Incident: NSA Blunder Causes Syria's Internet Blackout in 2012

Published Date: 2014-08-13

Postmortem Analysis
Timeline 1. The software failure incident where the NSA accidentally cut off Syria's internet occurred in November 2012 as reported by Renesys [29018]. Therefore, the software failure incident happened in November 2012.
System 1. Core router at the state internet provider in Syria [29018]
Responsible Organization 1. The National Security Agency's elite hacking unit, Tailored Access Operations, was responsible for causing the software failure incident that took Syria's internet offline [29018].
Impacted Organization 1. Syria's main internet service provider and its internet connectivity [29018]
Software Causes 1. The software cause of the failure incident was a glitch that occurred when the NSA's hacking unit, Tailored Access Operations, attempted to install an exploit in the hardware of Syria's main internet service provider, resulting in the accidental cutting off of Syria's internet [29018].
Non-software Causes 1. Attempted installation of an exploit in the hardware of Syria’s main internet service provider by the NSA's Tailored Access Operations unit [29018] 2. Botched router update speculated by Cloudfare to have been caused by the Syrian Telecommunications Establishment [29018]
Impacts 1. The software failure incident caused Syria's internet to go offline, with 92% of the routed networks providing internet connectivity for Syria being affected [Article 29018]. 2. The outage led to a complete blackout of Syrian IP space, indicating a comprehensive disruption of internet services in the country [Article 29018]. 3. The software failure incident potentially destabilized the ongoing civil war in Syria, impacting communication channels and internet access for the population [Article 29018]. 4. The failure of the core router at the state internet provider rendered it inoperable, leading to a sudden loss of connection to the internet for Syria [Article 29018].
Preventions 1. Implementing thorough testing procedures: Prior to attempting to infiltrate the Syrian internet, the NSA's Tailored Access Operations unit could have conducted more extensive testing to ensure that the exploit installation would not lead to a catastrophic failure like the one that occurred [29018]. 2. Enhanced monitoring and oversight: The NSA could have implemented better monitoring and oversight mechanisms to quickly identify and rectify any issues that arise during such operations, preventing a complete internet blackout [29018]. 3. Improved communication and coordination: Better communication and coordination within the NSA team could have helped in promptly addressing any unexpected outcomes of the operation, such as the bricking of the core router, before it led to a widespread failure [29018].
Fixes 1. Implementing more robust testing procedures to catch potential glitches or errors before deployment [29018]. 2. Conducting thorough risk assessments before attempting any intrusive actions on critical infrastructure to prevent unintended consequences [29018]. 3. Enhancing communication and coordination between different units within an organization to ensure proper oversight and accountability in sensitive operations [29018].
References 1. Edward Snowden - Whistleblower who alleged the NSA's involvement in the incident [29018] 2. Wired magazine - Conducted an interview with Edward Snowden where details about the incident were revealed [29018] 3. Renesys - Analysis firm that reported on the internet outage in Syria [29018] 4. The Guardian - Reported on the outage attributing it to the Syrian government [29018] 5. Cloudfare - Cybersecurity company that analyzed the outage and speculated on the cause [29018]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident of the NSA attempting to infiltrate the Syrian internet and accidentally causing a complete blackout by bricking a core router at the state internet provider is a unique incident that has not been reported to have happened again within the same organization [29018]. (b) There is no information in the provided article about a similar incident happening at other organizations or with their products and services.
Phase (Design/Operation) design, operation (a) The software failure incident in Syria's internet outage was attributed to a design failure introduced by the NSA's attempt to infiltrate the Syrian internet. The elite NSA hacking unit, Tailored Access Operations, attempted to install an exploit in the hardware of Syria’s main internet service provider to gain mass access to internet usage and communications. However, this attempt led to a glitch that caused Syria to go offline, as a core router at the state internet provider was rendered inoperable [29018]. (b) The operation failure aspect of the incident can be seen in the aftermath of the outage. The NSA operatives were unable to fix the problem caused by the bricked router, leading to a loss of internet connectivity for Syria. This operation failure was compounded by the fact that the operatives joked about blaming the outage on Israel if they were discovered, indicating a lack of accountability and responsibility in handling the situation [29018].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident related to the Syrian internet outage was caused by a blunder within the system. Specifically, the failure was attributed to the NSA's elite hacking unit, Tailored Access Operations, attempting to infiltrate the Syrian internet by installing an exploit in the hardware of Syria’s main internet service provider. This action led to a glitch that resulted in Syria losing all connection to the internet [29018].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in Syria's internet outage was primarily due to non-human actions. The incident was alleged to have been caused by a blunder from the National Security Agency's elite hacking unit, Tailored Access Operations, while attempting to infiltrate Syria's internet infrastructure. Snowden claimed that the NSA attempted to install an exploit in the hardware of Syria's main internet service provider, which resulted in a glitch that took Syria offline [29018]. (b) However, human actions also played a role in the incident. The NSA operatives were involved in the attempt to infiltrate the Syrian internet via a core router at the state internet provider. The failure of this operation caused Syria to lose all connection to the internet, leading to concerns among NSA operatives about being discovered. There were even jokes made about blaming the outage on Israel if discovered [29018].
