When I heard there was going to be a TV drama about cybersecurity, my initial reaction was that it was a brave thing to attempt. Trying to make what we do televisual is notoriously difficult. There is very little to see – just people tapping at keyboards and staring at screens, with most of the action going on inside their heads. So I have been pleasantly surprised by Peter Kosminsky’s Channel 4 series The Undeclared War (whose second episode airs tonight). I binge-watched the entire thing in a weekend.
The cyber-attack on the UK in episode one was all too credible. I initially thought they were going to be vague and melodramatic – “The internet’s gone down!” – but the script went on to explain how the BT infrastructure, which does run a huge chunk of web traffic in the UK, had been taken offline. They specified how 55% of web access had been lost and it was cleverly timed to be a disruptive attack, rather than a disastrous one with planes falling out of the sky. You can cause a lot of chaos by taking out any of these “Tier 1 networks”. We’ve seen it happen by accident – last October, Facebook managed to wipe itself by mistake – so it’s perfectly plausible an attacker could do the same.
We have also seen it happen by design. In 2016, there was an attack on a company called Dyn, a Domain Name System (essentially the phonebook for the internet) provider. It took down Amazon, Netflix, gaming platforms, social networks and news organisations for half a day. In internet time, that’s aeons. Two years ago, SolarWinds – network management software used by all sorts of government departments – was hacked. Somebody cleverly put in a backdoor, which sat undetected for months. It appeared to be espionage, but rather than stealing data it could have been used for something more disruptive.
Of course, the programme is fortuitously timed, too. An hour after it invaded Ukraine, Russia took offensive cyber action. A comms company called Viasat provides a lot of the internet connectivity in Ukraine. Russia managed to freeze it so nothing worked. It prevented people going online, which might not sound like much but look at the younger generation who are glued to their smartphones. A squeal goes up if they lose wifi for 10 seconds. Imagine no internet for 12 hours. That is quite a major disruption.
Right from the beginning, The Undeclared War visually represented protagonist Saara Parvin (Hannah Khalique-Brown) completing a digital Capture the Flag exercise. This portrayed her thought process beautifully. People who excel at cybersecurity tend to be good at problem-solving. At Bletchley Park during the war, they would print cryptic puzzles in newspapers and recruit people who completed them fastest.
Once it got down to the technological nitty-gritty, I was delighted to see characters using real tools. Analysts unpacked a piece of malware using an IDA (interactive disassembler). The code you saw on screen was actual machine language, rather than gobbledegook. Saara found a second virus nested inside another – a bit like Russian dolls – which is a well-known technique. My own original discipline was steganography, the art of hiding things in plain sight. It is used mostly for covert communications but increasingly in malware as well. Make people look in one direction, then suddenly the payload goes off somewhere unexpected.
We saw Saara exploit real vulnerabilities and break through a firewall, which was pretty authentic. So was putting the virus into a “sandbox”, which is what you do to test out malicious software: load it on to an isolated computer. As it happened, this piece of malware got out – but that’s also increasingly common. Malware is designed now to recognise when it’s in a sandbox and find ways to escape. I can tell much more thought has been put into The Undeclared War than your average “bombs and bullets” Bruce Willis movie.
I enjoyed the juxtaposition in the Cobra meeting between what the ministers demanded and what GCHQ advised. Politicians often suffer from “do-something-itis” – they want to be seen to take decisive action. Nobody in our trade would think hacking back is a good idea, because it leads to escalation. The GCHQ representatives – Danny Patrick (Simon Pegg) and David Neal (Alex Jennings) – correctly pointed out that tit-for-tat can go horribly wrong. If you’re not careful, a conflict in cyberspace can escalate into military retaliation. Indeed, Nato’s Tallinn document says that if it comes under a cyber-attack of sufficient magnitude, it reserves the right to respond “kinetically”, meaning missiles and bombs.
