AOL's research division put the file on its research site on Friday 4 August 2006: a 439-megabyte download holding, by the company's own figures, about twenty million search queries typed between March and May by roughly 658,000 subscribers, with a record of whether each searcher clicked a result, which one, and where it sat on the page. That was about a third of one per cent of the searches on its network in the period, AOL said, all made in the United States through its software, and nothing personally identifiable had been supplied with them. Each screen name had been replaced by a number. The number did the one thing a name would have done: it kept each person's searches together. On the Sunday evening AOL took the page down; copies were already circulating.
On Monday 7 August AOL's spokesman, Andrew Weinstein, called the release a mistake, an attempt to reach out to academics that had not been properly vetted, apologised, and announced an internal investigation. By then the file was being read for what it said about people. Some queries contained addresses, telephone numbers and, in some cases, Social Security numbers; programmers built websites for searching the whole collection, and bloggers claimed to have matched numbers to people. On 9 August The New York Times showed how little that took. User No. 4417749 had searched about numb fingers and about a dog that urinated on everything, for landscapers in Lilburn, Georgia, for homes sold in a subdivision in the same county, and for several people who shared one surname.
Michael Barbaro and Tom Zeller Jr. followed that trail to a 62-year-old widow in Lilburn, and when a reporter read part of the list to her she said: "Those are my searches." She agreed to be identified; she is not named here. The file could also mislead: her searches about hand tremors, dry mouth and nicotine were for friends whose ailments she looked up to reassure them. Weinstein apologised to her specifically and said there was little the company could do. She said she would cancel her subscription. On 14 August the Electronic Frontier Foundation asked the Federal Trade Commission to investigate and to make AOL notify the people in the file.
The departures became public on Monday 21 August. Jonathan Miller, AOL's chairman and chief executive, told staff that Maureen Govern, the chief technology officer, who oversaw the division responsible, had decided to leave effective immediately; a researcher and the manager responsible for the research were dismissed, according to reports citing an insider. Miller promised tighter limits on employees' access to data and a task force on privacy and data retention, to review how long search data should be kept. A class action in the federal court at Alexandria, Virginia, ended in a $5 million settlement, tentatively approved by the judge only in December 2012: up to $100 for a member who believed the searches had identified them, up to $50 for one who believed in good faith that their queries were included.
Two Arguments in Las Vegas
Black Hat USA met at Caesars Palace, Las Vegas, on 2 and 3 August 2006. On the Wednesday David Maynor of SecureWorks and Jon Ellch, a student at the US Naval Postgraduate School, showed a video of a MacBook taken over from a neighbouring laptop through a flaw in a wireless device driver, and Maynor said the flaw was not necessarily Apple's. Whose it was became the argument: SecureWorks said a third-party driver had been used, and Apple said it had been shown no evidence its machines were exposed, then on 21 September patched overflow flaws in its own AirPort driver, crediting an internal audit — a quarrel the Month of Apple Bugs would cite. On the Thursday Joanna Rutkowska of Coseinc showed Blue Pill, which used AMD's virtualisation extensions to slide a running Windows Vista into a virtual machine under a thin hypervisor, without a restart; in June she had called it one hundred per cent undetectable. Within days Anthony Liguori, an IBM engineer on the Xen hypervisor, disputed that in an interview, and a contest to settle it at Black Hat 2007 fell through over her request for $384,000.
Four Days From Patch to Bot
Microsoft's twelve bulletins of Tuesday 8 August 2006 led with MS06-040, an unchecked buffer in the Server service, the part of Windows that shares files and printers, rated Critical on every version listed from Windows 2000 to Server 2003. The flaw had been reported privately, but the bulletin conceded it was already being exploited. The SANS Internet Storm Center wrote that day that it could be developed into a worm; on 9 August the Department of Homeland Security took the unusual step of a press release urging Windows users to patch. Exploit code was public by 10 August. Over the weekend of 12 and 13 August a bot arrived, named Graweg, Mocbot, WGAReg or Cuebot depending on the vendor: it reached unpatched Windows 2000 machines through port 445, installed itself as a service whose description claimed to check that Windows was genuine, and took orders over IRC. Microsoft described the attacks as limited and targeted rather than a self-spreading worm; Symantec, Sophos and McAfee classed it as a worm anyway.
The August Peak
The Indian Computer Emergency Response Team counted 1,311 defacements of Indian websites in August 2006, its highest monthly figure of the year by a wide margin. The count is CERT-In's own, from its annual report for 2006, dated 31 March 2007, which noted an unusual rise in August in 2005 as well and gave no reason for either. India's independence day falls on 15 August and Pakistan's on the 14th, and threat analysts would later describe the pair as a predictable occasion for attack and retaliation between rival hacker groups; whether that explains 2006, the report does not say. Across the year CERT-In tracked 5,211 defacements, 3,177 of them on .com addresses and 1,226 under India's .in domain, and its response, by its own account, was to suggest to the organisations concerned how to harden their web servers.
