1
00:00:02,000 --> 00:00:04,279
This programme contains
some strong language

2
00:00:04,280 --> 00:00:06,839
I have decided to declare a state
of emergency. The Prime Minister
has issued a statement.

3
00:00:06,840 --> 00:00:09,279
A foreign power is
attempting to subvert

4
00:00:09,280 --> 00:00:11,679
our democracy and our elections

5
00:00:11,680 --> 00:00:13,800
and that power is Russia.

6
00:00:17,760 --> 00:00:21,759
Following the attack on the UK's
political institutions and telecoms,

7
00:00:21,760 --> 00:00:24,279
Russian FSB hackers
are being blamed.

8
00:00:24,280 --> 00:00:26,359
This constitutes
the cyber equivalent

9
00:00:26,360 --> 00:00:28,480
of an armed attack
on the United Kingdom.

10
00:00:29,520 --> 00:00:30,919
An act of war.

11
00:00:30,920 --> 00:00:34,079
It is vital that we do not react
as expected now.

12
00:00:34,080 --> 00:00:36,600
We need to hit back in a language
they understand.

13
00:00:47,520 --> 00:00:51,639
It was the FSB coder Vadim Trusov
you met in Harrogate, wasn't it?

14
00:00:51,640 --> 00:00:53,359
Yes.

15
00:00:53,360 --> 00:00:55,159
Have you had any more
contact with him?

16
00:00:55,160 --> 00:00:57,160
I understand you were
at college together.

17
00:01:02,760 --> 00:01:05,719
Stage three of the Russian attack
was a data scrape.

18
00:01:05,720 --> 00:01:10,239
All our own and the NSA's most
confidential material stolen.

19
00:01:10,240 --> 00:01:13,759
As of 20:00 hours today,
Eastern Time,

20
00:01:13,760 --> 00:01:18,519
the NSA's intelligence sharing
arrangement with the UK is withdrawn

21
00:01:18,520 --> 00:01:20,480
for the foreseeable future.

22
00:01:27,520 --> 00:01:31,280
JSS is showing Russian aircraft
entering our airspace.

23
00:01:32,320 --> 00:01:34,400
It is possible we are under attack.

24
00:01:35,440 --> 00:01:37,999
I'm sending you something now -
two things.

25
00:01:38,000 --> 00:01:41,639
You can use them to trade with
the Americans to bring them back in.

26
00:01:41,640 --> 00:01:43,919
As soon as it happens,
Putin will back down.

27
00:01:43,920 --> 00:01:46,720
I put my life in your hands now, OK?

28
00:01:47,760 --> 00:01:50,960
If they find out I told you this,
they will kill me.

29
00:02:36,280 --> 00:02:38,519
RAF squadrons are airborne.

30
00:02:38,520 --> 00:02:41,679
They have a fix on
the unidentified aircraft.

31
00:02:41,680 --> 00:02:43,759
The Prime Minister
is waiting for me.

32
00:02:43,760 --> 00:02:45,559
He's with the Chief of Staff.

33
00:02:45,560 --> 00:02:49,039
I will be advising him to order
an immediate retaliatory attack

34
00:02:49,040 --> 00:02:52,039
{\an8}on the Russian military base
in Kaliningrad.

35
00:02:52,040 --> 00:02:53,839
{\an8}It's a provocation.

36
00:02:53,840 --> 00:02:56,919
{\an8}I agree. A squadron of Russian
aircraft over the UK

37
00:02:56,920 --> 00:02:58,519
{\an8}is a provocation.

38
00:02:58,520 --> 00:03:00,279
{\an8}An intolerable one.

39
00:03:00,280 --> 00:03:03,039
Vadim Trusov confirmed
that the Russians' intentions

40
00:03:03,040 --> 00:03:06,039
was to isolate us and then
provoke us into an act of war.

41
00:03:06,040 --> 00:03:08,279
If any of these aircraft
exist at all,

42
00:03:08,280 --> 00:03:10,519
if they're Russian drones
or missiles,

43
00:03:10,520 --> 00:03:12,279
they want us to fire on them.

44
00:03:12,280 --> 00:03:14,039
We are playing their game.

45
00:03:14,040 --> 00:03:16,039
Sorry, how could they fake this?

46
00:03:16,040 --> 00:03:18,839
Hacking Air Traffic Control,
faking air attacks,

47
00:03:18,840 --> 00:03:21,039
it's entirely in keeping
with their MO.

48
00:03:21,040 --> 00:03:22,759
No, we cannot take the risk.

49
00:03:22,760 --> 00:03:25,919
We cannot do this without the
Americans being back on board!

50
00:03:25,920 --> 00:03:29,039
Defence Secretary, we have no doubt
the material Vadim Trusov

51
00:03:29,040 --> 00:03:31,359
leaked to us will encourage
the Americans

52
00:03:31,360 --> 00:03:34,119
to renew military and intelligence
alliances with us.

53
00:03:34,120 --> 00:03:35,759
Putin will back down.

54
00:03:35,760 --> 00:03:39,279
The director of the NSA, General
Perez, has confirmed in writing

55
00:03:39,280 --> 00:03:43,919
that all intelligence and military
alliances with the US are suspended.

56
00:03:43,920 --> 00:03:46,519
Perez hasn't seen
the leaked material.

57
00:03:46,520 --> 00:03:48,759
The Prime Minister has tried
the President.

58
00:03:48,760 --> 00:03:52,039
He's at Camp David incommunicado
for the Middle East talks.

59
00:03:52,040 --> 00:03:54,720
RAF squadrons are minutes away
from intercep...

60
00:03:55,760 --> 00:03:58,039
Try and get him to stop
declaring war on Russia

61
00:03:58,040 --> 00:04:00,400
for the next five minutes.
...Russian aircraft.

62
00:04:04,520 --> 00:04:06,039
Sally. Encryption.

63
00:04:06,040 --> 00:04:09,039
They've managed to reset the
nuclear codes. Some good news.

64
00:04:09,040 --> 00:04:11,039
OK, send that to
the Defence Secretary

65
00:04:11,040 --> 00:04:14,439
and then get me Michaela Jones on a
call in my office, now! Of course.

66
00:04:14,440 --> 00:04:17,279
Max, we need something to get
the Americans back on board.

67
00:04:17,280 --> 00:04:20,039
This Russian exploit you found
in the Trusov material...

68
00:04:20,040 --> 00:04:21,720
Phil found it, actually.

69
00:04:23,760 --> 00:04:26,279
It's malware breaching
the President's personal

70
00:04:26,280 --> 00:04:28,119
and domestic security.

71
00:04:28,120 --> 00:04:30,080
White House CCTV, everything.

72
00:04:31,120 --> 00:04:32,839
It's pretty ballsy.

73
00:04:32,840 --> 00:04:35,320
You can say that again.
Prep a secure link.

74
00:04:42,280 --> 00:04:44,000
DANNY EXHALES LOUDLY

75
00:04:47,280 --> 00:04:49,359
Michaela's on the screen.
Thank you.

76
00:04:49,360 --> 00:04:53,359
{\an8}Michaela? Dan. Touched you've
taken the time out to call.

77
00:04:53,360 --> 00:04:56,519
{\an8}Something up?
You could say that, yes.

78
00:04:56,520 --> 00:04:58,240
What's this about, Dan?

79
00:04:59,280 --> 00:05:03,039
It's about not seeing 80 years
of intelligence sharing

80
00:05:03,040 --> 00:05:05,759
and collaboration go down the pan.

81
00:05:05,760 --> 00:05:07,759
I'm going to send you something

82
00:05:07,760 --> 00:05:10,759
and I really need you to get Perez
to join a call for me.

83
00:05:10,760 --> 00:05:12,519
OK. Leave it with me.

