On Friday 7 March 2008 an engineer from Southern Company, which managed the technology operations of the Edwin I. Hatch nuclear plant near Baxley, Georgia, installed a software update on one computer on the plant's business network. The computer monitored chemical and diagnostic data from one of the plant's primary control systems, and the update was designed to synchronise data on both. When it rebooted, according to a report filed with the Nuclear Regulatory Commission, it reset the data on the control system; Unit 2's safety systems read the missing data as a drop in the water that cools the fuel rods, and shut the reactor down. The NRC's status report logged an automatic scram caused by a loss of condensate feedwater, with its high-pressure coolant injection and reactor core isolation cooling systems starting.
Unit 2, one of the plant's two General Electric boiling-water reactors, stood at zero power on 8 and 9 March and was starting up again on the 10th; The Washington Post put the shutdown at 48 hours. The Post's Brian Krebs reported the incident on Thursday 5 June, three months after it happened. Carrie Phillips, a Southern Company spokeswoman, said the emergency systems had performed as designed and that the plant's safety and security had never been endangered. Technicians had known of full two-way communication between certain computers on the corporate and control networks, she explained; the engineer had not known that the software synchronised data across both, or that rebooting the business-side computer would force a similar reset in the control-system machine.
"We were investigating cyber vulnerabilities and discovered that the systems were communicating, we just had not implemented corrective action prior to the automatic [shutdown]," Phillips said. Plant engineers had since physically removed all network connections between the affected servers. Joe Weiss, managing partner of Applied Control Solutions in Cupertino, said Hatch was one of only a handful of such events made public, because the NRC documented every unusual event while non-nuclear plants kept theirs private. "Anytime you have to shut down, especially with an automatic shutdown, you're challenging the safety systems," he told the Post. He cited Browns Ferry, where in August 2006 a flood of data traffic on the control network had locked up the controllers of two recirculation pumps and shut down Unit 3.
The regulator expected more such lessons. "The plants are expanding their use of digital technology to put more megawatts on the grid, and because of that these lessons are going to occur," said Scott Morris, the NRC's deputy director for reactor security. Operators were expected to correct such problems and share what they learned, and the agency was, he said, in the final stretch of rules requiring each plant to detail its defence of its digital networks as a condition of its licence. On 11 June, in a House debate about intrusions from China, Representative Zoe Lofgren offered a correction on "the nuclear power plant issue", in terms that fitted Hatch though she named no plant: "it was not an attack." The rule was published on 27 March 2009.
Open for Outside Eyes
On Wednesday 11 June 2008 Frank Wolf, a Virginia Republican, told the House that in August 2006 four computers in his office had been compromised, beginning with his foreign policy and human rights staffer's. They held his casework for political dissidents and human rights activists, "open for outside eyes to see". Meetings with House Information Resources and the FBI, he said, had placed the source inside the People's Republic of China; other members' offices and the Foreign Affairs Committee had been compromised too. Chris Smith of New Jersey said his human rights subcommittee's computers had been attacked in December 2006 and March 2007 from or through a Chinese internet address, which "absolutely doesn't prove that Beijing was behind the attack". The FBI declined to comment. In Beijing on 12 June the foreign ministry's spokesman, Qin Gang, asked: "Do we have such advanced technology? Even I don't believe it." Zoe Lofgren noted that the largest number of intrusions into the House in April had come from the United States, "And China wasn't second"; on her motion, Wolf's resolution asking that every office be briefed on electronic attacks went to committee.
Three Hundred Sites, One Server
On 17 June 2008 Lithuania's parliament made it an offence to display Soviet or Nazi insignia, from the hammer and sickle to the swastika, or their leaders' images, and banned both regimes' anthems. On the morning of Saturday 28 June the Chief Official Ethics Commission's website gave way to a Soviet flag and an abusive text in Russian. Over Sunday and Monday the same text appeared on the governing Social Democrats' site, and more than 300 Lithuanian sites, mostly private companies', were covered with Soviet symbols. Most were hosted by Hostex, formerly MicroLink, said Sigitas Jurkevicius of the communications regulator: "It seems to be a planned attack. Yet we cannot tell as yet which country it comes from." On 4 July a Lithuanian CERT official told IDG News that most had sat on one physical server with a flaw in its web-server software or Linux operating system, and officials knew that proxies, probably in Western Europe, had been used. The police took the case, and the week's reports named no one. Georgia's government sites were defaced and flooded in August, during its war with Russia.
Who Pays for a Phish
On 26 June 2008 a non-resident Indian based in Abu Dhabi filed an application against ICICI Bank with Tamil Nadu's IT secretary, who sat as the state's adjudicating officer under the Information Technology Act. On 2 September 2007 he had received an email, apparently from the bank, telling him to reply with his internet banking user name and password or his account would cease to exist. He replied. On 6 September ₹6.46 lakh left his account for a firm's account at a Mumbai branch, from which ₹4.6 lakh was drawn in cash over the counter. The bank, which said it had confirmed the fraud the next day, froze that account and returned ₹1,50,171 to him, but argued that he had carelessly disclosed his password and that a crime under police investigation lay outside the officer's jurisdiction.
