The letters went out in the second week of February 2005. ChoicePoint, a data broker in Alpharetta, Georgia, wrote to about 35,000 Californians because their state, alone among the fifty, required it: since 1 July 2003 California had obliged companies to tell residents when their unencrypted personal information “was, or is reasonably believed to have been, acquired by an unauthorized person.” What might have been acquired was a dossier — names, current and former addresses, Social Security and driver's licence numbers, public records and, in some cases, credit reports. Nobody had broken into anything. The company had sold the records itself, through some fifty accounts, to criminals who had applied to be its customers.
They had opened their accounts, the company said, “by using stolen identities and altered documents”, presenting themselves as small businesses with a lawful reason to look people up. On 27 September 2004 ChoicePoint found evidence of suspicious activity by a few of those small-business customers around Los Angeles, and in October it notified law enforcement there; the Los Angeles County Sheriff's Department, the FBI and the US Postal Inspection Service investigated. Under that investigation the company kept quiet until, by its account, it was cleared to tell the people affected, about two weeks before the story broke. One man, Olatunji Oluwatosin, was arrested in Los Angeles in connection with the fraud.
The letters were news within a week — MSNBC.com reported them on 14 February, when a ChoicePoint spokesman, James Lee, said “The only incident that has been confirmed is in California” — and the notion that the problem was Californian did not survive the next. Attorneys general in other states demanded that everyone affected be told, wherever they lived. ChoicePoint agreed to write to about 110,000 more people, and its annual report in March put the total at approximately 145,000 consumers “from 50 states and other territories”. Its own count reached about 162,000 by November, and the Federal Trade Commission's, when it settled with the company a year later, was higher still.
On 4 March ChoicePoint said it would stop selling products containing Social Security and driver's licence numbers except for transactions consumers had sought, fraud checks by large accredited companies, and government and law enforcement, and would re-examine all its small-business customers — “a direct result of the recent fraud activity”, said Derek Smith, its chief executive, at an expected cost of $15 million to $20 million in revenue that year. Its filing that day also disclosed an informal SEC inquiry that took in recent trading in ChoicePoint shares by Smith and Douglas Curling, its president and chief operating officer. The SEC opened a formal investigation that May; in January 2008 its staff told the company it had completed the investigation and was not recommending any enforcement action. Oluwatosin, who had pleaded no contest to identity theft that February, later pleaded guilty to conspiracy and grand theft, and on 10 February 2006 he was sentenced to ten years in a California state prison.
A Routine Bank Practice
On Friday 25 February 2005 Bank of America said it had lost backup tapes holding records of about 1.2 million charge-card accounts belonging to federal employees, missing since December. The cards were the government's SmartPay cards, used by federal staff for travel and expenses, and the Senate's were among them. “There were some senators' Visa credit card accounts involved,” said Tracy Schmaler, a spokeswoman for Senator Patrick Leahy, whose own was one. Senator Charles Schumer said he had been told that baggage handlers had probably stolen the tapes from a commercial plane; the bank would not say how they had travelled, and a spokeswoman, Eloise Hale, called shipping backup tapes “an industry practice and a routine bank practice.” Another, Alexandra Trower, said it would be “virtually impossible” for anyone who found the tapes to read them, but would not say whether the data was encrypted. Federal law enforcement, the bank said, had been told as soon as the tapes were found missing, and its investigation had found “no evidence” that they had been accessed or misused.
One Cyrillic Letter
At ShmooCon, a hacker convention in Washington, Eric Johanson of the Shmoo Group disclosed on 6 February 2005 that browsers supporting internationalised domain names would display a link to paypal.com, spelt with a Cyrillic а in place of the first Latin a, as the genuine address. Underneath it was xn--pypal-4ve.com, a different domain altogether, and the advisory warned that SSL certificates could be spoofed the same way. The idea was not new: two Technion students, Evgeniy Gabrilovich and Alex Gontmakher, had described the homograph attack three years earlier and registered a Cyrillic look-alike of microsoft.com. The Shmoo Group listed Firefox 1.0, Mozilla, Camino, Safari 1.2.5, Opera 7.54 and OmniWeb 5 as vulnerable; its demonstration worked, it said, in anything but Internet Explorer. Vendors had been told on 19 January. Opera said it believed it had implemented the standard correctly and would change nothing; Apple had not replied. Mozilla published a workaround, and on 24 February announced that Firefox 1.0.1 would show such names in their raw “punycode” form “as a temporary measure”, until registries, standards bodies and browser vendors could agree on a plan to keep them out of phishing.
A Hash Function in the Statute
India's Information Technology Act of 2000 gave digital signatures legal force and defined the hash function beneath them by what it must make computationally infeasible — among other things, “that two electronic records can produce the same hash result using the algorithm.” The Controller of Certifying Authorities, whose office opened on 1 November 2000, runs the root authority that signs the keys of India's licensed certifying authorities; in February 2005 its root certificate, “CCA India”, valid from 5 July 2002 to 4 July 2009, was itself signed with SHA-1. On Tuesday 15 February Bruce Schneier reported that Xiaoyun Wang, Yiqun Lisa Yin and Hongbo Yu, mostly of Shandong University, had found a way to produce SHA-1 collisions in about 269 operations rather than the 280 of brute force. “No one is going to be breaking digital signatures or reading encrypted messages anytime soon,” he wrote three days later — but “It's time for us all to migrate away from SHA-1.”
