The Undeclared War (2022) s02e02 Episode Script

1
I need to talk to you. If it's
about Vadim, I will talk to MI6,
but right now, I'm in the middle
It's not about Vadim.
It's something else.
Saara has something for us, Charlie.
It's how the Russian malware
got into our system.
Writers of the code had to have it
before it ever arrived at GCHQ.
In old money, a mole.
One of us.
Mr Makinde has seen fit
to appoint me Foreign Secretary.
I am seconding a team from
the Fourteenth Signal Regiment
and appointing their CO to the new
post of Director of Rapid Reaction.
So they probably think you're
the firing squad come for me.
Maybe we are.
Don't you ever dream of just
jacking it all in?
Dream, perhaps,
but if everyone thought like that
There'd be no-one left
to save the world.
Secret report on CCP activities in
managed asset pools.
Let's give it our best shot, team.
Alex.
They've had a sighting of Trusov.
If the FSB have got him,
it can only be a matter of time.
The news on Vadim is
not so good, I'm afraid.
What will they be doing to him?
This programme contains strong
language.
Sit.
Glass of wine.
Dinner.
Special occasion?
You're home, I'm home -
that's rare enough these days.
You didn't! Taj Mahal.
I was just passing and
"Chicken tikka masala for sir."
BARBARA LAUGHS.
"Jalfrezi for the lady."
PHONE RINGS Aw
Sorry. Go on.
Yes. Danny Patrick?
Yes?
Maya Young, Deputy Head of Security.
We're on a secure line.
What's up?
I have Saara Parvin here.
She's been communicating with
a third party
through a Discord server
from the event management centre.
She says you'll vouch for her.
Let me speak to her.
It's me, Danny.
What's going on, Saara?
It's Vadim - he's alive.
Oh, that's great news.
How is he? Where is he?
That's the thing -
he says it wasn't Russia,
the attack, Stage 3,
the data scrape -
or it was them
but it wasn't for them.
Sorry, what wasn't? Who was it for?
Stage 3 was China. Vadim's in China.
Everything OK?
NEWSREADER: The growing military
relationship between
China and Russia
is a major concern for the West.
Trade between the two countries is
at an all-time high.
Hostile nation states are waging
a new kind of war,
launching cyber-attacks that are
capable of crippling infrastructure,
causing chaos.
Presidents Xi and Putin have called
for a new global order.
Welcome, Russian coders.
Welcome to China,
welcome to Shenzhen.
As part of the no-limits partnership
as agreed by our gracious
Presidents Xi and Putin,
you are our honoured guests.
DOOR SLIDES OPENS
I am Ming Liu, your translator.
You'll call me Liu.
We speak English not because
English is a superior language
but because English is the
international language of coding.
Yin Technologies.
We are proud to be recognised
in the West
as one of the most sophisticated,
significant and sustained
cyber attackers in the world.
IN RUSSIAN:
Yin Technologies is an independent,
cyber-development enterprise.
We work from eight to six,
lunch at midday.
You can of course work more
if you so wish,
the job will be done quicker.
English, please.
Ming Liu,
I have three children,
and my wife works.
No-one knows that I'm here,
nor anyone's family.
We had to hand over all phones
and all personal devices.
I'm sure your families
will be informed
that you are engaged in
important work for your nation.
This is the breaking and
entering tool we built
for the attack on the UK.
As you are aware, in your recent
exploit against the United Kingdom,
there were three stages
to your attack,
and you are here to redesign your
breaking and entering tool for us.
To break in where?
You only need to know what is
essential to your job.
I will assign tasks
tomorrow morning.
Now, you sleep.
We sleep here too?
Yes, for your comfort.
We have all the latest games
MISHA SIGHS
we will call out for food.
Otherwise, you have everything
you need here -
clothing, bedding, toiletries,
your welcome pack.
So we are prisoners?
You are our honoured guests.
VADIM SIGHS
VIDEO GAMES SOUND EFFECTS
Please check the menu for your food.
I will take your order after.
TEXT ALER
I'm really glad it's you, Saara.
COMPUTER BEEPS
No-one else would use your login
on the sandbox, right?
No.
And you'd never leave it unattended
while you were logged on?
