The Undeclared War Season 1 Episode 1 Recap

As the first episode of The Undeclared War begins, Saara Parvin (Hannah Khalique-Brown) walks around circus stands looking for something. She climbs into a manhole and begins hitting the bricks in front of her with a hammer to find a hollow one. She removes the brick and finds a piece of paper behind it. It has the numbers 22, 67, and 45 written near the bottom. She is also shown working on a computer before jumping from the ladder. Someone else jumps into water around the same time. Saara goes to the number 10 cottage on the beach, breaks in, and begins looking around. She uses a keyboard to produce steps and reach the door above her. Then, she enters the numbers into the keypad. She steps through the door and enters another building. Once she goes into one of the rooms upstairs, another guy drops a glass jar and retrieves something from it.

The man, Gabriel Davies (Alfie Friedman), is congratulated for completing the course first. Later, she sits with Gabriel outside and says she likes his pens which he says are in spectrum order. Saara tells him well done on the challenge and they’ll obviously take him. He warns her that he isn’t very good at noticing when people want to talk or change the subject. She says it is okay before they formally introduce themselves. Saara goes home where she says hello to Amina (Aysha Kala). They wonder why she is here since London is over an hour away. Saara learns that Abu is in his den because he is off work again. She surprises Abu and tells him that she got it. They agree her mother wouldn’t understand since she doesn’t know anything about it.

He claims he is fine and will be back to work on Monday. Saara agrees to play a quick game with him before asking if he thinks it is okay what she is doing. He asks what could be wrong with learning to defend the country for a year and going back to the university after that. Next, she rides with James Cox (Edward Holcroft) to the Government Communications Headquarters or GCHQ. It is Friday, April 12, 2024. James promises she will be brilliant. Inside, the workers are busy performing stress tests on BT’s cyber security systems. Rich (Andrew Rothney) confirms they’re in and asks whether they can move to the next step. Chrissie lets someone else know that they’re inside. He reminds her that he told her this was a bad idea. She just wants them out now that they’ve broken in.

Saara waves at Gabriel as he walks by only for him not to wave back. Rich and the others learn that they’ve got the passwords and are about to log in. Zahir (Zaqi Ismail) learns that something is going on as the sirens sound. He asks Tahmid what is going on since he is seeing red lights. Finn is asked what he did, but he says nothing and they’re logging into the system now. Then, he tells them it looks like the Internet is down. Chrissie urges them to pull out now because she wants them completely disconnected from their estate. When Danny Patrick (Simon Pegg) contacts Rich to see what is going on, he is told he better get up here. Max (Tom McKay) introduces himself to Saara who learns they’re not shaking hands at the moment. She gets her ID.

Danny learns that the stress test took down half of their infrastructure. He is warned he needs to undo whatever he did before it starts impacting public safety. Rich insists it isn’t them since they never got past the admin platform. Saara apologizes for being overdressed. Max says they all do that on their first days. He admits they’re hideously male, stale, and pale. He clarifies himself by saying they’re all old and white. She hopes they didn’t pick her only because she has a brown face, but Max says no. They tag along with the others who’ve been summoned since she might find it interesting. Chrissie is introduced to Max who is the head of malware. Danny tells everyone that 55% of the Internet seems to be down although the national grid’s ICS is okay.

It is the same with gas and water, but rail signaling is down. While air traffic control is up, most flights have stopped because they use the Internet to control aircraft. Online banking and cash machines are down too. Caroline Fitch (Kirsty Hoiles) asks about smartphones. Chrissie says they can although a lot of the systems they access have been impacted. Email services are down so there is no Zoom or Teams. Surprisingly, social media has not been affected. They believe it is a cyberattack. Kathy Freeman (Maisie Richardson-Sellers), who is one of the analysts on attachment from the NSA, says the Russian bots are already retweeting mostly about how the ATMs are down. They blame the government and claim it is another scheme by the elite to steal money.

She says it is a bit quick like they knew it was coming. Later, Saara brings Phil (Joss Porter) coffee when she joins him in the malware department. He agrees to show her the malware on her computer. As she scours through the code, she imagines moving through a warehouse and finding a bunch of garbage in a corner. Phil says it is obfuscated and some type of FinFisher thing. Kathy enters to tell Max that the NSA would like to look at the code. Max asks if Danny has given them permission to let her look at it. He admits he wants her to walk all the way down the hall to get permission because that is how they do it around here. Before she leaves, she yells that they’re only trying to help since they’re on the same team. Phil shows Saara how the code uses jumps to leap over the garbage that isn’t actually read.

