Zero Days

In the summer of 2010 security researchers find a piece of malware nobody recognises. The code is unusually large, uses several unknown vulnerabilities at once, and only wakes up in front of one very particular kind of hardware: the controllers for the centrifuges at Iran's Natanz facility. The software is called Stuxnet. The documentary runs on two levels: researchers taking the code apart step by step, and a government that refuses to say whose operation it was. Its real claim is not that a state committed sabotage but that a new class of weapon has been opened with nobody drawing its limits. What that means becomes visible when the code spills past its target and spreads worldwide. Alex Gibney directed. The operation's code name is given as Olympic Games. The film ends by connecting to a follow-on plan called Nitro Zeus and to the 2015 Iran nuclear deal, at which point the scale jumps and the subject stops being one centrifuge plant. Who it is for: anyone interested in cyber security, intelligence and state secrecy. Who it is not for: anyone who wants technical detail, or anyone who wants none. The film sits between the two, runs long, and repeats the same point several times through the middle.