Iran, Israel, “Myrtus”, Esther and a Worm

When the Iranians announced that a worm had got into their computers last week, I was a little surprised. I mean, most computers have hard plastic cases and are not usually placed in muddy puddles. But then I realized, “Oh, they meant a virus, a trojan a computer worm, not just any old worm.” With that cleared up, the NY Times released a related story yesterday which prompted some Catholic Bible Student interest. (In case you have not read about what happened–basically, a big ugly computer worm called “Stuxnet” infested the computers at Iran’s nuclear facilities.) Apparently, one of the files in the worm is entitled “Myrtus.” The NY Times intelligently relates how this title may be an allusion to the Book of Esther. This allusion may indicate that the Stuxnet worm is connected to the Israelis, specifically their cyberwarfare unit in their intelligence service. Unfortunately, the Times article does not get into explaining the exact connection between the word “Myrtus” and Esther until late in the article, except for saying it is connected to the myrtle plant. So what is the connection?

The NY Times tells us this:

Then there is the allusion to myrtus — which may be telling, or may be a red herring.

Several of the teams of computer security researchers who have been dissecting the software found a text string that suggests that the attackers named their project Myrtus. The guava fruit is part of the Myrtus family, and one of the code modules is identified as Guava.

It was Mr. Langner who first noted that Myrtus is an allusion to the Hebrew word for Esther. The Book of Esther tells the story of a Persian plot against the Jews, who attacked their enemies pre-emptively.

“If you read the Bible you can make a guess,” said Mr. Langner, in a telephone interview from Germany on Wednesday.

Carol Newsom, an Old Testament scholar at Emory University, confirmed the linguistic connection between the plant family and the Old Testament figure, noting that Queen Esther’s original name in Hebrew was Hadassah, which is similar to the Hebrew word for myrtle. Perhaps, she said, “someone was making a learned cross-linguistic wordplay.”

Ok, so that’s all fine, but let’s get into the details about this so-called allusion.

The word at issue is actually a Latin word. In the Latin Vulgate, the word only shows up in Isaiah 55:13 (“pro saliunca ascendet abies et pro urtica crescet myrtus et erit Dominus nominatus in signum aeternum quod non auferetur”).  The word in Hebrew here is “hadas”. In Latin, it is less common than the adjectival form, myrteus.  Here’s the dictionary entry from Lewis and Short’s Latin Dictionary, provided by Perseus Digital Library:

myrtus (murtus), i and ?s, f.,

I. a myrtle, myrtle-tree, Plin. 15, 29, 37, § 122: “viridi caput impedire myrto,Hor. C. 1, 4, 9.—Poet., for a spear of myrtle-wood: “et pastoralem praefix? cuspide myrtum,Verg. A. 7, 817.—Nom. plur. myrt?s, Verg. G. 2, 64.—As masc., Cato, R. R. 8.—Anteclass. also, myrta or murta , ae, f.: “murta nigra,Cato, R. R. 125.—Murtus for myrtus: “murti nigrae baccae,Scrib. Comp. 109.

A Latin Dictionary. Founded on Andrews’ edition of Freund’s Latin dictionary. revised, enlarged, and in great part rewritten by. Charlton T. Lewis, Ph.D. and. Charles Short, LL.D. Oxford. Clarendon Press. 1879.

So that’s the word which shows up in the Stuxnet computer worm files. We have three more questions to answer. What does myrtle look like? How is the Latin word myrtus related to Esther? Why would an allusion to Esther indicate any kind of Israeli involvement?