Never. Hm.
What about people working with you
while you're logged on?
Sure, but I'm always there.
Do you remember working
with any Russian specialists
between these dates in 2022?
What, a three-month period
two years ago?
I mean, during a surge,
I could log on to the sandbox
seven times a day,
so, yeah, it's possible.
But none in particular?
Well, I'd need a particular time
to be particular.
Even then, it's
Sorry, what's this about?
I need to review your
security status.
Sure, but
Any changes in your circumstances
since your last review?
How do you mean? Financial? Lovers?
Old friends who have
come back into your life?
New friends?
Yeah. Yes.
There is actually something I
PHIL CLEARS THROA
I should declare.
We only have Trusov's word for it
that the Chinese are involved,
that he's even in China.
We've ignored Vadim before,
to our cost.
How can she be sure it was him?
I told you, she asked him
something only he would know.
OK, so it's him.
Maybe they have him under duress,
or maybe they've been playing
the long game with him,
and us, all along.
Fair conjecture, Danny.
All right, I accept that
that's a possibility.
Which means we should treat
the intel with the utmost caution.
I accept that it's a possibility
but I don't buy it.
The FSB data Vadim leaked us,
you've seen it -
there's no way that was a play.
He even gave us
a back door into their system.
So, yes, I trust the source.
What evidence have we in the code?
It was a fair question, Danny.
We haven't seen any evidence
of Chinese involvement in the code
because we weren't looking at them.
All right, if you've both had
your say, moving forward,
what do we know about offensive
cyber operations in Shenzhen?
APT10, one of the largest and
longest-established
It's an arm's length MSS operation -
Chinese Ministry of State Security -
and we would be unwise
to ignore the intel.
If Russia and China
are collaborating on cyber,
it represents a major threat
to national security.
Danny and I will have
to travel to London
to brief the Foreign Secretary.
We'll need to check through
the malware code.
Would you please see to this
personally, Lieutenant Colonel?
Sir, with due respect,
I'm Director of Rapid Reaction,
not a reverse engineer.
Until such time as we can offer
better proof of attribution,
China's possible involvement
must stay between us.
Still, sir For this,
and other reasons I can't go into,
I kindly request that you look into
this yourself.
Yes, sir.
You might want to check and see if
we've seen any of the code before,
anything to link
the data scrape back to the CCP.
One more thing, both of you.
This, all of this, is more important,
much more important,
than your two bruised egos.
CHARLIE: Wow.
And your friend Jules,
he bankrolled it?
Yeah, his start-up did, yeah.
How?
Venture capital? I don't know.
My job was to design the game.
Destiny Doom Loop?
I write code, OK? I don't
come up with the names
or do the deals.
Did Jules approach you, or you him?
I think he came to me. It's
Is that important?
And there were no
Russian connections,
his gaming company,
that you're aware of?
It's a dystopian, shoot-em-up game -
it's hardly divulging
strap three intel.
And it's not against the rules
to do a bit of moonlighting, OK?
Me and the other programmers,
we could earn ten times what we're
earning here in the private sector.
Right.
Phil.
Have a look at investors
going back three years
and check his personal accounts -
high street, crypto
et cetera.
Any big deposits.
KNOCKING
Sorry to interrupt.
You remember my deputy?
Maya Young.
Yes, we spoke on the phone.
Boss.
Any progress on our mole?
Sifting through the hay
piece by piece.
Well, I don't want to make that
stack any bigger but
What?
That Russian connection you're
looking for
Yes?
It might not, in fact, be Russian.
Yeah, it reads well.
Very well.
The ending, Calvin,
fair reflection of the original?
Yes, Barbara, I think so.
That's good.
Good report, Lydia. Well done.
Oh, hello. Hello.
Well, if it's a lunch date
you were hoping for,
I'm afraid today is team lunch.
Hey, is there somewhere we can talk
a bit more privately?
What is it? The boys?
No, no, no, no. Just
Yeah, sure.
So?
I was wondering,
anything new or unusual coming
through reports?
From China?
Well, all the time,
but if there was anything
relating to you,
it would have been passed on.
Can you be more explicit?
Mm, afraid not.
