In May 2017 he had been the outbreak's anonymous hero — the British researcher writing as MalwareTech, who registered an unclaimed domain he found in WannaCry's code for $10.69 and switched the epidemic off. By August the anonymity was long gone. On 2 August, with the Black Hat and DEF CON conferences over and the badges packed away, Marcus Hutchins was at McCarran International Airport in Las Vegas, waiting to board his flight home to England, when FBI agents took him into custody. He was 23. He spent that night in a cell in Henderson, Nevada, and the community that had spent three months calling him a hero learned where he was the way it learns most things — from a court docket, and from Twitter.
The indictment had been waiting since 11 July, sealed, returned by a federal grand jury in the Eastern District of Wisconsin after an investigation that predated his fame. Its six counts alleged that in 2014 and 2015 — when he was 20 and 21 — Hutchins wrote a banking trojan called Kronos and conspired with another man, unnamed in the public filing, who advertised and sold it; researchers who catalogued Kronos in 2014 had noted an asking price of about $7,000 on Russian-language forums. Among the places it was later offered was AlphaBay, the dark-web market that American and European police had seized and shut down mere weeks before the arrest. Nothing in the charges concerned WannaCry; everything about the arrest did.
The reaction moved from disbelief to organisation inside a week. A Las Vegas judge set bail at $30,000 on 4 August, finding Hutchins neither a danger to the community nor a flight risk, and ordered him to remain in the United States under GPS monitoring; two well-known defence lawyers, Marcia Hofmann and Brian Klein, took the case. In Milwaukee he pleaded not guilty and settled into a strange exile in Los Angeles — permitted to work, permitted the internet again, barred from the one domain that had made him famous. Foreign researchers watched, and some began quietly weighing whether flying to an American conference was still worth the risk. The question of what a teenager's code should cost the adult had acquired its test case.
This archive is written from 2026, so the ending is known. A superseding indictment in 2018 stacked on further charges, including lying to the FBI; in April 2019 Hutchins pleaded guilty to two counts of making and distributing malware, saying publicly that he regretted his actions and accepted full responsibility for them. On 26 July 2019, in Milwaukee, Judge J.P. Stadtmueller weighed the damage done by Kronos against the damage undone at WannaCry, found "too many positives on the other side of the ledger", and sentenced him to time served with a year's supervision — suggesting from the bench that he pursue a pardon. It remains American justice's most considered answer to a question the industry still asks about its own origins.
HBO, "Mr. Smith" and a six-month salary
The intrusion HBO had confirmed to staff on 31 July ran through August as a slow-motion extortion. Hackers signing themselves Mr. Smith claimed to hold 1.5 terabytes of the network's data — their figure, never confirmed — and released it in instalments: unaired episodes of Ballers and Room 104, then draft scripts for five Game of Thrones episodes, a month of one programming executive's email and, in a video addressed to chief executive Richard Plepler, a demand for "our 6-month salary in bitcoin" — roughly $6 million by the blackmailers' own claimed earnings, which were also unverifiable. A leaked email suggested HBO had floated $250,000 described as a bug-bounty payment; the company declined to discuss it. The month's clearest leak needed no hacking at all: episode four surfaced on 4 August bearing a Star India watermark, and on 14 August police in Mumbai arrested four men, three of them employees of a technology vendor in the distribution chain. HBO's own Spanish and Nordic services then published episode six early by mistake. In November the United States would charge an Iranian national, Behzad Mesri, over the intrusion. He has never been arrested.
Maersk puts a number on NotPetya
On 16 August A.P. Moller-Maersk published its interim results and attached the largest number any victim had yet put on NotPetya, the wiper that had spread out of Ukraine on 27 June: $200-300 million, falling predominantly in the third quarter. The wording was careful. This was lost revenue and business interruption — bookings that never happened while terminals ran on paper and customers sailed with competitors — not a full accounting of the incident. Chief executive Søren Skou's group said Maersk Line had been taking bookings again within days of the attack, with operations returning to normal over the following weeks; what the recovery had actually required was not in the report, and only the following January would chairman Jim Hagemann Snabe describe rebuilding 4,000 servers and 45,000 PCs in ten days. The outbreak itself is in this archive's June edition; the consequences kept compounding until October 2020, when the United States charged six officers of Russia's GRU over the attack. Russia has always denied responsibility.
Nine judges, one right
On 24 August 2017 nine judges of the Supreme Court of India did something Indian courts had circled for sixty years: they held, unanimously, that privacy is a fundamental right. Justice K.S. Puttaswamy v Union of India had begun in 2012 as a challenge to Aadhaar, filed by a retired Karnataka High Court judge who was 91 by the time the verdict came. It became a nine-judge question because the government argued that two old precedents — M.P. Sharma in 1954, decided by eight judges, and Kharak Singh in 1962, by six — had already settled that no such right existed. Only a larger bench could unsay them, and on 24 August it did, declaring privacy intrinsic to the right to life and personal liberty under Article 21 and to the freedoms guaranteed by Part III of the Constitution.