84
00:05:12,520 --> 00:05:15,000
Thank you. I owe you one.
I've got to go.

85
00:05:26,040 --> 00:05:28,839
Max, send that exploit
over secure link

86
00:05:28,840 --> 00:05:31,759
to Michaela Jones at the NSA,
please. Yeah, on it.

87
00:05:31,760 --> 00:05:35,119
I need to talk to you. If it's
about Vadim, I will talk to MI6,

88
00:05:35,120 --> 00:05:37,519
but right now... It's not.
It's something else.

89
00:05:37,520 --> 00:05:40,199
I should have said earlier,
but with everything going on,

90
00:05:40,200 --> 00:05:41,519
and I had to check.

91
00:05:41,520 --> 00:05:44,359
Danny, I've just put General Perez
through to the comms room.

92
00:05:44,360 --> 00:05:47,160
All right, thank you, Sally.
Just wait here for me, Saara, OK?

93
00:05:57,040 --> 00:05:59,519
I trust you're not going to ask
for our help.

94
00:05:59,520 --> 00:06:01,039
Those days are over.

95
00:06:01,040 --> 00:06:02,519
Danny. Yeah...

96
00:06:02,520 --> 00:06:04,759
Thank you for taking the call, sir.

97
00:06:04,760 --> 00:06:09,519
Trusov leaked terabytes
of the FSB's cyber capabilities

98
00:06:09,520 --> 00:06:11,279
and top secret data.

99
00:06:11,280 --> 00:06:14,839
At a conservative estimate,
it will set the FSB back years,

100
00:06:14,840 --> 00:06:16,439
losing this stuff.

101
00:06:16,440 --> 00:06:20,039
Now, Michaela Jones is making
one particular cyber exploit

102
00:06:20,040 --> 00:06:21,800
available to you now.

103
00:06:23,040 --> 00:06:25,919
We need you to convey this
to the President.

104
00:06:25,920 --> 00:06:29,039
In return, we need
the re-establishment

105
00:06:29,040 --> 00:06:31,359
of all intelligence sharing
agreements

106
00:06:31,360 --> 00:06:33,759
and for the President
to tell the Russians

107
00:06:33,760 --> 00:06:35,759
to withdraw from our airspace.

108
00:06:35,760 --> 00:06:39,919
We need this done immediately
or this war becomes real.

109
00:06:39,920 --> 00:06:41,519
What did you send him?

110
00:06:41,520 --> 00:06:44,359
Russian malware targeting
the President's own family.

111
00:06:44,360 --> 00:06:45,759
Mm.

112
00:06:45,760 --> 00:06:48,039
Thank you. We're on this now.

113
00:06:48,040 --> 00:06:51,480
You'll be hearing from us.
Please hold fire until you do.

114
00:06:52,520 --> 00:06:54,240
DANNY EXHALES

115
00:06:56,040 --> 00:06:57,759
I hope this works.

116
00:06:57,760 --> 00:07:00,039
Erm, Defence Secretary...

117
00:07:00,040 --> 00:07:03,039
...if I can take this opportunity,
erm,

118
00:07:03,040 --> 00:07:06,839
even if the special relationship
is indeed back up and running,

119
00:07:06,840 --> 00:07:09,279
we really need to be thinking
about next steps.

120
00:07:09,280 --> 00:07:11,839
Maybe not the time...
How do we fix this?

121
00:07:11,840 --> 00:07:15,039
It's a huge clean up job
and my staff are on their knees

122
00:07:15,040 --> 00:07:16,919
after the last fortnight. Danny!

123
00:07:16,920 --> 00:07:19,759
The truth is, we are
desperately low on numbers

124
00:07:19,760 --> 00:07:22,519
of sufficiently skilled staff, sir.

125
00:07:22,520 --> 00:07:24,999
I can't overstate the importance
of us being ready

126
00:07:25,000 --> 00:07:27,439
should this happen again.
Last time I checked,

127
00:07:27,440 --> 00:07:30,039
GCHQ came under
the Foreign Secretary's authority.

128
00:07:30,040 --> 00:07:32,359
Well, since Elizabeth Kahn's
resignation,

129
00:07:32,360 --> 00:07:34,439
there currently
is no Foreign Secretary.

130
00:07:34,440 --> 00:07:37,039
Well, I will ask the Prime Minister
to bring it up with

131
00:07:37,040 --> 00:07:39,880
whomever he sees fit to appoint
to that august office.

132
00:07:40,920 --> 00:07:42,720
ALERT BEEPS

133
00:07:43,760 --> 00:07:45,320
Oh, shit.

134
00:07:49,760 --> 00:07:52,000
Christ, they're almost over London.

135
00:07:54,040 --> 00:07:56,919
I'm ordering a strike
on Kaliningrad.

136
00:07:56,920 --> 00:08:00,039
Wait. Sir, if they're fake
and we attack,

137
00:08:00,040 --> 00:08:01,839
we are the aggressor.

138
00:08:01,840 --> 00:08:04,000
ALERTS AND SIRENS BLARE

139
00:08:05,280 --> 00:08:07,000
DANNY EXHALES LOUDLY

140
00:08:09,760 --> 00:08:11,279
It was fake.

141
00:08:11,280 --> 00:08:13,919
It was fake all along.
They're playing with us.

142
00:08:13,920 --> 00:08:15,359
Lucky.

143
00:08:15,360 --> 00:08:17,880
I don't like relying on luck.

144
00:08:19,440 --> 00:08:21,000
Gentlemen.

145
00:08:25,040 --> 00:08:27,480
Maybe the Americans are helping
after all.

146
00:08:33,040 --> 00:08:34,679
Danny. Yeah?

147
00:08:34,680 --> 00:08:37,759
With Marston,
you've got to pick your moment.

148
00:08:37,760 --> 00:08:40,359
We have a Cobra meeting
in London tomorrow morning.

149
00:08:40,360 --> 00:08:43,119
We can discuss next steps
with them then.

150
00:08:43,120 --> 00:08:44,880
Understood.

151
00:08:55,000 --> 00:08:57,000
DANNY BREATHES HEAVILY

152
00:09:15,760 --> 00:09:17,919
I'm sorry, Saara. What was it?

153
00:09:17,920 --> 00:09:21,039
When we shut off the data scrape,
our sandbox computer,

154
00:09:21,040 --> 00:09:23,880
which the Russian malware
broke out of... What about it?

155
00:09:25,520 --> 00:09:27,039
What am I looking at?

156
00:09:27,040 --> 00:09:28,519
Yes, James.

157
00:09:28,520 --> 00:09:31,720
Good, good. Well, that's...
That's excellent news.

158
00:09:32,760 --> 00:09:34,720
Yes. Thank you so much.

159
00:09:36,040 --> 00:09:37,720
Jesus Christ.

160
00:09:41,040 --> 00:09:43,519
Charlie, I need you
up in my office ASAP.

161
00:09:43,520 --> 00:09:45,039
Yes, ASAP.

162
00:09:45,040 --> 00:09:46,679
Thank you, buddy.

163
00:09:46,680 --> 00:09:48,000
Danny.

164
00:09:49,520 --> 00:09:51,640
Well, the President called Putin.

165
00:09:52,680 --> 00:09:56,519
Cease all action against the UK
or expect the full force

166
00:09:56,520 --> 00:10:00,000
of a combined NATO response
under Article 5.

167
00:10:01,040 --> 00:10:03,039
Putin has backed down.

168
00:10:03,040 --> 00:10:04,640
For now.

169
00:10:06,040 --> 00:10:09,039
That's good, David.
No, that's excellent,

170
00:10:09,040 --> 00:10:12,000
and you're the one that got
the Americans back in the game...

171
00:10:13,040 --> 00:10:14,640
...so what's wrong?

172
00:10:15,680 --> 00:10:17,880
I've had to call in Charlie Francis.

