1 00:00:21,960 --> 00:00:24,120 {\an8}So what made you decide to leave, 2 00:00:24,160 --> 00:00:25,480 {\an8}come to Moscow? 3 00:00:27,040 --> 00:00:30,560 {\an8}Because I'm fed up with lying to the public 4 00:00:30,600 --> 00:00:34,880 {\an8}about what's really going on at GCHQ where I work. 5 00:00:34,920 --> 00:00:38,560 {\an8}I've done 50 years of service 6 00:00:38,600 --> 00:00:40,200 {\an8}and I've had enough. 7 00:00:40,240 --> 00:00:44,080 {\an8}It's time for me to stand up and say my piece. 8 00:00:48,320 --> 00:00:50,080 {\an8} ...and I've had enough. 9 00:00:50,120 --> 00:00:53,800 {\an8}It's time for me to stand up and say my piece. 10 00:00:54,360 --> 00:00:55,800 {\an8}And what is that? 11 00:00:55,840 --> 00:00:57,760 {\an8}You were friends, weren't you? 12 00:01:00,320 --> 00:01:01,680 {\an8}Hi. Sorry? 13 00:01:02,400 --> 00:01:03,680 {\an8}You were friends. 14 00:01:05,360 --> 00:01:06,480 Yeah. 15 00:01:07,000 --> 00:01:08,600 {\an8}At least I thought so. 16 00:01:08,640 --> 00:01:10,680 {\an8}So what are you looking for? 17 00:01:11,280 --> 00:01:12,480 {\an8}I don't know. 18 00:01:13,120 --> 00:01:15,520 {\an8}A clue, anything. 19 00:01:16,360 --> 00:01:18,640 {\an8}I just can't believe he'd do this to us. 20 00:01:18,680 --> 00:01:20,960 {\an8} "Us." 21 00:01:21,000 --> 00:01:22,360 {\an8}He goes missing at the same time 22 00:01:22,400 --> 00:01:25,599 {\an8}as the biggest leak in intelligence history. 23 00:01:25,600 --> 00:01:29,120 {\an8}He turns up in Moscow and admits it on Russian television. 24 00:01:29,160 --> 00:01:31,520 {\an8}I'd have thought that was enough evidence, 25 00:01:32,640 --> 00:01:33,880 {\an8}even for you. 26 00:01:37,560 --> 00:01:39,120 You mean I should get back to work. 27 00:01:39,160 --> 00:01:40,320 That's OK, Saara. 28 00:01:40,360 --> 00:01:42,160 {\an8}I think we all gave up hope a while back 29 00:01:42,200 --> 00:01:44,560 {\an8}of you ever actually doing any work around here. 30 00:03:31,920 --> 00:03:35,240 Don't people hate having their grammar corrected? 31 00:03:35,280 --> 00:03:38,119 I mean, doesn't it just make everyone hate you? 32 00:03:38,120 --> 00:03:41,920 If we wrote code as sloppily as we write English, it would never run. 33 00:03:41,960 --> 00:03:43,840 Some things have to be right. 34 00:03:54,920 --> 00:03:56,800 Is that all you're having? 35 00:03:59,000 --> 00:04:00,680 I'm Muslim. 36 00:04:00,720 --> 00:04:02,560 They don't have anything halal here. 37 00:04:06,880 --> 00:04:09,000 ...they won't be very welcoming. 38 00:04:09,040 --> 00:04:10,880 What's funny? 39 00:04:10,920 --> 00:04:12,839 No different to any other department here then? 40 00:04:12,840 --> 00:04:15,800 Different "from" any other department. 41 00:04:15,840 --> 00:04:18,080 It's "different from, compared with." 42 00:04:21,720 --> 00:04:24,440 No different "from" any other department. 43 00:04:24,480 --> 00:04:26,800 It's "different from, compared with." 44 00:04:29,760 --> 00:04:32,320 Different from, compared with. 45 00:04:34,800 --> 00:04:37,720 Different from, compared with. 46 00:04:37,760 --> 00:04:39,960 Different from, compared with. 47 00:04:40,000 --> 00:04:41,960 Different from, compared with. 48 00:04:42,000 --> 00:04:43,960 Different from, compared with. 49 00:04:44,000 --> 00:04:46,680 Different from, compared with. 50 00:04:46,720 --> 00:04:48,960 Different from, compared with. 51 00:04:50,360 --> 00:04:54,040 ...because I'm fed up with lying to the public 52 00:04:54,080 --> 00:04:58,520 about what's really going on at GCHQ where I work. 53 00:04:58,560 --> 00:04:59,680 I've done... 54 00:05:02,720 --> 00:05:04,840 ...stand up and say my piece. 55 00:05:04,880 --> 00:05:06,279 And what is that? 56 00:05:06,280 --> 00:05:09,960 That we are no different to what we're always accusing you lot of. 57 00:05:10,000 --> 00:05:12,240 - Yes! - What is it? 58 00:05:12,280 --> 00:05:13,840 He said "different to." 59 00:05:13,880 --> 00:05:17,440 He would never say "different to." He would never make that mistake. 60 00:05:17,480 --> 00:05:18,800 It can't be him. 61 00:05:21,160 --> 00:05:23,440 What? Saara, wait. 62 00:05:38,320 --> 00:05:40,159 Where is he? 63 00:05:40,160 --> 00:05:42,440 Danny's on his way to London, Saara. 64 00:05:45,080 --> 00:05:46,280 Shit! 65 00:05:52,160 --> 00:05:53,360 Kathy? 66 00:05:57,040 --> 00:05:58,320 She's not here. 67 00:05:59,600 --> 00:06:00,760 Where is she? 68 00:06:02,160 --> 00:06:04,200 - She's gone. - What do you mean gone? 69 00:06:05,000 --> 00:06:06,400 What did you say to her? 70 00:06:10,400 --> 00:06:13,640 I didn't say anything. I came back and she was packing. 71 00:06:14,640 --> 00:06:16,920 {\an8}She's been recalled to Maryland. 72 00:06:17,760 --> 00:06:18,800 Er... 73 00:06:18,840 --> 00:06:21,400 She flew about 25 minutes ago. She left you this. 74 00:06:40,400 --> 00:06:41,800 What's going on, Saara? 75 00:06:44,240 --> 00:06:46,080 And don't lie to me this time. 76 00:06:53,920 --> 00:06:56,200 {\an8}You're in love with her, aren't you? 77 00:06:58,560 --> 00:06:59,880 Don't lie, please. 78 00:07:06,160 --> 00:07:07,640 I don't know. 79 00:07:10,000 --> 00:07:11,080 Maybe. 