Alexis Rosen's pager woke him at about 4:30 on the morning of Saturday 15 January 2005. Public Access Networks Corporation, the company he had co-founded in 1989 and New York City's oldest internet service provider, still had its servers, its connections and its thousands of customers; what it had lost overnight was its name. Visitors to www.panix.com were being shown a default page from freeparking.co.uk, and the registry's records now listed panix.com with Melbourne IT, an Australian registrar, instead of Dotster, the registrar Panix had chosen. At around one that morning, New York time, the domain's name servers had been switched to a reseller's, and mail addressed to Panix customers was going somewhere else. “When I turned on the computer, I saw we had a serious problem,” Rosen told IEEE Spectrum.
The paperwork had started about a week before, when Melbourne IT asked the .com registry to transfer panix.com from Dotster on behalf of Fibranet, a reseller incorporated on the Isle of Man that ran freeparking.co.uk, where someone had opened an account with a stolen credit card. ICANN's Inter-Registrar Transfer Policy, in force since 12 November 2004, required the gaining registrar to obtain the registrant's express authorisation; Melbourne IT had left that step to its reseller, and Fibranet never sent the confirming email to panix.com's administrative contact. The domain was not locked. Dotster, by ICANN's later account, did not ask Panix about the pending transfer, though Panix said no notice had reached Dotster at all; five days' silence counted as approval, and the transfer went through on Friday 14 January.
It was a long American holiday weekend, and neither registrar had office staff on duty that night. Panix said its registration had gone to Australia, its DNS records to Britain and its mail to Canada, made panix.net a stand-in for the lost name, and warned that passwords typed into a false site might have been captured. An engineer at Telecom Ottawa, acting on his own, pointed the misdirected mail at a nonexistent server, so that it would queue rather than be read. Rosen rang Melbourne IT's chief executive, Theo Hnarakis, at about eight on Sunday morning, Melbourne time; by Rosen's account Hnarakis, driving with his daughter, said there was nothing he could do. Melbourne IT said he had heard only that a domain had been hijacked, which it heard often.
Melbourne IT could verify the facts only once its office opened on Monday morning in Australia; at about 22:30 UTC on Sunday, half past five in the afternoon in New York, its staff put the name servers and registrant details back, more than forty hours after the switch; early on Monday 17 January Dotster requested the domain's return, and Melbourne IT approved it by hand. Bruce Tonkin, its chief technology officer, said that “there was an error in the checking process prior to initiating the transfer” and that the loophole had been closed. ICANN's security committee would later put the failure on the gaining side: the registrant's approval had been left to a reseller that never sought it, and neither a registrar lock nor a check by the losing registrar had been used. Whoever was responsible remained, IEEE Spectrum reported in February, “unknown and at large”.
The Agent's Sidekick
On 12 January 2005 SecurityFocus reported that Nicolas Jacobsen, 21, had been inside T-Mobile's servers for at least a year, able to look up any of its 16.3 million customers — Social Security numbers, dates of birth, voicemail PINs and web passwords, though not card numbers — and had read the email of a Secret Service cybercrime agent in New York who used a T-Mobile Sidekick. The trail began with T-Mobile customer data advertised on a bulletin board the Secret Service was watching in March 2004; an informant steered him onto a proxy the agents controlled, its logs placed him at a Residence Inn in Buffalo, where a call confirmed he was a guest, and his ICQ number turned up a 2001 résumé. Agents had arrested him in late October 2004. T-Mobile, which reportedly knew by July, had issued no public warning, and its spokesman declined to comment. He pleaded guilty on 15 February to a single count of computer intrusion; T-Mobile said it had notified 400 customers, and sources told Wired he had used a WebLogic flaw BEA had patched in March 2003, which T-Mobile would not discuss.
A Server Full of Faces
On Sunday 2 January 2005, during a routine review of system files, George Mason University found that someone had broken into its main ID server, the Virginia university's record of everyone who carried a campus card: names, photographs and Social Security numbers for more than 32,000 students and staff. Early signs, the university said, suggested the intruders had been in since late November, and they had installed tools to probe other campus servers. The server was taken off the network, and on Sunday 9 January Joy Hughes, vice-president for information technology, emailed the campus. “It appears that the hackers were looking for access to other campus systems rather than specific data,” she said; there was no evidence, she added, that the data had yet been used illegally, but she urged everyone to place fraud alerts with the three credit bureaus. Law enforcement and university officials were investigating, Computerworld reported on 10 January; who had broken in, the university could not yet say.
Broadband, and an Envelope
On Friday 14 January 2005 Dayanidhi Maran, the minister for communications and information technology, launched broadband from Chennai, with simultaneous launches by the state-owned carriers BSNL and MTNL in Delhi, Mumbai, Hyderabad, Bangalore and Kolkata, joined by video conference. BSNL called its service DataOne, with home plans from Rs 500 a month; MTNL's Tri Band offered 256 kbps to 2 Mbps. The two aimed at 1.5 million connections by the end of 2005 over the copper telephone lines they already had, and the government's broadband policy expected three million subscribers by then and twenty million by 2010. The regulator later counted 0.18 million broadband connections at the end of March 2005, and 8.75 million five years on.
