J-Com, a recruitment company from Osaka, joined the Tokyo Stock Exchange's Mothers market for young companies on Thursday 8 December 2005. It had 14,500 shares in issue, priced at ¥610,000 apiece in the flotation, and buy orders had poured in from the opening: by 9:20 the price being quoted was ¥672,000. At 9:27:56 an employee of Mizuho Securities, meaning to sell one share at ¥610,000, entered an order to sell 610,000 shares at ¥1. The terminal showed a warning, “beyond price limit”; as the Tokyo High Court later set out the facts, the employee confirmed the order by pressing Enter twice. Warnings of that kind came up from time to time, it was later reported. The order offered forty-two times as many shares as the company had.
Both sides saw it within a minute. At 9:28 an exchange official found the order, far above the 5,000 shares that marked a suspected error on Mothers. At Mizuho a colleague saw the first trade print at ¥672,000, checked with the employee and at 9:29:21 entered a cancellation, as the manual prescribed. The system answered that the order was already complete — 1,822 shares had traded — and five more attempts to cancel and three to amend failed. The exchange's surveillance chief telephoned twice to ask if it was a mistake. At 9:35:25 Mizuho told the exchange that its cancellation would not go through, and was told, in the court's account, that in principle a participant had to cancel its own erroneous order, and that the exchange was looking for a solution.
Mizuho bought its own order back between 9:35:43 and 9:37:17; eight seconds later the exchange rang to say it had decided to halt trading. By then Mizuho was left owing other buyers 96,236 shares, more than six times the number in existence, and the clearing house settled them in cash at ¥912,000 a share. Mizuho's first estimate of the loss was ¥27 billion or more; the court later put it at almost ¥40 billion. By 11 December the exchange had admitted that a fault in its own system was to blame: because ¥1 lay below the day's permitted range, the order counted as one at the lowest valid price, and the Fujitsu-built program for cancellations mishandled orders in that state. On 20 December the exchange's president, Takuo Tsurushima, said he would resign, and two other executives went with him.
Mizuho sued on 27 October 2006 for ¥41.5 billion. On 4 December 2009 the Tokyo District Court awarded about ¥10.7 billion, putting 70 per cent of the blame on the exchange for not halting trading; on 24 July 2013 the Tokyo High Court upheld the award. Its rules excused the exchange except for intent or gross negligence. The bug did not meet that bar, the High Court held, since nothing had gone wrong in over five years and the defect was not shown to have been easy to avoid or find; failing to halt trading by 9:35 did. Mizuho's 30 per cent was for the swapped figures, for no cap on order size and for no second check when a warning appeared. In September 2015 the Supreme Court refused both sides' appeals.
The Codes Kept on File
Guidance Software of Pasadena made EnCase, forensic software used, the Washington Post noted, by the Secret Service, the FBI and New York City police. Its privacy statement said the website “takes every precaution to protect our users' information.” In December 2005 Guidance found an intruder in its own network — the break-in ran until 7 December — and notified law enforcement. Its letter to customers, the Post reported, said the card numbers of 3,800 people had been taken, with expiry dates and the three-digit security codes, which it had kept unencrypted and indefinitely — both against Visa's and MasterCard's rules. The chief executive, John Colbert, told the paper that intrusions could happen to anybody, and the company said it had deleted its card data and would store no more; one customer, the Post found, had some $20,000 of Google advertising charged to his company's card. The Federal Trade Commission's complaint, issued with its order on 30 March 2007, said SQL injection through the website had begun in September and planted common hacking tools that found the card data and sent it out. The order required independent security audits every two years for ten years.
Seven Yes, One No
On Tuesday 13 December 2005, at the invitation of Ion Sancho, supervisor of elections for Leon County, Florida, researchers ran a mock election on the county's Diebold optical-scan system. Eight paper ballots, cast with the researchers Harri Hursti and Herbert Thompson looking on, answered one question, whether the machine could be hacked: six said no and two yes. Hursti had loaded the scanner's memory card with plus and minus votes, and the zero report printed before voting showed nothing amiss. The results tape read seven yes and one no, and the GEMS central tabulator, which gathers the scanners' counts, agreed. Sancho said afterwards that he would have had no way of knowing, and would have certified the result. A study for California's secretary of state found early in 2006 that the attack worked and that Hursti had “needed no passwords, no cryptographic keys, and no access to any other part of the voting system.” When HBO's documentary Hacking Democracy made the test its centrepiece in November 2006, Diebold, which had asked HBO not to show it, said the attack had “proved later to be a complete sham”. Princeton's study of a Diebold touch-screen machine followed in September 2006.
A Year in 179 Cases
When 2005 closed, India's police had registered 179 cases under the Information Technology Act, against 68 the year before — a rise of 163.2 per cent, in the count the National Crime Records Bureau published in Crime in India 2005. Eighty-eight concerned obscene material published or sent in electronic form. Seventy-four were hacking in the Act's two senses: 33 for loss or damage to a computer resource and 41 under the narrower hacking clause, 24 of those in Karnataka. Five were for breach of confidentiality or privacy. Of the 192 people arrested under the Act, 131 were aged between 18 and 30. Another 302 cases were filed under the Penal Code where a computer was involved, most of them fraud or breach of trust, and 146 came from a single city, Surat.
