All language subtitles for The.Undeclared.War.S02E01.720p.HEVC.x265-MeGusta[EZTVx.to]

This programme contains
some strong language

I have decided to declare a state of emergency.
The Prime Minister has issued a statement.

A foreign power is attempting to subvert

our democracy and our elections

and that power is Russia.

Following the attack on the UK's
political institutions and telecoms,

Russian FSB hackers are being blamed.

This constitutes the cyber equivalent

of an armed attack
on the United Kingdom.

An act of war.

It is vital that we do not react
as expected now.

We need to hit back in a language
they understand.

It was the FSB coder Vadim Trusov
you met in Harrogate, wasn't it?

Yes.

Have you had any more
contact with him?

I understand you were
at college together.

Stage three of the Russian attack
was a data scrape.

All our own and the NSA's most
confidential material stolen.

As of 20:00 hours today, Eastern Time,

the NSA's intelligence sharing
arrangement with the UK is withdrawn

for the foreseeable future.

JSS is showing Russian aircraft
entering our airspace.

It is possible we are under attack.

I'm sending you something now -
two things.

You can use them to trade with
the Americans to bring them back in.

As soon as it happens,
Putin will back down.

I put my life in your hands now, OK?

If they find out I told you this,
they will kill me.

RAF squadrons are airborne.

They have a fix on
the unidentified aircraft.

The Prime Minister is waiting for me.

He's with the Chief of Staff.

I will be advising him to order
an immediate retaliatory attack

on the Russian military base
in Kaliningrad.

It's a provocation.

I agree. A squadron of Russian
aircraft over the UK

is a provocation.

An intolerable one.

Vadim Trusov confirmed
that the Russians' intentions

was to isolate us and then
provoke us into an act of war.

If any of these aircraft exist at all,

if they're Russian drones or missiles,

they want us to fire on them.

We are playing their game.

Sorry, how could they fake this?

Hacking Air Traffic Control,
faking air attacks,

it's entirely in keeping with their MO.

No, we cannot take the risk.

We cannot do this without the
Americans being back on board!

Defence Secretary, we have no doubt
the material Vadim Trusov

leaked to us will encourage
the Americans

to renew military and intelligence
alliances with us.

Putin will back down.

The director of the NSA, General
Perez, has confirmed in writing

that all intelligence and military
alliances with the US are suspended.

Perez hasn't seen the leaked material.

The Prime Minister has tried
the President.

He's at Camp David incommunicado
for the Middle East talks.

RAF squadrons are minutes away
from intercep...

Try and get him to stop
declaring war on Russia

for the next five minutes.
..Russian aircraft.

Sally.Encryption.

They've managed to reset the
nuclear codes. Some good news.

OK, send that to the Defence Secretary

and then get me Michaela Jones on a
call in my office, now! Of course.

Max, we need something to get
the Americans back on board.

This Russian exploit you found
in the Trusov material...

Phil found it, actually.

It's malware breaching
the President's personal

and domestic security.

White House CCTV, everything.

It's pretty ballsy.

You can say that again.
Prep a secure link.

Michaela's on the screen. Thank you.

Michaela? Dan. Touched you've
taken the time out to call.

Something up? You could say that, yes.

What's this about, Dan?

It's about not seeing 80 years
of intelligence sharing

and collaboration go down the pan.

I'm going to send you something

and I really need you to get Perez
to join a call for me.

OK. Leave it with me.

Thank you. I owe you one. I've got to go.

Max, send that exploit over secure link

to Michaela Jones at the NSA,
please. Yeah, on it.

I need to talk to you. If it's
about Vadim, I will talk to MI6,

but right now... It's not.
It's something else.

I should have said earlier,
but with everything going on,

and I had to check.

Danny, I've just put General Perez
through to the comms room.

All right, thank you, Sally.
Just wait here for me, Saara, OK?

I trust you're not going to ask
for our help.

Those days are over.

Danny. Yeah...

Thank you for taking the call, sir.

Trusov leaked terabytes
of the FSB's cyber capabilities

and top secret data.

At a conservative estimate,
it will set the FSB back years,

losing this stuff.

Now, Michaela Jones is making
one particular cyber exploit

available to you now.

We need you to convey this
to the President.

