The case was already thirteen months old when the charges were read out. On 25 July 2013 a second superseding indictment was unsealed in federal court in Newark, naming five men: Vladimir Drinkman of Syktyvkar, Aleksandr Kalinin of St Petersburg, Roman Kotov and Dmitriy Smilianets of Moscow, and Mikhail Rytikov of Odessa. The United States Attorney, Paul Fishman, called it the largest hacking and data breach scheme ever prosecuted in the country. The conspiracy the government described had begun in 2005 and run until 2012, and the circle was not a new one: these were the associates of Albert Gonzalez, sentenced to twenty years in March 2010. Two of the five were not at large. Drinkman and Smilianets had been arrested in Amsterdam on 28 June 2012, at the request of the FBI.
Smilianets was not an anonymous name in Russia. He owned Moscow Five, an esports organisation that had taken bronze in Counter-Strike at the 2011 World Cyber Games and finished in the top four at the 2012 League of Legends world championship; it effectively broke up after his arrest, its League of Legends roster reforming as Gambit Gaming. The indictment set out a division of labour rather than a crew. Drinkman and Kalinin specialised in getting in, typically by injecting code into weakly configured database servers reachable from the web. Kotov worked the networks once they were open, hunting for where card data was held. Rytikov, who used the name Abdullah, supplied hosting that kept no logs. Smilianets sold what came out and distributed the proceeds.
The figures were allegations rather than findings, and several were larger than anything then on record: about 130 million card numbers from Heartland Payment Systems, 30 million from the payment processor Commidea, 4.2 million from Hannaford Brothers, roughly two million each from Carrefour and Euronet, 800,000 from Visa Jordan, half a million Diners Club accounts in Singapore. More than 160 million in all, resold — the indictment said — at prices running from about ten dollars apiece to about fifty. Three victims alone, the government stated, lost more than $300 million: a claimed loss, not an accounting of what the clean-up cost. NASDAQ appeared on the victim list, and the point made about it was drawn carefully — the infected servers did not include the trading platform.
Kalinin was charged separately in Manhattan the same day, in two further indictments — one over the NASDAQ servers, which the government said he had been inside from November 2008 to October 2010, and one, with Nikolay Nasenkov, over the theft of bank account details from institutions including Citibank and PNC. He has never appeared in an American court, and neither have Kotov nor Rytikov. For the two men in Dutch custody it took years. Smilianets was extradited on 7 September 2012; Drinkman contested extradition, lost, and was handed over on 17 February 2015. Both pleaded guilty in September 2015. On 14 February 2018 Drinkman was sentenced to twelve years and Smilianets to fifty-one months and twenty-one days — the time he had by then already served.
The Card That Signed Its Refusal
The alert came out of Geneva before the talk was given. On 21 July 2013 the International Telecommunication Union warned that a flaw in SIM cards could let a phone be taken over remotely, its secretary-general Hamadoun Touré saying the findings showed "where we could be heading". The work was Karsten Nohl's, at Security Research Labs in Berlin, and he presented it at Black Hat in Las Vegas on 31 July. Operators reconfigure SIMs by sending binary text messages the handset never shows its owner. Send one signed wrongly and a card still using the ageing DES cipher refuses it — and signs the refusal. Known text and signature resolve against a rainbow table to a 56-bit key in about two minutes on an ordinary computer; correctly signed messages then install a Java applet, and weak sandboxing let it reach the rest of the card, including the identifiers needed to clone the SIM. Nohl had tested about a thousand cards and put roughly a quarter at risk; his estimate of the worldwide figure moved between 750 million and a more conservative 500 million and upwards, and no number was ever agreed. The GSM Association, told three months earlier, said only that it had given guidance to operators and vendors that might be impacted. By 31 July Nohl said nearly every carrier he had spoken to had fixed it.
Eight Days Dark, and a Claim
Ubisoft opened the month badly: on 2 July 2013 it said one of its websites had been used to reach its account systems, that user names, email addresses and encrypted passwords had been taken, and that payment details sat elsewhere and were untouched. Every player was told to change their password. Sixteen days later Apple took its Developer Center offline and left it there. On 21 July it told developers that an intruder had attempted to secure personal information from the site; sensitive personal information was encrypted and could not be accessed, but it could not rule out that some developers' names, mailing addresses or email addresses had been reached. The site came back after eight days. A London-based researcher, Ibrahim Balic, then said publicly that he had filed thirteen bugs through Apple's own reporting system, taking details from seventy-three Apple staff accounts to demonstrate one. Apple never confirmed a connection between him and the outage; the two accounts are best held apart. On 25 July Barnaby Jack, who worked on the security of implanted medical devices at IOActive, died in San Francisco at 35, a week before he was to speak at Black Hat on attacks against cardiac implants. The medical examiner later gave the cause as an overdose; police found no evidence of foul play.
