On Thursday 17 March 2005 the Financial Times and the BBC reported that Britain's National Hi-Tech Crime Unit had been investigating, since October, an attempt to steal £220 million from the London office of Sumitomo Mitsui Banking Corporation by sending it electronically to ten accounts abroad; key-logging was said to have supplied the passwords. No money had moved. In Israel, it was reported, police had arrested a man after an attempt to put about £13.9 million into an account there. From Tokyo the bank said it had taken various security measures and had suffered no financial damage.
How the logger got there was the question. The unit would not say whether an insider or outside hackers had planted it, and in April reports citing unnamed sources said that cleaners had plugged hardware key-loggers into the bank's computers. The trial told it differently four years later, as reported from the courtroom. In September 2004 the bank's security supervisor, Kevin O'Donoghue, had let two men into the City office after hours more than once; when a colleague asked, he said they had come to play poker late at night. From a USB stick they installed iOpus Starr, commercial monitoring software that no anti-virus flagged, and it captured two sets of SWIFT log-ins: an ordinary user's, and the supervisor-level account needed to authorise a payment.
They came back on the evening of Friday 1 October 2004 and keyed in ten transfers from the accounts of customers including Toshiba International and Nomura Asset Management, bound for Spain, Dubai, Hong Kong, Turkey and Israel. None went through, and neither did larger sums tried the next day for Liechtenstein and Singapore: each time, one field of the SWIFT form had been filled in wrongly. On Monday staff found computers tampered with and cables disconnected, and the bank called the police; the tampering and the CCTV footage soon showed that something was wrong. A Belgian fraud-squad official identified the two, and Poelvoorde was arrested at Brussels Airport with a USB stick carrying the same key-logger.
It ended at Snaresbrook Crown Court in 2009. O'Donoghue and the hackers, Jan Van Osselaer and Gilles Poelvoorde, had admitted conspiracy to steal. A jury convicted Hugh Rodley, 61, a self-styled lord of the manor who had presided over the front companies and accounts meant to receive the money, of conspiracy to defraud and conspiracy to transfer criminal property, and David Nash, who had fronted some of the accounts, of the second charge; CCTV footage had shown O'Donoghue laughing and joking with the two hackers. On 5 March Rodley was jailed for eight years, Nash for three, O'Donoghue for four years and four months, Poelvoorde for four and Van Osselaer for three and a half. Of the £229 million counted at trial, none was lost.
The Applicants Who Looked
At 12:15 a.m. on Wednesday 2 March 2005 an anonymous poster on BusinessWeek Online's technology forum explained how applicants to business schools using ApplyYourself, an admissions system from a company in Fairfax, Virginia, could learn their fate weeks early: log in, copy an identification number from the source of the page, and paste it into another web address. The hole stayed open for more than nine hours. ApplyYourself said it was closed by 9:45 that morning and that nobody could reach anyone else's file; most who tried saw blank screens, though some Harvard applicants saw a decision. On Monday 7 March Harvard Business School's dean, Kim Clark, said 119 had tried, called their conduct unethical at best and a serious breach of trust that no rationalisation could answer, and said none would be admitted. MIT's Sloan School turned away its 32, and Carnegie Mellon and Duke took the same line. Dartmouth's Tuck School weighed its 17 one by one and admitted some; Stanford heard out its 41 and, on 1 April, said none had got in. Orin Kerr, writing on the Volokh Conspiracy, thought “no one hacked into anything.”
Thirty-Two Thousand, for Now
On Wednesday 9 March 2005 Reed Elsevier said that someone using the IDs and passwords of legitimate customers had been searching Accurint, a database run by Seisint, the Florida company its LexisNexis division had bought the year before for $775 million. Accurint sold reports that could carry a Social Security number, past addresses and a date of birth. The names, addresses and Social Security and driver's licence numbers of about 32,000 people had been exposed, the company said, but no credit histories, medical records or financial information. The company said the misuse had come to light in a review of Seisint's security, and that the FBI and the Secret Service were investigating. On 3 March, after ChoicePoint, Senator Bill Nelson of Florida had introduced a bill to regulate data brokers. After the markets closed the day before, the parent company of DSW Shoe Warehouse had said that card and purchase data had been stolen from 103 of its 175 stores, mostly over the previous three months, and that fraud had followed.
Phishing in Nasscom's Name
On 2 March 2005 the Delhi High Court granted Nasscom, the software and services industry's association, an ex parte injunction against an employment agency, and the same day a local commissioner appointed by the court recovered two hard disks holding the offending emails from the defendants' premises. To gather personal data it could use for head-hunting, the suit alleged, the agency had been sending emails to third parties in Nasscom's name; two of the defendants named turned out to be identities invented by an employee of another. The case never came to trial. On 23 March Justice Pradeep Nandrajog decreed it on the terms of a compromise — an acknowledgement that the employees' illegal action had violated Nasscom's rights, ₹16 lakh in Nasscom's favour, a permanent injunction, the disks handed over — and, because the facts required it, wrote a reasoned order.
