01x01 - Episode 1

[bunniefuu]

This programme contains strong language and
scenes some viewers may find distressing

SHE STRAINS

MUTED HAMMER TAPS

HOLLOW THUDDING

RAPID TYPING

LOCK RATTLES

MECHANICAL GEARS CLINKING

ELEVATOR BELL DINGS

ENTRY KEYPAD BEEPS

SHE SIGHS

BELL RINGS

APPLAUSE

Well done, Gabriel.

I think that's the fastest it's
ever been done. Congratulations.

INDISTINCT CHATTER

I like your pens.

They're in spectrum order.

And before you say that
pink is in the wrong place,

pink has nothing to do with red.

It's actually
white absent green.

Well done on the challenge.

They're obviously
going to take you.

You were incredibly fast.

If we're going to talk, I should
warn you, I'm not very good

at noticing when people want
to speak or change the subject,

so the conversation
could last half an hour,

or several days...
It's OK, it's OK.

I'm Saara, by the way.

I'm Gabriel.

KEYS JANGLE

SHE INHALES

It's fine... Hello, Ami.

Oh, my God. What
are you doing here?

Why didn't you ring?
Is everything OK?

I'm fine. I was just passing.

Just passing? What
are you talking about?

London's over an hour away.

You'll stay for...? Where's Abu?

Sorry.

Is he still at work?

He's in his den.

He's off work again.

Abu? DOOR SHUTS

Hey.

So...

..have you heard?

I got it. Ah!

HE EXCLAIMS

Oh, yes...

You haven't told your mother?

You know she wouldn't
understand. Of course not.

They don't know
anything about it.

Good.

Come. Sit, sit.

Mum said you're off work
again, Abu. Are you OK?

I'm fine. I was a bit
down, but I'm fine now.

I'll be back on Monday.

Down... like last time?

No, nothing like that.

Anyway, when I see
you, I feel better.

How long can you stay?

I'm sorry, Abu... I have
to get back tonight.

You've got classes
in the morning.

I'm really sorry. Oh,
don't be ridiculous.

Classes are important.

But you have time
for a quick game?

Of course. Excellent!

You do think it's OK, Abu?

What I'm doing.

Ah, this girl.

You'll be spending a year
learning to defend our country,

and at the end you go
back to university.

What could be wrong
with that, huh?

Hmm...

Oh... Ha.

Hey. You'll be brilliant.

Yeah.

We're in.

Happy for us to move
to the next step?

Go.

OK, let's get some resilience.

They're inside.

They've broken in.

How?

It doesn't matter how.
We'll work it out later.

Get going.

I want them out.

I told you this was a bad idea.

We've accessed credentials for
your ops and management system.

What? OK to proceed?

They've got the passwords.
They're about to log in.

Wait.

Zahir? ALARMS SOUNDING

Zahir?

I'm seeing red lights,
Tahmid. What's going on?

CONFUSED CLAMOUR

We're down. We're down.

What the f*ck...

What did you do?

Uh, nothing.

We're just logging in
to the system now...

Finn?

Erm...

Yep. Uh, looks
like the internet.

What do you mean, the internet?

I think we're
offline. Can't be.

Do you know what, pull out now.

I want you completely
disconnected from our estate.

CALL ALERT

Hey. My line just went
down. What's going on?

You'd better get up here.

Sorry to keep you waiting.

I'm Max.

Hi.

Oh, we're not shaking
hands at the moment.

Oh.

Of course. Sorry.

Well, welcome to GCHQ.

Tell me.

We have a serious problem.

Your stress test just took
down half our infrastructure.

Whatever you did, you need
to undo it, right now,

before it starts to
impact on public safety.

Rich? Can't be us, boss.

We never got beyond
the admin platform.

HE EXHALES OK.

Sorry, I'm totally overdressed.

Oh, don't worry.

We all make that mistake
on our first day.

We're very glad to have you.

As you can see, we're
hideously male, stale and pale.

Sorry?

Old and white.

Like me.

I hope that's not
why you picked me.

Because I've got a brown face.

No, of course not.

Where are you going?

We've been summoned.

Why don't you come?

You might find this interesting.

