1
00:00:02,000 --> 00:00:04,256
This programme contains
some strong language

2
00:00:04,280 --> 00:00:06,816
I have decided to declare a state of emergency.
The Prime Minister has issued a statement.

3
00:00:06,840 --> 00:00:09,256
A foreign power is
attempting to subvert

4
00:00:09,280 --> 00:00:11,656
our democracy and our elections

5
00:00:11,680 --> 00:00:13,800
and that power is Russia.

6
00:00:17,760 --> 00:00:21,736
Following the attack on the UK's
political institutions and telecoms,

7
00:00:21,760 --> 00:00:24,256
Russian FSB hackers
are being blamed.

8
00:00:24,280 --> 00:00:26,336
This constitutes
the cyber equivalent

9
00:00:26,360 --> 00:00:28,480
of an armed attack
on the United Kingdom.

10
00:00:29,520 --> 00:00:30,896
An act of war.

11
00:00:30,920 --> 00:00:34,056
It is vital that we do not react
as expected now.

12
00:00:34,080 --> 00:00:36,600
We need to hit back in a language
they understand.

13
00:00:47,520 --> 00:00:51,616
It was the FSB coder Vadim Trusov
you met in Harrogate, wasn't it?

14
00:00:51,640 --> 00:00:53,336
Yes.

15
00:00:53,360 --> 00:00:55,136
Have you had any more
contact with him?

16
00:00:55,160 --> 00:00:57,160
I understand you were
at college together.

17
00:01:02,760 --> 00:01:05,696
Stage three of the Russian attack
was a data scrape.

18
00:01:05,720 --> 00:01:10,216
All our own and the NSA's most
confidential material stolen.

19
00:01:10,240 --> 00:01:13,736
As of 20:00 hours today,
Eastern Time,

20
00:01:13,760 --> 00:01:18,496
the NSA's intelligence sharing
arrangement with the UK is withdrawn

21
00:01:18,520 --> 00:01:20,480
for the foreseeable future.

22
00:01:27,520 --> 00:01:31,280
JSS is showing Russian aircraft
entering our airspace.

23
00:01:32,320 --> 00:01:34,400
It is possible we are under attack.

24
00:01:35,440 --> 00:01:37,976
I'm sending you something now -
two things.

25
00:01:38,000 --> 00:01:41,616
You can use them to trade with
the Americans to bring them back in.

26
00:01:41,640 --> 00:01:43,896
As soon as it happens,
Putin will back down.

27
00:01:43,920 --> 00:01:46,720
I put my life in your hands now, OK?

28
00:01:47,760 --> 00:01:50,960
If they find out I told you this,
they will kill me.

29
00:02:36,280 --> 00:02:38,496
RAF squadrons are airborne.

30
00:02:38,520 --> 00:02:41,656
They have a fix on
the unidentified aircraft.

31
00:02:41,680 --> 00:02:43,736
The Prime Minister
is waiting for me.

32
00:02:43,760 --> 00:02:45,536
He's with the Chief of Staff.

33
00:02:45,560 --> 00:02:49,016
I will be advising him to order
an immediate retaliatory attack

34
00:02:49,040 --> 00:02:52,016
{\an8}on the Russian military base
in Kaliningrad.

35
00:02:52,040 --> 00:02:53,816
{\an8}It's a provocation.

36
00:02:53,840 --> 00:02:56,896
{\an8}I agree. A squadron of Russian
aircraft over the UK

37
00:02:56,920 --> 00:02:58,496
{\an8}is a provocation.

38
00:02:58,520 --> 00:03:00,256
{\an8}An intolerable one.

39
00:03:00,280 --> 00:03:03,016
Vadim Trusov confirmed
that the Russians' intentions

40
00:03:03,040 --> 00:03:06,016
was to isolate us and then
provoke us into an act of war.

41
00:03:06,040 --> 00:03:08,256
If any of these aircraft
exist at all,

42
00:03:08,280 --> 00:03:10,496
if they're Russian drones
or missiles,

43
00:03:10,520 --> 00:03:12,256
they want us to fire on them.

44
00:03:12,280 --> 00:03:14,016
We are playing their game.

45
00:03:14,040 --> 00:03:16,016
Sorry, how could they fake this?

46
00:03:16,040 --> 00:03:18,816
Hacking Air Traffic Control,
faking air attacks,

47
00:03:18,840 --> 00:03:21,016
it's entirely in keeping
with their MO.

48
00:03:21,040 --> 00:03:22,736
No, we cannot take the risk.

49
00:03:22,760 --> 00:03:25,896
We cannot do this without the
Americans being back on board!

50
00:03:25,920 --> 00:03:29,016
Defence Secretary, we have no doubt
the material Vadim Trusov

51
00:03:29,040 --> 00:03:31,336
leaked to us will encourage
the Americans

52
00:03:31,360 --> 00:03:34,096
to renew military and intelligence
alliances with us.

53
00:03:34,120 --> 00:03:35,736
Putin will back down.

54
00:03:35,760 --> 00:03:39,256
The director of the NSA, General
Perez, has confirmed in writing

55
00:03:39,280 --> 00:03:43,896
that all intelligence and military
alliances with the US are suspended.

56
00:03:43,920 --> 00:03:46,496
Perez hasn't seen
the leaked material.

57
00:03:46,520 --> 00:03:48,736
The Prime Minister has tried
the President.

58
00:03:48,760 --> 00:03:52,016
He's at Camp David incommunicado
for the Middle East talks.

59
00:03:52,040 --> 00:03:54,720
RAF squadrons are minutes away
from intercep...

60
00:03:55,760 --> 00:03:58,016
Try and get him to stop
declaring war on Russia

61
00:03:58,040 --> 00:04:00,400
for the next five minutes.
Russian aircraft.

62
00:04:04,520 --> 00:04:06,016
Sally. Encryption.

63
00:04:06,040 --> 00:04:09,016
They've managed to reset the
nuclear codes. Some good news.

64
00:04:09,040 --> 00:04:11,016
OK, send that to
the Defence Secretary

65
00:04:11,040 --> 00:04:14,416
and then get me Michaela Jones on a
call in my office, now! Of course.

66
00:04:14,440 --> 00:04:17,256
Max, we need something to get
the Americans back on board.

67
00:04:17,280 --> 00:04:20,016
This Russian exploit you found
in the Trusov material...

68
00:04:20,040 --> 00:04:21,720
Phil found it, actually.

69
00:04:23,760 --> 00:04:26,256
It's malware breaching
the President's personal

70
00:04:26,280 --> 00:04:28,096
and domestic security.

71
00:04:28,120 --> 00:04:30,080
White House CCTV, everything.

72
00:04:31,120 --> 00:04:32,816
It's pretty ballsy.

73
00:04:32,840 --> 00:04:35,320
You can say that again.
Prep a secure link.

74
00:04:42,280 --> 00:04:44,000
DANNY EXHALES LOUDLY

75
00:04:47,280 --> 00:04:49,336
Michaela's on the screen.
Thank you.

76
00:04:49,360 --> 00:04:53,336
{\an8}Michaela? Dan. Touched you've
taken the time out to call.

77
00:04:53,360 --> 00:04:56,496
{\an8}Something up?
You could say that, yes.

78
00:04:56,520 --> 00:04:58,240
What's this about, Dan?

79
00:04:59,280 --> 00:05:03,016
It's about not seeing 80 years
of intelligence sharing

80
00:05:03,040 --> 00:05:05,736
and collaboration go down the pan.

81
00:05:05,760 --> 00:05:07,736
I'm going to send you something

82
00:05:07,760 --> 00:05:10,736
and I really need you to get Perez
to join a call for me.

83
00:05:10,760 --> 00:05:12,496
OK. Leave it with me.

