've been monitoring you.

I love my country, but my country is not CCP.

This is the address of a friend in the movement.

LOUD BUZZER Her name is Hai. Maybe she can help.

Not interrupting, am I?

I bet if you look in your files

you'll find me named as a CCP spy in intercepted messages.

I only erased your files

because I believed in what I thought you stood for.

You used to say you wanted to do what is fair and just.

Now's your opportunity.

If this were to come to light, you'd lose your job,

your husband - his career would be destroyed.

I thought you should know first off -

Charlie's found the mole.

ALARM BEEPS

Oh, you're up.

Yeah. Heading to London.

You didn't say you had anything.

Got a text late last night - trade talks.

One of the PM's Special Advisers wants an in-person briefing

on the security of Chinese hedge funds.

Well, one of my team is facing serious charges.

Well, I'm sorry to hear that...

I really need to be there.

Can't one of your colleagues go?

Can't you get one of yours?

I'm head of the China Team -

it's my job to report to government.

You're going to have to drop the kids for once.

Since when do we talk to each other like this?

Since I have to look after them

while you're managing one bloody crisis after another.

What is this really about, Barbara?

It's about me doing my job, Danny.

Hey.

Ah. Sorry, sorry.

I had the kids and Barbara got called away.

We were discussing external agencies.

We can't be seen to police ourselves.

Well, surely we're still only questioning Phil.

Questioning officially now.

Yeah, well, none of us here think he's guilty.

And I think that speaks directly to the need for external auditing.

Now, if you don't mind, I am late.

Sorry to interrupt, Danny.

Something's come up.

Well, can Roz not take care of it?

She's not in yet.

I thought the Army prided itself on punctuality.

All right, I'll be there in a minute.

You all right, mate? I'm fine, I'm just...

I'm late and I'm already chasing my tail.

All right, Max, what exactly am I looking at here?

Well, it looks like pretty simple code.

And where has the malware come from?

Department of Immigration and Visas.

It started turning the printer on and off repeatedly.

It caught fire.

Well, what is it? Ransomware?

There's no ransom demand.

And Saara found this.

The breaking and entering tool, it's Russian.

The same the FSB used on its last attack?

The same as the Russians used in their recent attack

with modifications.

So our definitive response to Russia

led to escalation by them or their allies within 12 hours.

It could be a false flag,

someone wanting us to assume that.

This malware has not been seen anywhere but here

and wherever it was coded by the FSB.

And Shenzhen.

Vadim said that's why they were brought to China,

to work on their malware for the Chinese for APT10.

Not a Russian strike after all.

All right, Max, let's just triage this

and find out how it works and what it's after.

Why don't I take the lead on this?

Don't worry, I won't blow up any shit,

unless I have to.

OK.

Saara, any word from Vadim?

Nothing.

Well, when he does get in touch,

ask him if he knows anything about this malware.

TAPS KEYBOARD

PHONE RINGS

Hi. Hi.

I, um...

I don't want to leave things the way we did this morning.

Yeah, sorry, it was early -

I just needed that first coffee.

So you're at Admiralty, then?

The China trade talks.

Yeah.

Yeah, I'm just waiting for them to break.

Barbara... 67!

I got a 2:1!

What's that?

Don't know.

Look, I think they're calling us through.

STAMMERING: I should go.

It's open!

Nicky... Can I help you?

Where's Nicky Chan?

Never heard of him.

But this is his office.

This is MY office, has been for ten years.

Oh, OK.

Sorry. Sorry to bother you.

KNOCKING

HEAVY METAL MUSIC IN HEADPHONES

KNOCKING

Hey, Victor.

Victor Smith, exchange student, right?

Yeah, that's me.

How was your flight from Canada?

Looks like it was shitty.

Let's get you fixed up.

Old bastard,

telling tales on neighbours for extra social credit.

SHE SIGHS

You took your time, Russki.

I expected you last night.

I couldn't find it.

I slept somewhere under a bridge.

Liu says they're tearing the place up looking for you.

Liu's a friend of yours? We have interests in common.

He says they took your friend. Misha? Took him where?

Someplace he won't be coming back, my guess -

not in one piece anyway.

He's got kids.

This is my fault.

Listen, Russki...

...first rule, I don't want to know what you've done, what you believe.

No politics...

