The Estonian government's decision to move a Soviet-era war memorial from a square in central Tallinn, and to rebury the soldiers' remains beside it, brought protests and two nights of rioting from 26 April 2007, in which one man died. Excavation around the monument began that day. The first attacks on Estonian websites followed on 27 April — unsophisticated and apparently spontaneous, by the later assessment of NATO's Strategic Communications Centre of Excellence, and aimed at whatever was most prominent: the president, the parliament, the police, political parties and the larger news outlets. By 28 April the Finnish firm F-Secure found six sites wholly unreachable, among them the prime minister's, the government's, the parliament's and three ministries'. The tools were ordinary: ping floods, and mail bombing organised in internet forums.
Arbor Networks, whose data began on 3 May, counted 128 separate denial-of-service attacks over about two weeks — 115 ICMP floods, four TCP SYN floods and nine other traffic floods — running from bursts of about half an hour to one of more than ten hours, the largest at streams of about 90 megabits per second. Its daily tally went 21 on 3 May and 31 on 8 May, then 58 on 9 May, Victory Day in Russia: a better-organised second wave, by that reckoning, began on 8 May and peaked on the 9th. Estimates of the machines involved ran from one to two million — estimates, not counts. The banks came next. Hansapank, the largest, shut its internet bank for more than an hour on 10 May and blocked some 300 suspect addresses; SEB Eesti Ühispank's online service went down after similar attacks on 15 May. The last big wave came on 18 May and by 19 May the attacks had subsided. What struck President Toomas Hendrik Ilves was that the capacity had been bought: "There are organized crime rings and they do this by length of time," he said later, "but you have to have someone willing to pay for it."
Estonia's answer was to make its internet smaller. A CERT Estonia statement issued at 14:00 on 29 April said the traffic was plainly malicious rather than a surge of interest, and that foreign forums carried calls and tips inviting volunteers to help out; access by users abroad to government pages had been restricted so that domestic traffic could keep moving. "Our aim today is to restore webpages one by one to open them to users outside Estonia," said Hillar Aarelaid, who ran the team. Experts from NATO member states and from the United States were sent in to help. Steve Crocker told ICANN's security committee on 25 June that coordination inside Estonia had been excellent, that almost all the traffic came from abroad, and that external traffic to government had been stopped.
Responsibility was asserted early and never proved. Estonia's foreign minister, Urmas Paet, said at the start of May that it had been established that the attacks on government pages came from the IP addresses of concrete computers and concrete individuals in Russian government bodies, including the administration of the Russian president. "When there are attacks coming from official IP addresses of Russian authorities," he said, "then it is already very dangerous." An address, though, identifies a machine, and machines are hijacked. Russia denied involvement. Dmitry Peskov, deputy press secretary to the Russian president, observed on 17 May that the Russian president's own website was attacked hundreds of times a day from addresses in many countries: "This by no means suggests that governments of other countries are behind such attacks," he said, pointing to the possibility of faked addresses, and he told the BBC's Russian Service there was "no way" the Russian state could be involved in cyber terrorism. The defence minister, Jaak Aaviksoo, later said he could not state for certain the Kremlin had managed them. A criminal investigation opened on 2 May. One person was ever convicted: on 24 January 2008 a court fined Dmitri Galushkevich, a student in Tallinn, 17,500 kroons — about US$1,640 — for attacking the Reform Party's website.
The Flaw Already in Use
Microsoft's monthly release of 8 May 2007 included MS07-029, rated Critical, for a stack-based buffer overflow in the remote management interface of the Windows DNS service. The sequence of dates matters. The CERT Coordination Center at Carnegie Mellon had published its note on the flaw, VU#555920, on 13 April, citing a Microsoft advisory as the source of the report; by the time the patch arrived the note read that exploit code was publicly available and the flaw was being actively exploited. Microsoft's bulletin said as much in its own voice: asked whether it had received reports of exploitation when the bulletin was released, the answer printed was yes. An unauthenticated attacker could send a crafted RPC packet to a name server and run code as Local SYSTEM — complete control of a machine that, in most organisations, told every other machine where to find things. The interim advice had been to block RPC on the high ports, or to switch off remote management over RPC altogether. Microsoft credited Mark Hofman of the SANS Internet Storm Center and Bill O'Malley of the information security office at Carnegie Mellon University.
Billed by Text
Alexander Gostev of Kaspersky Lab wrote on 17 May 2007 about three samples found that week of something new on Symbian phones: a program that sent premium-rate text messages the owner had not asked for. The files sat in the download section of a popular Russian mobile site, described as a photo editor or a pack of video codecs. Installed, they texted a short code run by the content provider Infon. Each message cost 177 roubles, close to seven dollars, most of it split between the mobile operator and whoever had rented the number. One variant was downloaded by around 200 people in under a day before the site's administrators took it down — perhaps 14,000 roubles, Gostev estimated, for an afternoon. Kaspersky called it the first trojan of its type for smartphones; the earlier premium-rate trojans RedBrowser and Wesber had run on Java handsets, needed the user to approve each message and could only send inside Russia. F-Secure reported the three samples on 18 May. The Register, on 21 May, credited F-Secure, declined to call it a first, and noted that infection remained rare.
