On Friday 22 February 2008 the Pakistan Telecommunication Authority ordered the country's internet service providers, about seventy of them, to block YouTube, citing content it called blasphemous. Rather than filter individual pages, Pakistan Telecom blocked the whole site, and it did the blocking in its routers. YouTube announced its address block, 208.65.152.0/22, 1,024 addresses in all, to the rest of the internet. Pakistan Telecom made a route for a quarter of that block, 208.65.153.0/24, and pointed it nowhere. Routers send traffic along the most specific route they know, so inside Pakistan the narrower route would beat YouTube's own and requests for the site would simply vanish. The scheme depended on the route staying at home.
At 18:47 UTC on Sunday 24 February, 23:47 in Pakistan, it left. Pakistan Telecom announced the route to its upstream provider, PCCW Global, which did not check whether its customer had any claim to those addresses and passed it on. Renesys, a firm that tracked the internet's routing, first saw it in Asia at 18:47:45; by 18:48 nine networks carried it, large trans-Pacific providers among them, and by 18:49:30 all 97 networks in Renesys's view that would ever carry it. Wherever it arrived, the /24 beat YouTube's /22 by the same rule that was meant to apply only in Pakistan. From much of the world, requests for YouTube now crossed into Pakistan Telecom's network and went no further.
YouTube's engineers answered at 20:07 UTC, eighty minutes in, by announcing the same /24 themselves, an equal claim that could only compete. At 20:18 they split it in two, announcing 208.65.153.0/25 and 208.65.153.128/25, more specific than Pakistan Telecom's route and so preferred wherever they were heard, though RIPE NCC's route collectors heard them at only 21 of their peers. At 20:51 Pakistan Telecom's announcements began to appear with its network number twice, a standard way of making a route look longer and less attractive. At about 21:00 — 20:59 in Renesys's data, 21:01 in RIPE NCC's — PCCW withdrew every route Pakistan Telecom originated. Depending on where they sat, users had lost YouTube for about an hour and forty minutes, or for a little over two hours.
A Pakistani government telecommunications official acknowledged to reporters that the block might have briefly and mistakenly affected YouTube beyond the country. On Tuesday 26 February the authority ordered access restored. Martin A. Brown of Renesys, in a timeline published soon after, counted two errors: Pakistan Telecom's announcement, and PCCW's failure to validate it. A provider, he argued, should limit the routes it will accept from a customer to the addresses that customer actually holds. Beneath both lay BGP, by which networks tell one another which addresses they can reach. It kept no record of who held which; each network took its neighbours' word and passed it on, and one unchecked claim had crossed the world in under three minutes.
An Upside-Down Can of Duster
On 21 February 2008 nine researchers released "Lest We Remember: Cold Boot Attacks on Encryption Keys": J. Alex Halderman, Nadia Heninger, William Clarkson, Joseph Calandrino, Ariel Feldman and Edward Felten of Princeton, Seth Schoen of the Electronic Frontier Foundation, William Paul of Wind River Systems, and Jacob Appelbaum. Most security experts, they wrote, assumed that a computer's memory was erased almost as soon as it lost power. At normal operating temperatures the chips they tested took from about 2.5 seconds to an average of 35 seconds to lose everything. Sprayed from an upside-down can of compressed-air duster to about −50°C, they lost fewer than 1 per cent of their bits in ten minutes; in liquid nitrogen, 0.17 per cent in an hour. An attacker who cut the power and rebooted into a small imaging program, or moved the memory to another machine, could rebuild a mounted disk's keys from decayed copies, using the key schedules software kept beside them. BitLocker, FileVault, TrueCrypt, dm-crypt and Loop-AES all fell, whether the laptop was running, screen-locked or asleep; in its default mode BitLocker loaded its keys before anyone logged in.
Karlsruhe's New Right
On 27 February 2008 Germany's Federal Constitutional Court struck down a provision North Rhine-Westphalia had added to its Constitution Protection Act in December 2006, allowing the state's intelligence service to monitor the internet covertly and to gain covert access to information technology systems — to infiltrate a suspect's computer and search it from afar. The complainants were a journalist, a member of the Left party and three lawyers. Infiltration, the court noted, made it possible to monitor a system's use, read its storage media and even control it remotely. From the general right of personality it derived a new fundamental right, to the confidentiality and integrity of information technology systems. Secret access would be permissible only where facts pointed to a concrete danger to an exceptionally significant interest — the life, limb or liberty of a person, or the foundations of the state or of human existence — and generally only on a judge's order. Federal law followed within the year: approved by the Bundesrat on 19 December 2008, the BKA Act let the Federal Criminal Police Office search computers remotely to prevent terrorism from 1 January 2009.
The Long Way Round
On Wednesday 30 January 2008 two cables off Alexandria, SEA-ME-WE 4 and FLAG Europe-Asia, were cut several kilometres apart. That day Rajesh Chharia, president of the Internet Service Providers' Association of India, put the cut in India's bandwidth at 50 to 60 per cent. On 1 February FLAG's FALCON cable broke in the Gulf, 56 kilometres off Dubai, but by then Indian carriers had begun sending traffic the long way round, east through cables to Singapore; VSNL said it had restored service within a day by diverting it onto the TIC and SEA-ME-WE 3 cables. By 4 February some 90 per cent of the bandwidth was back, the Christian Science Monitor reported. The largest outsourcers saw little disruption; Infosys said diverse paths and providers had kept it connected. Consumers and smaller firms fared worse, by the account of Deepak Gupta of the Business Process Industry Association of India, and some call centres had been shut for days.
