Q&A: Oscar-winner Gibney on cyberwarfare in 'Zero Days'

Oscar-winning documentary filmmaker Alex Gibney believes the first atomic bomb of the cyberwarfare age has already been dropped.

That bomb was Stuxnet, a computer virus that's the subject of Gibney's latest movie, "Zero Days." Stuxnet disrupted an Iranian uranium-enrichment facility beginning in 2010 and set back Iran's nuclear ambitions. Iran considers Stuxnet part of a concerted effort by Israel and the U.S. to undermine its nuclear program through covert operations, though neither government has acknowledged any involvement.

"Zero Days" is an examination of Stuxnet: how outside security researchers got wind of it, where it came from, and what it portends for global security in the future. In the movie, Gibney warns of the destruction that could come from the proliferation of state-sponsored hacking. The movie opens Friday in theaters, online and through video on demand .

Gibney, who won the Oscar for a documentary on Afghanistan and has tackled WikiLeaks, Enron and Scientology, sat down with the media to talk about the movie. Questions and answers have been edited for clarity and length.

___

Q: Throughout the movie, you draw parallels between cyberwarfare and nuclear war. How big of a threat is cyberwarfare today?

A: The potential threat from these kinds of cyberweapons is huge, especially when you start talking about shutting down electric power grids. I'm not talking about the threat to me personally, but the threat to all of us. We're just at a point where everyone is starting to recognize the potential calamity.

Q: You relied on confidential intelligence sources, including NSA employees, and combined them into a composite character that's played by an actress and digitized to look more computer generated. How hard was it to gain their trust?

A: They were cautious at first. But the more information we discovered, the more we were able to say, "Can you tell us if we're on the right track? Does this sound right? Does this sound wrong?" It was only when we devised this idea of the character that they felt comfortable coming forward. A composite character gave everybody a lot more protection.

Q: Cybersecurity largely remains a boy's club, with few women in the field. Why did you make the composite character a woman? Were any of the sources women?

A: I'm not going to talk about sources, but I did feel it was important. All of the other voices in the film were men. There are women at the NSA, but the choice of a woman had more to do with the balance of men and women in the film.

Q: The actual Stuxnet code makes an appearance, with pieces incorporated into graphics. What went into that?

A: The code graphics took a lot of time. When you work with a graphics company like that, they always do beautiful work but it has to be tethered and focused to the story. It can't just be pretty in its own right. Also, we were determined to get it factually right, to make sure that at the right moments we go over the right code.

Q: What about creating the composite character?

A: Everyone assumed that we wanted a more perfect look. Actually, we wanted something that looked more patterned, particularly as you move around to the side you can see her hair starts to trail off in spectral dots. That was a hard effect to achieve, and in some aspects, something not entirely controllable. And that was kind of what we liked about it.

Q: Was the NSA involved?

A: We had hundreds and hundreds of emails between us. They kept saying, "we'll work something out," but they never worked something out. It was all really frustrating. But sometimes in that context you end up doing other things. We ended up finding out some things in Israel that we didn't really know. We went to Moscow. Slowly, but surely, we got stuff.

(Officials for the NSA and Israeli military didn't return emails seeking comment on the movie's accuracy.)

Q: Is there anything you wish you could have gone deeper on?

A: I would have liked to have gotten more into the espionage stuff. I just really wasn't able to figure out how the original version of Stuxnet got into the Iranian nuclear facility. We think it was a spy, but we don't know exactly how it happened. A lot of that spy craft is interesting to me.

© 2016 The Associated Press. All rights reserved.