1 00:03:43,800 --> 00:03:46,400 Well done, Gabriel. 2 00:03:46,440 --> 00:03:49,320 I think that's the fastest it's ever been done. 3 00:03:49,360 --> 00:03:50,440 Congratulations. 4 00:04:39,200 --> 00:04:40,520 {\an8}I like your pens. 5 00:04:41,480 --> 00:04:43,040 {\an8}They are in spectrum order. 6 00:04:44,080 --> 00:04:46,119 And before you say that pink is in the wrong place, 7 00:04:46,120 --> 00:04:47,879 pink has nothing to do with red. 8 00:04:47,880 --> 00:04:50,120 It's actually white absent green. 9 00:04:54,400 --> 00:04:56,400 Well done on the challenge. 10 00:04:56,440 --> 00:04:58,720 They are obviously going to take you. 11 00:04:59,520 --> 00:05:01,799 You were incredibly fast. 12 00:05:01,800 --> 00:05:04,759 If we're going to talk, I should warn you, I'm not very good at noticing 13 00:05:04,760 --> 00:05:06,959 when people want to speak or change the subject. 14 00:05:06,960 --> 00:05:10,320 So, the conversation could last a half an hour or several days. 15 00:05:10,360 --> 00:05:11,640 It's OK. It's OK. 16 00:05:14,000 --> 00:05:15,600 I'm Saara, by the way. 17 00:05:19,080 --> 00:05:20,200 I'm Gabriel. 18 00:05:45,560 --> 00:05:48,120 {\an8}- It's high time... - Hello, Ami. 19 00:05:48,920 --> 00:05:51,520 {\an8}Oh, my God. What are you doing here? 20 00:05:52,800 --> 00:05:55,159 Why didn't you ring? Is everything OK? 21 00:05:55,160 --> 00:05:57,160 I'm fine. I was just passing. 22 00:05:57,200 --> 00:05:59,720 Just passing? What are you talking about? 23 00:05:59,760 --> 00:06:01,440 London's over an hour away. 24 00:06:02,560 --> 00:06:04,720 - You'll stay for some... - Where's Abu? 25 00:06:04,760 --> 00:06:07,160 Sorry. Is he still at work? 26 00:06:09,040 --> 00:06:10,200 He is in his den. 27 00:06:12,320 --> 00:06:13,600 He's off work again. 28 00:06:41,800 --> 00:06:42,960 Abu? 29 00:06:44,680 --> 00:06:45,760 Hey! 30 00:06:47,280 --> 00:06:50,360 So... have you heard? 31 00:06:50,880 --> 00:06:52,200 I got it. 32 00:06:52,240 --> 00:06:53,319 Ah. 33 00:06:55,600 --> 00:06:57,400 Ah, yes. 34 00:06:59,320 --> 00:07:02,919 You haven't told your mother? You know she wouldn't understand. 35 00:07:02,920 --> 00:07:03,999 Of course not. 36 00:07:04,000 --> 00:07:05,960 They don't know anything about it. 37 00:07:06,360 --> 00:07:07,560 Good. 38 00:07:08,320 --> 00:07:09,800 {\an8}Come. Sit. Sit. 39 00:07:11,600 --> 00:07:14,560 Mum said you are off work again, Abu. Are you OK? 40 00:07:14,600 --> 00:07:17,440 I'm fine. I was a bit down, but I'm fine now. 41 00:07:17,480 --> 00:07:18,680 I'll be back on Monday. 42 00:07:20,000 --> 00:07:22,360 Down like last time? 43 00:07:22,400 --> 00:07:24,520 No, nothing like that. 44 00:07:24,560 --> 00:07:26,840 Anyway, when I see you, I feel better. 45 00:07:27,360 --> 00:07:28,720 How long can you stay? 46 00:07:30,400 --> 00:07:34,000 I'm sorry, Abu... I have to get back tonight. 47 00:07:34,040 --> 00:07:35,640 You have got classes in the morning. 48 00:07:36,200 --> 00:07:37,200 I'm really sorry. 49 00:07:37,240 --> 00:07:38,640 Oh, don't be ridiculous. 50 00:07:38,680 --> 00:07:40,200 Classes are important. 51 00:07:40,920 --> 00:07:42,880 But you have time for a quick game? 52 00:07:45,480 --> 00:07:47,319 - Of course. - Excellent! 53 00:07:59,160 --> 00:08:03,640 {\an8}You do think it's OK, Abu, what I'm doing. 54 00:08:03,680 --> 00:08:08,440 Oh, this girl... You'll be spending a year learning to defend our country, 55 00:08:08,480 --> 00:08:11,160 and at the end, you go back to university. 56 00:08:11,960 --> 00:08:14,400 What could be wrong with that? Huh? 57 00:08:19,080 --> 00:08:20,600 Ha! 58 00:08:51,760 --> 00:08:54,480 {\an8}Hey. You'll be brilliant. 59 00:09:27,760 --> 00:09:29,639 Yeah. 60 00:09:29,640 --> 00:09:33,040 We're in. Happy for us to move to the next step? 61 00:09:37,560 --> 00:09:40,760 - Go. - OK, let's get some resilience. 62 00:09:41,760 --> 00:09:42,679 They're inside. 63 00:09:42,680 --> 00:09:45,119 - They've broken in. - How? 64 00:09:45,120 --> 00:09:48,480 It doesn't matter how. We'll work it out later. Get going. 65 00:09:49,160 --> 00:09:50,680 {\an8}I want them out. 66 00:09:50,720 --> 00:09:52,680 {\an8}I told you this is a bad idea. 67 00:10:17,640 --> 00:10:21,120 We've accessed credentials for your Ops and Management system. 68 00:10:21,160 --> 00:10:22,600 - What? - OK to proceed? 69 00:10:23,520 --> 00:10:26,560 They've got the passwords. They're about to log in. 70 00:10:26,600 --> 00:10:27,760 Wait. 71 00:10:28,240 --> 00:10:29,279 Zahir? 72 00:10:31,320 --> 00:10:32,400 Zahir? 73 00:10:33,400 --> 00:10:36,040 I'm seeing red lights, Tahmid. What's going on? 74 00:10:38,240 --> 00:10:39,880 We're down. 75 00:10:39,920 --> 00:10:42,480 What the fuck... 76 00:10:43,480 --> 00:10:44,760 What did you do? 77 00:10:45,880 --> 00:10:47,080 Er, nothing. 78 00:10:47,120 --> 00:10:49,400 {\an8}We're just logging into the system now. 79 00:10:58,240 --> 00:10:59,360 Finn? 80 00:11:06,360 --> 00:11:08,280 Yeah, er, looks like the Internet. 