The four-count indictment was unsealed in Brooklyn on 9 May 2013, and it was the arithmetic that stayed with people. Prosecutors charged eight men, most of them from Yonkers, as the New York cell of an organisation that had twice reached into the systems of payment card processors, lifted the balances and withdrawal ceilings on a handful of prepaid MasterCard accounts, and passed the account data and PINs to crews standing at cash machines. On 21 and 22 December 2012 the cards belonged to the National Bank of Ras Al-Khaimah in the United Arab Emirates: about $5 million, more than 4,500 withdrawals, roughly twenty countries. On 19 and 20 February 2013 they belonged to Bank of Muscat in Oman: about $40 million, some 36,000 withdrawals, twenty-four countries, in about ten hours.
What the second operation looked like on the ground was set out with unusual precision. Prosecutors placed the New York crews at work from three o'clock on the afternoon of 19 February until twenty-six minutes past one the following morning — nearly 3,000 withdrawals, about $2.4 million, from machines in and around the city. The December run had been shorter and denser: some 750 transactions at more than 140 locations in two hours and twenty-five minutes, for about $400,000. Images released with the case showed one of the accused at machine after machine through the night, his backpack heavier each time. A photograph put out by prosecutors showed two of the defendants, Elvis Rafael Rodriguez and Emir Yasser Yeje, holding bundles of notes.
Cash in that volume is a problem in itself. The indictment described proceeds turned into portable value — expensive watches, expensive cars — and investigators seized, among other things, two Rolex watches, a Mercedes sport utility vehicle and a Porsche Panamera. One deposit made at a bank branch in Miami came to nearly $150,000 in 7,491 twenty-dollar notes, paid into an account controlled by Alberto Yusi Lajud-Peña, whom prosecutors named as a leader of the New York cell. Lajud-Peña was killed in the Dominican Republic on 27 April 2013, twelve days before the indictment was unsealed. The United States Attorney, Loretta Lynch, said it was not clear whether his death was connected to the case.
The banks themselves were not breached. The weak point sat with the processors standing between the card issuers and the network, and neither processor was named in the charging document. MasterCard said its own systems were not involved or compromised. Three members of the New York cell were sentenced in October and November 2014 — Saul Genao to fifteen months, Evan Peña to twenty-two, Elvis Rafael Rodriguez to thirty-four — and ordered jointly to pay $2,782,597 in restitution and forfeit $2.4 million. Lynch called it a massive twenty-first-century bank heist that reached across the internet and stretched around the globe. The man prosecutors would later describe as the architect of the intrusions was, in May 2013, still at liberty and not yet publicly named.
The bank for the underweb
Liberty Reserve had run since 2006 out of Costa Rica, describing itself as a currency for people without bank accounts. On 24 May 2013 five men were taken into custody — its founder, Arthur Budovsky, at Madrid airport and a manager of its accounts also in Spain, two more in Brooklyn and one in Costa Rica — and libertyreserve.com went dark. Four days later the domain carried a seizure notice naming the Justice Department, the Federal Bureau of Investigation, the Internal Revenue Service and the Secret Service, and the indictment was unsealed in Manhattan. Prosecutors alleged the service had moved more than $6 billion through about 55 million transactions in seven years, with over a million users worldwide and roughly 200,000 of them in the United States, and described the merchants who accepted the currency as overwhelmingly criminal: card fraud, identity theft, investment fraud, computer intrusion, narcotics. Law enforcement in seventeen countries took part. Two days after the seizure notice appeared, Krebs on Security reported that the criminal forums were already arguing about where to move next. Budovsky, who had renounced his American citizenship in 2011, pleaded guilty in January 2016 and was sentenced on 6 May 2016 to twenty years.
Twenty telephone lines
On Friday 10 May 2013 the Justice Department wrote to the Associated Press to say it had already obtained two months of records for more than twenty telephone lines used by the agency and its journalists. AP made the letter public on 13 May. The lines covered bureaus in New York, Washington and Hartford, general switchboard and fax numbers, and a telephone in the House of Representatives press gallery; the records ran to April and May 2012. Behind them lay an AP story of 7 May 2012 about a CIA operation in Yemen that had stopped a bomb plot. The agency's chief executive, Gary Pruitt, said there could be no possible justification for so broad a collection; the Attorney General, Eric Holder, called the leak among the most serious he had seen. Six days later the Washington Post reported a 2010 search warrant affidavit in a separate case, which had described the Fox News correspondent James Rosen as, at the very least, an aider, abettor or co-conspirator for having asked a State Department adviser for information. On 23 May the President directed the Attorney General to review the department's guidelines for investigations that involve reporters and to report back by 12 July; the revised media guidelines came on that date, and final rules in February 2014.
The fortnight India stood on both sides
Neither processor was named in the Brooklyn indictment. Over 11 and 12 May 2013 Reuters identified them, from unnamed sources, as ElectraCard Services of Pune and enStage, incorporated in California but running its operations out of Bangalore; contemporaneous reports differed over which served which bank, and neither company has been charged. On 12 May the Indian Computer Emergency Response Team said it was investigating, its director general, Gulshan Rai, saying it would examine what kind of breach had happened in the system and how. ElectraCard said it had been affected by fraud attacks in December and that PIN and magnetic-stripe data appeared to have been compromised outside its own processing environment; enStage's chief executive, Govind Setlur, said his customers had been adversely affected by a sophisticated crime and that outside experts had been brought in.