Erm, BT Openreach provides
the infrastructure for most of

the UK's internet. At 0907
this morning, whilst we were

stress-testing their systems, they
experienced a partial shutdown,

impacting, as far as we can tell,
about 55% of internet provision.

Oh, Chrissie, have you met
Max? He's our head of malware.

Hi. How you doing?

Now, we're still checking,
obviously, but so far

it looks like National
Grid's ICS is OK.

Same with gas and water.
Rail signalling is down...

Are you sure it's OK
for me to be here?

But the motorway signals... Why
not? You're DV cleared, aren't you?

Air traffic control is still up,
but it seems most of the flights

have stopped, because they use
the internet to control aircraft

on the ground. Uh,
online banking is down,

and some of their core
comms are affected.

So, most of the cash
machines are offline...

What about smartphones?

Sorry. Caroline
Fitch, Number 10.

Chrissie, can
smartphones get online?

Chrissie's head
of security at BT.

Yeah, as far as we can tell.

But a lot of the systems
they access are affected,

so there's not much they can do.

Erm, some of the big
email servers are down.

There's no Zoom, no Teams,

which has taken out all the
new hospital appointments.

Uh, there's no online shopping.

But social media is
unaffected, interestingly.

All in all, quite cleverly targeted
to cause significant disruption

without actually putting
that many lives at risk.

So, it's a cyber attack?
That's what you're saying?

We think so, yeah.

Virgin was also affected,
which rules out the stress test

as the cause, or any
hardware problems within BT.

That only really leaves malware, and
using the stress test as a cover.

Can I jump in?

Uh, yeah, go ahead.

Kathy's one of our analysts,
on attachment from the NSA.

So, the Russian bots
are already retweeting,

and it is mostly about
how all the ATMs are down.

Uh... "Another f*ck-up by this
sh*t-for-brains government."

"Just another scam by the
elite to steal our money."

"The bankers are screwing
us over again." Yada, yada.

It's a bit quick,
don't you think?

I mean, it's almost like
they knew it was coming.

Thanks.

So, is that it?

The malware?

Yep.

Mind if I take a look?

SAARA TYPING

What's all this garbage?

I don't understand.

It's obfuscated.

Some kind of FinFisher thing.

Hey. It's Kathy, right?

Yeah. NSA would like to
take a look at the code.

Well, has Danny approved it?

Well, he told me to update them.

Yeah, but he did he say that
you could give them the code?

KATHY SIGHS

So, you want me to walk all
the way back down the hall?

Really? Absolutely.

That's the way we do it here.

You do know that they're
only trying to help?

We're on the same team, guys.



You see these jumps?

Mm-hm.

They hop over the garbage.

So it's never actually read?

That's right.

So what's it there for?

To confuse the look of the code,

so the anti-virus software
won't recognise it as malware.

OK, how do we get round it?

We find a reverser that
locates all the garbage.

And then we write a
programme to delete it.

Is that what you're doing now?

Amongst other things.

Can I help?

No.

So what do you want me to do?

We have a test environment.

Do you mean a sandbox?

Paste in the code and see if
you can get it to run in there.

It's isolated so you can't do any
harm and we might learn something.

I'd really prefer to
help with the reversing.

Danny, it's the
Foreign Secretary.

Well, can we schedule a
conversation before then?

Yes, I'd like that.

Thanks.

Elizabeth. How are
you holding up?

Erm, I have had better
days, and nights.

Interesting timing,
don't you think,

right in the middle of
an election campaign?

Yeah. Will it have
much of an impact?

People not being
able to get online?

Absolutely.

Feeds straight into
the populist agenda.

The Government's crap, can't
organise a piss-up in a brewery.

Plus Labour does most of
its campaigning online,

so the Internet going down
looks very convenient for us.

So now we're corrupt,
as well as incompetent.

Anyway, where are we?

We are currently
about 35% restored.

It's not straightforward
unfortunately.

There's a lot of anti-debugging
tricks in the code, so...

I imagine you're
assuming it's Russia?

Well, as you know,

we try to avoid making
attributions prematurely.

Anything in the
code which suggests

a particular team could
be a misdirection.

And as soon as we
point the finger,

then there's pressure
to retaliate,

and we're into a
tit-for-tat escalation.

But what's your gut?

That it's probably
Russia. Most likely FSB.

