01x06 - Episode 6

[bunniefuu]

So what made
you decide to leave,

come to Moscow?

Because I'm fed up
with lying to the public

about what's really going
on at GCHQ where I work.

I've done 50 years of service

and I've had enough.

It's time for me to stand
up and say my piece.

And I've had enough.

It's time for me to stand
up and say my piece.

And what is that?

You were
friends, weren't you?

Hi. Sorry?

You were friends.

Yeah.

At least I thought so.

So what are you looking for?

I don't know.

A clue, anything.

I just can't believe
he'd do this to us.

"Us."

He goes missing at the same time

as the biggest leak in
intelligence history.

He turns up in Moscow and
admits it on Russian television.

I'd have thought that
was enough evidence,

even for you.

You mean I should
get back to work.

That's OK, Saara.

I think we all gave
up hope a while back

of you ever actually doing
any work around here.

Don't people hate having
their grammar corrected?

I mean, doesn't it just
make everyone hate you?

If we wrote code as sloppily as we
write English, it would never run.

Some things have to be right.

Is that all you're having?

I'm Muslim.

They don't have
anything halal here.

They won't be very welcoming.

- What's funny?

No different to any other
department here then?

Different "from" any
other department.

It's "different
from, compared with."

No different "from"
any other department.

It's "different
from, compared with."

Different from, compared with.

Different from, compared with.

Different from, compared with.

Different from, compared with.

Different from, compared with.

Different from, compared with.

Different from, compared with.

Because I'm fed up with
lying to the public

about what's really going
on at GCHQ where I work.

I've done...

stand up and say my piece.

And what is that?

That we are no different to what
we're always accusing you lot of.

- Yes!
- What is it?

He said "different to."

He would never say "different to."
He would never make that mistake.

It can't be him.

What? Saara, wait.

Where is he?

Danny's on his way
to London, Saara.

sh*t!

Kathy?

She's not here.

Where is she?

- She's gone.
- What do you mean gone?

What did you say to her?

I didn't say anything. I came
back and she was packing.

She's been recalled to Maryland.

Er...

She flew about 25 minutes
ago. She left you this.

What's going on, Saara?

And don't lie to me this time.

You're in love with
her, aren't you?

Don't lie, please.

I don't know.

Maybe.

Have you made love here?

Yes.

OK.

Where does that leave us?

Do you still love me?

Did you ever really
love me?

Don't go, James,
please. I'm sorry.

I know you just lost your dad...

and I
know you're upset,

and I know you say you can't
deal with your emotions.

I've tried to make allowances,

I really have.

But when you crash into
people's lives, people get hurt.

People who care about
you. People who love you.

Just try and think about that?

f*ck.

Ah, Mark, welcome.

Sorry, I'm late.

It's fine.

I'm sure I don't need to tell you
the effect of the Yeabsley leak is...

devastating.

Most of our tools have
been rendered nugatory

and will have to be
built again from scratch.

Our priority now is to keep what
little we do have left secure.

As of 2000 hours
today, Eastern Time,

the NSA's intelligence-sharing
arrangement with the UK is withdrawn.

For the foreseeable future.

Er, Mark...

It signals cooperation
between our two countries,

it goes back 75 years
and it plays a vital...

This decision comes from the
commander-in-chief personally

and is not open for discussion.

The question we're all
asking ourselves here is

why the hell you
re-employed a loose cannon

like John Yeabsley
in the first place?

- Hi.
- You all right?

Where do you want me, Sarge?

Er, get yourself round the back.

Make sure no press are trying
to get in through the garden.

Hey.

You're gonna need a mask, Sandy.

Oh, I'm just going straight
through, thank you.

Hiya.

Sorry. Thanks.

James, it's me again.

Please call me back.
I know you're angry.

We need to talk.

Come on!

GCHQ Intelligence
Analyst, John Yeabsley,

seen yesterday on Russian TV

admitting responsibility for
a massive leak of GCHQ secrets

could not have been in Moscow
yesterday. Back to Dan.