The same report sketches the rest of the job; its incident and phishing counts are told in March. It published 50 advisories, among them one on 9 August rating the month's Microsoft fixes, MS06-040 included, High. From 28 to 30 August it trained system administrators from ASEAN countries at Manesar in Haryana — 21 participants, two of them from the ASEAN Secretariat. Its statutory powers came three years later, when Section 70B of the amended Information Technology Act made it the national agency for incident response, able to call for information and issue directions; it now also runs a botnet-cleaning centre that works with internet providers to tell users when their machines are infected.
Hutter's prize for compressing Wikipedia
On Sunday 6 August 2006 Marcus Hutter, the German computer scientist behind AIXI, a theory of universal artificial intelligence, announced a prize for compressing human knowledge: 500 euros, from a fund of 50,000, for each one per cent by which an entrant shrank enwik8, the first hundred million characters of a version of the English Wikipedia, below the 18,324,887 bytes reached by PAQ8F. A program that compresses text well, the reasoning ran, must predict it well; that autumn Alexander Rhatushnyak's paq8hp5 took the first award, 3,416 euros. Google's machine translation team had promised the raw material of such prediction on 3 August: counts of word sequences up to five words long, drawn from a trillion words of public web pages. From 29 August the seventeenth European Conference on Artificial Intelligence met at Riva del Garda, in Italy, its 131 full papers chosen from 550 submissions reviewed; the best-paper award went to Richard Nock and Frank Nielsen's generalisation of AdaBoost. Hutter widened his prize tenfold in 2020, by when predicting the next word was how large language models learned.
IBM agrees to buy Internet Security Systems
On Wednesday 23 August 2006 IBM agreed to pay about $1.3 billion in cash, $28 a share, for Internet Security Systems of Atlanta, whose software, appliances and services guarded the networks, desktops and servers of thousands of companies and governments. It was the fourth purchase IBM had announced that month. The deal closed on 20 October, and X-Force, the ISS research team, still gives its name to IBM's threat intelligence and incident response. On 15 August the Federal Trade Commission and Washington State's attorney general had announced suits against the operators of Movieland.com, alleging that their software repeatedly filled screens with pop-ups, playing nearly a minute of music, that could be neither closed nor minimised until $29.95 was paid. The operators said users had signed up for a three-day free trial and not cancelled; most complainants said they had never heard of Movieland. A judge refused the FTC a temporary restraining order, and in September 2007 the operators settled with the FTC, agreeing to pay just over $500,000 in redress without admitting a violation.
⏳ Time capsule — August 2006
- On 14 August Dell recalled 4.1 million notebook batteries made with Sony cells, which could short-circuit, overheat and catch fire; the US Consumer Product Safety Commission called it the largest electronics-related recall it had been involved in.
- On 22 August, at the International Congress of Mathematicians in Madrid, Grigori Perelman was awarded the Fields Medal for his work on the Ricci flow, the method behind his proof of the Poincaré conjecture. He did not attend, and became the only person to have declined it.
- On 24 August the International Astronomical Union's General Assembly in Prague defined a planet as a body that orbits the Sun, is massive enough for its own gravity to make it round and has cleared the neighbourhood of its orbit. Pluto had not; a second resolution, passed by 237 votes to 157, made it a dwarf planet.
- On 25 August Amazon opened a limited public beta of its Elastic Compute Cloud: virtual servers equivalent to a 1.7GHz Xeon with 1.75GB of memory and 160GB of disk, at ten cents an hour, up to twenty per account.
What the Numbers Kept
Twenty years on, the AOL file is the standard demonstration that removing names does not make data anonymous, and what it taught was a mechanism rather than a scale. Nothing was broken into; reporters read a list and checked it against telephone listings. A number in place of a name took off the label but kept each person's searches in one bundle — a town, a subdivision, a surname, a dog — and the bundle was the person. The Netflix Prize ratings proved the point again with films. The question Miller handed his task force, how long search data should be kept at all, is now a legal one in India, where the DPDP Act expects personal data to go once its purpose is served, as our India desk explains.
The month's other arguments ended less cleanly. Blue Pill's claim was never settled in public; Rutkowska turned virtualisation to defence, and Qubes OS, which she began with Rafał Wojtczuk in 2010, isolates the parts of a desktop in separate Xen virtual machines. The kind of worm the Department of Homeland Security had warned of in August 2006 arrived two years later, through the same Windows service, when MS08-067 was patched out of band and the worm that used it became January 2009's story. Of everything in August 2006, though, the four words said to a reporter in Lilburn have travelled furthest.