84
00:05:12,520 --> 00:05:15,000
Thank you. I owe you one.
I've got to go.

85
00:05:26,040 --> 00:05:28,816
Max, send that exploit
over secure link

86
00:05:28,840 --> 00:05:31,736
to Michaela Jones at the NSA,
please. Yeah, on it.

87
00:05:31,760 --> 00:05:35,096
I need to talk to you. If it's
about Vadim, I will talk to MI6,

88
00:05:35,120 --> 00:05:37,496
but right now... It's not.
It's something else.

89
00:05:37,520 --> 00:05:40,176
I should have said earlier,
but with everything going on,

90
00:05:40,200 --> 00:05:41,496
and I had to check.

91
00:05:41,520 --> 00:05:44,336
Danny, I've just put General Perez
through to the comms room.

92
00:05:44,360 --> 00:05:47,160
All right, thank you, Sally.
Just wait here for me, Saara, OK?

93
00:05:57,040 --> 00:05:59,496
I trust you're not going to ask
for our help.

94
00:05:59,520 --> 00:06:01,016
Those days are over.

95
00:06:01,040 --> 00:06:02,496
Danny. Yeah...

96
00:06:02,520 --> 00:06:04,736
Thank you for taking the call, sir.

97
00:06:04,760 --> 00:06:09,496
Trusov leaked terabytes
of the FSB's cyber capabilities

98
00:06:09,520 --> 00:06:11,256
and top secret data.

99
00:06:11,280 --> 00:06:14,816
At a conservative estimate,
it will set the FSB back years,

100
00:06:14,840 --> 00:06:16,416
losing this stuff.

101
00:06:16,440 --> 00:06:20,016
Now, Michaela Jones is making
one particular cyber exploit

102
00:06:20,040 --> 00:06:21,800
available to you now.

103
00:06:23,040 --> 00:06:25,896
We need you to convey this
to the President.

104
00:06:25,920 --> 00:06:29,016
In return, we need
the re-establishment

105
00:06:29,040 --> 00:06:31,336
of all intelligence sharing
agreements

106
00:06:31,360 --> 00:06:33,736
and for the President
to tell the Russians

107
00:06:33,760 --> 00:06:35,736
to withdraw from our airspace.

108
00:06:35,760 --> 00:06:39,896
We need this done immediately
or this war becomes real.

109
00:06:39,920 --> 00:06:41,496
What did you send him?

110
00:06:41,520 --> 00:06:44,336
Russian malware targeting
the President's own family.

111
00:06:44,360 --> 00:06:45,736
Mm.

112
00:06:45,760 --> 00:06:48,016
Thank you. We're on this now.

113
00:06:48,040 --> 00:06:51,480
You'll be hearing from us.
Please hold fire until you do.

114
00:06:52,520 --> 00:06:54,240
DANNY EXHALES

115
00:06:56,040 --> 00:06:57,736
I hope this works.

116
00:06:57,760 --> 00:07:00,016
Erm, Defence Secretary...

117
00:07:00,040 --> 00:07:03,016
if I can take this opportunity,
erm,

118
00:07:03,040 --> 00:07:06,816
even if the special relationship
is indeed back up and running,

119
00:07:06,840 --> 00:07:09,256
we really need to be thinking
about next steps.

120
00:07:09,280 --> 00:07:11,816
Maybe not the time...
How do we fix this?

121
00:07:11,840 --> 00:07:15,016
It's a huge clean up job
and my staff are on their knees

122
00:07:15,040 --> 00:07:16,896
after the last fortnight. Danny!

123
00:07:16,920 --> 00:07:19,736
The truth is, we are
desperately low on numbers

124
00:07:19,760 --> 00:07:22,496
of sufficiently skilled staff, sir.

125
00:07:22,520 --> 00:07:24,976
I can't overstate the importance
of us being ready

126
00:07:25,000 --> 00:07:27,416
should this happen again.
Last time I checked,

127
00:07:27,440 --> 00:07:30,016
GCHQ came under
the Foreign Secretary's authority.

128
00:07:30,040 --> 00:07:32,336
Well, since Elizabeth Kahn's
resignation,

129
00:07:32,360 --> 00:07:34,416
there currently
is no Foreign Secretary.

130
00:07:34,440 --> 00:07:37,016
Well, I will ask the Prime Minister
to bring it up with

131
00:07:37,040 --> 00:07:39,880
whomever he sees fit to appoint
to that august office.

132
00:07:40,920 --> 00:07:42,720
ALERT BEEPS

133
00:07:43,760 --> 00:07:45,320
Oh, shit.

134
00:07:49,760 --> 00:07:52,000
Christ, they're almost over London.

135
00:07:54,040 --> 00:07:56,896
I'm ordering a strike
on Kaliningrad.

136
00:07:56,920 --> 00:08:00,016
Wait. Sir, if they're fake
and we attack,

137
00:08:00,040 --> 00:08:01,816
we are the aggressor.

138
00:08:01,840 --> 00:08:04,000
ALERTS AND SIRENS BLARE

139
00:08:05,280 --> 00:08:07,000
DANNY EXHALES LOUDLY

140
00:08:09,760 --> 00:08:11,256
It was fake.

141
00:08:11,280 --> 00:08:13,896
It was fake all along.
They're playing with us.

142
00:08:13,920 --> 00:08:15,336
Lucky.

143
00:08:15,360 --> 00:08:17,880
I don't like relying on luck.

144
00:08:19,440 --> 00:08:21,000
Gentlemen.

145
00:08:25,040 --> 00:08:27,480
Maybe the Americans are helping
after all.

146
00:08:33,040 --> 00:08:34,656
Danny. Yeah?

147
00:08:34,680 --> 00:08:37,736
With Marston,
you've got to pick your moment.

148
00:08:37,760 --> 00:08:40,336
We have a Cobra meeting
in London tomorrow morning.

149
00:08:40,360 --> 00:08:43,096
We can discuss next steps
with them then.

150
00:08:43,120 --> 00:08:44,880
Understood.

151
00:08:55,000 --> 00:08:57,000
DANNY BREATHES HEAVILY

152
00:09:15,760 --> 00:09:17,896
I'm sorry, Saara. What was it?

153
00:09:17,920 --> 00:09:21,016
When we shut off the data scrape,
our sandbox computer,

154
00:09:21,040 --> 00:09:23,880
which the Russian malware
broke out of... What about it?

155
00:09:25,520 --> 00:09:27,016
What am I looking at?

156
00:09:27,040 --> 00:09:28,496
Yes, James.

157
00:09:28,520 --> 00:09:31,720
Good, good. Well, that's...
That's excellent news.

158
00:09:32,760 --> 00:09:34,720
Yes. Thank you so much.

159
00:09:36,040 --> 00:09:37,720
Jesus Christ.

160
00:09:41,040 --> 00:09:43,496
Charlie, I need you
up in my office ASAP.

161
00:09:43,520 --> 00:09:45,016
Yes, ASAP.

162
00:09:45,040 --> 00:09:46,656
Thank you, buddy.

163
00:09:46,680 --> 00:09:48,000
Danny.

164
00:09:49,520 --> 00:09:51,640
Well, the President called Putin.

165
00:09:52,680 --> 00:09:56,496
Cease all action against the UK
or expect the full force

166
00:09:56,520 --> 00:10:00,000
of a combined NATO response
under Article 5.

167
00:10:01,040 --> 00:10:03,016
Putin has backed down.

168
00:10:03,040 --> 00:10:04,640
For now.

169
00:10:06,040 --> 00:10:09,016
That's good, David.
No, that's excellent,

170
00:10:09,040 --> 00:10:12,000
and you're the one that got
the Americans back in the game...

171
00:10:13,040 --> 00:10:14,640
so what's wrong?

172
00:10:15,680 --> 00:10:17,880
I've had to call in Charlie Francis.

