Alex Gibney on the Stuxnet Documentary “Zero Days”

You will not see a more purely terrifying movie this year than “Zero Days,” a documentary from Alex Gibney (“Enron: The Smartest Guys in the Room,” “Going Clear,” “We Steal Secrets”), one of my favorite filmmakers. He spoke to journalists along with Eric Chien and Liam O’Murchu, two of the film’s most important figures, the men who discovered what they dubbed the Stuxnet computer virus, which turned out to have been developed by the Unites States and Israeli governments to unleash on the nuclear facilities in Iran. As an expert in the film explains, for centuries countries had armies and navies, and then in the 20th century they had to have air force capacities. But now, in the 21st century, wars will be fought through computer networks, probably more frequently and more devastatingly than on battlefields.

As a filmmaker, Gibney had a challenge to present a non-cinematic story in a dynamic visual medium. “It was mostly men sitting in rooms with suits on. The main character was a piece of computer code. Talk about challenging. You’ve seen ‘Enron.’ Back then I broke rule number 1A of the filmmaking manual which is never make a film about accounting.” He worked with a special effects company to “design a code, with the help of Eric and Liam, to be able to make it both accurate and also make it feel like it’s a living breathing thing. So it really was like entering the Matrix or something like that. That was key — it was to come up with a visual design for the film and then also a narrative design for what is basically a detective story. It’s kind of a spy thriller and Eric and Liam were the detectives.”

Chien provided some historical context. “I think the internet itself sort of changed how we function, our economy, a lot of growth, and the ‘internet of things’ will grow equally as well…It is very insecure and a bit worrisome and I think we fear that we will repeat mistakes that we made in the past. When we started computing it was quite open and free which was great and you could hack the computer in the old traditional sense of hacking the computer and that allowed the sort of insecurity where we are at today. We did not design computer and networking with security in mind at the start. We designed it so anyone can use it and it would be completely free. We sort of learned a lesson that you needed some level of security and that lesson currently is not being applied to the internet of things. That’s what worries us the most the right now. There is a lot of push right now to get internet of things on board with some sort of standard with some sort of default security.”

In the film, Chien and O’Murchu, in evaluating the Stuxnet virus to protect their commercial customers, quickly realized that the code was vastly more powerful and robust than anything they had seen before. The obvious conclusion was that it came from a government. But that does not mean they stop trying to find a way to stop it because it may be coming from “the good guys.” O’Murchu said, “It’s funny when you say bad guys can do this, how do you define that? The whole problem is that there are no good guys and bad guys here.” “In our world the good guys are us and the bad guys are anyone else,” Chien added, “anyone who is writing malicious codes to get unauthorized access to a computer that ultimately we normally are in charge of protecting. That is our view so we don’t ignore code because it looks super sophisticated or might be from a nation state. We have customers all over the world in countries like Germany and Belgium that Western countries have attacked equally as well and we’re responsible for protecting those computers. I would say in some sense fortunately code doesn’t come with a marker that says this is from this particular country and even if it did you can’t say that anyone would put in their code ‘Welcome from so and so.'”

The film begins with a sequence of witnesses saying some variation of “I can’t talk about it.” So how can Gibney be sure of what he is reporting? “Obviously, there are false flags. People lie to you all the time but over time you develop patterns and you try to convince yourself that actually you got the story right.”

The most candid (to a point) and compelling witness in the film is an unidentified (until the end) insider portrayed as a disembodied face made of cascading pieces of code, created for the film by a company called Scatter. “We wanted to create a character that would be in the kind of code world of the film but would also be a means of protection. So what we did was, we shot an interview with a woman, and we shot it in a way that was very much straight on but it was like we were mapping her in a 3-D space. And then it allows you to go in after the fact and both render camera moves and also break down the image into points, lines and flesh and recombine them in different ways so that they both mask the identity but also create that kind of interesting sort of hacked computer look of the character. And as you move around to the side because they were mapping only 180° in space, suddenly it starts to trail or get messy and if you go all the way around actually in the first rendering of the character we were able to literally jump outside the room and then track in, that was all after-the-fact. So it was really a wonderful device and it also helped us in terms of convincing sources to come forward that we would have a device that would be so otherworldly that it would mask identity.”

In this movie about secrets, Gibney was especially careful to protect his sources. “One of the things we did for protection was the combined testimony of a number of different people. While the New York times would frown on that technique within the context of the film I think it’s perfectly appropriate and also frankly it was key to persuading the sources to come forward and that was very important to us.” He believes that in documentaries “form follows content.” Some stories require more narrative shaping and commentary. With his Lance Armstrong film, “The Armstrong Lie,” “we hung out with Lance, we follow Lance, we don’t comment in addition I did interviews but we film for 21 days at the Tour de France. So it depends. In a lot of the films that I do tend to look back at recent events and understand them in a different way. Usually knowledge narratives get built around them and then I go in after the fact and say is this really what happened. It’s like cold cases. Is this really what happened or actually is it different than we thought it was? Is very hard to use cinéma vérité in the past, impossible in fact. I’ve got nothing against it; for the right film I love it.”

This movie can be seen as a companion piece to Gibney’s documentary about Wikileaks, “We Steal Secrets.” “It’s a matter of momentum. So far the momentum on the side of the government has been to make more and more things clasified. It becomes almost a default policy and to read more and more people into these secrets so that they are unable to talk about this. Well if you create a mountain of secrets and a huge number of people who hold these secrets it shouldn’t be surprising that there are leaks. Despite the Obama administration’s insistence on prosecuting people who leak more than all other administrations combined, you continue to get these big leaks in part, I think, because there is a belief that what the government is doing is hiding either misguided, immoral, or illegal behavior behind those secrets and therefore not being held to account. You are seeing that in the torture debate, you are seeing that in the drone debate and now you are seeing it with Stuxnet. So at some point they’ve got to wake up and understand that if they are misusing secrets James Harper lied before the Senate regarding the operations of the NSA, there’s going to be blowback and the blowback is more leaks.” Chien called it “rough justice.”

The movie calls for some international negotiations on the use of cyber-weapons. “I think the point is if we start then we’ve got a shot at it. To just throw up our hands and say ‘well, it’s impossible so let’s not worry about it,’ I think that’s just the wrong answer. We have to embark on that and part of it also is that these technologies that these weapons exist because then all of us as citizens can say well is this what we want, a complete Wild West world where everybody is launching weapons at each other all the time and we don’t know when they might launch or who might launch them, not a good thing. Someone in the film says, ‘Right now the norm is do whatever you can get away with,’ not a very good norm.”