173
00:10:18,920 --> 00:10:20,279
OK.

174
00:10:20,280 --> 00:10:21,720
Saara.

175
00:10:24,040 --> 00:10:25,800
Come into my office.

176
00:10:30,520 --> 00:10:32,480
So, what's going on, Danny?

177
00:10:37,480 --> 00:10:40,240
Charlie. You're lucky you caught me.
I was just heading off.

178
00:10:41,720 --> 00:10:43,239
Or maybe not so lucky.

179
00:10:43,240 --> 00:10:45,839
Something tells me I'm
not getting home tonight.

180
00:10:45,840 --> 00:10:48,599
Saara, you know Charlie Francis,
Head of Security.

181
00:10:48,600 --> 00:10:52,839
Saara has something for us, Charlie.
And I'm afraid it is not good.

182
00:10:52,840 --> 00:10:54,759
How not good? For you to determine,

183
00:10:54,760 --> 00:10:57,999
but we think it could
be potentially disastrous.

184
00:10:58,000 --> 00:10:59,359
Right. It's how the Russian

185
00:10:59,360 --> 00:11:01,679
malware got into our systems
in the first place.

186
00:11:01,680 --> 00:11:05,159
If I understood correctly,
it was through a sandbox computer.

187
00:11:05,160 --> 00:11:07,839
They knew we'd put the malware
in there to analyse it.

188
00:11:07,840 --> 00:11:10,039
Yeah, but it could only
break out if it knew ahead

189
00:11:10,040 --> 00:11:12,919
of time which sandbox
it was going to be put into.

190
00:11:12,920 --> 00:11:16,919
OK. The Media Access Control.
The Mac address.

191
00:11:16,920 --> 00:11:20,999
It's a 12 digit alphanumeric
identifier unique to each computer.

192
00:11:21,000 --> 00:11:24,439
It was written into the third
stage Russian malware code.

193
00:11:24,440 --> 00:11:26,639
Meaning? The writers of the code

194
00:11:26,640 --> 00:11:29,319
had to have it
before it ever arrived at GCHQ.

195
00:11:29,320 --> 00:11:31,960
It's offline, highside.

196
00:11:33,000 --> 00:11:35,600
So the only way they could
have known is... A CI.

197
00:11:37,120 --> 00:11:38,520
In old money, a mole.

198
00:11:48,560 --> 00:11:49,560
One of us.

199
00:11:58,320 --> 00:12:01,119
REPORTER: Reports overnight
of further cyber attacks

200
00:12:01,120 --> 00:12:02,479
on the UK by Russia.

201
00:12:02,480 --> 00:12:05,639
Surely this begs the
question, are we safe?

202
00:12:05,640 --> 00:12:07,399
Do you think the Government
is doing enough

203
00:12:07,400 --> 00:12:09,479
to respond to these attacks?
What should

204
00:12:09,480 --> 00:12:12,759
Prime Minister Andrew Makinde do
in the face of Putin's aggression?

205
00:12:12,760 --> 00:12:13,760
Give us a call.

206
00:12:50,760 --> 00:12:51,960
Hello, stranger.

207
00:12:55,720 --> 00:12:58,360
Barbara, my love. Mm-hm.

208
00:12:59,560 --> 00:13:02,280
Charlie told me you didn't go
to France like we agreed.

209
00:13:03,960 --> 00:13:05,400
Well, if the world's going to end...

210
00:13:06,520 --> 00:13:08,000
...I'd quite like to be with you.

211
00:13:12,080 --> 00:13:13,160
I'm glad you didn't go.

212
00:13:15,240 --> 00:13:16,360
It was a false alarm.

213
00:13:32,360 --> 00:13:33,880
Bad? Mm.

214
00:13:35,840 --> 00:13:39,239
How are the boys? Fine.

215
00:13:39,240 --> 00:13:40,240
Oblivious.

216
00:13:41,440 --> 00:13:43,480
It's one benefit of
teenage hormones.

217
00:13:51,800 --> 00:13:55,160
What was it? You know
I can't tell you.

218
00:13:57,560 --> 00:13:58,560
Three guesses.

219
00:14:00,200 --> 00:14:03,639
I'm tired, Barbara. You wanted us
packed off to France

220
00:14:03,640 --> 00:14:04,919
and I'm not even allowed to guess

221
00:14:04,920 --> 00:14:08,440
the reason why? It was
Russia, wasn't it?

222
00:14:09,480 --> 00:14:11,639
Well, the news made
that quite clear.

223
00:14:11,640 --> 00:14:13,600
So guess one.

224
00:14:18,080 --> 00:14:20,159
They said there was a data breach.

225
00:14:20,160 --> 00:14:23,400
You can speculate all you like,
but I couldn't possibly say.

226
00:14:24,560 --> 00:14:26,480
Shit! How?

227
00:14:28,120 --> 00:14:32,240
Information possessed by...
...Virtue of your position.

228
00:14:38,160 --> 00:14:41,920
Three and out. But you will
tell me, Danny Patrick.

229
00:14:43,680 --> 00:14:45,200
I insist you tell me.

230
00:14:46,280 --> 00:14:48,320
Damn your insistence, Agent Napier.

231
00:14:49,480 --> 00:14:50,880
You'll never get it out of me.

232
00:15:00,640 --> 00:15:02,920
Don't you ever dream
of just jacking it all in?

233
00:15:05,120 --> 00:15:07,520
Dream, perhaps. But, um...

234
00:15:09,080 --> 00:15:10,919
...if everyone thought like that...

235
00:15:10,920 --> 00:15:13,160
There'd be no-one left
to save the world.

236
00:15:28,160 --> 00:15:33,920
ALARM BEEPS

237
00:15:35,800 --> 00:15:38,879
Er, stay. Oh,
I should at least say hi.

238
00:15:38,880 --> 00:15:40,520
Oh, they'll survive.

239
00:15:42,760 --> 00:15:45,800
I'll go and wake them up.
I'll do the drop before work.

240
00:15:47,880 --> 00:15:48,880
Right.

241
00:15:50,520 --> 00:15:51,520
Oh.

242
00:15:53,880 --> 00:15:54,880
Right. Come on.

243
00:16:17,320 --> 00:16:18,359
REPORTER: Mr Marston,

244
00:16:18,360 --> 00:16:21,319
how is it potential Russian
aircraft were allowed

245
00:16:21,320 --> 00:16:22,759
to fly so near to London?

246
00:16:22,760 --> 00:16:26,159
We knew all along
the attack was probably a fake.

247
00:16:26,160 --> 00:16:28,839
If we responded,
we would have been the aggressor.

248
00:16:28,840 --> 00:16:31,879
Cyber warfare
is notoriously escalatory,

249
00:16:31,880 --> 00:16:34,039
and this is just the
latest in a string

250
00:16:34,040 --> 00:16:37,599
of unacceptable Russian
provocations. That they could gain

251
00:16:37,600 --> 00:16:39,319
access to our radar systems is...
DOORBELL RINGS

252
00:16:39,320 --> 00:16:43,319
...of course, of serious concern,
and the PM and I are very clear

253
00:16:43,320 --> 00:16:46,519
that our cyber defences
must be strengthened.

254
00:16:46,520 --> 00:16:48,720
There's only so long we can
keep this to ourselves.

255
00:16:49,880 --> 00:16:50,919
Danny and I are to brief

256
00:16:50,920 --> 00:16:52,799
the Prime Minister
and security directors.

257
00:16:52,800 --> 00:16:54,839
We should inform them
about our mole.

258
00:16:54,840 --> 00:16:56,639
If we inform them,
then they're going to bring

259
00:16:56,640 --> 00:16:59,839
in external investigators
and work will be disrupted.

260
00:16:59,840 --> 00:17:01,879
And the mole will run to ground.