173
00:10:18,920 --> 00:10:20,256
OK.

174
00:10:20,280 --> 00:10:21,720
Saara.

175
00:10:24,040 --> 00:10:25,800
Come into my office.

176
00:10:30,520 --> 00:10:32,480
So, what's going on, Danny?

177
00:10:37,480 --> 00:10:40,240
Charlie. You're lucky you caught me.
I was just heading off.

178
00:10:41,720 --> 00:10:43,216
Or maybe not so lucky.

179
00:10:43,240 --> 00:10:45,816
Something tells me I'm
not getting home tonight.

180
00:10:45,840 --> 00:10:48,576
Saara, you know Charlie Francis,
Head of Security.

181
00:10:48,600 --> 00:10:52,816
Saara has something for us, Charlie.
And I'm afraid it is not good.

182
00:10:52,840 --> 00:10:54,736
How not good? For you to determine,

183
00:10:54,760 --> 00:10:57,976
but we think it could
be potentially disastrous.

184
00:10:58,000 --> 00:10:59,336
Right. It's how the Russian

185
00:10:59,360 --> 00:11:01,656
malware got into our systems
in the first place.

186
00:11:01,680 --> 00:11:05,136
If I understood correctly,
it was through a sandbox computer.

187
00:11:05,160 --> 00:11:07,816
They knew we'd put the malware
in there to analyse it.

188
00:11:07,840 --> 00:11:10,016
Yeah, but it could only
break out if it knew ahead

189
00:11:10,040 --> 00:11:12,896
of time which sandbox
it was going to be put into.

190
00:11:12,920 --> 00:11:16,896
OK. The Media Access Control.
The Mac address.

191
00:11:16,920 --> 00:11:20,976
It's a 12 digit alphanumeric
identifier unique to each computer.

192
00:11:21,000 --> 00:11:24,416
It was written into the third
stage Russian malware code.

193
00:11:24,440 --> 00:11:26,616
Meaning? The writers of the code

194
00:11:26,640 --> 00:11:29,296
had to have it
before it ever arrived at GCHQ.

195
00:11:29,320 --> 00:11:31,960
It's offline, high side.

196
00:11:33,000 --> 00:11:35,600
So the only way they could
have known is... A CI.

197
00:11:37,120 --> 00:11:38,520
In old money, a mole.

198
00:11:48,560 --> 00:11:49,560
One of us.

199
00:11:58,320 --> 00:12:01,096
REPORTER: Reports overnight
of further cyber attacks

200
00:12:01,120 --> 00:12:02,456
on the UK by Russia.

201
00:12:02,480 --> 00:12:05,616
Surely this begs the
question, are we safe?

202
00:12:05,640 --> 00:12:07,376
Do you think the Government
is doing enough

203
00:12:07,400 --> 00:12:09,456
to respond to these attacks?
What should.

204
00:12:09,480 --> 00:12:12,736
Prime Minister Andrew Makinde do
in the face of Putin's aggression?

205
00:12:12,760 --> 00:12:13,760
Give us a call.

206
00:12:50,760 --> 00:12:51,960
Hello, stranger.

207
00:12:55,720 --> 00:12:58,360
Barbara, my love. Mm-hm.

208
00:12:59,560 --> 00:13:02,280
Charlie told me you didn't go
to France like we agreed.

209
00:13:03,960 --> 00:13:05,400
Well, if the world's going to end...

210
00:13:06,520 --> 00:13:08,000
I'd quite like to be with you.

211
00:13:12,080 --> 00:13:13,160
I'm glad you didn't go.

212
00:13:15,240 --> 00:13:16,360
It was a false alarm.

213
00:13:32,360 --> 00:13:33,880
Bad? Mm.

214
00:13:35,840 --> 00:13:39,216
How are the boys? Fine.

215
00:13:39,240 --> 00:13:40,240
Oblivious.

216
00:13:41,440 --> 00:13:43,480
It's one benefit of
teenage hormones.

217
00:13:51,800 --> 00:13:55,160
What was it? You know
I can't tell you.

218
00:13:57,560 --> 00:13:58,560
Three guesses.

219
00:14:00,200 --> 00:14:03,616
I'm tired, Barbara. You wanted us
packed off to France

220
00:14:03,640 --> 00:14:04,896
and I'm not even allowed to guess

221
00:14:04,920 --> 00:14:08,440
the reason why? It was
Russia, wasn't it?

222
00:14:09,480 --> 00:14:11,616
Well, the news made
that quite clear.

223
00:14:11,640 --> 00:14:13,600
So guess one.

224
00:14:18,080 --> 00:14:20,136
They said there was a data breach.

225
00:14:20,160 --> 00:14:23,400
You can speculate all you like,
but I couldn't possibly say.

226
00:14:24,560 --> 00:14:26,480
Shit! How?

227
00:14:28,120 --> 00:14:32,240
Information possessed by...
Virtue of your position.

228
00:14:38,160 --> 00:14:41,920
Three and out. But you will
tell me, Danny Patrick.

229
00:14:43,680 --> 00:14:45,200
I insist you tell me.

230
00:14:46,280 --> 00:14:48,320
Damn your insistence, Agent Napier.

231
00:14:49,480 --> 00:14:50,880
You'll never get it out of me.

232
00:15:00,640 --> 00:15:02,920
Don't you ever dream
of just jacking it all in?

233
00:15:05,120 --> 00:15:07,520
Dream, perhaps. But, um...

234
00:15:09,080 --> 00:15:10,896
if everyone thought like that...

235
00:15:10,920 --> 00:15:13,160
There'd be no-one left
to save the world.

236
00:15:28,160 --> 00:15:33,920
ALARM BEEPS

237
00:15:35,800 --> 00:15:38,856
Er, stay. Oh,
I should at least say hi.

238
00:15:38,880 --> 00:15:40,520
Oh, they'll survive.

239
00:15:42,760 --> 00:15:45,800
I'll go and wake them up.
I'll do the drop before work.

240
00:15:47,880 --> 00:15:48,880
Right.

241
00:15:50,520 --> 00:15:51,520
Oh.

242
00:15:53,880 --> 00:15:54,880
Right. Come on.

243
00:16:17,320 --> 00:16:18,336
REPORTER: Mr Marston,

244
00:16:18,360 --> 00:16:21,296
how is it potential Russian
aircraft were allowed

245
00:16:21,320 --> 00:16:22,736
to fly so near to London?

246
00:16:22,760 --> 00:16:26,136
We knew all along
the attack was probably a fake.

247
00:16:26,160 --> 00:16:28,816
If we responded,
we would have been the aggressor.

248
00:16:28,840 --> 00:16:31,856
Cyber warfare
is notoriously escalatory,

249
00:16:31,880 --> 00:16:34,016
and this is just the
latest in a string

250
00:16:34,040 --> 00:16:37,576
of unacceptable Russian
provocations. That they could gain

251
00:16:37,600 --> 00:16:39,296
access to our radar systems is...
DOORBELL RINGS

252
00:16:39,320 --> 00:16:43,296
of course, of serious concern,
and the PM and I are very clear

253
00:16:43,320 --> 00:16:46,496
that our cyber defences
must be strengthened.

254
00:16:46,520 --> 00:16:48,720
There's only so long we can
keep this to ourselves.

255
00:16:49,880 --> 00:16:50,896
Danny and I are to brief

256
00:16:50,920 --> 00:16:52,776
the Prime Minister
and security directors.

257
00:16:52,800 --> 00:16:54,816
We should inform them
about our mole.

258
00:16:54,840 --> 00:16:56,616
If we inform them,
then they're going to bring

259
00:16:56,640 --> 00:16:59,816
in external investigators
and work will be disrupted.

260
00:16:59,840 --> 00:17:01,856
And the mole will run to ground.

