The Financial Times published it on Monday 3 September 2007, under the names of Demetri Sevastopulo and Richard McGregor: the Chinese military, the paper reported, had hacked into a Pentagon computer network in June. The intrusion itself was ten weeks old and had been public in outline all along. On Wednesday 20 June elements of the unclassified email system serving the Office of the Secretary of Defense were shut down, and an estimated 1,500 computers were taken offline. "The reality is that the Defense Department is constantly under attack," Robert Gates told reporters the following day, adding that redundant systems were in place and that no adverse effect on operations was expected. What was new in September was the name attached to the June shutdown.
What the name rested on was not said on the record. Current and former officials told the paper that an internal investigation had traced the incursion to the People's Liberation Army; one senior American official said the Pentagon had pinpointed its exact origins; another described confidence "trending towards total certainty". The Pentagon acknowledged shutting down part of a system serving Gates's office and declined to say who it believed was responsible. Beijing's defence ministry declined to comment on the day of publication. The foreign ministry answered repeatedly through the month: its spokeswoman, Jiang Yu, called claims that the Chinese military was behind cyber attacks "groundless and irresponsible". Writing on 4 September, Bruce Schneier allowed himself a line — "Not enough details to know what's really going on, though."
Berlin was first. Der Spiegel put its account online on 25 August, the day before the Chancellor flew to Beijing: spy programs had been found in the Chancellery and the foreign, economics and research ministries, arriving as doctored Word and PowerPoint files. They had been noticed in May. A sweep by the Federal Office for the Protection of the Constitution stopped a further 160 gigabytes leaving for China; a confidential assessment it cited judged the material "can only have been interesting for state institutions". The Chinese embassy in Berlin called that "irresponsible speculation without a shred of evidence". Merkel, in Beijing, refused to discuss the claims and pressed China on intellectual property. "I have become really worried about Chinese espionage in the technology area," said Hartmut Schauerte of the economics ministry.
London and Paris followed. On 5 September the Guardian's Richard Norton-Taylor reported that Chinese hackers had targeted Whitehall; the Foreign Office was among those hit, Whitehall officials said; the Ministry of Defence would not say whether its own had been. Part of the Commons system had been shut the previous year by what officials treated as an organised group. Alex Neill of the Royal United Services Institute called the reported Pentagon attack the "most flagrant and brazen to date". On 8 September Francis Delon, secretary-general of France's national defence secretariat, confirmed a Le Monde report. "We have proof that there is involvement with China," he said. "But I am prudent." Then the sentence the next two decades went on: "When I say China, this does not mean the Chinese government."
Hides Who, Not What
On 31 August 2007 The Register's Dan Goodin reported that a Swedish security consultant, Dan Egerstad, had published login credentials for email accounts at about 100 foreign embassies — among them Russia, India, Japan and Iran, most in Asia, the Middle East and eastern Europe. He had posted them a day earlier without saying how. The following Friday he explained: five Tor exit nodes he ran in Sweden, the United States and Asia as a research project. Traffic between Tor relays is encrypted; traffic leaving the last one is not unless the user encrypts it. In Wired on 10 September, Kim Zetter reported that about 95 per cent of what crossed his nodes was in the clear, and that by filtering mail from government domains on words such as "embassy" and "military" he had collected 200 to 250 such accounts. One Indian embassy's password was "1234". He said he never logged in. "I'm probably not the first one grabbing these passwords," he told The Register, "but I'm absolutely the first one publishing them." In November Swedish police searched his flat, took computers, CDs and papers, and released him without charge.
Six Thousand Forwarded Mails
MediaDefender was retained by film and music companies to disrupt file sharing; ARTISTdirect had bought it in August 2005 for $42.5 million in cash. On 14 September 2007 a group calling itself MediaDefender-Defenders posted 6,621 of the firm's internal emails on BitTorrent networks; on 16 September it released a 25-minute excerpt of a telephone call with the New York attorney general's office, and on 20 September the source code of one of its anti-infringement tools. The mail bore on MiiVi.com, a video sharing site the company had launched in February 2007 and taken down on 4 July after TorrentFreak connected the two. Randy Saaf, the chief executive, had described MiiVi as an internal project and later called the details trade secrets; the messages contradicted the internal-test account, showed the site had been closed once the connection became public, and showed a plan to relaunch it as viide.com, which never opened. One message proposed using the MiiVi client to turn users' machines into drones for spoofing on another network. Reporters read the set as evidence of a honeypot; the company disputed that reading. An SEC filing put ARTISTdirect's cost at not less than $825,000, and in August 2009 MediaDefender and MediaSentry were restructured into Peer Media Technologies.
Retained in Its Original Form
On 7 September 2007 the Standing Committee on Information Technology presented its Fiftieth Report, on the Information Technology (Amendment) Bill, 2006, to the Lok Sabha and laid it in the Rajya Sabha. The Bill had been introduced on 15 December 2006 and referred four days later. The committee, chaired by Nikhil Kumar, had taken evidence from industry, legal experts, the CBI and the Legislative Department. It was, it wrote, "really surprised to observe that the term 'cyber terrorism' has not been defined anywhere in the IT Act, 2000 or in the proposed amendments". It found "no justification" in the department's case for deleting the word "hacking" from section 66, and held that hacking "should be retained in its original form". On spam, the department's reply "does not convince the Committee". It wanted CERT-In's status spelled out, and refused to see section 80's power of search deleted, because it covered cyber cafes.
