Investigators close Nokia extortion probe without finding a motive or making an arrest

Extortionists’ demands met

Adopting a strategy endorsed by the NBI, and fearful of potential investor panic if news of the blackmail went public, Nokia quickly decided to meet the extortionists’ demands in full. It had very good reason to want to avoid alarming the markets by publicly disclosing the threat it faced.

In 2007, Nokia was the world’s leading producer of mobile phones, with revenues of €51bn and record profits of €8.2bn in that year. At that time, four out of 10 mobile phones sold worldwide were made by Nokia.

Alerting the stock market to news of an extortion attack, with the inevitable hysteria around the theft of critical encryption codes, could have ignited a fright-and-flight scenario among investors. Announcing to the world that the company had fallen victim to possible system breaches, and had become a target of software security extortion, was a situation Nokia wanted to avoid at all costs.

Significantly, Nokia not only asked the NBI to assist with the cash drop-off, but asked the bureau not to launch an active investigation into the affair until the company had had the opportunity to address security issues and change the encryption codes across its entire range of mobile devices and associated manufacturing systems.

By the time the drop-off was due to happen, the NBI had traced the email IP address used by the extortionists to communicate with Nokia. The bureau was also able to identify the mobile phone used to contact the phone company.

Information kept secret

So close was Nokia’s relationship with the NBI, not to mention the national interest of protecting Finland’s brightest stock market star, that information about the extortion did not enter the public domain until 2014. By that time, Nokia had overhauled its group-wide security protocols and encryption coding systems.

The NBI continued its investigation from 2014 until the first quarter of 2018, when it formally acknowledged that its lengthy enquiry had produced neither motive nor any arrests connected with the crime.   

The termination of the NBI’s investigation has come with valuable new information and insights into how the extortion was organised and executed. In the first instance, the blackmailers chose a random Nokia employee to relay the initial threat to. That first communication indicated that the extortion “group” had obtained, through clandestine means, the Symbian OS digital encryption key for Nokia’s mobile devices, a file comprising just a couple of kilobytes.

Nokia’s chief concern at that juncture was the very real danger that the extortionists would carry out their threat to distribute the digital key to innumerable hackers if the company failed to comply with the blackmail demands.

For Nokia, the likely result of rejecting the criminals’ demands was a security meltdown, with hackers potentially taking control of millions of Nokia mobile devices. Using the digital key, hackers would have been able to access Nokia devices, bypassing security mechanisms to sign, install malware and run their own applications.

Major vulnerability problems

In particular, such a security breach would have caused major vulnerability problems for Nokia phones operating the third edition of Series 60. This was a hardened version of Nokia’s proprietary Symbian OS 9.1 and widely used in E- and N-series phones.

NBI chiefs have variously used words like slick, confident, skilful, masterly, professional and knowledgeable to describe the 2007 extortion attack on Nokia. A Nokia 6691, bought at a second-hand phone store in Helsinki, was used to relay ransom instructions in SMS-text message format to the Operation Polarbear team. The blackmailers then selected a remote marina in Tampere, Finland’s second-biggest municipality, as the drop-off point for a carrier bag weighing 30kg and holding €1.6m in cash.

Although the NBI organised a “sting” operation in a bid to catch the criminals at the marina, police soon lost contact with the suspects, who escaped along the many small country roads that criss-cross heavily forested terrain in central Finland. What has now become clear from disclosures about the NBI’s investigation is the high degree of local knowledge and confidence shown by the culprits at all stages of the attack against Nokia.

Other revelations from the NBI investigation have shed light on the €400,000 “donation” to two Finnish charities that was demanded by the extortionists. Nokia complied fully with this demand, wiring the first €200,000 to the Arvo and Lea Ylppö Foundation, which supports paediatric neurology research, and giving the second €200,000 to Lasentautien Tutkimussäätiö, a Helsinki-based childhood diseases research foundation.