Original subtitles

This programme contains some strong language

I have decided to declare a state of emergency. The Prime Minister has issued a statement.

A foreign power is attempting to subvert

our democracy and our elections

and that power is Russia.

Following the attack on the UK's political institutions and telecoms,

Russian FSB hackers are being blamed.

This constitutes the cyber equivalent

of an armed attack on the United Kingdom.

An act of war.

It is vital that we do not react as expected now.

We need to hit back in a language they understand.

It was the FSB coder Vadim Trusov you met in Harrogate, wasn't it?

Yes.

Have you had any more contact with him?

I understand you were at college together.

Stage three of the Russian attack was a data scrape.

All our own and the NSA's most confidential material stolen.

As of 20:00 hours today, Eastern Time,

the NSA's intelligence sharing arrangement with the UK is withdrawn

for the foreseeable future.

JSS is showing Russian aircraft entering our airspace.

It is possible we are under attack.

I'm sending you something now - two things.

You can use them to trade with the Americans to bring them back in.

As soon as it happens, Putin will back down.

I put my life in your hands now, OK?

If they find out I told you this, they will kill me.

RAF squadrons are airborne.

They have a fix on the unidentified aircraft.

The Prime Minister is waiting for me.

He's with the Chief of Staff.

I will be advising him to order an immediate retaliatory attack

on the Russian military base in Kaliningrad.

It's a provocation.

I agree. A squadron of Russian aircraft over the UK

is a provocation.

An intolerable one.

Vadim Trusov confirmed that the Russians' intentions

was to isolate us and then provoke us into an act of war.

If any of these aircraft exist at all,

if they're Russian drones or missiles,

they want us to fire on them.

We are playing their game.

Sorry, how could they fake this?

Hacking Air Traffic Control, faking air attacks,

it's entirely in keeping with their MO.

No, we cannot take the risk.

We cannot do this without the Americans being back on board!

Defence Secretary, we have no doubt the material Vadim Trusov

leaked to us will encourage the Americans

to renew military and intelligence alliances with us.

Putin will back down.

The director of the NSA, General Perez, has confirmed in writing

that all intelligence and military alliances with the US are suspended.

Perez hasn't seen the leaked material.

The Prime Minister has tried the President.

He's at Camp David incommunicado for the Middle East talks.

RAF squadrons are minutes away from intercep...

Try and get him to stop declaring war on Russia

for the next five minutes. Russian aircraft.

Sally. Encryption.

They've managed to reset the nuclear codes. Some good news.

OK, send that to the Defence Secretary

and then get me Michaela Jones on a call in my office, now! Of course.

Max, we need something to get the Americans back on board.

This Russian exploit you found in the Trusov material...

Phil found it, actually.

It's malware breaching the President's personal

and domestic security.

White House CCTV, everything.

It's pretty ballsy.

You can say that again. Prep a secure link.

DANNY EXHALES LOUDLY

Michaela's on the screen. Thank you.

Michaela? Dan. Touched you've taken the time out to call.

Something up? You could say that, yes.

What's this about, Dan?

It's about not seeing 80 years of intelligence sharing

and collaboration go down the pan.

I'm going to send you something

and I really need you to get Perez to join a call for me.

OK. Leave it with me.

Thank you. I owe you one. I've got to go.

Max, send that exploit over secure link

to Michaela Jones at the NSA, please. Yeah, on it.

I need to talk to you. If it's about Vadim, I will talk to MI6,

but right now... It's not. It's something else.

I should have said earlier, but with everything going on,

and I had to check.

Danny, I've just put General Perez through to the comms room.

All right, thank you, Sally. Just wait here for me, Saara, OK?

I trust you're not going to ask for our help.

Those days are over.

Danny. Yeah...

Thank you for taking the call, sir.

Trusov leaked terabytes of the FSB's cyber capabilities

and top secret data.

At a conservative estimate, it will set the FSB back years,

losing this stuff.

Now, Michaela Jones is making one particular cyber exploit

available to you now.

We need you to convey this to the President.

In return, we need the re-establishment

of all intelligence sharing agreements

and for the President to tell the Russians

to withdraw from our airspace.

We need this done immediately or this war becomes real.

What did you send him?

Russian malware targeting the President's own family.

Mm.