“I find no legislation in India on ‘phishing’,” he wrote. Citing an American article dated six days earlier, he described phishing as a fraud in which personal data is extracted by “a person pretending to be a legitimate association such as a bank or an insurance company”, and held that in Indian law it was a misrepresentation made in the course of trade, leaving recipients confused about an email's source: “It would also be an act of passing off.” Whether the law should go further he left for another case. Commentators have since called it the first Indian case in which phishing was held to be an illegal act.
Palm's founders start Numenta; robots staff Aichi's Expo
On Thursday 24 March 2005 Jeff Hawkins and Donna Dubinsky, who had founded Palm Computing and Handspring, announced Numenta, a company to turn the theory of the cortex in On Intelligence, Hawkins's book with Sandra Blakeslee, into a new kind of computer memory for pattern recognition and machine learning. Dubinsky would run it, with Dileep George, a Stanford doctoral candidate, as principal engineer, while Hawkins stayed on as palmOne's chief technology officer; commercial products, she said, “may take several years”. The next day Expo 2005 opened at Nagakute, east of Nagoya, where robots were to work among the public with no fences between them. NEDO, a research arm of Japan's trade ministry, had chosen eight kinds: cleaners, security guards, child-minders, a self-driving wheelchair and receptionists, among them Actroid, a lifelike android that spoke four languages. Toyota's Partner Robots made their debut there as an eight-piece band, trumpets included. Two decades on, Hawkins's work on the cortex continues in the Thousand Brains Project, begun at Numenta and now an independent non-profit, part-funded by the Gates Foundation.
BlackLight hunts rootkits; the FTC targets Spyware Assassin
On 10 March 2005 F-Secure released an evaluation version of BlackLight, a detector for rootkits, the cloaks that hide a program's processes, files and settings from Windows and from anti-virus software. Mikko Hyppönen said it would go into F-Secure's consumer and corporate products. Not everyone was convinced. Jamie Butler, who wrote the FU rootkit, conceded that F-Secure had beaten it for now and promised a better technique; Symantec's Al Huger said any rise in rootkit infections was “not significant enough to warrant attention”. BlackLight went on to ship in F-Secure Internet Security 2006, and in November a rootkit turned up in the copy protection on Sony BMG's CDs. The Federal Trade Commission, meanwhile, turned to spyware. On 7 March its staff, reporting on a workshop, urged tougher prosecution of spyware's distributors under existing laws; on 11 March the commission announced a restraining order against the Spokane marketer of Spyware Assassin, a $29.95 removal program whose free scan, it alleged, found spyware even on clean computers. The company settled in January 2006 for $76,000.
⏳ Time capsule — March 2005
- On 6 March Narain Karthikeyan started the Australian Grand Prix in Melbourne for Jordan, the first Indian to race in Formula One. He qualified twelfth and finished fifteenth, two laps down; Giancarlo Fisichella won from pole position for Renault.
- On 22 March NASA announced that its Spitzer Space Telescope had become the first to capture light directly from planets orbiting other stars — two hot Jupiters, HD 209458b and TrES-1, each at least 1,000 kelvin — teased out by measuring each system's infrared light and then the star's alone while the planet passed behind it.
- On 24 March Sony's PlayStation Portable went on sale in North America at $249, more than three months after its launch in Japan; Sony said 500,000 had been sold in the first two days.
- On 26 March Doctor Who returned to BBC One with “Rose”, written by Russell T Davies, with Christopher Eccleston as the Doctor and Billie Piper as Rose Tyler — the first episode since a 1996 television film, and sixteen years after the original series ended. Counting recordings watched within a week, 10.81 million saw it.
What Stopped the Money
Had it worked, it would have been the largest bank raid ever attempted; its lessons were unglamorous. The logger was legitimate software, the way in was a man employed to keep intruders out, and the April story of cleaners and hardware bugs was wrong. The unit that took the bank's call was absorbed into the Serious Organised Crime Agency on 1 April 2006, and that agency gave way to the National Crime Agency in 2013. The method outlived both. In February 2016 thieves holding Bangladesh Bank's own SWIFT credentials sent orders worth about $951 million, and a misspelt payee stopped only some of them. SWIFT's customer security programme followed that May. Sumitomo had been saved by a form, Dhaka partly by a typo.
The briefs ended as precedents. LexisNexis's 32,000 became about 310,000 in April. The Federal Trade Commission's settlement of 1 December 2005 counted about 1.4 million cards and 96,000 checking accounts compromised at DSW, and bound it to independent security audits every other year for twenty years. The business schools' question — whether editing an address to read a page is breaking in — came back with AT&T's iPad page in June 2010, and was left unanswered in so many words when that case ended. The Delhi ruling has the plainest ending: the amendments to the IT Act passed in December 2008 made cheating by personation using a computer resource an offence, punishable by up to three years in prison — the statute Justice Nandrajog had looked for and not found.