The drama also highlighted the huge problem with retaliation. Cyber-attacks allow plausible deniability, and attribution is incredibly difficult. People presume it was the Russians but nobody knows for certain. If someone launches a missile at you, you’re pretty sure where it came from. With cyber-attacks, it’s hard to tell who wrote the code and where they were. It is also easy to plant false flags in there – make it look North Korean, say, or timestamp files to correspond with Moscow timezones. You need ancillary intelligence because the bits and pieces gleaned from electronic warfare data aren’t enough.
In the show, a rogue British hacker called Jolly Roger responds to the Russian attack by making the lights in Putin’s office flash on and off. You do get these vigilantes. There’s a whole group on the chat app Telegram called “the Ukrainian IT army”, trying to mount attacks against Russian targets. At another point in the programme, GCHQ mention taking control of Putin’s presidential jet. That’s an in-joke about cybersecurity consultant Chris Roberts, who told the FBI in 2015 that he had hacked into planes and controlled a United Airlines flight. Don’t worry: you might be able to hack into the galley system or in-flight entertainment system, but not the engine management or autopilot.
The GCHQ setting also feels very accurate. The old site comprised lots of small individual offices with locked doors and a high degree of compartmentalisation. Since “the Doughnut” was built in 2003, it’s more like a university campus. Once you are through the doors, there are open plan offices and coffee shops. The baristas serving the coffee have the same security clearance as you. I approved of how Kosminsky shows people in uniform walking around, because GCHQ does support military operations as well. Some staff work in flak jackets or behind armoured glass – brave people doing important work. It’s refreshing how the drama shows GCHQ in a positive light. These people help defend us on a daily basis, with little or no credit.
There are niggles, naturally. The cabinet office briefing rooms are too dark and not shabby enough. There’s too much external connectivity from within the Doughnut. These dramas always come down to six people saving the world, whereas in reality a thousand do the work. And having Saara, a student on placement, crack the code was a stretch. Then again, it’s surprising how often people find something in places where nobody else thought to look.
Some viewers have queried whether Saara would get clearance, considering her partner is a climate change activist, but things have changed a lot. In the 21st century, GCHQ welcomes anyone and everyone. The questions aren’t about “moral turpitude”, as they were when I joined, but whether you will remain loyal. What the process tries to establish is whether you are hiding anything. It doesn’t matter what your sex life involves or if you once took drugs, as long as you’re open and honest about it. If you keep something back that you could be blackmailed or coerced over, that’s where problems arise.
The security services nowadays are staffed with people who wouldn’t have got in 30 years ago. In the cold war era, we were mainly looking at the Soviet Union, so an awful lot of recruits were white, male, Russian-speaking public schoolboys. Now the threats are far more widespread. We’re worried about places like China, Iran and North Korea. You need diversity of staff to reflect the threats we are facing.
You can absolutely tell that Peter Kosminsky did three years of research. I’d wager he had quite a lot of cooperation as well, because many scenarios, tools and techniques chimed with my own experience. Kosminsky says that everything he depicted has either happened or been “war gamed” by security services, which I can well believe. We have an organisation called Centre for the Protection of National Infrastructure. Part of their job is to identify critical points of failure – “What will the impact be if certain telecom towers are taken out?”, “What if someone cut through the transatlantic data cables off the coast of Cornwall?” – and rehearse what might happen.
We’re a cautious lot in cybersecurity, but apart from a few elements added for dramatic effect, I feel very positive about the show’s realism. The security industry is just like any other, in that people will pick holes in the technical detail. Overall, though, The Undeclared War is very impressive. I’d love it to be renewed for a second run. That could portray another rogue state – perhaps ransomware from North Korea, Chinese data-gathering or something escalating out of the Middle East. There is definitely fodder for another series, put it that way.
As told to Michael Hogan
Alan Woodward is a computer scientist and visiting professor at the Surrey Centre for Cyber Security. He has worked for the UK government on signals intelligence and information security, as well as in business and academia
