On Thursday 24 April 2003 Judge John D. Bates of the federal district court in Washington ruled that Verizon must give the Recording Industry Association of America the name behind an internet address. The RIAA's subpoena, served on 4 February, sought an anonymous user of Verizon's internet service accused of offering hundreds of songs for downloading; a first one, served on 24 July 2002, had sought a subscriber said to have made more than 600 songs available through KaZaA, and Bates had enforced it in January. This time Verizon argued that the power overstepped the Constitution's limits on the courts and the First Amendment's protection of anonymous speech. Bates rejected both arguments and refused to stay either order pending appeal, giving Verizon fourteen days to ask the appeals court.
Under section 512(h) of the Digital Millennium Copyright Act a copyright owner filed three papers with the clerk of any federal district court: a notice of claimed infringement, a proposed subpoena and a sworn declaration that the name would be used only to protect copyrights. If they were in order, the clerk “shall expeditiously issue and sign” it; no judge need see it, and no lawsuit need follow. The RIAA could see a file-sharer's screen name and internet address for itself; only the provider's records could turn the address into a name and street address. Some providers, though not Verizon, might keep them only for a while, and section 512(h) said “expeditiously” eight times. A subscriber might hear nothing until the name was gone; here, at the court's urging, Verizon had told both.
Verizon, backed by 28 consumer and privacy groups and 18 providers and their associations, by the Electronic Frontier Foundation's count, warned of clerks swamped by tens of thousands of requests, of users named who had infringed nothing, and of cyberstalkers forging subpoenas to trace people they met in chat rooms. Bates called the flood “entirely speculative” and the stalker unlikely: a requester had to identify the material and where it was, which a provider could check, and risked damages, sanctions and perjury charges, and in nearly five years the record showed no such abuse. Customers, he wrote, “should have little expectation of privacy (or anonymity) in infringing copyrights”. “The privacy of Internet users has taken a big blow today,” said Cindy Cohn, the foundation's legal director.
The appeals court refused a stay on Wednesday 4 June, and Verizon then handed over the subscribers' names, still maintaining that the process gave too little protection to people who might have done nothing wrong. By September the RIAA had issued more than 1,600 subpoenas, by press counts, and on Monday 8 September it sued 261 people it called major offenders. The appeals court's reversal on 19 December, which held that the power did not reach a provider that merely carried traffic, came after the names were out. From January 2004 it sued “John Doe” defendants known only by their internet addresses, and a court had to allow the subpoenas that would name them.
The Letter Read Aloud
On Friday 11 April 2003, the day before Interz0ne 2, a hackers' conference in Atlanta, opened, Blackboard obtained a temporary restraining order against two students and the conference's organisers at an ex parte hearing they had no chance to attend. Blackboard, a Washington company whose transaction system ran campus card payments, wanted to stop Billy Hoffman, a Georgia Tech student known as Acidus, and Virgil Griffith of the University of Alabama from presenting their research on flaws in its campus ID card system, a subject Hoffman had written about in 2600 magazine. His own accounts described physically getting into Blackboard equipment on a campus. The copyright law the company's cease-and-desist letter invoked was not in its complaint, which rested on computer-security and trade-secrets laws. The organisers called it a curb on free speech; Blackboard's suit called it a matter of its trade secrets. The panel became a reading of the letter to several hundred attendees. The suit was settled in July, each student agreeing to forty hours of community service.
Caught on the Wire
On Tuesday 1 April 2003 someone attacked a server running Samba 2.2.8, the free software that lets Unix and Linux machines share files with Windows ones, and the security company Digital Defense had the packets. Reading the capture, its researchers found the hole: in the trans2open function a name supplied by the client was copied into a 1,024-byte buffer with a length taken from the input rather than the buffer, so an anonymous stranger could run code as root. They told the Samba Team on 3 April, and the team alerted other vendors the next day. The advisory, credited to Erik Parker, went out on Monday 7 April, the day Samba 2.2.8a was released and Linux distributors shipped fixed packages; the Samba Team's notes warned that an active exploit had been reported in the wild. Digital Defense also posted an exploit, trans2root.pl, on its website, and within two days another exploit for the same function was circulating on the Bugtraq mailing list. Machines with non-executable stacks resisted that exploit, and the Samba Team found three more overflows besides.
Constructive Presence
On Tuesday 1 April 2003 two judges of the Supreme Court of India, S. N. Variava and B. N. Agrawal, held that a criminal trial could take evidence by video-conferencing. Maharashtra was prosecuting a consulting surgeon who had advised an operation, carried out by another surgeon in December 1987, on a woman with terminal cancer, and wanted the evidence of a doctor at Memorial Sloan-Kettering in New York who had judged her inoperable. He was willing to testify but refused to come to India, and nothing in Indian procedure could compel him. The trial court allowed a video link in August 1999; the Bombay High Court held that section 273 of the Code of Criminal Procedure, which requires evidence to be taken in the accused's presence, ruled it out. “Advances in science and technology have now, so to say, shrunk the world,” the judges answered: section 273 “contemplates constructive presence”.