81 00:11:08,320 --> 00:11:10,200 What do you mean, "the Internet"? 82 00:11:10,240 --> 00:11:11,480 I think we are offline. 83 00:11:11,520 --> 00:11:12,720 Cannot be. 84 00:11:13,720 --> 00:11:15,439 Do you know what? Pull out now. 85 00:11:15,440 --> 00:11:18,400 I want you completely disconnected from our estate. 86 00:11:20,360 --> 00:11:22,760 Hey, my line just went down. What's going on? 87 00:11:22,800 --> 00:11:24,240 You'd better get up here. 88 00:11:31,000 --> 00:11:32,520 Sorry to keep you waiting. 89 00:11:32,960 --> 00:11:34,160 I'm Max. 90 00:11:34,200 --> 00:11:35,040 Hi. 91 00:11:35,080 --> 00:11:37,160 Er, we're not shaking hands at the moment. 92 00:11:37,200 --> 00:11:40,200 Oh. Of course. Sorry. 93 00:11:40,840 --> 00:11:42,120 Welcome to GCHQ. 94 00:11:55,720 --> 00:11:56,839 Tell me. 95 00:11:56,840 --> 00:11:58,120 We have a serious problem. 96 00:11:58,160 --> 00:12:01,200 Your stress test just took down half our infrastructure. 97 00:12:01,240 --> 00:12:03,240 Whatever you did, you need to undo it right now, 98 00:12:03,280 --> 00:12:05,760 before it starts to impact on public safety. 99 00:12:05,800 --> 00:12:07,599 - Rich? - Can't be us, boss. 100 00:12:07,600 --> 00:12:09,879 We never got beyond the admin platform. 101 00:12:11,240 --> 00:12:12,320 OK. 102 00:12:22,160 --> 00:12:24,560 Sorry, I'm totally overdressed. 103 00:12:25,040 --> 00:12:26,480 Oh, don't worry. 104 00:12:26,520 --> 00:12:28,880 We all make that mistake on our first day. 105 00:12:29,720 --> 00:12:31,760 We're very glad to have you. 106 00:12:31,800 --> 00:12:35,040 As you can see, we're hideously male, stale and pale. 107 00:12:36,200 --> 00:12:37,280 Sorry? 108 00:12:38,080 --> 00:12:39,240 Old and white. 109 00:12:40,520 --> 00:12:41,680 Like me. 110 00:12:46,640 --> 00:12:48,760 I hope that's not why you picked me. 111 00:12:50,520 --> 00:12:52,240 Because I've got a brown face. 112 00:12:53,680 --> 00:12:54,880 No, of course not. 113 00:12:56,400 --> 00:12:57,680 Where are you going? 114 00:12:57,720 --> 00:12:59,040 We've been summoned. 115 00:13:01,960 --> 00:13:03,160 Why don't you come? 116 00:13:04,200 --> 00:13:06,040 You might find this interesting. 117 00:13:08,400 --> 00:13:12,679 Erm, BT Openreach provides the infrastructure for most of the UK's Internet. 118 00:13:12,680 --> 00:13:15,879 At 0907 this morning, whilst we were stress-testing their systems, 119 00:13:15,880 --> 00:13:19,240 they experienced a partial shutdown, impacting as far as we can tell, 120 00:13:19,280 --> 00:13:22,079 about 55% of Internet provision. 121 00:13:22,080 --> 00:13:25,040 Oh, Chrissie, have you met Max? He is our head of malware. 122 00:13:25,080 --> 00:13:26,080 Hi, how you doing? 123 00:13:26,120 --> 00:13:28,160 Now, erm, we're still checking, obviously, 124 00:13:28,200 --> 00:13:32,480 but so far it looks like National Grid's ICS is OK. 125 00:13:32,520 --> 00:13:33,680 Same with gas and water. 126 00:13:33,720 --> 00:13:34,839 Rail signalling is down... 127 00:13:34,840 --> 00:13:36,759 Are you sure it's OK for me to be here? 128 00:13:36,760 --> 00:13:38,440 Why not? 129 00:13:38,480 --> 00:13:40,320 You're DV cleared, aren't you? 130 00:13:40,360 --> 00:13:41,840 Air Traffic Control is still up, 131 00:13:41,880 --> 00:13:43,799 but it seems most of the flights have stopped 132 00:13:43,800 --> 00:13:47,000 because they use the Internet to control aircraft on the ground. 133 00:13:47,040 --> 00:13:50,480 Er, online banking is down and some of their core comms are affected, 134 00:13:50,520 --> 00:13:53,080 so most of the cash machines are offline. 135 00:13:53,120 --> 00:13:54,960 What about smartphones? 136 00:13:55,000 --> 00:13:56,920 Sorry, Caroline Fitch, Number 10. 137 00:13:56,960 --> 00:13:59,199 Chrissie, can smartphones get online? 138 00:13:59,200 --> 00:14:01,560 Chrissie is head of security at BT. 139 00:14:01,600 --> 00:14:02,879 Yeah, as far as we can tell. 140 00:14:02,880 --> 00:14:05,440 But a lot of the systems, their access are affected, 141 00:14:05,480 --> 00:14:07,600 so there's not much they can do. 142 00:14:08,040 --> 00:14:09,279 Erm, 143 00:14:09,280 --> 00:14:11,120 some of the big email servers are down. 144 00:14:11,160 --> 00:14:15,640 There's no Zoom, no Teams, which has taken out all the new hospital appointments. 145 00:14:15,680 --> 00:14:17,120 Er, there's no online shopping. 146 00:14:17,160 --> 00:14:21,240 But, er, social media is unaffected, interestingly. 147 00:14:21,280 --> 00:14:22,880 All in all, quite cleverly targeted 148 00:14:22,920 --> 00:14:26,959 to cause significant disruption without actually putting that many lives at risk. 149 00:14:26,960 --> 00:14:28,640 So, it's a cyber attack? 150 00:14:28,680 --> 00:14:30,039 That's what you're saying? 151 00:14:30,040 --> 00:14:31,280 We think so. Yeah. 152 00:14:31,320 --> 00:14:34,080 Virgin was also affected, which rules out the stress test 153 00:14:34,120 --> 00:14:36,800 as the cause or any hardware problems within BT. 154 00:14:36,840 --> 00:14:40,160 That only leaves malware, and using the stress-test as a cover. 