"This was obviously the first, biggest, and most sophisticated example of a state or two states using a cyber weapon for offensive purposes," says New York Times national security correspondent David Sanger in Zero Days. He’s talking about Stuxnet—an elegant, dense, and massive piece of malware. First discovered via an "epidemic of computer shutdowns" in 2010, eventually it was recognized as something far greater: a powerful, covert American and Israeli cyber attack on an Iranian nuclear facility.
Alex Gibney’s documentary Zero Days delves into how Stuxnet happened—a tale that’s part 007-style spy caper, part computer nerds waxing rhapsodic about code—and what it means that the Obama administration refuses to acknowledge its role in the attack. The Bush and Obama administrations have been deeply committed to offensive cyber actions, Zero Days argues—to secretly developing and deploying, as Sanger says, "an entire new class of weapons."
Sanger’s hardly the only reliable talking head who gets interviewed: Here are computer security experts, former heads of the Central Intelligence Agency and National Security Agency, nuclear experts from the United Nations, shadowy Mossad agents, and the former director of cyber security for the US Department of Homeland Security. Some of the participants are identified (like Symantec Security Response’s Liam O’Murchu, who speaks of Stuxnet with both awe and fear: "Here is a piece of software that should only exist in a cyber realm, and it is able to affect physical equipment in a plant or factory and cause physical damage"), while others have their distinguishing characteristics hidden; some are happy to chat about everything, while others clam up once Gibney asks them about America’s involvement. But the history that evolves in Zero Days digs into America’s twisted pasts with Iran and Israel, and jumps from Bush and Ahmadinejad to Snowden and Obama
It’s a complicated saga—Gibney is stuck, for basically the first half of the film, catching the audience up on cyber warfare and geopolitical tensions—but eventually, the film hits on another issue: The fact that most people don’t know what Stuxnet is, and, as a result, aren’t having the conversation we’d normally have about such a massively destructive weapon—one that could affect everything from power to water to finance to medical care, and one that could be used against us as easily as we use it against others. Zero Days attributes this lack of accountability as a side effect of Stuxnet’s secrecy. But it also leaves another implication hanging in the air: That the lack of oversight for weapons like Stuxnet might be the very reason for their secrecy.