80 00:07:20,280 --> 00:07:21,480 Have you made love here? 81 00:07:29,160 --> 00:07:30,240 Yes. 82 00:07:39,200 --> 00:07:40,400 OK. 83 00:07:41,200 --> 00:07:43,400 {\an8}Where does that leave us? 84 00:07:46,160 --> 00:07:47,480 Do you still love me? 85 00:07:48,720 --> 00:07:51,680 Did you ever really love me? 86 00:08:00,680 --> 00:08:03,320 Don't go, James, please. I'm sorry. 87 00:08:08,880 --> 00:08:10,920 {\an8}I know you just lost your dad... 88 00:08:10,960 --> 00:08:12,240 and I know you're upset, 89 00:08:12,280 --> 00:08:15,200 and I know you say you can't deal with your emotions. 90 00:08:15,960 --> 00:08:17,920 I've tried to make allowances, 91 00:08:19,080 --> 00:08:20,680 I really have. 92 00:08:22,680 --> 00:08:26,600 But when you crash into people's lives, people get hurt. 93 00:08:28,440 --> 00:08:31,360 People who care about you. People who love you. 94 00:08:36,720 --> 00:08:38,520 Just try and think about that? 95 00:08:56,800 --> 00:08:58,000 Fuck. 96 00:09:12,200 --> 00:09:14,200 Ah, Mark, welcome. 97 00:09:15,360 --> 00:09:16,560 Sorry, I'm late. 98 00:09:17,200 --> 00:09:18,560 It's fine. 99 00:09:18,600 --> 00:09:22,960 I'm sure I don't need to tell you the effect of the Yeabsley leak is... 100 00:09:24,640 --> 00:09:26,600 devastating. 101 00:09:26,640 --> 00:09:29,240 Most of our tools have been rendered nugatory 102 00:09:29,280 --> 00:09:32,480 and will have to be built again from scratch. 103 00:09:32,520 --> 00:09:36,920 Our priority now is to keep what little we do have left secure. 104 00:09:39,400 --> 00:09:42,280 As of 2000 hours today, Eastern Time, 105 00:09:42,320 --> 00:09:46,800 the NSA's intelligence-sharing arrangement with the UK is withdrawn. 106 00:09:47,640 --> 00:09:49,560 For the foreseeable future. 107 00:09:50,600 --> 00:09:52,640 Er, Mark... 108 00:09:52,680 --> 00:09:56,120 It signals cooperation between our two countries, 109 00:09:56,160 --> 00:09:58,760 it goes back 75 years and it plays a vital... 110 00:09:58,800 --> 00:10:03,400 This decision comes from the commander-in-chief personally 111 00:10:04,400 --> 00:10:06,040 and is not open for discussion. 112 00:10:07,360 --> 00:10:09,480 The question we're all asking ourselves here is 113 00:10:09,520 --> 00:10:11,440 why the hell you re-employed a loose cannon 114 00:10:11,480 --> 00:10:13,680 like John Yeabsley in the first place? 115 00:10:31,280 --> 00:10:32,600 - Hi. - You all right? 116 00:10:36,080 --> 00:10:38,040 Where do you want me, Sarge? 117 00:10:38,080 --> 00:10:39,520 Er, get yourself round the back. 118 00:10:39,560 --> 00:10:42,080 Make sure no press are trying to get in through the garden. 119 00:10:42,760 --> 00:10:43,719 Hey. 120 00:10:43,720 --> 00:10:44,880 {\an8}You're gonna need a mask, Sandy. 121 00:10:44,920 --> 00:10:47,400 {\an8}Oh, I'm just going straight through, thank you. 122 00:10:51,680 --> 00:10:52,840 {\an8}Hiya. 123 00:11:07,440 --> 00:11:08,960 Sorry. Thanks. 124 00:11:47,280 --> 00:11:50,120 James, it's me again. 125 00:11:51,240 --> 00:11:54,480 Please call me back. I know you're angry. 126 00:11:55,560 --> 00:11:56,800 We need to talk. 127 00:12:01,920 --> 00:12:03,040 Come on! 128 00:12:04,080 --> 00:12:07,239 ...GCHQ Intelligence Analyst, John Yeabsley, 129 00:12:07,240 --> 00:12:09,040 seen yesterday on Russian TV 130 00:12:09,080 --> 00:12:13,199 admitting responsibility for a massive leak of GCHQ secrets 131 00:12:13,200 --> 00:12:17,480 {\an8}could not have been in Moscow yesterday. Back to Dan. 132 00:12:17,520 --> 00:12:18,879 {\an8}- Yes! - That's right, Alan... 133 00:12:18,880 --> 00:12:20,720 {\an8}Yes, yes, yes! I knew it! 134 00:12:20,760 --> 00:12:22,280 {\an8} ...in light of what the police are saying here tonight, 135 00:12:22,320 --> 00:12:27,160 {\an8}the interview shown yesterday {\an8}on Russian TV seems likely now 136 00:12:27,200 --> 00:12:29,519 somehow to have been faked. 137 00:12:29,520 --> 00:12:31,840 {\an8}As he was clearly already dead, here in Cheltenham, 138 00:12:31,880 --> 00:12:34,760 {\an8}when he was supposedly being taped in Moscow. 139 00:12:58,600 --> 00:13:00,159 Oh, dear... 140 00:13:00,160 --> 00:13:01,919 A mountain of code. 141 00:13:01,920 --> 00:13:06,320 {\an8}Perhaps it will make you, er, check your assumptions. 142 00:13:06,360 --> 00:13:08,320 Remember the Nigerian prince. 143 00:13:13,000 --> 00:13:19,039 If you find yourself scouring through thousands and thousands of lines of code, 144 00:13:19,040 --> 00:13:25,000 that's probably exactly what they're expecting you to do. 145 00:13:26,920 --> 00:13:28,120 Don't. 146 00:13:28,520 --> 00:13:30,200 Do something else, 147 00:13:31,280 --> 00:13:32,560 unexpected. 148 00:13:34,920 --> 00:13:38,400 You have to think outside the box. 149 00:13:43,040 --> 00:13:47,760 If you can't, then you have to find someone who can. 150 00:13:57,880 --> 00:13:59,399 Should I offer to help? 151 00:13:59,400 --> 00:14:01,200 Oh, no, she doesn't need any help. 152 00:14:01,240 --> 00:14:03,200 She knows exactly where everything is. 153 00:14:03,240 --> 00:14:04,400 Don't you, dear? 154 00:14:12,360 --> 00:14:15,000 It's the first time we've had one of Gabe's work friends to visit. 