The arrests came in the last week of October 2004 — in the United States on criminal complaints, with police abroad acting alongside — and on Thursday 28 October the Justice Department explained them. A grand jury in Newark, New Jersey, had returned a 62-count indictment against 19 people accused of running ShadowCrew, a members-only website that Attorney General John Ashcroft called “a one-stop marketplace for identity theft”. Its 4,000 or so members, prosecutors alleged, had traded at least 1.7 million stolen card numbers, along with bank account numbers and counterfeit driving licences, passports and Social Security cards, with losses of more than $4 million. The department counted 21 arrests in the United States and “several” abroad; the Secret Service, which called its investigation Operation Firewall, put the total at 28, in eight states and six other countries.
The indictment described a business with ranks. Three administrators, in Arizona, New Jersey and Moscow, decided who could join and who could moderate, and kept the servers running and secure; moderators controlled what was posted about card and identity theft; would-be vendors were approved only after a review, and some members reported on testing what the vendors sold. Payments, defendants later admitted, moved by Western Union or in digital currencies such as E-Gold and Web Money. The Secret Service linked its arrests to two more groups, Carderplanet and Darkprofits. “These individuals operated a virtual trading post for stolen identity and financial information,” said Christopher Christie, the United States Attorney for New Jersey; the group, he said, was out of business.
The agency had been listening for months. Operation Firewall, run from the Secret Service's Newark field office, began in July 2003 and grew, with Britain's National Hi-Tech Crime Unit, Canadian police and Europol helping and officials in six more countries taking part; by later accounts of the case, agents came to watch the forum's traffic under court order. The agency's director, W. Ralph Basham, put the losses prevented at potentially “hundreds of millions of dollars” — the agency's own estimate, beside the more than $4.3 million that financial institutions reckoned they had actually lost. The agency did not say that one of the forum's own members had been informing for it since 2003: Albert Gonzalez, whose role became public only in 2008 and whose story August 2009 tells.
Many of the cases ended in pleas. On 17 November 2005 six defendants pleaded guilty before Judge William J. Martini in Newark, among them Andrew Mantovani, 23, of Scottsdale, Arizona, a co-founder and administrator, who admitted obtaining some 18 million email accounts with personal details in September 2004; by then, the Justice Department said, 12 of the 21 people arrested had pleaded guilty. The case outlasted the decade. Aleksi Kolarov, a Bulgarian whom the indictment named as a vendor, was arrested in Paraguay in 2011 and extradited to the United States in 2013.
The Tray That Opened
On 12 October 2004 the Federal Trade Commission announced its first spyware case, asking a federal court in New Hampshire to shut down Seismic Entertainment Productions, Smartbot.Net and Sanford Wallace. Since December 2003, the commission alleged, their websites had used a feature of Internet Explorer to download software without notice or consent. It changed home pages and search engines, set off barrages of pop-up advertisements and installed more programs, some able to track what people did; computers slowed or crashed, and some users lost data. Then the CD-ROM tray opened and a “FINAL WARNING!!” appeared: users, it said, “DESPERATELY NEED to rid your system of spyware pop-ups IMMEDIATELY!” The cure on offer, Spy Wiper or Spy Deleter, cost about $30, and the defendants took a commission. “This is our first spyware case, but it won't be our last,” said Lydia Parnes, acting director of the commission's Bureau of Consumer Protection. In May 2006 a default judgment ordered Wallace and Smartbot.Net to give up $4,089,500; in June 2016, over spam pushed through Facebook in 2008 and 2009, a federal judge in San Jose sentenced Wallace to 30 months in prison.
A Photographic Memory
On Thursday 14 October 2004 Google released a test version of Desktop Search, a free program for Windows XP and 2000 that indexed Outlook and Outlook Express mail, Word, Excel and PowerPoint files, AOL instant-messenger chats and the pages viewed in Internet Explorer. Google pitched it as a kind of photographic memory of everything seen on the computer. On a shared machine, that memory was open to the next user: because it indexed the browser's cache, a search could bring up copies of webmail and other pages an earlier user had viewed, and privacy advocates warned that it could serve as a spying tool. The index stayed on the computer, and Google said nothing in it reached Google without the user's permission. Bruce Schneier, in eWeek that November, called the worry about other users' files a nonissue, since indexing them needed administrator rights that already opened everyone's files; he blamed the browsers instead, for keeping encrypted pages in their caches at all. Google withdrew the program in September 2011.
A Key That Never Leaves
On 29 October 2004 the government notified the Information Technology (Security Procedure) Rules, G.S.R. 735(E), and tied the law's secure digital signature to a physical object. Read with section 16 of the IT Act, as the Controller of Certifying Authorities summarised them, the rules required the key pair to be created on a smart card or a hardware token with a cryptographic module of its own. The private key was to stay inside the device: the hash of the content to be signed travelled from the computer to the token and came back signed. The controller's guidance on storing keys spelt out the consequence. Only smart cards and USB crypto tokens qualified; a key kept on a hard disk, a floppy, a CD or an ordinary pen drive, from which it could be copied, did not.