Policing that network was another matter. A Wired News report from Mumbai on 5 January recalled that the city's cyber crime cell had seen its own new website defaced within days of its launch in 2001, and carried a security consultant's complaint about raids in which officers seized monitors and left the computers behind: police who could not afford computers of their own, he argued, were poorly placed to fight crime on them. On 23 January police in Pune arrested a software programmer accused, the Indian Express's Pune Newsline reported, of opening a bank letter that carried a colleague's internet-banking password at their office and moving about Rs 138,598 out of the account in the last days of December. The weak point was an envelope. Two decades on, fraud needs no stolen password at all: the victim is talked into moving the money, as our India desk's anatomy of the “digital arrest” sets out.
A word tree speeds up neural language models
Two papers from the tenth International Workshop on Artificial Intelligence and Statistics, held at the Savannah Hotel in Barbados from 6 to 8 January 2005, outlived the occasion. Frederic Morin and Yoshua Bengio of the Université de Montréal took on the slowness of neural language models, which had to weigh every word in the vocabulary to predict the next: they hung the words from a binary tree, shaped with help from WordNet, so that each prediction became a short chain of two-way choices. On a 10,000-word vocabulary, training ran more than 250 times faster and prediction close to 200 times faster, at a modest cost in accuracy; in 2013 the Google team behind word2vec credited them with first bringing the trick to neural language models. Miguel Carreira-Perpiñán and Geoffrey Hinton of the University of Toronto showed that contrastive divergence, Hinton's shortcut for training Boltzmann machines, was biased, but typically only slightly. On 12 January Microsoft Research opened a laboratory in Bangalore under P. Anandan, a computer-vision researcher, with multilingual systems among its first subjects.
Microsoft's anti-spyware beta and a monthly clean-up
On Thursday 6 January 2005 Microsoft posted the first beta of Windows AntiSpyware, for Windows 2000, XP and Server 2003: a repackaging of software it had bought with GIANT Company Software in December. It checked memory, files and the registry against signatures of known spyware, guarded more than 50 routes by which spyware got in, and invited users into SpyNet, a voluntary community reporting suspect programs to Microsoft. On Tuesday 11 January came the Malicious Software Removal Tool, free and pushed through Windows Update: it looked for eight families, Blaster, Sasser and Mydoom among them, removed any it found and was to return on the second Tuesday of every month. It drew on GeCAD, the anti-virus firm Microsoft had bought in 2003, and Microsoft's announcement called it “designed to augment traditional antivirus solutions” — a reassurance, one trade paper noted, to vendors nervous since that purchase. Renamed Windows Defender, the anti-spyware program reached a second beta in February 2006; the removal tool still comes out most months, at version 5.145 by September 2026.
⏳ Time capsule — January 2005
- On 1 January the United Kingdom's Freedom of Information Act 2000 came fully into force, creating a general right of access, on request, to information held by public authorities — more than 100,000 bodies, which in general have 20 working days to reply.
- On 14 January the European Space Agency's Huygens probe landed on Titan, Saturn's largest moon, at about 12:43 UTC, two and a half hours after entering its atmosphere: the first landing on Titan, the farthest from Earth any spacecraft has made, and still the only one in the outer Solar System.
- On 18 January Airbus unveiled the first A380, a double-deck airliner registered F-WWOW with typical seating for 525 passengers, at Toulouse. Production ended in 2021, when the last was delivered to Emirates on 16 December.
- On 28 January Procter & Gamble agreed to buy Gillette, the maker of Mach3 razors, Duracell batteries and Oral-B toothbrushes, in a share deal valued at about $57 billion, the largest in its history; it was completed on 1 October.
The Five Days Remain
ICANN's Security and Stability Advisory Committee reported on 12 July 2005. Fibranet, it found, had suspected credit-card fraud and locked the domain, and panix.com's mail had ended up on its default server; reports that it had gone to the hijackers were “inflammatory and uncorroborated”. ICANN's Transfer Policy still turns five days' silence from the losing registrar into approval; what changed is around it — AuthInfo codes unique to each domain, and a Transfer Emergency Action Contact at every registrar, required to answer an urgent request within hours. Later hijackers went after the accounts instead: Comcast's at Network Solutions in May 2008, The New York Times's at Melbourne IT, through a reseller's login, in August 2013, and a campaign that drew CISA's first emergency directive in January 2019.
The other stories have long tails in this archive. Jacobsen pleaded guilty within weeks of the report, but the carrier that had issued no warning in 2005 went on to disclose intrusions of another order: more than 54 million current, former and prospective customers in August 2021, some 37 million accounts through a single interface in January 2023. India's broadband fell far short of the 2004 promise, at 8.75 million connections in March 2010 against twenty million, and its frauds moved from the envelope to the video call. Panix kept its name; panix.com still leads to the company that started in 1989. Behind this edition the archive runs back through December 2004 to January 2004.