At 22:34 UTC on 27 January 2011 — thirty-four minutes past midnight in Cairo, already the 28th — the monitoring firm Renesys watched the routes to Egypt's networks leave the internet's global routing table at what it called virtually the same moment. Approximately 3,500 individual BGP routes were withdrawn, and with them went every valid path by which the rest of the world could exchange traffic with Egypt's service providers. Link Egypt, Vodafone and Raya, Telecom Egypt, Etisalat Misr and all their customers and partners were off the air; the Electronic Frontier Foundation counted Internet Egypt Network among them and noted the providers had gone within minutes of each other. Nothing was broken. The announcements that told other networks where to find Egypt had simply stopped.
One provider stayed. The Noor Group, AS20928, still had 83 of its 83 routes live the next morning, and Renesys put the share of Egyptian networks unreachable at about 93 per cent; Noor carried the Egyptian Stock Exchange, which was the explanation most people reached for and none could confirm. Noor began disappearing at about 20:46 UTC on 31 January. The mobile networks went separately: on 28 January the operators were ordered to suspend service in selected areas, and Vodafone said that under Egyptian legislation the authorities had the right to issue such an order and "we are obliged to comply with it". The government itself announced nothing about the routes; days earlier, when users had found Twitter and Facebook unreachable, a spokesman for the Egyptian embassy in Washington had denied that either was being blocked. The mobile suspension lasted about a day. The internet did not come back with it.
What filled the gap was old equipment and other people's telephone lines. The French Data Network, a small independent provider, opened a dial-up account to anyone in Egypt with an analogue line who could call France, describing the shutdown as an open attack by a state against the internet; the Swedish collective Telecomix ran a second number, offered technical help and sent faxes. Over the weekend of 29 and 30 January, on a permission granted late on the Saturday, engineers at Google, Twitter and SayNow — a voice-messaging company Google had just bought — built Speak To Tweet, announced on 31 January: a caller dialled an international number, left a voicemail, and the recording was posted as a tweet. The caller needed no connection at all.
Egyptian providers returned at 09:29:31 UTC on 2 February 2011, 11:29 in Cairo, Noor among the last back with a full complement of prefixes — five days in all, 28 January to 2 February. The OECD later put the loss at at least $90 million, reckoning telecommunications and internet services at 3 to 4 per cent of Egypt's GDP and the daily cost at around $18 million. That is lost revenue in one industry rather than the cost of the episode: the organisation said its figure excluded knock-on losses in e-commerce, tourism and the call-centre business, and analysts at the time called it conservative. What no figure covered was the week's other effect, on people trying to find out whether their families were safe.
Forty Lines in the Login Page
Facebook's security team began seeing something wrong at the end of 2010, when reports arrived of Tunisian journalists' and activists' pages being deleted wholesale. By 5 January 2011 the mechanism was established: users inside Tunisia were being served the login pages of Facebook, Gmail and Yahoo with extra lines of JavaScript injected in transit — ten in the copy Danny O'Brien of the Committee to Protect Journalists read that day, about forty in the copies described later in the month — possible because those pages travelled over plain HTTP. John Graham-Cumming, reading the code on 22 January, found a handler that took the username and password as they were submitted, encoded each character as two lowercase letters and appended them to a request for a page on facebook.com itself, so the credentials never had to leave the machinery that collected them. Facebook's chief security officer, Joe Sullivan, had every request from inside Tunisia served over HTTPS and added a step asking returning users to identify photographs of friends, so a stolen password alone no longer opened an account. O'Brien wrote that the evidence pointed to the state-run Tunisian Internet Agency dropping the lines into the pages as they passed; the agency made no public answer, and the attribution stayed an inference. The president left the country on 14 January.
A Registry Emptied, a Worm Rehearsed
Two of the month's other stories were about work done where nobody was looking. At about half past twelve on the Tuesday, 18 January, Prague police took a bomb threat and the offices of OTE, which ran the Czech emissions registry, were emptied; the next morning a trader at Blackstone Global Ventures found the firm's account empty and its contact details altered, which those in the market took to mean that someone with administrator access had been at work. The registry said about 1.3 million allowances had gone from six accounts, 475,000 of them Blackstone's. Five registries were hit within days — Austria, the Czech Republic, Estonia, Greece and Poland — for roughly two million allowances worth something near €30 million on that week's reckoning, and on 19 January the European Commission suspended transactions in every national registry; reopening required multi-factor authentication, and the Czech registry did not resume until 24 March. Separately, on 15 January the New York Times reported, in an article by William J. Broad, John Markoff and David E. Sanger, that Stuxnet had been tested at Israel's Dimona complex on centrifuges of the type spinning at Natanz. The account rested on unnamed officials; no government confirmed it. What the programme was called is June 2012's story.