- Yes!
That's right, Alan...

Yes, yes, yes! I knew it!

In light of what the police
are saying here tonight,

the interview shown yesterday
on Russian TV seems likely now

somehow to have been faked.

As he was clearly already
dead, here in Cheltenham,

when he was supposedly
being taped in Moscow.

Oh, dear...

A mountain of code.

Perhaps it will make you,
er, check your assumptions.

Remember the Nigerian prince.

If you find yourself scouring through
thousands and thousands of lines of code,

that's probably exactly what
they're expecting you to do.

Don't.

Do something else,

unexpected.

You have to think
outside the box.

If you can't, then you have
to find someone who can.

Should I offer to help?

Oh, no, she doesn't
need any help.

She knows exactly
where everything is.

Don't you, dear?

It's the first time we've had one
of Gabe's work friends to visit.

Isn't it, Gabe?

We'd almost given up hope.

Sorry?

He was turned down by so
many employers before GCHQ.

We moved here so we
could look after him.

He can't
live alone, obviously.

I know you said you didn't
want to help me any more

- but I'm in trouble.
- What kind of trouble?

What I'm saying is...

I've got GCHQ into trouble.

OK, what I mean is...

I didn't realise
I was being used.

I think there's a
third-stage malware, Gabriel,

hidden inside the code.

I need to find it.

Someone tried to warn me about
it, that it was really dangerous,

but it's only now I think
I know what he meant.

- Who warned you?
- That's not important now.

There's been a massive leak
of data from GCHQ, right?

Incredibly damaging?

I think that's what
the third stage does.

I think there's some hidden
part of the original malware

that was built to
steal our data.

But I can't find it.

I've been back through the code
line by line. There's nothing.

That's the puzzle, Gabriel.

- I'm asking if you'd...
- It's OK, Saara. I get it.

Where are you going, Gabe?

Sorry.

But what about the curfew?

-It's obfuscated. You don't need to...
Wait.

I was just trying to say you
don't need to waste time on it.

The original code's obfuscated.

They included all this garbage
so that anti-virus software

wouldn't recognise
it as malware.

How many lines of garbage?

I don't know, thousands.

We stripped them out
so we could work on it.

Tea?

Before you stripped them out, you
tried to get it to run in a sandbox.

That's right. How did you know?

What happened?

Nothing. It didn't run.

- They designed it so that it...
- Oh, I think it did.

It didn't, Gabriel. I
tried it again and again.

It just sat there.

I watched. Nothing happened.

You need to learn to look at
the garbage in a different way.

It's all about patterns.

Finding the code, hidden
within the garbage.

But in this case...

it's more complicated
than normal.

Usually, there'd be
one character of code,

and, say, five
characters of garbage.

In that case, you just need to write
a script to read one character in six.

So you're saying
it's not all garbage?

Then...

there's where the number of real
code and garbage characters vary

according to a regular pattern.

Say, one in four, then one in three,
then one in two and back up again.

And that's what we've
got here in the BT code?

No.

This is more complicated.

Here, there's no simple pattern.

The code characters
and garbage characters

vary according to an algorithm.

So, we can't extract the hidden
code unless we know the algorithm?

Oh, I've worked out the algorithm.
That's what took me the time.

There's your third stage.

Hidden inside of what you
thought was just garbage.

That's a data scraper.
That's how it mined our files.

That must be the MAC
address of your sandbox.

That's how it broke
out into our system.

It can't be.
Yes, I think so.

But how could they
possibly know that?

A MAC address is
like a fingerprint.

How could someone in
Russia know the address

of a particular computer
at GCHQ? It's impossible.

No, it's obvious.

Obvious? How?

Someone must have told them.

OK, even if that is true,

it doesn't explain how
they got the data out.

This malware
doesn't communicate.

It exfiltrates as email.

The data goes out
as attachments.

The emails get lost in the flood
of all our other email traffic.

No one notices.

They've moved on from
NSA exploits, by the way.

Now they're taking
our own stuff.

What?

