The Undeclared War (2022) s02e04 Episode Script

1
A symmetric attack would be
highly escalatory
and unpredictable.
Lieutenant Colonel Cavendish,
deploy our response
to Russia's attack.
No-one else would use
your login on the sandbox?
And there were no Russian
connections? His gaming company?
Welcome, Russian coders.
You are here to re-design your
breaking and entering tool for us.
I'm done here with
recoding the search tool.
I've been monitoring you.
I love my country,
but my country is not CCP.
This is the address of
a friend in the movement.
LOUD BUZZER
Her name is Hai. Maybe she can help.
Not interrupting, am I?
I bet if you look in your files
you'll find me named as
a CCP spy in intercepted messages.
I only erased your files
because I believed in
what I thought you stood for.
You used to say you wanted
to do what is fair and just.
Now's your opportunity.
If this were to come to light,
you'd lose your job,
your husband -
his career would be destroyed.
I thought you should
know first off -
Charlie's found the mole.
ALARM BEEPS.
Oh, you're up.
Yeah. Heading to London.
You didn't say you had anything.
Got a text late last night -
trade talks.
One of the PM's Special Advisers
wants an in-person briefing
on the security of
Chinese hedge funds.
Well, one of my team is
facing serious charges.
Well, I'm sorry to hear that
I really need to be there.
Can't one of your colleagues go?
Can't you get one of yours?
I'm head of the China Team -
it's my job to report to government.
You're going to have to
drop the kids for once.
Since when do we talk to
each other like this?
Since I have to look after them
while you're managing
one bloody crisis after another.
What is this really about, Barbara?
It's about me doing my job, Danny.
Hey.
Ah. Sorry, sorry.
I had the kids and
Barbara got called away.
We were discussing
external agencies.
We can't be seen
to police ourselves.
Well, surely we're still
only questioning Phil.
Questioning officially now.
Yeah, well, none of us
here think he's guilty.
And I think that speaks directly
to the need for external auditing.
Now, if you don't mind, I am late.
Sorry to interrupt, Danny.
Something's come up.
Well, can Roz not take care of it?
She's not in yet.
I thought the Army prided
itself on punctuality.
All right, I'll be there in a minute.
You all right, mate?
I'm fine, I'm just
I'm late
and I'm already chasing my tail.
All right, Max,
what exactly am I looking at here?
Well, it looks like
pretty simple code.
And where has the malware come from?
Department of Immigration and Visas.
It started turning
the printer on and off repeatedly.
It caught fire.
Well, what is it? Ransomware?
There's no ransom demand.
And Saara found this.
The breaking and entering tool,
it's Russian.
The same the FSB used
on its last attack?
The same as the Russians used
in their recent attack
with modifications.
So our definitive response to Russia
led to escalation by them
or their allies within 12 hours.
It could be a false flag,
someone wanting us to assume that.
This malware has not been
seen anywhere but here
and wherever it was coded by the FSB.
And Shenzhen.
Vadim said that's why they
were brought to China,
to work on their malware for
the Chinese for APT10.
Not a Russian strike after all.
All right, Max,
let's just triage this
and find out how it works
and what it's after.
Why don't I take the lead on this?
Don't worry,
I won't blow up any shit,
unless I have to.
OK.
Saara, any word from Vadim?
Nothing.
Well, when he does get in touch,
ask him if he knows anything
about this malware.
TAPS KEYBOARD
PHONE RINGS
Hi. Hi.
I, um
I don't want to leave things
the way we did this morning.
Yeah, sorry, it was early -
I just needed that first coffee.
So you're at Admiralty, then?
The China trade talks.
Yeah.
Yeah, I'm just waiting
for them to break.
Barbara 67!
I got a 2:1!
What's that?
Don't know.
Look, I think they're
calling us through.
STAMMERING: I should go.
It's open!
Nicky Can I help you?
Where's Nicky Chan?
Never heard of him.
But this is his office.
This is MY office,
has been for ten years.
Oh, OK.
Sorry. Sorry to bother you.
KNOCKING
HEAVY METAL MUSIC IN HEADPHONES
KNOCKING
Hey, Victor.
Victor Smith, exchange student, right?
Yeah, that's me.
How was your flight from Canada?
Looks like it was shitty.
Let's get you fixed up.
Old bastard,
telling tales on neighbours
for extra social credit.
SHE SIGHS
You took your time, Russki.
I expected you last night.
I couldn't find it.
I slept somewhere under a bridge.
