COBRA: Cyberwar S2E4 Walkthrough
How Sky described the episode: The team try to understand the latest discovery, while Francine’s criticism of Lord Singer is met with delight from the Labour leader.
A brief recap on the wider context – in season one a geomagnetic storm knocked out power networks causing widespread chaos and (amongst other things) leading to a decision being taken to shoot a reporter. There’s mounting strength of feeling against the Prime Minister.
So far in season two, we’ve seen, well, A LOT – earthquakes off the Kent coast, an explosion of a sunken ship carrying munitions, coastal flooding, a helicopter crash carrying a notable Ukrainian, a cyberattack, radioactive blueberries as well as somebody poisoned with radiation and a dirty bomb.
If I’d have suggested that as an exercise scenario I’d have been laughed out of the room. (I have been for suggesting much less!). Developing an exercise is truly a dark art, and as emergency manager Luke Bird noted in 2014, you’re only ever a single inject away from accusations of straying into “the realms of fantasy.”
This episode starts with the Prime Minister gathering his most trusted (in the loosest sense) Ministers for a catch-up. It looks like the cyber attack and import of the radiation was a state-sponsored action, but there’s no suspect at the moment. Just based on the use of Polonium 210 would provide a fairly strong lead, given its use in the Litvinenko case.
A hacker (you can tell because they always sit in the dark and wear a hoodie) is editing a video about a politician “siding with the establishment rather than the will of people” feels close to the bone after the shenanigans in the House of Commons this week.
COBR is meeting now and discussing the rise of far-right extremism. I wasn’t really listening at this stage, because I was so distracted by what the screens in the background are showing.
Look at those graphics on the screens in COBR! The one graph I despise more than a pie chart is a rose chart #NextSlidePlease #COBRAcyberwar pic.twitter.com/mMALbj70XZ
— mtthwhgn (@mtthwhgn) November 5, 2021
They’re too far away to see the detail but I had a stab at what they could be showing…
- A This looks like it could be either some sort of topographic/digital elevation model or could be a chart of social media analysis?
- B Duplicate of A (why bother?)
- C CCTV footage from somewhere?
- D This looks like it might be weather-related – a map on the right-hand side and then maybe a wind rose on the left? In which case, perhaps something similar to a CHEMET report for the potential dirty bomb?
- E It’s not clear in the screengrab, but later in the same scene, this looks to be the online video from the cyber hackers Firestorm.
- F Also looks to be footage from Firestorm. I’m not sure why either of these would need to be on repeat in COBR.
- G I have no idea?! Is this an Audacity screen? Or just lots of mini DOS windows? Either way, I can’t figure out what it could helpfully be showing.
- H Duplicate of D (again, why duplicate information that is already displayed?)
Some of that information is useful, but this is how I’d use the COBR screens:
- 1 TV News channel (domestic channel) – to see what the public is seeing. Personally, I’d go with Sky News.
- 2 TV News channel (foreign channel) – to see a snapshot of how it is being reported overseas.
- 3 With the impact to cyber networks – some sort of analysis of their robustness – perhaps a summary of main SCADA system uptime
- 4 The CHEMET modelling is a fairly good idea, that can stay.
- 5 Maybe use this one for information on response capacity – what strategic resources are available/could be deployed?
- 6 I’d keep this one free for video conferencing (as it doesn’t look like they have a screen for that) especially for dialling in the devolved administrations, or perhaps relevant Strategic Commanders from affected areas or wider experts (SAGE?).
- 7 I’d use this to display the CRIP, the document produced as a single source of briefing information.
Lord Singer, the judge who has gotten himself into some hot water, is offered police protection given stated threats against him from fascists. He’s not keen and would prefer to jet off to Cyprus. There are also veiled threats to the Home Secretary, Prime Minister and his wife.
Oh dear, the irradiated body is a US citizen, and a scientist involved in classified research. That’s probably not great for diplomatic relations and probably means that we’re going to hear more from the truly awful Foreign Secretary (played brilliantly by David Haig).
A radicalised young man is seen readying some weapons. The last few episodes of COBRA season two were initially pulled from broadcast in the wake of the “no duff” murder of David Amess. It doesn’t take a genius to figure out where this part of the episode is heading. Yep.
The murder is also generating conspiracy theories and counter conspiracies; which feels pretty accurate. The Prime Minister has given the security services a clear direction to ‘deal with’ a problematic journalist. So we can also guess how that’s going to play out too.
The journalist in question is seen in a cafe speaking with an opposition politician. There is a lingering shot on a coffee cup with a mysterious logo on it. Has he also been poisoned? There are no immediate signs, but maybe something slower acting? More Polonium?
Fraser, the Head of the Civil Contingencies Secretariat, is at a warehouse where the forensic investigation of the exploded ship is taking place. The voyage data recorder (VDR) is a bit like a black box from a plane and has been recovered. The data shows something unusual, a low frequency but high decibel noise 3.7 seconds before the explosion.
Back to Manchester where our journalist has received some encrypted files from an anonymous source, which seem to implicate the American Government in something, which looks like it could be related to the ship explosion as it briefly mentions sub-aquatic research. The computer the journalist is using has been hacked, as has the rest of his office. Spooks are waiting outside however before they can get to him he is bundled into a black Range Rover by unknown men.
Separately, armed officers are assembling to raid the home of the suspected cyber hacker.
We’ve got discordant strings. Tension is mounting!
And…they’ve raided the home of an old frail lady. Great! Luckily upstairs the hacker is found. So that’s one of the problems resolved.
Some shocking radio protocol from the Counter Terrorism Specialist Firearms Officers though.
“Over and out” 🤨 #COBRAcyberwar
— mtthwhgn (@mtthwhgn) November 5, 2021
We see the journalist beaten and shot, and then in the culmination of the episode Francine, the opposition politician causing waves, sees that the offices of the journalist have been firebombed. She’s allowed to get quite close to the building and there’s no evidence of safety cordons being in place.
That’s it for this week. Two more episodes to go!!