155 00:14:40,200 --> 00:14:41,600 Can I jump in? 156 00:14:42,640 --> 00:14:44,560 Er, yeah, go ahead. 157 00:14:44,600 --> 00:14:48,999 Kathy is one of our analysts, on attachment from the NSA. 158 00:14:49,000 --> 00:14:51,600 So, the Russian bots are already retweeting, 159 00:14:51,640 --> 00:14:54,559 and it is mostly about how all the ATMs are down. 160 00:14:54,560 --> 00:14:58,039 Er, "Another fuck-up by this shit-for-brains government." 161 00:14:58,040 --> 00:15:01,639 "Just another scam by the elite to steal our money." 162 00:15:01,640 --> 00:15:03,920 "The bankers are screwing us over again." 163 00:15:03,960 --> 00:15:05,560 Yada-yada. 164 00:15:05,600 --> 00:15:08,480 It's a bit quick, don't you think? 165 00:15:10,480 --> 00:15:12,960 I mean, it's almost like they knew it was coming. 166 00:15:38,280 --> 00:15:39,400 Thanks. 167 00:15:50,840 --> 00:15:52,080 So is that it? 168 00:15:52,640 --> 00:15:53,960 The malware. 169 00:15:54,880 --> 00:15:55,960 Yep. 170 00:15:56,840 --> 00:15:58,280 Mind if I take a look? 171 00:17:21,800 --> 00:17:23,640 What's all this garbage? 172 00:17:28,120 --> 00:17:29,480 I don't understand. 173 00:17:30,280 --> 00:17:32,160 It's obfuscated. 174 00:17:32,200 --> 00:17:34,760 Some kind of FinFisher thing. 175 00:17:40,640 --> 00:17:42,880 - Hey. - It's, er, Kathy, right? 176 00:17:42,920 --> 00:17:46,320 Yeah. Erm, NSA would like to take a look at the code. 177 00:17:47,080 --> 00:17:49,040 Well, has Danny approved it? 178 00:17:49,600 --> 00:17:52,200 Well, he told me to update them. 179 00:17:52,240 --> 00:17:54,880 Yeah, but did he say that you could give them the code? 180 00:17:56,320 --> 00:17:58,880 So you want me to walk all the way back down the hall? 181 00:17:58,920 --> 00:18:00,560 - Really? - Absolutely. 182 00:18:01,600 --> 00:18:03,320 That's the way we do it here. 183 00:18:11,160 --> 00:18:13,839 You do know that they're only trying to help. 184 00:18:13,840 --> 00:18:16,200 We're on the same team, guys. 185 00:18:19,560 --> 00:18:21,079 51st State. 186 00:18:26,880 --> 00:18:29,560 - You see these jumps? - Mmhmm. 187 00:18:29,600 --> 00:18:31,599 They hop over the garbage. 188 00:18:31,600 --> 00:18:33,519 Oh, so it's never actually read. 189 00:18:33,520 --> 00:18:34,760 That's right. 190 00:18:36,400 --> 00:18:37,720 So what's it there for? 191 00:18:37,760 --> 00:18:40,119 To confuse the look of the code 192 00:18:40,120 --> 00:18:44,080 so the anti-virus software won't recognise it as malware. 193 00:18:44,920 --> 00:18:47,520 OK. How do we get around it? 194 00:18:48,720 --> 00:18:51,800 We find a reverser that locates all the garbage, 195 00:18:51,840 --> 00:18:54,920 and then we write a program to delete it. 196 00:18:54,960 --> 00:18:57,039 Is that what you're doing now? 197 00:18:57,040 --> 00:18:59,600 - Amongst other things. - Can I help? 198 00:18:59,960 --> 00:19:01,120 No. 199 00:19:04,800 --> 00:19:06,920 So what do you want me to do? 200 00:19:10,240 --> 00:19:12,480 We have a test environment. 201 00:19:12,960 --> 00:19:14,279 Do you mean a sandbox? 202 00:19:14,280 --> 00:19:17,200 Paste in the code and see if you can get it to run in there. 203 00:19:17,240 --> 00:19:20,400 It's isolated, so you can't do any harm. 204 00:19:20,440 --> 00:19:22,640 And we might learn something. 205 00:19:24,400 --> 00:19:26,880 I'd really prefer to help with the reversing. 206 00:19:34,720 --> 00:19:37,240 Danny. It's the Foreign Secretary. 207 00:19:39,600 --> 00:19:42,560 Well, can we schedule a conversation before then? 208 00:19:42,600 --> 00:19:43,800 Yes, I'd like that. 209 00:19:44,840 --> 00:19:45,960 Thanks. 210 00:19:47,880 --> 00:19:48,920 Elizabeth. 211 00:19:48,960 --> 00:19:50,240 How are you holding up? 212 00:19:50,280 --> 00:19:54,200 Er, I have had better days. And nights. 213 00:19:54,240 --> 00:19:56,200 Interesting timing, don't you think? 214 00:19:56,240 --> 00:19:58,280 Right in the middle of an election campaign. 215 00:19:58,320 --> 00:20:00,320 Yeah. Will it have much of an impact? 216 00:20:00,360 --> 00:20:02,240 People not being able to get online? 217 00:20:02,280 --> 00:20:05,760 Absolutely. Feeds straight into the populist agenda. 218 00:20:05,800 --> 00:20:08,760 The government's crap, can't organise a piss up in a brewery. 219 00:20:08,800 --> 00:20:11,040 Plus, Labour does most of its campaigning online, 220 00:20:11,080 --> 00:20:14,040 so the Internet going down looks very convenient for us. 221 00:20:14,080 --> 00:20:16,279 So now we're corrupt as well as incompetent. 222 00:20:17,320 --> 00:20:19,159 Anyway, where are we? 223 00:20:19,160 --> 00:20:23,120 Er, we are currently about 35% restored. 224 00:20:23,160 --> 00:20:24,520 It's not straightforward, unfortunately. 225 00:20:24,560 --> 00:20:28,360 There's a lot of anti-debugging tricks in the code, so. 226 00:20:28,400 --> 00:20:31,640 I imagine you're assuming it's Russia. 227 00:20:31,680 --> 00:20:37,400 Well, as you know, we try to avoid making attributions prematurely. 