Liu says they're tearing
the place up looking for you.
Liu's a friend of yours?
We have interests in common.
He says they took your friend.
Misha? Took him where?
Someplace he won't be
coming back, my guess -
not in one piece anyway.
He's got kids.
This is my fault.
Listen, Russki
first rule, I don't want to know
what you've done, what you believe.
No politics
strictly business.
And he says you have friends.
They're going to have
to come pick you up.
It's too dangerous
for you out there -
facial recognition,
and the MSS are looking for you.
I don't know,
if I can message them
You can also tell them my help
costs 200,000 kuai
in Bitcoin.
Burners.
Tell them you'll message them back
in one hour on a new phone.
Every new SIM costs them 2,000 kuai.
Thank you.
No thanks - Bitcoin.
Now, clothes.
You smell like under
a Shenzhen bridge.
You shower.
I'll take your clothes to
the laundry downstairs.
WATER RUNS
My colleague Joanna from
Counter Intelligence will join me
to audit questioning.
I'll report to no-one until
we believe there are grounds
for the DPP to press charges.
I hope that allays
your fears, Danny.
My fear is that
we have the wrong person.
My hope is that you've
got the right one
or else the real mole
is out there,
as they have been for
the last 18 months, spying on you.
DOOR OPENS
Am I interrupting?
No, we're just finishing.
Alex Sheldon, MI6 Chief,
Roz Cavendish.
Hm, Marston's girl.
Lieutenant Colonel Cavendish,
Director of Rapid Reaction, GCHQ.
And no longer a girl.
CHARLIE: Right,
shall we run over
a few of these details
before we head down to Security?
Come on.
Daniel?
Before I'm consigned
to the dungeons,
I might ask that lovely wife
of yours for a spot of lunch.
Where would I find her?
London.
I'll tell her she missed you.
I'm sure she'll be gutted.
DOOR OPENS.
What's wrong?
A senior management meeting
to which I wasn't invited.
It was a separate matter,
extremely delicate.
You're just going to have
to trust me on that.
That's the crux of the matter,
isn't it? Trust.
You're in your hut, I'm in mine.
Did you have something to discuss?
This new malware, it's propagating.
Which suggests? It's wormware,
replicating itself to spread
to other computers.
To what end?
At the moment it seems
satisfied with internal chaos.
Immigration was on the phone -
the whole system is at a standstill.
We should be doing something
more than triaging.
Step at a time.
Looks like we're
going to have to quarantine
the whole Department of Immigration.
I'll talk to the
Permanent Secretary
No, I will.
That's my job.
I said I'd call him back.
And wasn't I to lead on this?
And you've obviously got other
"delicate" matters to attend to.
Hi, love, I just wanted to
VOICEMAIL: Hi. You've
reached Barbara's phone.
I'm unable to take your call.
It's Vadim on the secure line.
He's OK.
He's confirmed this
attack was APT10,
but he's stuck in Shenzhen.
This is Danny Patrick,
Director of Operations, GCHQ.
Vadim can stay here,
but it costs, Mr Whoever You Are -
Bitcoin.
Who is this?
I'm Hai -
that's all you need to know.
And you're with Vadim?
Yeah, but MSS and State Police
are looking for him.
OK, I can call MI6,
talk about getting you out of there.
I'm sure we can arrange
a suitable fee.
OK, as long as we understand.
Vadim, Saara says you
and your colleagues
were working on a breaking
and entering tool there. Yeah.
Well, it's broken a worm
into our government system.
Do you know what it's looking for?
Not exactly, no.
Saara says you have something.
Vadim?
I did get something -
a long alphanumeric.
Possibly a ciphertext.
It was stolen from you in the
data scrape in the Russian attack.
Can we have it?
It could be really important to us.
When I'm safe.
Vadim, we're doing our best, really.
And we could really do
with that ciphertext now.
I just spent a night under a bridge
hiding from
the facial recognition cameras.
If one of them spots me, I'm dead
so I could really do
with being safe now.
I'll call back in one hour.
HANGS UP PHONE.
We have to get him out.
You're learning, Russki.
Don't give anything away
in this world for free.
We need Vadim Trusov.
We've got an attack coming
out of China at present,
and he holds the key.
I'll see what we can do
but, with the CCP love-in
going on at Admiralty,
the Prime Minister
is going to resist
exfiltrating a Russian citizen
from mainland China
at least until the trade talks
are concluded.
Have your girl liaise
with our China desk.
