Three newspapers ran it the same day. On 5 September 2013 the Guardian, the New York Times and ProPublica published, from the Snowden documents, an account of a long effort by the National Security Agency and Britain's GCHQ to defeat the encryption ordinary internet traffic depends on — not by breaking the mathematics but by going around it. The NSA called its programme Bullrun, GCHQ called its own Edgehill, each after the first major battle of its country's civil war. Budget material cited by ProPublica put more than $250 million a year into a Sigint Enabling Project that, in the documents' language, engages American and foreign technology industries to shape commercial products so they stay exploitable. The Director of National Intelligence's office said the disclosures handed adversaries "a road map".
Matthew Green, a cryptographer at Johns Hopkins, posted his own reading of the revelations on 6 September. On the morning of 9 September the interim dean of the university's engineering school, Andrew Douglas, asked him to take it down from university servers; the reason given was that the post linked to classified material and used the NSA's logo. It linked to material the newspapers had already printed. Hopkins reversed within hours the same day, and Douglas apologised the next, writing that he had acted "too quickly, on the basis of inadequate and — as it turns out — incorrect information". The flag had come from someone at the university's Applied Physics Laboratory, which does a great deal of work for the agency down the road at Fort Meade.
The standards body moved fast. On 9 September the National Institute of Standards and Technology reissued Special Publication 800-90A as a draft and reopened the accompanying documents for public comment. A supplemental bulletin on 10 September recommended that Dual_EC_DRBG — a generator the publication had carried since 2006 — no longer be used, with comments running to 6 November. NIST said it would not deliberately weaken a cryptographic standard. On 19 September RSA Security told developers to stop using Dual_EC as the default in its BSAFE toolkit and in Data Protection Manager, citing the NIST guidance. What Reuters reported in December about a ten-million-dollar contract, and RSA's denial that it had entered a secret deal, belong to December's edition.
The suspicion was six years old. In August 2007 two Microsoft cryptographers, Dan Shumow and Niels Ferguson, showed at a conference session that anyone knowing a particular relationship between the two elliptic curve points written into the standard could recover the generator's internal state from about thirty-two bytes of output and predict everything after. Bruce Schneier wrote it up that November; nobody outside could say where the constants had come from. On 18 September 2013 Green published a walk through the flaws with the numbers as they sit in shipped code. CERT/CC's note of 7 November listed RSA's BSAFE libraries as using the generator by default and Juniper's ScreenOS as using it, though not by default — a line whose weight took another two years to land.
A carrier and a contractor
On 12 September 2013 Vodafone told about two million German customers that their names, addresses, dates of birth and bank account details had been taken from a server deep inside its own infrastructure; credit card numbers, passwords, PINs and mobile numbers had not been, it said. The attack required insider knowledge, Vodafone said; German press reports put the suspect, whose premises police had searched, at a contractor rather than at Vodafone itself. Four days later Belgacom, Belgium's largest telephone company, said an investigation had found "an unknown virus" in a number of units of its internal IT system, with no indication of any impact on customers, and that the federal prosecutor was investigating; the prime minister, Elio Di Rupo, said the aim looked like strategic information rather than sabotage. On 20 September Der Spiegel, from the Snowden documents, named GCHQ and an operation called Socialist; GCHQ, then and since, has declined to discuss it. Symantec named the malware family Regin in November 2014; The Intercept published the inside account on 13 December 2014, describing engineers lured through counterfeit LinkedIn pages. In October 2018 the Belgian daily De Standaard reported that investigators had concluded the work was GCHQ's. Nobody was charged.
A finger made of woodglue
Apple announced Touch ID with the iPhone 5s on 10 September 2013: a capacitive sensor reading at 500 pixels per inch, said to reach the sub-epidermal layers of a finger, the template held in a secure enclave on the A7 processor and, Apple said, never sent to Apple's servers. The phone went on sale on 20 September. On 22 September the Chaos Computer Club published its method for defeating the sensor, the experiments credited to a member using the name Starbug: photograph a print left on a glass at 2,400 dpi, invert and clean the image, laser-print it at 1,200 dpi onto transparent film with heavy toner, smear woodglue over the ridges, peel the sheet away when dry and breathe on it. Fingerprints, Starbug said, should not be used to secure anything, because a person leaves them everywhere. The month's other lasting arrival came with no announcement: CryptoLocker, believed first posted to the internet on 5 September 2013, encrypted a machine's documents and photographs and put a countdown on the screen. It was still running when the seizure that took apart the network carrying it was announced on 2 June 2014.
The week India was told twice
On 23 September 2013 a two-judge bench of the Supreme Court of India — Justices B.S. Chauhan and S.A. Bobde — made an interim order on petitions led by Justice K.S. Puttaswamy, a retired judge of the Karnataka High Court. In the meanwhile, the order read, no person should suffer for not getting the Aadhaar card in spite of the fact that some authority had issued a circular making it mandatory; a person applying voluntarily might be checked for entitlement, and the number should not go to any illegal immigrant. No statute governed Aadhaar then — the Act came in 2016 — and the order had to be made again: on 24 March 2014, which also restrained the authority from sharing biometric data without written consent, on 16 March 2015, on 11 August 2015 and in October 2015.
