On Thursday 9 October 2003, at Microsoft's first Worldwide Partner Conference, in New Orleans, its chief executive, Steve Ballmer, set out how the company would answer a year of worms. “Our goal is simple: Get our customers secure and keep them secure,” he said. Slammer had spread in January; Blaster, from 11 August, had used a flaw Microsoft patched on 16 July (July, August). Security patches would now be released once a month. Windows XP Service Pack 2, promised for the first half of 2004, would add protections against attacks through network ports, email, malicious web content and buffer overruns, meant to hold even where a patch was missing (August 2004).
Until then bulletins had come out on Wednesdays, as each fix was ready, with weeks skipped and urgent ones issued out of turn, which left administrators no date to plan around. A monthly release, Microsoft said, would give them a predictable date and more time to evaluate and test, and, in its white paper's words, several fixes with a “single install and single reboot”; the plan also promised, by mid-2004, fewer patch installers and 30 per cent fewer restarts. Emergencies would not wait: Microsoft kept the right to release a fix at any time. From November, regular releases would come on the second Tuesday of each month.
The first monthly release came on Wednesday 15 October, five weeks after the last regular bulletin, though an urgent fix for Internet Explorer had gone out on Friday 3 October. It held seven bulletins: five for Windows, four of them rated critical, and two for Exchange. One, MS03-043, mended a buffer overrun in the Messenger Service, which carries net send alerts: a crafted message could run code with full system privileges. It was critical on Windows NT, 2000 and XP and moderate on Server 2003, where the service was off by default, and Microsoft advised disabling it at once. The finders, the Last Stage of Delirium Research Group, had also reported the flaw Blaster used; a revised patch followed on 29 October, after the first caused problems for some customers.
The first second Tuesday fell on 11 November. Its bulletins included MS03-049, a critical overrun in the Workstation service reported by eEye Digital Security; the Windows XP fix, the bulletin explained, had already shipped inside October's Messenger patch. Not everyone was persuaded. The Register cast Ballmer's plan as the same patches made nicer, and objected that worms kept no monthly timetable. They never did, but the calendar held, and others fell in with it: SAP set its Security Patch Day to coincide, and from November 2012 Adobe's Flash updates came the same day. The day after acquired a name of its own, Exploit Wednesday, for the attacks that could follow once a patch had shown what it fixed.
The Source Tree
On Thursday 2 October 2003 Gabe Newell, Valve's managing director, confirmed on a fan site, Half-Life2.net, that source code circulating online was that of Half-Life 2, a game already late. “Starting around 9/11 of this year, someone other than me was accessing my email account,” he wrote — Valve had matched mail-server traffic against his travel — and around 19 September someone copied the game's source tree. Keystroke recorders had been installed on several Valve machines; he speculated that they were a customised remote-administration program, undetected by ordinary virus scanners, put there through a buffer overflow in Outlook's preview pane. “Well, this sucks,” he wrote, and asked players for help. Early in 2004 Axel Gembe, a German who had been 20 when he got in, wrote to Newell admitting the intrusion and asking for a job. Valve, working with the FBI's Seattle office, offered him an interview in the United States; he did not go, and German police arrested him that May. He pleaded guilty and was given two years' probation, saying he had shared the code but not posted it. Half-Life 2 went on sale on 16 November 2004.
From Host to Host
In March 2003 someone using a Diebold employee's ID number had copied 1.8 gigabytes of bulletins and internal emails, back to January 1999, from the voting-machine maker's servers. In August voting activists posted them, and Diebold, saying its copyright was infringed, sent takedown notices under the Digital Millennium Copyright Act to sites that hosted the archive or linked to it. Hosts that complied were shielded from liability. At Swarthmore College, where students had posted about 15,000 of the emails, administrators warned that their network access would be cut unless the files came down; by 22 October, when the college's paper reported their plan, the students were moving them from one computer to another with each notice. Sued by two of them and by the Online Policy Group, the non-profit provider for San Francisco's IndyMedia, which had refused its notice, Diebold told the court on 24 November that it had withdrawn its notices and would send no more over the archive. On 30 September 2004 Judge Jeremy Fogel held that it had “knowingly materially misrepresented” infringement — the first court to enforce the law's penalty for such notices — and Diebold agreed to pay $125,000 in damages and fees.
A Harbour of Its Own
In June 2003 India's IT secretary had said a draft law to protect data was ready (June). On 10 October Out-Law News, published by the law firm Pinsent Masons, relayed a Times of India report: the government was not likely to enact a data protection act as such, and might amend the Information Technology Act of 2000 instead. Its preferred route was a safe-harbour agreement with the European Union like the one the United States had, under which companies signed up to principles the European Commission accepted as adequate. The Department of Information Technology was corresponding with India's ambassadors to the EU and the United States, and Nasscom had been asked for best-practice guidelines.
