On Tuesday 12 April 2005 Reed Elsevier, LexisNexis's parent, said a review of the previous two full years of searches had found 59 incidents in which unauthorised persons, predominantly using the IDs and passwords of legitimate customers of Seisint, its data business in Boca Raton, may have fraudulently acquired identifying information from its American risk-management databases. The number of people whose names, addresses, Social Security and driver's licence numbers may have been seen rose from about 32,000, the figure given in March, to 310,000, all of whom would be notified and offered credit reports, a year's credit monitoring and fraud insurance. Neither the LexisNexis nor the Seisint technology infrastructure “has been breached by hackers”, the company stressed.
The next morning at 9:30, in room SD-226 of the Dirksen Senate Office Building, Arlen Specter opened a Judiciary Committee hearing on securing electronic personal data. “There is no Federal legislation on the subject,” he said, and he had concluded that there needed to be. Deborah Platt Majoras, chairman of the Federal Trade Commission, speaking for herself rather than the commission, said one sensible step would be “to mandate security requirements for sensitive personal information collected by data brokers”, and that a federal duty to notify consumers was worth considering. Vermont's attorney general and officials of the FBI and the Secret Service sat on her panel. Then came the companies: Douglas Curling, ChoicePoint's president; Kurt Sanford, who ran LexisNexis's American corporate and federal business; and Jennifer Barrett, Acxiom's chief privacy officer.
Specter had the news in hand. “I am advised that LexisNexis just yesterday announced a breach of security involving some 310,000 people,” he said, and asked when Sanford had known. Sanford said an integration team had noticed “irregular billing activities” in February; “I didn't know what I had until I did an investigation, Senator.” Specter answered: “Those people are all at risk and you have a duty to notify them at the earliest possible moment.” Curling described “an organized ring of fraudsters” who had “hijacked legitimate business identities or created false business identities” to pass ChoicePoint's checks, and said it would stop selling products containing personally identifiable information unless they met one of three tests. He conceded a breach in 2001 that had never been reported. Why not? “No one was made aware of it, sir.”
Barrett described a breach two years earlier on one of Acxiom's external file-transfer servers: a person at a client's site with legitimate access had downloaded its password file, decrypted part of it and used the passwords to reach other people's data. “These are the only two breaches,” she said, and Acxiom supported “federally preemptive legislation requiring notice to consumers” when a breach put them at risk of identity fraud. When Charles Schumer read out a list of proposals, Curling and Barrett answered “yes, in general”; Sanford was more guarded. On 29 June Specter and Patrick Leahy introduced their Personal Data Privacy and Security Act, and in November the committee approved a version that would have pre-empted the more than twenty state notification laws already passed. It never became law.
Ten Dollars an Account
On Thursday 28 April 2005 police in Hackensack, New Jersey, said they had charged nine people, seven of them bank workers, over the sale of customers' account details. By the police account, the man they called the ring's leader ran a locator business from his home. He gave bank staff lists of people debt collectors wanted; they looked the names up in customer files at Bank of America, Wachovia, Commerce Bancorp and PNC and passed on the details, and were paid $10 an account. Law firms and collection agencies, police said, bought the results. The police first put the number of customers whose records had been sold at about 500,000; within weeks their count had grown to some 676,000. These were charges, not findings: when the month ended, none of the nine had been tried.
The Retailer Nobody Named
In early April 2005 HSBC North America began writing to about 180,000 holders of its General Motors-branded MasterCard, warning that criminals might have obtained their card details and that the cards would be replaced as a precaution. Neither HSBC nor MasterCard would name the merchant; MasterCard said only that the data had been taken from a retailer in the United States. On Thursday 14 April the Wall Street Journal, citing people with knowledge of the matter, named Polo Ralph Lauren. The ending is in Polo's filings with the Securities and Exchange Commission, which dated the alleged breach to 2004: in its 2005 financial year it became subject to claims from card issuers and processors over “an alleged security breach of its point-of-sale systems” at certain American stores, eventually reserved $13 million, and “ultimately paid approximately $11 million in settlement”.
The PINs That Left the Building
In early April 2005 the Pune police began arresting people over money taken from the Citibank accounts of four customers in New York: about $350,000, moved in February and March into accounts opened in Pune under fictitious names. According to the police, three former employees of the Pune call centre that MphasiS BFL ran for Citibank were among the accused: they had left the company in December 2004, having obtained the customers' PINs while working there, and the PINs were later used to order the transfers. Sanjay Jadhav, the assistant commissioner of police who led the inquiry, said one of them had been caught when he came to a bank in Pune to ask about one of the accounts.