...strictly business.

And he says you have friends.

They're going to have to come pick you up.

It's too dangerous for you out there -

facial recognition, and the MSS are looking for you.

I don't know, if I can message them...

You can also tell them my help costs 200,000 kuai

in bitcoin.

Burners.

Tell them you'll message them back in one hour on a new phone.

Every new SIM costs them 2,000 kuai.

Thank you.

No thanks - bitcoin.

Now, clothes.

You smell like under a Shenzhen bridge.

You shower.

I'll take your clothes to the laundry downstairs.

WATER RUNS

My colleague Joanna from Counter Intelligence will join me

to audit questioning.

I'll report to no-one until we believe there are grounds

for the DPP to press charges.

I hope that allays your fears, Danny.

My fear is that we have the wrong person.

My hope is that you've got the right one...

...or else the real mole is out there,

as they have been for the last 18 months, spying on you.

DOOR OPENS

Am I interrupting?

No, we're just finishing.

Alex Sheldon, MI6 Chief,

Roz Cavendish.

Hm, Marston's girl.

Lieutenant Colonel Cavendish, Director of Rapid Reaction, GCHQ.

And no longer a girl.

CHARLIE: Right,

shall we run over a few of these details

before we head down to Security? Come on.

Daniel?

Before I'm consigned to the dungeons,

I might ask that lovely wife of yours for a spot of lunch.

Where would I find her?

London.

I'll tell her she missed you.

I'm sure she'll be gutted. DOOR OPENS

What's wrong?

A senior management meeting to which I wasn't invited.

It was a separate matter, extremely delicate.

You're just going to have to trust me on that.

That's the crux of the matter, isn't it? Trust.

You're in your hut, I'm in mine.

Did you have something to discuss?

This new malware, it's propagating.

Which suggests...? It's wormware,

replicating itself to spread to other computers.

To what end?

At the moment it seems satisfied with internal chaos.

Immigration was on the phone - the whole system is at a standstill.

We should be doing something more than triaging.

Step at a time.

Looks like we're going to have to quarantine

the whole Department of Immigration.

I'll talk to the Permanent Secretary...

No, I will.

That's my job.

I said I'd call him back.

And wasn't I to lead on this?

And you've obviously got other "delicate" matters to attend to.

Hi, love, I just wanted to...

VOICEMAIL: Hi. You've reached Barbara's phone.

I'm unable to take your call.

It's Vadim on the secure line. He's OK.

He's confirmed this attack was APT10,

but he's stuck in Shenzhen.

This is Danny Patrick, Director of Operations, GCHQ.

Vadim can stay here,

but it costs, Mr Whoever You Are -

bitcoin.

Who is this?

I'm Hai - that's all you need to know.

And you're with Vadim?

Yeah, but MSS and State Police are looking for him.

OK, I can call MI6, talk about getting you out of there.

I'm sure we can arrange a suitable fee.

OK, as long as we understand.

Vadim, Saara says you and your colleagues

were working on a breaking and entering tool there. Yeah.

Well, it's broken a worm into our government system.

Do you know what it's looking for?

Not exactly, no.

Saara says you have something.

Vadim?

I did get something -

a long alphanumeric.

Possibly a ciphertext.

It was stolen from you in the data scrape in the Russian attack.

Can we have it?

It could be really important to us.

When I'm safe.

Vadim, we're doing our best, really.

And we could really do with that ciphertext now.

I just spent a night under a bridge

hiding from the facial recognition cameras.

If one of them spots me, I'm dead...

...so I could really do with being safe now.

I'll call back in one hour. HANGS UP PHONE

We have to get him out.

You're learning, Russki.

Don't give anything away in this world for free.

We need Vadim Trusov.

We've got an attack coming out of China at present,

and he holds the key.

I'll see what we can do

but, with the CCP love-in going on at Admiralty,

the Prime Minister is going to resist

exfiltrating a Russian citizen from mainland China...

...at least until the trade talks are concluded.

Have your girl liaise with our China desk.

We'll get a plan in place and ready to roll.

Alex, we really should begin.

Thank you.

Saara, I've got a number at MI6.

ALEX CLEARS THROAT

Alex Sheldon, MI6.

Our MI6 colleagues are here to offer an independent ear

to our ongoing investigation.

Can you tell us the main reason...