155 00:14:15,040 --> 00:14:16,720 Isn't it, Gabe? 156 00:14:16,760 --> 00:14:18,280 We'd almost given up hope. 157 00:14:19,080 --> 00:14:20,079 Sorry? 158 00:14:20,080 --> 00:14:23,440 He was turned down by so many employers before GCHQ. 159 00:14:23,480 --> 00:14:25,799 We moved here so we could look after him. 160 00:14:25,800 --> 00:14:27,560 He can't live alone, obviously. 161 00:14:31,280 --> 00:14:33,600 I know you said you didn't want to help me any more 162 00:14:33,640 --> 00:14:36,040 - but I'm in trouble. - What kind of trouble? 163 00:14:37,000 --> 00:14:38,560 {\an8}What I'm saying is... 164 00:14:38,600 --> 00:14:40,640 I've got GCHQ into trouble. 165 00:14:41,800 --> 00:14:43,840 OK, what I mean is... 166 00:14:44,880 --> 00:14:47,239 I didn't realise I was being used. 167 00:14:47,240 --> 00:14:49,560 I think there's a third-stage malware, Gabriel, 168 00:14:49,600 --> 00:14:51,480 hidden inside the code. 169 00:14:51,520 --> 00:14:53,839 I need to find it. 170 00:14:53,840 --> 00:14:56,799 {\an8}Someone tried to warn me about it, that it was really dangerous, 171 00:14:56,800 --> 00:14:59,799 but it's only now I think I know what he meant. 172 00:14:59,800 --> 00:15:02,679 - Who warned you? - That's not important now. 173 00:15:02,680 --> 00:15:05,679 There's been a massive leak of data from GCHQ, right? 174 00:15:05,680 --> 00:15:07,120 Incredibly damaging? 175 00:15:07,160 --> 00:15:09,480 {\an8}I think that's what the third stage does. 176 00:15:09,520 --> 00:15:12,120 {\an8}I think there's some hidden part of the original malware 177 00:15:12,160 --> 00:15:14,160 {\an8}that was built to steal our data. 178 00:15:14,840 --> 00:15:16,439 {\an8}But I can't find it. 179 00:15:16,440 --> 00:15:20,000 {\an8}I've been back through the code line by line. There's nothing. 180 00:15:24,280 --> 00:15:26,320 That's the puzzle, Gabriel. 181 00:15:26,360 --> 00:15:30,600 {\an8}- I'm asking if you'd... - It's OK, Saara. I get it. 182 00:15:32,280 --> 00:15:34,039 Where are you going, Gabe? 183 00:15:34,040 --> 00:15:35,759 Sorry. 184 00:15:35,760 --> 00:15:38,240 {\an8}But what about the curfew? 185 00:15:48,080 --> 00:15:50,880 - It's obfuscated. You don't need to... - Wait. 186 00:15:58,520 --> 00:16:01,159 I was just trying to say you don't need to waste time on it. 187 00:16:01,160 --> 00:16:02,639 The original code's obfuscated. 188 00:16:02,640 --> 00:16:05,039 They included all this garbage so that anti-virus software 189 00:16:05,040 --> 00:16:06,399 wouldn't recognise it as malware. 190 00:16:06,400 --> 00:16:07,920 How many lines of garbage? 191 00:16:07,960 --> 00:16:09,279 I don't know, thousands. 192 00:16:09,280 --> 00:16:11,600 We stripped them out so we could work on it. 193 00:16:12,840 --> 00:16:14,120 Tea? 194 00:16:14,160 --> 00:16:16,719 Before you stripped them out, you tried to get it to run in a sandbox. 195 00:16:16,720 --> 00:16:18,640 That's right. How did you know? 196 00:16:20,200 --> 00:16:21,480 What happened? 197 00:16:22,120 --> 00:16:24,159 Nothing. It didn't run. 198 00:16:24,160 --> 00:16:26,840 - They designed it so that it... - Oh, I think it did. 199 00:16:28,040 --> 00:16:32,040 It didn't, Gabriel. I tried it again and again. 200 00:16:32,080 --> 00:16:33,640 It just sat there. 201 00:16:33,680 --> 00:16:35,559 I watched. Nothing happened. 202 00:16:35,560 --> 00:16:39,240 You need to learn to look at the garbage in a different way. 203 00:16:41,080 --> 00:16:42,760 It's all about patterns. 204 00:16:42,800 --> 00:16:44,880 Finding the code, hidden within the garbage. 205 00:16:44,920 --> 00:16:46,000 But in this case... 206 00:16:46,040 --> 00:16:47,720 it's more complicated than normal. 207 00:16:47,760 --> 00:16:50,280 Usually, there'd be one character of code, 208 00:16:50,320 --> 00:16:52,400 and, say, five characters of garbage. 209 00:16:52,440 --> 00:16:56,560 In that case, you just need to write a script to read one character in six. 210 00:16:56,600 --> 00:16:58,840 So you're saying it's not all garbage? 211 00:16:59,840 --> 00:17:01,760 Then... 212 00:17:01,800 --> 00:17:04,599 ...there's where the number of real code and garbage characters vary 213 00:17:04,600 --> 00:17:06,040 according to a regular pattern. 214 00:17:06,080 --> 00:17:09,800 Say, one in four, then one in three, then one in two and back up again. 215 00:17:09,840 --> 00:17:12,360 {\an8}And that's what we've got here in the BT code? 216 00:17:12,880 --> 00:17:14,200 No. 217 00:17:16,160 --> 00:17:17,720 This is more complicated. 218 00:17:17,760 --> 00:17:20,680 Here, there's no simple pattern. 219 00:17:20,720 --> 00:17:22,760 The code characters and garbage characters 220 00:17:22,800 --> 00:17:24,359 vary according to an algorithm. 221 00:17:24,360 --> 00:17:27,040 {\an8}So, we can't extract the hidden code unless we know the algorithm? 222 00:17:27,080 --> 00:17:30,280 {\an8}Oh, I've worked out the algorithm. That's what took me the time. 223 00:17:38,000 --> 00:17:40,320 There's your third stage. 224 00:17:40,360 --> 00:17:42,920 Hidden inside of what you thought was just garbage. 225 00:17:47,680 --> 00:17:52,040 That's a data scraper. That's how it mined our files. 