The flood began on Saturday 4 July 2009, the American Independence Day, and the first sites to fail were American government ones. Over the long weekend the websites of the Treasury, the Secret Service, the Federal Trade Commission and the Transportation Department each went down for a time. Keynote Systems, which measures how reachable websites are, found the Transportation site entirely unreachable for two days and the FTC's still failing seven attempts in ten on the Tuesday. "This is very strange," said Ben Rushlo, its director of internet technologies. "You don't see this." The White House, the Pentagon, the State Department, the New York Stock Exchange, Nasdaq and the Washington Post were on the list as well, and many of them blunted the traffic.
On the evening of Tuesday 7 July websites began to fail in Seoul: the presidential Blue House, the defence ministry, the National Assembly, Shinhan Bank, Korea Exchange Bank and the portal Naver, with further waves over the next two days reaching the foreign ministry and the National Intelligence Service's own website. North Korea had test-fired short-range ballistic missiles on 4 July, and suspicion needed no prompting. On 8 July the intelligence service briefed a parliamentary committee, and a member told the Yonhap news agency that the service had been saying "North Korea or a pro-North Korean force might be behind" the attacks. Its own statement said only that they appeared "elaborately prepared and staged by a certain organization or state". In Washington the State Department said it could not yet confirm the source.
The researchers who took the code apart were less alarmed than the politicians. It was Mydoom, a worm first seen in January 2004, reworked for the purpose; researchers found nothing in it built to slip past anti-virus software, Dean Turner of Symantec said it had taken no great skill to put together, and Joe Stewart of SecureWorks thought its author wanted headlines more than damage. Counts of infected machines ran from the South Korean intelligence service's early 20,000 to the 166,908 in 74 countries claimed by Bkis, a Vietnamese firm. What set the code apart was a date: from 10 July the machines were to overwrite documents of many common file types and their own master boot records — with, researchers reported, the words "Memory of the Independence Day" — so that they would not start again.
The fuse caught, though not everywhere: South Korean users reported hundreds of wrecked computers — 424 in one tally the Yonhap news agency carried. On 14 July Bkis said a master server, on an address belonging to an internet television company in Brighton, had been directing eight command servers, two of which it had taken over; one of the company's owners, Tim Wray, said the machine was in Miami, at a partner's data centre, linked to Britain by a private network. On 30 October the service's director, Won Sei-hoon, told a closed session of the National Assembly that the traffic had been traced to a line from China rented by North Korea's Ministry of Post and Telecommunications. He gave no further detail, the evidence was not made public, and Pyongyang made no admission.
Three Hundred and Ten Documents
Late on 14 July 2009 Michael Arrington of TechCrunch wrote that someone calling himself Hacker Croll had sent the site 310 Twitter documents, from executive meeting notes and financial projections to employees' calendars and meal preferences. Floor plans, office passcodes and job candidates' names would stay unpublished; a few documents had "so much news value" that TechCrunch ran them, the last on 16 July, with word that Twitter was not happy but could live with it. Biz Stone, a co-founder, wrote on 15 July that an administrative employee's personal email had been hacked about a month earlier and her Google Apps account reached from it; Twitter had carried out a security audit, and the leak was, in a phrase he borrowed, "akin to having your underwear drawer rifled". TechCrunch's reconstruction on 19 July, based on the intruder's account, traced the way in to a lapsed Hotmail address, re-registered by him, to which Gmail sent its reset link, and to a password reused at work. In March 2010 French police working with the FBI arrested François Cousteix; in June a Clermont-Ferrand court convicted him of unauthorised access and gave him a five-month suspended sentence.
Lawful and Proportionate
On 31 July 2009 Lord Justice Stanley Burnton and Mr Justice Wilkie, in the High Court in London, dismissed Gary McKinnon's judicial review. The United States had indicted him in 2002, accused of entering ninety-seven military and NASA computers in 2001 and 2002; he said he had been looking for evidence of UFOs. The House of Lords had already rejected his appeal and the European Court of Human Rights had declined to intervene. This time his lawyers relied on a recent diagnosis of Asperger's syndrome and the risk extradition posed to his life, and argued that he could be tried in Britain; prosecutors had decided in February that the United States was the proper venue. Extradition, Stanley Burnton wrote in a 41-page ruling, was "a lawful and proportionate response to his offending". His mother, Janis Sharp, said that if the law allowed it, "then it's a bad law"; David Cameron, then leader of the Opposition, said he saw no compassion in sending him thousands of miles away. The legal fight went on, and it ended three years later without a trial anywhere.
One Paragraph, ₹120 Crore
On 6 July 2009 Pranab Mukherjee presented the first full budget of the re-elected United Progressive Alliance government, and one paragraph of his speech gave ₹120 crore to an authority the Planning Commission had constituted by notification on 28 January. The Unique Identification Authority of India, he told the Lok Sabha, would "set up an online data base with identity and biometric details of Indian residents and provide enrolment and verification services across the country", and the first numbers would be rolled out in twelve to eighteen months. The paragraph said nothing about how the database would be protected. The items that followed it in the speech concerned police modernisation and border fences.