Thank you. We're on this now.

You'll be hearing from us. Please hold fire until you do.

DANNY EXHALES

I hope this works.

Erm, Defence Secretary...

if I can take this opportunity, erm,

even if the special relationship is indeed back up and running,

we really need to be thinking about next steps.

Maybe not the time... How do we fix this?

It's a huge clean up job and my staff are on their knees

after the last fortnight. Danny!

The truth is, we are desperately low on numbers

of sufficiently skilled staff, sir.

I can't overstate the importance of us being ready

should this happen again. Last time I checked,

GCHQ came under the Foreign Secretary's authority.

Well, since Elizabeth Kahn's resignation,

there currently is no Foreign Secretary.

Well, I will ask the Prime Minister to bring it up with

whomever he sees fit to appoint to that august office.

ALERT BEEPS

Oh, shit.

Christ, they're almost over London.

I'm ordering a strike on Kaliningrad.

Wait. Sir, if they're fake and we attack,

we are the aggressor.

ALERTS AND SIRENS BLARE

DANNY EXHALES LOUDLY

It was fake.

It was fake all along. They're playing with us.

Lucky.

I don't like relying on luck.

Gentlemen.

Maybe the Americans are helping after all.

Danny. Yeah?

With Marston, you've got to pick your moment.

We have a Cobra meeting in London tomorrow morning.

We can discuss next steps with them then.

Understood.

DANNY BREATHES HEAVILY

I'm sorry, Saara. What was it?

When we shut off the data scrape, our sandbox computer,

which the Russian malware broke out of... What about it?

What am I looking at?

Yes, James.

Good, good. Well, that's... That's excellent news.

Yes. Thank you so much.

Jesus Christ.

Charlie, I need you up in my office ASAP.

Yes, ASAP.

Thank you, buddy.

Danny.

Well, the President called Putin.

Cease all action against the UK or expect the full force

of a combined NATO response under Article 5.

Putin has backed down.

For now.

That's good, David. No, that's excellent,

and you're the one that got the Americans back in the game...

so what's wrong?

I've had to call in Charlie Francis.

OK.

Saara.

Come into my office.

So, what's going on, Danny?

Charlie. You're lucky you caught me. I was just heading off.

Or maybe not so lucky.

Something tells me I'm not getting home tonight.

Saara, you know Charlie Francis, Head of Security.

Saara has something for us, Charlie. And I'm afraid it is not good.

How not good? For you to determine,

but we think it could be potentially disastrous.

Right. It's how the Russian

malware got into our systems in the first place.

If I understood correctly, it was through a sandbox computer.

They knew we'd put the malware in there to analyse it.

Yeah, but it could only break out if it knew ahead

of time which sandbox it was going to be put into.

OK. The Media Access Control. The Mac address.

It's a 12 digit alphanumeric identifier unique to each computer.

It was written into the third stage Russian malware code.

Meaning? The writers of the code

had to have it before it ever arrived at GCHQ.

It's offline, high side.

So the only way they could have known is... A CI.

In old money, a mole.

One of us.

REPORTER: Reports overnight of further cyber attacks

on the UK by Russia.

Surely this begs the question, are we safe?

Do you think the Government is doing enough

to respond to these attacks? What should.

Prime Minister Andrew Makinde do in the face of Putin's aggression?

Give us a call.

Hello, stranger.

Barbara, my love. Mm-hm.

Charlie told me you didn't go to France like we agreed.

Well, if the world's going to end...

I'd quite like to be with you.

I'm glad you didn't go.

It was a false alarm.

Bad? Mm.

How are the boys? Fine.

Oblivious.

It's one benefit of teenage hormones.

What was it? You know I can't tell you.

Three guesses.

I'm tired, Barbara. You wanted us packed off to France

and I'm not even allowed to guess

the reason why? It was Russia, wasn't it?

Well, the news made that quite clear.

So guess one.

They said there was a data breach.

You can speculate all you like, but I couldn't possibly say.

Shit! How?

Information possessed by... Virtue of your position.

Three and out. But you will tell me, Danny Patrick.

I insist you tell me.

Damn your insistence, Agent Napier.

You'll never get it out of me.

Don't you ever dream of just jacking it all in?

Dream, perhaps. But, um...

if everyone thought like that...