226 00:17:54,800 --> 00:17:58,000 That must be the MAC address of your sandbox. 227 00:17:58,040 --> 00:17:59,559 That's how it broke out into our system. 228 00:17:59,560 --> 00:18:01,840 - It can't be. - Yes, I think so. 229 00:18:01,880 --> 00:18:03,960 {\an8}But how could they possibly know that? 230 00:18:04,000 --> 00:18:05,840 A MAC address is like a fingerprint. 231 00:18:05,880 --> 00:18:07,640 How could someone in Russia know the address 232 00:18:07,680 --> 00:18:11,480 of a particular computer at GCHQ? It's impossible. 233 00:18:11,520 --> 00:18:12,759 No, it's obvious. 234 00:18:12,760 --> 00:18:14,560 Obvious? How? 235 00:18:15,080 --> 00:18:17,080 Someone must have told them. 236 00:18:23,080 --> 00:18:25,320 {\an8}OK, even if that is true, 237 00:18:25,360 --> 00:18:27,520 {\an8}it doesn't explain how they got the data out. 238 00:18:27,560 --> 00:18:29,520 {\an8}This malware doesn't communicate. 239 00:18:39,640 --> 00:18:41,480 It exfiltrates as email. 240 00:18:42,640 --> 00:18:44,840 The data goes out as attachments. 241 00:18:44,880 --> 00:18:48,640 The emails get lost in the flood of all our other email traffic. 242 00:18:50,040 --> 00:18:51,480 No one notices. 243 00:18:54,280 --> 00:18:57,239 They've moved on from NSA exploits, by the way. 244 00:18:57,240 --> 00:18:58,880 Now they're taking our own stuff. 245 00:18:58,920 --> 00:18:59,839 What? 246 00:18:59,840 --> 00:19:01,520 Your emails are still going out. 247 00:19:01,920 --> 00:19:03,080 What? 248 00:19:48,920 --> 00:19:50,279 They must know what we're doing. 249 00:19:50,280 --> 00:19:53,479 {\an8}Every time I cut a link to a domain, they set up a new one. 250 00:19:53,480 --> 00:19:55,599 {\an8}We're losing a massive amount of data 251 00:19:55,600 --> 00:19:56,880 every second. 252 00:20:00,040 --> 00:20:01,919 The scraper you found in the garbage. 253 00:20:01,920 --> 00:20:04,880 Can you can shut it down, stop all this at source? 254 00:20:04,920 --> 00:20:06,039 Of course. 255 00:20:06,040 --> 00:20:07,240 Then do it! 256 00:20:07,720 --> 00:20:08,920 Please. 257 00:20:36,280 --> 00:20:38,200 - Is that it? - Yes. 258 00:20:38,240 --> 00:20:39,200 {\an8}You've stopped it? 259 00:20:39,240 --> 00:20:41,560 Of course. Why do you sound so surprised? 260 00:20:41,600 --> 00:20:42,760 You're brilliant. 261 00:21:39,920 --> 00:21:41,760 I owe you an apology. 262 00:21:46,680 --> 00:21:49,040 You're right, you do. 263 00:21:52,040 --> 00:21:53,360 I'm sorry. 264 00:21:54,680 --> 00:21:56,960 {\an8}What you did last night was amazing. 265 00:22:02,360 --> 00:22:05,760 ...as well as in Bradford, the central Mosque in Southall 266 00:22:05,800 --> 00:22:08,479 was fire-bombed while a service was taking place. 267 00:22:08,480 --> 00:22:12,399 A spokesperson for the Muslim Council of Britain blamed the attack, 268 00:22:12,400 --> 00:22:15,120 one of dozens reported in the last 36 hours, 269 00:22:15,160 --> 00:22:20,440 on the breakdown in public order in the aftermath of the disputed election... 270 00:22:23,440 --> 00:22:24,760 What is it? 271 00:22:26,680 --> 00:22:29,119 They're attacking mosques again. 272 00:22:29,120 --> 00:22:31,640 My brother works at a mosque in Swindon. 273 00:22:35,000 --> 00:22:36,880 Well, you should go. 274 00:22:45,480 --> 00:22:49,720 We read about it everyday in the papers and on our phones, 275 00:22:50,720 --> 00:22:52,640 we hear about it on the radio, 276 00:22:52,680 --> 00:22:56,200 we speak about it every morning with our neighbours... 277 00:22:56,240 --> 00:22:59,040 we watch it every night on the TV news. 278 00:23:00,480 --> 00:23:04,440 And of course, when they're attacking us in the streets, 279 00:23:04,480 --> 00:23:06,760 when they're burning our mosques, 280 00:23:08,000 --> 00:23:09,680 we want to strike back. 281 00:23:10,800 --> 00:23:12,200 Why wouldn't we? 282 00:23:12,920 --> 00:23:14,360 It's only human. 283 00:23:15,040 --> 00:23:18,000 It sounds easy, brothers and sisters, 284 00:23:19,880 --> 00:23:22,160 as do all the words of Shaytan. 285 00:23:23,000 --> 00:23:25,719 He speaks to us when we're angry. 286 00:23:25,720 --> 00:23:29,280 He fans the flames of our completely reasonable anger 287 00:23:29,960 --> 00:23:32,400 which comes from fear 288 00:23:34,640 --> 00:23:37,280 and the desire to protect those we love. 289 00:23:39,080 --> 00:23:43,320 But we don't protect them, brothers and sisters, 290 00:23:44,080 --> 00:23:47,640 by meeting violence with violence. 291 00:23:47,680 --> 00:23:51,360 Violence only breeds more violence, more hatred. 292 00:23:51,400 --> 00:23:54,800 We hit back and they hit us again, 293 00:23:55,240 --> 00:23:56,480 even harder. 294 00:23:58,200 --> 00:24:01,679 The way of Allah, Subhanahu wa-ta'ala, 295 00:24:01,680 --> 00:24:06,960 is the harder way, the more courageous way. 296 00:24:07,000 --> 00:24:11,280 The voice of Shaytan rages in our ears, blasting out all other sound. 297 00:24:13,560 --> 00:24:18,360 You will hear the voice of Allah, Subhanahu wa-ta'ala, 298 00:24:19,880 --> 00:24:21,680 when you are quiet, 299 00:24:23,640 --> 00:24:25,320 when you are at rest, 300 00:24:27,400 --> 00:24:29,320 when you are at peace. 