Alex Gibney explores the next frontier of cyberwarfare in this white-knuckle nonfiction thriller.
Whereas nearly all forms of 20th-century combat go boom, the next frontier of cyberwarfare goes beep — or scarier still, it makes no sound at all as hyper-targeted malware disables or destroys its adversaries’ infrastructure. It is this silent threat, made all the more intimidating by a muzzle of secrecy in which those involved are forbidden even to speak about computer network attacks, that Alex Gibney not just exposes but almost miraculously manages to explain in “Zero Days,” a white-knuckle nonfiction thriller whose geek-speak title effectively announces that this new threat is already here and the world is now playing catch-up to contain it.
Clear, urgent and positively terrifying at times, the latest bombshell from one of America’s most prolific and unapologetically probing docu directors should do well for Magnolia Pictures, which acquired the film in advance of its Berlin Film Festival premiere, having previously backed Gibney’s no-punches-pulled films about Steve Jobs, Eliot Spitzer and the architects of the Enron fiasco. It was likely another of Gibney’s films, “We Steal Secrets: The Story of WikiLeaks” — in which the helmer found inventive visual solutions to present a relatively technical subject — that inspired producer Marc Shmuger to approach Gibney with the idea of investigating Stuxnet.
An unprecedentedly elaborate worm used in the real-world cyber-attack against Iran’s Natanz nuclear plant, Stuxnet was programmed to sabotage its target from within, manipulating uranium-processing centrifuges to explode while masking its own tracks. Had things gone according to plan, neither Iran nor the rest of the world would have realized they’d been hacked. But somewhere along the way, the worm got out, spreading to computers around the globe, where it finally caught the attention of an antivirus contractor in Belarus, before finding its way to the front page of the New York Times.
Though nearly all Gibney’s talking-head sources clam up at the mention of Stuxnet, as far as the filmmaker and his lawyers are concerned, the cat’s out of the bag: They feel confident in saying that Stuxnet — or better yet, “Olympic Games,” as it was internally called — was an operation between multiple intelligence agencies within the United States and Israel. But that’s only the beginning: New York Times reporter David Sanger (perhaps the film’s most quoted source) waited until the day before its Berlin premiere to break the news that Olympic Games was just one part of a much larger plan, code-named “Nitro Zeus,” that could conceivably cripple Iran’s infrastructure.
As in his “Client 9” documentary, Gibney hires an actress (Joanne Tucker) to perform testimony too sensitive for his sources to present themselves, although he takes the effect to a higher level here, putting the footage through an elaborate digital filter. He also pulls the trick of presenting her as a single high-level National Security Agency whistleblower, when in fact, her interview has been compiled from various sources. Combine this with the shadow-shrouded Israeli security figure whose computer-garbled confession opens and closes the film, as well as a Hollywood-caliber recreation (lifted from an Iranian state TV documentary) of the assassination of two nuclear scientists, and “Zero Days” takes on an exciting cloak-and-dagger dimension.
Will Bates’ tense doomsday music aside, it’s the philosophical aspect of the cyberwarfare issue that proves most unnerving. Gibney presents a lucid and impressively easy-to-follow analysis of the Stuxnet case, while tactically interweaving his hypothetical concerns about technology that remains so under-regulated and “over-classified” (per former CIA and NSA chief Michael Hayden, no less): whether an attack made in peacetime could be considered an act of war, what’s to stop Iran and other potential enemies from launching an equivalent or worse cyber-weapon against the U.S., etc.
When America dropped not one, but two atomic bombs on Japan in 1945, it helped to end World War II, even as it opened a massive Pandora’s Box, introducing a terrifying new weapon that other countries would also seek to possess — the very same arm’s race responsible for current nuclear tensions between the U.S. and Iran. Judging by the “Zero Days” subjects’ “deafening silence” (“This was really beginning to piss me off,” Gibney vents via voiceover), perhaps the administration’s stealth-like approach to cyberwarfare has been an attempt to prevent other countries from developing their own malware — except that whatever miscalculation brought Stuxnet to public attention (blamed here on Israel’s Unit 8200, which may have engineered the more aggressive version that “went viral”) ironically inspired Iran and others to develop their own “cyber armies.”
“Zero Days” is merely the latest documentary to take aim at the issue of secrecy in American government, slamming both George W. Bush and Barack Obama for their policies — not just for implementing offense-oriented cyberwarfare strategies, but for threatening to prosecute anyone who talks about them to the media. In one clip, Hilary Clinton holds the party line: that the U.S. had nothing to do with Stuxnet. But Gibney presents overwhelming evidence to the contrary, starting with a detailed analysis of the worm itself. Working with analysts at Symantec Research Labs, “Zero Days” literally sets out to decode the malware, with two analysts clearly explaining how the worm operates.
Words alone would probably bore most viewers, but Gibney and visual effects vet Sarah Dowland create a sophisticated way or representing the complex program, digitally altering photo and video artifacts, then pushing past the surface to reveal an elaborate three-dimensional matrix of code — a strategy that feels like plunging beneath the skin to study the elaborate double helix of human DNA. This recurring visual motif blends well with the digital maps and selective re-enactments, including an exploding balloon model meant to show how Stuxnet can selectively turn vulnerable Siemens PLC machines (used to regulate motors, pumps and other infrastructure devices) against themselves.
One doesn’t need a mushroom cloud — though Gibney offers a few — to imagine the potential havoc malware can unleash, though it’s not Stuxnet the world has to fear. That worm had a built-in cut-off date, but if Gibney and Sanger’s sources are to be believed, operation Nitro Zeus represents a far greater threat, one that could be just as easily redirected against us. The film illustrates how Iran already struck Saudi Aramco and several U.S. banks, and then there’s the question (reported in the news, but not so explicitly raised here) of how U.S. ally Israel might use the technology. While most people weren’t looking, America went and changed the rules of engagement, and with “Zero Days,” Gibney urgently suggests how little time the world has to clarify its stand before the wrong party goes too far.