We'll get a plan in place
and ready to roll.
Alex, we really should begin.
Thank you.
Saara, I've got a number at MI6.
ALEX CLEARS THROA
Alex Sheldon, MI6.
Our MI6 colleagues are here
to offer an independent ear
to our ongoing investigation.
Can you tell us the main reason
for doing the gaming design jobs?
Uh, I enjoy it.
Not for the money?
That too, but I wouldn't do it
if I didn't like it.
I've got a job here.
Last time we spoke,
you said that you could earn much
more in the private sector
than you do here -
does that bother you?
WHISPERS: Shit.
I didn't mean it that way.
I was just saying how it is.
Have you thought about leaving GCHQ?
Yeah, it's crossed my mind, but
I believe in the mission.
And aside from everything else,
what the Russians have done -
Ukraine, the malware attack here
I mean, you've lost the plot
if you think I'd work for them.
Phil, have you ever heard of
a company called XXN Ventures?
No. Xiangxin Corp?
Xiangxin? The
China tech giant?
You think I'm spying for China now?
Now I'm a communist?
Fuck's sake.
XXN supplied the venture capital
for your friend's company
to produce and develop the game.
XXN are a subsidiary
of Xiangxin Corp,
and Xiangxin Corp have established
links to the ruling CCP.
WHISPERS: Fuck.
You weren't aware?
Of course not.
Trouble is,
how can you prove what you did
and did not know?
Because it's the truth.
OK, let's leave motive
aside for one minute
and move on to opportunity.
Hi. You've reached Barbara's phone.
I'm unable to take your call.
Shit. PHONE BEEPS.
Hi. Um
I just wanted to talk.
This morning was
wobbly, and felt like before -
you know, just sudden trips
to London, and
There's difficult things
happening here too.
It doesn't matter.
Um, I hope you have a good day.
KNOCKING Come in.
Department of Trade and Industry
reporting similar issues
as Immigration.
Well, did you quarantine Immigration
like we agreed? Yes.
We produced a timeline.
The worm jumped 600ths of
a second before the door closed.
It knew it was being quarantined.
It still presents as simple code,
but we think the emerging pattern
suggests something more complex.
And the chaos and destruction
are deceptions for a deeper goal.
So, while we were trying
to contain it at Immigration,
it attacked the Department of Trade
during the trade talks.
Maybe that's its deeper goal.
I'm going to have to warn
the Prime Minister's office.
Quarantine Trade too?
It didn't work last time -
no reason to believe
it's going to work this time.
We're going to have to
shut down the system,
both Immigration and Trade
and all related systems. Completely?
That will bring
those departments to a halt.
And much beyond.
Every computer turned off.
It will close our ports,
airports, customs.
And the China trade talks
will have to be suspended.
I'm going to need sign-off
from the top for that.
In the meantime,
you just look for any clues as
to what its target might be.
INTERCOM: Your call
has been forwarded.
David Neal's office.
It's Danny Patrick.
I need to talk to David ASAP.
He's in a meeting.
I'll see if I can get hold of him.
I'll wait. Please hold.
TAPS PHONE KEYPAD
PHONE RINGS
Legal Clearance, Fran speaking.
Hey, Fran, it's Danny Patrick here.
Hi, Danny, how are you?
Er, good-ish.
We're dealing with a
Category 1 attack.
I'm going to need access to ANPR,
and key surveillance systems,
for the duration.
Can your office sign that off?
Yeah, I'll give you
emergency access now.
Will you just send over
the documents?
Yeah, I'll send over the paperwork.
Thanks, Fran, I owe you one.
What the fuck?
Sorry, Danny,
I'm afraid I can't reach him
at the moment.
Do you want to hold?
Never mind, I'm going to
go to London.
Just have him call me ASAP.
MUFFLED TV CHATTER
Is there someone here
I could speak to?
Hello?
I'm looking for Nicky Chan?
Chan Chi Lam?
I know he comes here -
we have photographs.
Um
I'm looking for Nicky Chan
or Chan Chi Lam.
I need to talk to him.
There is no Chan Chi Lam here.
This is a Chinese takeaway.
But you know and I know that
this is a Chinese police station.
The police station is
on the high street
if you need the police.
You know that's not what I mean.
You know this is
an MSS overseas office.
The talks.
What the hell is he doing there?
Who do you work for?
Is there anything you want to amend?
Or add?
Because this statement
makes very clear
that you had motive and opportunity.
