The evidence that mattered took one line of the verdict. On 6 September 2005 Reporters Without Borders published what it had found in the judgment of the Changsha Intermediate People's Court, which on 27 April had sentenced a journalist to ten years in prison for “divulging state secrets abroad”. Among the evidence, in the Dui Hua Foundation's English translation, was account holder information furnished by Yahoo Holdings (Hong Kong) Ltd., tying IP address 218.76.8.201, at 11:32:17 p.m. on 20 April 2004, to a telephone line at the Contemporary Business News office in Hunan, where he worked. The address and the time belonged to an email sent that night from his personal Yahoo! account: his notes on an official directive to the paper, written for the editor of a New York-based website.
The chain behind that line was short. China's state security authorities sent Yahoo! a document dated 22 April 2004, two days after the email, seeking information about a user and naming the suspected offence as the illegal provision of state secrets abroad, Reporters Without Borders later said. Yahoo!'s records supplied the address and the time; the address led to a newsroom. Security police took the journalist from his home in Taiyuan on 24 November 2004, and on 2 June 2005 the Hunan Higher People's Court rejected his appeal. Yahoo!'s part surfaced in the verdict's text, translated by the Dui Hua Foundation. The company's first answer was guarded: a spokeswoman, Mary Osako, said that like any other global company Yahoo! had to ensure that its local country sites “operate within the laws, regulations and customs” of the countries where they were based.
Jerry Yang, Yahoo!'s co-founder, answered more fully on 10 September at an internet forum in Hangzhou, a month after Yahoo! had bought 40 per cent of Alibaba for $1 billion. The demand had been a legal one, he said: “To be doing business in China, or anywhere else in the world, we have to comply with local law.” Asked whether the information had been crucial, he said he did not know, since Yahoo! was not told what the authorities were looking for. On 15 February 2006 Yahoo!'s general counsel, Michael Callahan, told a congressional hearing that when Yahoo! China was required to provide the information, “we had no information about the nature of the investigation.” The 2004 document had named the suspected offence. In November 2007, ahead of a second hearing, Callahan apologised to the House Foreign Affairs Committee for not having alerted it once Yahoo! learned what the document said.
On 6 November 2007 Yang, by then chief executive, and Callahan appeared before the committee. Its chairman, Tom Lantos, called the 2006 testimony inexcusably negligent at best and deliberately deceptive at worst, and told Yang to “beg the forgiveness” of the journalist's mother, who was in the room. Yang apologised to her. On 13 November Yahoo! settled, on undisclosed terms, a lawsuit brought in California by the families of the journalist and of a jailed pro-democracy writer, saying it would provide financial, humanitarian and legal support to the families and create a fund for others. In October 2008 Yahoo!, Google and Microsoft founded the Global Network Initiative, whose principles cover governments' demands for user data. The journalist was released on 23 August 2013, fifteen months early.
A Hostname of Soft Hyphens
On 8 September 2005 Tom Ferris, a researcher who published as Security Protocols, made public a flaw in Firefox and the Mozilla Suite for which there was not yet a fix. A link whose hostname consisted entirely of soft hyphens, an invisible Unicode character, crashed the browser: the code that handled internationalised domain names stripped them out, was left with an empty string and overran a heap buffer, which Mozilla said “could be exploited to run or install malware”. Mozilla's bug tracker had logged his report on the 6th, and the bug stayed hidden there until his own publication made it public. On the 9th Mozilla offered a stopgap, a preference change or a small download that switched internationalised domain names off, and CERT/CC recorded exploit code in public. Firefox 1.0.7 followed on 20 September; the advisory of the 22nd, rated critical, listed Mozilla Suite 1.7.12 as fixed too. Microsoft's monthly release on the 13th carried no security fix at all: it had withdrawn the one bulletin it had announced, rated critical, after problems late in testing.
The Relief Sites
The frauds began within days of Hurricane Katrina's landfall on 29 August 2005, and the SANS Internet Storm Center watched them arrive in the .com zone file. On 1 September it counted about 230 .com domains containing the strings “katrina” and “hurrican”, with lots of innocent ones among them, it warned, and described an email dressed as a news report whose link ran obfuscated JavaScript to download what looked like an exploit. On 8 September Attorney General Alberto Gonzales announced a newly established Hurricane Katrina Fraud Task Force, and on the 13th he told reporters that criminals had tried to profit from the disaster by posting fraudulent internet sites. A man was indicted for soliciting charitable contributions through AirKatrina.com, which claimed to be flying medical supplies into Louisiana and children out; it had taken in almost $40,000 in two days before it was shut down. By 20 October, Gonzales said, the task force had secured criminal charges against 42 people for hurricane-related fraud, among them fifteen people in California, some of them working at a call centre in Bakersfield, indicted over false claims for Red Cross payments.
