Zero Days: Director says US government secrecy trend 'appalling'

The US government developed a cyberwar capacity to cripple Iran's military defences, power plants and other vital infrastructure in case diplomatic attempts to curtail its nuclear programme failed, a documentary shown in Berlin has alleged. The film, Zero Days by veteran documentary maker Alex Gibney, being shown in competition for the Berlin International Film Festival's top Golden Bear prize, claims the US's National Security Agency (NSA) developed a cyberwar programme dubbed "Nitro Zeus" which it hoped would bring Iran to its knees in the event of hostilities.

The documentary focuses on Stuxnet, a computer worm developed by the United States and Israel – but never acknowledged by either government – in order to attack Iran's nuclear programme and sabotage centrifuges that were enriching uranium.

Through accounts of whistleblowers, analysts, journalists and secret service officials, the documentary shows how Stuxnet was the first-known attack in which computer malware left the realm of cyberspace and caused destruction in the real world. The film hints, based on accounts of several NSA insiders, that Stuxnet was just the tip of the iceberg.

"I mean you've been focusing on Stuxnet but that was just part of a much larger operation... Nitro Zeus, NZ," an actress says in the film, speaking for several NSA employees who were interviewed but whose identity was kept secret for source protection. According to these accounts, the NSA spent "hundreds of millions, maybe billions" on Nitro Zeus to be prepared for the eventuality that Israel decided to attack Iran and the United States would be drawn into the conflict.

The film suggests that Israel moved independently from its US partners and changed the code of the initial Stuxnet virus in such a way that it spread all over the world with unforeseeable consequence, including allowing other governments to copy it. Before its discovery in 2010, Stuxnet took advantage of previously unknown security holes in software from Microsoft and Siemens AG to penetrate Iran's facilities without triggering security programmes.

Gibney contends that Stuxnet opened at long last the Pandora's Box of digital warfare, and that it had been used as an instrument of warfare against a country with which the United States was not at war. He also says the United States could well be more vulnerable than other countries, taking into account that its economy and companies are the most Internet-dependent in the world.

"I am angry about the incredible amount of secrecy in the United States and how it has become a kind of obsession that is damaging our democracy," Gibney said at a post-screening news conference. "I think, frankly, that the trend and the momentum towards greater and greater secrecy in the US administration is appalling. And as we can see from this film and this subject, it's preventing a very important discussion about offensive cyber weapons which I think threaten us in a profound and existential way."

The film Zero Days derives its title from the term used for previously unknown flaws in computer software that hackers and spy agencies can exploit to attack networks in order to damage infrastructure such as hospitals, transportation systems or power plants.