Synopsis
Gibney started out to make a film about the Stuxnet computer virus,
which reportedly was used in a destructive attack on Iran’s nuclear
program by the security agencies of the U.S. and Israel, even though no
official in either country will acknowledge that such a thing ever
existed. But the filmmaker ended up being propelled into two much larger
stories, which are intertwined and till now have had very little
purchase on public consciousness.
The first is the existence and
mounting peril of cyber warfare. As “Zero Days” shows, this form of
cryptic aggression is already highly developed, in the possession of
numerous governments as well as non-state actors, and currently employed
in various surreptitious ways around the world. Yet it’s a weapon whose
destructive potential has only been glimpsed till now. In a cyber world
war, millions could be killed in very short order as national
infrastructures are decimated and havoc wreaked technologically. It’s
enough to make old-fashioned nuclear war seem benign in comparison.
The
film’s second great subject is the secrecy that surrounds the first and
prevents citizens and their governments from discussing it, much less
doing anything about it. Gibney doesn’t explore how much this is a
result of post-9/11 paranoia and security measures, and how much simply a
product of a decades-long growth in government secrecy, which climaxed
with the Obama administration’s unprecedented war on whistle-blowers.
But the film shows that even some of the nation’s highest-ranking secret
keepers now think the policies have been taken too far, and indeed
increase rather than reduce the dangers posed by cyber warfare.
While
together these subjects and Gibney’s storytelling skills make “Zero
Days” play like a riveting espionage thriller crossed with a uniquely
chilling sci-fi horror yarn, the film remains in the realm of fact
throughout. Gibney starts out recalling the assassination of Iranian
nuclear scientists in 2010, and then the discovery of Stuxnet, in
Belarus. Though the virus was identified as coming from Iran, by that
time it had spread all over the world.
The danger may have been
technological, but its appearance in the world was, of course,
political. Following the invasion of Iraq, George W. Bush
faced an Israel that was threatening to bomb Iran, which it claimed was
developing nuclear weapons with the express aim of destroying the
Jewish state. Frustrated, Bush told aides he didn’t want to see himself
or any of his successors put in the position of having only two choices:
a nuclear Iran, or Israel starting a war that the U.S. would surely be
drawn into. Offered a third way, he okayed the development of a cyber
warfare campaign against Iran that linked the NSA, the CIA and the
Defense Department with Israel and its Mossad.
Naturally, no
American or Israeli scientists who worked on developing Stuxnet—a
program that in the government was called Olympic Games—speak for
Gibney’s cameras, but the malware’s composition and operation are
lucidly described by virus experts and illustrated by Sarah Dowland’s
smart graphics. The most destructive code ever developed, the virus,
when introduced by human agents into Iran’s nuclear facility in Natanz,
caused centrifuges to spin too fast or too slow, and violently
self-destruct.
Though the weapon had the desired effect on many of
Natanz’s centrifuges, the offensive could hardly be counted a success
from the outset. The Israelis jumped the gun on implementing it—when
Obama, who was now president, and Joe Biden learned of this, the vice
president reportedly flew into a rage—and did so in a way that made it
leap-frog all over the world. Thus Obama got the two things that he
expressly didn’t want: the virus escaping Iran, and the U.S. identified
as its source.
While Gibney does not show that Iran claimed its
nuclear program was only for peaceful purposes (an assertion backed up
by U.S. and international intelligence experts), the Natanz attack
proved to be only a temporary setback in any case. Not only did the
program come roaring back stronger than before, and Iran rapidly build a
Cyber Army of young people bent on defending their country, but the
Iranians mounted cyber attacks of their own, successfully targeting
Saudi Aramco and several U.S. banks. Their message was clear: “We can do
this too.”
As significant as these ground-breaking attacks and
counter-attacks were, they only indicated a tiny portion of what was
possible even then. As “Zero Days” reveals, the U.S. has a program
called Nitro Zeus that makes Olympic Games look like a sandbox game.
Aimed to “disrupt, degrade and destroy” Iran’s infrastructure, the
program would mean “a full scale cyber war,” in the words of one expert,
a war in which the U.S. would be subject to the same sort of attacks.
Releasing
Stuxnet was, as has been observed, opening a Pandora’s Box, and now its
effects have spread across the globe. The Russians were big on this
kind of warfare from early on, and most states are now assumed to be
building their own cyber arsenals. But how do we get a handle on what is
really going on?
“This is really beginning to piss me off,” says
Gibney after about the fifteenth official, former official or expert
puts on a bland smile and says he can’t doesn’t know a thing about
Stuxnet and couldn’t say anything if he did. This whole “wall of
secrecy” policy—which renders the whole subject “hideously
over-classified,” in the words of one high-ranking former
official—leaves the public, the press and Congress unable to engage in
the debate that this perilous technology demands. The point is made
that, although they took a long time, treaties were eventually produced
that contained the threats of biological, chemical and nuclear weapons.
But you can’t even get a start on such instruments for cyber weaponry
unless you can acknowledge and discuss them.