He believes it is there to confuse the look of the code and prevent the anti-virus software from recognizing it as malware. They get around it by finding a reverser that locates all the garbage before writing a program to delete it. Although he working on that and other things, he doesn’t want Saara to help him. Instead, he asks her to paste the code into the texting sandbox to see if she can get it to run in there. Saara admits she’d prefer to help with the reversing. Danny gets a call from Foreign Secretary Elizabeth who finds the timing interesting since they’re in the middle of an election campaign. She argues it’ll feed right into the populist agenda that people are unable to get online. Since Labour does most of its campaigning online, it looks convenient for her party.

Danny says they’re about 35% restored, but it isn’t straightforward because there are many anti-debugging tricks in the code. She thinks they’re going to blame Russia although Danny says they try to avoid making attributions prematurely. Anything in the code that links to anyone could be misdirection. If they point the finger, there will be pressure to retaliate and they’ll be in a tit-for-tat situation. His gut is telling him that it is probably Russia and the FSB. Elizabeth says their Embassy in Moscow says the lights have been flashing on and off in Putin’s office for the last half hour. She wants to make sure it isn’t them or someone acting on their behalf. Saara can’t understand why the code will run inside BT’s computers, but it won’t run on hers.

Phil says malware can be written so it’ll know when it is being run in a sandbox since it’ll search for normal computer activity. If it can’t find any, it’ll deactivate. She can paste in some Word documents and scroll around a bit to try to bypass it. Saara asks if she can use the phone next to them because she didn’t know they were going to take hers. Later, she walks by a television as Prime Minister Andrew Makinde (Adrian Lester) is being asked about his father who was a wealthy Nigerian businessman. He is told that the country is in the deepest recession this century. Saara tries to call Abu Ahmed (Nitin Ganatra) to check how he is feeling. He doesn’t answer so she promises to call back later while the PM argues that the recession has nothing to do with Brexit which has been a success.

Danny approaches Kathy to tell her about the Jolly Roger. He is the one who is making the light in Putin’s office turn on and off. He blames Russia for the attack and is retaliating because he is a patriotic hacker. They promise it has nothing to do with any of them and they didn’t encourage him. Danny doesn’t think he knows it is Russia so he accuses the hacker of grandstanding. This is all anyone is going to remember when they come out with an official attribution. Before he leaves, he agrees to let NSA look at the malware code. A news report says the PM was aggressively heckled during campaigning in Bristol.

Andrew tells the media that he’ll be chairing a COBRA meeting on Sunday at 10 AM. In the meantime, he has instructed the security forces to do whatever is necessary to find out who is responsible for the cyberattack. The local workers yell over him until a security official takes him away. The reporter says the PM has rarely been seen outside of the Westminster bubble since as a junior minister not even in the Cabinet he ousted Boris Johnson in a bloody palace coup 15 months ago. With the Conservatives running behind in the polls, he is facing real anger about the economic crisis and how deep the disillusionment with authority in general now runs. Saara imagines she is looking through A-to-Z books in a phone booth while scouring through the malware code.

She notices something when she finds that a page in the book has been cut. Saara tells Phil she still couldn’t get it to run in the sandbox so she looked at the code instead. Max and Phil look at her computer to see what she thinks she has found. Phil says it is okay because they’ve all tried to reverse a library. Max claims it is boilerplate code and there to avoid having to write some common functions from scratch. Saara believes there is something else hidden in there. She points out the line that mentions a bitsadmin.exe file because they likely thought they wouldn’t bother checking it. Danny is brought in and told that Saara found it. It is a tiny dropper that they missed the first time and it raises a flag when you run it. The flag is a like on a Facebook page for a woman named Sylvia T.

Danny believes it is a tripwire so they’ll know when someone has downloaded the payload. It is obfuscated like that last one. Danny video chats David Neal (Alex Jennings) to tell him there is a second virus hidden inside the first so they should upgrade to a level one attack. He also suggests calling JSTAT to get them to raise the threat level to critical because they don’t know what the new virus does yet. David says he’ll call number ten. Danny orders them to shut it down and find out what it is meant to do before telling Saara well done. On Sunday, Saara gets a call from Sis who tells her Abu has had an accident on the tracks. He is in the hospital. Her sister tells her that she needs to get here because he is asking for her. Saara tells Max that her dad isn’t well. He offers to let her go, but she says it is okay.