There'd be no-one left to save the world.

ALARM BEEPS

Er, stay. Oh, I should at least say hi.

Oh, they'll survive.

I'll go and wake them up. I'll do the drop before work.

Right.

Oh.

Right. Come on.

REPORTER: Mr Marston,

how is it potential Russian aircraft were allowed

to fly so near to London?

We knew all along the attack was probably a fake.

If we responded, we would have been the aggressor.

Cyber warfare is notoriously escalatory,

and this is just the latest in a string

of unacceptable Russian provocations. That they could gain

access to our radar systems is... DOORBELL RINGS

of course, of serious concern, and the PM and I are very clear

that our cyber defences must be strengthened.

There's only so long we can keep this to ourselves.

Danny and I are to brief

the Prime Minister and security directors.

We should inform them about our mole.

If we inform them, then they're going to bring

in external investigators and work will be disrupted.

And the mole will run to ground.

We have a duty. We have a duty to fix our entire network

after this attack and find the mole as quickly as possible.

If we tell Marston, he'll use it to break up GCHQ once and for all.

There might be another option.

The Event Management Centre is the most secure unit in GCHQ.

Every terminal has live tracking. If you can find a pretext to move

all those in malware who had access to the sandbox there,

I have the perfect

person to monitor their online behaviour remotely.

This way, we might catch them in the act and we keep working.

All right.

Richard. David.

David. Alex. Defence Secretary.

Alex.

Danny.

Are we expecting the Prime Minister?

Director General MI5? No, it's just us.

And it's no longer Defence Secretary.

Mr Makinde has seen fit to appoint me Foreign Secretary.

So you report to me now.

The Prime Minister wishes to pursue a more robust foreign policy.

And given the response to the Russian attack,

he has asked me to ensure that there are no repeats of

the failures of GCHQ in the past few weeks.

Three waves of unopposed Russian cyber attacks

and the loss of our and

the NSA's most highly confidential material.

So we're going to do something a little bit different.

From now on, GCHQ and MI6 will be directly answerable to me.

I would like to see this as an opportunity to reset relations.

I hope you do too. Of course, Foreign Secretary.

Good.

Good.

The search for a mole boils down to two simple questions.

Access and motive. We need to know who had access to the computer

and of those who did

who had motive to pass the Mac address to the Russians.

The computer in question served as a sandbox

for the Malware department for two years

and two months until the time of the attack.

Anyone in Malware or IT could have accessed the

Mac address in that time.

What about CCTV and logs? They're cycled every few months.

It would have taken six months at least

to build it into that malware and run the operation.

So those who only logged in for

the first time this year are off the hook.

That includes you.

But with thousands of log-ins 18 months before...

it does mean we're looking for a needle in a haystack.

But there's a record of every time

a Mac address is checked in the log files.

Date and time stamped. So we just need

to cross-reference those with who was logged in at the time.

Mm-hm. In that case, it's lucky I had IT

swap out the sandbox terminal and bring it here.

And the data of ours that was stolen?

Well, I've asked our Composite Signals side

to work on a full inventory assessment.

Nonetheless,

Cyber Security remains stretched to the limit.

Is there any evidence

that the Russians are aware yet of their data loss?

Uh, no. Trusov used UDP via Netcat.

He bounced via satellite. Several satellites, actually.

We can trace the route back because we know it's there.

That gives us a back door into the FSB.

Until they know there's a leak,

they won't be able to discover the route.

MI6 agents on the ground confirm there's

no clear evidence they're aware of the leak.

And while they are unaware, we can basically see their every move.

So the British public,

who have seen ample evidence of the Russian

attack on our streets and on our news,

they as yet have seen no sign of any actual response from us.

They no doubt think the Russians have won.

The Prime Minister has stated publicly

that he will take equal and proportionate action...

Excuse me, Foreign Secretary. A symmetric attack would

be highly escalatory and unpredictable.

In my opinion, it would be completely unnecessary.

We are assured by our colleagues here and in the US

that the opportunity to listen in on the FSB is priceless.

If we listen, we will listen robustly.

If we respond, we will respond robustly.

That is why I am seconding a team from

the 14th Signal Regiment and appointing their CEO,

Lieutenant Colonel Cavendish,

to the new post of Director of Rapid Reaction.