261
00:17:01,880 --> 00:17:04,999
We have a duty. We have a duty
to fix our entire network

262
00:17:05,000 --> 00:17:08,599
after this attack and find the
mole as quickly as possible.

263
00:17:08,600 --> 00:17:12,080
If we tell Marston, he'll use it
to break up GCHQ once and for all.

264
00:17:13,280 --> 00:17:14,520
There might be another option.

265
00:17:16,320 --> 00:17:19,639
The Event Management Centre
is the most secure unit in GCHQ.

266
00:17:19,640 --> 00:17:24,199
Every terminal has live tracking.
If you can find a pretext to move

267
00:17:24,200 --> 00:17:28,839
all those in malware who had
access to the sandbox there,

268
00:17:28,840 --> 00:17:29,919
I have the perfect

269
00:17:29,920 --> 00:17:33,079
person to monitor their
online behaviour remotely.

270
00:17:33,080 --> 00:17:38,560
This way, we might catch them
in the act and we keep working.

271
00:17:40,960 --> 00:17:41,960
All right.

272
00:17:50,560 --> 00:17:53,199
Richard. David.

273
00:17:53,200 --> 00:17:55,400
David. Alex. Defence Secretary.

274
00:17:56,960 --> 00:17:58,639
Alex.

275
00:17:58,640 --> 00:17:59,640
Danny.

276
00:18:02,160 --> 00:18:03,680
Are we expecting the Prime Minister?

277
00:18:04,720 --> 00:18:08,400
Director General MI5?
No, it's just us.

278
00:18:10,320 --> 00:18:12,559
And it's no longer
Defence Secretary.

279
00:18:12,560 --> 00:18:17,079
Mr Makinde has seen fit to
appoint me Foreign Secretary.

280
00:18:17,080 --> 00:18:18,640
So you report to me now.

281
00:18:19,680 --> 00:18:25,839
The Prime Minister wishes to pursue
a more robust foreign policy.

282
00:18:25,840 --> 00:18:28,479
And given the response
to the Russian attack,

283
00:18:28,480 --> 00:18:32,519
he has asked me to ensure
that there are no repeats of

284
00:18:32,520 --> 00:18:37,119
the failures of GCHQ
in the past few weeks.

285
00:18:37,120 --> 00:18:40,599
Three waves of unopposed
Russian cyber attacks

286
00:18:40,600 --> 00:18:42,279
and the loss of our and

287
00:18:42,280 --> 00:18:45,080
the NSA's most highly
confidential material.

288
00:18:47,640 --> 00:18:50,599
So we're going to do something
a little bit different.

289
00:18:50,600 --> 00:18:56,280
From now on, GCHQ and MI6
will be directly answerable to me.

290
00:18:57,560 --> 00:19:03,480
I would like to see this as
an opportunity to reset relations.

291
00:19:04,720 --> 00:19:09,319
I hope you do too. Of course,
Foreign Secretary.

292
00:19:09,320 --> 00:19:10,320
Good.

293
00:19:11,720 --> 00:19:12,720
Good.

294
00:19:15,160 --> 00:19:20,159
The search for a mole boils
down to two simple questions.

295
00:19:20,160 --> 00:19:24,719
Access and motive. We need to know
who had access to the computer

296
00:19:24,720 --> 00:19:25,959
and of those who did

297
00:19:25,960 --> 00:19:28,959
who had motive to pass
the Mac address to the Russians.

298
00:19:28,960 --> 00:19:31,639
The computer in question
served as a sandbox

299
00:19:31,640 --> 00:19:35,679
for the Malware department
for two years

300
00:19:35,680 --> 00:19:37,639
and two months
until the time of the attack.

301
00:19:37,640 --> 00:19:40,119
Anyone in Malware or IT
could have accessed the

302
00:19:40,120 --> 00:19:41,279
Mac address in that time.

303
00:19:41,280 --> 00:19:44,359
What about CCTV and logs?
They're cycled every few months.

304
00:19:44,360 --> 00:19:47,599
It would have taken
six months at least

305
00:19:47,600 --> 00:19:50,199
to build it into that malware
and run the operation.

306
00:19:50,200 --> 00:19:52,159
So those who only logged in for

307
00:19:52,160 --> 00:19:54,599
the first time this year
are off the hook.

308
00:19:54,600 --> 00:19:57,199
That includes you.

309
00:19:57,200 --> 00:20:00,960
But with thousands of log-ins
18 months before...

310
00:20:02,640 --> 00:20:04,759
...it does mean we're looking
for a needle in a haystack.

311
00:20:04,760 --> 00:20:06,199
But there's a record of every time

312
00:20:06,200 --> 00:20:09,519
a Mac address is checked
in the log files.

313
00:20:09,520 --> 00:20:11,559
Date and time stamped.
So we just need

314
00:20:11,560 --> 00:20:16,159
to cross-reference those with
who was logged in at the time.

315
00:20:16,160 --> 00:20:19,479
Mm-hm. In that case,
it's lucky I had IT

316
00:20:19,480 --> 00:20:22,080
swap out the sandbox terminal
and bring it here.

317
00:20:37,520 --> 00:20:40,559
And the data of ours
that was stolen?

318
00:20:40,560 --> 00:20:42,599
Well, I've asked our
Composite Signals side

319
00:20:42,600 --> 00:20:44,480
to work on
a full inventory assessment.

320
00:20:45,760 --> 00:20:47,119
Nonetheless,

321
00:20:47,120 --> 00:20:50,280
Cyber Security remains
stretched to the limit.

322
00:20:52,240 --> 00:20:53,439
Is there any evidence

323
00:20:53,440 --> 00:20:56,239
that the Russians
are aware yet of their data loss?

324
00:20:56,240 --> 00:21:00,720
Uh, no. Trusov used UDP via Netcat.

325
00:21:02,560 --> 00:21:06,799
He bounced via satellite.
Several satellites, actually.

326
00:21:06,800 --> 00:21:09,359
We can trace the route back
because we know it's there.

327
00:21:09,360 --> 00:21:12,359
That gives us a back door
into the FSB.

328
00:21:12,360 --> 00:21:14,039
Until they know there's a leak,

329
00:21:14,040 --> 00:21:15,799
they won't be able to
discover the route.

330
00:21:15,800 --> 00:21:17,919
MI6 agents on the
ground confirm there's

331
00:21:17,920 --> 00:21:19,759
no clear evidence they're
aware of the leak.

332
00:21:19,760 --> 00:21:23,959
And while they are unaware, we can
basically see their every move.

333
00:21:23,960 --> 00:21:26,079
So the British public,

334
00:21:26,080 --> 00:21:28,639
who have seen ample evidence
of the Russian

335
00:21:28,640 --> 00:21:31,559
attack on our streets
and on our news,

336
00:21:31,560 --> 00:21:37,159
they as yet have seen no sign
of any actual response from us.

337
00:21:37,160 --> 00:21:39,080
They no doubt think
the Russians have won.

338
00:21:41,920 --> 00:21:43,799
The Prime Minister
has stated publicly

339
00:21:43,800 --> 00:21:46,639
that he will take equal
and proportionate action...

340
00:21:46,640 --> 00:21:51,079
Excuse me, Foreign Secretary.
A symmetric attack would

341
00:21:51,080 --> 00:21:54,439
be highly escalatory
and unpredictable.

342
00:21:54,440 --> 00:21:56,839
In my opinion,
it would be completely unnecessary.

343
00:21:56,840 --> 00:22:00,199
We are assured by our
colleagues here and in the US

344
00:22:00,200 --> 00:22:03,559
that the opportunity to listen
in on the FSB is priceless.

345
00:22:03,560 --> 00:22:05,839
If we listen,
we will listen robustly.

346
00:22:05,840 --> 00:22:09,160
If we respond,
we will respond robustly.