The man chosen to build it had been named in late June. The notification appointing Nandan Nilekani, a co-founder of Infosys, is dated 2 July 2009 and gave him an initial five years in the rank and status of a Cabinet minister; he assumed charge on 24 July, and the Prime Minister's Council of UIDAI was constituted on 30 July. Those dates are recited in the Supreme Court's Aadhaar judgment of 26 September 2018, which struck down the provision allowing disclosure on national-security grounds. The idea had a security pedigree — after the Kargil war of 1999 a review committee recommended identity cards, beginning with residents of border villages — but in 2009 it was presented as a matter of delivering services. The first numbers came just under fifteen months after the speech, in Tembhli.
IBM agrees to buy SPSS for $1.2 billion
On 28 July 2009 IBM agreed to buy SPSS, of Chicago, for $50 a share in cash: about $1.2 billion, 42 per cent above the previous day's close. SPSS had begun in 1968 as the Statistical Package for the Social Sciences; by 2009 its software was used to score credit, detect fraud and forecast demand, and it claimed some 250,000 customers. Ambuj Goyal, who ran IBM's information-management software division, said clients could move from sensing and responding to "predict and act"; the deal closed on 2 October. At the International Joint Conference on Artificial Intelligence in Pasadena that month, a special session presented the highlights of a panel Eric Horvitz had convened at Asilomar in February as president of the Association for the Advancement of Artificial Intelligence; on 26 July the New York Times reported its worries, among them criminals using synthetic speech to pass as human, and computer worms and viruses that could not be stamped out. IBM still sells SPSS Statistics in 2026, with a watsonx.ai assistant that explains its output in plain language.
Google promises an OS without viruses
On 7 July 2009 Google announced Chrome OS, a lightweight operating system built on Linux and meant for netbooks from the second half of 2010. Sundar Pichai and Linus Upson wrote that its security architecture was being completely redesigned so that users "don't have to deal with viruses, malware and security updates". Security vendors were sceptical: Graham Cluley of Sophos granted that much existing malware would not run but called the promise marketing, and Carl Leonard of Websense expected malware writers to hunt for flaws from the first day. On 30 July McAfee agreed to pay about $140 million in cash, with up to $30 million more against targets, for MX Logic, a privately owned company that filtered email and web traffic for some 40,000 customers, sold largely through managed service providers. Chromebooks went on sale in June 2011, guarded by sandboxing, a self-check at every start-up and updates that install themselves; Intel Security, as McAfee had become, on 11 January 2016 stopped selling the email services MX Logic had brought.
⏳ Time capsule — July 2009
- On 5 July Roger Federer beat Andy Roddick 5–7, 7–6, 7–6, 3–6, 16–14 in the Wimbledon final for his fifteenth major singles title, one more than Pete Sampras; its 77 games made it the longest men's major final, and its fifth set the longest in one.
- On 15 July Harry Potter and the Half-Blood Prince, directed by David Yates, opened in Britain and the United States, eight days after its premiere at the Odeon Leicester Square; it took $394.7 million worldwide in five days, the largest five-day opening to that date.
- On 20 July, forty years to the day after the first Moon landing, Barack Obama received Neil Armstrong, Buzz Aldrin and Michael Collins, the crew of Apollo 11, in the Oval Office.
- On 22 July the longest total solar eclipse of the twenty-first century crossed India and China: totality lasted up to 6 minutes 38.86 seconds over the Pacific south of the Bonin Islands, thousands of pilgrims gathered on the Ganges at Varanasi, and cloud hid it from Shanghai. No longer one is due until 13 June 2132.
The first entry in the file
From 2026 the month reads as a beginning. The flood was clumsy and the fuse caught a few hundred disks, but its last act — an order to destroy — came back to Seoul in March 2013, when a wiper took banks and broadcasters off their own disks. In February 2016 a Novetta-led coalition of security companies put the July 2009 attacks at the head of the record of the group it called Lazarus, tied by reused code to DarkSeoul and to the destruction at Sony Pictures; it stopped short of naming a state behind the group. American prosecutors later charged a named North Korean programmer over Sony and WannaCry; Pyongyang denied it all. For July 2009 itself, attribution still rests on a closed briefing and on code compared years afterwards.
The other lesson was in the recovery link. Twitter's documents left through an address nobody was watching and a password used twice, and the same chain — one reset opening the next account — cost a writer his digital life in fifteen minutes in August 2012 and, by telephone, handed teenagers Twitter's own administrative console in July 2020; Twitter ended 2009 with its DNS hijacked through valid credentials. Second factors and passkeys have since made the password the lesser weakness and the help desk the greater. McKinnon was never tried in either country, and the authority funded that month went on to assemble the largest biometric register ever built. Behind this edition the archive runs back through June 2009 to January 2009.