Nearly all detective stories begin with a corpse, and all of Alex Gibney’s documentaries are detective stories. In his Academy Award–winning Taxi to the Dark Side, it’s the corpse of Dilawar the cab driver, desecrated into pulp by US soldiers at the Bagram Theater Internment Facility in Afghanistan. As the curtain goes up on Enron: The Smartest Guys in the Room, the remains are those of the eponymous company, freshly expired in one of the largest corporate bankruptcies in US history. Client 9: The Rise and Fall of Eliot Spitzer and The Armstrong Lie each begins with a dazzling career in rigor mortis: Eliot Spitzer, the brainy, audacious New York governor and Wall Street corruption-buster, whose powerful enemies followed his scent to a prostitution ring, and super-athlete Lance Armstrong, the seven-time Tour de France winner who doped and managed to crush anyone who said so until he finally got busted and lost all his trophies.
And now the first minutes of Zero Days, Gibney’s latest, delivers a murdered Iranian nuclear scientist in what feels like a lost scene from Costa-Gavras’s 1969 political thriller Z. Reenactment footage generated by Iran State Television, backed by white-knuckle techno music, shows a motorcyclist deftly passing the scientist’s car and slapping a magnetic detonating device onto its roof, transforming a morning commute into a fireball.
This newest—and arguably best—Gibney doc investigates the Stuxnet virus, an ingenious piece of malware twenty times the size of a normal piece of code that in 2010 started showing up across the globe and provoked an epidemic of computer shutdowns, with Iran as the number-one infected country in the world. What made Stuxnet exceptional was not just its size but its precision: As Silicon Valley analyst Eric Chien explains, Stuxnet was a virus in which “every piece of code does something, and does something right.” This worm is what’s known as a zero-day exploit—which means nobody knows about it except the attacker, and no one needs to launch it; once downloaded, it just runs and propagates. All by itself, Stuxnet could act upon the motors, pumps, and valves that run power plants as well as transportation, healthcare, and communications systems, causing them to malfunction or shut down.
When a series of Iranian gas-pipeline explosions coincided with an assassination campaign against that country’s top nuclear scientists, and a spate of centrifuges at Iran’s Natanz nuclear enrichment facility went berserk and tore their own guts out, the range of possible perps grew narrow. These attacks offered no payday for cybercriminals, nor a coherent ideological message for hacktivists; only a nation-state stood to make any gain, or could possess the resources to pull them off. And the states with the most to gain were Israel and the United States. As the film later discloses, Stuxnet was just the beginning: the United States held in reserve an even more destructive worm called Nitro Zeus, ready to take down Iran’s power grid, air defense system, and communications infrastructure had the July 2015 nuclear deal not worked out.
Gibney is no apologist for the government of Iran, a regime of world-class criminality with its own richly documented track record of assassinations of critics abroad. But he does invite audiences to imagine what would happen if the shoe were on the other foot: If we can shut down the power on others, might others be able to do the same thing to us? What about the consequences for democracy of an unabated and unaccountable cyberwarfare program? And what about the threat of an escalating and unending cyberwar? Such implications are far-reaching, but the director starts his investigation with a much more modest question: Why can’t we talk about Stuxnet, which everybody has known about for half a dozen years?