A Nodal Agency Without Powers
India had a national computer emergency response team in May 2007, and had had one for three years. CERT-In was set up on 19 January 2004 under what was then the Ministry of Communications and Information Technology, as the nodal agency for cyber security incidents, the national incident response centre and the issuer of advisories. What it did not have was any means of making anyone tell it anything. An organisation whose servers were being flooded, or whose homepage had been rewritten overnight, could telephone CERT-In or not. The contrast with the month's main story was exact: Estonia's defence held because a small circle of engineers, ministries and internet providers already had each other's numbers and could agree within an afternoon to shut the country's government sites to the outside world.
The law that would change the Indian position was in a committee room. The Information Technology (Amendment) Bill, 2006 had been introduced in the Lok Sabha on 15 December 2006 and referred to the Standing Committee on Information Technology four days later; the committee reported on 7 September 2007, and both Houses passed the Bill on 22 and 23 December 2008. It carried compensation of up to Rs 5 crore against a company negligent in protecting sensitive personal data, protection for intermediaries hosting other people's material provided they removed unlawful content on "actual knowledge" — a term, PRS Legislative Research noted, the Bill did not define — and an examiner of electronic evidence. The duty to report an incident within six hours, which our India desk sets out, came in April 2022, fifteen years after the month that showed what such a duty is for.
Cameras on the street, cameras in the table
Google announced Street View on 29 May 2007, at the Where 2.0 conference in San Jose — a Google Maps layer covering five areas at the start: New York, Las Vegas, Miami, Denver and the San Francisco Bay Area. Immersive Media, later named as the contractor for four of them, used a patented dodecahedral camera array on a moving car. Objections to what the cars had happened to photograph came almost at once, and the eventual answer was to turn machine vision on Google's own pictures: by May 2008 face-blurring was in testing, and automatic blurring of faces and number plates has run over the collection since. Thirteen days earlier Marissa Mayer had presented universal search, pulling books, local listings, images, news and video onto a single ranked page — "breaking down the silos of information", she said — the first step away from a page of ten links. Steve Ballmer unveiled Microsoft Surface the same day as Street View, a 30-inch tabletop reading fingers and tagged objects through five near-infrared cameras; it was discontinued in 2011.
Microsoft starts selling anti-virus to business
Microsoft launched Forefront Client Security in Los Angeles on 2 May 2007, in a keynote by the senior vice-president Bob Muglia, alongside System Center Essentials 2007: anti-virus and anti-spyware protection for desktops, laptops and server operating systems, reporting to one console and wired into System Center and Active Directory. It was licensed per user or device — $12.72 a year for the agent, plus $2,468 a year for the management console — and sold that day as part of the Enterprise Client Access License suite, standalone in July. Symantec, saying the product rested on the same technology as Microsoft's consumer OneCare, called it "riddled with shortcomings"; Microsoft cited a West Coast Labs certification. Renamed twice since, the line became System Center Endpoint Protection. The other platform company moved too: weeks after its researchers had counted the drive-by downloads, Google confirmed on 29 May its first security purchase, GreenBorder, which ran browsers inside an isolated virtual environment — a hire of engineers, it said, not a product. Chrome arrived in September 2008 with a sandbox of its own.
⏳ Time capsule — May 2007
- On 4 May the Intergovernmental Panel on Climate Change agreed the summary for policymakers of its working group on mitigation, at the panel's twenty-sixth session; the working group's own session had opened in Bangkok on 30 April with nearly 300 participants, among them lead authors and government delegations. Holding greenhouse gases to 445–535 parts per million of carbon-dioxide equivalent would take less than 0.12 percentage points off average annual growth in global output, it found, and renewables could supply 30 to 35 per cent of electricity by 2030, against 18 per cent in 2005.
- On 7 May NASA reported SN 2006gy, a supernova so much brighter than any previously recorded that astronomers suggested it might represent a new type of stellar explosion.
- On 8 May the Israeli archaeologist Ehud Netzer announced that he had identified the tomb of Herod the Great at Herodium, after decades of excavation on the hill.
- On 12 May the Eurovision Song Contest final was held in Helsinki, and Serbia won with "Molitva" on its first entry as an independent country.
What Tallinn Became
The institutions came quickly. NATO's secretary general, Jaap de Hoop Scheffer, said on 25 May 2007 that the attacks carried "a security dimension without any doubt", and NATO expertise was sent to Tallinn; the alliance approved its first policy on cyber defence in January 2008. Estonia's defence ministry published a national cyber security strategy for 2008–2013, and in January 2011 the government created a Cyber Defence Unit inside the Kaitseliit, its volunteer reserve. The Cooperative Cyber Defence Centre of Excellence was established in Tallinn on 14 May 2008 by Estonia with Germany, Italy, Latvia, Lithuania, Slovakia and Spain, and it was granted full accreditation as a NATO military organisation on 28 October 2008. The Tallinn Manual, on how existing international law applies to cyber conflict, followed in 2013; Tallinn Manual 2.0, by nineteen international lawyers, in 2017.
The legal questions moved more slowly than the buildings. Estonia's prosecutors asked Russia for investigative assistance under a mutual legal assistance treaty on 10 May 2007; Russia's Supreme Procurature refused on 28 June, saying the steps sought were not covered by it. The inquiry into everything beyond one party website found nobody, and the only penalty anyone paid was that one fine. The method outlasted the argument: capacity rented by the hour, volunteers supplied with ready-made tools, a crowd large enough to leave the question of direction unanswerable — the shape of the attacks on Georgian websites in August 2008 and of much since. Nineteen years on, Estonia's question — what allies owe a country whose banks and ministries cannot be reached — has an answer on paper and none in a courtroom. What a May can do to a wired country was learned again in three days in May 2017.