Explanations competed. Egypt's transport ministry said 24 hours of video showed no ships near the Alexandria breaks; on 7 February FLAG said an abandoned anchor of five to six tonnes had been found by the FALCON break; on 18 February the ITU's head of development, Sami al-Murshed, said "we do not rule out that a deliberate act of sabotage caused the damage". The evidence that followed pointed to ships. In mid-April two ships were reported impounded at Dubai, charged with dropping anchor improperly where FLAG's cables had been cut. In September 2025 cuts to two cables in the Red Sea near Jeddah slowed India's connections again.
Ten thousand cores behind every search
On 19 February 2008 Yahoo! said it had put into production what it believed was the largest Apache Hadoop application anywhere: the Search Webmap, built on the open-source answer to Google's MapReduce and running across a Linux cluster of more than 10,000 cores. The Webmap started from every page Yahoo! had crawled and produced a graph of roughly a trillion links, over 300 terabytes compressed, held on more than five petabytes of raw disk; its output fed the machine-learned ranking behind every Yahoo! web search query. Jeremy Zawodny, an engineer there, wrote that it was not "just an experiment or research project". Earlier that month Microsoft had made an unsolicited $44.6 billion bid for the company, which Yahoo! rejected and which Microsoft withdrew in May. The month's other notable item was quieter: on 15 February the National Academy of Engineering published fourteen grand challenges for the century, among them to reverse-engineer the brain. Hadoop became the floor under a decade of large-scale machine learning.
Sixteen scanners and a frozen test set
AV-Comparatives froze its malware set on 2 February 2008, updated sixteen products two days later and ran Anti-Virus Comparative No. 17, an on-demand detection test last revised that March. The set had been narrowed, DOS viruses dropped the year before and non-Windows malware this time, to some 1.7 million samples, about 73 per cent of which all sixteen scanners caught. TrustPort led on total detection at 99.8 per cent, AVIRA at 99.6 and G DATA's AntiVirusKit at 99.5; ten products cleared the Advanced+ line of 97 per cent, while Sophos, BitDefender, McAfee, Norman and Microsoft's Live OneCare fell into Advanced and VBA32 into Standard. Andreas Clementi promised dynamic tests from the following year, the beginning of the whole-product testing by which labs now measure protection. Grisoft of Brno also renamed itself AVG Technologies that month, to "enhance awareness of the AVG brand in the world" for software it put at 66 million users, and on 25 February Trend Micro bought Identum, a ten-person Bristol university spin-off whose Private Post encrypted email by identity, for an undisclosed sum.
⏳ Time capsule — February 2008
- On 3 February, in Glendale, Arizona, the New York Giants beat the New England Patriots 17–14 in Super Bowl XLII and denied them the first 19–0 season in NFL history. Eli Manning's 13-yard pass to Plaxico Burress won it with 35 seconds left, after David Tyree had pinned a 32-yard catch to his helmet.
- On 19 February Toshiba said it would stop developing, manufacturing and marketing HD DVD players, and the high-definition format war went to Blu-ray; Warner Bros. had announced on 4 January that it would stop supporting HD DVD by June.
- On 20 February in Mumbai the English auctioneer Richard Madley ran the first Indian Premier League player auction, and Chennai Super Kings bought Mahendra Singh Dhoni for $1.5 million, the highest price paid; Andrew Symonds was the most expensive overseas player.
- In the early hours of 21 February a total lunar eclipse reached its greatest at 03:26 UTC and held the Moon in Earth's shadow for 49 minutes and 46 seconds; it was seen whole from the Americas, western Africa and western Europe.
Who May Announce What
Pakistan Telecom's /24 would not get so far today. On 1 January 2011 RIPE NCC began certifying which addresses its members held, and holders can sign route origin authorisations naming the networks allowed to announce them; RFC 6811, in January 2013, told routers how to check. A /24 from a network YouTube's record did not name would be invalid, and by May 2024 all but one of the largest transit networks dropped invalid routes, by Kentik and Fastly researchers' count; that month, for the first time, more than half of IPv4 routes were covered. Only the origin is checked; path validation was barely used by the end of 2024. Later routing crises fill November 2010, when China Telecom denied that routes it had advertised in April were a hijack, and January 2011, when Egypt's were withdrawn.
The month's other stories have sequels too. The industry's answer to cold boot attacks was a Trusted Computing Group safeguard that overwrote memory when power returned; in September 2018 F-Secure's Olle Segerdahl and Pasi Saarinen showed that rewriting the chip holding the firmware's settings switched it off on nearly all modern computers, and Microsoft revised its BitLocker guidance. Memory's physics became an attack surface of its own with Rowhammer in March 2015, and Halderman went on to examine an Indian voting machine, as April 2009 recalls. Karlsruhe's limits met practice on 8 October 2011, when the Chaos Computer Club published its analysis of a police surveillance trojan that, it found, could fetch and run further code; the federal interior ministry denied that the BKA had used it.