301 00:24:38,480 --> 00:24:39,560 Saj? 302 00:25:06,280 --> 00:25:07,760 Hello, sir. 303 00:25:08,600 --> 00:25:10,040 - Shut the door. - Yeah. 304 00:25:13,880 --> 00:25:15,159 What is it? 305 00:25:15,160 --> 00:25:18,040 I've just been speaking to the Prime Minister. 306 00:25:18,080 --> 00:25:22,800 Apparently, MI5's found some compromising material 307 00:25:22,840 --> 00:25:24,920 {\an8} ...on the Foreign Secretary's laptop. 308 00:25:27,800 --> 00:25:29,760 What kind of material? 309 00:25:29,800 --> 00:25:33,200 I'm not sure. They're sending it over, the laptop. 310 00:25:34,360 --> 00:25:36,600 Inappropriate communications with someone inside 311 00:25:36,640 --> 00:25:39,760 the Russian government, that's all I've been told. 312 00:25:39,800 --> 00:25:42,800 "Highly prejudicial to national security." 313 00:25:43,440 --> 00:25:45,920 For fuck's sake. 314 00:25:45,960 --> 00:25:48,799 Surely even they must know that's a Russian plant? 315 00:25:48,800 --> 00:25:51,720 I don't know. It looks authentic, apparently. 316 00:25:51,760 --> 00:25:54,439 None of the usual signs of crashing around inside a computer. 317 00:25:54,440 --> 00:25:57,679 If it's a plant, it's a clever one, 318 00:25:57,680 --> 00:25:59,000 hard to prove. 319 00:26:00,520 --> 00:26:03,039 Anyway, she's had to resign. 320 00:26:08,280 --> 00:26:10,480 We're being played, aren't we? 321 00:26:11,640 --> 00:26:14,360 Have been. At every stage. 322 00:26:14,960 --> 00:26:18,360 Yeah. Yeah. 323 00:26:18,400 --> 00:26:21,399 And very convenient that we should lose our best friend in government 324 00:26:21,400 --> 00:26:22,800 at this precise moment. 325 00:26:27,480 --> 00:26:29,360 Secretary of State for Defence. 326 00:26:32,640 --> 00:26:37,680 I said after the BT attack that if we didn't respond robustly, 327 00:26:37,720 --> 00:26:40,120 we'd be hit again and we have been. 328 00:26:40,160 --> 00:26:46,199 Our election has been undermined and our most sensitive secrets stolen. 329 00:26:46,200 --> 00:26:49,639 By any measure, this constitutes the cyber equivalent 330 00:26:49,640 --> 00:26:52,320 of an armed attack on the United Kingdom. 331 00:26:54,200 --> 00:26:55,720 An act of war. 332 00:26:59,480 --> 00:27:01,680 Head of Operations, GCHQ. 333 00:27:05,200 --> 00:27:06,960 I'm not... 334 00:27:07,000 --> 00:27:10,360 disagreeing that a strong response is required 335 00:27:10,400 --> 00:27:13,159 but you should be aware that if you decide upon 336 00:27:13,160 --> 00:27:15,960 a symmetric cyber-attack, 337 00:27:16,000 --> 00:27:17,680 it will be highly escalatory. 338 00:27:18,480 --> 00:27:21,240 {\an8}Truth is they've been one step ahead of us, 339 00:27:21,280 --> 00:27:22,400 provoking us, 340 00:27:22,440 --> 00:27:24,879 {\an8}anticipating how we'll react at every stage. 341 00:27:24,880 --> 00:27:29,080 It's vital that we do not react as expected now. 342 00:27:29,120 --> 00:27:34,400 We should be careful of empty gestures that have profound consequences. 343 00:27:35,520 --> 00:27:37,160 Empty gestures? 344 00:27:37,200 --> 00:27:42,240 Yes. Especially if there are other motives for doing it. 345 00:27:43,640 --> 00:27:45,040 What other motives? 346 00:27:46,960 --> 00:27:48,400 Can I speak frankly? 347 00:27:49,280 --> 00:27:50,440 Of course. 348 00:27:52,720 --> 00:27:54,479 To shore up the position of a government 349 00:27:54,480 --> 00:27:56,320 whose legitimacy has been questioned. 350 00:27:56,360 --> 00:27:59,560 To distract attention. 351 00:28:00,440 --> 00:28:02,320 Is that what you think is going on here? 352 00:28:02,360 --> 00:28:07,120 With the greatest respect to our colleague from GCHQ, Prime Minister, 353 00:28:07,160 --> 00:28:10,679 that is a completely outrageous suggestion. 354 00:28:10,680 --> 00:28:17,079 This country has either faced an attack amounting to an act of war or it hasn't. 355 00:28:17,080 --> 00:28:18,360 And if it has, 356 00:28:18,400 --> 00:28:22,519 it is our duty as the properly constituted government to respond. 357 00:28:22,520 --> 00:28:26,960 It's nothing to do with legitimacy or any other political considerations. 358 00:28:32,080 --> 00:28:34,680 Can I just remind us that the then Attorney General 359 00:28:34,720 --> 00:28:39,119 made our red lines absolutely clear in his 2018 speech. 360 00:28:39,120 --> 00:28:41,799 Use of cyber to manipulate the electoral system 361 00:28:41,800 --> 00:28:45,920 explicitly constitutes an intervention in our domestic affairs. 362 00:28:45,960 --> 00:28:47,960 If, after that speech, we do nothing, 363 00:28:48,000 --> 00:28:51,679 we are basically saying it's OK to just roll your tanks into London. 364 00:28:51,680 --> 00:28:53,719 Yes, I see your point. 365 00:28:53,720 --> 00:28:58,200 Of course, if we retaliate, we might expose some of the things 366 00:28:58,240 --> 00:28:59,360 we ourselves are doing, 367 00:28:59,400 --> 00:29:03,160 within Russia's critical national infrastructure. 368 00:29:03,200 --> 00:29:07,200 Which would leave us open to the accusation of double standards. 369 00:29:08,040 --> 00:29:10,560 But if that is the way you wish to go, 370 00:29:10,600 --> 00:29:14,480 Prime Minister, Danny can lay out some further options. 