228 00:20:37,440 --> 00:20:38,640 Erm, anything in the code, 229 00:20:38,680 --> 00:20:41,480 which suggests a particular team could be a misdirection. 230 00:20:41,520 --> 00:20:43,400 And as soon as we point the finger, 231 00:20:43,440 --> 00:20:48,680 {\an8}then there's pressure to retaliate and we're into tit-for-tat escalation. 232 00:20:48,720 --> 00:20:50,720 But what's your gut? 233 00:20:55,080 --> 00:20:58,240 That it's probably Russia, most likely FSB. 234 00:20:58,440 --> 00:20:59,560 OK. 235 00:20:59,600 --> 00:21:02,000 Because according to our embassy in Moscow, 236 00:21:02,040 --> 00:21:06,799 the lights have been flashing on and off in Putin's office for the last half hour. 237 00:21:06,800 --> 00:21:08,560 Really? 238 00:21:08,600 --> 00:21:11,320 - So that's nothing to do with you then? - No. 239 00:21:11,360 --> 00:21:14,920 But, erm, if it's true, then that's pretty funny. 240 00:21:14,960 --> 00:21:16,120 Yes, hysterical. 241 00:21:16,160 --> 00:21:18,799 As long as it's not us or anyone acting as our proxy, 242 00:21:18,800 --> 00:21:21,720 - can you check, please, Danny? - Yes. 243 00:21:39,160 --> 00:21:41,040 I don't understand. 244 00:21:41,080 --> 00:21:44,200 it ran inside BT's computers. Why won't it run here? 245 00:21:45,800 --> 00:21:50,039 You can write malware, so it knows when it's in a sandbox. 246 00:21:50,040 --> 00:21:52,760 It searches for normal computer activity. 247 00:21:52,800 --> 00:21:55,600 If it can't find any, it deactivates. 248 00:21:55,640 --> 00:21:57,320 {\an8}Is there a workaround? 249 00:22:00,400 --> 00:22:03,040 You could paste in some Word documents, 250 00:22:03,480 --> 00:22:04,880 scroll around a bit. 251 00:22:04,920 --> 00:22:07,559 That could make it think that it's in a real environment, 252 00:22:07,560 --> 00:22:09,480 but it's not always a guarantee. 253 00:22:09,520 --> 00:22:10,840 Can I use this? 254 00:22:12,280 --> 00:22:14,080 Do you always change the subject like that? 255 00:22:15,320 --> 00:22:16,760 - Sorry, I... - Why do you need it? 256 00:22:16,800 --> 00:22:19,160 If there's something you don't understand, you can just ask me. 257 00:22:19,200 --> 00:22:20,640 It's not about work. 258 00:22:20,680 --> 00:22:22,120 I need to make an outside call. 259 00:22:22,160 --> 00:22:25,120 I didn't know they were going to take my phone off me at reception. 260 00:22:25,800 --> 00:22:28,920 Yeah, it's nine, and then the number. 261 00:22:29,840 --> 00:22:32,560 Paste in those Word documents, all right? 262 00:22:38,120 --> 00:22:40,600 Prime Minister, throughout this election campaign, 263 00:22:40,640 --> 00:22:42,039 you made a great deal of the fact 264 00:22:42,040 --> 00:22:43,960 that you are Britain's first Black Prime Minister 265 00:22:44,000 --> 00:22:46,440 and that you understand ordinary working people. 266 00:22:46,480 --> 00:22:49,960 But your father was an incredibly wealthy Nigerian businessman. 267 00:22:50,000 --> 00:22:53,480 and you spent your childhood in one of Britain's top public schools. 268 00:22:53,520 --> 00:22:55,480 Come on, Campbell, not that old chestnut. 269 00:22:55,520 --> 00:22:58,719 Look, I don't think that's what people are worrying about at all. 270 00:22:58,720 --> 00:23:02,520 - I think they're worrying about... - Isn't it, Prime Minister? 271 00:23:02,560 --> 00:23:04,760 This country's in the middle of the deepest recession... 272 00:23:04,800 --> 00:23:08,760 Hello, this is Ahmed. Please leave a message after the tone. 273 00:23:09,280 --> 00:23:10,720 Thank you. 274 00:23:18,520 --> 00:23:20,520 Hi, Abu. Er, it's me. 275 00:23:20,560 --> 00:23:22,920 Just checking in to see how you're feeling. 276 00:23:22,960 --> 00:23:27,599 You can't really ring me back here, but I'll try again later. 277 00:23:27,600 --> 00:23:30,680 - Love you. - I don't know what you're implying, Campbell, 278 00:23:30,720 --> 00:23:32,160 but I live here too, 279 00:23:32,200 --> 00:23:36,520 and this recession has nothing to do with Brexit, which is a huge success. 280 00:23:37,280 --> 00:23:38,640 Kathy, have you got a moment? 281 00:23:38,680 --> 00:23:40,000 Sure. What do you need? 282 00:23:40,040 --> 00:23:42,000 Er, the "Jolly Roger"? 283 00:23:43,160 --> 00:23:44,680 Jolly Roger. 284 00:23:50,480 --> 00:23:53,039 "You've been Rogered." 285 00:23:53,040 --> 00:23:54,160 Subtle. 286 00:23:56,640 --> 00:23:57,840 Oh. 287 00:23:57,880 --> 00:24:01,559 He blames Russia for the attack and he says that he's retaliating. 288 00:24:01,560 --> 00:24:04,120 Calls himself "the patriotic hacker." 289 00:24:04,880 --> 00:24:07,039 Right. That's all we need. 290 00:24:07,040 --> 00:24:08,040 Yeah. 291 00:24:08,080 --> 00:24:09,680 This has nothing to do with any of you? 292 00:24:09,720 --> 00:24:12,639 - No. No. Not at all. Nothing. - No? No one's encouraged him? 293 00:24:12,640 --> 00:24:14,559 Well. 294 00:24:14,560 --> 00:24:16,400 How do you think he knows that it's Russia? 295 00:24:17,160 --> 00:24:19,320 He doesn't. He's just grandstanding. 