1. I have attached a picture of myrtle to this post, courtesy of Wikipedia.Myrtus

2. The Latin word myrtus translates into Hebrew as “hadas”, which I stated above. This exact Hebrew form shows up only in Isaiah 55:13 and Nehemiah 8:15. Other forms of the same word occur in Isaiah 41:19 and Zechariah 1:8, 10 and 11. In every case, the word is translated as myrtle. But…where this gets interesting is that the name of Esther in Hebrew is “Hadassah”. The word only appears once in the Bible in Esther 2:7. The Bible is talking about Mordecai who “was bringing up Hadassah, that is Esther.” Hadassah is her Hebrew name and “Esther” is her name in Persian. The Hebrew name, Hadassah, comes from the same root as the word for myrtle (hadas). So…by a long, circuitous, multi-langugage path, the word myrtus which is “hadas” in Hebrew, the basis for “Hadassah,” the Hebrew name for Esther, connects us to the biblical story of Esther.

3. Ok, great. We have traced the linguistic connections, but why Esther? Well, in Esther, the Jews beat the Persians. Esther and Mordecai are living in the capital of the Persian empire and are under attack by a certain high Persian official. Through a series of twisty-turny events, Esther and Mordecai avoid the persecutions of the official and win peace and prosperity for the Jews in the Persian empire. It is a story of the underdog overcoming a powerful foe. In addition, the Persian empire was the ancient version of Iran. Susa, the capital, was in modern-day Iran. Iranians speak the Persian language. And modern-day Iranians think of themselves as the heirs of the great Persian empire of ancient times.

So, the connection is rather apt, if a little obscure. Just as Esther subverted the power of the Persian empire in ancient times, so the Stuxnet worm is subverting the neo-Persian-Iranian empire in modern times.

Then there is the allusion to myrtus — which may be telling, or may be a red herring.

Several of the teams of computer security researchers who have been dissecting the software found a text string that suggests that the attackers named their project Myrtus. The guava fruit is part of the Myrtus family, and one of the code modules is identified as Guava.

It was Mr. Langner who first noted that Myrtus is an allusion to the Hebrew word for Esther. The Book of Esther tells the story of a Persian plot against the Jews, who attacked their enemies pre-emptively.

“If you read the Bible you can make a guess,” said Mr. Langner, in a telephone interview from Germany on Wednesday.

Carol Newsom, an Old Testament scholar at Emory University, confirmed the linguistic connection between the plant family and the Old Testament figure, noting that Queen Esther’s original name in Hebrew was Hadassah, which is similar to the Hebrew word for myrtle. Perhaps, she said, “someone was making a learned cross-linguistic wordplay.”

Then there is the allusion to myrtus — which may be telling, or may be a red herring.

Several of the teams of computer security researchers who have been dissecting the software found a text string that suggests that the attackers named their project Myrtus. The guava fruit is part of the Myrtus family, and one of the code modules is identified as Guava.

It was Mr. Langner who first noted that Myrtus is an allusion to the Hebrew word for Esther. The Book of Esther tells the story of a Persian plot against the Jews, who attacked their enemies pre-emptively.

“If you read the Bible you can make a guess,” said Mr. Langner, in a telephone interview from Germany on Wednesday.

Carol Newsom, an Old Testament scholar at Emory University, confirmed the linguistic connection between the plant family and the Old Testament figure, noting that Queen Esther’s original name in Hebrew was Hadassah, which is similar to the Hebrew word for myrtle. Perhaps, she said, “someone was making a learned cross-linguistic wordplay.”

One thought on “Iran, Israel, “Myrtus”, Esther and a Worm

  1. Tyone

    “Myrtus” in the Stuxnet worm most likly stands for MyRTUs, where “RTU” is “Remote Terminal Unit”. See the following white paper from Motorola, it examines RTUs and PICs in SCADA systems. http://www.motorola.com/web/Business/Products/SCADA%20Products/_Documents/Static%20Files/SCADA_
    Sys_Wht_Ppr-2a_New.pdf

    This has been brought up many times in the IT Community, but there’s too much money to be made in the News Media to allow Occams Razor to apply.

    See for example, http://cryptome.org/0002/myrtus-v-myRTUs.htm

Leave a Reply

Your email address will not be published. Required fields are marked *