Cyberwarfare is real, but there are no discernable rules of engagement, a fact made clear in Alex Gibney's latest documentary, Zero Days.
Zero Days recounts the discovery of Stuxnet—a computer virus created by the United States and Israel to destroy centrifuges at Iran's nuclear enrichment facility in Natanz—by two Symantec engineers, Eric Chien and Liam O'Murchu. Stuxnet was brought to their attention by Belarusian antivirus researcher Sergey Ulasen, but they were the first to uncover the source and scope of the virus, and to realize that it was the work of a nation state.
In this PCMag exclusive clip from Zero Days, you get a sense of the initial horror Chien and O'Murchu felt when they realized the purpose of the code in front of them. "Here you had malware potentially killing people and that was always something that was Hollywoodesque to us," Chien says.
Gibney is no stranger to secretive and scary topics. He's covered the shadowy world of Scientology in Going Clear: Scientology and the Prison of Belief, unfettered financial felony in Enron: The Smartest Guys in the Room, and Silicon Valley's cult of personality in Steve Jobs: The Man in the Machine.
In an interview with Gibney, Chien, and O'Murchu, Chien expressed surprise that his job has become so political. Stuxnet has made him look at the news differently now; "even things like Brexit," he says.
Since Stuxnet, Chien and O'Murchu have seen a tremendous uptick in suspected nation states engaging in malware attacks. "We see this proliferation of particularly government-based threats," O'Murchu said. "So back at the time of Stuxnet, we only knew about about one or two operations. Now we're tracking over 100 government-backed operations that are running for years."
A peek inside the spy machines can be intimidating, Chien acknowledged. "The real danger or blueprint about Stuxnet was, it demonstrated to people that this was not some hypothetical movie story ... you can practically and really and actually do this."
Former CIA and NSA Director Michael Hayden seems to agree. In Zero Days, he dodges questions, but makes clear that he appears in the film to alert the public about a practice that is now considered fair game.
As retaliation for Stuxnet, Iran disabled online banking across the United States. But this is a global phenomenon. China has attempted to obtain information about power, telecommunications, and Internet infrastructure in the US through cyber espionage. And Russia recently took down a power grid in Ukraine for several hours.
"Honestly, the potential of the threat for these kind of cyber weapons is huge when you start talking about shutting down grids," Gibney said. "The threat for all of us is enormous."
Zero Days is in theaters July 8 and is on demand on some services.