Simultaneous jamming, phone-line flooding and network denial of service against BBC Persian (March 2012)
What happened
On 2 March 2012 the BBC's London headquarters was the target of a sustained online attack that disrupted email access in parts of the corporation for about four hours, with internal communications problems continuing into the following week; it did not affect on-air output and is understood to have been a distributed denial-of-service attack. It came two days after the BBC published figures showing that its Persian TV audience had almost doubled in two years to six million. In a speech on 14 March, the BBC's director-general, Mark Thompson, said it now looked as if those seeking to disrupt or block BBC Persian might be widening their tactics, and that on one recent day there had been a simultaneous attempt to jam two different satellite feeds of BBC Persian into Iran, to disrupt the service's London phone lines by the use of multiple automatic calls, and a sophisticated cyber-attack on the BBC. Thompson was explicit that it was difficult and might prove impossible to confirm the source of the attacks, while noting that attempted jamming of BBC services into Iran was nothing new and that the coincidence of the three was self-evidently suspicious. BBC Persian TV had been regularly jammed since its launch in 2009, and several BBC journalists had been detained or intimidated in Iran in the preceding twelve months.
The thinnest record in the batch, and deliberately so. The satellite-jamming component is a single clause in a speech by the affected broadcaster's chief executive, with no frequency, no spacecraft, no duration, no geolocation and an explicit refusal to attribute. The Guardian's account of that speech, which is the source SPARTA cites, does not carry the sentence at all; the quotation had to be sourced separately, which is recorded in the sources file. Most of what is documented is a ground and IT incident, which is why the primary segment is ground rather than link. It is recorded because the brief asked for it and because SPARTA's bibliography carries it, not because it can support a detailed mapping. The record should be read alongside iran-foreign-broadcast-jamming-2009-2012, which documents the pattern this event is said to belong to.
Attack vector
Three simultaneous actions against one broadcaster: an attempt to jam two satellite feeds, automated flooding of the service's telephone lines, and a network denial-of-service attack against the broadcaster's corporate systems.
Operational impact
Loss of email access in parts of the BBC for about four hours with internal communications problems into the following week; disruption of the Persian service's London telephone lines; no effect on on-air output.
Affected segments
link
Disclosed
2012-03-14
SPARTA techniques evidenced
Each row is a technique this record evidences, with the reasoning and the source that attests to it.
What relationship, confidence, and evidence mean on the rows below
- Relationship
What kind of link this is between the technique and the target.
Mitigates: the target actively prevents, detects, or recovers from the technique.
Addresses: the target governs the technique or is relevant to it, without interdicting it. Most governance and policy obligations sit here.
Triggers obligation: the technique occurring is what triggers the duty the target imposes.
Relates to: related to the technique, but the target neither interdicts nor governs it. Used sparingly.
- Confidence
How strongly the source supports this mapping, not how severe the technique is.
High: the source supports the mapping squarely.
Moderate: supported, with a qualification such as a cross-tactic reading that stays operationally sound.
Low: the source reaches the technique only in part.
- Evidence
How close to the source text the mapping was made.
Direct: a verbatim excerpt of the cited source was read against the technique, and the rationale argues from that excerpt.
Derived: the mapping follows from the source's scope or structure, with no on-point excerpt addressing the technique.
Inferred: reached by composition through another framework, or by domain reasoning the source does not support on its face.
Thompson describes an attempt to disrupt BBC Persian's London phone lines with multiple automatic calls, alongside a network attack that took out email access in parts of the corporation for about four hours. EX-0013.01's distinguishing feature is saturation by syntactically valid inputs that the system attempts to process rather than discards, which is what an automated call flood against a switchboard is. Derived because the source gives no volume, duration or mechanism for the call flood. Recovered per decision 67: the record previously called this a category error because EX-0013.01 is written on a spacecraft's command path, and recorded that a terrestrial reading was a scope question for the catalogue. The ruling answers it.
The BBC's director-general states on the record that there was a simultaneous attempt to jam two different satellite feeds of BBC Persian into Iran. The technique is named by the affected party. Confidence is moderate rather than high because the statement is a single clause with no technical particulars and no attribution, and because it describes an attempt rather than a measured outcome.
The measured effect on the record is the loss of email access in parts of the BBC for about four hours, with internal communications problems continuing into the following week, and disruption of the Persian service's London phone lines, while on-air output was unaffected. Temporary impairment over a period rather than elimination.
Considered and not mapped
These techniques were considered for this record because a source, a related record or SPARTA's own catalogue pointed at them. Each was read against what the sources say and not mapped. The reason is given in full.
No source says whether the attempt was made against the uplink or the downlink, and 'two different satellite feeds' does not settle it.
No source says whether the attempt was made against the uplink or the downlink, and 'two different satellite feeds' does not settle it. The same ground as
EX-0016.01.Cited by SPARTA at this incident. Thompson describes an attempt to jam; no source says either feed was lost, and on-air output was explicitly unaffected.
Sources
The published accounts this record rests on. The tier is SafeMode Space's own assessment of the source, and the reason for it is given beside it. What the tiers mean and how they are assigned: the source tiers.
A source is listed when a mapped technique rests on it, or when it disputes the account. One the curators read but neither cited nor recorded as disputing the record is not listed, so an absence here means neither is true rather than that nobody looked.
Tier 2: National newspaper reporting, carrying the BBC director-general's prepared remarks and the corporation's own characterisation of the incident.
Tier 3: Curated incident tracker maintained by the Council on Foreign Relations. An index entry recording how an event is catalogued and which sources it rests on, not independent evidence of any of them.
Tier 3: Media trade publication; cited specifically because it carries Mark Thompson's prepared remarks at greater length than the national-newspaper reporting does.
Every source SafeMode Space reproduces, and on what terms: sources and attribution.