Announced on New Year's Day
On 1 January 2011 Kapil Sibal, the minister for communications and information technology, said that steps would be taken to establish the Central Monitoring System, which would "facilitate and prevent misuse of lawful interception facility". Time called the announcement muted, and the sentence was doing a great deal of work: the system would automate interception that then moved on paper between agencies and telecom operators under section 5(2) of the Indian Telegraph Act, 1885, read with rule 419A of the 2007 amendment rules. The Centre for Development of Telematics was to build it and the Telecom Enforcement Resource and Monitoring cells to run it, one to each major state. It did not begin going out state by state until April 2013.
Three days later, on 4 January, Infosecurity Magazine reported that Research In Motion had offered India a cloud-based arrangement through which service providers could intercept BlackBerry Messenger traffic, with a final solution promised by 31 January 2011; the home ministry asked the Intelligence Bureau to validate the technology. The company's public position was that it kept a consistent global standard for lawful access with no special deals for particular countries, and that corporate mail was different because only the sponsoring organisation could grant access to it — the argument that settled in February 2012. The same department was drafting the intermediary rules gazetted that April, which are April's story. On 20 January the prime minister launched mobile number portability across the country.
Watson's dress rehearsal at Yorktown Heights
On 13 January 2011, before reporters at IBM's laboratory in Yorktown Heights, the question-answering system Watson played a fifteen-clue practice round of Jeopardy! against Ken Jennings and Brad Rutter and won it, $4,400 to $3,400 and $1,200, with no wrong answers from anyone. IBM's David Ferrucci put the problem the system was built for in one sentence: "Language is ambiguous; it's contextual; it's implicit". Behind the screen stood ten racks of Power 750 servers, 2,880 processor threads in all, and about 200 million pages of text on four terabytes of disk, with no connection to the internet. The match proper was recorded the next day and held for broadcast in February. Google supplied two smaller items: on 10 January Goggles learned to solve a photographed Sudoku, and on 12 January Translate for Android gained an alpha Conversation Mode that spoke English into Spanish and back, hedged with warnings about accents and background noise. Goggles was retired in favour of Lens in 2018; the conversation feature outlasted its warnings.
Dell buys SecureWorks, General Atlantic buys into Kaspersky
On 4 January 2011 Dell said it had agreed to buy SecureWorks, an Atlanta managed-security firm of some 700 staff with revenue projected above $120 million; the price was not disclosed, and a later quarterly filing lumped it with the storage company Compellent at about $1.5 billion for both. On 20 January Kaspersky Lab announced that General Atlantic had bought existing shares to become its second-largest shareholder, "a strategic step in our global growth plans" in Eugene Kaspersky's words; the terms were confidential, though reports put them at about $200 million for a fifth of a company valued near $1 billion, ahead of an expected flotation. Kaspersky Lab bought the stake back the following year, which is February 2012's story. On 5 January Sourcefire had said it paid $21 million, part of it contingent, for Immunet, a cloud-based anti-malware start-up with about 750,000 users; the engine became FireAMP a year later and went to Cisco with the rest of Sourcefire in 2013. Dell floated SecureWorks in 2016 and sold it to Sophos in 2025.
⏳ Time capsule — January 2011
- On 11 January, at an event in New York, Verizon Wireless and Apple announced that the iPhone 4 would go on sale on Verizon's American network on 10 February, giving buyers in the United States a choice of carrier for the first time.
- On 15 January Wikipedia turned ten, and its editors held celebrations around the world; the site had been launched on that date in 2001.
- On 17 January Steve Jobs told Apple's staff that the board had granted him a medical leave of absence "so I can focus on my health", the second in two years; he remained chief executive, and Tim Cook took the day-to-day running of the company.
- On 30 January Novak Djokovic beat Andy Murray 6–4, 6–2, 6–3 at Melbourne Park to win the Australian Open, his second Grand Slam title.
The order that went by telephone
Egypt showed that a national internet can be switched off administratively, because the paths out of the country ran through four or five companies and an instruction had only to reach them. The demonstration outlived the government that gave it. On 28 May 2011 an administrative court held Hosni Mubarak, his prime minister Ahmed Nazif and his interior minister Habib el-Adly liable for the economic damage and fined them 540 million Egyptian pounds between them, roughly $90 million; on 24 March 2018 the Supreme Administrative Court set that judgment aside, holding that the suspension had protected the public interest and national security — the defence had argued from article 67 of the telecommunications law. The same argument reached Britain in August 2011, where a prime minister raised the idea of shutting messaging services during the riots and dropped it.
The Tunisian injection was answered by encryption rather than by law. It worked only because login pages travelled in clear text, and on 26 January 2011 Facebook made HTTPS available across the whole site as a setting a user could switch on; the industry spent the following decade making that the default, until a page served over plain HTTP became the thing a browser marks as not secure. The carbon registries got multi-factor authentication the same spring, and India got the monitoring system announced on that New Year's Day, though not for another two years. January 2011 is, for now, where this archive begins: 2010 and the years before it are still to be restored, and the rest of the story runs forward from February.