296 00:24:19,360 --> 00:24:21,199 But this is all anyone's going to remember. 297 00:24:21,200 --> 00:24:23,399 When we come out with the official attribution, 298 00:24:23,400 --> 00:24:25,039 no-one's going to be listening. 299 00:24:26,360 --> 00:24:29,920 - All right, thanks, Kathy. - Oh, er, did you get my message? 300 00:24:29,960 --> 00:24:31,399 Er, no, I don't think I did? 301 00:24:31,400 --> 00:24:34,160 NSA's asked to see the malware code. Is that cool? 302 00:24:34,200 --> 00:24:35,640 Er, yeah. Why not? 303 00:24:36,360 --> 00:24:38,479 - Thanks. - So, what's the problem? 304 00:24:38,480 --> 00:24:40,440 - No, there's no problem. - OK. 305 00:24:40,480 --> 00:24:43,480 Almost certainly not the image party election managers 306 00:24:43,520 --> 00:24:45,279 wanted on your TV screens tonight. 307 00:24:45,280 --> 00:24:49,559 The Prime Minister being aggressively heckled while campaigning in Bristol. 308 00:24:49,560 --> 00:24:55,479 And, as a precaution, I'll be chairing a COBR meeting on Sunday at 10:00 a.m. 309 00:24:55,480 --> 00:24:56,880 In the meantime... 310 00:24:56,920 --> 00:24:58,479 In the meantime, 311 00:24:58,480 --> 00:25:03,159 in the face of this criminal and unprovoked cyber attack, 312 00:25:03,160 --> 00:25:07,480 I have instructed security forces to do whatever is necessary 313 00:25:07,520 --> 00:25:09,400 to find out who's responsible. 314 00:25:10,600 --> 00:25:14,960 To ensure your services and access to your bank account 315 00:25:15,000 --> 00:25:19,080 and your hard-earned savings are absolutely safe... 316 00:25:20,920 --> 00:25:22,800 Thank you. Thank you. 317 00:25:30,200 --> 00:25:31,600 Extraordinary scenes here. 318 00:25:31,640 --> 00:25:33,439 The Prime Minister has rarely been seen 319 00:25:33,440 --> 00:25:36,839 outside the Westminster bubble since, as a junior minister, 320 00:25:36,840 --> 00:25:39,440 not even in the Cabinet, he ousted Boris Johnson 321 00:25:39,480 --> 00:25:42,800 in a particularly bloody "palace coup" 15 months ago. 322 00:25:42,840 --> 00:25:46,919 But with the Conservatives running six points behind in the polls, 323 00:25:46,920 --> 00:25:49,680 this campaign is confronting him with a very real anger 324 00:25:49,720 --> 00:25:51,480 some feel about the economic crisis. 325 00:25:51,520 --> 00:25:56,520 And just how deep the disillusionment with authority in general now runs. 326 00:27:43,480 --> 00:27:44,640 Phil. 327 00:27:45,760 --> 00:27:47,560 I still couldn't get it to run in the sandbox, 328 00:27:47,600 --> 00:27:51,160 so I thought I'd take a look at the code itself. 329 00:27:51,200 --> 00:27:55,080 I hope you don't mind. I think I might've found something. 330 00:28:11,360 --> 00:28:13,720 Well, that's OK. We've all done it. 331 00:28:14,560 --> 00:28:16,040 Done what? 332 00:28:16,080 --> 00:28:18,080 Tried to reverse a library. 333 00:28:18,680 --> 00:28:20,840 It's boilerplate code. 334 00:28:20,880 --> 00:28:22,880 It's just there to avoid the coder having to write 335 00:28:22,920 --> 00:28:25,199 some common functions from scratch. 336 00:28:25,200 --> 00:28:27,040 It's the one that you don't need to bother reversing. 337 00:28:27,080 --> 00:28:29,000 I know what a library is. 338 00:28:29,040 --> 00:28:31,640 {\an8}I think there's something else hidden in there. 339 00:28:40,840 --> 00:28:43,360 Probably thought we wouldn't bother checking. 340 00:29:01,720 --> 00:29:02,839 Saara found it. 341 00:29:02,840 --> 00:29:05,160 One of our work-experience students. 342 00:29:08,080 --> 00:29:09,240 Thanks. 343 00:29:14,360 --> 00:29:15,600 It's a dropper, right? 344 00:29:15,640 --> 00:29:17,439 Yeah. Tiny. 345 00:29:17,440 --> 00:29:19,880 That's why we missed it the first time round. 346 00:29:19,920 --> 00:29:22,040 If you run it, it raises a flag. 347 00:29:22,080 --> 00:29:23,320 What's the flag? 348 00:29:24,520 --> 00:29:25,600 Saara? 349 00:29:28,120 --> 00:29:30,000 Er, a "like" 350 00:29:31,080 --> 00:29:33,720 on this Facebook page. 351 00:29:33,760 --> 00:29:37,119 I suppose someone somewhere must be monitoring it. 352 00:29:37,120 --> 00:29:38,999 It's a tripwire. 353 00:29:39,000 --> 00:29:40,120 If they see a "like" on the story, 354 00:29:40,160 --> 00:29:41,599 then they know we've downloaded the payload. 355 00:29:41,600 --> 00:29:44,120 I presume you've managed to pull it down without tripping it. 356 00:29:44,160 --> 00:29:45,400 - I think so. - And? 357 00:29:45,440 --> 00:29:48,200 I'm not sure yet. It's obfuscated like the last one. 358 00:29:57,880 --> 00:29:58,839 Danny. 359 00:29:58,840 --> 00:30:01,279 There's a second virus hidden inside the first. 360 00:30:01,280 --> 00:30:04,159 I think we should upgrade to a Level One attack. 361 00:30:04,160 --> 00:30:06,880 - Level One? Really? - Yeah, I think so. 362 00:30:06,920 --> 00:30:08,399 This degree of sophistication. 363 00:30:08,400 --> 00:30:10,039 And maybe we should call JSTAT, 364 00:30:10,040 --> 00:30:12,400 get them to raise the threat level to critical. 