OK, because, according
to our embassy in Moscow,

the lights have
been flashing on,

and off in Putin's office
for the last half hour.

Really?

So that's nothing to
do with you, then?

No, but if it's true,
then that's pretty funny.

Yes, hysterical,

as long as it's not us or
anyone acting as our proxy.

Can you check please, Danny?

Yes.

I don't understand.

It ran inside BT's computers.
Why won't it run here?

You can write malware so it
knows when it's in a sandbox.

It searches for normal
computer activity.

If it can't find
any, it deactivates.

Is there a workaround?

You could paste in
some Word documents,

scroll around a bit.

That can make it think that
it's in a real environment.

But it's not always a guarantee.

Can I use this?

Do you always change
the subject like that?

Sorry, I? Why do you need it?

If there's something you don't
understand, you can just ask me.

It's not about work. I need
to make an outside call.

I didn't know they were going to
take my phone off me at reception.

Yeah, it's nine and
then the number.

Paste in those Word
documents, right?

Mr Prime Minister, throughout
this election campaign you've made

a great deal of the fact that you
are Britain's first black Prime

Minister and that you understand
ordinary working people.

But your father was an incredibly
wealthy Nigerian businessman,

and you spent your childhood in one
of Britain's top public schools.

Oh, come on, Campbell,
not that old chestnut?

Look, I don't think that's what
people are worrying about at all.

I think they're worrying about...
Isn't it? Isn't it, Prime Minister?

This country's in the middle of the
deepest recession this century...

Hello, this is Ahmed.

Please leave a message
after the tone. Thank you.

VOICEMAIL MESSAGE REPEATED
IN ANOTHER LANGUAGE

TONE

Hi, Abu, it's me.

Just checking in to
see how you're feeling.

You can't really ring me back
here but I'll try again later.

Love you.

ON TV: I don't know what
you're implying, Campbell,

but I live here too, you know, and
this recession has nothing to do

with Brexit, which
is a huge success.

Kathy? Have you got a moment?
Sure. What do you need?

The Jolly Roger? Jolly Roger.

"You've been Rogered"?

Subtle.

Oh. He blames Russia
for the attack

and he says that he's retaliating.
Calls himself a patriotic hacker.

Right. That's all we need.

Yeah.

This is nothing to do with
any of you? No. No. Nothing.

No? No-one's encouraged
him? Not at all. Nope.

No.

How do you think he
knows that it's Russia?

He doesn't. He's
just grandstanding.

But this is all anyone's
going to remember.

When we come out with
the official attribution,

no-one's going to be listening.

All right, thanks, Kathy.

Oh, did you get my message?

No, I don't think I did.

NSA's asked to see the
malware code. Is that cool?

Erm, yeah, why not?

Thanks. What's the problem?

Oh, there's no problem. OK.

ON TV: Almost certainly not the
image party election managers wanted

on your TV screens tonight.

The Prime Minister being
aggressively heckled while

campaigning in Bristol.

And, as a precaution,

I'll be chairing a COBRA
meeting on Sunday at 10am.

In the meantime...

CROWD SHOUT OVER EACH
OTHER In the meantime,

in the face of this criminal
and unprovoked cyber-attack,

I have instructed
the security forces

to do whatever's necessary to
find out who's responsible.

CROWD NOISE INCREASES

And to ensure that your services
and access to your bank accounts,

and your hard-earned savings,
are absolutely safe and...

MUMBLING

Thank you. Thank you.

Extraordinary scenes here.

The Prime Minister's
rarely been seen outside

the Westminster bubble since,

as a junior minister
not even in the Cabinet,

he ousted Boris Johnson in

a particularly bloody
palace coup 15 months ago.

But with the Conservatives
running six points behind in

the polls, this campaign
is confronting him with

a very real anger some feel
about the economic crisis,

and just how deep
the disillusionment

with authority in
general now runs.

Phil.

I still couldn't get it
to run in the sandbox,

so I thought I'd take a
look at the code itself.

I hope you don't mind.

I think I might have
found something.

Ah, that's OK.
We've all done it.

Done what?

Tried to reverse a library.

It's boilerplate code.

It's just there to
avoid the coder having

to write some common
functions from scratch.

