“I truly don’t know and even though I truly don’t know, I still can’t talk about it.”
— Michael Hayden, Zero Days
“It’s important to tell the story of Olympic Games,” says David Sanger. The New York Times reporter isn’t talking about the athletic contests you might have in mind. He means Operation Olympic Games, a secret sabotage campaign directed against Iranian nuclear facilities. While neither the US nor Israel has acknowledged the program, it was initiated in 2006 and became visible with the malicious worm named Stuxnet in 2010. The attack and its effects have already had consequences. “As a nation,” Sanger goes on, “We need to have a debate about how we want to use cyber weapons, because we are the most vulnerable nation on earth.”
Alex Gibney’s new documentary, Zero Days, takes on both the vital need for the debate and the prodigious resistance to starting it. Opening in theaters on 8 July and available on iTunes and VOD, the film is structured as a series of interviews with people who talk and don’t talk. A montage of talking heads near its start treats the dilemma with some humor, declarations by experts and officials that they can’t talk about it, that they don’t know much about it, that they understand this must be frustrating for the filmmaker.
“I won’t acknowledge or knowingly offer up anything I consider classified,” begins former CIA officer Rolf Mowatt-Larsse. “Countries aren’t happy about owning up to what they did,” says Colonel Gary D. Brown, former Staff Judge Advocate at US Cyber Command, “Because they’re not quite sure where they want the system to go.”
Off-screen, Gibney confirms his frustration, and persists, turning to people who will talk about it, including anti-virus-engineers-turned-detectives from around the world. As they recount their investigations and discoveries, the film works something like a thriller. Gibney talks to Sergey Ulasen, the antivirus expert in Belarus who first found the unnamed virus in 2010, then Eugene Kaspersky and a couple of Symantec engineers, Eric Chien and Liam O’Murchu. All are simultaneously impressed and mystified by the sophistication of the virus, its lack of a cut-off date and its aggressiveness — characteristics that identified it as the work of a nation state, an entity with tremendous resources of time, money, and technology.
Between these two sorts of storytelling — one apparently straightforward and the other obviously not — Gibney’s questions form their own narrative, bringing together and breaking down what his interviewees say and don’t say. Cyber weapons, the film points out, mark a change in how surveillance technologies might be used. Where NSA was primarily tasked with defensive work, “code-making and code-breaking”, now the mission might and does include offense.
“If you can spy on a network, you can manipulate it,” says Michael Hayden, former head of NSA and the CIA. “It’s already included, the only thing you need is an act of will.” That act began under the Bush administration and came to a kind of fruition under Obama. Hayden goes on to note that the program’s home agency has shaped its development and the thinking of those developing it, all premised on secrecy, a system he describes as “this we-don’t-talk-about-these-things box”.
It’s the not-talking that troubles GIbney. If Stuxnet’s history includes successful “insertions” (the worm that stymied Iranian nuclear weapons development for years), it also features unanswered — and worse, unasked — questions, having to do with what Gibney calls “unintended consequences”. Sanger identifies one when he says the US, so brilliantly networked, so technologically advanced, is “the most vulnerable nation on earth”.
Along with the information that might be hacked and systems that can be shut down (power grids, planes, trains, medical facilities), this vulnerability has to do with the very premise of this program: secrets. “DC is a city of secrets,” notes Gibney, over gorgeous nighttime-illuminated images of streets and monuments, “But it’s also a city of leaks.” And so he turns to speakers with stories to tell, beyond the investigation after the fact, to the inception, the reasoning, the invention, and, most chillingly, the lack of foresight.
For the story of Stuxnet is less about its immediate goal and achievement (to stop or slow Iran’s nuclear program) than it is about what comes after. What are the moral or political consequences? What are the limits of behavior that might be expanded or obliterated? Who believes in what limits? And who communicates about those beliefs and those limits. Emad Kyael, Executive Director of the American Iranian Council, points out that the attack by a cyber weapon is an act of war. “Let’s say a nuclear facility in the US was targeted, if it wasn’t Iran,” he posits. “The American government would not sit by and let this go.”
As much as the US might want to avoid debate on that question — to keep it in the “we-don’t-talk-about-these-things box” — the debate about it is already in progress. Zero Days offers an exceptionally compelling incarnation of it in a visually compelling interviewee, an NSA engineer who worked on Stuxnet. To protect their identity, Gibney uses an actor reading from a transcript, then digitizes that performance. The strategy draws attention to the problem and also the intrigue of secrecy, extending the meta-critique embodied as well by Angelina, the prostitute interpreted by an actor in Gibney’s 2010 documentary, Client 9: The Rise and Fall of Elliot Spitzer.
Where “Angelina” protected the speaker’s identity, the digital figure in Zero Days does that but also dramatizes the problem of such protection. Not being able to talk means not being able to debate, to question, to know. Configured as a woman, she’s made of digital flecks that never stop moving, that make a code and break a code before your eyes. Her blond hair is shimmery and also disintegrating as she describes the culture at NSA as “two parts macho military and two parts cyber geek”. As the camera pans a re-enacted cubicle, populated by Batman and Han Solo action figures, the Death Star made out of grey Legos, she remembers that the developers had their own focus and jokes: “Saying Stuxnet out loud was like saying the name Voldemort in Harry Potter, the name that shall not be spoken.”
The perfection of this irony is hard to overstate, as the film repeats the name that shall not be spoken, even when everyone knows who or what we’re not talking about, because we are talking about it. The cyber figure scoffs entertainingly at ideas proffered by the anti-virus guys, or rationales conjured by politicians and administrators, she is most fascinating for what her very conception proposes regarding how stories and secrets circulate. She is the puzzle — the virus, the idea — made vividly eloquent and visible. Her story illustrates how secrets can’t be sustained, how they corrupt, how they affect lives. And she makes clear who’s affected most immediately, those whose lives are altered by a cyber weapon, a system shutdown or shift.
The lessons of all kinds of war remain unlearned. Innovation in warfare is governed by short-sightedness. Smart, seductive and seemingly trustworthy, this cyber figure may or may not be the truth you’re seeking. At least she makes you wonder if she is, and makes you think about the questions you’re asking.