On Wednesday 21 July 2004 Christopher Wray, head of the Justice Department's Criminal Division, announced the indictment of Scott Levine, 45, of Boca Raton, Florida, on 144 counts filed in federal court in Little Rock, Arkansas: conspiracy, unauthorised access to a protected computer, access-device fraud, money laundering and obstruction of justice. Levine effectively controlled Snipermail, a bulk emailer. He and other employees, the indictment alleged, had downloaded some 8.2 gigabytes from a server of Acxiom, an Arkansas company that stored and processed personal, financial and corporate data for its clients, to add to the lists Snipermail sold. The department said it might be the largest case of intrusion into personal data to date, and that it had no evidence the data had been used for fraud.
The way in was a contract. A sub-contract from firms working for one of Acxiom's clients gave Snipermail access to some files on Acxiom's file-transfer server in Conway, Arkansas. From about April 2002, the department said, its staff got further: they took encrypted password files, deciphered passwords from them and used those accounts to reach files that belonged to Acxiom's other clients. In 2003 an investigation involving the Hamilton County Sheriff's Office in Ohio, the Secret Service and the FBI found that Daniel Baas, systems administrator at a Cincinnati firm that did business with Acxiom, had done much the same, cracking some 300 passwords, one of which worked like a master key; he pleaded guilty on 18 December 2003. Following that case up, investigators traced a second set of intrusions to Snipermail. The downloads, the department said, ran until August 2003, and Acxiom had told law enforcement promptly once it found them.
Levine pleaded not guilty, and his trial opened in Little Rock on 11 July 2005. Prosecutors put the haul at some 1.6 billion records; the department's releases said more than a billion. A witness told of a program that deletes files so they are hard to recover, run on his laptop the morning he turned it over to law enforcement. The jury began deliberating on 10 August, and on 12 August the department announced that it had convicted him on 120 counts of unauthorised access, two of access-device fraud and one of obstruction; he was acquitted on the other counts, conspiracy and money laundering among them.
On 22 February 2006 Judge William R. Wilson sentenced him to eight years, above the advisory range of 63 to 78 months, citing an earlier civil judgment against him for violating securities law; the Eighth Circuit upheld conviction and sentence a year later. What the theft cost was never one number: the 2004 announcement had headlined a loss of more than $7 million, the pre-sentence report said $58.2 million, the government $6.8 million, and the judge, for sentencing, $850,000. No one was charged with identity theft, though some of the data, the department said, had been resold to a broker for an advertising campaign. Nine months after the indictment Acxiom's chief privacy officer described both of its breaches to a Senate committee, as April 2005 recounts.
The Fifth Ratification
On 1 July 2004 the Council of Europe's Convention on Cybercrime, opened for signature in Budapest in November 2001, came into force, the first international treaty on computer crime. It needed five ratifications, at least three of them from the Council's own members; Lithuania's, on 18 March, was the fifth, after those of Albania, Croatia, Estonia and Hungary. The larger signatories, the United States, Britain, France and Germany among them, had yet to ratify. Each party was to make crimes of illegal access to computer systems, illegal interception, interference with data and with systems, the misuse of devices, computer-related forgery and fraud, child pornography and copyright infringement; to give its authorities powers to have stored data preserved for up to ninety days, to compel its production, to search and seize it and to collect traffic data in real time; and to keep a point of contact available around the clock for the other parties. Civil-liberties groups and Europe's data-protection commissioners had criticised the secrecy of its drafting and argued that it widened police powers without requiring matching protections. India, as September 2005 records, stayed outside it.
Asking Google for Addresses
On the morning of Monday 26 July 2004 a new MyDoom, called O by Sophos and M by Symantec, Trend Micro and Kaspersky, began arriving in mailboxes in force, posing as a bounced message or as a notice from the recipient's internet provider about spam. Like other mass-mailing worms it mailed itself to addresses found on the infected machine; then, for each domain among them, it asked Google, Yahoo!, Lycos and AltaVista for more, and strings in its code suggested it could decode addresses disguised with “at” and “dot”. Google and Lycos “experienced significant problems as a result of the large number of queries”, Johannes Ullrich of the SANS Internet Storm Center wrote, though he saw no evidence that this was the worm's purpose. Google said its site had slowed for a short period and was at no point significantly impaired; by the afternoon, The Register reported, searches were running smoothly again, on the day Google set out the price range for its flotation. The next day Symantec reported a worm, Zindos, using the backdoor MyDoom left behind to aim traffic at microsoft.com. The original MyDoom is told in January.
Beyond the Scope of Monitoring
On 9 July 2004 the Ministry of Communications said that officials of the Department of Telecommunications, VSNL and BSNL, with the Punjab Police, had unearthed two clandestine telephone exchanges in Jalandhar and other parts of Punjab. They took international calls arriving over the internet and passed them on to local telephone networks, bypassing the licensed international long-distance operators. A single ISDN number gave them away: it appeared on the caller-identification display of an incoming international call, and call records showed it dialling numbers across Jalandhar and other parts of Punjab. Raids at the Lotus Tower and the World Trade Center in Jalandhar found switching equipment, telephone connections, wireless-in-local-loop phones and GSM SIM cards, with internet leased lines terminating at both.