The reason was commercial: the EU's 1995 directive restricted transfers of personal data to countries without equivalent protection, India had none, and its outsourcers relied on contracts with each client. No harbour came. By April 2004 Nasscom was drafting amendments to the IT Act, after which, informed sources said, India would seek recognition as adequate; in July the IT secretary, K. K. Jaswal, promised to “remove all the lacunae in laws covering the BPO” within months. The amendments took effect in October 2009. The American arrangement India had hoped to copy was struck down by the EU's Court of Justice on 6 October 2015 (October 2015), and in 2026, three years after the Digital Personal Data Protection Act, India is still not among the countries whose protection the Commission accepts as adequate.
Searching films as Google searches text
At ICCV, the International Conference on Computer Vision, in Nice from 13 to 16 October 2003, Josef Sivic and Andrew Zisserman of Oxford set out to search films as Google searched text. They clustered descriptions of image regions into visual words, dropped the commonest as text engines drop stop words, weighted the rest likewise and indexed a keyframe for every second; an object outlined in one frame of Run Lola Run was found across the film, ranked, in their abstract's words, “in the manner of Google”. Matthew Brown and David Lowe of the University of British Columbia used Lowe's SIFT features to find the panoramas among all the pictures on a flash card and stitch them unaided. On 13 October, the day PLoS Biology began publishing, it carried Duke University's report that two rhesus monkeys had learnt to steer a robot arm by brain signals alone. In 2017 both Nice papers won the Helmholtz Prize for ICCV work of lasting impact, though hand-engineered features had lost the ImageNet challenge to a deep network in October 2012.
Symantec buys beyond anti-virus; Gator becomes Claria
On Wednesday 22 October 2003 Symantec reported record revenue of $429 million for the quarter to 3 October, up 32 per cent; its consumer business, up 56 per cent, beat expectations after numerous threat outbreaks, August's among them. It was buying beyond anti-virus. On 20 October it said it had paid $26 million in cash for SafeWeb of Emeryville, California, which had closed its free web anonymiser in 2001 and now sold an appliance that let remote staff reach mail and file servers through a browser, with nothing to install. On 27 October it agreed to pay $4 a share, about $100 million, for ON Technology of Waltham, Massachusetts, whose software deployed operating systems and applications, applied patches and tracked licences; its agreement to buy Altiris in January 2007 took that course much further. On 30 October Gator, whose GAIN network served targeted advertisements to more than 38 million people, renamed itself Claria, saying the name reflected a broadened business; ClickZ suggested the move might also help the company distance itself from controversy.
⏳ Time capsule — October 2003
- On 15 October a Long March 2F rocket carried Shenzhou 5 from Jiuquan, in the Gobi Desert, with Yang Liwei, a 38-year-old lieutenant colonel and former fighter pilot, aboard. He landed in Inner Mongolia after fourteen orbits and some 21 hours, and China became the third country, after the Soviet Union and the United States, able to send people into space on its own.
- On 19 October Pope John Paul II beatified Mother Teresa in St Peter's Square, six years after her death in Calcutta on 5 September 1997; the Vatican had recognised as a miracle the healing of an Indian woman's abdominal tumour. Pope Francis canonised her on 4 September 2016.
- On 23 October the Walt Disney Concert Hall opened in downtown Los Angeles as the home of the Los Angeles Philharmonic. Frank Gehry's building had begun with a gift of $50 million from Lillian Disney in 1987 and cost an estimated $274 million; its stainless-steel skin had replaced a planned stone exterior to save money.
- On 24 October British Airways retired Concorde: G-BOAG, in from New York under Captain Mike Bannister, landed at Heathrow in sequence with two others, back from Edinburgh and from a circuit over the Bay of Biscay. Air France had flown its last commercial service on 30 May, and on 26 November G-BOAF made the last Concorde flight of all, to Bristol Filton Airport.
Still the Second Tuesday
Twenty-three years on, Microsoft still releases its fixes on the second Tuesday, and the breaks in the rhythm mark the emergencies. In January 2006 it published a fix for a metafile flaw already under attack, five days ahead of the monthly release it had promised; MS08-067 went out of band in October 2008 and still fed Conficker (January 2009); in May 2017 it patched even the long-retired Windows XP against WannaCry. The rhythm bent the other way too: February 2017's release was cancelled outright (April 2017), and Windows 7's last free fix came on the second Tuesday of January 2020. The Register's objection kept its force: SharePoint's fixes of 8 July 2025 were followed, ten days later, by attackers exploiting SharePoint anyway (July 2025).
Valve was breached again in November 2011, when intruders who had defaced Steam's forums reached a database of hashed and salted passwords and encrypted card numbers, though Valve found no evidence that any was taken. By November 2008 Gembe also faced American charges as the alleged author of Agobot, the program behind the attacks for hire told in August 2004; The Register reported that it was unclear whether the United States would seek his extradition, and the record we found goes no further. Scrutiny moved from Diebold's emails to its machines: researchers changed a mock election's count on one of its optical scanners in December 2005, and Princeton's team reported in September 2006 that code installed in as little as a minute could alter a touch-screen machine's records.