‘Zero Days’ details U.S. vulnerability to cyberattacks

It’s a detective story. It’s a spy thriller. It’s a cautionary tale.

And it’s true.

It’s “Zero Days,” filmmaker Alex Gibney’s disturbing documentary about the future of global warfare, a future that’s already here and a war that’s already being fought. But quietly, shrouded in secrecy most of the time.

The first major battle, Gibney’s picture asserts, was the cyberattack on Iran’s nuclear facility at Natanz started during the George W. Bush administration in 2007 and continued by President Obama that destroyed centrifuges critical to Iran’s bomb-making effort and temporarily crippled the Iranian program.

In a series of talking-head interview segments with private industry computer experts, former government officials — several from the U.S. and Israel — and The New York Times national-security correspondent David Sanger, Gibney’s picture describes how the super-sophisticated computer worm dubbed Stuxnet was introduced into Natanz, how it spread around the world and how it was detected and dissected by experts in the private sector.

It was jointly developed by the U.S. and the Israelis to forestall an Israeli airstrike on Iran that would, the experts say, surely have drawn the U.S. into a shooting war with Iran.

Neither nation has ever officially acknowledged any of this, and Gibney repeatedly runs into walls of “no comments” from the principals he puts on camera.

Despite that, the gist of the story is generally known, thanks to leaks and to the efforts of journalists like Sanger.

What’s most disturbing about “Zero Day’s” revelations is that the Stuxnet virus was of only limited effectiveness, in that Iran quickly reconstituted and ramped up its weapons-development capacity. It also built up a sophisticated cyberwarfare infrastructure of its own that it was used to strike at the U.S. banking industry in 2013 with a series of distributed denial of service attacks.

Those attacks were intended to send a message, says security expert Richard Clarke: “We can do it too.” And so can the Russians and the Chinese and the North Koreans and even nongovernment hackers.

The U.S., Sanger says, is the “most vulnerable nation to cyberattacks” in the world, with it computer-operated infrastructure poorly defended against them. Millions of attacks are detected daily, and it’s difficult for experts to determine where they’re all coming from.

It’s war, and it’s here.