You can keep your Conjuring 2 s and Lights Outs and Don’t Breathes; the scariest movie of the summer is Zero Days, and it’s a documentary. The latest from the gutty, gifted and comically prolific Alex Gibney (Taxi to the Dark Side, Client 9, Going Clear, We Steal Secrets, Steve Jobs: The Man in the Machine) is an up-close, in-depth, and straight-up frightening account of the development, implementation, and danger of the Stuxnet worm, a devastatingly effective computer virus allegedly developed by the U.S. and Israel to slow Iran’s nuclear program.
The virus was subject to some media scrutiny upon its discovery in 2010, and discussions of it continue in cybersecurity circles, but this hasn’t penetrated the public consciousness the way Snowden or Wikileaks have, for one simple reason: it’s complicated. Those complexities, and the levels of state secrecy and general confidentiality engendered by them, make it easier to brush aside; most people don’t understand it, so they don’t understand its implications.
Gibney, as he often does, refuses to let those red flags put him off – instead, he digs deep into the complexity of this thing, hoping to not only investigate but clarify. Few in positions of power will comment directly on this story (one of the film’s first montages is basically a series of no comments), so he has to chase it down himself, and lay it out via clear interviews, crisp explainers, and helpful on-screen graphics. He knows this is dense material, and he’s determined not to lose you.
At a critics’ screening this spring, I asked Gibney how he works that out, measuring how far into the weeds to go, and how to get there. “Usually by the quizzical looks on the faces of those people I show it to in the office,” he laughed. “There was a deeper level that we had gone at some point, and that’s usually when my editor looks at me and says, ‘Dude, forget about it.’ But I think it’s always a balance, because there’s also a narrative and a narrative momentum you have to be concerned about, and you hopefully try to find the right mix.”
Yet this is no dry position paper; he paces Zero Days like a thriller, and a relentless one, throwing maps, graphics, context, and information at us with intensity and urgency. Because of the level of secrecy around this stuff, Gibney becomes something of a detective, working through a mystery backwards, from clues found in pieces of code or backgrounds of photographs. His fascination and curiosity is what propels the piece, as he methodically works through development and implementation, figuring out exactly how this thing worked in the wild, and how they kept rolling it out.
He gets some help, talking to diplomats, officials, spies, hackers, reporters, technicians, and other experts, and while many won’t answer the questions he’s asking, the things they do say are quite telling; former NSA and CIA director Michael Hayden, for example, will not confirm the U.S.’s role in Stuxnet’s development (no one from our government has ever acknowledged this or any other weapon for cyber attack) but he does say that the work it did was “an unalloyed good”. And as he did with Client 9, Gibney finds an ingenious way to dramatize the words of anonymous sources, here putting the words of NSA sources into a digitized actor. They are, unsurprisingly, the most chilling. “We did Stuxnet. It’s a fact,” the source admits. “We came so fucking close to disaster.”
We’re getting into All the President’s Men territory here, though if anything, the stakes are higher here; asked to pinpoint his paranoia levels before and after making the film, Gibney laughed, “Extreme/extremer.” But these are the kind of big questions our best non-fiction films can, and should, pose: do the potential benefits of such a sophisticated weapon outweigh its possible abuse? In theory, it allows an attack on a hostile nation-state without troop deployment or collateral damage, but is this a genie you want out of its bottle?
“From a moral perspective, I think we should take it extremely seriously,” Gibney said. “I think that’s the point of making the film. Now that the weapons are a relatively unadvanced stage – even though they’re at a stage where they can shut down entire grids – now we should be looking at that, and that I think was actually the reason why a number of the sources came forward, because they were convinced that the people at Cyber Command, particularly the military officials at Cyber Command, didn’t really have a full enough appreciation of the damage that these weapons can do.”
And that’s the chilling destination of Zero Days – the terrifying “what-ifs” of a virus that can remotely shut down electrical systems, melt down ATMs, erase information, and generally push the nuclear button in a cyber-war. We don’t think of these things the way we do other weapons systems, with their rules of engagement and acknowledgements of dangers and implications. But at some point, we have to, and I shudder to think what might take for us all to make that leap.
Zero Days is out Friday in select cities and on demand.