It's the one bit you don't
need to bother reversing.

I know what a library is.

I think there's something
else hidden in there.

Probably thought we
wouldn't bother checking.

Saara found it, one of our
work experience students.

Thanks.

It's a dropper,
right? Yeah, tiny.

That's why we missed it
the first time round.

If you run it, it raises a flag.

What's the flag?

Saara?

A like.

On this Facebook page.

I suppose someone somewhere
must be monitoring it.

It's a tripwire. If they
see a like on the story,

then they know we've
downloaded the payload.

I presume you've managed to pull
it down without tripping it?

I think so. And? I'm not sure yet.
It's obfuscated, like the last one.

HE SIGHS

Danny. There's a second virus,
hidden inside the first.

I think we should upgrade
to a Level One attack.

Level One? Really?

Yeah, I think so. This
degree of sophistication.

And maybe we should call JSTAT,

get them to raise the
threat level to Critical?

We don't know what
this new one does yet.

OK, I'll call Number 10. Thanks.

Right, shut it down. OK?

And find out what it was meant
to do. Quick as you can please.

Got it.

Well done, Saara.

Excuse me.

CHANTING

PHONE RINGS

Hi. Where are you? Why
didn't you call back?

Why, what's wrong?

Abu's had an accident.

On the tracks.

What? He's in the hospital.

You need to come.

I can't. Not right now.

Just give me... He's
asking for you, Saar.

You need to get back here.

I will. I'll get a train
as soon as this is done.

I'll be there soon.
Pass please, Ma'am.

Thought we'd lost
you. Are you OK?

My dad's not well.

Do you need to go?

No, it's OK.

Plug in, they're about to start.

Saara, do you want to follow me?

Go on, then.

Leave it. You won't need it.

..about 70% left.
See you in a bit.

Andy, good to see you. We'll
catch up after the meeting.

Home Secretary,
nice to see you. Hi.

Do you want to sit
down, just there?

QUIET CONVERSATION

As you will know from the CRIP,

we've located the malware
within BT's systems and,

with some round-the-clock work,

its code has been 70%
reverse engineered.

Based on what we've learnt,

I'm confident we can have
most of the Internet back up

and running by midnight tonight.

As far as we can tell,

this virus has never been
seen in the wild before,

which means it was specially written
to take down sections of the BT,

and Virgin infrastructures,

which is quite a feat, considering
the built-in safety features.

Perhaps most notably, it
doesn't seem to be communicating

with any sort of home
base, which is unusual.

Really? Is that the
most notable thing?

Because I'd say it's the devastating
effect it's having on our economy,

which is already in
recession. And which,

I can tell you from
personal experience,

is going down with voters
like a bucket of cold sick.

It could have been
worse, Prime Minister.

How?

Well, if the attack had
happened on Monday morning.

Instead of on Friday.

Which is, in fact, exactly
what would have happened,

Prime Minister, if it hadn't
been for the sharp eyes of one

of our work-experience students,

who spotted something else,
hidden inside the malware code.

Danny.

Yeah, at 9am tomorrow morning,

a second stage attack
was set to activate,

this time taking out
the entire Internet,

with potentially
catastrophic results.

The whole country,
including vital services,

would have been left
unable to get online,

just as the Monday
morning rush began.

And this is the young
student who spotted it.

WHISPERS: Stand up.

Do we know who's responsible?

For the attack?

We're still working on that.

Well, the Jolly
Roger seems to know,

judging by the way he's
flashing the lights off

and on in Putin's office.

Perhaps we're relying on him for
our cyber responses nowadays.

I'm sorry to interrupt
this happy moment,

Prime Minister, but I'd be glad of
some clarification, if that's OK?

You say the second malware was
spotted by this young woman.

What's her name?

Saara Parvin.

And she's a student?

Yes, that's right.

And the rest of GCHQ just...

..missed it?

I'm sorry, is that something
we're supposed to applaud?

I mean, it's hardly
reassuring, is it?

If she hadn't been doing her work
experience or whatever it was,

the entire panoply of our cyber
security apparatus would have missed

an extremely dangerous attack,

paralysing commercial
life in this country for

the second time in four days.

If a student could find this
thing and the rest of you didn't,

how do we know there isn't
something else hiding in there...