261
00:17:01,880 --> 00:17:04,976
We have a duty. We have a duty
to fix our entire network

262
00:17:05,000 --> 00:17:08,576
after this attack and find the
mole as quickly as possible.

263
00:17:08,600 --> 00:17:12,080
If we tell Marston, he'll use it
to break up GCHQ once and for all.

264
00:17:13,280 --> 00:17:14,520
There might be another option.

265
00:17:16,320 --> 00:17:19,616
The Event Management Centre
is the most secure unit in GCHQ.

266
00:17:19,640 --> 00:17:24,176
Every terminal has live tracking.
If you can find a pretext to move

267
00:17:24,200 --> 00:17:28,816
all those in malware who had
access to the sandbox there,

268
00:17:28,840 --> 00:17:29,896
I have the perfect

269
00:17:29,920 --> 00:17:33,056
person to monitor their
online behaviour remotely.

270
00:17:33,080 --> 00:17:38,560
This way, we might catch them
in the act and we keep working.

271
00:17:40,960 --> 00:17:41,960
All right.

272
00:17:50,560 --> 00:17:53,176
Richard. David.

273
00:17:53,200 --> 00:17:55,400
David. Alex. Defence Secretary.

274
00:17:56,960 --> 00:17:58,616
Alex.

275
00:17:58,640 --> 00:17:59,640
Danny.

276
00:18:02,160 --> 00:18:03,680
Are we expecting the Prime Minister?

277
00:18:04,720 --> 00:18:08,400
Director General MI5?
No, it's just us.

278
00:18:10,320 --> 00:18:12,536
And it's no longer
Defence Secretary.

279
00:18:12,560 --> 00:18:17,056
Mr Makinde has seen fit to
appoint me Foreign Secretary.

280
00:18:17,080 --> 00:18:18,640
So you report to me now.

281
00:18:19,680 --> 00:18:25,816
The Prime Minister wishes to pursue
a more robust foreign policy.

282
00:18:25,840 --> 00:18:28,456
And given the response
to the Russian attack,

283
00:18:28,480 --> 00:18:32,496
he has asked me to ensure
that there are no repeats of

284
00:18:32,520 --> 00:18:37,096
the failures of GCHQ
in the past few weeks.

285
00:18:37,120 --> 00:18:40,576
Three waves of unopposed
Russian cyber attacks

286
00:18:40,600 --> 00:18:42,256
and the loss of our and

287
00:18:42,280 --> 00:18:45,080
the NSA's most highly
confidential material.

288
00:18:47,640 --> 00:18:50,576
So we're going to do something
a little bit different.

289
00:18:50,600 --> 00:18:56,280
From now on, GCHQ and MI6
will be directly answerable to me.

290
00:18:57,560 --> 00:19:03,480
I would like to see this as
an opportunity to reset relations.

291
00:19:04,720 --> 00:19:09,296
I hope you do too. Of course,
Foreign Secretary.

292
00:19:09,320 --> 00:19:10,320
Good.

293
00:19:11,720 --> 00:19:12,720
Good.

294
00:19:15,160 --> 00:19:20,136
The search for a mole boils
down to two simple questions.

295
00:19:20,160 --> 00:19:24,696
Access and motive. We need to know
who had access to the computer

296
00:19:24,720 --> 00:19:25,936
and of those who did

297
00:19:25,960 --> 00:19:28,936
who had motive to pass
the Mac address to the Russians.

298
00:19:28,960 --> 00:19:31,616
The computer in question
served as a sandbox

299
00:19:31,640 --> 00:19:35,656
for the Malware department
for two years

300
00:19:35,680 --> 00:19:37,616
and two months
until the time of the attack.

301
00:19:37,640 --> 00:19:40,096
Anyone in Malware or IT
could have accessed the

302
00:19:40,120 --> 00:19:41,256
Mac address in that time.

303
00:19:41,280 --> 00:19:44,336
What about CCTV and logs?
They're cycled every few months.

304
00:19:44,360 --> 00:19:47,576
It would have taken
six months at least

305
00:19:47,600 --> 00:19:50,176
to build it into that malware
and run the operation.

306
00:19:50,200 --> 00:19:52,136
So those who only logged in for

307
00:19:52,160 --> 00:19:54,576
the first time this year
are off the hook.

308
00:19:54,600 --> 00:19:57,176
That includes you.

309
00:19:57,200 --> 00:20:00,960
But with thousands of log-ins
18 months before...

310
00:20:02,640 --> 00:20:04,736
it does mean we're looking
for a needle in a haystack.

311
00:20:04,760 --> 00:20:06,176
But there's a record of every time

312
00:20:06,200 --> 00:20:09,496
a Mac address is checked
in the log files.

313
00:20:09,520 --> 00:20:11,536
Date and time stamped.
So we just need

314
00:20:11,560 --> 00:20:16,136
to cross-reference those with
who was logged in at the time.

315
00:20:16,160 --> 00:20:19,456
Mm-hm. In that case,
it's lucky I had IT

316
00:20:19,480 --> 00:20:22,080
swap out the sandbox terminal
and bring it here.

317
00:20:37,520 --> 00:20:40,536
And the data of ours
that was stolen?

318
00:20:40,560 --> 00:20:42,576
Well, I've asked our
Composite Signals side

319
00:20:42,600 --> 00:20:44,480
to work on
a full inventory assessment.

320
00:20:45,760 --> 00:20:47,096
Nonetheless,

321
00:20:47,120 --> 00:20:50,280
Cyber Security remains
stretched to the limit.

322
00:20:52,240 --> 00:20:53,416
Is there any evidence

323
00:20:53,440 --> 00:20:56,216
that the Russians
are aware yet of their data loss?

324
00:20:56,240 --> 00:21:00,720
Uh, no. Trusov used UDP via Netcat.

325
00:21:02,560 --> 00:21:06,776
He bounced via satellite.
Several satellites, actually.

326
00:21:06,800 --> 00:21:09,336
We can trace the route back
because we know it's there.

327
00:21:09,360 --> 00:21:12,336
That gives us a back door
into the FSB.

328
00:21:12,360 --> 00:21:14,016
Until they know there's a leak,

329
00:21:14,040 --> 00:21:15,776
they won't be able to
discover the route.

330
00:21:15,800 --> 00:21:17,896
MI6 agents on the
ground confirm there's

331
00:21:17,920 --> 00:21:19,736
no clear evidence they're
aware of the leak.

332
00:21:19,760 --> 00:21:23,936
And while they are unaware, we can
basically see their every move.

333
00:21:23,960 --> 00:21:26,056
So the British public,

334
00:21:26,080 --> 00:21:28,616
who have seen ample evidence
of the Russian

335
00:21:28,640 --> 00:21:31,536
attack on our streets
and on our news,

336
00:21:31,560 --> 00:21:37,136
they as yet have seen no sign
of any actual response from us.

337
00:21:37,160 --> 00:21:39,080
They no doubt think
the Russians have won.

338
00:21:41,920 --> 00:21:43,776
The Prime Minister
has stated publicly

339
00:21:43,800 --> 00:21:46,616
that he will take equal
and proportionate action...

340
00:21:46,640 --> 00:21:51,056
Excuse me, Foreign Secretary.
A symmetric attack would

341
00:21:51,080 --> 00:21:54,416
be highly escalatory
and unpredictable.

342
00:21:54,440 --> 00:21:56,816
In my opinion,
it would be completely unnecessary.

343
00:21:56,840 --> 00:22:00,176
We are assured by our
colleagues here and in the US

344
00:22:00,200 --> 00:22:03,536
that the opportunity to listen
in on the FSB is priceless.

345
00:22:03,560 --> 00:22:05,816
If we listen,
we will listen robustly.

346
00:22:05,840 --> 00:22:09,160
If we respond,
we will respond robustly.