She is invited to join Danny in the COBRA room. During the meeting, they confirm they’ve located the malware within BT’s system and its code has been 70% reverse engineered. They believe they can have most of the Internet up and running by midnight tonight. They’ve never seen the virus in the wild before so they suspect it was specially written to take down sections of the BT and Virgin infrastructures. Danny finds it unusual that it doesn’t seem to be communicating with any sort of home base. Andrew asks if that is the most notable thing. He suspects it is the impact the virus is having on the economy which is already in a recession. It is going down with voters like a bucket of cold sick. Elizabeth suggests it could’ve been worse since the attack could’ve happened on Monday morning.

David says that would’ve happened if it wasn’t for Saara who spotted something else hidden in the malware code. Danny explains there was supposed to be a second attack that would’ve taken out the entire Internet and it would’ve impacted vital services. Everyone begins clapping when Saara stands up and takes credit for spotting the second virus. Richard Martson (Ed Stoppard) asks if they know who is responsible, but Danny says they’re still working on that. Richard says the Jolly Roger seems to know since he is flashing the lights in Putin’s office on and off. He’d like to know more about the young woman who spotted it. He asks whether the rest of GCHQ missed it.

Richard finds it odd that this is something they’re supposed to applaud. He asks how they’re supposed to know there is nothing else hiding in there since a student found it and nobody else did. Richard recommends going back and taking another look to see what else they missed. Andrew asks for some options for an offensive cyber attack on Russia too. Danny asks his team to bring everyone in tonight. When Saara finally makes it to the hospital, her family complains about her not being there. She can’t believe that Abu died not too long ago. She is taken to see his body. They’re not sure why he was on the tracks so there will be an investigation.

At home, Saara and the others learn that they’re withholding his body because there will be a postmortem. Saara suggests it might be suicide, but the others don’t want to hear it. They get into an argument when Ami tells her to just go if she is in such a hurry. Saara is accused of being selfish because she isn’t showing any emotion for her father. Saara storms out and returns to the office around 2200 hours. Danny tells everyone that they were beaten up at COBRA and that doesn’t mean it wasn’t justified. With the pressure to get everything back up and running, they didn’t look for extra functionality in the code. He knows it doesn’t reflect well on them that one of the work experience students found it. They’re going to go back through the code line by line.

Malware will be leading while some will be reassigned to help out for the time being. In private, Danny apologizes for putting Saara through that during the COBRA meeting but promises he didn’t see it coming. He thinks it is best for her to go home even though she doesn’t want to. Once she goes home, she listens to the Prime Minister talk about the event on television. James kneels down next to her, wakes her up, and says he never thought they’d let her out. He asks her how it went. She tells him about her father’s death, but she won’t say anything else. Andrew talks about the countries that will stand up for the rule of law and the fact that they will respond to the attack within the law in a time and manner of their choosing. David calls Danny to ask how they’re getting on with Andrew’s options.

Danny says they’re not because it is a very bad idea. Even though Danny says it is going to escalate things, David thinks they have to do it. Danny calls Finn to tell him to get up here. Andrew says they will defend themselves even though they’re a democracy. While James sleeps, Saara cries in bed next to him.

 

The Undeclared War Review

The first episode of The Undeclared War sets an interesting premise involving a potential cyber war although it was a mixed bag. The cast is good with the likes of Simon Pegg, Adrian Lester, Edward Holcroft, and Alex Jennings. While the soundtrack songs were enjoyable, it is hard to say whether they fit since the show needed to be intense instead of moody.

It is puzzling what was going on when Saara was working on the computer. Although it was a neat idea, it is hard to say how successful this is. It is understandable why the writers decided to add action scenes to make the computer scenes more interesting since that could get boring and difficult to understand.

Certain lines of the dialogue were unnecessary and a bit alienating. It’ll be interesting to see if the show can successfully juggle the professional scenes with the personal scenes or if the latter will become a distraction. It might just be too much because the whole cyberwar storyline is already a big swallow.

It has hard to say too much after the first episode because it didn’t give a lot away. The first episode was watchable so it scores a 6 out of 10. Recaps of The Undeclared War can be found on Reel Mockery here. Want to find out how to support our work? Learn how to do so here.