Your emails
are still going out.

What?

They must know what we're doing.

Every time I cut a link to a
domain, they set up a new one.

We're losing a
massive amount of data

every second.

The scraper you
found in the garbage.

Can you can shut it down,
stop all this at source?

Of course.

Then do it!

Please.

- Is that it?
- Yes.

You've stopped it?

Of course. Why do you
sound so surprised?

You're brilliant.

I owe you an apology.

You're right, you do.

I'm sorry.

What you did last
night was amazing.

as well as in Bradford,
the central Mosque in Southall

was fire-bombed while a
service was taking place.

A spokesperson for the Muslim
Council of Britain blamed the attack,

one of dozens reported
in the last 36 hours,

on the breakdown in public order in the
aftermath of the disputed election...

What is it?

They're attacking mosques again.

My brother works at
a mosque in Swindon.

Well, you should go.

We read about it everyday
in the papers and on our phones,

we hear about it on the radio,

we speak about it every
morning with our neighbours...

we watch it every
night on the TV news.

And of course, when they're
attacking us in the streets,

when they're
burning our mosques,

we want to strike back.

Why wouldn't we?

It's only human.

It sounds easy,
brothers and sisters,

as do all the words of Shaytan.

He speaks to us
when we're angry.

He fans the flames of our
completely reasonable anger

which comes from fear

and the desire to
protect those we love.

But we don't protect them,
brothers and sisters,

by meeting violence
with violence.

Violence only breeds more
violence, more hatred.

We hit back and
they hit us again,

even harder.

The way of Allah,
Subhanahu wa-ta'ala,

is the harder way, the
more courageous way.

The voice of Shaytan rages in our
ears, blasting out all other sound.

You will hear the voice of
Allah, Subhanahu wa-ta'ala,

when you are quiet,

when you are at rest,

when you are at peace.

Saj?

Hello, sir.

- Shut the door.
- Yeah.

What is it?

I've just been speaking
to the Prime Minister.

Apparently, MI5's found
some compromising material

on the Foreign
Secretary's laptop.

What kind of material?

I'm not sure. They're
sending it over, the laptop.

Inappropriate communications
with someone inside

- the Russian government, that's all I've been told.

"Highly prejudicial
to national security."

For f*ck's sake.

Surely even they must know
that's a Russian plant?

I don't know. It looks
authentic, apparently.

None of the usual signs of
crashing around inside a computer.

If it's a plant,
it's a clever one,

hard to prove.

Anyway, she's had to resign.

We're being played, aren't we?

Have been. At every stage.

Yeah. Yeah.

And very convenient that we should
lose our best friend in government

at this precise moment.

Secretary of
State for Defence.

I said after the BT attack
that if we didn't respond robustly,

we'd be hit again
and we have been.

Our election has been undermined and
our most sensitive secrets stolen.

By any measure, this
constitutes the cyber equivalent

of an armed attack on
the United Kingdom.

An act of w*r.

Head of
Operations, GCHQ.

I'm not...

disagreeing that a strong
response is required

but you should be aware
that if you decide upon

a symmetric cyber-attack,

it will be highly escalatory.

Truth is they've been
one step ahead of us,

provoking us,

anticipating how we'll
react at every stage.

It's vital that we do not
react as expected now.

We should be careful of empty gestures
that have profound consequences.

Empty gestures?

Yes. Especially if there are
other motives for doing it.

What other motives?

Can I speak frankly?

Of course.

To shore up the
position of a government

whose legitimacy
has been questioned.

- To distract attention.

Is that what you think
is going on here?

With the greatest respect to our
colleague from GCHQ, Prime Minister,

that is a completely
outrageous suggestion.

This country has either faced an attack
amounting to an act of w*r or it hasn't.

And if it has,

it is our duty as the properly
constituted government to respond.

It's nothing to do with legitimacy or
any other political considerations.

Can I just remind us that
the then Attorney General

made our red lines absolutely
clear in his 2018 speech.

