Thirty hours against a national login

A distributed denial of service attack against Norway's Digitalisation Agency began on Monday and ran for about thirty hours at varying intensity, with some services still degraded on Tuesday morning. Ten services were affected. The target was Vivicta, Digdir's IT partner.

What was down

• ID-porten, the national digital identity gateway, which serves 4.5 million users.
• Identity verification and public service login.
• Government data and document exchange, and access to public records.
• Employee access management.
• Online pharmacies and the electronic prescription system.

The pharmacy entry is the one to sit with. Nothing was attacked in the health system. Health services broke because they authenticate through ID-porten, and when the gateway stopped answering, everything downstream of it stopped too.

Scale and repetition

Digdir press officer Are Kvistad told NRK the attack was two to three times larger than the last one. This was the third incident against Digdir's services since June, and it is not known whether the three are connected or part of a wider campaign. No unauthorised access to sensitive information has been confirmed, and no actor has been identified.

The design question underneath

A single national identity gateway is efficient by construction and concentrated by construction. Every service that adopts it inherits its availability, which is fine until availability is the thing under attack. The cost of the alternative, every service running its own identity, is worse in almost every dimension except this one. Thirty hours is what the trade looks like when the bill comes.