Mumbai's Chief Metropolitan Magistrate would depute an officer, preferably a judicial officer, to record the evidence at VSNL's office, with the accused, his counsel and one assistant in the studio, and to administer the oath; an officer at the witness's end would ensure “that there is no other person in the room where the witness is sitting” and that he was not “coached/tutored/prompted”. VSNL would advise on the hour, the state would pay, and the trial was to end within a year; we found no record of how it ended. The safeguards were on people and rooms, not on the link between them. Seventeen years later India's home ministry advised that Zoom was not a safe platform for officials' meetings (April 2020).
Google buys Applied Semantics; ScanSoft to buy SpeechWorks
On Wednesday 23 April 2003 Google said it had bought Applied Semantics, a Santa Monica company founded in 1998 as Oingo. Its software, for online advertising, domain names and managing corporate information, rested on CIRCA, a patented technology for extracting knowledge from websites and other repositories, and its AdSense product picked out a page's key themes so that advertisements could match them. Sergey Brin, a Google co-founder, called it an innovator in “semantic text processing”; Google bought it to strengthen the content-targeted advertising it had launched in March, and the team stayed in Santa Monica to form a Southern California development centre. No price was announced; Google's filings a year later put it at $102.4 million, $41.5 million of it in cash. The same day ScanSoft, of Peabody, Massachusetts, agreed to buy SpeechWorks International of Boston, a maker of speech-recognition, text-to-speech and speaker-verification software, in an all-share deal valued at about $132 million net of SpeechWorks' cash. Google kept the AdSense name for its own programme, and ScanSoft took Nuance's name after merging with it (May 2005).
Network Associates buys IntruVert and Entercept
On Tuesday 1 April 2003 Network Associates agreed to buy IntruVert Networks for $100 million in cash, and on Friday 4 April Entercept Security Technologies for $120 million, also in cash. IntruVert's IntruShield appliances inspected network traffic at multi-gigabit speeds and could block an attack rather than only report it; Entercept's software guarded servers, databases and applications with behavioural rules as well as signatures. It had stopped developing its own CyberCop scanning and intrusion-detection line the previous May, and The Register remarked that it was buying its way back into a market which vendors, after concern over false alerts, now called intrusion prevention. Sandra England, its head of corporate development, said customers needed defences that detected and stopped attacks before damage was done. Entercept's purchase closed on 30 April, the company citing Slammer's speed, 5,000 servers in about three minutes, though Microsoft's fix had been out six months before the worm struck (January 2003); IntruVert's closed on 14 May. Entercept's host intrusion prevention went into McAfee's VirusScan Enterprise 8.0i in 2004, and the IntruShield line, renamed, passed in time to Trellix (January 2022).
⏳ Time capsule — April 2003
- On 3 April Jean-Pierre Serre of the Collège de France was named the first winner of the Abel Prize, founded by Norway for the bicentenary of Niels Henrik Abel's birth to give mathematicians their own equivalent of a Nobel, “for playing a key role in shaping the modern form of many parts of mathematics”.
- On 13 April Paula Radcliffe won the London Marathon in 2 hours 15 minutes 25 seconds, almost two minutes inside the world record of 2:17:18 she had set in Chicago the previous October; her time stood as the record for sixteen years.
- On 14 April the Human Genome Project was declared complete, two years ahead of plan and, at about $2.7 billion, under budget. Its sequence covered about 92 per cent of the genome; the Telomere-to-Telomere consortium finished the rest in 2022 and, for the Y chromosome, in 2023.
- On 16 April Michael Jordan, who had turned 40 during the season, played his last NBA game, for the Washington Wizards against the 76ers in Philadelphia, and left to a three-minute standing ovation from both teams, the officials and a crowd of 21,257.
A Judge Before the Name
The reversal put a court back between an internet address and a name. The industry's suits went on until 19 December 2008, when it said it would stop suing file-sharers and ask internet providers to warn, then cut off, repeat offenders; by then it had sued some 35,000 people since 2003, by press counts, most of whom settled for a few thousand dollars. The question Verizon raised outlived the campaign: who holds the records that turn a number into a person. AOL's numbered search logs led reporters to a widow in Georgia (August 2006), and on 25 April 2013, ten years and a day after Bates ruled, a secret court order told Verizon's business network to hand the NSA its call records every day (June 2013).
Blackboard was not the last company to go to court over a conference talk. Cisco and Internet Security Systems sued Michael Lynn on the evening he showed a Black Hat audience how a Cisco router could be made to run an attacker's code, and an agreed injunction followed the next afternoon (July 2005); Boston's transit authority stopped three MIT students from describing its fare cards at DEF CON, though their slides had already gone out, and its suit was dismissed that December (August 2008). The ports Samba's developers told administrators to close to strangers, 139 and 445, are Windows file-sharing's ports too, and an exploit for a flaw behind them was the engine of WannaCry in May 2017.