Use of cyber to manipulate
the electoral system

explicitly constitutes an
intervention in our domestic affairs.

If, after that
speech, we do nothing,

we are basically saying it's OK to
just roll your tanks into London.

Yes, I see your point.

Of course, if we retaliate, we
might expose some of the things

we ourselves are doing,

within Russia's critical
national infrastructure.

Which would leave us open to the
accusation of double standards.

But if that is the
way you wish to go,

Prime Minister, Danny can
lay out some further options.

We don't need your options.

The army will be taking
the lead this time.

Good luck with that.

What was that?

Nothing.

Good, because Russia has effectively
declared w*r on this country.

And, we, those of
us around this table

are charged with the
defence of this nation.

I require your support to do so.

David.

I'm sending you a team from
the National Cyber Force.

I want you to build them an attack,
targeting the Russian arms industry.

And I want it done
today. Can you do that?

Put them out of action?

We can certainly try.

It's time to show us what
we've been paying for at GCHQ.

All this money we've spent,

it's time to show
us what you can do.

I'm sorry, Saj.

You were right.

I should've thought more carefully
before I took the job at GCHQ.

About the consequences
for our family.

I over-reacted.

No, you didn't.

You were right.

I shouldn't have gone there.

I've made a mistake. At work.

What mistake?

I suppose you can't say?

I did something...

I thought was really clever.

But it wasn't.

It was incredibly
stupid and gullible.

And it's allowed something
terrible to happen.

Are you sure?

Because you always think
everything's your fault.

You have no idea.

Anyway, Dad was my fault.

What? How is that your fault?

He k*lled himself.

He k*lled himself because I
went away to uni and left him.

- No, Saar...
- He did.

- I abandoned him.
- No, that's not what happened, Saar.

- Yeah, he k*lled himself.
- He didn't k*ll himself.

I mean sorry to ruin this "I'm
to blame for everything" thing

you've got going, but no,

he didn't k*ll himself.

If you'd come home,
you'd know that.

It was an accident.

A signalman made a mistake.

He sent a goods train up a line that
was supposed to be out of service.

Dad took a short cut across the
track and the train hit him.

It wasn't suicide.

You're just saying that
because suicide is haram.

No, I swear on Mum's life.

That's what happened.

You may have behaved like a
sh*t not coming to see him

but he didn't commit suicide.

I liked your sermon.

Thanks.

I mean, I... I agreed with... I
agreed with everything you said.

Do you think I should resign?

Oh.

That's up to you,

but we'd be losing the last real
voice of moderation around the table.

There'd be nobody left
to protect the staff.

Well, what about you?

Me?

They'd sack me 15 seconds
after you're out the door.

Sorry, they're ready.

They're ready.

Um,

I told Barbara to take the kids and go
and stay with her parents in France.

- You're joking.
- No, absolutely not.

Well, it's not that bad, is it?

I don't know. But I'm pretty
sure this, us attacking them,

it's exactly what
they want us to do.

You have to ask yourself why.

Do you think I should
get Freddie out?

Maybe.

Ready, boss.

OK, what happens now?

You stand aside and
we press the button.

That way it's covered
by the "rules of w*r"

and you don't end
up in the Hague.

OK, Finn. Up you get.

Control-E.

How long will
it take to have an effect?

No time at all.

It's happening now.

Is this real?

Real? I doubt it.

Danny? Can
I have a word with you?

- What is it?
- A private word.

- What is it?
- Our comms are down.

- Sorry?
- All our comms are down.

I wanted to speak to you out here
because I didn't want to create a panic.

- What, just army comms...
- To be honest, we're not sure.

I managed to get through to the
MOD on one of your landlines.

They're requesting that GCHQ
help re-establish contact.

- With...
- With UK Armed Forces.

Sorry, Danny.

The Defence Secretary
is on the line.

Which channel?

No, I mean he's actually on
the line. He's on the phone.

Richard. We've just heard.

Heard what?

About your loss of comms.

Not that. The nuclear submarine
control system is unresponsive.

It may have been hacked.

