On Tuesday 1 July 2003 a law signed the previous September came into force in California, the first in any state to require that a breach be disclosed to its victims. Any state agency, and any person or business conducting business in California, that owned or licensed computerised personal information had to notify any resident whose unencrypted personal information “was, or is reasonably believed to have been, acquired by an unauthorized person”, and to do so “in the most expedient time possible and without unreasonable delay”. Personal information meant a first name or initial and a last name with a Social Security number, a driver's licence or state identity-card number, or an account or card number plus any code or password that would open the account. Encrypted data was exempt.
On 5 April 2002 an intruder reached State Controller files at the Stephen P. Teale Data Center in Rancho Cordova holding the Social Security numbers, last names, initials and payroll deductions of as many as 265,000 state workers, from judges and politicians to clerical staff, by the Sacramento Bee's account — the governor and state legislators among them, the Daily Journal later noted. The intrusion was found on 7 May; the workers were told on 24 May. The controller's office said it had shut off the computers and called in the Sacramento Valley Hi-Tech Crimes Task Force the day it found the breach, and that the task force had advised against telling the public, which would hamper its investigation. Whether anything had been downloaded, nobody knew.
Steve Peace, a Democratic state senator — who had co-written and produced the film Attack of the Killer Tomatoes — announced a hearing on 28 May. His vehicle was SB 1386, a minor public-records bill he had introduced in February; on 6 June he rewrote it in the Assembly as a duty to disclose breaches, and Assembly Member Joe Simitian became its principal co-author. The Assembly passed it 78 to 0 and the Senate agreed 39 to 0, “over strong objections from industry groups”, SecurityFocus reported, and Governor Gray Davis signed it on 25 September 2002. It kept the controller's excuse, with a limit: notice could wait while a law-enforcement agency judged it would impede a criminal investigation, and no longer. Peace, term-limited, left the Senate that November.
How far it reached was argued before it began. Scott Pink, deputy chair of the American Bar Association's cybersecurity task force, called it “revolutionary” and told a trade group's conference call that selling to Californians would probably count as doing business there: “Many, many companies outside California are likely to be governed by this law.” Nor did it say how strong the encryption had to be. In November 2003 Wells Fargo wrote to every customer whose details had been on computers stolen from an analyst's office in Concord, and offered to pay for credit monitoring, more than the California law itself required. San Diego State wrote to 178,000 people in March 2004; ChoicePoint's letters made breaches national news in February 2005.
Too Dangerous
On Wednesday 16 July 2003 Microsoft published MS03-026, rated critical: a buffer overrun in the part of Windows' RPC service that handled DCOM activation requests let an attacker sending it a malformed message run code with Local System privileges, on Windows NT 4.0, 2000, XP and Server 2003. The finders, the Last Stage of Delirium Research Group, four researchers in western Poland, kept their exploits to themselves, judging them too dangerous to publish. The day before, the Department of Homeland Security had announced a five-year, $90 million agreement for Microsoft software on some 140,000 desktops. On 17 July Todd Sabin of BindView pointed out that ports 139, 445 and 593 reached the flaw as well as 135; Microsoft revised its bulletin the next day. On 24 July the department's National Cyber Security Division (June) warned of potential for significant impact on internet operations. On 25 July Xfocus, a Chinese group, posted working code; by the end of July, the department said, several working exploits were in wide circulation. Blaster came on 11 August (August).
Two Sleepless Nights
The same Wednesday Cisco warned that almost any device running its IOS software could be stopped from afar. A sequence of crafted IPv4 packets sent to the device itself — protocols 53, 55 or 77 with a time-to-live of 0 or 1, or 103 where PIM was not running — filled an interface's input queue. The interface then stopped processing inbound traffic, routing protocols could drop as their timers ran out, and only a reboot cleared it; the device would not reload on its own. IPv4 processing was on by default and needed no authentication, though traffic merely passing through could not do it. Cisco offered fixed software free of charge and had given top-tier backbone providers three days' notice, GCN reported: at one backbone, staff spent two days and two sleepless nights upgrading and were halfway through when the flaw went public. On 18 July CERT/CC reported an exploit posted publicly. The SANS Internet Storm Center heard of its use in some attacks but saw nothing widespread, and attributed sporadic outages to operators upgrading routers.
A Network on Hold
On 3 July 2003 Arun Kumar, who ran BSNL's Jammu and Kashmir circle, told reporters in Jammu that a mobile network the operator had spent Rs 60 crore building was standing idle, ready for all fourteen district headquarters and the Jammu–Srinagar highway. A launch set for 27 April had been put on hold, he said, by telephoned orders three days before. Of sixteen departments whose clearance was needed, only the Defence Ministry was holding out, over the frequencies. The Cabinet Committee on Security had cleared the service on condition that the ministry monitor it; that, Kumar argued, was delicate, since under the telegraph law a telephone could be monitored only on the written order of the state's Home Secretary.
