The DOI matches its Crossref record; 1 of the 1 references it cites were found in a registry or an index.
DigiNotar: Dissecting the First Dutch Digital Disaster
Open accessAbstract
In the middle of the night on September 2, 2011, the Dutch Minister of the Interior and Kingdom Relations held an emergency press conference. DigiNotar, a Certificate Authority (CA), had been electronically ‘broken into’ and as a result intruders had managed to generate falsified certificates. As a CA, DigiNotar issued digital certificates to secure digital communication, but as a result of the breach the authenticity of such certificates could no longer be verified. The Dutch government subsequently revoked its trust in all certificates issued by DigiNotar. This was the beginning of the first digital disaster in the Netherlands. As a pioneering disaster, this article focuses on the implications of DigiNotar as a vital case study for future scenarios of digital disaster management. The main focus of this article is on the underlying ‘weaknesses’ of the DigiNotar incident, which allowed the situation to evolve from a problem into a disaster. These include lack of oversight, lack of security attention and risk awareness and the absence of an effective mitigation strategy. By identifying and subsequently analyzing the underlying problems, this article aims to demonstrate how future situations can be better contained if sufficient attention is granted to these factors and subsequent changes are introduced.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“A CA can misuse certificates, issue invalid certificates [52], or become the victim of a security breach leading to a wide-ranging ramification including fraudulent issuance of certificates and man-in-the-middle (MITM) and impersonation attacks [53-55].”
From A Survey of Self-Sovereign Identity Ecosystem (2021) · cites this paper as [53]
Citations
Cites
Cited by
A Survey of Self-Sovereign Identity Ecosystem
Soltani, R., Nguyen, U. T., & An, A. (2021) · Security and Communication Networks · doi:10.1155/2021/8873429 · Cited by 131
The influence of internet architecture on centralised versus distributed internet services
Arkko, J. (2020) · Journal of Cyber Policy · doi:10.1080/23738871.2020.1740753 · Cited by 30
Skierka, I. (2022) · Government Information Quarterly · doi:10.1016/j.giq.2022.101781 · Cited by 47
The KISS Principle in Software-Defined Networking: A Framework for Secure Communications
Kreutz, D., Yu, J., Verı́ssimo, P., Magalhaes, C., & Ramos, F. M. V. (2018) · IEEE Security & Privacy · doi:10.1109/msp.2018.3761717 · Cited by 21
“Finally, the Public Key Infrastructure (PKI) on which TLS relies is complex and thus vulnerability prone [5], opening a large surface for successful attacks [6].”
BackgroundBlockchain Based PKI and Certificates Management in Mobile Networks
Yan, J., Hang, X., Yang, B., Su, L., & He, S. (2020) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom50675.2020.00242 · Cited by 20
Trust and scalable blockchain-based message exchanging scheme on VANET
Chukwuocha, C., Thulasiraman, P., & Thulasiram, R. K. (2021) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-021-01164-9 · Cited by 20
“This is dangerous, as evidenced by the security breach in the 2011 DigiNotar [16] scandal, issuing fraudulent certificates.”
BackgroundLightweight public key infrastructure for the Internet of Things: A systematic literature review
El-Hajj, M. I., & Beune, P. (2024) · Journal of Industrial Information Integration · doi:10.1016/j.jii.2024.100670 · Cited by 19
DID Link: Authentication in TLS with Decentralized Identifiers and Verifiable Credentials
Garzon, S. R., Natusch, D., Philipp, A., Küpper, A., Einsiedler, H., & Schneider, D. (2024) · Conference on Privacy, Security and Trust · doi:10.1109/pst62714.2024.10788053 · Cited by 7
“Breaches in centralized PKIs occur from time to time and cause an immense damage to the digital economy and society as a whole [7], [8].”
Blockchain-Based Public Key Authentication of IoT Devices for Electrical Energy Systems
Cardamone, N., Dalena, V., Mauro, A., Settembre, M., Vecchia, G. D., Vitaliti, A., Dondossola, G., Bartalesi, D., Garrone, F., & Terruggia, R. (2022) · AEIT International Annual Conference · doi:10.23919/aeit56783.2022.9951818 · Cited by 7
“Attacks targeting CAs are not a new phenomenon, as demonstrated by the DigiNotar case, a Dutch Certification Authority that in 2011 was victim of a security breach resulted in fraudulent issuing of certificates, [5].”