The verdict ran to six concurring opinions, the lead written by Justice D.Y. Chandrachud for four judges including the Chief Justice. It reached back past Aadhaar: Chandrachud declared the majority opinions in ADM Jabalpur — the Emergency-era case which held that even the right to life could be suspended — "seriously flawed", overruling a judgment his own father had joined on that bench 41 years earlier. The immediate effect was to reframe the Aadhaar litigation, which a five-judge bench would decide in September 2018. The longer effect is the reason this box exists: every Indian argument about data since — surveillance, encryption, the Digital Personal Data Protection Act of 2023 — begins by citing Puttaswamy.
The bot that beat Dendi
On 11 August, between matches at The International, Valve's Dota 2 championship in Seattle, the young research laboratory OpenAI put a bot on stage against Danylo "Dendi" Ishutin, one of the game's most popular professionals, for a mirrored one-against-one exhibition. Trained for about two weeks by playing copies of itself, the bot won the opening game convincingly; Dendi resigned the second after conceding the first kill. OpenAI called the restricted format a step towards a full five-a-side team, and kept its word: the successor system beat the game's reigning world champions in 2019, and the recipe — self-play at serious computing scale — became doctrine at the laboratory that later built ChatGPT. The month's quieter launches wore just as well. On 8 August Andrew Ng returned to Coursera with deeplearning.ai, a five-course specialisation that schooled a generation of engineers; and on 28 August a small Cologne company shipped the DeepL Translator, seven languages and a claim of blind-test wins over far larger rivals — a claim that held, as DeepL grew into one of Europe's most successful AI companies.
Symantec sells the padlock
On 2 August Symantec agreed to sell its website-security business — the certificate authority it had bought from VeriSign, with the Thawte, GeoTrust and RapidSSL brands — to DigiCert, for $950 million in cash and a stake of about 30 per cent in the buyer. It was the outcome of the browser-trust dispute this archive's March edition carries: Google and Mozilla had lost confidence in the way those certificates were issued, and Symantec — contesting the browsers' claims to the end — sold the problem to a company they trusted. The sale closed that October; by autumn 2018 Chrome distrusted Symantec's old certificates entirely. On 15 August Kaspersky Lab disclosed ShadowPad, a backdoor hidden in digitally signed NetSarang server-management software from 17 July to 4 August, caught through odd DNS lookups at a Hong Kong bank and removed in an update once the vendor was told. Kaspersky read the tooling as Chinese-speaking espionage; from 2026, ShadowPad looks like the debut of a platform that never retired — after NotPetya's poisoned tax software, the year's second warning that the software supply chain was the way in.
⏳ Time capsule — August 2017
- On 21 August a total solar eclipse crossed the continental United States from Oregon to South Carolina — the first coast-to-coast totality since 1918 — and millions travelled into a path of darkness roughly 70 miles wide.
- On 17 August the LIGO and Virgo observatories recorded GW170817, the first detected collision of two neutron stars, a gamma-ray flash arriving 1.7 seconds behind the gravitational waves; the discovery was kept quiet until October.
- Usain Bolt ended his career at the World Championships in London: beaten to bronze in the 100 metres by Justin Gatlin on 5 August, he pulled up injured in the 4×100 metres final on 12 August, his last race.
- Hurricane Harvey came ashore in Texas late on 25 August as a Category 4 storm and stalled; over the following days parts of the southeast of the state received more than 1.5 metres of rain.
The other side of the ledger
Marcus Hutchins completed his year of supervised release in 2020 and remained in the United States, where the conviction complicates any departure and return; the pardon the judge spoke of has never been reported. He went back to the work the case had interrupted and became one of the field's most-followed public explainers of how malware actually functions, while a long magazine reconstruction of the years the indictment covered, published with his cooperation in 2020, filled in what the plea agreement had only outlined. The kill-switch domain he registered on 12 May 2017 stayed sinkholed, for years still logging beacons from infected machines nobody ever cleaned. Those three days have their own restoration in this archive: WannaCry — three days in May.
The month's other stories closed at different speeds. Behzad Mesri was charged over the HBO intrusion in November 2017, went onto the FBI's cyber most-wanted list and has never been arrested. NotPetya was formally attributed to the Russian military in February 2018, and in October 2020 six GRU officers were charged by name; Maersk's $200-300 million was later dwarfed by a US government estimate that put the worldwide damage near $10 billion. And Puttaswamy compounded the way constitutional law does: it reframed the Aadhaar verdict of September 2018, and six Augusts later India's Digital Personal Data Protection Act — the statute this magazine's India desk now tracks clause by clause — received assent in August 2023, its first premise the right those nine judges found.