347
00:22:12,040 --> 00:22:13,999
That is why I am
seconding a team from

348
00:22:14,000 --> 00:22:17,839
the 14th Signal Regiment
and appointing their CEO,

349
00:22:17,840 --> 00:22:19,879
Lieutenant Colonel Cavendish,

350
00:22:19,880 --> 00:22:23,040
to the new post of
Director of Rapid Reaction.

351
00:22:27,400 --> 00:22:31,519
What's rapid reaction?
You want to attack Russia?

352
00:22:31,520 --> 00:22:33,880
You said you were
short of expert staff.

353
00:22:35,360 --> 00:22:36,480
These are experts.

354
00:22:37,760 --> 00:22:40,080
Your minister is listening.

355
00:22:45,880 --> 00:22:47,000
Thank you, gentlemen.

356
00:22:56,360 --> 00:22:58,279
Danny.

357
00:22:58,280 --> 00:23:00,119
You're still Director of Operations.

358
00:23:00,120 --> 00:23:04,119
14th Signals? That's soldiers.
They'll be offensive cyber.

359
00:23:04,120 --> 00:23:05,279
And with their own director,

360
00:23:05,280 --> 00:23:06,759
they'll be free to
act independently.

361
00:23:06,760 --> 00:23:08,879
And they'll still be
answerable to me.

362
00:23:08,880 --> 00:23:11,199
Yeah, it's just the
first shot, David.

363
00:23:11,200 --> 00:23:14,079
And with Marston as our boss now,
frankly,

364
00:23:14,080 --> 00:23:17,159
we are fucked. Everyone's on
edge because of the attack.

365
00:23:17,160 --> 00:23:20,399
When things calm down,
we'll find a way through.

366
00:23:20,400 --> 00:23:22,399
If Marston gets his way
and attacks the Russians,

367
00:23:22,400 --> 00:23:24,199
things are hardly
going to calm down.

368
00:23:24,200 --> 00:23:26,400
Our new minister seems
to be gunning for you.

369
00:23:27,600 --> 00:23:30,639
I understand David passed you
the details for Vadim Trusov.

370
00:23:30,640 --> 00:23:34,119
We're working on a plan.
We'll take it to our new minister.

371
00:23:34,120 --> 00:23:38,119
Marston, eh? We live
in interesting times.

372
00:23:38,120 --> 00:23:39,560
Robust times at least.

373
00:23:41,240 --> 00:23:44,799
Yeah, well, thank you for Vadim.
We owe him.

374
00:23:44,800 --> 00:23:47,320
Must dash. Do give my best
to Barbara, Danny.

375
00:23:51,320 --> 00:23:52,320
Come on.

376
00:23:59,000 --> 00:24:01,039
A gap.

377
00:24:01,040 --> 00:24:04,639
I'm not sure I understand.
It's really quite simple.

378
00:24:04,640 --> 00:24:08,119
These are all the log-ins to
the sandbox over an 18-month period.

379
00:24:08,120 --> 00:24:11,319
The haystack. And this is a list

380
00:24:11,320 --> 00:24:13,879
of the Mac address log-ins between

381
00:24:13,880 --> 00:24:17,799
the 31st of July
and the 1st of November 2022.

382
00:24:17,800 --> 00:24:20,279
The records for the Mac address
log-ins are missing.

383
00:24:20,280 --> 00:24:21,280
You can see here...

384
00:24:22,520 --> 00:24:25,959
...where they've been
erased or removed.

385
00:24:25,960 --> 00:24:30,279
The FSB must have wiped them during
the attack to protect their mole.

386
00:24:30,280 --> 00:24:33,120
Well, at least we have those dates.

387
00:24:38,200 --> 00:24:40,160
It also rules out anyone from IT.

388
00:24:42,480 --> 00:24:45,119
IT check every computer
every few months.

389
00:24:45,120 --> 00:24:47,319
If it was one of them,
then they'd have cover.

390
00:24:47,320 --> 00:24:48,920
No need to wipe any records, so...

391
00:24:55,120 --> 00:24:58,279
Saara, tomorrow I want you back
with your malware colleagues.

392
00:24:58,280 --> 00:25:00,079
I'm moving you all to the EMC

393
00:25:00,080 --> 00:25:03,279
so I can personally oversee
the response to the FSB attack,

394
00:25:03,280 --> 00:25:05,959
and while we still have a back door
into their system,

395
00:25:05,960 --> 00:25:08,279
I want you to have a look
for the stolen Mac log-ins.

396
00:25:08,280 --> 00:25:12,919
OK? And before you ask, yes.
I've spoken to MI6 about Vadim.

397
00:25:12,920 --> 00:25:15,840
Thank you. I'll get started on
that straight away.

398
00:25:18,520 --> 00:25:21,960
If IT are ruled out, that means...

399
00:25:23,840 --> 00:25:25,720
It means it must be someone
from malware.

400
00:25:27,320 --> 00:25:28,360
From our team.

401
00:25:45,640 --> 00:25:48,959
Right, come on, come on.
Last chopper out of Saigon.

402
00:25:48,960 --> 00:25:50,839
Elliot!

403
00:25:50,840 --> 00:25:53,159
Come on, mate.
What have you been doing up there?

404
00:25:53,160 --> 00:25:55,079
He's been in the bathroom,

405
00:25:55,080 --> 00:25:56,760
making himself handsome
like his dad.

406
00:25:58,360 --> 00:26:00,759
RADIO: You're listening to This
Morning Britain, and we'll have

407
00:26:00,760 --> 00:26:03,400
Prime Minister Andrew Makinde
with us at ten-past.

408
00:26:05,000 --> 00:26:07,039
PRIME MINISTER: Mr Putin
can rest assured

409
00:26:07,040 --> 00:26:10,079
the UK's alliance with the US
is unbreakable,

410
00:26:10,080 --> 00:26:11,159
and we're unshakeable

411
00:26:11,160 --> 00:26:13,559
in our opposition
to his territorial ambitions.

412
00:26:13,560 --> 00:26:16,759
We will answer his recent attempts
to undermine our infrastructure

413
00:26:16,760 --> 00:26:18,479
in like and in kind.

414
00:26:18,480 --> 00:26:21,639
But what I really want to talk
about is China.

415
00:26:21,640 --> 00:26:25,759
Oh, for God's sake.
We are negotiating a trade deal.

416
00:26:25,760 --> 00:26:27,519
What about their human
rights record?

417
00:26:27,520 --> 00:26:29,599
Exactly. Thank you.
This is a deal

418
00:26:29,600 --> 00:26:33,359
that will herald a second golden age
in Sino-British relations.

419
00:26:33,360 --> 00:26:35,000
Oh, God help us all.

420
00:26:37,240 --> 00:26:40,960
Right, we have arrived
at the juvenile correction facility.

421
00:26:45,920 --> 00:26:48,119
Child locks, Mum. Yeah.
I'll release you

422
00:26:48,120 --> 00:26:50,599
when you bid your parents adieu
in a civil manner.

423
00:26:50,600 --> 00:26:52,880
BOTH: Bye, Mum. Bye, Dad. Love you.

424
00:26:57,360 --> 00:26:59,639
RADIO: The UK Government
is now considering how

425
00:26:59,640 --> 00:27:03,199
to respond after one of the most
significant Russian cyber attacks...

426
00:27:03,200 --> 00:27:07,359
So... in recent history...
...Marston's mob arriving today? Mmm.

427
00:27:07,360 --> 00:27:10,959
RADIO: ..concerns about the
growing threat of cyber warfare...

428
00:27:10,960 --> 00:27:12,400
Are you going to be back late?

429
00:27:13,560 --> 00:27:17,439
I have no idea. But if I am,
I'll get Charlie to give me a lift.

430
00:27:17,440 --> 00:27:18,559
All right.