371 00:29:14,520 --> 00:29:16,600 We don't need your options. 372 00:29:16,640 --> 00:29:18,959 The army will be taking the lead this time. 373 00:29:20,040 --> 00:29:21,360 Good luck with that. 374 00:29:22,560 --> 00:29:23,999 What was that? 375 00:29:24,000 --> 00:29:25,200 Nothing. 376 00:29:25,240 --> 00:29:30,080 Good, because Russia has effectively declared war on this country. 377 00:29:30,120 --> 00:29:32,040 And, we, those of us around this table 378 00:29:32,080 --> 00:29:35,079 are charged with the defence of this nation. 379 00:29:35,080 --> 00:29:37,560 I require your support to do so. 380 00:29:52,440 --> 00:29:53,680 David. 381 00:29:57,280 --> 00:29:59,600 I'm sending you a team from the National Cyber Force. 382 00:29:59,640 --> 00:30:03,360 I want you to build them an attack, targeting the Russian arms industry. 383 00:30:03,400 --> 00:30:06,480 And I want it done today. Can you do that? 384 00:30:06,960 --> 00:30:08,280 {\an8}Put them out of action? 385 00:30:10,760 --> 00:30:12,880 We can certainly try. 386 00:30:12,920 --> 00:30:16,480 It's time to show us what we've been paying for at GCHQ. 387 00:30:16,520 --> 00:30:18,560 All this money we've spent, 388 00:30:18,600 --> 00:30:20,720 it's time to show us what you can do. 389 00:30:29,880 --> 00:30:32,160 I'm sorry, Saj. 390 00:30:33,480 --> 00:30:34,880 You were right. 391 00:30:36,840 --> 00:30:40,680 I should've thought more carefully before I took the job at GCHQ. 392 00:30:41,360 --> 00:30:44,280 About the consequences for our family. 393 00:30:44,960 --> 00:30:46,560 I over-reacted. 394 00:30:46,600 --> 00:30:48,880 No, you didn't. 395 00:30:50,640 --> 00:30:52,080 You were right. 396 00:30:53,280 --> 00:30:54,960 I shouldn't have gone there. 397 00:31:00,600 --> 00:31:03,879 I've made a mistake. At work. 398 00:31:03,880 --> 00:31:05,200 What mistake? 399 00:31:07,320 --> 00:31:09,040 I suppose you can't say? 400 00:31:16,040 --> 00:31:17,600 I did something... 401 00:31:19,120 --> 00:31:21,240 I thought was really clever. 402 00:31:21,840 --> 00:31:23,320 But it wasn't. 403 00:31:23,360 --> 00:31:26,640 It was incredibly stupid and gullible. 404 00:31:28,200 --> 00:31:30,920 And it's allowed something terrible to happen. 405 00:31:32,200 --> 00:31:33,960 Are you sure? 406 00:31:34,000 --> 00:31:36,720 Because you always think everything's your fault. 407 00:31:38,760 --> 00:31:40,280 You have no idea. 408 00:31:50,000 --> 00:31:52,080 Anyway, Dad was my fault. 409 00:31:52,120 --> 00:31:54,440 What? How is that your fault? 410 00:31:55,960 --> 00:31:57,640 He killed himself. 411 00:31:57,680 --> 00:32:00,240 He killed himself because I went away to uni and left him. 412 00:32:00,280 --> 00:32:01,440 - No, Saar... - He did. 413 00:32:01,480 --> 00:32:04,199 - I abandoned him. - No, that's not what happened, Saar. 414 00:32:04,200 --> 00:32:08,239 - Yeah, he killed himself. - He didn't kill himself. 415 00:32:08,240 --> 00:32:11,440 I mean sorry to ruin this "I'm to blame for everything" thing 416 00:32:11,480 --> 00:32:12,920 you've got going, but no, 417 00:32:13,520 --> 00:32:14,960 he didn't kill himself. 418 00:32:15,000 --> 00:32:17,600 If you'd come home, you'd know that. 419 00:32:19,080 --> 00:32:20,560 It was an accident. 420 00:32:20,600 --> 00:32:22,840 A signalman made a mistake. 421 00:32:22,880 --> 00:32:27,040 He sent a goods train up a line that was supposed to be out of service. 422 00:32:27,080 --> 00:32:30,880 Dad took a short cut across the track and the train hit him. 423 00:32:31,360 --> 00:32:32,960 It wasn't suicide. 424 00:32:36,200 --> 00:32:38,679 You're just saying that because suicide is haram. 425 00:32:38,680 --> 00:32:41,280 No, I swear on Mum's life. 426 00:32:42,160 --> 00:32:44,799 That's what happened. 427 00:32:44,800 --> 00:32:47,840 You may have behaved like a shit not coming to see him 428 00:32:47,880 --> 00:32:50,040 but he didn't commit suicide. 429 00:33:04,080 --> 00:33:05,520 I liked your sermon. 430 00:33:06,880 --> 00:33:08,000 Thanks. 431 00:33:10,080 --> 00:33:15,400 I mean, I... I agreed with... I agreed with everything you said. 432 00:33:27,760 --> 00:33:29,680 Do you think I should resign? 433 00:33:30,560 --> 00:33:31,800 Oh. 434 00:33:32,480 --> 00:33:34,920 That's up to you, 435 00:33:34,960 --> 00:33:38,799 but we'd be losing the last real voice of moderation around the table. 436 00:33:38,800 --> 00:33:42,520 There'd be nobody left to protect the staff. 437 00:33:42,560 --> 00:33:43,840 Well, what about you? 438 00:33:44,360 --> 00:33:45,680 Me? 439 00:33:46,640 --> 00:33:50,039 They'd sack me 15 seconds after you're out the door. 440 00:33:53,160 --> 00:33:55,480 Sorry, they're ready. 441 00:33:57,320 --> 00:33:58,480 They're ready. 442 00:34:04,160 --> 00:34:05,600 Um, 443 00:34:05,640 --> 00:34:10,080 I told Barbara to take the kids and go and stay with her parents in France. 444 00:34:10,760 --> 00:34:13,200 - You're joking. - No, absolutely not. 445 00:34:14,280 --> 00:34:16,560 Well, it's not that bad, is it? 446 00:34:16,600 --> 00:34:20,160 I don't know. But I'm pretty sure this, us attacking them, 447 00:34:20,200 --> 00:34:22,560 it's exactly what they want us to do. 448 00:34:22,600 --> 00:34:24,480 You have to ask yourself why. 449 00:34:25,760 --> 00:34:27,960 Do you think I should get Freddie out? 450 00:34:31,160 --> 00:34:32,360 Maybe. 