In return, we need the re-establishment

of all intelligence sharing agreements

and for the President to tell the Russians

to withdraw from our airspace.

We need this done immediately
or this war becomes real.

What did you send him?

Russian malware targeting
the President's own family.

Thank you. We're on this now.

You'll be hearing from us.
Please hold fire until you do.

I hope this works.

Defence Secretary...

if I can take this opportunity,

even if the special relationship
is indeed back up and running,

we really need to be thinking
about next steps.

Maybe not the time... How do we fix this?

It's a huge clean up job
and my staff are on their knees

after the last fortnight. Danny!

The truth is, we are
desperately low on numbers

of sufficiently skilled staff, sir.

I can't overstate the importance
of us being ready

should this happen again.
Last time I checked,

GCHQ came under
the Foreign Secretary's authority.

Well, since Elizabeth Kahn's resignation,

there currently is no Foreign Secretary.

Well, I will ask the Prime Minister
to bring it up with

whomever he sees fit to appoint
to that august office.

Shit.

Christ, they're almost over London.

I'm ordering a strike on Kaliningrad.

Wait. Sir, if they're fake and we attack,

we are the aggressor.

It was fake.

It was fake all along.
They're playing with us.

Lucky.

I don't like relying on luck.

Gentlemen.

Maybe the Americans are helping
after all.

Danny. Yeah?

With Marston,
you've got to pick your moment.

We have a Cobra meeting
in London tomorrow morning.

We can discuss next steps
with them then.

Understood.

I'm sorry, Saara. What was it?

When we shut off the data scrape,
our sandbox computer,

which the Russian malware
broke out of... What about it?

What am I looking at?

Yes, James.

Good, good. Well, that's...
That's excellent news.

Yes. Thank you so much.

Jesus Christ.

Charlie, I need you up in my office ASAP.

Yes, ASAP.

Thank you, buddy.

Danny.

Well, the President called Putin.

Cease all action against the UK
or expect the full force

of a combined NATO response
under Article 5.

Putin has backed down.

For now.

That's good, David. No, that's excellent,

and you're the one that got
the Americans back in the game...

so what's wrong?

I've had to call in Charlie Francis.

OK.

Saara.

Come into my office.

So, what's going on, Danny?

Charlie. You're lucky you caught me.
I was just heading off.

Or maybe not so lucky.

Something tells me I'm
not getting home tonight.

Saara, you know Charlie Francis,
Head of Security.

Saara has something for us, Charlie.
And I'm afraid it is not good.

How not good? For you to determine,

but we think it could
be potentially disastrous.

Right. It's how the Russian

malware got into our systems
in the first place.

If I understood correctly,
it was through a sandbox computer.

They knew we'd put the malware
in there to analyse it.

Yeah, but it could only
break out if it knew ahead

of time which sandbox
it was going to be put into.

OK. The Media Access Control.
The Mac address.

It's a 12 digit alphanumeric
identifier unique to each computer.

It was written into the third
stage Russian malware code.

Meaning? The writers of the code

had to have it
before it ever arrived at GCHQ.

It's offline, high side.

So the only way they could
have known is... A CI.

In old money, a mole.

One of us.

Reports overnight
of further cyber attacks

on the UK by Russia.

Surely this begs the
question, are we safe?

Do you think the Government
is doing enough

to respond to these attacks?
What should.

Prime Minister Andrew Makinde do
in the face of Putin's aggression?

Give us a call.

Hello, stranger.

Barbara, my love.

Charlie told me you didn't go
to France like we agreed.

Well, if the world's going to end...

I'd quite like to be with you.

I'm glad you didn't go.

It was a false alarm.

Bad?

How are the boys? Fine.

Oblivious.

It's one benefit of teenage hormones.

What was it? You know I can't tell you.

Three guesses.

I'm tired, Barbara. You wanted us
packed off to France

and I'm not even allowed to guess

the reason why? It was
Russia, wasn't it?

Well, the news made that quite clear.

So guess one.

They said there was a data breach.

You can speculate all you like,
but I couldn't possibly say.

Shit! How?

Information possessed by...
..Virtue of your position.

Three and out. But you will
tell me, Danny Patrick.

I insist you tell me.

Damn your insistence, Agent Napier.

You'll never get it out of me.

Don't you ever dream
of just jacking it all in?

