{"id":21798,"date":"2016-07-21T13:19:45","date_gmt":"2016-07-21T20:19:45","guid":{"rendered":"https:\/\/qgp.ykq.mybluehost.me\/cinephiled\/?p=21798"},"modified":"2016-07-21T13:19:45","modified_gmt":"2016-07-21T20:19:45","slug":"interview-director-alex-gibney-and-cyber-security-expert-eric-chien-on-powerful-doc-zero-days","status":"publish","type":"post","link":"https:\/\/www.cinephiled.com\/interview-director-alex-gibney-and-cyber-security-expert-eric-chien-on-powerful-doc-zero-days\/","title":{"rendered":"Interview: Director Alex Gibney and Cyber-Security Expert Eric Chien on Powerful Doc \u2018Zero Days\u2019"},"content":{"rendered":"

\"zerodays-poster\"<\/a>Acclaimed filmmaker Alex Gibney\u2019s Zero Days<\/em> is a documentary thriller about the world of cyber war. For the first time, the film tells the complete story of Stuxnet, a piece of self-replicating computer malware (known as a \u201cworm\u201d for its ability to burrow from computer to computer on its own) that the U.S. and Israel unleashed to destroy a key part of an Iranian nuclear facility, and which ultimately spread beyond its intended target. Zero Days<\/em> is the most comprehensive accounting to date of how a clandestine mission hatched by two allies with clashing agendas opened forever the Pandora\u2019s Box of cyber warfare. Beyond the technical aspects of the story, Zero Days<\/em> reveals a web of intrigue involving the CIA, the U.S. Military’s cyber command, Israel’s Mossad, and operations that include both espionage and covert assassinations but also a new generation of cyber weapons whose destructive power is matched only by Nuclear War. I sat down with Alex Gibney and Eric Chien, one of the digital security experts featured in the film who discovered Stuxnet.<\/p>\n

Danny Miller: Alex, I spoke to you when your great doc We Steal Secrets: The Story of WikiLeaks<\/em> came out a few years ago and wondered if that film was in some ways the parent of this film.<\/strong><\/p>\n

\"Alex-Gibney-Zero-Days-Men\"<\/a>Alex Gibney:<\/strong> Yeah, I guess you could say that. Working on the WikiLeaks story is what got me interested in this territory. And both films share a producer, Marc Shmuger, who was the one who reached out to me for both films.<\/p>\n

I think one of the miracles of this film is that it makes the very\u00a0complex subject matter intelligible to laypeople. I thought one of the most effective ways you did that was the balloon experiment where you show how Stuxnet could make a pump pop a balloon remotely.<\/strong><\/p>\n

Yeah, that was awesome.<\/p>\n

Did you create that for the film or was it something that was already out there?<\/strong><\/p>\n

Eric Chien:<\/strong>\u00a0What happened was in 2010 we were going to present at one of the biggest security conferences about Stuxnet and our discovery. Whenever I present at a conference, I like to have some kind of demo that shows people what we\u2019re talking about. So we were thinking, \u201cWell, we can\u2019t really build a gigantic centrifuge like the ones in nuclear facilities \u2014<\/p>\n

Unless you wanted to expose every person in the room to radiation poisoning!<\/strong><\/p>\n

Right. (Laughs.) So we kept thinking about how we could show this code in action. First we thought we could maybe create something spinning or we could blow something up and finally we got the idea of getting a pump and using the code to make the pump go out of control by blowing a balloon up until it explodes.<\/p>\n

So brilliant, because in that one second, we all get it. And then our minds immediately go to the endless possibilities of how\u00a0that technology could be\u00a0used to wreak endless havoc on our lives. I kept wondering why we haven\u2019t had way more horrible incidents because of this.<\/strong><\/p>\n

Well, the truth is that a lot of things have<\/em> happened. One example from last December, I don\u2019t know if you remember this, but the power was completely cut off in Ukraine as a result of a cyber-attack. The power grid on the whole western half of the country was out for six hours. This is no longer science fiction, it\u2019s not even \u201cOh, when\u2019s the next thing going to happen?\u201d Things are<\/em> happening.<\/p>\n

Alex Gibney:<\/strong> And one of the reasons the power came back so quickly during that episode is because Ukraine\u2019s power grid is so old school. They literally still have levers and on-off switches.<\/p>\n

Oh, so they were actually helped by the fact that their infrastructure is so antiquated?<\/strong><\/p>\n

Eric Chien:<\/strong> Yes. They basically just took their computers offline and went back to manual controls.<\/p>\n

\"zerodays-2\"<\/a><\/p>\n

Would you say there\u2019s any way to completely protect ourselves from something like Stuxnet?<\/strong><\/p>\n

Look, if anyone ever comes to you and tries to sell you 100 percent security, you should run in the opposite direction \u2014 there\u2019s really no such thing.<\/p>\n

Yeah, not even in our private computers or phones.<\/strong><\/p>\n

Exactly. Not in your home Mac or in the giant infrastructure of an entire nation, that kind of foolproof security just doesn\u2019t exist.<\/p>\n