The first reports counted twelve under arrest; by mid-April The Associated Press reported sixteen, the three former employees and thirteen associates. All were accused, not convicted. For the outsourcing industry the lesson was uncomfortable: the controls had not stopped customers' PINs leaving the building with a worker who knew them. The industry's answer, a registry of vetted outsourcing staff, followed in January 2006.
PASCAL's first benchmarks for vision and language
From 11 to 13 April 2005 PASCAL, a European Union network of excellence in machine learning coordinated from the University of Southampton, held the workshop for its first challenges there. Twelve teams had tried, in the Visual Object Classes challenge run in February and March, to find motorbikes, bicycles, cars and people in unsegmented images. In the Recognising Textual Entailment challenge, organised by Ido Dagan and Oren Glickman of Bar-Ilan University and Bernardo Magnini of ITC-irst in Trento, sixteen groups' systems judged whether the meaning of one short news text could be inferred from another. On 800 test pairs, half of them true, their accuracies fell between 50 and 60 per cent, some of the best from systems that merely matched words. A third challenge evaluated predictions' estimates of their own uncertainty. The object challenge's last run, in 2012, had twenty classes, and R-CNN was measured on its final set in November 2013; the entailment pairs, pooled with later rounds', became one of nine tasks in GLUE, the benchmark BERT lifted in October 2018.
Trend Micro stalls PCs; Spitzer sues Intermix
At 7:33 on the morning of Saturday 23 April 2005, Tokyo time, Trend Micro released pattern file 2.594.00. Code added to unpack Rbot variants compressed with UltraProtect fell into an endless loop under Windows XP Service Pack 2, holding processors at 100 per cent; some machines would not restart. The file was withdrawn at 9:02, but Internet Watch reported trouble at the Asahi Shimbun, Kyodo News and JR East, and calls from Japanese users passed 300,000. The company admitted skipping tests on XP SP2, and on 26 April Eva Chen, chief executive since January, cut her pay to 594 yen a month until the last machine was repaired. A CrowdStrike update, likewise withdrawn within about ninety minutes, would crash millions of Windows machines in July 2024. On 28 April New York's attorney general, Eliot Spitzer, sued Intermix Media, MySpace's parent, alleging its free screensavers and games installed adware without proper notice. Intermix said it did not condone spyware and had stopped distributing the programs; in June it agreed in principle to pay $7.5 million, admitting no wrongdoing.
⏳ Time capsule — April 2005
- On 2 April Pope John Paul II died, aged 84. On 19 April, on the fourth ballot of a conclave attended by 115 of the 117 eligible cardinal electors, Cardinal Joseph Ratzinger was elected and took the name Benedict XVI.
- On 6 April the Mona Lisa was moved to the Salle des États in the Louvre, a gallery whose renovation was financed by the Japanese broadcaster Nippon Television.
- On 9 April the Prince of Wales married Camilla Parker Bowles in a civil ceremony at Windsor Guildhall, a day later than planned so that he could represent the Queen at the Pope's funeral; she became the Duchess of Cornwall.
- On 10 April Tiger Woods won his fourth Masters and ninth major championship at the first hole of a play-off with Chris DiMarco, having chipped in for a birdie at the 16th in the final round.
The Duty the States Wrote
Twenty-one years on, the duty Specter described exists fifty times over, and never in the form he wanted: no general federal breach-notification law has passed, and the states wrote their own, as February records. ChoicePoint's reckoning came from the Federal Trade Commission, as January 2006 records. The industry, meanwhile, consolidated: in February 2008 Reed Elsevier agreed to buy ChoicePoint, and in 2009 ChoicePoint was merged into what became LexisNexis Risk Solutions, so two of the three companies Specter questioned that morning became one. The trade itself only widened. The broker that spilled billions of records, Social Security numbers among them, in August 2024 was one almost nobody had heard of.
The month's other stories ended in smaller print. Polo's was a line in an annual report, and the card thefts that followed at TJX and Hannaford were fought over in the same currency of reissued cards and issuers' claims. The insider with a price per record came back in July 2007, when a database administrator at Certegy sold millions of consumers' records to a data broker. India's law came later still. Section 43A of the amended IT Act, which made a company handling sensitive personal data liable for negligent security, took effect only in October 2009; under the DPDP Act a vendor that processes data on a company's instructions is a processor, and the accountability stays with the company.