...for doing the gaming design jobs?

Uh, I enjoy it.

Not for the money?

That too, but I wouldn't do it if I didn't like it.

I've got a job here.

Last time we spoke,

you said that you could earn much more in the private sector

than you do here -

does that bother you?

WHISPERS: Shit.

I didn't mean it that way.

I was just saying how it is.

Have you thought about leaving GCHQ?

Yeah, it's crossed my mind, but...

...I believe in the mission.

And aside from everything else,

what the Russians have done -

Ukraine, the malware attack here...

...I mean, you've lost the plot if you think I'd work for them.

Phil, have you ever heard of a company called XXN Ventures?

No. Xiangxin Corp?

Xiangxin? The...

...China tech giant?

You think I'm spying for China now?

Now I'm a communist?

Fuck's sake.

XXN supplied the venture capital for your friend's company

to produce and develop the game.

XXN are a subsidiary of Xiangxin Corp,

and Xiangxin Corp have established links to the ruling CCP.

WHISPERS: Fuck.

You weren't aware?

Of course not.

Trouble is, how can you prove what you did

and did not know?

Because it's the truth.

OK, let's leave motive aside for one minute

and move on to opportunity.

Hi. You've reached Barbara's phone. I'm unable to take your call.

Shit. PHONE BEEPS

Hi. Um...

I just wanted to talk.

This morning was...

...wobbly, and felt like before -

you know, just sudden trips to London, and...

There's difficult things happening here too.

It doesn't matter.

Um, I hope you have a good day.

KNOCKING Come in.

Department of Trade and Industry

reporting similar issues as Immigration.

Well, did you quarantine Immigration like we agreed? Yes.

We produced a timeline.

The worm jumped 600ths of a second before the door closed.

It knew it was being quarantined.

It still presents as simple code,

but we think the emerging pattern suggests something more complex.

And the chaos and destruction are deceptions for a deeper goal.

So, while we were trying to contain it at Immigration,

it attacked the Department of Trade during the trade talks.

Maybe that's its deeper goal.

I'm going to have to warn the Prime Minister's office.

Quarantine Trade too? It didn't work last time -

no reason to believe it's going to work this time.

We're going to have to shut down the system,

both Immigration and Trade and all related systems. Completely?

That will bring those departments to a halt.

And much beyond.

Every computer turned off.

It will close our ports, airports, customs.

And the China trade talks will have to be suspended.

I'm going to need sign-off from the top for that.

In the meantime,

you just look for any clues as to what its target might be.

INTERCOM: Your call has been forwarded.

David Neal's office.

It's Danny Patrick. I need to talk to David ASAP.

He's in a meeting. I'll see if I can get hold of him.

I'll wait. Please hold.

TAPS PHONE KEYPAD

PHONE RINGS Legal Clearance, Fran speaking.

Hey, Fran, it's Danny Patrick here.

Hi, Danny, how are you?

Er, good-ish.

We're dealing with a Category 1 attack.

I'm going to need access to ANPR,

and key surveillance systems,

for the duration.

Can your office sign that off?

Yeah, I'll give you emergency access now.

Will you just send over the documents?

Yeah, I'll send over the paperwork.

Thanks, Fran, I owe you one.

What the fuck?

Sorry, Danny,

I'm afraid I can't reach him at the moment.

Do you want to hold?

Never mind, I'm going to go to London.

Just have him call me ASAP.

MUFFLED TV CHATTER

Is there someone here I could speak to?

Hello?

I'm looking for Nicky Chan?

Chan Chi Lam?

I know he comes here - we have photographs.

Um...

I'm looking for Nicky Chan...

...or Chan Chi Lam.

I need to talk to him.

There is no Chan Chi Lam here.

This is a Chinese takeaway.

But you know and I know that...

...this is a Chinese police station.

The police station is on the high street

if you need the police.

You know that's not what I mean.

You know this is an MSS overseas office.

The talks. What the hell is he doing there?

Who do you work for?

Is there anything you want to amend?

Or add?

Because this statement makes very clear

that you had motive and opportunity.

But you have no proof that I accepted money from the Chinese,

and you won't, because...

...I didn't...

...not knowingly.

You can't prove that I accessed the MAC address

at a specific time.

I mean, your only hope is that I confess,

which I'm not going to do, because...