Dream, perhaps. But...

if everyone thought like that...

There'd be no-one left to save the world.

Er, stay. I should at least say hi.

They'll survive.

I'll go and wake them up.
I'll do the drop before work.

Right.

Right. Come on.

Mr Marston,

how is it potential Russian
aircraft were allowed

to fly so near to London?

We knew all along
the attack was probably a fake.

If we responded,
we would have been the aggressor.

Cyber warfare is notoriously escalatory,

and this is just the latest in a string

of unacceptable Russian
provocations. That they could gain

access to our radar systems is...

of course, of serious concern,
and the PM and I are very clear

that our cyber defences
must be strengthened.

There's only so long we can
keep this to ourselves.

Danny and I are to brief

the Prime Minister and security directors.

We should inform them about our mole.

If we inform them,
then they're going to bring

in external investigators
and work will be disrupted.

And the mole will run to ground.

We have a duty. We have a duty
to fix our entire network

after this attack and find the
mole as quickly as possible.

If we tell Marston, he'll use it
to break up GCHQ once and for all.

There might be another option.

The Event Management Centre
is the most secure unit in GCHQ.

Every terminal has live tracking.
If you can find a pretext to move

all those in malware who had
access to the sandbox there,

I have the perfect

person to monitor their
online behaviour remotely.

This way, we might catch them
in the act and we keep working.

All right.

Richard. David.

David. Alex. Defence Secretary.

Alex.

Danny.

Are we expecting the Prime Minister?

Director General MI5? No, it's just us.

And it's no longer Defence Secretary.

Mr Makinde has seen fit to
appoint me Foreign Secretary.

So you report to me now.

The Prime Minister wishes to pursue
a more robust foreign policy.

And given the response
to the Russian attack,

he has asked me to ensure
that there are no repeats of

the failures of GCHQ
in the past few weeks.

Three waves of unopposed
Russian cyber attacks

and the loss of our and

the NSA's most highly
confidential material.

So we're going to do something
a little bit different.

From now on, GCHQ and MI6
will be directly answerable to me.

I would like to see this as
an opportunity to reset relations.

I hope you do too. Of course,
Foreign Secretary.

Good.

Good.

The search for a mole boils
down to two simple questions.

Access and motive. We need to know
who had access to the computer

and of those who did

who had motive to pass
the Mac address to the Russians.

The computer in question
served as a sandbox

for the Malware department
for two years

and two months
until the time of the attack.

Anyone in Malware or IT
could have accessed the

Mac address in that time.

What about CCTV and logs?
They're cycled every few months.

It would have taken six months at least

to build it into that malware
and run the operation.

So those who only logged in for

the first time this year are off the hook.

That includes you.

But with thousands of log-ins
18 months before...

it does mean we're looking
for a needle in a haystack.

But there's a record of every time

a Mac address is checked in the log files.

Date and time stamped. So we just need

to cross-reference those with
who was logged in at the time.

In that case, it's lucky I had IT

swap out the sandbox terminal
and bring it here.

And the data of ours that was stolen?

Well, I've asked our
Composite Signals side

to work on a full inventory assessment.

Nonetheless,

Cyber Security remains
stretched to the limit.

Is there any evidence

that the Russians
are aware yet of their data loss?

No. Trusov used UDP via Netcat.

He bounced via satellite.
Several satellites, actually.

We can trace the route back
because we know it's there.

That gives us a back door into the FSB.

Until they know there's a leak,

they won't be able to discover the route.

MI6 agents on the
ground confirm there's

no clear evidence they're
aware of the leak.

And while they are unaware, we can
basically see their every move.

So the British public,

who have seen ample evidence
of the Russian

attack on our streets and on our news,

they as yet have seen no sign
of any actual response from us.

They no doubt think
the Russians have won.

The Prime Minister has stated publicly

that he will take equal
and proportionate action...

Excuse me, Foreign Secretary.
A symmetric attack would

be highly escalatory and unpredictable.

In my opinion,
it would be completely unnecessary.

We are assured by our
colleagues here and in the US

that the opportunity to listen
in on the FSB is priceless.

If we listen, we will listen robustly.

If we respond, we will respond robustly.