On 15 July the chief minister, Mufti Mohammad Sayeed, said after meeting George Fernandes that he had “a clear indication from the Defence Minister” that clearance would come. The Home Ministry had cleared the service; the Army, The Tribune reported, objected that the network's frequencies lay very close to those of its own wireless network, wanted more spectrum and feared the phones would become a weapon for militants. Final clearance rested with the same committee. When bookings opened on 18 August the terms were post-paid connections only, SIM cards by computerised draw and no service within 10 kilometres of the international border; under existing rules, BSNL said, the central or state governments could authorise security agencies to intercept particular subscribers' calls. The chief minister launched the service in Srinagar on 20 August, making the inaugural call by video link to Prime Minister Atal Bihari Vajpayee in New Delhi. Sales of prepaid connections there were halted in November 2009, and the Valley's networks fell silent in August 2019.
Robot football in Padua; parsing without head words
From 2 to 11 July 2003 Padua hosted RoboCup's seventh world championship, with more than two hundred teams. Cornell won the small-size league, its fourth world title, beating the University of Queensland's RoboRoos 1–0 with a goal in the second sudden-death period; its coach, Raffaello D'Andrea, called the win “by far the sweetest of all”, and that year co-founded what became Kiva Systems, which Amazon bought in 2012. Amsterdam's UvA Trilearn beat China's TsinghuAeolus 4–3 in the simulation final, and the University of New South Wales won the league for Sony's four-legged robots, their walk sped up by automatic gait optimisation. In Sapporo, where the Association for Computational Linguistics met from 8 to 10 July, one of two best papers, by Stanford's Dan Klein and Christopher Manning, showed that a parser which did not mark phrases with their head words, relying instead on simple, linguistically motivated splits of its grammar's categories, could beat the early lexicalised models and come close to the best; the Stanford Parser still cites it for its PCFG model.
Bono's spyware bill; Virginia's spam felony
On Friday 25 July 2003 Representatives Mary Bono, a California Republican, and Edolphus Towns, a New York Democrat, introduced the Safeguard Against Privacy Invasions Act. It directed the Federal Trade Commission to forbid sending spyware, software that could report on a computer's use or user over the internet without the user doing anything, unless the user expressly consented after a clear and conspicuous request; some breaches would carry up to a year in prison. Renamed the SPY Act, it passed the House 399 to 1 in October 2004 and again in May 2005, but the Senate never acted. Virginia's law giving large-scale spammers who forged routing information up to five years in prison had taken effect on 1 July; a jury convicted under it in November 2004, and the state's Supreme Court struck it down in 2008. Vendors' quarters diverged: on 16 July Network Associates reported revenue of $216.6 million, below the year before, and a $1.1 million profit; on 23 July Symantec reported $391 million, up 24 per cent, with consumer revenue up 35 per cent.
⏳ Time capsule — July 2003
- From 5 to 27 July the Tour de France marked its centenary with a 3,427-kilometre race that had stage finishes in Lyon, Marseille, Toulouse, Bordeaux, Nantes and Paris, the towns of the first Tour in 1903. Lance Armstrong finished first, 61 seconds ahead of Jan Ullrich; in October 2012 the UCI endorsed his disqualification from every result since August 1998 and named no other winner.
- On 15 July the Mozilla Foundation was set up to carry on the Mozilla project Netscape had begun in 1998, as Netscape's owner, AOL, scaled back its involvement; AOL gave $2 million over two years, hardware, intellectual property and a three-person team on loan for three months, and Mitch Kapor gave $300,000.
- On 27 July Bob Hope died of pneumonia at his home in Toluca Lake, California, two months after his hundredth birthday. He had hosted the Academy Awards a record 19 times and made 57 tours for the USO between 1941 and 1991.
- On 30 July, at 9.05 in the morning, the last original Volkswagen Beetle, the Type 1, came off the line at Puebla in Mexico, ending a run of 21,529,464 built since 1938; Volkswagen had marked the end with a final series of 3,000, the Última Edición.
The Letters Kept Coming
Every state has had a notification law since Alabama and South Dakota passed theirs in 2018, but Congress never passed a general one (April 2005), though Senator Dianne Feinstein had offered one patterned on California's. Any business writing to more than 500 Californians must send a sample of the letter to the state's attorney general, and under California's Consumer Privacy Act, signed in June 2018, a company whose customers' data is stolen can face class actions for statutory damages of $100 to $750 per resident and incident. Encrypted data needs no notice under many state laws; federal agencies were asked to encrypt mobile computers after the theft of veterans' records in May 2006. India's DPDP Act requires notice of a breach to the Data Protection Board and to each person affected.
Microsoft's flaw set the other pattern this archive keeps finding: an advisory, working code within days, then a worm for every machine left unpatched. After Blaster, Microsoft's MS03-039 of 10 September, for further holes in the same RPC service, superseded the July fix. Windows XP's firewall was switched on by default in August 2004; MS08-067 and Conficker ran the sequence again in January 2009, and WannaCry came eight weeks after its patch (May 2017). Routers stayed the harder case, rarely watched and patched on their makers' schedules, as the warnings of April 2018 found. When Blaster arrived, the patch that would have stopped it had been on Microsoft's site for twenty-six days.