BackgroundStorage Optimization for Certificates in Blockchain Based PKI System
Yan, J., Yang, B., Su, L., & He, S. (2021) · Communications in computer and information science · doi:10.1007/978-981-33-6478-3_8 · Cited by 7
A Semi-Decentralized PKI Based on Blockchain With a Stake-Based Reward-Punishment Mechanism
Turan, E., Şen, S., & Ergun, T. (2024) · IEEE Access · doi:10.1109/access.2024.3394657 · Cited by 6
Monitoring Key Pair Usage through Distributed Ledgers and One-Time Signatures
Mayr, L., Palma, L., Zambonin, G., Silvano, W. F., & Custódio, R. F. (2023) · Information · doi:10.3390/info14100523 · Cited by 4
Transparency, Compliance, And Contestability When Code Is(n’t) Law
Hicks, A. (2022) · New Security Paradigms Workshop · doi:10.1145/3584318.3584854 · Cited by 9
“This allows misbehaving certificate authorities who (on purpose or due to compromise [78]) emit problematic SSL certificates to be detected, disincentivising such misbehaviour or, conversely, incentivising security on the part of certificate authorities.”
Risk Management Planning of Certification Authority Termination Based on ISO 31000:2018
Nastiti, A. D., Wulandari, M., Agustiningtyas, S., Radhitya, R., Ahmad, I., & Hermawan, W. (2023) · International Conference on New Media Studies (CONMEDIA) · doi:10.1109/conmedia60526.2023.10428241 · Cited by 4
“This is precisely why considerable trust is placed in the certificate itself, since the underlying assumption is that the identity of the recipient of the certificate has been verified by a TTP [5].”
BackgroundBRT: An Efficient and Scalable Blockchain-Based Revocation Transparency System for TLS Connections
Xing, Q., Wang, X., Xu, X., Lin, J., Wang, F., Cui, L., & Wang, B. (2023) · Sensors · doi:10.3390/s23218816 · Cited by 3
Gardenier, A. M. (2024) · Advances in intelligent systems and computing · doi:10.1007/978-3-031-66635-3_35 · Cited by 3
Digitalization in Corporations
Kanojia, S. (2024) · Advances in human and social aspects of technology book series · doi:10.4018/979-8-3693-3334-1.ch008 · Cited by 3
PKChain: Compromise-Tolerant and Verifiable Public Key Management System
Mosakheil, J. H., & Yang, K. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3478754 · Cited by 3
“However, recent high-profile incidents involving DigiNotar, Comodo, GlobalSign, StartSSL, and TurkTrust [8], [9], [10], [11] have revealed vulnerabilities where compromised CAs threaten the security and availability of PKI, creating a single point of failure.”
Provably Robust Decisions based on Potentially Malicious Sources of Information
Muller, T., Wang, D., & Sun, J. (2020) · IEEE Computer Security Foundations Workshop (CSFW) · doi:10.1109/csf49147.2020.00036 · Cited by 2
“Compromised certificate authorities are seldom trusted by browsers in default settings; DigiNotar [9] being a notable exception.”
BackgroundRSA Keys Quality in a Real-world Organizational Certificate Dataset: a Practical Outlook
Kamiński, K., & Mazurczyk, W. (2023) · International Journal of Electronics and Telecommunications · doi:10.24425/ijet.2023.147704 · Cited by 1
“There have also been cases where Certificate Authorities have been compromised as a result of attackers gaining access [8].”
BackgroundWhy Zero Trust Architectures Are Not Replacing Trust
Jensen, C. D. (2024) · IFIP advances in information and communication technology · doi:10.1007/978-3-031-76714-2_8 · Cited by 2
A Semi-decentralized PKI Based on Blockchain with Identity Retention
Dinh, H.-N., & Do, B.-L. (2025) · Lecture notes in networks and systems · doi:10.1007/978-981-96-5217-4_15 · Cited by 1
Internal audit and complex systems: emerging approaches
Lindgreen, E. R., Hartog, P., & Hamaker, P. (2025) · Maandblad Voor Accountancy en Bedrijfseconomie · doi:10.5117/mab.99.154652 · Cited by 1
Assessing SSL/TLS Certificate Centralization: Implications for Digital Sovereignty
Azevedo, A. C., Scheid, E. J., Franco, M. F., & Granville, L. Z. (2025) · Globecom · doi:10.1109/globecom59602.2025.11432644 · Cited by 1
A Cost-benefit Analysis of Information Security Mitigation Methods for ORVIs
Street, J., & Olajide, F. (2021) · Journal of Internet Technology and Secured Transaction · doi:10.20533/jitst.2046.3723.2021.0092 · Cited by 1
A preliminary engagement with the spatiality of power in cyberwar
Ashraf, C. (2023) · GeoJournal · doi:10.1007/s10708-023-10929-z · Cited by 1
“The security risk was significant enough for the Dutch government to take ownership of the firm, prompting a major restructuring of Dutch encryption certificate-issuing authorities (Arnbak & Van Eijk, 2012; van der Meulen, 2013; Zetter, 2011b).”