451 00:34:53,600 --> 00:34:55,159 Ready, boss. 452 00:34:55,160 --> 00:34:57,240 OK, what happens now? 453 00:34:57,280 --> 00:34:59,920 You stand aside and we press the button. 454 00:34:59,960 --> 00:35:01,639 That way it's covered by the "rules of war" 455 00:35:01,640 --> 00:35:03,840 and you don't end up in the Hague. 456 00:35:07,480 --> 00:35:09,160 OK, Finn. Up you get. 457 00:35:24,560 --> 00:35:26,320 Control-E. 458 00:35:36,560 --> 00:35:38,760 How long will it take to have an effect? 459 00:35:39,800 --> 00:35:41,360 No time at all. 460 00:35:42,600 --> 00:35:44,120 It's happening now. 461 00:36:13,560 --> 00:36:14,920 {\an8}Is this real? 462 00:36:15,480 --> 00:36:17,600 {\an8}Real? I doubt it. 463 00:36:51,080 --> 00:36:53,160 Danny? Can I have a word with you? 464 00:36:53,200 --> 00:36:55,720 - What is it? - A private word. 465 00:37:04,480 --> 00:37:06,840 - What is it? - Our comms are down. 466 00:37:06,880 --> 00:37:08,360 - Sorry? - All our comms are down. 467 00:37:08,400 --> 00:37:12,400 I wanted to speak to you out here because I didn't want to create a panic. 468 00:37:12,440 --> 00:37:15,280 - What, just army comms... - To be honest, we're not sure. 469 00:37:15,320 --> 00:37:18,480 I managed to get through to the MOD on one of your landlines. 470 00:37:18,520 --> 00:37:22,119 They're requesting that GCHQ help re-establish contact. 471 00:37:22,120 --> 00:37:24,640 - With... - With UK Armed Forces. 472 00:37:25,560 --> 00:37:26,839 Sorry, Danny. 473 00:37:26,840 --> 00:37:28,439 The Defence Secretary is on the line. 474 00:37:28,440 --> 00:37:29,560 Which channel? 475 00:37:29,600 --> 00:37:32,680 No, I mean he's actually on the line. He's on the phone. 476 00:37:37,880 --> 00:37:39,440 Richard. We've just heard. 477 00:37:39,480 --> 00:37:40,640 Heard what? 478 00:37:40,680 --> 00:37:42,200 About your loss of comms. 479 00:37:42,240 --> 00:37:47,919 Not that. The nuclear submarine control system is unresponsive. 480 00:37:47,920 --> 00:37:49,640 It may have been hacked. 481 00:37:49,680 --> 00:37:51,120 What? 482 00:37:51,160 --> 00:37:53,400 Are you... Are you absolutely sure? 483 00:37:54,680 --> 00:37:55,880 Richard? 484 00:37:56,760 --> 00:37:57,960 Richard? 485 00:38:01,400 --> 00:38:03,040 If there's anything still working around here, 486 00:38:03,080 --> 00:38:05,520 try and get me NSA up on the satellite... 487 00:38:05,560 --> 00:38:07,320 - ...on this one. - OK. 488 00:38:29,640 --> 00:38:31,320 I've decided to leave. 489 00:38:32,760 --> 00:38:34,160 GCHQ. 490 00:38:35,200 --> 00:38:36,280 OK. 491 00:38:39,320 --> 00:38:41,079 But if you've made a mess, 492 00:38:41,080 --> 00:38:43,840 don't leave before you've cleared it up. 493 00:38:43,880 --> 00:38:46,600 You should never leave someone else to clear up your mess, Saar. 494 00:38:57,680 --> 00:38:58,800 Mitch. 495 00:38:59,760 --> 00:39:00,840 Danny. 496 00:39:00,880 --> 00:39:03,120 Look, I know you guys aren't talking to us at the moment 497 00:39:03,160 --> 00:39:04,960 but I thought you should know somebody just hacked 498 00:39:05,000 --> 00:39:06,920 our nuclear submarine control system. 499 00:39:07,840 --> 00:39:09,000 What? You're kidding? 500 00:39:09,040 --> 00:39:11,479 Plus all of our military comms are down. 501 00:39:11,480 --> 00:39:13,400 The Russians have just spent the last two hours 502 00:39:13,440 --> 00:39:15,559 exaggerating the effect of a very targeted attack 503 00:39:15,560 --> 00:39:17,319 on a couple of arms factories to make 504 00:39:17,320 --> 00:39:19,840 whatever it is they're doing look like self-defence. 505 00:39:19,880 --> 00:39:22,480 And my guess is, they've been planning this for a long time. 506 00:39:22,520 --> 00:39:26,320 Yeah, the problem is we're seeing those images of hospital fires too, Danny... 507 00:39:26,360 --> 00:39:27,440 Yeah, they're fakes, Mitch. 508 00:39:27,480 --> 00:39:30,160 Well, they look pretty real to us. 509 00:39:31,040 --> 00:39:32,559 I've gotta tell you, 510 00:39:32,560 --> 00:39:35,200 there's not a lot of warm feelings towards you guys here at the moment. 511 00:39:37,840 --> 00:39:41,240 We really could do with some help right now, Mitch. 512 00:39:50,080 --> 00:39:51,440 You can't use that in here. 513 00:39:57,520 --> 00:40:00,000 You can't use that here. Turn it off, now. 514 00:40:00,040 --> 00:40:02,880 OK, but I've got to write this down. 515 00:40:03,880 --> 00:40:05,720 Have you got any paper? 516 00:41:38,640 --> 00:41:39,920 Saara, wait. 517 00:41:40,480 --> 00:41:42,160 I've got nothing to say to you. 518 00:41:42,200 --> 00:41:43,200 Please. 519 00:41:43,240 --> 00:41:44,839 I think you're about to be attacked. 520 00:41:44,840 --> 00:41:45,800 The UK. 521 00:41:45,840 --> 00:41:47,800 I've got something to give you that will stop it. 522 00:41:47,840 --> 00:41:49,520 I don't believe you, Vadim. 523 00:41:49,560 --> 00:41:51,840 It's just another provocation. 