Cyber Film Club

The season

The programme

1. 1

   Out Thursday 1 October · Discussion Group Friday 9 October

   WarGames (1983) Discussed

   A teenager looking for new video games dials into a military supercomputer and starts a game it doesn’t know how to stop.

   Details and discussion questions

   Directed by John Badham · Matthew Broderick, Ally Sheedy, Dabney Coleman

   Seattle student David Lightman spends his evenings with a modem and an autodialler, hunting for systems to explore. When he stumbles into a machine offering a list of intriguing games, he picks "Global Thermonuclear War" and sets off something far bigger than a game.

   Why it’s on the list

   The film that put hacking into the mainstream. It’s full of attacks that still work four decades later: guessable passwords, a forgotten backdoor, and credentials left where anyone could find them. It reportedly prompted President Reagan to ask whether it could really happen, and US policy on computer security followed.

   This week’s theme

   This film opens Cyber Security Month by design: it’s the CISO’s own choice to start the season. David Lightman isn’t a spy, he’s a bored teenager looking for new games, and everything that gets him from the school’s grading system onto a live military network starts from ordinary curiosity — trying a door because it’s there, borrowing a password because it’s quicker, poking at a backdoor because it’s an interesting puzzle. That’s the question worth sitting with this week: at what point does looking around become an incident? For anyone across the Corporation, the Police, our councils, and our cultural and education partners, the honest answer is often sooner than it feels at the time — an unlocked shared drive, a colleague’s still-open session, a test system nobody remembers is live. WarGames isn’t an argument against curiosity, it’s curiosity that eventually helps stop the war too; WOPR’s own conclusion, “the only winning move is not to play”, is really an argument for asking first, rather than finding out afterwards that you already had.

   Things to think about while you watch

   1. How does David get into the school computer, and then the military one? Which of those weaknesses still exist in organisations today?
   2. The backdoor was left by the system’s own designer. Who in your organisation could leave a door open without anyone noticing?
   3. Why does removing humans from the decision loop look like a good idea in the film, and what goes wrong?
   4. David’s curiosity nearly starts a war, but it’s also what helps stop one. Where’s the line, in your own work, between exploring and overstepping — and who do you check with when you’re not sure?

   Where to watch

   Available to rent (around £3.49) or buy (around £8.99) from Amazon Video, the Apple TV Store and Sky Store, or to stream if you already subscribe to MGM+.

   It also turns up on YouTube — some listings are free to watch, but expect adverts breaking up the film.

2. 2

   Out Friday 9 October · Discussion Group Friday 16 October

   Sneakers (1992) Discussed

   A team paid to break into banks to prove they can is hired to steal a little black box that can break any code.

   Details and discussion questions

   Directed by Phil Alden Robinson · Robert Redford, Sidney Poitier, Dan Aykroyd, River Phoenix, Ben Kingsley

   Martin Bishop runs a crew of misfits who test companies’ security by breaking in, with permission. When government agents lean on him to recover a mysterious device, the job turns out to be much more dangerous than it looks.

   Why it’s on the list

   An early, affectionate picture of penetration testing: social engineering, physical intrusion, voice authentication and the question of what happens if encryption itself can be broken. "My voice is my passport. Verify me."

   Things to think about while you watch

   1. How many of the team’s tricks rely on technology, and how many on people? What does that say about where to spend security effort?
   2. The team only wins because they can prove who they’re working for. How do you verify a caller or visitor who says they’re “from IT” or “from the bank”?
   3. If one device could decrypt everything, who should control it? How does that debate play out today?

   Where to watch

   Widely available to rent or buy from the major digital stores. Check your usual streaming services too.

3. 3

   Out Friday 16 October · Discussion Group Friday 23 October

   Catch Me If You Can (2002) Discussed

   A teenage con artist poses as a pilot, a doctor and a lawyer, and cashes millions in forged cheques, with the FBI one step behind.

   Details and discussion questions

   Directed by Steven Spielberg · Leonardo DiCaprio, Tom Hanks, Christopher Walken, Amy Adams

   Inspired by the story Frank Abagnale Jr. told about his youth: a charming runaway discovers that a uniform, a confident manner and a convincing piece of paper open almost any door, while a dogged FBI agent tries to catch up with him.

   Why it’s on the list

   Hardly any computers, but it’s a masterclass in social engineering and fraud: impersonation, pretexting, forged documents and exploiting trust in authority. The same tricks power today’s CEO fraud, invoice fraud and phishing. Worth knowing: many of Abagnale’s claims have since been seriously questioned, which is its own lesson in taking a good story on trust.

   Things to think about while you watch

   1. Which props does Frank use to be believed (uniforms, letterheads, confidence)? What are their digital equivalents in a phishing email?
   2. Where could a single phone call or check have stopped him? Where are the equivalent checks in your own work?
   3. Abagnale’s story itself turned out to be partly a con. How do you judge whether a source is telling the truth?

   Where to watch

   Widely available to rent or buy from the major digital stores. Check your usual streaming services too.

4. 4

   Out Friday 23 October · Discussion Group Friday 30 October

   The Great Hack (2019) Discussed

   A documentary about Cambridge Analytica, the Facebook data scandal, and one professor’s fight to find out what was held about him.

   Details and discussion questions

   Directed by Karim Amer and Jehane Noujaim · David Carroll, Brittany Kaiser, Carole Cadwalladr

   Following a New York professor, a former Cambridge Analytica insider and the Observer journalist who helped break the story, the film asks how personal data harvested from social media was used to profile and target voters.

   Why it’s on the list

   The one film on the list with no hacking in the usual sense, and perhaps the most relevant. It’s about personal data, consent and profiling, and the professor uses UK data protection law (a subject access request) to try to get his data back. The ICO’s investigation led to the maximum fine then available against Facebook.

   Things to think about while you watch

   1. What personal data do you give away every day without thinking? Which of it would you mind being used to profile you?
   2. David Carroll used a subject access request under UK law. What rights do people have over the data your organisation holds about them?
   3. Where is the line between clever marketing and manipulation?

   Where to watch

   A Netflix documentary.