Summary

  • At 18:47 UTC on Sunday 24 February 2008, AS17557 Pakistan Telecom began announcing 208.65.153.0/24; AS3491 PCCW Global propagated the announcement, routers worldwide received it, and traffic bound for YouTube was redirected to Pakistan.
  • The event ended at 21:01 UTC when AS3491 withdrew every prefix originated by AS17557 — two hours and fourteen minutes after it started, through the same commercial relationship that had carried the unauthorized route to the world.

The timeline is short enough to hold in one hand. According to the RIPE NCC's own case study of the event, AS17557 Pakistan Telecom started announcing 208.65.153.0/24 at 18:47 UTC. AS3491 PCCW Global propagated it, routers around the world accepted it, and requests meant for YouTube went to Pakistan instead.

Eighty minutes later the victim answered. At 20:07 UTC YouTube's AS36561 announced the same prefix, 208.65.153.0/24. At 20:18 UTC it announced the two more-specific halves, 208.65.153.128/25 and 208.65.153.0/25.

That move deserves more respect than it usually gets, and less credit than it usually takes. Under longest-prefix-match, a /25 beats a /24 wherever a network accepts it — and that is exactly the limit of the manoeuvre. It worked because the unauthorized /24 stayed in the table, less specific than the cure. It was self-help under a rule the attacker could also use, and it neither removed the unauthorized origin nor bound any other network to prefer YouTube's version. The victim could compete with the hijack. It could not end it.

What ended it was a withdrawal. At 21:01 UTC AS3491 PCCW Global withdrew all prefixes originated by AS17557 Pakistan Telecom, and the hijack stopped. Two hours and fourteen minutes, measured from the first announcement.

The party that had propagated the bad route was the party that removed it. That is the fact this case keeps teaching and keeps being written around. Propagation and termination ran through one commercial relationship: a customer announced, an upstream exported, and the same upstream eventually stopped exporting. No registry record was consulted to decide whether the announcement would travel. No regulator issued an instruction inside those two hours. A NANOG 42 presentation from February 2008 confirms the same shape of events — the upstream propagated the route worldwide and the incident ended when the route was withdrawn after pressure and coordination with network operators — and it is worth saying plainly that this is corroboration of roles, not a quotation of times.

So the evening produced two different kinds of power, and they were held by different people. Route monitoring made the failure legible while it ran; the RIPE NCC records that its Routing Information Service and tools such as BGPlay were used to detect and analyse the event, and describes the original announcement as unauthorized. Legibility is worth a great deal. It is how an incident becomes a documented fact rather than a rumour, how a victim proves harm, how an operator's conduct becomes accountable to a record. But a monitor is a sensor. Sensors do not reject routes.

The actuator was a transit provider's operational decision. That is an uncomfortable sentence for anyone who would prefer routing security to be administered by an authority with a switch. It isn't. Address registries describe who holds a block; they do not control which routes other networks accept. That gap is not a scandal, it is the architecture: routing is voluntary interconnection among independently operated networks, and no one of them can order another to stop carrying a prefix. In February 2008 the lever that existed was on the transit side, inside a commercial relationship, and it was pulled by the company that owned it.

Responsibility in this case is distributed and should be described that way. The origin announced a block it had no authorization for. The upstream admitted and exported that announcement to the world. Receiving networks accepted it. Every one of those three steps was a place where the event could have been smaller. Naming only the first step, as most retellings do, turns a systems failure into a national embarrassment and leaves the machinery exactly as it was.

Which brings the durable question. A repair that depends on the discretion of one intermediary, exercised two hours into an outage, is not a control — it is luck with a plausible narrative. Durable repair is ex ante and distributed: authenticated authorization for the origin, customer-prefix filters at the provider edge, origin validation on the operator side, alerts wired to a pre-agreed escalation path, and emergency withdrawal that someone has rehearsed before it is needed. Those are candidate controls, not a description of what was deployed in 2008.

The point is direction: move the decision earlier, spread it across more hands, and make it auditable, so that no single company's judgement call is the only thing standing between a misconfiguration and a global outage.

One boundary on the record reviewed here. The material read for this briefing contains no documented instance of a registry, regulator or automated validation system halting the announcement, and it also contains no raw collector export, party correspondence or transit contract; the decisive action it names is the upstream withdrawal. Where a question turns on documents this review did not read, the honest answer is that it is open — not that the actors were idle.