You come to me wanting answers
and I've got to
come up with the questions?
No, no. Not that I'm aware of.
Look, if they were after something
in here, then what might that be?
They're in here?
Not that we know of,
but if they were, what do you think
they'd be looking for?
Well, I suppose speculation
doesn't count as disclosure.
I believe not.
Everything.
I mean, they love data.
And, of course, anything
in relation to Hong Kong,
Tibet, Uighurs, Taiwan,
but they're quiet on all that
at present.
The main thing in relation to us
is the trade deal.
But the Department of Trade and
Industry or the Treasury,
they hold our significant
economic data, not us.
There's much richer pickings there.
We're just security profiling
their industries and state bodies.
Hardly worth the fallout
of an attack
for them finding out
what we know about them.
Now they're attacking us?
I didn't say that.
I said it was hardly worth it.
David's going to be waiting for me.
Oh, well, sorry
I couldn't be of more help.
You've been a lot of help.
Thank you.
Take care.
See you later. OK.
RECORDING OF FEMALE VOICE
SPEAKING MANDARIN
Barbara? Calvin, there's something
I need to attend to.
Kids. Danny's gone to London.
Of course.
PHONE BUZZES
Roz.
We're just coming into London,
what have you found?
I ran the code similarity searches
on our holdings.
The interfaces between stages 2 and
3 have been seen before,
but not in Russian capability.
So the code is Chinese in origin?
Well, yeah, Chinese in origin,
but it does not prove that it is
a Chinese attack.
The Russians could have used it as
part of an attempt
to deflect us towards China.
All right, I'll talk to
MI6 and our Five Eye partners
and see if they have anything to
corroborate or contradict.
In the meantime,
would you write up a report, please?
Thanks.
Alex, short notice,
but we're wondering if you might
have any human intelligence
which speaks to
something we're looking at?
PHONE BUZZES
Marston. Richard
bit of a heads up,
you're going to be hearing
the recent attack
might not have been
solely the work of the Russians.
PHONE RINGS
Oh, hi, Anne. Um
Uh sorry, yeah, too many things.
Look, Dan's been called away again
and we are up to our teeth
in the department -
I don't suppose the boys could come
to yours after school, could they?
Yes, of course, no problem.
No, that's great.
Yeah.
Everything all right with you?
No, no, everything's fine.
Yeah, sure. I'll give them some tea.
Oh, thank you.
All right. No worries. Bye.
OK, yeah. Bye, Barbara.
All right, bye.
Vadim Trusov, who we have
good reason to believe
alerted us to the involvement
of China state actors
in the recent malware attack APT10.
Lieutenant Colonel Cavendish
confirmed
that the interface for the
Stage 3 malware code originated
in the same Chinese Ministry of
State Security-backed APT10.
There's been an increase in
monitored traffic,
human and electronic, between the
FSB in St Petersburg and Shenzhen -
it would support the theory of
a partnership. Mm.
And despite growing political ties,
a collaboration between Russia
and China on a cyber exploit is,
to date, unheard of.
But you can't be 100% sure.
Well, you can never be 100% sure
when it comes to attribution
unless the one party admits to it.
However, there's a significant
weight of evidence.
We have a high confidence.
Help me out with something.
They're in the middle of
negotiating a huge -
excuse me, David -
a huge trade deal with us.
What exactly would their motive be?
The silent theft of big data
is classic Chinese MO.
So, we can't be 100% sure
and we have no clear motive apart
from their previous charge sheet?
When it was Russia, it demanded
an equal and proportionate response.
MI6's thoughts?
The CCP's quest for big data
has been historically to tighten
control of their own population
or for industrial espionage.
In short,
for their own internal purposes.
China already wields power over our
key technologies,
utilities, internet,
social networks.
They have directly or indirectly
bought the influence of
Nonetheless, we can only advise
government of the potential threats.
Thank you, Director GCHQ.
Sometimes, we must put
our economic interests before
Our principles?
Before suspected threats,
the aims of which are, at best,
unclear.
Danny, a word?
So, reports of Mr Trusov's demise
were greatly exaggerated?
Yeah. Do you think you can get him
out of China?