A Charter for High-Tech Crime
At Interpol's 74th General Assembly in Berlin in September 2005 the director of the Central Bureau of Investigation, U. S. Misra, leading an eight-member Indian delegation, set out India's proposals, according to a CBI press note reported by The Tribune on 21 September. Countries should enact laws against high-tech crime modelled on those of the United Nations Commission on International Trade Law, so that dual criminality — an act being an offence in both countries, the condition for deportation and extradition — would be easier to establish, and sign mutual legal assistance treaties under which such offenders would as a rule be deported, and extradited only exceptionally. Developed countries should train investigators from developing ones in cyber forensics. He proposed mobile investigation units that could be sent at short notice to any country that asked, and a universal cooperation charter drafted by Interpol. India, in the paper's account, “is ideally placed to perform a nodal role in combating high-tech crimes in the Asian region”.
A treaty of that kind already existed. The Council of Europe's Convention on Cybercrime, opened for signature in Budapest in November 2001, had been in force since 1 July 2004; India has stayed outside it, saying it had no part in the drafting. A United Nations convention, adopted in December 2024 and opened for signature in Hanoi on 25 October 2025, takes effect only after forty ratifications. At home the obligations came to rest on providers: CERT-In's 2022 directions require logs to be kept for 180 days within India, as our India desk sets out.
Kurzweil dates the Singularity to 2045
Viking published Ray Kurzweil's The Singularity Is Near on 22 September 2005. Its argument was a law of accelerating returns: progress in computing, genetics, nanotechnology and robotics feeds on itself and compounds, so that machines would pass the Turing test by 2029, and the Singularity, which Kurzweil called “a profound and disruptive transformation in human capability”, would follow in 2045. Critics, the physicist Paul Davies among them, answered that exponential growth never lasts. Turing's test already had a contest of its own. Four days before publication, on 18 September, the Loebner Prize for the most human-like conversation program was decided in Hugh Loebner's apartment in New York; of four finalists, the $3,000 award went to George, a character built on Rollo Carpenter's Jabberwacky. Its most prominent critic, Marvin Minsky, called the prize a publicity stunt that did nothing for the field. Kurzweil joined Google in December 2012, and in June 2024 The Singularity Is Nearer kept both of his dates.
Symantec agrees to buy WholeSecurity
On 22 September 2005 Symantec agreed to buy WholeSecurity, a venture-backed company of fewer than a hundred people in Austin, Texas, whose website listed eBay, Deutsche Bank and Visa as customers. Products such as Norton Internet Security identified malicious software by signatures, code samples of threats already seen; WholeSecurity's software judged a program by what it tried to do, and it sold anti-phishing products too. Terms were not disclosed, but Symantec's quarterly filing later showed that the purchase closed on 5 October for $66 million in cash. Three days before the agreement, on 19 September, the eighth volume of Symantec's Internet Security Threat Report had said that attackers were turning from large attacks on network perimeters to “smaller, more focused attacks on client-side targets”, and that malicious code exposing confidential information made up 74 per cent of the top fifty samples reported to it in the first half of 2005, against 54 per cent in the previous six months. Some of WholeSecurity's technology went into Norton Confidential, which Symantec regarded in 2006 as a stop-gap.
⏳ Time capsule — September 2005
- On 6 September Antony and the Johnsons won the Mercury Music Prize, worth £20,000, with I Am a Bird Now, an album with guest appearances by Boy George and Lou Reed, ahead of nominees including Coldplay and the bookmakers' favourites, the Kaiser Chiefs.
- On 12 September eBay agreed to buy Skype, the internet telephone company based in Luxembourg, for $2.6 billion in cash and shares, with more to follow if it met performance targets. eBay sold 65 per cent of it to a group including Silver Lake and Andreessen Horowitz in 2009, and Microsoft bought the company for $8.5 billion in 2011.
- At 1 p.m. on 12 September Hong Kong Disneyland opened on reclaimed land at Penny's Bay on Lantau Island, the second Disneyland in Asia after Tokyo's, owned through a joint venture of the Hong Kong government and the Walt Disney Company.
- On 28 September the Japanese researchers Tsunemi Kubodera and Kyoichi Mori made public the first photographs of a giant squid alive in the wild, taken a year earlier by a camera on a baited line 900 metres down off the Ogasawara Islands; the animal, more than eight metres long, tore free and left part of a tentacle behind.
What a Provider Keeps
Read from 2026, the mechanics of the case are the part that has not dated: a provider can disclose only what it keeps, and which government may demand it depends on where, and through which company, it is kept. Google's announcement in January 2010 that it would stop censoring its Chinese results followed an attack that had, among other things, gone after activists' Gmail accounts. After the PRISM disclosures of June 2013, transparency reports counting government demands became an annual publication; that summer Lavabit, built so that its owner could not read stored mail, was ordered to hand over the keys protecting every account, as August 2013 records. Whose law reaches mail stored abroad became a case of its own, over a server in Dublin, as March 2014 recounts.
The month's other stories settled into routines. Mozilla's stopgap of 9 September, switching a feature off until the fix shipped, has the shape of the interim mitigations vendors still publish ahead of a patch, and disclosure before a fix became a programme in July 2006, when H D Moore published a browser flaw a day for a month. That October Internet Explorer 7 and Firefox 2 began warning users away from reported fraudulent sites. Disaster lures returned with each emergency: in March 2020 Barracuda counted coronavirus-themed spear-phishing detections rising from 137 in January to 9,116 in the first three weeks of March, and in India a counterfeit UPI handle one letter short of the PM CARES fund's was flagged within 48 hours of the fund's creation.