But you have no proof that
I accepted money from the Chinese,
and you won't, because
I didn't
not knowingly.
You can't prove that I
accessed the MAC address
at a specific time.
I mean, your only hope
is that I confess,
which I'm not going to do,
because
Because I didn't do anything, OK?
Listen, Phil,
you accessed the sandbox
on an almost daily basis
when the MAC address was stolen.
In the same period of time,
you also accepted money
from a CCP proxy -
Xiangxin Technology Corp.
Nothing's ever lost.
There will be a record somewhere
of who accessed the MAC address.
DAVID: I've spoken to the PM's office
and it's a no to shutting it down.
They have introduced a worm
into the government system.
Every time we try and quarantine it,
it jumps.
It's looking for something.
It could well be to
do with the talks.
But what exactly?
Well, we don't know!
That's why we have to shut
the system down so we can find out.
We can't argue that it
poses an immediate threat
because we don't know
what that threat is.
DANNY STAMMERS
When you identify that,
we'll go back to them.
PHONE RINGS
Understood. I've got to jump.
Roz.
Tell me you've got some good news.
Yeah, I'm going to have
to disappoint you there.
We passed it through
reverse engineering
but they've used environment keying.
You know Marston, right?
Yes, a bit.
All right, well, can you call him?
As minister responsible
and Deputy PM,
he might be able to authorise us.
I'll see what I can do. Thank you.
Mind if I have a word with Saara?
Yes, in fact, I do.
Wasn't really a question.
Saara, we'll talk in here.
So is he right?
Phil?
Is nothing ever lost?
Are you questioning him?
I can't comment on
current inquiries.
That's what people say in here
when they mean "yes".
The files in the system settings
were cleaned out
during the Russian attack
and Chinese data scrape.
And there's no other way
to retrieve them?
Not that I
Let me try something. What?
Start,
Control Panel,
Network and Internet.
Network and Sharing Center,
MAC Address Network,
Details.
The keys you hit when you
access the MAC address,
the pattern,
maybe there's a trace.
Could you find them?
Will it help Phil?
I can't comment on that.
We wouldn't be asking if we
did not think it was imperative.
Danny Patrick put you up to this,
didn't he?
This is his phone line.
A moment. No, no, no, no.
You can't take her.
Internal security takes precedence.
Ah, this place.
Richard
It's a no in any event, Roz.
We are ratifying a trade deal
with the top Chinese delegation.
We cannot have the lights at
the Department of Trade go out.
End of.
Your job is to keep them on, soldier.
TAPS PHONE KEYPAD
It's a no from Marston.
Why does that not surprise me?
OK. Thank you for trying,
I appreciate it.
Where are you going?
PM Andrew Makinde and
Foreign Secretary Richard Marston
reconvened their
landmark trade talks
with China at Admiralty House today.
The Government hail it as
a watershed moment,
claiming the potential for
billions of pounds in economic gains.
But the negotiations
are controversial,
with critics warning that a deeper
strategic partnership with Beijing
risks compromising British security.
SIREN WAILS
Sorry, excuse me.
Pass?
Not on the list.
Oh, come on, I'm GCHQ.
Please keep the entrance clear.
Oh, come on, you've got to let
Right.
So, the talks are progressing
extremely well, as I would've hoped,
but I'm sure you can appreciate
these things do take some time.
However, I hope that,
within the next 48 hours,
we will have an agreement
on the table
which both sides are satisfied with
and which will be of great benefit
to both the United Kingdom and China.
MUFFLED CHATTER
Barbara.
What a nice surprise.
It's been a while.
It has indeed.
Let's take a walk in St James's
Park, shall we, Nicky Chan?
SIREN WAILS
WHISPERS: Control Panel,
Network and Internet,
Network and Sharing Center.
MAC Address Network, Details.
Control Panel, Network and Internet,
Network and Sharing Center,
MAC Address Network, Details.
Control Panel, Network and Internet,
Network and Sharing Center,
MAC Address Network,
Details.
Control Panel, Network and Internet,
Network and Sharing Center,
MAC Address Network, Details.
Control Panel, Network and Internet,
Network and Sharing Center,
MAC Address Network,
Details.
Control Panel.
WHISPERS: Charlie.
Charlie?
Mm.
I think I might've found something.
RINGING
PHONE RINGS
RINGING
Hey there.
Hi.
Where are you?
Um I was on my way home,
but I got called back in.
You?
I just got home.
I picked the boys up on the way,
ordered pizza.