What's rapid reaction? You want to attack Russia?

You said you were short of expert staff.

These are experts.

Your minister is listening.

Thank you, gentlemen.

Danny.

You're still Director of Operations.

14th Signals? That's soldiers. They'll be offensive cyber.

And with their own director,

they'll be free to act independently.

And they'll still be answerable to me.

Yeah, it's just the first shot, David.

And with Marston as our boss now, frankly,

we are fucked. Everyone's on edge because of the attack.

When things calm down, we'll find a way through.

If Marston gets his way and attacks the Russians,

things are hardly going to calm down.

Our new minister seems to be gunning for you.

I understand David passed you the details for Vadim Trusov.

We're working on a plan. We'll take it to our new minister.

Marston, eh? We live in interesting times.

Robust times at least.

Yeah, well, thank you for Vadim. We owe him.

Must dash. Do give my best to Barbara, Danny.

Come on.

A gap.

I'm not sure I understand. It's really quite simple.

These are all the log-ins to the sandbox over an 18-month period.

The haystack. And this is a list

of the Mac address log-ins between

the 31st of July and the 1st of November 2022.

The records for the Mac address log-ins are missing.

You can see here...

where they've been erased or removed.

The FSB must have wiped them during the attack to protect their mole.

Well, at least we have those dates.

It also rules out anyone from IT.

IT check every computer every few months.

If it was one of them, then they'd have cover.

No need to wipe any records, so...

Saara, tomorrow I want you back with your malware colleagues.

I'm moving you all to the EMC

so I can personally oversee the response to the FSB attack,

and while we still have a back door into their system,

I want you to have a look for the stolen Mac log-ins.

OK? And before you ask, yes. I've spoken to MI6 about Vadim.

Thank you. I'll get started on that straight away.

If IT are ruled out, that means...

It means it must be someone from malware.

From our team.

Right, come on, come on. Last chopper out of Saigon.

Elliot!

Come on, mate. What have you been doing up there?

He's been in the bathroom,

making himself handsome like his dad.

RADIO: You're listening to This Morning Britain, and we'll have.

Prime Minister Andrew Makinde with us at ten-past.

PRIME MINISTER: Mr Putin can rest assured

the UK's alliance with the US is unbreakable,

and we're unshakeable

in our opposition to his territorial ambitions.

We will answer his recent attempts to undermine our infrastructure

in like and in kind.

But what I really want to talk about is China.

Oh, for God's sake. We are negotiating a trade deal.

What about their human rights record?

Exactly. Thank you. This is a deal

that will herald a second golden age in Sino-British relations.

Oh, God help us all.

Right, we have arrived at the juvenile correction facility.

Child locks, Mum. Yeah. I'll release you

when you bid your parents adieu in a civil manner.

BOTH: Bye, Mum. Bye, Dad. Love you.

RADIO: The UK Government is now considering how

to respond after one of the most significant Russian cyber attacks...

So... in recent history... Marston's mob arriving today? Mmm.

RADIO: concerns about the growing threat of cyber warfare...

Are you going to be back late?

I have no idea. But if I am, I'll get Charlie to give me a lift.

All right.

RADIO: They warned that if the UK launches

offensive cyber operations, Russia could retaliate

with even more severe attacks.

You know, don't give that place everything, Danny.

And impact citizens' everyday lives...

Leave some for us, hmm?

RADIO: So, as tensions rise...

I'll try... the Government faces a difficult choice.

How to protect national security without escalating

a dangerous cyber conflict?

Ms Napier. Thank you.

And you've got visitors, Mr Patrick. Uh... Oh, God.

That must be them. Go on.

Go be brilliant. I'll see you later.

Good morning.

Danny Patrick, Director of Operations, GCHQ.

Lieutenant Colonel Cavendish,

14th Royal Signals and Director of Rapid Reaction, GCHQ, it seems.

Well, welcome.

I thought you had quite a few service personnel here.

Uh, they only wear their uniforms on Military Monday,

so they probably think you're the firing squad come for me.

Maybe we are.

Morning.

Hi.

In all my time as head of China Team,

I've never seen such a fuss over a trade deal.

Oh, thank you, Lydia.

Mmm.

Economic and technical security reports.

God, they must have every asset reporting on this.

