Zero Days

This two-hour documentary released Friday, July 8, and playing in selected theaters and streaming online, traces the history and consequences of Stuxnet, a sophisticated piece of malware unleashed on the world in 2010. Before you yawn and click away, there's an important feature of the Stuxnet worm and others like it that makes this story of vital interest to you. Stuxnet was not designed to invade your home or office computer, but to attack the industrial control systems that manage critical infrastructure. These systems make sure trains and airplanes don't crash, control car and truck traffic, maintain oil and gas production, manage industrial automation, ensure you have water to brush your teeth with and electricity to run the coffee maker, keep life-saving medical technology operating, and, of course, give you access to the internet. Cyber-attacks on these systems cause real-world, physical destruction, even widespread death. Behind the Computer Screen The Stuxnet story—still highly classified, but revealed over time—began with an effort by the United States and Israel to thwart Iran's ability to produce nuclear weapons by destroying centrifuges at the country's Natanz uranium enrichment facility. The software was diabolically clever, virtually undetectable, and essentially untraceable. In theory. The fact that it was a Zero Day exploit--that is, that the attack would begin before the software problem was discovered and attempts made to fix it or shut it down--and that the Stuxnet code contained not one, but four zero day features, was remarkable. Once it was inside, it worked autonomously; even the attacker could not call it back. The Israelis, apparently, were impatient. They assassinated Iranian nuclear scientists, and they changed the Stuxnet code, and it spread. It ended up infecting computers worldwide, at which point it was no longer secret, people were looking for it, and the Russians and others found it. "Israel blew the (malware's) cover and it could have led to war," the film says. Another consequence is that the day when something similar can be unleashed on us grows ever closer. It will come from one of three sources: • Cybercriminals, in it for the money • Activists, intent on making a political point or • Nation-states seeking intelligence or opportunities for sabotage. U.S. security agencies are not complacent. While they talk publicly about our cyber-defenses, in fact, there is a large (unexamined) effort to develop offensive cyber-weapons. There are reports of an even more draconian cyber-weapon embedded throughout Iranian institutions. Warding off its activation is believed a primary reason the Iranians finally struck a nuclear agreement. Certainly it prompted the rapid development surge in Iran's cyberarmy. In putting this story together, writer and director Alex Gibney interviewed former high-ranking U.S. and Israeli security officials, analysts from Symantec who teased the code apart, personnel from Russia's Kaspersky Lab, and many others, including CIA/NSA/DoD officials unable to speak on camera. "Fear Does Not Protect Us" The documentary makes a persuasive case for who holds the smoking Stuxnet gun, but it also suggests that finding fault is not the primary issue. The climate of international secrecy around Stuxnet—and the inevitable clones that will follow—makes an open discussion about them impossible. Nor does it allow development of rational strategies for managing the risks, regardless of how urgently needed those strategies are. Cyber-risk management will never be easy, but as one of the film's experts points out, "it will never happen unless you start." The subject is "hideously overclassified," says Michael Hayden, former director of both the NSA and CIA. (The climate of secrecy is so extreme that even the U.S. Department of Homeland Security cyber team was unaware that Stuxnet originated across town and spent countless resources trying to track it down.) We, of all nations, need this debate, because there is no more vulnerable country in the world, when it comes to systems' connectedness. "Evil and good live side by side," says an anonymous agent of the Israeli intelligence agency, Mossad. Keeping secrets is a good way to prevent being able to tell one from the other.

Zero Days is an important documentary devoted much needed attention to the issue of cyberwarfare, focusing on a case study of the Stuxnet attack. It provides a behind the scenes take on the discovery and the development of the virus, as well as the political developments that caused it to spiral out of control.

Alex Gibney does a good job of explaining the technical aspects of the computer virus, as well as the political context that spurred the United States and Israel to develop the computer virus. He assembles a good cast of interviewees from various perspectives on the issue. Although Gibney has a definite viewpoint, he gives both sides of the question a hearing.

Although I had previously watched news coverage dealing with Stuxnet, this documentary goes far more in depth, making good use of inside sources within the NSA. In particular, Gibney examines the split that emerged between the United States and Israel over the use of the virus, ultimately culminating in a near disaster. The film provides a disturbing warning of how the American and Israeli governments have potentially opened a Pandora's box.

This film is important viewing that should be seen by everyone interested in current events or concerned over the implications of American foreign policy.

The new weapons of warfare (specifically computer viruses) and the climate of secrecy and legality, in which such weapons are used are excellently portrayed in this documentary. Experts of high standing from both the intelligence and cyber security communities have been interviewed and their insights and opinions wonderfully woven together to tell the story of the most complex stealth- like computer virus to have targeted very specific critical infrastructure to date, aka 'The Stuxnet' virus This documentary covers new ground in documentary film making and uses the Stuxnet virus as a platform to explain many of the complexities, secrecy and politics involved with international cyber warfare and the dangers and to some extent morality of it. Essential informative viewing without doubt!

This documentary about the Stuxnet worm that attacked Iran's uranium centrifuges tries to get at the truth about who was behind the attack. The movie shows interviews with a lot of high-ranking people who either won't talk or who will only comment about very public information. The facts are that Stuxnet was a large and very sophisticated computer virus, ultimately capable of infecting any Windows PC but it only activated inside of very specialized equipment: one brand of programmable logic controllers attached to a very specific configuration of machines. The target pattern matched Iran's uranium enrichment facility.

The movie's point is that, like the Trinity atomic test in New Mexico in 1945, Stuxnet has let another genie out of the weapons bottle. This genie is cyber weapons that can strike anywhere on the planet essentially in an instant.

If that makes you nervous, then the movie has met the filmmaker's objective.

I watched the BBC Storyville version of this film, which appears to run about 20 minutes or so shorter than the feature currently in cinemas; not sure what was lost in that, but I mention it for context. At the start of the film we have several talking heads who refuse to even respond to a question regarding the computer virus/worm which attacked Iran's nuclear centrifuges; this opening sets the stage for a documentary where a lot has to be pieced together, or cannot officially be known, but yet manages to do it in a way that gives the viewer a broad view, with enough detail to aid understanding, but nothing likely to lose you (I say this as someone who can setup his wifi but not much more).

The film starts after the fact and works backwards. In doing this it allows to do enter the subject via the security companies who found this virus and started trying to figure out what it does. This is done in a way that is engaging and accessible, even though you are talking about guys reading screen after screen of code. From here the film starts to draw in the politics, to explain Iran, and as it does this, the pieces fall into place – just as they did for the security guys. This framing helps make the film clear to follow, but also builds the tension in the film as we go from the unknown, to the understanding, and then are left with what it means for the road ahead.

The film's ending doesn't really do a good job of leaving us with that chill (I think the drawing in of the Iran deal didn't really work), but mostly it still does leave the viewer thinking about how much could go wrong if key infrastructure elements were switched off or controlled to do harm. Watching it a few days after the inauguration of Trump only makes it more chilling, since the only time I have heard him speak about this he said "So we have to get very, very tough on cyber and cyber warfare. It is — it is a huge problem. I have a son. He's 10 years old. He has computers. He is so good with these computers, it's unbelievable. The security aspect of cyber is very, very tough. And maybe it's hardly doable". Hardly oil on troubled waters.