..waiting to go off
at 11am tomorrow?

Or 2pm or whenever?

I think you'd better go back and
take another look, don't you?

See what else you've missed.

And let's have some options for an
offensive cyber attack on Russia.

I'd like to know what
we can do to retaliate.

OK.

Get everybody back tonight.



Where have you been?

How is he? Where
have you been, Saara?

I got here as
quickly as I could.

SHE SOBS

What's happened?

Tell me.

Abu died. About
half an hour ago.

It's OK, Ami. It's OK.

SOBBING CONTINUES

Are you sure you
want to do this?

What was he doing on the tracks?

They're not sure.

There's going to have
to be an investigation.

SHE SOBS

They're withholding his body.

What?

What, why? There's going
to have to be a postmortem.

So can't we bury him?

The police won't let us.

Not yet. Why?

Is it because it might
be suicide? Saara!

I'll get you some tea. No.

Saara can get it.

It's fine, Ami.
I'm not an invalid.

Why don't you just go? You
know, if you're in such..?

SLAMS TABLE Enough, Ami!

Give her a break!

None of this is her fault.
No, I won't give her a break.

Her father has just died
and she shows nothing.

She looks at her watch!

All she ever thinks
about is herself.

Why are you so selfish?

Tell me. Because I
don't understand.

That's not fair, Mum. I'm
sorry, I can't do this.

That's right, leave!
Like you always do!

DOOR SLAMS

For those of you who don't
know, we've just returned from

London where we were
comprehensively beaten up at COBRA.

Yeah, but just because
it was unpleasant,

doesn't mean it
wasn't justified.

There was a Level One attack
on the Internet on Friday,

and all of our focus has been on
isolating the malware responsible

and disabling it.

With the pressure to get
everything back up and running,

it's hardly surprising that we
weren't looking as carefully as

we should for extra
functionality in the code.

The fact that it was one of our work
experience students that found it,

in a place we wouldn't
ordinarily be looking,

probably doesn't reflect that
well on us, if I'm honest.

Certainly not in the opinion of some
of the members of COBRA, anyway.

SCATTERED LAUGHTER

So we're going to be going
back over the malware code,

line by line, see what
else is hiding in there.

It's a big task,
and it's urgent.

We cannot afford to
be caught out again.

Malware will be leading this and
some of you will be reassigned

for a bit to help out.
GROANS AND MURMURS

And shifts will be
extended again, I'm afraid,

until this gets sorted.

OK. Sorry about that.
Let's get to it.

Saara?

Hey, listen, I'm sorry about what
I put you through at COBRA today.

I didn't see that coming.

You should go home.
You look exhausted.

No, I'm fine, honestly.

I'm serious, Saara.
You look terrible.

I can't. Everyone
else is working.

Go home, OK?

You did a really good job today
and it will still be here in the

morning, I promise you.

ON TV: A completely ill*gal
and irresponsible attack,

which could have been far
worse if it hadn't been for...

DOOR OPENS AND CLOSES

..the carefully prepared strategies
we brought into play on Friday.

Everything will be fully back
up and running by midnight.

In fact, many services have
already been restored...

FOOTSTEPS

WHISPERING: Hey.

What incredible timing
for your first day.

I thought they'd
never let you out.

How was it?

What is it? What's wrong?

Saar?

My father died this evening.

I am so sorry, Saar.

What?

When? When? What happened?

You're probably hungry.

..countries like the United
States, countries like France,

Spain, Germany and many
others which believe in

and are prepared to stand
up for the rule of law.

And I can assure you
that we will respond to

the attack within the law,

and at a time and in a
manner of our choosing.

NOTIFICATION

The rules based international...

Hi. Are you watching?

Yeah.

And how are we getting
on with his options?

We're not. It's a
really bad idea.

We have to do this, Danny.

Right. And to hell
with the escalation?

Because that's where this
leads. You know that.

OK.

Finn, get up here.

Yes, boss.

..can claim a
similar legitimacy.

But just because
this is a democracy,

it doesn't mean we are weak

or lack the will or the
capability to defend ourselves.

And we will defend ourselves,

with all the force available
to us, within the law.

Thank you.

SHE SOBS AND WHIMPERS