A computer virus – even one as apparently malevolent and unstoppable as the infamous Stuxnet – would make an unlikely subject for a feature-length documentary, you might think. But New York documentary maker Alex Gibney’s Zero Days is a remarkable achievement – and in so many ways. As an edge-of-your-seat, real-world thriller; as a sobering investigation of shadowy US foreign policy; and ultimately as a wake-up call to a new form of warfare, unleashed without us even noticing. It has its faults, for sure, but Zero Days is an undeniably important film – compelling, expertly structured, and truly frightening.
Gibney won the 2007 Oscar for his documentary Taxi to the Dark Side on US torture in Afghanistan, and he’s equally fearless in his investigations here. Stuxnet first emerged in Belarus in 2010, but by then the virus had already infected systems throughout the world, spreading and self-replicating without the need for human intervention – although its goal (or payload, as Zero Days’ techies chillingly call it) remained a mystery. Gibney unravels the Stuxnet worm’s complex story with brilliant clarity, taking us through several carefully explained acts in its development – how its four "zero days" self-replicators pointed to the involvement of a nation state, almost certainly the US; how the kit that Stuxnet was designed to damage – a Siemens equipment controller – was miraculously revealed; how the worm’s target was identified as Iran’s fledgling nuclear facilities.
Gibney picks apart Stuxnet’s meandering tale using remarkable access to key figures in the CIA, NSA, Mossad, US and Israeli military, IAEA and more, who not only provide startling insights into the shadowy Stuxnet programme, but also turn out to be as fascinating as the protagonists in a fictional thriller. Symantec’s Eric Chien and Liam O’Murchu are the two buddies who first discover the malware, watching each other’s backs as its power and sophistication become clear; ex-CIA and -NSA chief Michael Hayden is a chilling bad guy, disarmingly charming while denying any knowledge of the project; and gentle IAEA inspector Olli Heinonen seems too well-meaning for the piercing insights he supplies.
Most remarkable of all, though, is Gibney’s access to the NSA officials involved in the Stuxnet programme itself – which they themselves dubbed Olympic Games, just part of a far broader Nitro Zeus project to disable Iran’s critical infrastructure in the event of war – who are embodied, fittingly, in a grotesque, sweary figure heavily disguised behind pixellation (pictured above).
It’s a visually stunning film, often as murky as the dealings it unpicks – although it perhaps relies a little too much on scrolling lines of computer code to make its visual points, even if by doing so Gibney shows he’s unafraid to take us deep into the heart of Stuxnet itself. By its closing call to action, however, Zero Days has both sounded an alarm and shown us the only path we can take: that cyber war has already been quietly unleashed, and that only by coming clean about their capabilities can nations control this terrifying new weapon. It’s a dense, demanding film, but Gibney’s Zero Days is an urgent warning, and an exceptional investigative documentary.