That is why I am seconding a team from

the 14th Signal Regiment
and appointing their CEO,

Lieutenant Colonel Cavendish,

to the new post of
Director of Rapid Reaction.

What's rapid reaction?
You want to attack Russia?

You said you were short of expert staff.

These are experts.

Your minister is listening.

Thank you, gentlemen.

Danny.

You're still Director of Operations.

14th Signals? That's soldiers.
They'll be offensive cyber.

And with their own director,

they'll be free to act independently.

And they'll still be answerable to me.

Yeah, it's just the first shot, David.

And with Marston as our boss now,
frankly,

we are fucked. Everyone's on
edge because of the attack.

When things calm down,
we'll find a way through.

If Marston gets his way
and attacks the Russians,

things are hardly going to calm down.

Our new minister seems
to be gunning for you.

I understand David passed you
the details for Vadim Trusov.

We're working on a plan.
We'll take it to our new minister.

Marston? We live in interesting times.

Robust times at least.

Yeah, well, thank you for Vadim.
We owe him.

Must dash. Do give my best
to Barbara, Danny.

Come on.

A gap.

I'm not sure I understand.
It's really quite simple.

These are all the log-ins to
the sandbox over an 18-month period.

The haystack. And this is a list

of the Mac address log-ins between

the 31st of July
and the 1st of November 2022.

The records for the Mac address
log-ins are missing.

You can see here...

where they've been erased or removed.

The FSB must have wiped them during
the attack to protect their mole.

Well, at least we have those dates.

It also rules out anyone from IT.

IT check every computer
every few months.

If it was one of them,
then they'd have cover.

No need to wipe any records, so...

Saara, tomorrow I want you back
with your malware colleagues.

I'm moving you all to the EMC

so I can personally oversee
the response to the FSB attack,

and while we still have a back door
into their system,

I want you to have a look
for the stolen Mac log-ins.

OK? And before you ask, yes.
I've spoken to MI6 about Vadim.

Thank you. I'll get started on
that straight away.

If IT are ruled out, that means...

It means it must be someone
from malware.

From our team.

Right, come on, come on.
Last chopper out of Saigon.

Elliot!

Come on, mate.
What have you been doing up there?

He's been in the bathroom,

making himself handsome like his dad.

You're listening to This
Morning Britain, and we'll have.

Prime Minister Andrew Makinde
with us at ten-past.

Mr Putin can rest assured

the UK's alliance with the US
is unbreakable,

and we're unshakeable

in our opposition
to his territorial ambitions.

We will answer his recent attempts
to undermine our infrastructure

in like and in kind.

But what I really want to talk
about is China.

For God's sake.
We are negotiating a trade deal.

What about their human rights record?

Exactly. Thank you. This is a deal

that will herald a second golden age
in Sino-British relations.

God help us all.

Right, we have arrived
at the juvenile correction facility.

Child locks, Mum. Yeah. I'll release you

when you bid your parents adieu
in a civil manner.

Bye, Mum. Bye, Dad. Love you.

The UK Government
is now considering how

to respond after one of the most
significant Russian cyber attacks...

So... in recent history...
..Marston's mob arriving today?

Concerns about the
growing threat of cyber warfare...

Are you going to be back late?

I have no idea. But if I am,
I'll get Charlie to give me a lift.

All right.

They warned that if the UK launches

offensive cyber operations,
Russia could retaliate

with even more severe attacks.

You know, don't give
that place everything, Danny.

And impact citizens' everyday lives...

Leave some for us?

So, as tensions rise...

I'll try... the Government faces a
difficult choice.

How to protect national
security without escalating

a dangerous cyber conflict?

Ms Napier. Thank you.

And you've got visitors, Mr Patrick. God.

That must be them. Go on.

Go be brilliant. I'll see you later.

Good morning.

Danny Patrick,
Director of Operations, GCHQ.

Lieutenant Colonel Cavendish,

14th Royal Signals and Director
of Rapid Reaction, GCHQ, it seems.

Well, welcome.

I thought you had quite a few
service personnel here.

They only wear their
uniforms on Military Monday,

so they probably think you're
the firing squad come for me.

Maybe we are.

Morning.

Hi.

In all my time as head of China Team,

I've never seen such a fuss over
a trade deal.

Thank you, Lydia.

Economic and technical security reports.