Most of the list arrived. The Act Parliament passed in December 2008 carries cyber terrorism at section 66F, material depicting children at section 67B, CERT-In as the national agency for incident response at section 70B, and section 80 still standing. Two things went the other way. The word it fought hardest for never came back: section 66 is headed "Computer related offences" to this day. Spam is still not addressed. It also acquired a section nobody had asked for, 66A, struck down entirely by the Supreme Court in Shreya Singhal v. Union of India on 24 March 2015. Section 70B is the hook CERT-In's six-hour rule hangs on; the data protection it wanted arrived sixteen years later, in the DPDP Act.
Machine minds and a Moon prize
The Singularity Institute for Artificial Intelligence held its second summit in San Francisco on 8 and 9 September 2007, billed as "Artificial Intelligence and the Future of Humanity", with seats at $50 including lunch. Rodney Brooks of MIT and Peter Norvig, Google's director of research, shared a programme with Ray Kurzweil, Eliezer Yudkowsky and Peter Thiel; the institute has since renamed itself the Machine Intelligence Research Institute, and the arguments rehearsed there about timelines and machine superintelligence have since moved from that hall into legislation. On 13 September, at Wired's NextFest, the X Prize Foundation announced that Google would fund a $30 million purse — $20 million for the winner — for the first privately financed robot to land on the Moon, travel 500 metres and send back high-definition video; Buzz Aldrin read out a plaque signed by most of the surviving Apollo astronauts. No team launched in time and the prize expired unclaimed on 31 March 2018, by which point the field it had assembled was the commercial lunar-lander industry NASA buys deliveries from.
Price lists for the malware trade
Symantec published the twelfth volume of its Internet Security Threat Report on 17 September 2007, covering January to June. It counted 212,101 new malicious code threats, up 185 per cent on the previous six months. The durable part was commercial: 64 per cent of the underground servers Symantec knew of, where stolen card and identity numbers changed hands, were in the United States, Germany second and Sweden third, and the attack kits feeding them sold for $300 to $800 — MPack for about $1,000, with support from its authors. Browser plug-ins were the way in: 237 flaws against 74 in the half-year before, and Alfred Huger of Symantec's security response group said plug-in issues "went through the roof". Late in the month a federal grand jury in Sacramento returned a four-count indictment over denial-of-service attacks said to have used some 7,000 compromised machines against a gamers' forum and against CastleCops, whose volunteers cleaned infected machines and chased phishing sites for nothing. CastleCops closed on 24 December 2008; the priced, outsourced trade Symantec had measured became ransomware as a service.
⏳ Time capsule — September 2007
- On 5 September Apple introduced the iPod touch alongside a new nano and a renamed classic, and cut the 8 GB iPhone from $599 to $399 while discontinuing the 4 GB model at $499. After complaints from buyers who had paid the launch price, Steve Jobs published a letter to all iPhone customers offering early adopters a $100 Apple Store credit.
- On 24 September, at the Wanderers in Johannesburg, India beat Pakistan by five runs to win the first ICC World Twenty20, a tournament that had run from 11 September. The team paraded through Mumbai on 26 September.
- On 27 September, at 11:34 UTC, a Delta II lifted NASA's Dawn from Cape Canaveral towards the asteroid Vesta and the dwarf planet Ceres, carrying three xenon ion thrusters fired one at a time. It ran out of hydrazine eleven years later; NASA announced the end of the mission on 1 November 2018.
- From 12 to 30 September the World Chess Championship was played in Mexico City as an eight-player double round-robin rather than a match. Viswanathan Anand won it undefeated, with nine points from fourteen games, ahead of Vladimir Kramnik and Boris Gelfand on eight.
Putting a Name to It
In September 2007 the strongest attribution on offer was an unnamed official's confidence, and the strongest denial a named spokeswoman's. The sequence that followed is the history of making that charge in public. A company put a country in a blog post in January 2010. A security firm put a unit and a street address in a report in February 2013. On 19 May 2014 a federal grand jury indicted five officers of People's Liberation Army Unit 61398 by name — Wang Dong, Sun Kailiang, Wen Xinyu, Huang Zhenyu and Gu Chunhui — for stealing commercial information from American companies, the first such charges against serving military officers of another state, and the story May 2014 tells. China rejected the indictment. None of the five has stood trial.
Delon's caution has worn better than anyone's certainty: the hard part was never the packets but the chain from a network to a payroll. The month's other stories are quieter. The Tor exit node is still in the clear, but the web around it encrypted itself, so the mail Egerstad scooped up in plaintext now mostly travels wrapped; the lesson he was making — that the network hides who is talking, not what is said in the open — is the one line of his that needed no revision. MediaDefender's leak cost its parent at least $825,000 by its own filing and the business was folded into another name within two years. And in New Delhi the committee got nearly everything on its list except a single word.