On 12 April 2010 the adjudicating officer, P.W.C. Davidar, found that the bank had "failed to put in place a foolproof internet banking system with adequate levels of authentications and validation", and awarded ₹12.85 lakh. The bank appealed to the Cyber Appellate Tribunal, which heard the case in 2011 but, largely non-functional, never ruled; the Finance Act, 2017 moved its work to TDSAT. On 10 January 2019 TDSAT upheld the finding. The bank's choice of mail server, it said, had in all probability let the fraudster use the bank's own domain, and the bank never explained its safeguards. Tricked by a sub-domain of the bank's own, the customer was not negligent; the bank's negligence could count as assistance: "A watchman can assist a thief by being 'negligently' absent from the place of duty." Only the ₹6 lakh awarded for expenses was cut, to ₹50,000.
Object detection, broken into parts
Computer vision's main meeting, CVPR, convened in Anchorage in late June, and one paper it carried has aged better than the month's hardware. Pedro Felzenszwalb, David McAllester and Deva Ramanan presented a discriminatively trained, multiscale, deformable part model — object detection as a scaffold of parts free to shift against one another — and a decade later the conference's pattern analysis committee gave it the Longuet-Higgins Prize, for "significant impact on computer vision research"; such models held the detection field until convolutional networks displaced them. Two best-paper awards went to Lampert, Blaschko and Hofmann, for locating objects without sliding a window across the image, and to Woodford, Reid, Torr and Fitzgibbon, for stereo reconstruction under second-order smoothness priors. The rest was silicon: Nvidia's GT200, 1.4 billion transistors with double-precision arithmetic, arrived on 16 and 17 June 2008 as the GeForce GTX 260 and 280, and on 9 June IBM and Los Alamos announced that Roadrunner, a hybrid of Cell and Opteron chips, had sustained a petaflop in May. Neither was sold for learning, which both were later used for.
Kaspersky asks for help with Gpcode
On 5 June 2008 Kaspersky Lab described a new version of Gpcode, a Windows virus that encrypted documents, pictures and source files on the machines it reached and demanded payment for their return. Earlier variants had used keys the company broke by finding faults in the implementation rather than in the mathematics, up to 660 bits. Gpcode.ak used a 1024-bit RSA key, and on 9 June Kaspersky invited cryptographers, government and research institutions, rival anti-virus vendors and independent researchers "to join the efforts to solve this problem"; the cryptographer Eran Tromer put up a challenge page. Bruce Schneier was unimpressed, writing on 12 June that no 1024-bit number had been factored outside a secret government agency and that far more than Kaspersky's estimate of fifteen million computer-years would be needed. The key held, and encryption the vendor cannot undo is the shape the trade's worst problem took. Elsewhere, Panda Security's board replaced Jorge Dinares as chief executive with Juan Santana on 3 June amid flagging sales, and Virus Bulletin's June comparative ran scanners on Ubuntu's server edition.
⏳ Time capsule — June 2008
- On 1 June, at the DY Patil Stadium in Navi Mumbai, Shane Warne's Rajasthan Royals beat Chennai Super Kings by three wickets, reaching their target off the last ball, to win the first Indian Premier League; Yusuf Pathan, who took three wickets for 22 and made 56, was man of the match.
- On 17 June Mozilla released Firefox 3. So many people tried to fetch it that Mozilla's website became unavailable and the download opened two hours late, and it still recorded more than eight million downloads in a day, a Guinness World Record.
- On 27 June Bill Gates spent his last day as a full-time employee of Microsoft, completing the two-year handover to Ray Ozzie and Craig Mundie that he had announced in June 2006 in order to give more time to philanthropy; he remained chairman until 2014.
- On 29 June, in Vienna's Ernst-Happel-Stadion, Fernando Torres scored the only goal after 33 minutes and Spain beat Germany to win Euro 2008, their first major title since 1964; the World Cup of 2010 and Euro 2012 followed.
One Way Only
The NRC's rule was published on 27 March 2009. Section 73.54 required every power-reactor licensee to protect its digital systems against cyber attacks "up to and including the design basis threat", and the licensees' plans ran to eight milestones, the third a "deterministic one-way device": hardware that lets data leave a protected network and lets nothing in, the engineered form of what Hatch's engineers had done by removing the connections. A rule of 2 November 2015 added a duty to report cyber incidents. Separation answered Hatch's fault, not every fault: Stuxnet, found in July 2010, travelled on USB sticks, and in May 2021 ransomware on the business side of Colonial Pipeline was enough for the company to stop the pipeline itself.
The other stories have sequels. Attribution of the kind Wolf relayed, which the FBI declined to discuss, grew more specific: Mandiant named a People's Liberation Army unit in February 2013, and in May 2014 the United States charged five of its officers; Beijing denied both. In London the Cabinet Secretary's review of 25 June made encryption and penetration testing obligatory across government after the HMRC and Ministry of Defence losses. TDSAT's order of 2019 rested on the IT Act's older clause on "assistance", because Section 43A, in force from October 2009, came too late for the case. And when India's nuclear operator confirmed malware at Kudankulam in October 2019, it said the machine sat on an administrative network isolated from the plant's critical one: the separation Hatch had lacked.