A Policy, and a Pipe
Two things happened in India that month and they pointed in opposite directions. On 2 July, speaking in Brunei at the ASEAN Regional Forum, the external affairs minister Salman Khurshid defended the American surveillance programmes then being reported, calling them analysis of patterns of calls and emails rather than, in his phrase, "actually snooping" on content. The same day in Delhi, Kapil Sibal, Union Minister for Communications and Information Technology, released the National Cyber Security Policy 2013, a Department of Electronics and Information Technology framework whose stated aim was a secure and resilient cyberspace for citizens, business and government. It promised round-the-clock national and sectoral mechanisms for threat intelligence and crisis response, and a target of five hundred thousand trained cyber security professionals by 2018. It said nothing about what the Indian state itself collected.
That was answered eight days later, from the other side. On 10 and 11 July the Economic Times reported an internal Department of Telecommunications document stating that the lawful interception system for BlackBerry services was ready. BlackBerry confirmed that lawful access now covered consumer email and BlackBerry Messenger, and said plainly that it did not extend to BlackBerry Enterprise Server, whose corporate keys it did not hold. Business Today reported on 30 July that interception would begin on 1 August, through a facility BlackBerry had built in Mumbai in April 2012. The traffic would run into the Central Monitoring System — approved by the Cabinet Committee on Security, built by the Centre for Development of Telematics, rolled out state by state from April 2013 — which rests on section 5(2) of the Indian Telegraph Act of 1885. There was no Indian privacy statute to set against it, and nothing obliging anyone to say when a system had failed.
The Small Program That Mapped Meaning
July 2013 produced little in artificial intelligence that announced itself as such. The field was a research subject, not a product line, and what it did produce was small enough to miss. On 29 July 2013 a group at Google led by Tomas Mikolov released word2vec, a compact open-source program that read plain text in bulk and gave every word a position in a space of many dimensions, arranged so that distance and direction carried meaning: the step from Germany to Berlin came out much the same as the step from France to Paris. The method had been set out in a paper posted to arXiv in January by Mikolov with Kai Chen, Greg Corrado and Jeffrey Dean; Google's own announcement of the code followed only on 14 August 2013. Nothing in it was described as intelligence. A companion paper presented that December took a Test of Time award ten years later, and the idea beneath it — that meaning can be held as a position and worked on arithmetically — is the assumption every language model since has rested on.
An Invitation Withdrawn in Las Vegas
The rupture came before the conference did. On 11 July 2013 Jeff Moss, founder of both DEF CON and Black Hat, posted a note asking federal employees not to come to DEF CON 21, which was to run at the Rio in Las Vegas from 1 to 4 August. Recent revelations, he wrote, had "made many in the community uncomfortable about this relationship". It was the first withdrawal of the kind in the event's twenty-year history, and it fell on agencies that had recruited there for two decades. Black Hat, opening the day before, went the other way: General Keith Alexander, director of the National Security Agency, keynoted on 31 July 2013 and was heckled through it, told to read the Constitution and answering that he had. The vendor news was quieter: the offer period for Stonesoft of Helsinki closed on 10 July 2013 with almost ninety-eight per cent of the Finnish firewall maker tendered to McAfee, a deal agreed in May for about $389 million; the line went on to Forcepoint in 2016. The estrangement outlasted the asset.
⏳ Time capsule — July 2013
- On 1 July ISRO launched IRNSS-1A from the Satish Dhawan Space Centre at Sriharikota aboard a PSLV-XL, the first satellite of the Indian Regional Navigation Satellite System.
- On 7 July Andy Murray beat Novak Djokovic 6–4, 7–5, 6–4 to win the Wimbledon men's singles, the first British man to take the title since Fred Perry in 1936.
- On 18 July Detroit filed for Chapter 9 bankruptcy protection, the largest municipal bankruptcy in United States history by debt, with liabilities later put at $18.5 billion.
- On 22 July, at 4.24 in the afternoon, Prince George was born at St Mary's Hospital in London, third in line to the British throne.
Empty chairs at the table
The case at the centre of July 2013 set the shape of nearly everything that followed. An indictment naming people who are not in custody; an arrest that turns on a holiday taken in the wrong country; an extradition contested through foreign courts for years; a sentence handed down long after the victims have finished paying. Drinkman was sentenced on 14 February 2018, thirteen years after the earliest intrusions the indictment described. Smilianets left with time served. Kalinin, Kotov and Rytikov have never been brought to the United States, and in 2026 nothing about that has changed. The pattern has been repeated against far larger cases since, with the same proportion of empty chairs at the table.
The trade the indictment described was ended by hardware rather than by prosecution. Chip cards made a cloned magnetic stripe near worthless, and fraud moved to transactions where no card is presented — which is where the Vault finds it again in September 2014. Nohl's SIM work aged differently: what threatens a phone number in 2026 is the SIM swap, social rather than cryptographic, though old ciphers living on in hardware nobody replaces is still the recurring lesson. The Indian questions raised that July were answered much later and elsewhere: by the Supreme Court on 24 August 2017, when nine judges held privacy a fundamental right, then by CERT-In's six-hour rule in 2022 and the DPDP Act in 2023. Snowden spent the whole month in the transit area at Sheremetyevo; Russia gave him temporary asylum on 1 August — the month this archive covers next, and the first half of the year has since been restored behind it, back to January 2013.