BackgroundFrom Criminal to Crucial Participation: The Case of Dutch Volunteer Hackers
Gardenier, A. M. (2025) · Social Inclusion · doi:10.17645/si.8876 · Cited by 1
The Spatiality of Power in Internet Control and Cyberwar
Ashraf, C. (2015) · eScholarship (California Digital Library) · Cited by 1
Schrijvers, E., Prins, J. E. J., & Passchier, R. (2021) · Research for policy · doi:10.1007/978-3-030-77838-5_1
Migration Service Process for Certification Authority Using Project Management Body of Knowledge
Agustiningtyas, S., Wulandari, M., Nastiti, A. D., Radhitya, R., Ahmad, I., & Hermawan, W. (2024) · IEEE International Conference on Technology, Informatics, Management, Engineering and Environment (TIME-E) · doi:10.1109/time-e62724.2024.10919606
“This is why considerable trust is placed in the certificate [13][14].”
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.003.0011
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.002.0007
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.003.0009
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.003.0004
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.003.0013
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.003.0007
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.005.0001
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.003.0005
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.001.0001
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.002.0004
Theoretical versus Practical Security
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.003.0003
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.002.0008
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.003.0001
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.003.0006
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.003.0010
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.002.0003
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.003.0014
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.002.0005
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.003.0002
Implementation of Cryptography
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.003.0008
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.003.0015
Cryptography for Personal Devices
Martin, K. M. (2025) · doi:10.1093/oso/9780198903277.003.0012
EU Policies Meet Global Practices: The Discourse on Qualified Website Authentication CertificatesPreprint
Dikshit, P., Hölzmer, P., Sedlmeir, J., & Fridgen, G. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5784176
VeriCert: SSL/TLS Certificate Verification Based on Self-sovereign Identity and Blockchain
Giuliani, A., Salve, A. D., Mori, P., & Ricci, L. (2026) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-032-12335-0_5
Leveraging Proof-of-Authority Blockchain for Decentralized Certificate Revocation
Premont, A., & Afifi, H. (2026) · IEEE International Conference on Network Softwarization (NetSoft) · doi:10.1109/netsoft70012.2026.11603527
Murakami, T., Motogi, Y., Nakagawa, R., Jin, Y., & Yamai, N. (2026) · Electronics · doi:10.3390/electronics15174020
Signatures with Post-compromise Accountability
Dayanikli, D., Lang, J., & Lehmann, A. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-36264-3_5
Metadata
- Authors
- van der Meulen, N.
- Venue
- Journal of Strategic Security
- Published
- 2013-06
- Volume
- 6
- Issue
- 2
- Pages
- 46-58
- ISSN
- 1944-0464 (ISSN-L)
- 1944-0472
- OpenAlex
- W2156717295
- Cited by
- 59
- References
- 1
- Citations by year
- 2026: 4 · 2025: 27 · 2024: 8 · 2023: 5 · 2022: 3 · 2021: 5 · 2020: 4 · 2018: 1 · 2015: 1 · 2013: 1
- FWCI
- 1.94
- Type
- journal article
- Language
- en
- Open access
- diamond
- doi.org
- Licence
- cc-by-nc
- Locations
- Journal of Strategic Security (publishedVersion, cc-by-nc)
- Digital Commons - University of South Florida (University of South Florida) (submittedVersion)
- Digital Academic REpository of VU University Amsterdam (Vrije Universiteit Amsterdam) (submittedVersion)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion)
- VU Research Portal (submittedVersion, other-oa)
- Data Archiving and Networked Services (DANS) (submittedVersion, other-oa)
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Social Sciences › Political Science and International Relations › Cybersecurity and Cyber Warfare Studies
- Social Sciences › Sociology and Political Science › Disaster Management and Resilience
- Keywords
- digital certificates, certificate revocation, security oversight, risk awareness, mitigation measures
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