431
00:27:18,560 --> 00:27:20,319
RADIO: They warned that if
the UK launches

432
00:27:20,320 --> 00:27:23,599
offensive cyber operations,
Russia could retaliate

433
00:27:23,600 --> 00:27:25,879
with even more severe attacks.

434
00:27:25,880 --> 00:27:28,399
You know, don't give
that place everything, Danny.

435
00:27:28,400 --> 00:27:30,399
...and impact citizens'
everyday lives...

436
00:27:30,400 --> 00:27:32,519
Leave some for us, hmm?

437
00:27:32,520 --> 00:27:34,519
RADIO: So, as tensions rise...

438
00:27:34,520 --> 00:27:37,239
I'll try. ..the Government faces a
difficult choice.

439
00:27:37,240 --> 00:27:40,359
How to protect national
security without escalating

440
00:27:40,360 --> 00:27:42,040
a dangerous cyber conflict?

441
00:27:45,960 --> 00:27:47,359
Ms Napier. Thank you.

442
00:27:47,360 --> 00:27:50,679
And you've got visitors,
Mr Patrick. Uh... Oh, God.

443
00:27:50,680 --> 00:27:53,999
That must be them.
Go on.

444
00:27:54,000 --> 00:27:56,720
Go be brilliant.
I'll see you later.

445
00:28:07,320 --> 00:28:08,879
Good morning.

446
00:28:08,880 --> 00:28:11,639
Danny Patrick,
Director of Operations, GCHQ.

447
00:28:11,640 --> 00:28:12,759
Lieutenant Colonel Cavendish,

448
00:28:12,760 --> 00:28:17,399
14th Royal Signals and Director
of Rapid Reaction, GCHQ, it seems.

449
00:28:17,400 --> 00:28:18,400
Well, welcome.

450
00:28:21,480 --> 00:28:24,439
I thought you had quite a few
service personnel here.

451
00:28:24,440 --> 00:28:26,599
Uh, they only wear their
uniforms on Military Monday,

452
00:28:26,600 --> 00:28:28,679
so they probably think you're
the firing squad come for me.

453
00:28:28,680 --> 00:28:29,680
Maybe we are.

454
00:28:32,640 --> 00:28:34,359
Morning.

455
00:28:34,360 --> 00:28:35,360
Hi.

456
00:28:42,560 --> 00:28:44,639
In all my time
as head of China Team,

457
00:28:44,640 --> 00:28:47,519
I've never seen such a fuss over
a trade deal.

458
00:28:47,520 --> 00:28:49,959
Oh, thank you, Lydia.

459
00:28:49,960 --> 00:28:51,120
Mmm.

460
00:28:52,520 --> 00:28:55,759
Economic and technical
security reports.

461
00:28:55,760 --> 00:28:58,479
God, they must have every
asset reporting on this.

462
00:28:58,480 --> 00:29:00,399
And the Department of
Trade and Industry

463
00:29:00,400 --> 00:29:02,959
want it all translated
and synopsised by tomorrow.

464
00:29:02,960 --> 00:29:05,159
HE SCOFFS
I know, I know.

465
00:29:05,160 --> 00:29:08,439
But it is our duty, our privilege,
our joy, no less, to serve.

466
00:29:08,440 --> 00:29:11,559
So, let's get to work.
Calvin. Yes, ma'am.

467
00:29:11,560 --> 00:29:13,959
I've sent you each your allocation
to your desktop.

468
00:29:13,960 --> 00:29:16,800
I've printed yours out, ma'am,
as per. Oh, thank you.

469
00:29:18,200 --> 00:29:21,199
"Secret report on the CCP activities
in managed asset pools."

470
00:29:21,200 --> 00:29:24,200
Hedge funds. My favourite.
Let's give it our best shot, team.

471
00:29:26,040 --> 00:29:28,719
Any idea why they moved us up here?

472
00:29:28,720 --> 00:29:29,720
No, he didn't say.

473
00:29:31,000 --> 00:29:34,199
Oh, look, Phil.
Soldier boys. Your wet dream.

474
00:29:34,200 --> 00:29:36,239
Yeah,
some of us actually served, mate.

475
00:29:36,240 --> 00:29:38,319
GCO, Afghan. Yeah.

476
00:29:38,320 --> 00:29:41,839
Sat in a comms container
for three months playing Minecraft.

477
00:29:41,840 --> 00:29:43,679
The Event Management Centre

478
00:29:43,680 --> 00:29:47,999
or EMC, where we'll all be based.
Um, find a terminal.

479
00:29:48,000 --> 00:29:49,839
IT will set you up with log-ins.

480
00:29:49,840 --> 00:29:52,759
Yeah, we need to be accommodated
together in our own space.

481
00:29:52,760 --> 00:29:56,959
We'll just take that one. A hut.
Isn't that what you call it?

482
00:29:56,960 --> 00:29:59,799
Yeah... It's best
if all the reverse engineers,

483
00:29:59,800 --> 00:30:02,159
offensive cyber teams,
and analysts are in one space,

484
00:30:02,160 --> 00:30:05,079
so I can co-ordinate the response
to the FSB attack.

485
00:30:05,080 --> 00:30:07,399
I understand that you shall
co-ordinate the clean-up operation

486
00:30:07,400 --> 00:30:08,959
and damage assessment.

487
00:30:08,960 --> 00:30:13,279
I, as Director of Rapid Reaction,
shall co-ordinate said reaction.

488
00:30:13,280 --> 00:30:16,199
Whatever offensive operation
our minister orders.

489
00:30:16,200 --> 00:30:18,560
That conference room
looks sufficient for the time being.

490
00:30:22,960 --> 00:30:25,720
We also try to foster a culture
of civility.

491
00:30:27,280 --> 00:30:28,919
Good morning, everyone.

492
00:30:28,920 --> 00:30:31,279
I would like to introduce you
to your new colleagues,

493
00:30:31,280 --> 00:30:33,599
joining us from
the 14th Signal Regiment

494
00:30:33,600 --> 00:30:36,479
and our new Director
of Rapid Reaction,

495
00:30:36,480 --> 00:30:39,559
Lieutenant Colonel Cavendish.
Roz, please.

496
00:30:39,560 --> 00:30:41,119
Thank you, Danny.

497
00:30:41,120 --> 00:30:43,039
Er, first, the uniforms.

498
00:30:43,040 --> 00:30:45,759
Don't worry.
Everyone gets it wrong first day.

499
00:30:45,760 --> 00:30:47,559
CHUCKLES

500
00:30:47,560 --> 00:30:51,319
Yeah, I appreciate there's
a cultural difference here.

501
00:30:51,320 --> 00:30:53,480
You like to listen,
when you're not interrupting.

502
00:30:55,240 --> 00:30:57,359
We like to act.

503
00:30:57,360 --> 00:31:02,239
Hopefully, listening and acting
do not prove mutually exclusive.

504
00:31:02,240 --> 00:31:03,560
And the uniforms stay.

505
00:31:06,800 --> 00:31:07,920
As you were, troops.

506
00:31:10,920 --> 00:31:13,840
Max, Charlie Francis
from Security would like a word.

507
00:31:23,040 --> 00:31:25,599
OK, OK, let's crack on, shall we?
We've got a whole

508
00:31:25,600 --> 00:31:27,799
computer network to analyse
for vulnerabilities

509
00:31:27,800 --> 00:31:32,279
and damage and anything our Russian
visitors may have left behind.

510
00:31:32,280 --> 00:31:33,360
Let's have a good one.

511
00:31:47,040 --> 00:31:50,959
Just a routine security sift, Max.

512
00:31:50,960 --> 00:31:52,039
Given the scare,

513
00:31:52,040 --> 00:31:55,279
those on high are jumpy
and have asked me to check

514
00:31:55,280 --> 00:31:59,120
that all security protocols
have been, and are being, followed.