What?

Are you... Are you
absolutely sure?

Richard?

Richard?

If there's anything still
working around here,

try and get me NSA up
on the satellite...

- on this one.
- OK.

I've decided to leave.

GCHQ.

OK.

But if you've made a mess,

don't leave before
you've cleared it up.

You should never leave someone
else to clear up your mess, Saar.

Mitch.

Danny.

Look, I know you guys aren't
talking to us at the moment

but I thought you should
know somebody just hacked

our nuclear submarine
control system.

What? You're kidding?

Plus all of our
military comms are down.

The Russians have just
spent the last two hours

exaggerating the effect
of a very targeted attack

on a couple of arms
factories to make

whatever it is they're doing
look like self-defence.

And my guess is, they've been
planning this for a long time.

Yeah, the problem is we're seeing those
images of hospital fires too, Danny...

Yeah, they're fakes, Mitch.

- Well, they look pretty real to us.

I've gotta tell you,

there's not a lot of warm feelings
towards you guys here at the moment.

We really could do with
some help right now, Mitch.

You can't
use that in here.

You can't use that
here. Turn it off, now.

OK, but I've got
to write this down.

Have you got any paper?

Saara, wait.

I've got nothing to say to you.

Please.

I think you're about
to be attacked.

The UK.

I've got something to give
you that will stop it.

I don't believe you, Vadim.

It's just another provocation.

Anyway, I thought you said
in Harrogate they'd k*ll you.

I don't care any more.

I don't care what happens to me.

This is too important.

Look at this.

What is that?

It's you. At your desk in GCHQ.

OK, you hacked the CCTV.

So what? What does that prove?

Saara, please. There
isn't much time.

You have to trust me. You
have to think outside the box.

What? What did you say?

JSSO's showing unidentified
aircraft entering our airspace.

None of the other
systems are showing it

and the RAF doesn't seem
to have been scrambled yet.

But it is possible
we are under attack.

It's just another hack,
isn't it? Fake news?

But what if it's real this
time, you know, like crying wolf?

How can we take that chance?

- What, an invasion?
- Why not?

We've been underestimating
Putin for ten years.

All the way through we've been
asking what's the bigger picture.

The one thing we've never considered
is that he might just be insane enough

to have territorial ambitions.

What if this whole thing is
about separating us from Europe

and the Americans so that when
this moment came, we'd be alone?

Not now, Saara.

Danny, you absolutely have
to come and see this. Right now!

It's the CCTV, so what? Saara,
I don't have time for this.

You have to turn it off.

Please.

I can't show you what I've got to
show you until you turn it off.

Shut down the CCTV.

Really?

Yeah. Do it.

They hacked the system.

The FSB were watching
everything we're doing.

They can't. It's
air-gapped. How do you know?

Because I've just been
inside their computer.

I'm sending you something
now. Two things.

You can use them to
trade with the Americans,

to bring them back in.

As soon as that happens,
Putin will back down.

During this first phase,

we are degrading the capability
and resolve of our enemy

as well as discrediting

his institutions and
leadership with espionage,

assassination, er,
manipulation of social media,

cyber attacks,
faking of imagery...

all with the aim of
creating disillusionment,

confusion and chaos.

Er, by the time w*r
is openly declared,

- the enemy's ability to defend himself...
- w*r?

will be significantly reduced...
Danny?

- We're receiving a data dump.
- Where from?

Russia.

In the next phase, we engineer...
- OK, let's go.

Er, our enemy's
strategic situation.

His, er, relationships with his allies
are fatally undermined, one by one.

It's mostly code.
There's terabytes of it.

I think it's the FSB's
offensive cyber exploits.

My God!

This puts us back in the game.

So how is all
this to be achieved?

How do you ensure that, er, the
final phase, the w*r is won?

The w*r is won using a technique
called Reflexive Control.

This is, er, the...

Predetermining the enemy's
behaviour in Russia's favour.

We define our
ultimate objective...

We define our ultimate objective,
the total defeat of our enemy.