Because I didn't do anything, OK?

Listen, Phil,

you accessed the sandbox on an almost daily basis

when the MAC address was stolen.

In the same period of time,

you also accepted money from a CCP proxy -

Xiangxin Technology Corp.

Nothing's ever lost.

There will be a record somewhere of who accessed the MAC address.

DAVID: I've spoken to the PM's office

and it's a no to shutting it down.

They have introduced a worm into the government system.

Every time we try and quarantine it,

it jumps.

It's looking for something.

It could well be to do with the talks.

But what exactly?

Well, we don't know!

That's why we have to shut the system down so we can find out.

We can't argue that it poses an immediate threat

because we don't know what that threat is.

DANNY STAMMERS When you identify that,

we'll go back to them.

PHONE RINGS Understood. I've got to jump.

Roz.

Tell me you've got some good news.

Yeah, I'm going to have to disappoint you there.

We passed it through reverse engineering

but they've used environment keying.

You know Marston, right?

Yes, a bit.

All right, well, can you call him?

As minister responsible and Deputy PM,

he might be able to authorise us.

I'll see what I can do. Thank you.

Mind if I have a word with Saara?

Yes, in fact, I do.

Wasn't really a question.

Saara, we'll talk in here.

So is he right?

Phil?

Is nothing ever lost?

Are you questioning him?

I can't comment on current inquiries.

That's what people say in here when they mean "yes".

The files in the system settings were cleaned out

during the Russian attack and Chinese data scrape.

And there's no other way to retrieve them?

Not that I...

Let me try something. What?

Start,

Control Panel,

Network and Internet.

Network and Sharing Center,

MAC Address Network,

Details.

The keys you hit when you access the MAC address,

the pattern,

maybe there's a trace.

Could you find them?

Will it help Phil?

I can't comment on that.

We wouldn't be asking if we did not think it was imperative.

Danny Patrick put you up to this, didn't he?

This is his phone line.

A moment. No, no, no, no.

You can't take her.

Internal security takes precedence.

Ah, this place.

Richard...

It's a no in any event, Roz.

We are ratifying a trade deal with the top Chinese delegation.

We cannot have the lights at the Department of Trade go out.

End of.

Your job is to keep them on, soldier.

TAPS PHONE KEYPAD

It's a no from Marston.

Why does that not surprise me?

OK. Thank you for trying, I appreciate it.

Where are you going?

PM Andrew Makinde and Foreign Secretary Richard Marston

reconvened their landmark trade talks

with China at Admiralty House today.

The Government hail it as a watershed moment,

claiming the potential for billions of pounds in economic gains.

But the negotiations are controversial,

with critics warning that a deeper strategic partnership with Beijing

risks compromising British security.

SIREN WAILS

Sorry, excuse me.

Pass?

Not on the list.

Oh, come on, I'm GCHQ.

Please keep the entrance clear.

Oh, come on, you've got to let...

Right.

So, the talks are progressing extremely well, as I would've hoped,

but I'm sure you can appreciate these things do take some time.

However, I hope that, within the next 48 hours,

we will have an agreement on the table

which both sides are satisfied with

and which will be of great benefit

to both the United Kingdom and China.

MUFFLED CHATTER

Barbara.

What a nice surprise.

It's been a while.

It has indeed.

Let's take a walk in St James's Park, shall we, Nicky Chan?

SIREN WAILS

WHISPERS: Control Panel, Network and Internet,

Network and Sharing Center.

MAC Address Network, Details.

Control Panel, Network and Internet,

Network and Sharing Center,

MAC Address Network, Details.

Control Panel, Network and Internet,

Network and Sharing Center, MAC Address Network,

Details.

Control Panel, Network and Internet,

Network and Sharing Center,

MAC Address Network, Details.

Control Panel, Network and Internet,

Network and Sharing Center, MAC Address Network,

Details.

Control Panel.

WHISPERS: Charlie.

Charlie?

Mm.

I think I might've found something.

RINGING

PHONE RINGS

RINGING

Hey there.

Hi.

Where are you?

Um... I was on my way home, but I got called back in.

You?

I just got home.

I picked the boys up on the way,

ordered pizza.

They're just doing their homework.

How was London?

Fine.

And your talks with the special advisers?

Fine.

I got your message.