365 00:30:12,440 --> 00:30:14,400 We don't know what this new one does yet. 366 00:30:15,120 --> 00:30:17,080 OK, I'll call Number 10. 367 00:30:17,120 --> 00:30:19,399 Thanks. Right. Shut it down. 368 00:30:19,400 --> 00:30:22,040 OK, and find out what it was meant to do. Quick as you can. 369 00:30:22,080 --> 00:30:23,320 Yes. Got it. 370 00:30:24,960 --> 00:30:26,200 Well done, Saara. 371 00:30:33,160 --> 00:30:34,320 Excuse me. 372 00:30:45,000 --> 00:30:46,720 - Hi. - Where are you? 373 00:30:46,760 --> 00:30:48,200 Why didn't you call back? 374 00:30:48,240 --> 00:30:49,400 Why? What's wrong? 375 00:30:50,000 --> 00:30:51,920 Abu's had an accident... 376 00:30:53,200 --> 00:30:54,360 on the tracks. 377 00:30:54,800 --> 00:30:55,800 What? 378 00:30:55,840 --> 00:30:57,160 He's in the hospital. 379 00:30:57,560 --> 00:30:59,000 You need to come. 380 00:30:59,360 --> 00:31:00,480 I can't. 381 00:31:00,960 --> 00:31:02,120 Not right now. 382 00:31:02,160 --> 00:31:04,639 - Just... - He's asking for you, Saar. 383 00:31:04,640 --> 00:31:06,359 You need to get back here. 384 00:31:06,360 --> 00:31:07,200 I will. 385 00:31:07,240 --> 00:31:09,200 I'll get a train as soon as this is done. 386 00:31:09,240 --> 00:31:11,880 - I'll be there soon. - Pass please, ma'am. 387 00:31:11,920 --> 00:31:14,120 Thought we'd lost you. Are you OK? 388 00:31:15,040 --> 00:31:16,240 My dad's not well. 389 00:31:17,400 --> 00:31:18,680 Do you need to go? 390 00:31:20,080 --> 00:31:21,240 No, it's OK. 391 00:31:27,960 --> 00:31:29,960 Plug in, they're about to start. 392 00:31:35,760 --> 00:31:36,920 Saara. 393 00:31:37,640 --> 00:31:39,040 Do you want to follow me? 394 00:31:39,320 --> 00:31:40,560 Go on, then. 395 00:31:40,600 --> 00:31:42,920 Leave it. You won't need it. 396 00:32:01,960 --> 00:32:02,960 Andy. 397 00:32:03,000 --> 00:32:05,600 Good to see you. We'll catch up after the meeting. 398 00:32:06,880 --> 00:32:08,720 Home Secretary, nice to see you. 399 00:32:13,600 --> 00:32:15,840 Do you wanna sit down? Sit there. 400 00:32:35,480 --> 00:32:38,400 As you all know, from the CRIP, we've located the malware 401 00:32:38,440 --> 00:32:41,880 within BT's systems and with some round the clock work, 402 00:32:41,920 --> 00:32:45,680 its code has been 70% reverse engineered. 403 00:32:45,720 --> 00:32:47,200 Based on what we've learned, 404 00:32:47,240 --> 00:32:49,439 I'm confident we can have most of the Internet 405 00:32:49,440 --> 00:32:51,680 back up and running by midnight tonight. 406 00:32:51,720 --> 00:32:53,159 Good. 407 00:32:53,160 --> 00:32:56,479 Er, as far as we can tell, this virus has never been seen in the wild before. 408 00:32:56,480 --> 00:32:59,880 Which means it was specially written to take down sections of the BT 409 00:32:59,920 --> 00:33:02,840 and Virgin infrastructures, which is quite a feat, 410 00:33:02,880 --> 00:33:05,080 considering the built-in safety features. 411 00:33:05,120 --> 00:33:08,480 Perhaps most notably, it doesn't seem to be communicating 412 00:33:08,520 --> 00:33:12,040 with any sort of home base, which is, erm, unusual. 413 00:33:12,080 --> 00:33:13,199 Really? 414 00:33:13,200 --> 00:33:16,280 Is that the most notable thing? 415 00:33:17,120 --> 00:33:18,999 Because I'd say, it's the devastating effect 416 00:33:19,000 --> 00:33:21,879 it's having on our economy, which is already in recession. 417 00:33:21,880 --> 00:33:24,039 And which I can tell you from personal experience, 418 00:33:24,040 --> 00:33:27,200 is going down with voters like a bucket of cold sick. 419 00:33:29,120 --> 00:33:31,680 It could have been worse, Prime Minister. 420 00:33:33,760 --> 00:33:34,680 How? 421 00:33:34,720 --> 00:33:37,440 Well, if the attack had happened on Monday morning, 422 00:33:38,160 --> 00:33:39,519 instead of on Friday. 423 00:33:39,520 --> 00:33:43,320 Which is, in fact, exactly what would have happened, Prime Minister, 424 00:33:43,360 --> 00:33:48,360 if it hadn't been for the sharp eyes of one of our work-experience students, 425 00:33:48,400 --> 00:33:50,400 who spotted something else, 426 00:33:51,040 --> 00:33:53,720 hidden inside the malware code. 427 00:33:54,600 --> 00:33:55,999 Danny. 428 00:33:56,000 --> 00:33:59,039 Yeah, at 9:00 a.m. tomorrow morning, a second stage attack was set to activate, 429 00:33:59,040 --> 00:34:03,720 this time taking out the entire Internet with potentially catastrophic results. 430 00:34:03,760 --> 00:34:05,680 The whole country, including vital services, 431 00:34:05,720 --> 00:34:10,159 would have been left unable to get online, just as the Monday morning rush began. 432 00:34:10,160 --> 00:34:14,040 And this is the young student who spotted it. Stand up. 433 00:34:26,600 --> 00:34:28,520 Do we know who's responsible? 434 00:34:30,800 --> 00:34:31,960 For the attack? 435 00:34:33,120 --> 00:34:35,160 We're still working on that. 436 00:34:35,200 --> 00:34:37,719 Well, Jolly Roger seems to know judging by the way 437 00:34:37,720 --> 00:34:41,080 he's flashing the lights off and on in Putin's office. 