God, they must have every
asset reporting on this.

And the Department of
Trade and Industry

want it all translated
and synopsised by tomorrow.

I know, I know.

But it is our duty, our privilege,
our joy, no less, to serve.

So, let's get to work. Calvin. Yes, ma'am.

I've sent you each your allocation
to your desktop.

I've printed yours out, ma'am,
as per. Thank you.

"Secret report on the CCP activities
in managed asset pools."

Hedge funds. My favourite.
Let's give it our best shot, team.

Any idea why they moved us up here?

No, he didn't say.

Look, Phil. Soldier boys. Your wet dream.

Yeah, some of us actually served, mate.

GCO, Afghan. Yeah.

Sat in a comms container
for three months playing Minecraft.

The Event Management Centre

or EMC, where we'll all be based.
Find a terminal.

IT will set you up with log-ins.

Yeah, we need to be accommodated
together in our own space.

We'll just take that one. A hut.
Isn't that what you call it?

Yeah... It's best
if all the reverse engineers,

offensive cyber teams,
and analysts are in one space,

so I can co-ordinate the response
to the FSB attack.

I understand that you shall
co-ordinate the clean-up operation

and damage assessment.

I, as Director of Rapid Reaction,
shall co-ordinate said reaction.

Whatever offensive operation
our minister orders.

That conference room
looks sufficient for the time being.

We also try to foster a culture of civility.

Good morning, everyone.

I would like to introduce you
to your new colleagues,

joining us from the 14th Signal Regiment

and our new Director of Rapid Reaction,

Lieutenant Colonel Cavendish.
Roz, please.

Thank you, Danny.

Er, first, the uniforms.

Don't worry.
Everyone gets it wrong first day.

Yeah, I appreciate there's
a cultural difference here.

You like to listen,
when you're not interrupting.

We like to act.

Hopefully, listening and acting
do not prove mutually exclusive.

And the uniforms stay.

As you were, troops.

Max, Charlie Francis
from Security would like a word.

OK, OK, let's crack on, shall we?
We've got a whole

computer network to analyse
for vulnerabilities

and damage and anything our Russian
visitors may have left behind.

Let's have a good one.

Just a routine security sift, Max.

Given the scare,

those on high are jumpy
and have asked me to check

that all security protocols
have been, and are being, followed.

OK. No bother. Like all teams,
you run a hot-desk policy?

All your programmers can log
in on any computer?

This applies to all machines,
sandboxes included?

Yeah.

What happens
if you need to leave your desk?

Well, then you log out.

We're, we're pretty hot on that.
Even for a quick pee?

You leave a machine logged in,

and someone comes along
and doesn't know...

accidentally wipes all your work.
Or, you know,

spills coffee, whatever. So if
someone, while they're logged in...

accessed something...

Like what? Anything.

Something on the system.

It would pretty much have
to be through their own log-in?

Yes, I'd have thought so.
Can you be 100% sure?

Well, no, but... 99%.

Is this about the attack?

Just answer the questions, please.

Alex. Danny. We've got the sign-off

from Marston on
the Vadim Trusov exfiltration.

That's good.

But, I'm afraid we've had word from
Dutch intel.

They've had a sighting of Trusov.
They've got a hack on the camera on

the FSB entrance in Saint Petersburg.

It's not good news.
Needless to say, if they have him,

we can't proceed, and I imagine
Vadim Trusov is in grave danger.

Does that mean they know
we're inside their system?

There's no indication as yet.

But if the FSB have got him,
it can only be a matter of time.

OK.

Where are they? Where's who?

The soldiers in the FSB system.
I mean, this is all us.

What are they doing? They're soldiers.

They follow orders.
They don't ask questions.

Maybe you should try it sometime.

Right after my next sarcasm lesson?

Looking for something?

They're rigging the FSB
system to blow it up.

Excuse me. If we blow the system,

they'll find out how we got in
and trace it back to Vadim.

Saara, go back to your station. Shall we?

Come in, Danny.

Lieutenant Colonel Cavendish.

I'm so sorry I wasn't
able to greet you earlier.

Problem?

I am the Director of Operations.

I answer to the Foreign Secretary.
I cannot answer to him

if there are operations being
conducted behind my back.

My operation was ordered by
the Foreign Secretary.