The offences the Act already punished barely registered. The National Crime Records Bureau counted 68 cases under the IT Act across India in 2004, up from 60: half of them, 34, for obscene publication in electronic form, 26 for hacking, and none under its digital-signature offences; 60 people were arrested, 25 of them in Maharashtra and 16 in Tamil Nadu. Under the Penal Code it counted 279 cases with what it called “cyber tones”, down from 411 — 173 of them criminal breach of trust or fraud, 117 of those in Gujarat — and 24 of the 35 mega cities reported no cyber crime at all.
Three programs beat three grandmasters in Bilbao
From 6 to 9 October 2004 Bilbao staged the first Man vs Machine World Team Championship: three grandmasters against three programs, four games apiece. Veselin Topalov, fifth in the world rankings, Ruslan Ponomariov, a former FIDE world champion, and a fourteen-year-old grandmaster faced Hydra, on sixteen processors in Abu Dhabi, Deep Junior, the reigning computer world champion, and Fritz 8, on a Centrino notebook in the hall. The programs won 8½–3½. Hydra and Fritz scored 3½ points each, Topalov lost only to Fritz, and the humans' one win came against Junior. David Levy, president of the International Computer Games Association, which sanctioned the match, blamed thin preparation for the margin while granting that the machines were stronger. On 11 October Carnegie Mellon's Robot Hall of Fame inducted Shakey, introduced at the Stanford Research Institute in 1969 and the first mobile robot that could reason about its actions, alongside Honda's ASIMO. Two years later, in Bonn, Deep Fritz beat the world champion, Vladimir Kramnik, 4–2, in what is regarded as the last major match of its kind.
Spyware found on four home PCs in five
On Monday 25 October 2004, in the first National Cyber Security Awareness Month, America Online and the National Cyber Security Alliance, a non-profit backed by federal agencies and technology companies, published an Online Safety Study. A few hundred adults in twelve states were polled by telephone, and experts then examined the computers in their homes. More than three-quarters felt safe from online threats, yet spyware or adware turned up on four machines in five, with 93 components on the average infected computer and more than a thousand on one of them; about one in five carried a virus, and two-thirds lacked up-to-date anti-virus software. Daniel Caprio of the Commerce Department saw “quite a perception gap”. Security software was selling all the same: on 20 October Symantec reported revenue up 44 per cent, to $618 million, for its quarter to 1 October, with consumer products, half its sales, up 63 per cent. The awareness month has returned every October since, now as Cybersecurity Awareness Month.
⏳ Time capsule — October 2004
- From 5 to 7 October O'Reilly Media held the first Web 2.0 Conference at the Hotel Nikko in San Francisco, with Tim O'Reilly and John Battelle as its moderators. Renamed the Web 2.0 Summit in 2006, it met every year until October 2011, and has not met since.
- On 8 October the Nobel Peace Prize went to Wangari Maathai, Kenya's assistant minister for environment and natural resources, whose Green Belt Movement had been planting trees since 1977, for “her contribution to sustainable development, democracy and peace”. She was the first African woman to receive it.
- On 20 October Ubuntu 4.10, Warty Warthog, the first release of Ubuntu, a Linux distribution built on Debian, was offered as a free download or on CDs posted free through Canonical's ShipIt service. Its version number was its date, year and month; the scheme reached 26.04 on 23 April 2026.
- On 27 October the Boston Red Sox, who had come back from three games down to beat the New York Yankees for the American League pennant, won 3–0 at Busch Stadium in St. Louis, under a lunar eclipse, to sweep the Cardinals in four games and take their first World Series since 1918.
Watching, Then Running
ShadowCrew's methods outlived it on both sides, and the agencies moved from reading forums to running them. At DarkMarket an FBI agent kept the server for two years, and the bureau's own carding forum, Carder Profit, ended in the Card Shop arrests of June 2012 (October 2008); Dutch police ran the Hansa market for twenty-seven days, logging orders and addresses (July 2017); and in February 2024 a coalition led by Britain's National Crime Agency kept LockBit's own leak site running to publish what it had found. The trade moved on too, from forums with moderators to markets selling stolen browser sessions, like the Genesis Market the FBI seized in April 2023 (June 2021).
Spy Wiper's pitch, frighten first and then sell the cure, returned in the scareware the Federal Trade Commission stopped in a Baltimore court in December 2008 and in the rings broken up by Operation Trident Tribunal in June 2011. Google's photographic memory came back as Microsoft's Recall, a searchable store of screenshots that researchers picked apart soon after its unveiling in May 2024. And the token is still being renewed: the Controller of Certifying Authorities has told certifying authorities to stop issuing signature certificates on modules validated only to FIPS 140-2 by 21 September 2026 and to move to FIPS 140-3, while certificates already on older tokens run until they expire. eSign, meanwhile, signs with no token at all, its key made in the provider's hardware security module and destroyed after one use.