The geography said more than the totals. Bangalore, Chennai and Delhi accounted for 68 of the 94 IT Act cases registered in the 35 cities the bureau counted as mega cities, and 25 of those cities did not register a single cyber-crime case all year. The bureau itself noted a limit: because the Act's primary objective was “to create an enabling environment for commercial use of I.T.”, some of what criminals did with computers had been left out of it. Parliament amended it in December 2008, adding offences of identity theft and of cheating by means of a computer resource. A victim today calls the national helpline, 1930, and files a complaint at cybercrime.gov.in, as our India desk sets out — reporting routes for crimes that most of India's large cities, in 2005, never recorded at all.
Honda's faster ASIMO and LeCun's self-steering truck
On 13 December 2005 Honda unveiled a new ASIMO that ran at 6 km/h, double its predecessor's speed, and could run in a circle. Sensors and an IC card carried by visitors let it track who and where they were; with what Honda called a “total control system” it could work unaided as receptionist, guide or courier, push a cart and hand over a tray, and was to start work at Honda's Wako office in spring 2006. Honda said its research would now turn to intelligence. At the Neural Information Processing Systems conference, which opened in Vancouver on 5 December, Yann LeCun of New York University and engineers from Net-Scale Technologies described DAVE, a 50-centimetre off-road truck whose six-layer convolutional network had learned to avoid obstacles from 95,000 image pairs labelled with a human driver's steering. Honda unveiled another ASIMO in November 2011, stopped developing it in 2018 and retired it from regular shows on 31 March 2022; in 2016 Nvidia built on DAVE for DAVE-2, which learned to steer on public roads.
Heap overflows in Symantec's RAR library
On 20 December 2005 Alex Wheeler, a security consultant, published heap overflows in Dec2Rar.dll, the library Symantec's products used to unpack RAR archives. A crafted archive arriving by email or the web needed no click, only a scan, and since scanners often ran with Local System privileges, CERT/CC warned, an attacker could gain complete control. Symantec's advisory of 21 December rated the flaw high and listed Norton AntiVirus, Internet Security and SystemWorks from 2004 to 2006, the Macintosh editions, Symantec AntiVirus Corporate Edition 10 and its mail-security and scan-engine products; a heuristic LiveUpdate signature for exploits had gone out on 20 December, and fixes followed into late January. Wheeler told users to “disable scanning of RAR-compressed files” until Symantec's code was fixed. On 14 December iDefense published flaws in the management console of Trend Micro's ServerProtect, among them heap overflows that let code run with the web server's privileges; Trend, told in June, blamed Microsoft's Foundation Classes libraries. Google's Tavis Ormandy found Symantec's unpackers flawed again, in the Windows kernel, in June 2016.
⏳ Time capsule — December 2005
- On 10 December, at the Feroz Shah Kotla in Delhi, Sachin Tendulkar made 109 against Sri Lanka, his thirty-fifth Test century, passing the record of 34 that Sunil Gavaskar had held. India won the match.
- On 13 December One Laptop per Child, the project that set out to build a laptop for $100, chose Quanta Computer of Taiwan to manufacture it. Full-scale production began on 6 November 2007, and in April 2011 the price was still above $209.
- On 15 December Nature published a comparison of 42 science articles in Wikipedia and Encyclopaedia Britannica. Its reviewers found four serious errors in each, and 162 lesser errors, omissions or misleading statements in Wikipedia against 123 in Britannica, which later called the study “fatally flawed”.
- At 05:19 UTC on 28 December a Soyuz rocket launched GIOVE-A, the first test satellite for Europe's Galileo navigation system, from Baikonur. Built by Surrey Satellite Technology, its main task was to claim the frequencies the International Telecommunication Union had allocated to Galileo; it sent its first navigation signals on 12 January 2006.
A Duty to Halt
The Tokyo case left a principle: an exchange that can see an order running out of control must use its power to stop it, and can owe damages when it grossly fails to. The Financial Services Agency had ordered the exchange and then Mizuho to improve their operations, on 14 and 22 December. On 31 January 2006 the exchange adopted rules on erroneous orders that let its trading supervisor hold or halt trading in an emergency, and from 1 October 2006 brokers' order-management systems came under rules too. Its next system, Arrowhead, arrived in 2010; on 1 October 2020 it failed to switch to backup hardware and trading in every share stopped for a day. In July 2024 a single faulty update did the same to airlines, hospitals and banks.
The briefs ended in orders and successors. Guidance's order from the Federal Trade Commission has months to run — it terminates on 30 March 2027 — and EnCase has belonged to OpenText since September 2017. SQL injection, the way into Guidance, stayed in service: it was how Cl0p stole from MOVEit servers in May 2023. Marriott's time-share division said on 27 December that backup tapes holding credit-card and Social Security numbers of about 206,000 people had been missing from its Orlando headquarters since mid-November; Marriott disclosed a far larger exposure, at Starwood, in November 2018. On 27 December, too, a flaw in the way Windows drew metafiles became public; January 2006 takes up that thread.