Dimension (Hardware/Software) hardware (a) The software failure incident in Syria, where the internet was cut off, was attributed to a hardware failure. According to the articles, the incident occurred when the NSA's hacking unit, Tailored Access Operations, attempted to install an exploit in the hardware of Syria’s main internet service provider's core router. This attempt to infiltrate the Syrian internet resulted in the router being bricked, rendering it totally inoperable and causing Syria to lose all connection to the internet [29018]. (b) The software failure incident in Syria was not directly attributed to software issues but rather to a hardware failure caused by the NSA's attempt to install an exploit in the hardware of the main internet service provider's core router [29018].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident related to the Syrian internet outage in 2012 was malicious in nature. According to the article, whistleblower Edward Snowden alleged that the National Security Agency's elite hacking unit, Tailored Access Operations, attempted to infiltrate the Syrian internet by installing an exploit in the hardware of Syria's main internet service provider with the intention of gaining mass access to internet usage and communications in the country. However, this action led to a glitch that caused Syria to go offline, rendering the router inoperable and cutting off internet connectivity for the country [29018].
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) poor_decisions: The software failure incident related to the NSA cutting off Syria's internet was a result of poor decisions made by the elite NSA hacking unit, Tailored Access Operations. They attempted to install an exploit in the hardware of Syria's main internet service provider to gain mass access to internet usage and communications. However, this decision led to a glitch that caused Syria to go offline instead of achieving their intended goal [29018]. (b) accidental_decisions: The software failure incident can also be attributed to accidental decisions made by the NSA operatives. The attempt to infiltrate the Syrian internet via a core router at the state internet provider resulted in the router being bricked instead, rendering it inoperable and causing Syria to lose all connection to the internet. This unintended consequence led to a situation where the NSA operatives were powerless to fix the problem, leading to concerns about being discovered [29018].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the article. Edward Snowden alleged that the NSA's elite hacking unit, Tailored Access Operations, accidentally cut off Syria's internet while attempting to infiltrate it. The unit attempted to install an exploit in the hardware of Syria's main internet service provider, but instead of gaining mass visibility into internet habits, a glitch took Syria offline [29018]. (b) The software failure incident was accidental as per the article. Snowden mentioned that the NSA attempted to infiltrate the Syrian internet via a core router at the state internet provider, but something went wrong, and the router was rendered totally inoperable, causing Syria to lose all connection to the internet. This failure was not intentional, leading to an "oh shit" moment at the NSA's Tailored Access Operations center [29018].
Duration temporary The software failure incident related to the Syrian internet outage in 2012 was temporary. The outage was caused by a glitch resulting from the NSA's attempt to infiltrate the Syrian internet, which led to the core router being rendered inoperable [29018]. The outage was not a permanent failure but rather a temporary disruption caused by specific circumstances surrounding the NSA's actions.
Behaviour crash, other (a) crash: The software failure incident in Syria's internet outage can be categorized as a crash. The incident resulted in the core router at the state internet provider being rendered totally inoperable, causing Syria to suddenly lose all connection to the internet [29018]. (b) omission: There is no specific mention of the software failure incident being due to the system omitting to perform its intended functions at an instance(s). (c) timing: The software failure incident is not described as a timing issue where the system performed its intended functions correctly but too late or too early. (d) value: The software failure incident is not attributed to the system performing its intended functions incorrectly. (e) byzantine: The software failure incident does not exhibit characteristics of a byzantine failure where the system behaves erroneously with inconsistent responses and interactions. (f) other: The behavior of the software failure incident in Syria's internet outage can be categorized as a crash, where the system lost state and failed to perform its intended functions as a result of a botched attempt to infiltrate the Syrian internet [29018].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence delay, theoretical_consequence (a) death: There is no mention of any deaths resulting from the software failure incident in the provided article [29018]. (b) harm: The article does not mention any physical harm caused to individuals due to the software failure incident [29018]. (c) basic: The incident did not directly impact people's access to food or shelter as a consequence of the software failure [29018]. (d) property: The software failure incident did not result in any direct impact on people's material goods, money, or data [29018]. (e) delay: The software failure incident did cause a significant disruption by taking Syria's internet offline, impacting communication and access to online resources for the population [29018]. (f) non-human: The software failure incident primarily affected the internet infrastructure in Syria and did not mention any specific non-human entities being impacted [29018]. (g) no_consequence: The software failure incident had real observed consequences as it resulted in Syria's internet being taken offline, affecting communication and online activities [29018]. (h) theoretical_consequence: There were potential consequences discussed in the article, such as the fear of the Syrian government discovering the NSA's involvement in the incident and the speculation about blaming the outage on Israel if discovered [29018]. (i) other: The article does not mention any other specific consequences of the software failure incident beyond the disruption of internet services and the potential geopolitical implications discussed [29018].
Domain information, government (a) The failed system was intended to support the industry of information, specifically related to internet usage, communications, and patterns in Syria [29018]. (b) No information provided in the articles about the transportation industry. (c) No information provided in the articles about the natural resources industry. (d) No information provided in the articles about the sales industry. (e) No information provided in the articles about the construction industry. (f) No information provided in the articles about the manufacturing industry. (g) No information provided in the articles about the utilities industry. (h) No information provided in the articles about the finance industry. (i) No information provided in the articles about the knowledge industry. (j) No information provided in the articles about the health industry. (k) No information provided in the articles about the entertainment industry. (l) The failed system incident was related to the government industry, specifically involving politics, defense, and public services in Syria [29018]. (m) No information provided in the articles about any other industry.

Sources

Back to List