The paper was presented at CRYPTO that August. India moved slowly: the root issued in June 2007 was signed with SHA-1 again. On 5 August 2009 the certifying-authority rules were amended by a notification the Controller files under “MD5-SHA2-Hash Algorithms”, and the root of March 2011 was signed with SHA-256, as were those of 2014 and 2022. The collision the Act requires to be infeasible was produced in public in February 2017. The Controller's interoperability guidelines now mandate SHA-256, and on 24 August 2026 it told developers, government departments and certifying authorities that they “shall not use deprecated hash algorithms such as SHA-1 and MD5” for new signatures, document hashes or timestamps, and auditors to report any use of them.
MIT's Toddler teaches itself to walk
On 17 February 2005, at the annual meeting of the American Association for the Advancement of Science in Washington, three teams showed the walking robots described in the next day's Science. Each was a passive-dynamic walker — the kind of machine that can amble down a shallow slope unpowered — given small motors in place of gravity so that it could walk on the level. Cornell's, from Andy Ruina's laboratory, pushed off with spring-loaded ankles and used about as much energy for its weight and distance as a person; Honda's Asimo, by the researchers' estimate, used at least ten times as much. Delft's pushed at the hip with compressed air. MIT's, Russ Tedrake's Toddler, ran a reinforcement-learning program: with no prior information built into its controller, it taught itself to walk in under twenty minutes, about 600 steps, and went on adapting its gait to the ground. Tedrake later spent ten years leading robotics research at the Toyota Research Institute; in 2011 Ruina's Ranger walked 40.5 miles on a single charge.
Microsoft buys Sybari; Gates makes AntiSpyware free
On 8 February 2005 Microsoft agreed to buy Sybari Software of East Northport, New York, for an undisclosed sum. Sybari's Antigen products ran several scanning engines licensed from other vendors, Sophos, Norman, Computer Associates and Kaspersky among them, on the Exchange, Lotus Notes and SharePoint servers of more than 10,000 businesses. Gartner's John Pescatore saw Microsoft “taking aim at the enterprise server market” for the first time, though he thought companies unlikely to drop their specialist vendors soon. On 15 February Bill Gates told the RSA Conference in San Francisco that Windows AntiSpyware would be free to licensed Windows users; that Internet Explorer 7 would reach beta that summer; and that Microsoft's own engine, from the GeCAD purchase behind January's removal tool, would join Antigen's line-up and go into a consumer product by the end of the year. The deal closed on 21 June. Antigen was renamed Forefront in 2006, and its Exchange edition was withdrawn from sale on 1 December 2012, as basic anti-malware protection moved into Exchange Server 2013.
⏳ Time capsule — February 2005
- On 7 February Ellen MacArthur completed the fastest solo voyage around the world, sailing the trimaran B&Q/Castorama 27,354 nautical miles in 71 days, 14 hours, 18 minutes and 33 seconds — a day, eight hours and 35 minutes inside the record Francis Joyon had set in February 2004. The next day it was announced that she would be made a dame.
- On 9 February Hewlett-Packard said that Carly Fiorina, its chief executive since 1999, had stepped down as chairman and chief executive over differences with the board on carrying out its strategy; Robert Wayman, the finance chief, took over as interim chief executive.
- On 12 February Sania Mirza beat Alona Bondarenko 6–4, 5–7, 6–3 in the final of the Hyderabad Open, in her home city, to become the first Indian woman to win a WTA singles title.
- From 12 to 27 February Christo and Jeanne-Claude's The Gates stood along 23 miles of paths in New York's Central Park: 7,503 steel gates hung with saffron-coloured nylon. The artists put the cost at $21 million and paid it by selling their own works, preparatory drawings among them.
From One State to Fifty
ChoicePoint's letters turned one state's rule into a national habit. The Privacy Rights Clearinghouse began its chronology of data breaches that year; states began passing notification laws of their own, and since Alabama and South Dakota acted in 2018 every state has had one. A single federal standard, proposed by President Obama in January 2015, never left committee. Europe set a 72-hour clock for telling regulators in May 2018, and India's DPDP Act requires notice to the Data Protection Board and to each person affected, as our India desk explains. The trade outlived the scandal: in August 2024 a background-check broker, National Public Data, lost the Social Security numbers of people who had never heard of it.
The month's other stories ended more quietly. Mozilla's temporary measure hardened into policy: a list of registries whose anti-spoofing rules it had checked and, from 2012, a test of the scripts in each name as well, under which Latin may share a label with one other script, but not with Cyrillic or Greek. NIST wants SHA-1 retired by 2030. Bank of America's tapes, by its account at the time, showed no sign of misuse; Schumer used them to call for background checks on airline baggage handlers. And the audits the FTC imposed on ChoicePoint in January 2006 run out this year — twenty-one years after a single state's law made a data broker write its first letters.