438 00:34:42,440 --> 00:34:45,600 Perhaps we're relying on him for our cyber responses nowadays. 439 00:34:49,160 --> 00:34:51,720 I'm sorry to interrupt this happy moment, Prime Minister, 440 00:34:51,760 --> 00:34:54,920 but I'd be glad of some clarification, if that's OK. 441 00:34:56,200 --> 00:35:01,560 You say the second malware was spotted by this young woman. What's her name? 442 00:35:03,240 --> 00:35:04,800 Saara Parvin. 443 00:35:05,600 --> 00:35:07,000 And she's a student? 444 00:35:08,440 --> 00:35:10,000 Yes, that's right. 445 00:35:10,040 --> 00:35:11,920 And the rest of GCHQ just... 446 00:35:13,040 --> 00:35:14,360 missed it. 447 00:35:16,760 --> 00:35:19,760 I'm sorry. Is that something we're supposed to applaud? 448 00:35:22,560 --> 00:35:25,480 I mean, it's hardly reassuring, is it? 449 00:35:25,520 --> 00:35:28,439 If she hadn't been doing her work experience or whatever it was, 450 00:35:28,440 --> 00:35:31,479 the entire panoply of our cyber security apparatus 451 00:35:31,480 --> 00:35:33,600 would have missed an extremely dangerous attack, 452 00:35:33,640 --> 00:35:37,840 paralysing commercial life in this country for the second time in four days. 453 00:35:42,200 --> 00:35:44,520 If a student could find this thing and the rest of you didn't, 454 00:35:44,560 --> 00:35:47,280 how do we know there isn't something else hiding in there, 455 00:35:48,680 --> 00:35:52,480 waiting to go off at 11:00 a.m. tomorrow? Or 2:00 p.m. or whenever? 456 00:35:57,680 --> 00:36:00,880 I think you'd better go back and take another look, don't you? 457 00:36:02,000 --> 00:36:03,640 See what else you've missed. 458 00:36:05,080 --> 00:36:09,680 And let's have some options for an offensive cyber attack on Russia. 459 00:36:09,720 --> 00:36:12,479 I'd like to know what we could do to retaliate. 460 00:36:17,240 --> 00:36:18,760 OK. 461 00:36:18,800 --> 00:36:20,560 Get everybody back tonight. 462 00:36:21,320 --> 00:36:23,560 10:00 p.m., bring them all in. 463 00:36:56,640 --> 00:36:58,320 - Where have you been? - How is he? 464 00:36:58,360 --> 00:37:01,960 - Where have you been, Saara? - I got here as quickly as I could. 465 00:37:05,200 --> 00:37:06,360 What's happened? 466 00:37:07,720 --> 00:37:08,840 Tell me. 467 00:37:09,320 --> 00:37:10,880 Abu died. 468 00:37:10,920 --> 00:37:12,560 About half an hour ago. 469 00:37:17,200 --> 00:37:18,600 It's OK, Ami. 470 00:37:19,480 --> 00:37:20,600 It's OK. 471 00:38:01,880 --> 00:38:03,800 Are you sure you want to do this? 472 00:38:25,760 --> 00:38:27,720 What was he doing on the tracks? 473 00:38:29,040 --> 00:38:30,120 They're not sure. 474 00:38:30,160 --> 00:38:32,360 There's going to have to be an investigation. 475 00:39:59,760 --> 00:40:01,360 They're withholding his body. 476 00:40:01,400 --> 00:40:02,400 What? 477 00:40:02,440 --> 00:40:03,520 What? Why? 478 00:40:03,560 --> 00:40:06,199 There's going to have to be a post mortem. 479 00:40:06,200 --> 00:40:07,880 So we can't bury him? 480 00:40:09,080 --> 00:40:11,799 The police won't let us. Not yet. 481 00:40:11,800 --> 00:40:13,759 Why? 482 00:40:13,760 --> 00:40:16,640 - Is it because it might be suicide? - Saara! 483 00:40:16,680 --> 00:40:18,400 - I'll get you some tea. - No! 484 00:40:19,120 --> 00:40:20,120 Saara can get it. 485 00:40:20,160 --> 00:40:22,640 Oh, it's fine, Ami. I'm not an invalid. 486 00:40:26,120 --> 00:40:27,320 Why don't you just go? 487 00:40:27,360 --> 00:40:29,400 - If you're in such a hurry... - Enough, Ami! 488 00:40:29,440 --> 00:40:30,840 Give her a break! 489 00:40:30,880 --> 00:40:32,960 - None of this is her fault. - No. 490 00:40:33,000 --> 00:40:34,800 I won't give her a break. 491 00:40:34,840 --> 00:40:37,320 Her father has just died and she shows nothing. 492 00:40:37,360 --> 00:40:39,680 She looks at her watch! 493 00:40:39,720 --> 00:40:41,679 All she ever thinks about is herself. 494 00:40:41,680 --> 00:40:42,839 Why are you so selfish? 495 00:40:42,840 --> 00:40:44,280 Tell me. Because I don't understand! 496 00:40:44,320 --> 00:40:46,200 - That's not fair, Mum. - I'm sorry, I can't do this. 497 00:40:46,240 --> 00:40:49,439 That's right, leave, like you always do! 498 00:40:57,120 --> 00:41:00,800 Right, for those of you that don't know, we've just returned from London 499 00:41:00,840 --> 00:41:05,080 where we were comprehensively beaten up at COBR. 500 00:41:05,120 --> 00:41:06,520 Erm... 501 00:41:06,560 --> 00:41:10,640 Yeah, but just because it was unpleasant doesn't mean it wasn't justified. 502 00:41:10,680 --> 00:41:13,319 There was a Level One attack on the Internet on Friday. 503 00:41:13,320 --> 00:41:18,680 And all of our focus has been on isolating the malware responsible and disabling it. 504 00:41:18,720 --> 00:41:21,560 With the pressure to get everything back up and running, 505 00:41:21,600 --> 00:41:23,680 it's hardly surprising that we weren't looking 506 00:41:23,720 --> 00:41:27,639 as carefully as we should for extra functionality in the code. 507 00:41:27,640 --> 00:41:31,920 Erm, the fact that it was one of our work-experience students that found it 508 00:41:31,960 --> 00:41:34,160 in a place we wouldn't ordinarily be looking, 509 00:41:34,200 --> 00:41:36,880 probably doesn't reflect that well on us, if I'm honest. 