And the Department of Trade and Industry

want it all translated and synopsised by tomorrow.

HE SCOFFS I know, I know.

But it is our duty, our privilege, our joy, no less, to serve.

So, let's get to work. Calvin. Yes, ma'am.

I've sent you each your allocation to your desktop.

I've printed yours out, ma'am, as per. Oh, thank you.

"Secret report on the CCP activities in managed asset pools."

Hedge funds. My favourite. Let's give it our best shot, team.

Any idea why they moved us up here?

No, he didn't say.

Oh, look, Phil. Soldier boys. Your wet dream.

Yeah, some of us actually served, mate.

GCO, Afghan. Yeah.

Sat in a comms container for three months playing Minecraft.

The Event Management Centre

or EMC, where we'll all be based. Um, find a terminal.

IT will set you up with log-ins.

Yeah, we need to be accommodated together in our own space.

We'll just take that one. A hut. Isn't that what you call it?

Yeah... It's best if all the reverse engineers,

offensive cyber teams, and analysts are in one space,

so I can co-ordinate the response to the FSB attack.

I understand that you shall co-ordinate the clean-up operation

and damage assessment.

I, as Director of Rapid Reaction, shall co-ordinate said reaction.

Whatever offensive operation our minister orders.

That conference room looks sufficient for the time being.

We also try to foster a culture of civility.

Good morning, everyone.

I would like to introduce you to your new colleagues,

joining us from the 14th Signal Regiment

and our new Director of Rapid Reaction,

Lieutenant Colonel Cavendish. Roz, please.

Thank you, Danny.

Er, first, the uniforms.

Don't worry. Everyone gets it wrong first day.

CHUCKLES

Yeah, I appreciate there's a cultural difference here.

You like to listen, when you're not interrupting.

We like to act.

Hopefully, listening and acting do not prove mutually exclusive.

And the uniforms stay.

As you were, troops.

Max, Charlie Francis from Security would like a word.

OK, OK, let's crack on, shall we? We've got a whole

computer network to analyse for vulnerabilities

and damage and anything our Russian visitors may have left behind.

Let's have a good one.

Just a routine security sift, Max.

Given the scare,

those on high are jumpy and have asked me to check

that all security protocols have been, and are being, followed.

OK. No bother. Like all teams, you run a hot-desk policy?

All your programmers can log in on any computer? Mm-hm.

This applies to all machines, sandboxes included?

Yeah.

What happens if you need to leave your desk?

Well, then you log out.

We're, uh, we're pretty hot on that. Even for a quick pee?

You leave a machine logged in,

and someone comes along and doesn't know...

accidentally wipes all your work. Mmm. Or, you know,

spills coffee, whatever. So if someone, while they're logged in...

accessed something...

Like what? Anything.

Something on the system.

It would pretty much have to be through their own log-in?

Yes, I'd have thought so. Can you be 100% sure?

Well, no, but... 99%.

Is this about the attack?

Just answer the questions, please.

PHONE RINGS

Alex. Danny. We've got the sign-off

from Marston on the Vadim Trusov exfiltration.

That's good.

But, I'm afraid we've had word from Dutch intel.

They've had a sighting of Trusov. They've got a hack on the camera on

the FSB entrance in Saint Petersburg.

It's not good news. Needless to say, if they have him,

we can't proceed, and I imagine Vadim Trusov is in grave danger.

Does that mean they know we're inside their system?

There's no indication as yet.

But if the FSB have got him, it can only be a matter of time.

OK.

Where are they? Where's who?

The soldiers in the FSB system. I mean, this is all us.

What are they doing? They're soldiers.

They follow orders. They don't ask questions.

Maybe you should try it sometime.

Right after my next sarcasm lesson?

Looking for something?

They're rigging the FSB system to blow it up.

Excuse me. If we blow the system,

they'll find out how we got in and trace it back to Vadim.

Saara, go back to your station. Shall we?

Come in, Danny.

Lieutenant Colonel Cavendish.

I'm so sorry I wasn't able to greet you earlier.

Problem?

I am the Director of Operations.

I answer to the Foreign Secretary. I cannot answer to him

if there are operations being conducted behind my back.

My operation was ordered by the Foreign Secretary.

It has not been conducted behind your back, but in parallel.

Operation?

