Latest / The Digital Warfare Podcast / EP. 151: How One Cyberattack Disrupted Norway’s Government Services
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today we are covering a cyber attack against Norway that demonstrates something important about modern digital government. You do not necessarily have to attack every government service, sometimes, you only need to attack the infrastructure they all depend on. A large distributed denial of service attack has disrupted shared digital infrastructure operated by Norway's digitalization agency, known as Digdeer. And the key issue is not simply that websites became unavailable, it is dependency. Here's what happened. The attack began at approximately 3 38 in the morning, Central European summertime, on Monday, August 24th. Attack traffic targeted infrastructure supporting Digdeer and its operations provider, Vivicta. The attack continued at varying intensity, creating instability across several shared government services. Some became completely unavailable for short periods. Others experience slow responses, failed connections, and authentication problems. Among the affected services was ID Porton, and that is where the incident becomes strategically important. ID Porton is Norway's common authentication gateway for public digital services. Citizens use it to identify themselves when accessing government systems, so even when another government application remains technically operational. Users may still be unable to access it if the identity layer underneath it is unavailable. The disruption also affected services including Min ID, Maskin Porton, e-signering, e-formidling, e-Insin, ANSAT porton, and other shared government platforms. Dependent services including Altin were also affected. Think about the architecture: digital identity, electronic signatures, secure digital communication, government forms, machine-to-machine authentication. Data exchange between public agencies. These capabilities are intentionally centralized because shared infrastructure can improve efficiency, interoperability, and security. But centralization creates another property: a shared failure domain. If hundreds of organizations depend on one authentication platform, disrupting that platform can create consequences far beyond the infrastructure being directly attacked. That is exactly why this incident deserves attention. A distributed denial of service attack does not need to steal information, it does not need ransomware, and it does not need persistent access. Its objective can simply be to make legitimate users unable to reach legitimate services. In this case, Norwegian authorities say they have found no evidence that attackers breach the systems or compromise personal information. That distinction matters. This was an availability attack. But availability is part of cybersecurity, especially when digital infrastructure supports government services that citizens increasingly depend on. There is another important point. This was not Dig Deer's first recent encounter with denial of service activity. Current reporting describes previous attacks against its infrastructure in June and again earlier in August. However, there is currently no official attribution for this latest incident. Speculation about who may be responsible should therefore remain exactly that. Speculation. For defenders, the lesson extends beyond government. Map your dependencies. Organizations often know which servers they operate. They are less certain about which shared services could disable dozens of business processes simultaneously. Identity providers, DNS cloud gateways, API infrastructure, certificate services, payment platforms, communication systems, and third party authentication. These are concentration points. They deserve resilience engineering proportional to the number of services depending on them. Organizations should test DDOS mitigation before an attack occurs, build redundant paths for critical services, monitor upstream providers, define degraded operating modes, and understand which functions remain possible when centralized identity or communications infrastructure becomes unavailable. Because redundancy at the application layer means very little if every redundant application still depends on the same unavailable identity service, the strategic lesson is direct. Attackers do not always need to compromise the systems delivering the service, sometimes they can attack the dependency that makes the service usable. And as governments and businesses centralize digital infrastructure, cybersecurity must protect not only individual systems, but the shared foundations connecting them. This has been your Digital Warfare Daily Brief. Stay secure. We'll see you tomorrow.