The same week brought the argument's other half. On 23 September The Hindu, with Glenn Greenwald, reported from the Snowden documents that India stood fifth on the NSA's Boundless Informant heat map, at about 6.3 billion pieces of information in a month, behind Iran, Pakistan, Jordan and Egypt. On 25 September it reported that India's permanent mission at the United Nations and its embassy in Washington had been marked as location targets, one technique, codenamed Lifesaver, imaging a hard drive. India's own answer had come earlier: the external affairs minister, Salman Khurshid, had said in July that what was involved was metadata and "not actually snooping on the specific content of anybody's message", while his ministry said it would raise the allegations with Washington; on 27 September Manmohan Singh met President Obama at the White House. India then had neither a data protection statute nor a duty to disclose a breach: the duty arrived by direction in 2022, the statute in 2023, and the privacy question underneath both waited until August 2017.
The silicon that stayed awake
Apple announced the iPhone 5s on 10 September 2013 around a processor rather than a feature. The A7 was the first 64-bit system on a chip to ship in a consumer phone, and beside it sat something smaller: the M7 motion coprocessor, an NXP part on an ARM Cortex-M3 core, whose only work was to collect accelerometer, gyroscope and compass readings while the main processor slept. Battery life was the reason given; the pattern of a low-power companion core, always measuring, ran through the M8 to the M11 before Apple folded it into the A12 and, in time, into on-device inference. The month's research sat further from any product. On 17 September three Google researchers, Tomas Mikolov, Quoc Le and Ilya Sutskever, posted a paper on learning "a linear mapping between vector spaces of languages", translating words by projecting one language's vectors into another's — the right answer among the top five candidates close to nine times in ten for English and Spanish. Meaning as a position in a vector space is roughly where the field still stands.
The sinkhole and the raiders
On 30 September 2013 Symantec said it had detached more than half a million machines from ZeroAccess, a click-fraud and bitcoin-mining network running at about 1.9 million infected computers on a typical day. ZeroAccess had no central command server — bots took instructions from one another — so there was nothing to seize. A weakness in the peer-to-peer mechanism had been described by researchers in May; on 29 June Symantec watched a repaired version begin spreading, and rather than wait began sinkholing on 16 July, facing, it wrote, the choice to "start our operations now or risk losing the initiative". The remainder drew a Microsoft-led action in December. Five days earlier Kaspersky had published on Icefog, a small group working since 2011 against shipbuilders, defence contractors, telecom operators and media in South Korea and Japan, and through them at Western supply chains — days or weeks inside a network, the wanted files copied, then gone. Kaspersky found Chinese-language artefacts but said no concrete evidence pointed to a state sponsor. The brief, surgical intrusion was unusual then and is ordinary now.
⏳ Time capsule — September 2013
- On 12 September NASA announced that Voyager 1 had entered interstellar space, placing the crossing at 25 August 2012 and at about 121 astronomical units from the Sun; its plasma instrument had failed in 1980, so the finding rested on plasma oscillations measured from 9 April 2013.
- On 12 September the National Food Security Act received the President of India's assent, entitling about two-thirds of the population — 75 per cent of rural and 50 per cent of urban households — to five kilograms of subsidised grain a person each month.
- On 17 September the Costa Concordia was rotated upright off Isola del Giglio in Tuscany in a parbuckling operation, twenty months after the ship went aground.
- On 29 September AMC broadcast "Felina", the final episode of Breaking Bad, watched by 10.28 million viewers in the United States — the series' largest audience.
The constants nobody chose
Dual_EC_DRBG did not survive the decade it helped define. NIST recommended against it on 10 September 2013, removed it from the recommendation on 21 April 2014, and published Special Publication 800-90A Revision 1 without it in June 2015. Six months after that, in December 2015, Juniper Networks disclosed that the same generator sat in shipped ScreenOS firmware with its second point replaced by one nobody at Juniper had chosen — the theoretical problem of 2007 found in production code, with a stranger holding the key. The larger correction was quieter and far more complete. After September 2013 the industry stopped treating encryption as a feature to be offered and began treating it as the floor to be assumed, which is where it has stayed.
The rest of the month settled into ordinary life. Fingerprint unlock is on nearly every phone sold in 2026, and the Chaos Computer Club's objection held rather than lost: a fingerprint is a convenience, not a secret, and the sensible uses of one assume it can be lifted from a glass. Ransomware went from a sample posted quietly to the internet on 5 September 2013 to the dominant criminal business of the years that followed, through May 2017 and past it. Belgacom, now Proximus, was never officially told who had been inside its network; Belgian investigators reached a conclusion in 2018 and no prosecution followed. In India the order of 23 September 2013 lasted long enough to matter: the court was still restating it when it gave judgment in September 2018.