It has not been conducted
behind your back, but in parallel.

Operation?

To mine and blow up the FSB system,
and the Russians will retaliate.

It will end in World War III.

To install a comprehensive
array of degrading effects

to trigger as and when we receive
orders from our superiors.

We cannot have two chains of command
in the one operations room.

We don't.

We have two parallel operations.

Our political masters will decide
which one they wish to pursue.

In that case, I'll get back to
what I was doing.

Danny, a moment.

I don't like it either but we cannot
control the Government.

We can only advise.

After the last few weeks,
Marston's going to be all over us.

You heard him.

We need to be seen to be running
a steady ship.

And we need to find that mole.

Sally, can you get me Michaela Jones
at the NSA, please?

Of course.

You're gonna let her do it,
aren't you? Sorry.

What about Vadim?

It won't take them long
to work out how we got in.

They're not going to blow it up.
Not if I can help it.

But the news on Vadim is...

It's not so good, I'm afraid.

Hacked CCTV footage shows Vadim
and other coders being led out of

the FSB headquarters in St Petersburg.

When? Same night he leaked
us the material.

That's days ago.

He's only there because he helped us.

What will they be doing to him?

I don't know, Saara. I don't know.

MI6 believe that as long

as Vadim is in the hands
of the Russian authorities...

They need to get him out.
..they won't be able to help him.

I'm sorry, Saara.

This is all my fault.

That's Michaela for you.
Thank you, Sally.

Michaela.Dan.

We have a problem with
Richard Marston.

He's been moved to Foreign, hasn't he?

Yeah. He's playing nice,
as nice as he can.

But he's determined to live out his
Churchillian fantasies.

So he's sent in his own dirty tricks
team to blow up the FSB system.

Shit. Greatest listening
opportunity we've ever had

and he wants to piss it up the wall
for the sake of his own ego.

How soon before his finger gets itchy?

I don't know, but my guess is not long.

I'll talk to Perez. Thank you.

I'd like to work on the
offensive cyber with you.

I don't want to imagine
what they're doing to Vadim.

I just want to hurt them back.

I'm good at this.

Yeah, start on the comms code.

Then... we'll see.

I'll be watching.

Come in.

You're working with them now, are you?

You told me to look

for our missing Mac log-in data
in the FSB system.

Otherwise she'd see me in there.

I'm impressed.

And?

Nothing. Not even a trace.
And there's no sign

of any data they stole
from us in their system.

Sorry, Saara, I've got to take this.

General Perez, sir.

You have two minutes.

I appreciate I'm speaking out of turn,

but I felt you should
know our listening operation against

the FSB is in danger,
and not from the Russians.

Night, Dave. See you.

Pub?

Thanks. I don't really do pubs.

So, what did old
Checkpoint Charlie want?

Just routine, he said.

But he was asking a lot of questions
about our sandboxes.

Really? Phil? Changed your mind?

Do you know a game called
End of Daze?

Yeah, it's... Horizon Zero Dawn
with a touch of Zelda.

Phil's Mr Gamer.
The rougher the dystopia,

the more he enjoys it.

I just need to know how to get into
the Discord chat.

Well... You'll be sorry you asked.

Let's see.

Yeah. You need to switch those around.

I swear, if one of
you ever goes behind my back to

the Yanks like that again,

I will see to it
that you're charged with treason.

If I may, Foreign Secretary,
to function effectively

as a government
intelligence gathering institution,

there can be no going
behind anyone's back.

I had hoped this could be a new
beginning.

He means that we understand fully
and unequivocally.

Just to be clear,

we're not triggering the degrading
effects.

That is correct, Lieutenant Colonel,
we are not triggering them...

yet.

How are the interviews going?

Nothing jumping out.

They're a pretty clean bunch,
your coders.

They just busted their guts
turning this thing around.

For one of them to be the cause of it...

Man, that'd just break my heart.

I pity them.

Nobody wakes up in the morning
and says,

"Today I'm going to betray"

"my colleagues,
my friends, my family, my country."

Sometimes they're believers,

but usually they've been got to.

Love, sex, blackmail.

By the time we get to them, they're
in the worst place in the world.

But don't worry, Dan. We'll find the mole.

Clock's ticking.

What are you doing?

Subtitles by Red Bee Media