515
00:32:00,440 --> 00:32:05,279
OK. No bother. Like all teams,
you run a hot-desk policy?

516
00:32:05,280 --> 00:32:08,559
All your programmers can log
in on any computer? Mm-hm.

517
00:32:08,560 --> 00:32:12,839
This applies to all machines,
sandboxes included?

518
00:32:12,840 --> 00:32:14,040
Yeah.

519
00:32:15,440 --> 00:32:17,040
What happens
if you need to leave your desk?

520
00:32:19,080 --> 00:32:20,360
Well, then you log out.

521
00:32:22,280 --> 00:32:25,679
We're, uh, we're pretty hot on that.
Even for a quick pee?

522
00:32:25,680 --> 00:32:27,519
You leave a machine logged in,

523
00:32:27,520 --> 00:32:30,280
and someone comes along
and doesn't know...

524
00:32:31,520 --> 00:32:35,119
...accidentally wipes all your work.
Mmm. Or, you know,

525
00:32:35,120 --> 00:32:39,680
spills coffee, whatever. So if
someone, while they're logged in...

526
00:32:40,800 --> 00:32:42,120
...accessed something...

527
00:32:43,920 --> 00:32:46,159
Like what? Anything.

528
00:32:46,160 --> 00:32:47,879
Something on the system.

529
00:32:47,880 --> 00:32:50,839
...it would pretty much have
to be through their own log-in?

530
00:32:50,840 --> 00:32:53,720
Yes, I'd have thought so.
Can you be 100% sure?

531
00:32:55,040 --> 00:32:57,840
Well, no, but...99%.

532
00:33:00,040 --> 00:33:01,119
Is this about the attack?

533
00:33:01,120 --> 00:33:02,680
Just answer the questions, please.

534
00:33:11,560 --> 00:33:13,120
PHONE RINGS

535
00:33:19,400 --> 00:33:21,759
Alex. Danny. We've got the sign-off

536
00:33:21,760 --> 00:33:24,319
from Marston on
the Vadim Trusov exfiltration.

537
00:33:24,320 --> 00:33:25,599
That's good.

538
00:33:25,600 --> 00:33:29,159
But, I'm afraid we've had word from
Dutch intel.

539
00:33:29,160 --> 00:33:32,639
They've had a sighting of Trusov.
They've got a hack on the camera on

540
00:33:32,640 --> 00:33:34,639
the FSB entrance
in Saint Petersburg.

541
00:33:34,640 --> 00:33:39,559
It's not good news.
Needless to say, if they have him,

542
00:33:39,560 --> 00:33:44,879
we can't proceed, and I imagine
Vadim Trusov is in grave danger.

543
00:33:44,880 --> 00:33:47,079
Does that mean they know
we're inside their system?

544
00:33:47,080 --> 00:33:48,439
There's no indication as yet.

545
00:33:48,440 --> 00:33:53,479
But if the FSB have got him,
it can only be a matter of time.

546
00:33:53,480 --> 00:33:54,520
OK.

547
00:34:13,680 --> 00:34:15,719
Where are they? Where's who?

548
00:34:15,720 --> 00:34:19,039
The soldiers in the FSB system.
I mean, this is all us.

549
00:34:19,040 --> 00:34:22,039
What are they doing?
They're soldiers.

550
00:34:22,040 --> 00:34:25,119
They follow orders.
They don't ask questions.

551
00:34:25,120 --> 00:34:26,840
Maybe you should try it sometime.

552
00:34:28,240 --> 00:34:29,960
Right after my next sarcasm lesson?

553
00:35:19,520 --> 00:35:20,960
Looking for something?

554
00:35:25,160 --> 00:35:27,119
They're rigging the FSB
system to blow it up.

555
00:35:27,120 --> 00:35:29,079
Excuse me. If we blow the system,

556
00:35:29,080 --> 00:35:31,319
they'll find out how we got in
and trace it back to Vadim.

557
00:35:31,320 --> 00:35:33,600
Saara, go back to your station.
Shall we?

558
00:35:51,480 --> 00:35:52,640
Come in, Danny.

559
00:35:58,800 --> 00:36:00,359
Lieutenant Colonel Cavendish.

560
00:36:00,360 --> 00:36:02,760
I'm so sorry I wasn't
able to greet you earlier.

561
00:36:05,240 --> 00:36:06,919
Problem?

562
00:36:06,920 --> 00:36:08,839
I am the Director of Operations.

563
00:36:08,840 --> 00:36:11,879
I answer to the Foreign Secretary.
I cannot answer to him

564
00:36:11,880 --> 00:36:14,999
if there are operations being
conducted behind my back.

565
00:36:15,000 --> 00:36:16,919
My operation was ordered by
the Foreign Secretary.

566
00:36:16,920 --> 00:36:20,159
It has not been conducted
behind your back, but in parallel.

567
00:36:20,160 --> 00:36:21,199
Operation?

568
00:36:21,200 --> 00:36:25,639
To mine and blow up the FSB system,
and the Russians will retaliate.

569
00:36:25,640 --> 00:36:27,279
It will end in World War III.

570
00:36:27,280 --> 00:36:30,319
To install a comprehensive
array of degrading effects

571
00:36:30,320 --> 00:36:33,559
to trigger as and when we receive
orders from our superiors.

572
00:36:33,560 --> 00:36:37,599
We cannot have two chains of command
in the one operations room.

573
00:36:37,600 --> 00:36:39,039
We don't.

574
00:36:39,040 --> 00:36:42,799
We have two parallel operations.

575
00:36:42,800 --> 00:36:45,960
Our political masters will decide
which one they wish to pursue.

576
00:36:48,880 --> 00:36:50,520
In that case, I'll get back to
what I was doing.

577
00:36:52,240 --> 00:36:53,920
DOOR OPENS
Danny, a moment.

578
00:36:59,760 --> 00:37:02,599
I don't like it either but we cannot
control the Government.

579
00:37:02,600 --> 00:37:04,159
We can only advise.

580
00:37:04,160 --> 00:37:07,159
After the last few weeks,
Marston's going to be all over us.

581
00:37:07,160 --> 00:37:08,999
You heard him.

582
00:37:09,000 --> 00:37:11,320
We need to be seen to be running
a steady ship.

583
00:37:15,160 --> 00:37:16,880
And we need to find that mole.

584
00:37:29,000 --> 00:37:32,039
Sally, can you get me Michaela Jones
at the NSA, please?

585
00:37:32,040 --> 00:37:33,040
Of course.

586
00:37:36,600 --> 00:37:38,119
You're gonna let her do it,
aren't you? Sorry.

587
00:37:38,120 --> 00:37:39,399
What about Vadim?

588
00:37:39,400 --> 00:37:41,439
It won't take them long
to work out how we got in.

589
00:37:41,440 --> 00:37:44,599
They're not going to blow it up.
Not if I can help it.

590
00:37:44,600 --> 00:37:47,519
But the news on Vadim
is, um...

591
00:37:47,520 --> 00:37:49,559
It's not so good, I'm afraid.

592
00:37:49,560 --> 00:37:52,839
Hacked CCTV footage shows Vadim
and other coders being led out of

593
00:37:52,840 --> 00:37:54,879
the FSB headquarters
in St Petersburg.

594
00:37:54,880 --> 00:37:57,200
When? Same night he leaked
us the material.

595
00:37:58,480 --> 00:37:59,520
That's days ago.

596
00:38:07,360 --> 00:38:09,320
He's only there
because he helped us.

597
00:38:11,160 --> 00:38:12,839
What will they be doing to him?

598
00:38:12,840 --> 00:38:15,639
I don't know, Saara.
I don't know.