524 00:41:51,880 --> 00:41:54,120 Anyway, I thought you said in Harrogate they'd kill you. 525 00:41:54,160 --> 00:41:55,240 I don't care any more. 526 00:41:55,280 --> 00:41:57,120 I don't care what happens to me. 527 00:41:57,160 --> 00:41:58,760 This is too important. 528 00:42:00,120 --> 00:42:01,440 Look at this. 529 00:42:15,280 --> 00:42:16,360 What is that? 530 00:42:16,400 --> 00:42:19,480 It's you. At your desk in GCHQ. 531 00:42:36,680 --> 00:42:39,799 OK, you hacked the CCTV. 532 00:42:39,800 --> 00:42:41,720 So what? What does that prove? 533 00:42:41,760 --> 00:42:44,640 Saara, please. There isn't much time. 534 00:42:44,680 --> 00:42:48,520 You have to trust me. You have to think outside the box. 535 00:42:49,680 --> 00:42:52,840 What? What did you say? 536 00:42:59,520 --> 00:43:03,160 JSSO's showing unidentified aircraft entering our airspace. 537 00:43:03,200 --> 00:43:04,760 None of the other systems are showing it 538 00:43:04,800 --> 00:43:06,680 and the RAF doesn't seem to have been scrambled yet. 539 00:43:06,720 --> 00:43:08,600 But it is possible we are under attack. 540 00:43:08,640 --> 00:43:10,639 It's just another hack, isn't it? Fake news? 541 00:43:10,640 --> 00:43:14,720 But what if it's real this time, you know, like crying wolf? 542 00:43:14,760 --> 00:43:16,960 How can we take that chance? 543 00:43:17,000 --> 00:43:19,120 - What, an invasion? - Why not? 544 00:43:19,160 --> 00:43:22,040 We've been underestimating Putin for ten years. 545 00:43:22,080 --> 00:43:25,039 All the way through we've been asking what's the bigger picture. 546 00:43:25,040 --> 00:43:28,280 The one thing we've never considered is that he might just be insane enough 547 00:43:28,320 --> 00:43:30,600 to have territorial ambitions. 548 00:43:30,640 --> 00:43:33,080 What if this whole thing is about separating us from Europe 549 00:43:33,120 --> 00:43:37,440 and the Americans so that when this moment came, we'd be alone? 550 00:43:38,920 --> 00:43:40,199 Not now, Saara. 551 00:43:40,200 --> 00:43:44,480 {\an8}Danny, you absolutely have to come and see this. Right now! 552 00:43:45,520 --> 00:43:48,880 {\an8}It's the CCTV, so what? Saara, I don't have time for this. 553 00:43:48,920 --> 00:43:50,599 You have to turn it off. 554 00:43:50,600 --> 00:43:51,800 Please. 555 00:43:51,840 --> 00:43:54,680 {\an8}I can't show you what I've got to show you until you turn it off. 556 00:43:57,600 --> 00:43:59,240 Shut down the CCTV. 557 00:43:59,880 --> 00:44:01,000 Really? 558 00:44:01,880 --> 00:44:03,160 Yeah. Do it. 559 00:44:07,600 --> 00:44:09,319 They hacked the system. 560 00:44:09,320 --> 00:44:11,320 The FSB were watching everything we're doing. 561 00:44:11,360 --> 00:44:15,919 They can't. It's air-gapped. How do you know? 562 00:44:15,920 --> 00:44:18,400 {\an8}Because I've just been inside their computer. 563 00:44:22,640 --> 00:44:25,720 I'm sending you something now. Two things. 564 00:44:25,760 --> 00:44:27,920 {\an8}You can use them to trade with the Americans, 565 00:44:27,960 --> 00:44:29,359 to bring them back in. 566 00:44:29,360 --> 00:44:32,280 As soon as that happens, Putin will back down. 567 00:44:36,960 --> 00:44:38,519 {\an8}During this first phase, 568 00:44:38,520 --> 00:44:43,280 {\an8}we are degrading the capability and resolve of our enemy 569 00:44:43,320 --> 00:44:45,560 {\an8}as well as discrediting 570 00:44:45,600 --> 00:44:48,639 his institutions and leadership with espionage, 571 00:44:48,640 --> 00:44:52,359 assassination, er, manipulation of social media, 572 00:44:52,360 --> 00:44:55,080 cyber attacks, faking of imagery... 573 00:44:55,120 --> 00:44:57,560 all with the aim of creating disillusionment, 574 00:44:57,600 --> 00:44:59,880 confusion and chaos. 575 00:45:01,040 --> 00:45:04,600 Er, by the time war is openly declared, 576 00:45:04,640 --> 00:45:06,800 {\an8}- the enemy's ability to defend himself... - War? 577 00:45:06,840 --> 00:45:08,840 - ...will be significantly reduced... - Danny? 578 00:45:08,880 --> 00:45:11,960 {\an8}- We're receiving a data dump. - Where from? 579 00:45:12,000 --> 00:45:13,960 {\an8}Russia. 580 00:45:15,480 --> 00:45:18,240 - In the next phase, we engineer... - OK, let's go. 581 00:45:18,280 --> 00:45:20,879 ...er, our enemy's strategic situation. 582 00:45:20,880 --> 00:45:27,080 His, er, relationships with his allies are fatally undermined, one by one. 583 00:45:29,960 --> 00:45:33,480 {\an8}It's mostly code. There's terabytes of it. 584 00:45:35,320 --> 00:45:39,040 {\an8}I think it's the FSB's offensive cyber exploits. 585 00:45:42,600 --> 00:45:43,880 {\an8}My God! 586 00:45:44,760 --> 00:45:47,040 {\an8}This puts us back in the game. 587 00:45:54,000 --> 00:45:57,119 So how is all this to be achieved? 588 00:45:57,120 --> 00:46:02,120 How do you ensure that, er, the final phase, the war is won? 589 00:46:02,160 --> 00:46:08,800 The war is won using a technique called Reflexive Control. 590 00:46:08,840 --> 00:46:10,479 This is, er, the... 591 00:46:10,480 --> 00:46:14,840 Predetermining the enemy's behaviour in Russia's favour. 592 00:46:14,880 --> 00:46:18,440 We define our ultimate objective... 593 00:46:22,120 --> 00:46:27,320 {\an8}We define our ultimate objective, the total defeat of our enemy.