They're just doing their homework.
How was London?
Fine.
And your talks
with the special advisers?
Fine.
I got your message.
Sorry I couldn't pick up, I, um
What time are you home?
Uh, I can't say.
Danny? Let's
Let's talk later, OK?
Love you. Yep. Got to go.
Fucking hell,
how long is it going to be?
Nice friends -
they prefer to talk about business
with CCP than help you out.
Saara won't let me down.
Is she your girlfriend? No.
I mean, no, she's not.
Magic.
I don't understand.
Balaclava,
so you can get from
here to the car,
or whatever it is your friends
decide to send for you.
Thank you.
Thank me in Bitcoin,
not flower boy eyes.
Is that a compliment or an insult?
Insult.
Put it on now
so I don't have to look at you.
Wow, you look better already.
HEAVY METAL MUSIC PLAYS
HAI YELLS
THEY YELL
This completes the list of
all the times
the MAC address was accessed.
It was actually
quite easy in the end.
I dumped the RAM
and examined the raw data
using memory forensics.
Yes, that's the full list.
And only one falls
into our time period
of October, 2022, 10.51.
So now we just need to
cross-reference.
No.
I can't believe I just did that.
You did your job.
TAPS PHONE KEYPAD
Maya. Boss.
I need you here.
And get Joanna from MI6
and I think Phil Draper's
going to need a lawyer.
DOOR SHUTS
How bad?
The threat level has escalated.
The whole financial services sector
will soon be in meltdown.
And the malware is irreversible?
Not that we can determine as yet.
DANNY SIGHS
Close down the system -
Departments of Immigration,
Trade and all contiguous systems.
But Marston said
To hell with Marston.
The man is a posturing idiot.
Perhaps, but can we, legally,
without ministerial sign-off?
The Intelligence Act of 1994 -
senior officials can organise
preliminary actions
in the national interest
without ministerial approval.
If anyone questions you, it's on me.
There has been travel chaos
across the UK today
after the Department
of Immigration's
computer system went down.
Airports, ferry terminals and
the Eurostar were all affected.
There is growing suspicion that
hackers from a hostile nation state
may be behind the disruption.
The lawyers at Trade and
Industry were writing
key paragraphs in the agreement
when you pulled the plug.
It was necessary.
You should have consulted us.
I did - you said no.
I was within my rights as Direc
That's as may be,
but the PM's exact words were,
"I'll have Danny Patrick for this."
Well, the Public
and Commercial Services Union
will have something
to say about that.
You do realise it's chaos out there,
don't you?
It was chaos before.
At least now it's confined.
We need to turn the system on again
as soon as possible, Danny.
The risk of contagion is too great.
This is a potentially nuclear
piece of malware.
Until we understand it,
those departments remain isolated.
Well, I hope you're right, Danny.
I am.
Some blowback.
Someone had to make the right call.
Look, you've been here all day.
I'll do the night shift,
you go get some sleep.
Are you sure? Yeah.
Just come in with
a brilliant solution tomorrow.
You know
the reason MI6 are here
is because
we've got a mole.
It could be anyone
but they think they've
got the right person now.
Well, thanks for trusting me
enough to tell me.
DOOR OPENS
You've been read your rights,
Phil, do you understand?
Yes.
And I didn't betray my country.
This is a timestamped log
of the missing MAC address
access records,
which proves the MAC address
was stolen on your login.
No, this This isn't right.
There must be a mistake.
I need to see the
Malware work calendar
to see what we were working on.
RINGING
Boss? Maya,
could you see if anyone in Malware
can supply us with
their work calendar?
Matter of urgency.
"Laughing Panda"?
"Malware Attack, Chinese, APT10."
We went into surge mode
for a good two weeks.
How is that relevant?
What have you got for me?
It's Phil, isn't it?
It can't be.
Can't be what?
Barbara Napier.
She asked me to get her a coffee.
I left her at the terminal
I went down to the coffee van.
I must've been gone
a good ten, 15 minutes.
But it was Danny Patrick's wife,
the boss,
Barbara Napier.
You wouldn't be an angel
and get me a latte
from the coffee van, would you?
Here, have one yourself.
Barbara Napier? Yeah.
I don't know why they sent the most
senior analyst on the China Team
but it was Danny's wife
the boss -
of course I got her a coffee.
These are very serious allegations
you're making here, Phil
about a senior and
widely respected colleague.
I'm not making allegations
I'm just saying what happened.