Eight days later the country appeared in a different role. On 20 May the Norwegian firm Norman Shark published a report on what it called an Indian cyberattack infrastructure: three years of espionage traced, on the evidence of addresses, domain registrations and text inside the code, to private actors in India, against targets in Pakistan, the United States and Europe — among them Telenor, which had disclosed an intrusion on 17 March 2013. The firm's head of research, Snorre Fagerland, said the data appeared to show a group of attackers based in India employing several developers to deliver specific malware; espionage on that scale had until then been assumed to come from China, and Norman Shark said it found no evidence of state sponsorship. Twelve days earlier the Register had reported that India was quietly rolling out a Central Monitoring System giving agencies direct access to calls and messages without going through the carriers. No privacy statute stood behind any of it: a duty to report breaches came by direction in 2022, and a general law on personal data in 2023.
A quantum machine at Ames
Google, NASA and the Universities Space Research Association announced the Quantum Artificial Intelligence Lab on 16 May 2013, built around a 512-qubit D-Wave Two installed at NASA's Ames Research Center. Google Research said the lab would "pioneer research" into how quantum computing might help machine learning. The claim arrived contested. A benchmark by Catherine McGeoch of Amherst College and Cong Wang of Simon Fraser University, reported a day earlier, had the machine solving a 439-qubit optimisation instance about 3,600 times faster than a commercial classical solver, while showing no advantage on other problem types; McGeoch cautioned it was not yet a fair comparison, and sceptics doubted the annealer was doing anything usefully quantum. Google's own comparisons, reported in January 2014, came out ambiguous, and D-Wave disputed the methodology. Google I/O ran at Moscone West from 15 to 17 May with conversational search in Chrome, spoken answers holding context across follow-ups; on 21 May IBM unveiled the Watson Engagement Advisor in Nashville. By 2014 Google had recruited a team to build superconducting qubits of its own.
A code sent to one phone
On 22 May 2013 Twitter began offering login verification, an opt-in second factor that texted a code to a registered telephone at sign-in. It arrived four weeks after the Associated Press's account was hijacked on 23 April and used to report explosions at the White House, a message that briefly knocked about 140 points off the Dow. The design carried a limit newsrooms noticed at once: one telephone number per account, which left shared press desks relaying codes between staff. Twitter's Jim O'Leary said the underlying engineering had "cleared the way" for further account security work; text messages proved the weak version of the idea, and in 2023 the company restricted them to paying subscribers. Microsoft's Patch Tuesday on 14 May shipped ten bulletins, MS13-038 among them, closing the Internet Explorer 8 use-after-free served from a compromised United States Department of Labor page reported on 1 May. On 20 May Websense agreed to be taken private by Vista Equity Partners at $24.75 a share; it became Forcepoint in 2016.
⏳ Time capsule — May 2013
- On 8 May Sir Alex Ferguson announced his retirement as manager of Manchester United after twenty-six years and thirty-eight trophies.
- On 16 May Delhi Police arrested three Rajasthan Royals cricketers — S. Sreesanth, Ajit Chandila and Ankeet Chavan — in the Indian Premier League spot-fixing case, along with a number of bookmakers; a Delhi court discharged the three in July 2015, though the cricket board said its own bans would stand.
- On 17 May Daft Punk released Random Access Memories in continental Europe, on 20 May in Britain and on 21 May in the United States; its first single, "Get Lucky", had gone out on 19 April.
- On 20 May a tornado rated EF5 crossed Moore, Oklahoma, on a fourteen-mile path in thirty-nine minutes, killing twenty-four people and injuring more than two hundred.
The ceiling in the database
The architect was named later. Ercan Findikoglu, a Turkish citizen who used the handles Segate, Predator and Oreon, was arrested in Germany in December 2013, fought extradition and lost, pleaded guilty in Brooklyn on 1 March 2016 and was sentenced on 10 February 2017 to eight years, with restitution set at $55,080,226.14 — a figure covering three operations, not two, the first in February 2011. The method did not retire with him. In February 2016, instructions sent over the interbank messaging network moved $81 million out of Bangladesh Bank's account at the Federal Reserve Bank of New York. The target had shifted from the card processor to the payment message, but the shape held: change a number in a system nobody is watching, then collect it.
The press-records story turned out to be an overture. The first document from Edward Snowden was published on 5 June 2013, three weeks after the Associated Press made the Justice Department's letter public, so the argument about what a government may take from a telephone company was under way before the larger disclosures began; June 2013 is where that thread continues. India's side of the month aged more slowly. The Central Monitoring System was built and never given a statute of its own, and the duties that would have applied to the two breached processors — mandatory incident reporting, and a general law on personal data — took another nine and ten years to arrive. Prepaid cards still carry limits. May 2013 established that a limit is only as good as the machine that stores it.