It's possible, but complicated,
and there seems a reluctance
to ruffle CCP feathers.
Yeah, I can see that.
I suppose ruffling
would be inevitable.
And a special op would need not only
Marston's sign-off
but also the PM's.
If you can get your Vadim Trusov
to find out
what the CCP were looking for
in our data,
then not only would our masters
be bound to sanction the
exfiltration,
but also to respond to China's
involvement in the attack.
OK.
And a word to the wise, Danny -
sometimes - well, most times -
it's not about managing the enemy,
it's about managing them.
See you, Danny. Alex.
Oh, and, Danny?
Love to Barbara.
DOOR SHUTS Hello?
Saara, can you get a message
to Vadim?
RUSSIAN CHATTER
Hey, Liu,
I'm done here with recoding
the search tool.
Have you run it?
No, because it needs to know
what it's searching for.
I will run it. Please stand away
from your terminal.
OK, just let me close a few windows.
It's good.
It's time to eat.
I will print out the menus.
DOOR SHUTS
Lunch.
NEWSREADER: Prime Minister
Andrew Makinde continues
his landmark trade talks with China.
Critics say the Government is naive
to hand China access.
Makinde should put down his
begging bowl and
consider British national security.
You've been on that since dinner -
what is it?
Ay-ay-ay-ay.
It's in the public realm,
I suppose.
Marston allegedly taking bribes
for the nuclear deal?
China again?
Your team worked on the inquiry,
didn't they?
I couldn't possibly comment.
I get it - payback.
We made submissions -
what they were, I can't tell you.
Why do you want to know?
Do you think the inquiry was
a whitewash?
Come on, aren't they always?
You know what? I don't like Marston
and his "Rule Britannia"
Empire politics but,
well, they couldn't find
anything on him.
Hey.
Come here.
Morning, Charlotte. Morning.
Thanks for your help yesterday.
It's OK.
I enjoyed it.
A little bit, anyway.
What did they say?
Well, the Foreign Secretary didn't
seem too surprised
at the mention of
Chinese involvement.
I meant what I said about
going behind people's backs.
Who went behind
the Foreign Secretary to the NSA?
You're right,
but I've realised it wasn't
the best move.
"Win a battle, lose the war,"
and all that.
You don't need to use military
metaphors for my benefit.
All right. There's no harm in the
Foreign Secretary being pre-briefed.
It allows him to
consider a response.
I got a response, all right.
For someone so intent on action,
he seems strangely reluctant
to consider even
the smallest complaint to China.
I presume he'll downplay it to
the Prime Minister.
Well, what do you suggest we do?
Well, we keep a skeleton team
on the FSB
and your team tries
to understand what China were after.
If we know that,
then the case for a considered
response will be stronger.
OK.
Good morning, team.
ALL: Morning, sir.
RECORDING OF FEMALE VOICE
SPEAKING MANDARIN
Oh, Charlie.
What brings you up here?
I'd like to say it was social
but I need to talk
to some of your team. Ah.
Well, we're on a bit of a surge here
with the trade talks.
Internal security, Barbara.
So, who do you want to talk to?
Anyone who's had cause to go to
Malware in the last two years or so.
Right.
In that case, most of the team.
I was hoping you weren't
going to say that. Mm.
I'll get Calvin to bring
you the log.
You can have the small
conference room. All right.
Ah.
What happened to you yesterday?
Were you with Checkpoint Charlie
all that time?
Mm.
Did he find out you've been cheating
the fantasy football?
Using an algorithm is not cheating.
I think it probably is.
What? I'm just saying.
Did I miss something yesterday?
No.
So what's the big deal?
There's no big deal.
Just, as your line manager
in our non-hierarchical hierarchy,
I'm looking out for you.
Just checking in.
Consider yourself checked in.
ALL IN OFFICE GROAN
Wait, was that you?
I didn't do anything.
The back door into the FSB system
Trusov left us,
they've closed it.
Fuck.
Which means Which means
they know we've been in there,
and they won't be long in figuring
out how we got in. Oh, shit.
We'd better tell Danny.
Well, you'd better tell Danny.
You know, line manager and all that.
PHONE BEEPS
Hello? Saara, where are you?