Sorry I couldn't pick up, I, um...

What time are you home?

Uh, I can't say.

Danny? Let's...

Let's talk later, OK?

Love you. Yep. Got to go.

Fucking hell, how long is it going to be?

Nice friends -

they prefer to talk about business with CCP than help you out.

Saara won't let me down.

Is she your girlfriend? No.

I mean, no, she's not.

Magic.

I don't understand.

Balaclava,

so you can get from here to the car,

or whatever it is your friends decide to send for you.

Thank you.

Thank me in bitcoin, not flower boy eyes.

Is that a compliment or an insult?

Insult.

Put it on now so I don't have to look at you.

Wow, you look better already.

HEAVY METAL MUSIC PLAYS

HAI YELLS

THEY YELL

This completes the list of

all the times the MAC address was accessed.

It was actually quite easy in the end.

I dumped the RAM

and examined the raw data using memory forensics.

Yes, that's the full list.

And only one falls into our time period

of October, 2022, 10.51.

So now we just need to cross-reference.

No.

I can't believe I just did that.

You did your job.

TAPS PHONE KEYPAD

Maya. Boss.

I need you here.

And get Joanna from MI6...

...and I think Phil Draper's going to need a lawyer.

DOOR SHUTS

How bad?

The threat level has escalated.

The whole financial services sector will soon be in meltdown.

And the malware is irreversible?

Not that we can determine as yet.

DANNY SIGHS

Close down the system -

Departments of Immigration, Trade and all contiguous systems.

But Marston said... To hell with Marston.

The man is a posturing idiot.

Perhaps, but can we, legally,

without ministerial sign-off?

The Intelligence Act of 1994 -

senior officials can organise preliminary actions

in the national interest without ministerial approval.

If anyone questions you, it's on me.

There has been travel chaos across the UK today

after the Department of Immigration's

computer system went down.

Airports, ferry terminals and the Eurostar were all affected.

There is growing suspicion that hackers from a hostile nation state

may be behind the disruption.

The lawyers at Trade and Industry were writing

key paragraphs in the agreement when you pulled the plug.

It was necessary.

You should have consulted us.

I did - you said no.

I was within my rights as Direc...

That's as may be,

but the PM's exact words were,

"I'll have Danny Patrick for this."

Well, the Public and Commercial Services Union

will have something to say about that.

You do realise it's chaos out there, don't you?

It was chaos before.

At least now it's confined.

We need to turn the system on again as soon as possible, Danny.

The risk of contagion is too great.

This is a potentially nuclear piece of malware.

Until we understand it, those departments remain isolated.

Well, I hope you're right, Danny.

I am.

Some blowback.

Someone had to make the right call.

Look, you've been here all day.

I'll do the night shift, you go get some sleep.

Are you sure? Yeah.

Just come in with a brilliant solution tomorrow.

You know...

...the reason MI6 are here is because...

...we've got a mole.

It could be anyone...

...but they think they've got the right person now.

Well, thanks for trusting me enough to tell me.

DOOR OPENS

You've been read your rights, Phil, do you understand?

Yes.

And I didn't betray my country.

This is a timestamped log...

...of the missing MAC address access records,

which proves the MAC address was stolen on your login.

No, this... This isn't right.

There must be a mistake.

I need to see the Malware work calendar

to see what we were working on.

RINGING

Boss? Maya,

could you see if anyone in Malware

can supply us with their work calendar?

Matter of urgency.

"Laughing Panda"?

"Malware Attack, Chinese, APT10."

We went into surge mode for a good two weeks.

How is that relevant?

What have you got for me?

It's Phil, isn't it?

It can't be.

Can't be what?

Barbara Napier.

She asked me to get her a coffee.

I left her at the terminal...

...I went down to the coffee van.

I must've been gone a good ten, 15 minutes.

But it was Danny Patrick's wife, the boss,

Barbara Napier.

You wouldn't be an angel

and get me a latte from the coffee van, would you?

Here, have one yourself.

Barbara Napier? Yeah.

I don't know why they sent the most senior analyst on the China Team...

...but it was Danny's wife...

...the boss -

of course I got her a coffee.

These are very serious allegations you're making here, Phil...

...about a senior and widely respected colleague.

I'm not making allegations...

...I'm just saying what happened.

Subtitles by Red Bee Media