347
00:22:12,040 --> 00:22:13,976
That is why I am
seconding a team from

348
00:22:14,000 --> 00:22:17,816
the 14th Signal Regiment
and appointing their CEO,

349
00:22:17,840 --> 00:22:19,856
Lieutenant Colonel Cavendish,

350
00:22:19,880 --> 00:22:23,040
to the new post of
Director of Rapid Reaction.

351
00:22:27,400 --> 00:22:31,496
What's rapid reaction?
You want to attack Russia?

352
00:22:31,520 --> 00:22:33,880
You said you were
short of expert staff.

353
00:22:35,360 --> 00:22:36,480
These are experts.

354
00:22:37,760 --> 00:22:40,080
Your minister is listening.

355
00:22:45,880 --> 00:22:47,000
Thank you, gentlemen.

356
00:22:56,360 --> 00:22:58,256
Danny.

357
00:22:58,280 --> 00:23:00,096
You're still Director of Operations.

358
00:23:00,120 --> 00:23:04,096
14th Signals? That's soldiers.
They'll be offensive cyber.

359
00:23:04,120 --> 00:23:05,256
And with their own director,

360
00:23:05,280 --> 00:23:06,736
they'll be free to
act independently.

361
00:23:06,760 --> 00:23:08,856
And they'll still be
answerable to me.

362
00:23:08,880 --> 00:23:11,176
Yeah, it's just the
first shot, David.

363
00:23:11,200 --> 00:23:14,056
And with Marston as our boss now,
frankly,

364
00:23:14,080 --> 00:23:17,136
we are fucked. Everyone's on
edge because of the attack.

365
00:23:17,160 --> 00:23:20,376
When things calm down,
we'll find a way through.

366
00:23:20,400 --> 00:23:22,376
If Marston gets his way
and attacks the Russians,

367
00:23:22,400 --> 00:23:24,176
things are hardly
going to calm down.

368
00:23:24,200 --> 00:23:26,400
Our new minister seems
to be gunning for you.

369
00:23:27,600 --> 00:23:30,616
I understand David passed you
the details for Vadim Trusov.

370
00:23:30,640 --> 00:23:34,096
We're working on a plan.
We'll take it to our new minister.

371
00:23:34,120 --> 00:23:38,096
Marston, eh? We live
in interesting times.

372
00:23:38,120 --> 00:23:39,560
Robust times at least.

373
00:23:41,240 --> 00:23:44,776
Yeah, well, thank you for Vadim.
We owe him.

374
00:23:44,800 --> 00:23:47,320
Must dash. Do give my best
to Barbara, Danny.

375
00:23:51,320 --> 00:23:52,320
Come on.

376
00:23:59,000 --> 00:24:01,016
A gap.

377
00:24:01,040 --> 00:24:04,616
I'm not sure I understand.
It's really quite simple.

378
00:24:04,640 --> 00:24:08,096
These are all the log-ins to
the sandbox over an 18-month period.

379
00:24:08,120 --> 00:24:11,296
The haystack. And this is a list

380
00:24:11,320 --> 00:24:13,856
of the Mac address log-ins between

381
00:24:13,880 --> 00:24:17,776
the 31st of July
and the 1st of November 2022.

382
00:24:17,800 --> 00:24:20,256
The records for the Mac address
log-ins are missing.

383
00:24:20,280 --> 00:24:21,280
You can see here...

384
00:24:22,520 --> 00:24:25,936
where they've been
erased or removed.

385
00:24:25,960 --> 00:24:30,256
The FSB must have wiped them during
the attack to protect their mole.

386
00:24:30,280 --> 00:24:33,120
Well, at least we have those dates.

387
00:24:38,200 --> 00:24:40,160
It also rules out anyone from IT.

388
00:24:42,480 --> 00:24:45,096
IT check every computer
every few months.

389
00:24:45,120 --> 00:24:47,296
If it was one of them,
then they'd have cover.

390
00:24:47,320 --> 00:24:48,920
No need to wipe any records, so...

391
00:24:55,120 --> 00:24:58,256
Saara, tomorrow I want you back
with your malware colleagues.

392
00:24:58,280 --> 00:25:00,056
I'm moving you all to the EMC

393
00:25:00,080 --> 00:25:03,256
so I can personally oversee
the response to the FSB attack,

394
00:25:03,280 --> 00:25:05,936
and while we still have a back door
into their system,

395
00:25:05,960 --> 00:25:08,256
I want you to have a look
for the stolen Mac log-ins.

396
00:25:08,280 --> 00:25:12,896
OK? And before you ask, yes.
I've spoken to MI6 about Vadim.

397
00:25:12,920 --> 00:25:15,840
Thank you. I'll get started on
that straight away.

398
00:25:18,520 --> 00:25:21,960
If IT are ruled out, that means...

399
00:25:23,840 --> 00:25:25,720
It means it must be someone
from malware.

400
00:25:27,320 --> 00:25:28,360
From our team.

401
00:25:45,640 --> 00:25:48,936
Right, come on, come on.
Last chopper out of Saigon.

402
00:25:48,960 --> 00:25:50,816
Elliot!

403
00:25:50,840 --> 00:25:53,136
Come on, mate.
What have you been doing up there?

404
00:25:53,160 --> 00:25:55,056
He's been in the bathroom,

405
00:25:55,080 --> 00:25:56,760
making himself handsome
like his dad.

406
00:25:58,360 --> 00:26:00,736
RADIO: You're listening to This
Morning Britain, and we'll have.

407
00:26:00,760 --> 00:26:03,400
Prime Minister Andrew Makinde
with us at ten-past.

408
00:26:05,000 --> 00:26:07,016
PRIME MINISTER: Mr Putin
can rest assured

409
00:26:07,040 --> 00:26:10,056
the UK's alliance with the US
is unbreakable,

410
00:26:10,080 --> 00:26:11,136
and we're unshakeable

411
00:26:11,160 --> 00:26:13,536
in our opposition
to his territorial ambitions.

412
00:26:13,560 --> 00:26:16,736
We will answer his recent attempts
to undermine our infrastructure

413
00:26:16,760 --> 00:26:18,456
in like and in kind.

414
00:26:18,480 --> 00:26:21,616
But what I really want to talk
about is China.

415
00:26:21,640 --> 00:26:25,736
Oh, for God's sake.
We are negotiating a trade deal.

416
00:26:25,760 --> 00:26:27,496
What about their human
rights record?

417
00:26:27,520 --> 00:26:29,576
Exactly. Thank you.
This is a deal

418
00:26:29,600 --> 00:26:33,336
that will herald a second golden age
in Sino-British relations.

419
00:26:33,360 --> 00:26:35,000
Oh, God help us all.

420
00:26:37,240 --> 00:26:40,960
Right, we have arrived
at the juvenile correction facility.

421
00:26:45,920 --> 00:26:48,096
Child locks, Mum. Yeah.
I'll release you

422
00:26:48,120 --> 00:26:50,576
when you bid your parents adieu
in a civil manner.

423
00:26:50,600 --> 00:26:52,880
BOTH: Bye, Mum. Bye, Dad. Love you.

424
00:26:57,360 --> 00:26:59,616
RADIO: The UK Government
is now considering how

425
00:26:59,640 --> 00:27:03,176
to respond after one of the most
significant Russian cyber attacks...

426
00:27:03,200 --> 00:27:07,336
So... in recent history...
Marston's mob arriving today? Mmm.

427
00:27:07,360 --> 00:27:10,936
RADIO: concerns about the
growing threat of cyber warfare...

428
00:27:10,960 --> 00:27:12,400
Are you going to be back late?

429
00:27:13,560 --> 00:27:17,416
I have no idea. But if I am,
I'll get Charlie to give me a lift.

430
00:27:17,440 --> 00:27:18,536
All right.

431
00:27:18,560 --> 00:27:20,296
RADIO: They warned that if
the UK launches

432
00:27:20,320 --> 00:27:23,576
offensive cyber operations,
Russia could retaliate

433
00:27:23,600 --> 00:27:25,856
with even more severe attacks.

434
00:27:25,880 --> 00:27:28,376
You know, don't give
that place everything, Danny.

435
00:27:28,400 --> 00:27:30,376
And impact citizens'
everyday lives...

436
00:27:30,400 --> 00:27:32,496
Leave some for us, hmm?

437
00:27:32,520 --> 00:27:34,496
RADIO: So, as tensions rise...

438
00:27:34,520 --> 00:27:37,216
I'll try... the Government faces a
difficult choice.

439
00:27:37,240 --> 00:27:40,336
How to protect national
security without escalating

440
00:27:40,360 --> 00:27:42,040
a dangerous cyber conflict?

441
00:27:45,960 --> 00:27:47,336
Ms Napier. Thank you.

442
00:27:47,360 --> 00:27:50,656
And you've got visitors,
Mr Patrick. Uh... Oh, God.

443
00:27:50,680 --> 00:27:53,976
That must be them. Go on.

444
00:27:54,000 --> 00:27:56,720
Go be brilliant.
I'll see you later.

445
00:28:07,320 --> 00:28:08,856
Good morning.

446
00:28:08,880 --> 00:28:11,616
Danny Patrick,
Director of Operations, GCHQ.

447
00:28:11,640 --> 00:28:12,736
Lieutenant Colonel Cavendish,

448
00:28:12,760 --> 00:28:17,376
14th Royal Signals and Director
of Rapid Reaction, GCHQ, it seems.

449
00:28:17,400 --> 00:28:18,400
Well, welcome.

450
00:28:21,480 --> 00:28:24,416
I thought you had quite a few
service personnel here.

451
00:28:24,440 --> 00:28:26,576
Uh, they only wear their
uniforms on Military Monday,

452
00:28:26,600 --> 00:28:28,656
so they probably think you're
the firing squad come for me.

453
00:28:28,680 --> 00:28:29,680
Maybe we are.

454
00:28:32,640 --> 00:28:34,336
Morning.

455
00:28:34,360 --> 00:28:35,360
Hi.

456
00:28:42,560 --> 00:28:44,616
In all my time
as head of China Team,

457
00:28:44,640 --> 00:28:47,496
I've never seen such a fuss over
a trade deal.

458
00:28:47,520 --> 00:28:49,936
Oh, thank you, Lydia.

459
00:28:49,960 --> 00:28:51,120
Mmm.

460
00:28:52,520 --> 00:28:55,736
Economic and technical
security reports.

461
00:28:55,760 --> 00:28:58,456
God, they must have every
asset reporting on this.

462
00:28:58,480 --> 00:29:00,376
And the Department of
Trade and Industry

463
00:29:00,400 --> 00:29:02,936
want it all translated
and synopsised by tomorrow.

464
00:29:02,960 --> 00:29:05,136
HE SCOFFS I know, I know.

465
00:29:05,160 --> 00:29:08,416
But it is our duty, our privilege,
our joy, no less, to serve.

466
00:29:08,440 --> 00:29:11,536
So, let's get to work.
Calvin. Yes, ma'am.

467
00:29:11,560 --> 00:29:13,936
I've sent you each your allocation
to your desktop.

468
00:29:13,960 --> 00:29:16,800
I've printed yours out, ma'am,
as per. Oh, thank you.

469
00:29:18,200 --> 00:29:21,176
"Secret report on the CCP activities
in managed asset pools."

470
00:29:21,200 --> 00:29:24,200
Hedge funds. My favourite.
Let's give it our best shot, team.

471
00:29:26,040 --> 00:29:28,696
Any idea why they moved us up here?

472
00:29:28,720 --> 00:29:29,720
No, he didn't say.

473
00:29:31,000 --> 00:29:34,176
Oh, look, Phil.
Soldier boys. Your wet dream.

474
00:29:34,200 --> 00:29:36,216
Yeah,
some of us actually served, mate.

475
00:29:36,240 --> 00:29:38,296
GCO, Afghan. Yeah.

476
00:29:38,320 --> 00:29:41,816
Sat in a comms container
for three months playing Minecraft.

477
00:29:41,840 --> 00:29:43,656
The Event Management Centre

478
00:29:43,680 --> 00:29:47,976
or EMC, where we'll all be based.
Um, find a terminal.

479
00:29:48,000 --> 00:29:49,816
IT will set you up with log-ins.

480
00:29:49,840 --> 00:29:52,736
Yeah, we need to be accommodated
together in our own space.

481
00:29:52,760 --> 00:29:56,936
We'll just take that one. A hut.
Isn't that what you call it?

482
00:29:56,960 --> 00:29:59,776
Yeah... It's best
if all the reverse engineers,

483
00:29:59,800 --> 00:30:02,136
offensive cyber teams,
and analysts are in one space,

484
00:30:02,160 --> 00:30:05,056
so I can co-ordinate the response
to the FSB attack.

485
00:30:05,080 --> 00:30:07,376
I understand that you shall
co-ordinate the clean-up operation

486
00:30:07,400 --> 00:30:08,936
and damage assessment.

487
00:30:08,960 --> 00:30:13,256
I, as Director of Rapid Reaction,
shall co-ordinate said reaction.

488
00:30:13,280 --> 00:30:16,176
Whatever offensive operation
our minister orders.

489
00:30:16,200 --> 00:30:18,560
That conference room
looks sufficient for the time being.

490
00:30:22,960 --> 00:30:25,720
We also try to foster a culture
of civility.

491
00:30:27,280 --> 00:30:28,896
Good morning, everyone.

492
00:30:28,920 --> 00:30:31,256
I would like to introduce you
to your new colleagues,

493
00:30:31,280 --> 00:30:33,576
joining us from
the 14th Signal Regiment

494
00:30:33,600 --> 00:30:36,456
and our new Director
of Rapid Reaction,

495
00:30:36,480 --> 00:30:39,536
Lieutenant Colonel Cavendish.
Roz, please.

496
00:30:39,560 --> 00:30:41,096
Thank you, Danny.

497
00:30:41,120 --> 00:30:43,016
Er, first, the uniforms.

498
00:30:43,040 --> 00:30:45,736
Don't worry.
Everyone gets it wrong first day.

499
00:30:45,760 --> 00:30:47,536
CHUCKLES

500
00:30:47,560 --> 00:30:51,296
Yeah, I appreciate there's
a cultural difference here.

501
00:30:51,320 --> 00:30:53,480
You like to listen,
when you're not interrupting.

502
00:30:55,240 --> 00:30:57,336
We like to act.

503
00:30:57,360 --> 00:31:02,216
Hopefully, listening and acting
do not prove mutually exclusive.

504
00:31:02,240 --> 00:31:03,560
And the uniforms stay.

505
00:31:06,800 --> 00:31:07,920
As you were, troops.

506
00:31:10,920 --> 00:31:13,840
Max, Charlie Francis
from Security would like a word.

507
00:31:23,040 --> 00:31:25,576
OK, OK, let's crack on, shall we?
We've got a whole

508
00:31:25,600 --> 00:31:27,776
computer network to analyse
for vulnerabilities

509
00:31:27,800 --> 00:31:32,256
and damage and anything our Russian
visitors may have left behind.

510
00:31:32,280 --> 00:31:33,360
Let's have a good one.

511
00:31:47,040 --> 00:31:50,936
Just a routine security sift, Max.

512
00:31:50,960 --> 00:31:52,016
Given the scare,

513
00:31:52,040 --> 00:31:55,256
those on high are jumpy
and have asked me to check

514
00:31:55,280 --> 00:31:59,120
that all security protocols
have been, and are being, followed.

515
00:32:00,440 --> 00:32:05,256
OK. No bother. Like all teams,
you run a hot-desk policy?

516
00:32:05,280 --> 00:32:08,536
All your programmers can log
in on any computer? Mm-hm.

517
00:32:08,560 --> 00:32:12,816
This applies to all machines,
sandboxes included?

518
00:32:12,840 --> 00:32:14,040
Yeah.

519
00:32:15,440 --> 00:32:17,160
What happens
if you need to leave your desk?

520
00:32:19,080 --> 00:32:20,360
Well, then you log out.

521
00:32:22,280 --> 00:32:25,656
We're, uh, we're pretty hot on that.
Even for a quick pee?

522
00:32:25,680 --> 00:32:27,496
You leave a machine logged in,

523
00:32:27,520 --> 00:32:30,280
and someone comes along
and doesn't know...

524
00:32:31,520 --> 00:32:35,096
accidentally wipes all your work.
Mmm. Or, you know,

525
00:32:35,120 --> 00:32:39,680
spills coffee, whatever. So if
someone, while they're logged in...

526
00:32:40,800 --> 00:32:42,120
accessed something...

527
00:32:43,920 --> 00:32:46,136
Like what? Anything.

528
00:32:46,160 --> 00:32:47,856
Something on the system.

529
00:32:47,880 --> 00:32:50,816
It would pretty much have
to be through their own log-in?

530
00:32:50,840 --> 00:32:53,720
Yes, I'd have thought so.
Can you be 100% sure?

531
00:32:55,040 --> 00:32:57,840
Well, no, but... 99%.

532
00:33:00,040 --> 00:33:01,096
Is this about the attack?

533
00:33:01,120 --> 00:33:02,680
Just answer the questions, please.

534
00:33:11,560 --> 00:33:13,120
PHONE RINGS

535
00:33:19,400 --> 00:33:21,736
Alex. Danny. We've got the sign-off

536
00:33:21,760 --> 00:33:24,296
from Marston on
the Vadim Trusov exfiltration.

537
00:33:24,320 --> 00:33:25,576
That's good.

538
00:33:25,600 --> 00:33:29,136
But, I'm afraid we've had word from
Dutch intel.

539
00:33:29,160 --> 00:33:32,616
They've had a sighting of Trusov.
They've got a hack on the camera on

540
00:33:32,640 --> 00:33:34,616
the FSB entrance
in Saint Petersburg.

541
00:33:34,640 --> 00:33:39,536
It's not good news.
Needless to say, if they have him,

542
00:33:39,560 --> 00:33:44,856
we can't proceed, and I imagine
Vadim Trusov is in grave danger.

543
00:33:44,880 --> 00:33:47,056
Does that mean they know
we're inside their system?

544
00:33:47,080 --> 00:33:48,416
There's no indication as yet.

545
00:33:48,440 --> 00:33:53,456
But if the FSB have got him,
it can only be a matter of time.

546
00:33:53,480 --> 00:33:54,520
OK.

547
00:34:13,680 --> 00:34:15,696
Where are they? Where's who?

548
00:34:15,720 --> 00:34:19,016
The soldiers in the FSB system.
I mean, this is all us.

549
00:34:19,040 --> 00:34:22,016
What are they doing?
They're soldiers.

550
00:34:22,040 --> 00:34:25,096
They follow orders.
They don't ask questions.

551
00:34:25,120 --> 00:34:26,840
Maybe you should try it sometime.

552
00:34:28,240 --> 00:34:29,960
Right after my next sarcasm lesson?

553
00:35:19,520 --> 00:35:20,960
Looking for something?

554
00:35:25,160 --> 00:35:27,096
They're rigging the FSB
system to blow it up.

555
00:35:27,120 --> 00:35:29,056
Excuse me. If we blow the system,

556
00:35:29,080 --> 00:35:31,296
they'll find out how we got in
and trace it back to Vadim.

557
00:35:31,320 --> 00:35:33,600
Saara, go back to your station.
Shall we?

558
00:35:51,480 --> 00:35:52,640
Come in, Danny.

559
00:35:58,800 --> 00:36:00,336
Lieutenant Colonel Cavendish.

560
00:36:00,360 --> 00:36:02,760
I'm so sorry I wasn't
able to greet you earlier.

561
00:36:05,240 --> 00:36:06,896
Problem?

562
00:36:06,920 --> 00:36:08,816
I am the Director of Operations.

563
00:36:08,840 --> 00:36:11,856
I answer to the Foreign Secretary.
I cannot answer to him

564
00:36:11,880 --> 00:36:14,976
if there are operations being
conducted behind my back.

565
00:36:15,000 --> 00:36:16,896
My operation was ordered by
the Foreign Secretary.

566
00:36:16,920 --> 00:36:20,136
It has not been conducted
behind your back, but in parallel.

567
00:36:20,160 --> 00:36:21,176
Operation?

568
00:36:21,200 --> 00:36:25,616
To mine and blow up the FSB system,
and the Russians will retaliate.

569
00:36:25,640 --> 00:36:27,256
It will end in World War III.

570
00:36:27,280 --> 00:36:30,296
To install a comprehensive
array of degrading effects

571
00:36:30,320 --> 00:36:33,536
to trigger as and when we receive
orders from our superiors.

572
00:36:33,560 --> 00:36:37,576
We cannot have two chains of command
in the one operations room.

573
00:36:37,600 --> 00:36:39,016
We don't.

574
00:36:39,040 --> 00:36:42,776
We have two parallel operations.

575
00:36:42,800 --> 00:36:45,960
Our political masters will decide
which one they wish to pursue.

576
00:36:48,880 --> 00:36:50,760
In that case, I'll get back to
what I was doing.

577
00:36:52,240 --> 00:36:53,920
DOOR OPENS Danny, a moment.

578
00:36:59,760 --> 00:37:02,576
I don't like it either but we cannot
control the Government.

579
00:37:02,600 --> 00:37:04,136
We can only advise.

580
00:37:04,160 --> 00:37:07,136
After the last few weeks,
Marston's going to be all over us.

581
00:37:07,160 --> 00:37:08,976
You heard him.

582
00:37:09,000 --> 00:37:11,320
We need to be seen to be running
a steady ship.

583
00:37:15,160 --> 00:37:16,880
And we need to find that mole.

584
00:37:29,000 --> 00:37:32,016
Sally, can you get me Michaela Jones
at the NSA, please?

585
00:37:32,040 --> 00:37:33,040
Of course.

586
00:37:36,600 --> 00:37:38,096
You're gonna let her do it,
aren't you? Sorry.

587
00:37:38,120 --> 00:37:39,376
What about Vadim?

588
00:37:39,400 --> 00:37:41,416
It won't take them long
to work out how we got in.

589
00:37:41,440 --> 00:37:44,576
They're not going to blow it up.
Not if I can help it.

590
00:37:44,600 --> 00:37:47,496
But the news on Vadim is, um...

591
00:37:47,520 --> 00:37:49,536
It's not so good, I'm afraid.

592
00:37:49,560 --> 00:37:52,816
Hacked CCTV footage shows Vadim
and other coders being led out of

593
00:37:52,840 --> 00:37:54,856
the FSB headquarters
in St Petersburg.

594
00:37:54,880 --> 00:37:57,200
When? Same night he leaked
us the material.

595
00:37:58,480 --> 00:37:59,520
That's days ago.

596
00:38:07,360 --> 00:38:09,320
He's only there
because he helped us.

597
00:38:11,160 --> 00:38:12,816
What will they be doing to him?

598
00:38:12,840 --> 00:38:15,616
I don't know, Saara.
I don't know.

599
00:38:15,640 --> 00:38:16,856
MI6 believe that as long

600
00:38:16,880 --> 00:38:18,896
as Vadim is in the hands
of the Russian authorities...

601
00:38:18,920 --> 00:38:21,680
They need to get him out.
They won't be able to help him.

602
00:38:23,240 --> 00:38:24,280
I'm sorry, Saara.

603
00:38:26,880 --> 00:38:27,960
This is all my fault.

604
00:38:45,560 --> 00:38:48,096
That's Michaela for you.
Thank you, Sally.

605
00:38:48,120 --> 00:38:49,976
Michaela. Dan.

606
00:38:50,000 --> 00:38:52,000
We have a problem with
Richard Marston.

607
00:38:53,120 --> 00:38:54,736
He's been moved to Foreign,
hasn't he?

608
00:38:54,760 --> 00:38:57,056
Yeah. He's playing nice,
as nice as he can.

609
00:38:57,080 --> 00:39:00,696
But he's determined to live out his
Churchillian fantasies.

610
00:39:00,720 --> 00:39:04,336
So he's sent in his own dirty tricks
team to blow up the FSB system.

611
00:39:04,360 --> 00:39:07,616
Ah, shit. Greatest listening
opportunity we've ever had

612
00:39:07,640 --> 00:39:10,616
and he wants to piss it up the wall
for the sake of his own ego.

613
00:39:10,640 --> 00:39:12,656
How soon before
his finger gets itchy?

614
00:39:12,680 --> 00:39:15,280
Mmm, I don't know,
but my guess is not long.

615
00:39:17,000 --> 00:39:18,720
I'll talk to Perez. Thank you.

616
00:39:47,920 --> 00:39:51,096
I'd like to work on the
offensive cyber with you.

617
00:39:51,120 --> 00:39:53,056
I don't want to imagine
what they're doing to Vadim.

618
00:39:53,080 --> 00:39:54,600
I just want to hurt them back.

619
00:39:55,840 --> 00:39:57,040
I'm good at this.

620
00:40:03,200 --> 00:40:04,560
Yeah, start on the comms code.

621
00:40:06,080 --> 00:40:07,600
Then... we'll see.

622
00:40:09,120 --> 00:40:10,360
I'll be watching.

623
00:40:46,400 --> 00:40:48,256
KNOCK AT DOOR Come in.

624
00:40:48,280 --> 00:40:49,280
DOOR OPENS

625
00:40:53,200 --> 00:40:55,456
You're working with them now,
are you?

626
00:40:55,480 --> 00:40:56,896
You told me to look

627
00:40:56,920 --> 00:41:00,256
for our missing Mac log-in data
in the FSB system.

628
00:41:00,280 --> 00:41:02,256
Otherwise she'd see me in there.

629
00:41:02,280 --> 00:41:03,816
I'm impressed.

630
00:41:03,840 --> 00:41:05,496
And?

631
00:41:05,520 --> 00:41:08,296
Nothing. Not even a trace.
And there's no sign

632
00:41:08,320 --> 00:41:10,936
of any data they stole
from us in their system.

633
00:41:10,960 --> 00:41:13,480
NOTIFICATION CHIME
Sorry, Saara, I've got to take this.

634
00:41:14,800 --> 00:41:16,776
HE CLEARS THROAT

635
00:41:16,800 --> 00:41:18,200
General Perez, sir.

636
00:41:20,240 --> 00:41:21,336
You have two minutes.

637
00:41:21,360 --> 00:41:23,136
I appreciate I'm speaking out
of turn,

638
00:41:23,160 --> 00:41:26,016
but I felt you should
know our listening operation against

639
00:41:26,040 --> 00:41:29,240
the FSB is in danger,
and not from the Russians.

640
00:41:32,600 --> 00:41:34,080
Night, Dave. See you.

641
00:41:47,080 --> 00:41:48,280
PHONE NOTIFICATION CHIME

642
00:41:57,360 --> 00:41:58,360
Pub?

643
00:42:00,000 --> 00:42:02,040
Thanks. I don't really do pubs.

644
00:42:10,760 --> 00:42:13,176
So, what did old
Checkpoint Charlie want?

645
00:42:13,200 --> 00:42:14,896
Just routine, he said.

646
00:42:14,920 --> 00:42:17,456
But he was asking a lot of questions
about our sandboxes.

647
00:42:17,480 --> 00:42:20,376
Really? Phil? Changed your mind?

648
00:42:20,400 --> 00:42:23,176
Do you know a game called
End of Daze?

649
00:42:23,200 --> 00:42:28,336
Yeah, it's, uh... Horizon Zero Dawn
with a touch of Zelda.

650
00:42:28,360 --> 00:42:30,936
Phil's Mr Gamer.
The rougher the dystopia,

651
00:42:30,960 --> 00:42:32,496
the more he enjoys it.

652
00:42:32,520 --> 00:42:34,840
I just need to know how to get into
the Discord chat.

653
00:42:36,160 --> 00:42:38,320
Well... You'll be sorry you asked.

654
00:42:40,280 --> 00:42:42,296
Let's see.

655
00:42:42,320 --> 00:42:45,896
Yeah.
You need to switch those around.

656
00:42:45,920 --> 00:42:50,456
I swear, if one of
you ever goes behind my back to

657
00:42:50,480 --> 00:42:51,856
the Yanks like that again,

658
00:42:51,880 --> 00:42:54,560
I will see to it
that you're charged with treason.

659
00:42:57,520 --> 00:43:00,776
If I may, Foreign Secretary,
to function effectively

660
00:43:00,800 --> 00:43:04,176
as a government
intelligence gathering institution,

661
00:43:04,200 --> 00:43:07,136
there can be no going
behind anyone's back.

662
00:43:07,160 --> 00:43:09,696
I had hoped this could be a new
beginning.

663
00:43:09,720 --> 00:43:13,960
He means that we understand fully
and unequivocally.

664
00:43:16,640 --> 00:43:17,936
Just to be clear,

665
00:43:17,960 --> 00:43:21,456
we're not triggering the degrading
effects.

666
00:43:21,480 --> 00:43:24,880
That is correct, Lieutenant Colonel,
we are not triggering them...

667
00:43:26,680 --> 00:43:27,840
yet.

668
00:43:45,840 --> 00:43:47,840
How are the interviews going?

669
00:43:48,920 --> 00:43:50,080
Nothing jumping out.

670
00:43:51,640 --> 00:43:54,456
They're a pretty clean bunch,
your coders.

671
00:43:54,480 --> 00:43:57,000
They just busted their guts
turning this thing around.

672
00:43:58,080 --> 00:43:59,640
For one of them to be
the cause of it...

673
00:44:01,360 --> 00:44:03,040
oh, man,
that'd just break my heart.

674
00:44:04,400 --> 00:44:05,440
I pity them.

675
00:44:07,280 --> 00:44:09,056
Nobody wakes up in the morning
and says,

676
00:44:09,080 --> 00:44:10,696
"Today I'm going to betray"

677
00:44:10,720 --> 00:44:14,400
"my colleagues,
my friends, my family, my country."

678
00:44:15,760 --> 00:44:17,736
Sometimes they're believers,

679
00:44:17,760 --> 00:44:19,360
but usually they've been got to.

680
00:44:21,360 --> 00:44:24,040
Love, sex, blackmail.

681
00:44:25,640 --> 00:44:28,800
By the time we get to them, they're
in the worst place in the world.

682
00:44:30,320 --> 00:44:32,680
But don't worry, Dan.
We'll find the mole.

683
00:44:34,960 --> 00:44:36,240
Clock's ticking.

684
00:45:51,160 --> 00:45:52,480
TYPING

685
00:46:49,440 --> 00:46:50,680
What are you doing?

686
00:47:33,720 --> 00:47:36,720
Subtitles by Red Bee Media