Heading home.
You need to get a message to Vadim.
The FSB know.
Shit. How?
We don't know. We just know they
closed the door on us.
How did he get you
the first link to the FSB?
Text message to my phone.
All right, well they might
know about that as well.
Just get a message to him.
Tell him to get out of
wherever he is and go off-grid.
The Russians know what he did,
his life is in danger.
And you might want to do something
about your phone as well.
Fuck.
BEEP
Where are you going?
If you don't let me go,
they'll kill me.
Put it on - anti-facial recognition.
Make sure the design
faces the front.
It pixelates the face.
State Security are on their way,
the FSB are with them.
But the FSB know what I've done.
They'll kill me.
I've been monitoring you.
Only I know you have been in contact
with someone on the outside.
I am part of the democracy movement.
I love my country,
but my country is not the CCP.
I think you feel similarly about
your country and leadership.
I've disconnected
the facial recognition, CCTV
and alarms in the service elevator.
You have three minutes
to get to the basement and out.
This is the address of
a friend in the movement.
Her name is Hai.
Maybe she can help.
Go!
Thank you.
ALARM BLARES
GATE BEEPS
KNOCKING
Barbara. Thanks for waiting.
Well, I was here anyway -
China trade talks, riveting.
So
have you discovered
anything interesting?
Only what a large department
you've become.
Well, that's China for you.
Mm.
I had to go down to the cages
to get your file.
My old MI6 file.
CHARLIE CHUCKLES
I have my notes from
your vetting interview here.
Well, there's nothing like going
through your whole love life
with your husband's best friend.
We should begin.
I understand you've found a way
to launch our cyber offensive,
Lieutenant Colonel. Yes, sir.
GCHQ reverse engineers
showed great ingenuity
in re-establishing the comms.
I'm glad to hear it.
See? Making a difference already.
We await orders.
One last time, Foreign Secretary,
I strongly urge you to reconsider.
Launching a cyber-attack
against Russia could be seen
as a declaration of war.
Lieutenant Colonel Cavendish,
the back door to the FSB has closed.
Deploy our response to
Russia's attack.
Now, if you'll excuse me,
I am entertaining the German
ambassador at the Royal Opera.
Die Walkure. Yes, sir.
Orders to deploy degrading effects.
Launch our cyber offensive.
You found the way back in -
would you like to do the honours?
Pleasure.
Bastards have caused us
enough trouble.
Command Control E. HE TYPES.
Boom!
So, no material change there either?
No, just a boring,
suburban mum's existence.
You've never been boring, Barbara.
You're too kind, Charlie.
You've always been too kind.
No. No big windfalls,
no tall, dark strangers
taking me aside.
Nothing much, in fact.
The Malware department -
you said you sometimes have
call to go there.
Yeah. Most of us do.
Yet at no point are you signed in
to the sandbox computer.
I'm not sure
I'd even have the clearance.
But I've never needed to.
I'm sure you've heard from others,
the reverse engineer finds
a bit of Mandarin or Cantonese text,
whoever answers the call
in my department sits with them
as they walk us through it,
and we translate it on the hoof.
Do you answer the call often?
Not so much.
I'm less across contemporary
and technical hacker slang
than my younger colleagues.
KNOCKING
Boss. You need to see this.
Give me a moment. Of course.
Barbara, sorry,
I've kept you long enough.
Oh, we're done?
Yep, and you need to pick up
the boys.
No, Anne picked them up,
they're at yours.
Thank you,
and sorry for keeping you again.
I think we've got him, but we need to
double and triple-check this.
And it's definitely linked
to Phil Draper? Aye.
Sorry.
I forgot my smart card.
TV: and Chinese money,
with access to the London markets.
Is that correct, Mr Marston?
The Prime Minister is working
around the clock Hello?
On this trade deal with China.
Finance will be at its centre
Where is everybody?
Fabian's asleep.
Mum's upstairs too.
Finance, technology, manufacturing
and, of course, security.
This trade deal with China
WHISPERS: Trust you?
How can I trust you?
PHONE RINGS
David.
I'm sorry to interrupt you at home
but I thought you should know
first off
Charlie's found the mole.
IN MANDARIN: