Movie & TV Corner: The Amateur

★★★★ for the movie. ★★ for the infosec.

I watched The Amateur on a Friday night and spent the entire next day arguing with myself about dead man's switches. This is what journalism school does to you.

The movie: great. Rami Malek plays CIA cryptographer Charlie Heller, whose wife is killed in a London terrorist attack. He then discovers his bosses have been secretly bombing hospitals in Syria and disguising the strikes as suicide bombings. Instead of filing an HR complaint, he does something elegant: he builds a program that will release all the classified files to three top investigative journalists if he doesn't enter a code every five hours. Then he walks into his boss's office and says, essentially, train me to be a field agent or the story goes out.

This is the correct threat model. This is beautiful. I cheered.

And then my brain started asking questions the movie didn't want me to ask.

The Five-Hour Problem

Heller is now chasing professional assassins across Europe while babysitting a countdown timer. Every five hours, no matter where he is or what's happening to him, he must check in. Which is fine if he's free. What if he's captured but alive? 

Also: the three journalists receive a massive, classified file dump from an anonymous source. No authentication. No identity verification. No chain of custody. Three reporters waking up to "HERE IS PROOF OF WAR CRIMES, TRUST ME" are not automatically safe, legally or physically. They are, in fact, now also targets.

These are not movie problems. The movie is paced beautifully and does not have time for my threat modeling homework. These are real world problems for anyone trying to replicate what Heller built.

The Bigger Issue

Heller's program works because he is one of the most skilled cryptographers employed by the United States government. He hid it so well that the CIA tore apart his home and workstation and found nothing. That scene is tense and satisfying and a quiet reminder that this protection is only available to people who can build it.

Most journalists are not Heller. Most whistleblowers are not Heller. Most people sitting on evidence that powerful institutions would prefer to stay buried are not, in fact, world-class cryptographers. They are people with a laptop and a source who trusted them and an increasingly urgent sense that something could go wrong.

Those people need The Vault.

One Final Message's The Vault does everything Heller's program was trying to do, without requiring a security clearance or a computer science PhD to build it. Your documents are AES-256 encrypted at every layer, the same standard used by enterprise organizations. One Final Message cannot read your content. When your materials reach your designated recipients, they verify their identity through a one-time code before viewing anything. The information reaches who you chose. 

If Heller had used The Vault, Moore's people searching the workstation would have found nothing, not because Heller hid it brilliantly, but because there was nothing there to find. 

It costs $5 a month. Heller's solution cost him approximately one very stressful European vacation.

Watch the Movie. Then Set Up The Vault.

The Amateur is the rare spy thriller that understands information as the actual weapon. Malek is quietly excellent. The ending is more satisfying than it has any right to be. Watch it.

And when Heller explains his program to Moore and you watch Moore's face do the math, ask yourself: what if the person holding those files wasn't a genius? What if it was just a reporter who found something they weren't supposed to find?

That person needs infrastructure, not genius. That's what The Vault is.

One Final Message: The Vault is at onefinalmessage.com. Your contingency plan shouldn't require a CIA badge to build.