"This has the whiff of August 1945 about it. Someone has used a new weapon, and it can't be put back into the box," says Michael Hayden, the former head of both the CIA and the NSA. He's talking about cyberwarfare, the use of computer viruses and worms aggressively to attack and disrupt systems within another country.
This important documentary starts by telling the story of Stuxnet, the self-replicating computer virus invented by the United States and Israel to infiltrate and sabotage the Iranian nuclear centrifuges at Natanz. It is not an easy story to get, as all the officials who might have something to say about it refuse, citing national security reasons. But writer and director Alex Gibney is a skilled filmmaker who knows how to make the most out of interviews, re-enactments, and stock footage in the creation of thought-provoking and ethically charged works like Zero Days.
He begins with a description of the growing threat of malware infections in personal, business, and government computers. Tech security experts from the anti-virus company Symantec, Liam O'Murchu and Eric Chien, describe the challenge presented when they learned about this never-before-seen type of worm which could not only alter programs within a computer but could take over physical machines and make changes in them that would trigger their destruction.
The implications of this development are enormous. This weapon of war is capable of taking out a country's power grid, water supply, or defense system without being detected or traced back to its creators. The two technicians are awestruck by the complexity and lack of bugs in the virus. They and other cyber detectives from companies around the world were able to determine that the worm's intended targets were in Iran and it had been developed by U.S. and Israeli intelligence agencies.
How Stuxnet was used in Iran is just part of the story, however. It soon showed up on computers elsewhere, so that at one point U.S. Homeland Security spent billions trying to figure out how to protect the United States from something its own agencies had developed. Iran figured out who was behind it and responded by recruiting a Cyber Army of hackers, who then launched an attack on the Bank of American and other U.S. institutions.
At the core of this story is how Stuxnet was authorized by the Bush administration and the cyberwarfare program was continued under the Obama administration. According to David Sanger of The New York Times, who has written major stories about cyberwarfare, the secrecy surrounding these operations makes it impossible for the citizens to evaluate this new branch of the military (there is the Army, Navy, Air Force, and now Cyber Command) nor its high cost (Stuxnet may have cost $52.6 billion dollars). How can people debate the value of something that is secret? How can treaties be negotiated if no one is told what these weapons can do?
Zero Days also presents other topics which must be discussed: the possibility that rogue viruses can infect other systems (similar to drones and "peripheral damage") and the fact that nation states as well as hackers working for terrorist organizations now have access to the codes and can design and launch their own pre-emptive attacks.
Some of the most compelling commentary in the film is given by an actor playing a fictional whistleblower from the NSA. Her lines were put together from a number of interviews conducted by the filmmakers with people in the know about what the intelligence community has been doing. She notes that this project was given the codename "Olympic Games." It is a fitting metaphor for the competition that will likely happen as more and more nations are involved in continuous cyber war.
Being released during an election year in the U.S., this film comes just in time. "I hope this film wakes a lot of people up," says Gibney. “We need to insist that our political leaders tell us the truth. We need to know what happened and what the potential for these weapons are. And we need to understand how vigorous is our offensive capability and how weak is our defensive capability. And we need to insist that our governments do a better job of figuring out both some kind of international agreement, as in nuclear and in chemical weapons, but also honestly reckoning with the American people about our own situation at the moment."