599
00:38:15,640 --> 00:38:16,879
MI6 believe that as long

600
00:38:16,880 --> 00:38:18,919
as Vadim is in the hands
of the Russian authorities...

601
00:38:18,920 --> 00:38:21,680
They need to get him out.
...they won't be able to help him.

602
00:38:23,240 --> 00:38:24,280
I'm sorry, Saara.

603
00:38:26,880 --> 00:38:27,960
This is all my fault.

604
00:38:45,560 --> 00:38:48,119
That's Michaela for you.
Thank you, Sally.

605
00:38:48,120 --> 00:38:49,999
Michaela. Dan.

606
00:38:50,000 --> 00:38:52,000
We have a problem with
Richard Marston.

607
00:38:53,120 --> 00:38:54,759
He's been moved to Foreign,
hasn't he?

608
00:38:54,760 --> 00:38:57,079
Yeah. He's playing nice,
as nice as he can.

609
00:38:57,080 --> 00:39:00,719
But he's determined to live out his
Churchillian fantasies.

610
00:39:00,720 --> 00:39:04,359
So he's sent in his own dirty tricks
team to blow up the FSB system.

611
00:39:04,360 --> 00:39:07,639
Ah, shit. Greatest listening
opportunity we've ever had

612
00:39:07,640 --> 00:39:10,639
and he wants to piss it up the wall
for the sake of his own ego.

613
00:39:10,640 --> 00:39:12,679
How soon before
his finger gets itchy?

614
00:39:12,680 --> 00:39:15,280
Mmm, I don't know,
but my guess is not long.

615
00:39:17,000 --> 00:39:18,720
I'll talk to Perez. Thank you.

616
00:39:47,920 --> 00:39:51,119
I'd like to work on the
offensive cyber with you.

617
00:39:51,120 --> 00:39:53,079
I don't want to imagine
what they're doing to Vadim.

618
00:39:53,080 --> 00:39:54,600
I just want to hurt them back.

619
00:39:55,840 --> 00:39:57,040
I'm good at this.

620
00:40:03,200 --> 00:40:04,560
Yeah, start on the comms code.

621
00:40:06,080 --> 00:40:07,600
Then... we'll see.

622
00:40:09,120 --> 00:40:10,360
I'll be watching.

623
00:40:46,400 --> 00:40:48,279
KNOCK AT DOOR
Come in.

624
00:40:48,280 --> 00:40:49,280
DOOR OPENS

625
00:40:53,200 --> 00:40:55,479
You're working with them now,
are you?

626
00:40:55,480 --> 00:40:56,919
You told me to look

627
00:40:56,920 --> 00:41:00,279
for our missing Mac log-in data
in the FSB system.

628
00:41:00,280 --> 00:41:02,279
Otherwise she'd see me in there.

629
00:41:02,280 --> 00:41:03,839
I'm impressed.

630
00:41:03,840 --> 00:41:05,519
And?

631
00:41:05,520 --> 00:41:08,319
Nothing. Not even a trace.
And there's no sign

632
00:41:08,320 --> 00:41:10,959
of any data they stole
from us in their system.

633
00:41:10,960 --> 00:41:13,480
NOTIFICATION CHIME
Sorry, Saara, I've got to take this.

634
00:41:14,800 --> 00:41:16,799
HE CLEARS THROAT

635
00:41:16,800 --> 00:41:18,200
General Perez, sir.

636
00:41:20,240 --> 00:41:21,359
You have two minutes.

637
00:41:21,360 --> 00:41:23,159
I appreciate I'm speaking out
of turn,

638
00:41:23,160 --> 00:41:26,039
but I felt you should
know our listening operation against

639
00:41:26,040 --> 00:41:29,240
the FSB is in danger,
and not from the Russians.

640
00:41:32,600 --> 00:41:34,080
Night, Dave. See you.

641
00:41:47,080 --> 00:41:48,280
PHONE NOTIFICATION CHIME

642
00:41:57,360 --> 00:41:58,360
Pub?

643
00:42:00,000 --> 00:42:02,040
Thanks. I don't really do pubs.

644
00:42:10,760 --> 00:42:13,199
So, what did old
Checkpoint Charlie want?

645
00:42:13,200 --> 00:42:14,919
Just routine, he said.

646
00:42:14,920 --> 00:42:17,479
But he was asking a lot of questions
about our sandboxes.

647
00:42:17,480 --> 00:42:20,399
Really? Phil? Changed your mind?

648
00:42:20,400 --> 00:42:23,199
Do you know a game called
End of Daze?

649
00:42:23,200 --> 00:42:28,359
Yeah, it's, uh... Horizon Zero Dawn
with a touch of Zelda.

650
00:42:28,360 --> 00:42:30,959
Phil's Mr Gamer.
The rougher the dystopia,

651
00:42:30,960 --> 00:42:32,519
the more he enjoys it.

652
00:42:32,520 --> 00:42:34,840
I just need to know how to get into
the Discord chat.

653
00:42:36,160 --> 00:42:38,320
Well... You'll be sorry you asked.

654
00:42:40,280 --> 00:42:42,319
Let's see.

655
00:42:42,320 --> 00:42:45,919
Yeah.
You need to switch those around.

656
00:42:45,920 --> 00:42:50,479
I swear, if one of
you ever goes behind my back to

657
00:42:50,480 --> 00:42:51,879
the Yanks like that again,

658
00:42:51,880 --> 00:42:54,560
I will see to it
that you're charged with treason.

659
00:42:57,520 --> 00:43:00,799
If I may, Foreign Secretary,
to function effectively

660
00:43:00,800 --> 00:43:04,199
as a government
intelligence gathering institution,

661
00:43:04,200 --> 00:43:07,159
there can be no going
behind anyone's back.

662
00:43:07,160 --> 00:43:09,719
I had hoped this could be a new
beginning.

663
00:43:09,720 --> 00:43:13,960
He means that we understand fully
and unequivocally.

664
00:43:16,640 --> 00:43:17,959
Just to be clear,

665
00:43:17,960 --> 00:43:21,479
we're not triggering the degrading
effects.

666
00:43:21,480 --> 00:43:24,880
That is correct, Lieutenant Colonel,
we are not triggering them...

667
00:43:26,680 --> 00:43:27,840
...yet.

668
00:43:45,840 --> 00:43:47,840
How are the interviews going?

669
00:43:48,920 --> 00:43:50,080
Nothing jumping out.

670
00:43:51,640 --> 00:43:54,479
They're a pretty clean bunch,
your coders.

671
00:43:54,480 --> 00:43:57,000
They just busted their guts
turning this thing around.

672
00:43:58,080 --> 00:43:59,640
For one of them to be
the cause of it...

673
00:44:01,360 --> 00:44:03,040
...oh, man,
that'd just break my heart.

674
00:44:04,400 --> 00:44:05,440
I pity them.

675
00:44:07,280 --> 00:44:09,079
Nobody wakes up in the morning
and says,

676
00:44:09,080 --> 00:44:10,719
"Today I'm going to betray

677
00:44:10,720 --> 00:44:14,400
"my colleagues,
my friends, my family, my country."

678
00:44:15,760 --> 00:44:17,759
Sometimes they're believers,

679
00:44:17,760 --> 00:44:19,360
but usually they've been got to.

680
00:44:21,360 --> 00:44:24,040
Love, sex, blackmail.

681
00:44:25,640 --> 00:44:28,800
By the time we get to them, they're
in the worst place in the world.

682
00:44:30,320 --> 00:44:32,680
But don't worry, Dan.
We'll find the mole.

683
00:44:34,960 --> 00:44:36,240
Clock's ticking.

684
00:45:51,160 --> 00:45:52,480
TYPING

685
00:46:49,440 --> 00:46:50,680
What are you doing?

686
00:47:33,720 --> 00:47:36,720
Subtitles by Red Bee Media