To mine and blow up the FSB system, and the Russians will retaliate.

It will end in World War III.

To install a comprehensive array of degrading effects

to trigger as and when we receive orders from our superiors.

We cannot have two chains of command in the one operations room.

We don't.

We have two parallel operations.

Our political masters will decide which one they wish to pursue.

In that case, I'll get back to what I was doing.

DOOR OPENS Danny, a moment.

I don't like it either but we cannot control the Government.

We can only advise.

After the last few weeks, Marston's going to be all over us.

You heard him.

We need to be seen to be running a steady ship.

And we need to find that mole.

Sally, can you get me Michaela Jones at the NSA, please?

Of course.

You're gonna let her do it, aren't you? Sorry.

What about Vadim?

It won't take them long to work out how we got in.

They're not going to blow it up. Not if I can help it.

But the news on Vadim is, um...

It's not so good, I'm afraid.

Hacked CCTV footage shows Vadim and other coders being led out of

the FSB headquarters in St Petersburg.

When? Same night he leaked us the material.

That's days ago.

He's only there because he helped us.

What will they be doing to him?

I don't know, Saara. I don't know.

MI6 believe that as long

as Vadim is in the hands of the Russian authorities...

They need to get him out. They won't be able to help him.

I'm sorry, Saara.

This is all my fault.

That's Michaela for you. Thank you, Sally.

Michaela. Dan.

We have a problem with Richard Marston.

He's been moved to Foreign, hasn't he?

Yeah. He's playing nice, as nice as he can.

But he's determined to live out his Churchillian fantasies.

So he's sent in his own dirty tricks team to blow up the FSB system.

Ah, shit. Greatest listening opportunity we've ever had

and he wants to piss it up the wall for the sake of his own ego.

How soon before his finger gets itchy?

Mmm, I don't know, but my guess is not long.

I'll talk to Perez. Thank you.

I'd like to work on the offensive cyber with you.

I don't want to imagine what they're doing to Vadim.

I just want to hurt them back.

I'm good at this.

Yeah, start on the comms code.

Then... we'll see.

I'll be watching.

KNOCK AT DOOR Come in.

DOOR OPENS

You're working with them now, are you?

You told me to look

for our missing Mac log-in data in the FSB system.

Otherwise she'd see me in there.

I'm impressed.

And?

Nothing. Not even a trace. And there's no sign

of any data they stole from us in their system.

NOTIFICATION CHIME Sorry, Saara, I've got to take this.

HE CLEARS THROAT

General Perez, sir.

You have two minutes.

I appreciate I'm speaking out of turn,

but I felt you should know our listening operation against

the FSB is in danger, and not from the Russians.

Night, Dave. See you.

PHONE NOTIFICATION CHIME

Pub?

Thanks. I don't really do pubs.

So, what did old Checkpoint Charlie want?

Just routine, he said.

But he was asking a lot of questions about our sandboxes.

Really? Phil? Changed your mind?

Do you know a game called End of Daze?

Yeah, it's, uh... Horizon Zero Dawn with a touch of Zelda.

Phil's Mr Gamer. The rougher the dystopia,

the more he enjoys it.

I just need to know how to get into the Discord chat.

Well... You'll be sorry you asked.

Let's see.

Yeah. You need to switch those around.

I swear, if one of you ever goes behind my back to

the Yanks like that again,

I will see to it that you're charged with treason.

If I may, Foreign Secretary, to function effectively

as a government intelligence gathering institution,

there can be no going behind anyone's back.

I had hoped this could be a new beginning.

He means that we understand fully and unequivocally.

Just to be clear,

we're not triggering the degrading effects.

That is correct, Lieutenant Colonel, we are not triggering them...

yet.

How are the interviews going?

Nothing jumping out.

They're a pretty clean bunch, your coders.

They just busted their guts turning this thing around.

For one of them to be the cause of it...

oh, man, that'd just break my heart.

I pity them.

Nobody wakes up in the morning and says,

"Today I'm going to betray"

"my colleagues, my friends, my family, my country."

Sometimes they're believers,

but usually they've been got to.

Love, sex, blackmail.

By the time we get to them, they're in the worst place in the world.

But don't worry, Dan. We'll find the mole.

Clock's ticking.

TYPING

What are you doing?

Subtitles by Red Bee Media