The ministry counted two harms: lost revenue for the operators, and a security risk, because calls routed through such exchanges, it said, lay beyond the monitoring of the security agencies. Police registered cases under the Indian Telegraph Act and the Penal Code and were probing the accused's links with other Indian and foreign partners; the release named no one, and how the cases ended is not in any record this edition could find. The disguise outlived the exchanges. By 2024, the Department of Telecommunications said, criminals abroad were making calls that displayed Indian numbers, some of them to stage the fake “digital arrests” our India desk describes; on 22 October 2024 it launched a system that, by its count, identified and blocked about 1.35 crore such calls in its first 24 hours, 90 per cent of incoming international calls bearing Indian numbers.
Kernels in Banff, commutes in San Jose
The twenty-first International Conference on Machine Learning met in Banff, Alberta, from 4 to 8 July 2004, sharing the town with conferences on learning theory and on uncertainty in AI. It received 368 submissions and accepted 118. An honourable mention for its outstanding paper award went to Francis Bach, Gert Lanckriet and Michael Jordan, whose algorithm let support vector machines learn how to weight several kernels, their measures of similarity, much more efficiently than general-purpose optimisation toolboxes could; in 2014 ICML gave the paper its ten-year award. At AAAI-04, held at the San Jose Convention Center from 25 to 29 July, 120 of 453 submitted papers were accepted, and the outstanding paper award went to Lin Liao, Dieter Fox and Henry Kautz of the University of Washington. Their hierarchical Markov model learned a person's usual destinations and ways of travelling from a wearable GPS unit's logs, without hand-labelling, and could tell when its user had missed the usual bus stop; the motivating application, they wrote, was guiding cognitively impaired people safely and independently through their community.
Sasser lifts Symantec, which buys a spam throttle
On 21 July 2004 Symantec reported a record quarter: revenue of $577 million in the three months to 2 July, 48 per cent more than a year earlier. Its consumer business, more than half the total, had grown by 79 per cent, and Greg Myers, the chief financial officer, said the outbreak of Sasser “had a powerful impact on our consumer channel”. Earlier in the month, on 12 July, TurnTide, a start-up in Conshohocken, Pennsylvania, had disclosed in a notice on its website that Symantec had bought it; Symantec issued no press release, though a spokesperson confirmed the all-cash deal, reported at $28 million. Spun out of the ePrivacy Group that year, TurnTide had launched its first anti-spam router only in February. Rather than judge each message, it watched traffic flows and cut the bandwidth available to machines identified as sending spam, slowing them instead of blocking them. The throttling went into the Mail Security 8160, an appliance Symantec showed in January 2005 that rationed each sending address's bandwidth by its history of spam.
⏳ Time capsule — July 2004
- On 1 July, at 02:48 UTC, the Cassini spacecraft, launched in October 1997, entered orbit around Saturn after passing through the gap between the F and G rings, the first spacecraft to orbit the planet. It studied Saturn for thirteen years, until it was sent into the planet's upper atmosphere on 15 September 2017.
- On 4 July, at the Estádio da Luz in Lisbon, Greece beat the hosts, Portugal, 1–0 in the final of Euro 2004 before 62,865 spectators, Angelos Charisteas heading in a corner in the 57th minute. It was Greece's first title, at only its second European Championship, and a rematch of the tournament's opening game.
- On 16 July Chicago opened Millennium Park, four years behind schedule, on ground once taken up by Illinois Central rail yards and parking lots; some 300,000 people came to three days of opening celebrations, and Anish Kapoor's Cloud Gate, 168 stainless-steel plates welded together, was unveiled that weekend.
- On 21 July, at the 17th International Conference on General Relativity and Gravitation in Dublin, Stephen Hawking argued that black holes eventually give back, in garbled form, information about what they swallow, and conceded the bet he and Kip Thorne had made with John Preskill in 1997, paying him with a baseball encyclopedia; Thorne did not concede.
Records by the Billion
Acxiom's file-transfer server was an early entry in a long ledger. The marketing-data trade kept losing records in quantities only it could count: Epsilon's email system in April 2011, with an indictment four years later over more than a billion addresses taken from it and other providers; Exactis, a Florida marketing broker, with some 340 million records on an open server in June 2018; National Public Data, whose leaked files a seller claimed held 2.9 billion records, bankrupt within weeks in August 2024. A partner's access remained a way in: a refrigeration contractor's stolen credentials were named as the route into Target in February 2014. Acxiom itself was split in 2018, when Interpublic agreed to buy its marketing business for $2.3 billion and the rest became LiveRamp.
The month's other beginnings lasted. The Convention that came into force on five ratifications has more than eighty parties in 2026, the United States having ratified it in 2006; India is still not among them. Search engines stayed in attackers' kits: in December the Santy worm found vulnerable forums through Google, and when Google blocked its queries, variants turned to other engines; MyDoom's own code was reworked for the floods of July 2009.