Alex Gibney:<\/strong> Unless you\u2019re using paper and pencil.<\/p>\n

Eric Chien: <\/strong>Right. The reality is that it\u2019s a constant cat and mouse game that we\u2019re playing. Our best hope is that we are always staying one step ahead. But there\u2019s no question that more bad things will happen. And then people ask us, \u201cBut why haven\u2019t there been more huge disasters?\u201d It\u2019s not just about the technical capabilities because those are already there. What\u2019s keeping worse things from happening more often is more about geopolitics than technology. But if the U.S. gets involved in some major skirmish and another country is willing to engage in this kind of cyber warfare and suffer the repercussions, it could happen.<\/p>\n

And what almost scares me more is how some of these things seem to happen accidentally. Codes that can go out of control so even the people who invented them have no ability to stop the computer worms from spreading.<\/strong><\/p>\n

Stuxnet is the perfect example of that \u2014 it\u2019s still out there right now spreading to people\u2019s machines. And it will never stop, we\u2019ll always see it spreading even though it\u2019s unlikely that it will ever destroy another centrifuge plant. That was one of the many jaw-dropping moments for us when we realized that there are people who are willing to make the conscious decision to unleash such things knowing the enormous collateral damage that can result.<\/p>\n

Do you think the people who created these codes fully realized the damage that could be done beyond their target?<\/strong><\/p>\n

Alex Gibney: <\/strong>Yes, I do. They just didn\u2019t care.<\/p>\n

But some of the reasons for creating Stuxnet, for example, having the ability to stop a nuclear attack from Iran, seemed sound.\u00a0Would you agree with that and say that it just got out of control?<\/strong><\/p>\n

It was certainly a\u00a0very ingenious device, and particularly ingenious because at first the malware was sending messages back to the engineers that all was well. The problem with these things, and I would include drones, is\u00a01) What are the unintended consequences once you introduce this technology into the world, and 2) Once it spreads, you\u2019ve now created a precedent that becomes the new norm and sends the message that you can do whatever you can get away with.<\/p>\n

Yeah, it made me think about drones, too. And that psychological component that exists when you\u2019re more physically involved in creating destruction \u2014 like when human beings have to fly over areas to bomb them versus having everything seem like a big video game.<\/strong><\/p>\n

That was one of the things that bothered the people in the NSA who came forward \u2014 they felt that the military folks in command didn\u2019t properly appreciate the destructive capabilities of these cyber weapons. That they were used to thinking about nuclear weapons, conventional bombs and artillery, and so forth, but they didn\u2019t fully grasp that if you\u2019re shutting down someone\u2019s grid, you\u2019re also shutting down hospitals, life support systems, dialysis machines, all sorts of things like that. And if you\u2019re doing it in an area where, unlike Ukraine, they\u2019re much more computer-oriented, these things may not come right back up \u2014 you\u2019ve done something that you can\u2019t really control.<\/p>\n

\"zerodays-1\"<\/a><\/p>\n

Alex, you\u2019ve made a lot of films that, shall we say, didn\u2019t exactly thrill some very powerful organizations and institutions. Do you expect people in those groups to try to discredit this film in any way?<\/strong><\/p>\n

Perhaps. We\u2019ve heard about some people in national intelligence who weren\u2019t happy about some of the information in our film but they didn\u2019t try to prevent any of our screenings so far. You do need to be careful when you\u2019re dealing with classified information. You certainly don\u2019t want to put anyone at risk. We vetted everything that\u2019s in the film with those considerations. But part of the job of a filmmaker is to sometimes say that certain things are so important that there is a need-to-know for the American public.<\/p>\n

The scene in the film where we see official after official refusing to comment on Stuxnet is very effective. But when you were interviewing them, were you surprised that they were so unwilling to talk about it?<\/strong><\/p>\n

Yes. Frankly, I did expect a little more because Stuxnet had already happened and there had been a good deal of literature about it including Eric\u2019s research. So when you have an extremely important event that people already know about, you would think that our public officials could comment on it. But no, most wouldn\u2019t.<\/p>\n

Do you ever worry about any personal repercussions from pissing off these powerful organizations?<\/strong><\/p>\n

No, you just can\u2019t live that way, it would completely debilitate you. We certainly took precautions, and I was pretty certain I was being listened to. During the making of this film, we used encrypted phone calls and emails and we transcribed all of our conversations with our sources on electric typewriters, we didn\u2019t use computers, and then we destroyed the original recordings.<\/p>\n

What\u2019s your ultimate hope for the film other than having more people become aware of these events?<\/strong><\/p>\n

In terms of policy, I think the public really needs to know more about what\u2019s going on than we currently do. It\u2019s ridiculous how much information is over-classified. That has to stop because it\u2019s vital that we have discussions about some of the things that are being done in our name, we\u2019re just keeping too much secret. What happens is that the people who are keeping these secrets start to develop contempt for average citizens who they don\u2019t think have any right to know what\u2019s going on. And I think that kind of contempt is not a healthy thing.<\/p>\n

Being in the middle of a presidential campaign and knowing what you do about this technology, does the result of the upcoming election worry you?<\/strong><\/p>\n

Oh, I think having a President Trump with his finger on the button should scare anyone!<\/p>\n