The Undeclared War is a sluggish cyber thriller

British TV loves its institutions even while bashing them. Tinker Tailor Soldier Spy, House Of Cards, and The Crown take their respective whacks at MI6, Parliament, and the royals just as much as they polish their mythic statuses in English culture. Now comes a cyber thriller that dissects a lesser-known outfit: Government Communications Headquarters, or GCHQ, the U.K. intelligence agency that provides the government and armed forces with signal intelligence and protection. Timely if sluggish and ultimately unfocused, The Undeclared War amounts to a dramatized stress-test of GCHQ in the face of triple-tier malware, CC TV hacking, and deep-fake media.

Similar to the forward-looking Years And Years, the e-sabotage drama is set in 2024 after Boris Johnson has been ousted from 10 Downing Street by fellow Tory Andrew Makinde (Adrian Lester). Just as life has imitated that bit of art, we recognize this near future: Russian bots flood social media to undermine trust in government; Putin-supported outlets pump out propaganda disguised as news; and cyber-attacks test the weakness of our digital infrastructure.

Coinciding with the first day of “work experience” for university coder prodigy Saara Parvan (Hannah Khalique-Brown), a foreign virus shuts down a portion of the U.K.’s internet, massively embarrassing GCHQ head of operations Danny Patrick (Simon Pegg, doing lots of slouching and deep sighing) and his boss, David Neal (Alex Jennings, dapper and worried). Tasked with combing through thousands of lines of malware code to determine how the virus was transmitted, clever Saara finds a second virus nested in the first and eventually digs up an encrypted invitation to the Cyber World conference, where she is confronted by a classmate from her past. He’s there to warn her that yet a third virus is lying dormant, ready to wreak havoc.

Parallel to Saara’s journey through the bureaucracy and politics of British internet security is the story of Vadim (German Segal), a Russian computer whiz who really just wants to paint. Son of a Saint Petersburg oligarch, Vadim drifts passively into tweetaganda at a Russian troll farm, then gets promoted to cyber operations at FSB (formerly KGB), a job he literally cannot refuse. Vadim’s tentative love interest, burned-out journalist and single mother Marina (Tinatin Dalakishvili), also finds herself coopted by Putin’s machine—through the London-based Russian Global News, a Kremlin tool that spreads disinformation through audacious deep-fake videos. The station creates Facebook accounts for fictitious pro- and anti-Labor grassroots organizations, plans demonstrations for both groups at the same location and time, then films the violent scuffle. Marina’s boss prefers to call this news “managed” rather than fake.

As unrest turns to rioting over an apparently rigged general election—voters of color wiped from polls (more Putin mischief)—Saara races to uncover the third virus. Her activities at GCHQ are all-consuming, so much so that she misses her father’s funeral and becomes estranged from her politically active boyfriend (Ed Holcroft). Work is joyless and often hostile: Saara gets cold looks and terse replies from random white dudes staring at screens and squeezing tension balls. She develops a fraught, sexualized friendship with Kathy (Maisie Richardson-Sellers), an American NSA attaché at GCHQ. Saara also forms a gentle alliance with another outsider at the agency, the 50-year code-busting veteran John Yeabsley (Mark Rylance, providing glimmers of wit). And when Saara needs help decrypting code, she turns to Gabriel (Alfie Friedman), a classmate on the autism spectrum also working at GCHQ.

Parsing JavaScript for a telling deviation could be deadly dry stuff, but writer-director Peter Kosminsky (Wolf Hall) comes up with a neat visual device: Codeworld. As Saara or Vadim smash away on their keyboards, the camera cuts to exterior locations that serve as topographical metaphors: Saara stalks an abandoned gymnasium, toolbelt around her waist, looking for a hidden door in the ceiling; or she taps a wall of bricks to find a hollow space. There’s a whiff of The Queen’s Gambit in this externalizing of coding as entering strange houses or unlocking manhole covers. At one point, Saara is flummoxed by a pile of random garbage blocking an aisle in an infinite stockroom; but, as Gabriel shows, the trash is key to unlocking the code. But these cutaway vignettes—dreamlike, surreal, and far more stimulating than the dreary workplace locales—could have been integrated more fully. As it is, they feel like meager cookies.

A plea for more eye candy (or god forbid, comic relief) might seem like decadent cavils in the face of Kosminksy’s urgent warning that infowars are real and will shape our politics. In truth, he doesn’t need to make a case for Americans that Russian cyber endangers democracy. We just lived through a Presidency that was basically facilitated by Putin’s troll farms and Facebook fake accounts; and the Colonial Pipeline ransomware attack was only a year ago. Even so, armed with a handful of top-shelf British actors and Gillian Devenney’s coolly claustrophobic production design, Kosminsky puts on compelling show—at least for the first three episodes. After the setup, the storylines get bit draggy and padded as we wait for Saara and her friends to find a way to stop the nefarious FSB virus.

Worse, The Undeclared War fails to create a protagonist quirky or layered enough to carry a season, and Khalique-Brown has two speeds: earnest or unhappy. A subplot involving her Muslim family reeling from grief remains subdued and generic. The impulsive affair with Kathy unfolds superficially, as does her struggle with the boyfriend. And her potentially rich surrogate father-daughter bond comes to a dead end, with Yeabsley’s advice limply climaxing with “think outside the box.” A cyber adventure that succeeds both as human and tech drama seems to be that code remains uncracked.