510 00:41:36,920 --> 00:41:40,320 Certainly not in the opinion of some of the members of COBR, anyway. 511 00:41:41,680 --> 00:41:44,839 So we're going to be going back over the malware code line by line. 512 00:41:44,840 --> 00:41:47,200 Let's see what else is hiding in there. 513 00:41:47,240 --> 00:41:50,040 It's a big task and it's urgent. 514 00:41:50,080 --> 00:41:52,680 We cannot afford to be caught out again. 515 00:41:53,560 --> 00:41:55,080 Malware will be leading this. 516 00:41:55,120 --> 00:41:57,159 And some of you will be reassigned for a bit to help out. 517 00:41:57,160 --> 00:41:59,720 And shifts will be extended again, 518 00:41:59,760 --> 00:42:01,360 I'm afraid, until this gets sorted. 519 00:42:01,400 --> 00:42:03,320 OK. Sorry about that. Let's get to it. 520 00:42:10,200 --> 00:42:11,360 Saara? 521 00:42:12,560 --> 00:42:15,920 Hey, listen, I'm sorry about what I put you through at COBR today. 522 00:42:15,960 --> 00:42:17,360 I didn't see that coming. 523 00:42:18,800 --> 00:42:21,800 You should go home. You look exhausted. 524 00:42:21,840 --> 00:42:23,360 No, I'm fine, honestly. 525 00:42:23,400 --> 00:42:25,800 No, I'm serious, Saara. You look terrible. 526 00:42:27,040 --> 00:42:27,960 I can't. 527 00:42:28,000 --> 00:42:29,640 Everyone else is working. 528 00:42:29,680 --> 00:42:31,240 Go home. OK? 529 00:42:31,280 --> 00:42:32,440 You did a really good job today. 530 00:42:32,480 --> 00:42:35,440 And it will still be here in the morning, I promise you. 531 00:42:59,800 --> 00:43:03,879 A completely illegal and irresponsible attack, 532 00:43:03,880 --> 00:43:05,240 which could have been far worse 533 00:43:05,280 --> 00:43:07,999 {\an8}if it hadn't been for the carefully prepared strategies 534 00:43:08,000 --> 00:43:11,000 {\an8}we brought into play on Friday. 535 00:43:11,040 --> 00:43:14,039 {\an8}Everything will be fully back up and running by midnight. 536 00:43:14,040 --> 00:43:16,999 {\an8}In fact, many services have already been restored. 537 00:43:17,000 --> 00:43:20,480 {\an8}All our online banking, all our major transport links. 538 00:43:23,000 --> 00:43:27,160 {\an8}Our allies around the world have been quick to condemn this outrageous attack 539 00:43:27,200 --> 00:43:30,720 {\an8}on UK's sovereignty and to offer their support, 540 00:43:30,760 --> 00:43:32,720 {\an8}- countries like the United States... - Hey. 541 00:43:32,760 --> 00:43:35,440 {\an8} ...countries like France, Spain, Germany and many others, 542 00:43:35,480 --> 00:43:37,200 {\an8}which believe in and are prepared to stand... 543 00:43:37,240 --> 00:43:40,280 {\an8}What incredible timing for your first day. 544 00:43:41,480 --> 00:43:43,440 {\an8}I thought they'd never let you out. 545 00:43:44,200 --> 00:43:45,400 How was it? 546 00:43:51,840 --> 00:43:53,800 What is it? What's wrong? 547 00:43:57,560 --> 00:43:58,680 Saar? 548 00:44:04,240 --> 00:44:06,120 My father died this evening. 549 00:44:12,000 --> 00:44:13,679 I am so sorry, Saar. 550 00:44:13,680 --> 00:44:14,800 What? 551 00:44:16,400 --> 00:44:18,160 When? When? What happened? 552 00:44:22,520 --> 00:44:24,080 You're probably hungry. 553 00:44:33,960 --> 00:44:37,800 Countries like the United States. Countries like France, Spain, Germany 554 00:44:37,840 --> 00:44:41,840 and many others, which believe in and are prepared to stand up 555 00:44:42,480 --> 00:44:43,999 for the rule of law, 556 00:44:44,000 --> 00:44:47,199 and I can assure you that we will respond to the attack 557 00:44:47,200 --> 00:44:48,320 within the law 558 00:44:48,360 --> 00:44:51,399 and at a time and in a manner of our choosing. 559 00:44:53,160 --> 00:44:55,000 The rules based International... 560 00:44:58,720 --> 00:45:00,960 - Hi. - You watching? 561 00:45:01,320 --> 00:45:03,039 Yeah. 562 00:45:03,040 --> 00:45:06,160 And how are we getting on with his options? 563 00:45:06,200 --> 00:45:09,440 Er, we're not. It's a really bad idea. 564 00:45:09,480 --> 00:45:11,160 We have to do this, Danny. 565 00:45:11,200 --> 00:45:12,480 Right. 566 00:45:12,520 --> 00:45:15,999 And to hell with the escalation? Because that's where this leads. 567 00:45:16,000 --> 00:45:17,280 You know that. 568 00:45:22,160 --> 00:45:23,240 OK. 569 00:45:32,520 --> 00:45:33,800 Finn, get up here. 570 00:45:34,160 --> 00:45:35,320 Yes, boss. 571 00:45:37,160 --> 00:45:41,759 ...which we have to do it in the world, can claim a similar legitimacy. 572 00:45:41,760 --> 00:45:45,119 But just because this is a democracy, it doesn't mean we are weak. 573 00:45:45,120 --> 00:45:48,280 Or lack the will or the capability to defend ourselves. 574 00:45:48,320 --> 00:45:53,560 And we will defend ourselves with all the force available to us, 575 00:45:53,600 --> 00:45:55,360 within the law. 576 00:45:56,520 --> 00:45:57,680 Thank you.