On Tuesday 12 December 2006 the University of California, Los Angeles began writing to about 800,000 people whose names were in a restricted campus database an intruder had broken into. The list ran wide: current and former students, faculty and staff, some records reaching back to the early 1990s; some applicants of the previous five years who had never enrolled; some parents of students and applicants who had sought financial aid; and about 3,200 people at UC Merced and the system's Oakland headquarters, whose administrative processing UCLA handled. The database held names, Social Security numbers, dates of birth, home addresses and contact details, but no driver's licence, card or bank numbers. "I regret having to inform you that your name is in the database," wrote the acting chancellor, Norman Abrams.
The intrusion had begun in October 2005. It ended on Tuesday 21 November 2006, when security technicians noticed an unusually high number of suspicious queries; staff, in the university's words, "immediately blocked all access to Social Security numbers and began an emergency investigation", and it took several days more to confirm an attack and to establish that the numbers were what it was after. Jim Davis, the chief information officer, said the intruder had exploited "a subtle vulnerability in one of hundreds of applications" and had been careful: "An attacker found one small vulnerability and was able to exploit it, and then cover their tracks." The FBI's Los Angeles office confirmed it was investigating. Thirteen months separated the intrusion from its discovery; three weeks separated the discovery from the letters.
The letters offered advice rather than a service. UCLA set up a website, identityalert.ucla.edu, and a toll-free line; it recommended fraud alerts on credit files and suggested considering a security freeze, and it warned that the university would not ask anyone for personal information by telephone or email. Free credit monitoring was not mentioned. The calls came at once — 12,000 on the first day, Davis told a Senate Judiciary subcommittee in March 2007, and about 36,000 in all; at the peak 1,600 operators at twenty-six locations were handling as many as 1,000 an hour, and the website averaged 15,000 visitors a day through the first week. "The largest group felt violated and anxious and wanted the connection with a live person for answers and empathy," he said.
Writing to all 800,000 was a choice. The forensic picture, Davis testified, "evolved over multiple weeks", and in the end "a very small percentage of the 800,000 individuals in our data base required notification under California law"; the university notified everyone on the strength of the duration of the exposure and the targeted nature of the attack. The ending came in instalments. In January 2008 the Daily Bruin reported that investigators had traced the intrusion to a foreign country but had no suspects; that the intruder had reached 28,600 Social Security numbers, more than 18,000 of them from financial-aid applications made between 2002 and 2006, and those people had been written to again; and that no evidence of identity theft had been found. The public record stops there.
A Laptop in a Car
In the first week of December 2006, a Boeing spokeswoman said, "a laptop was stolen from an employee's car." The company would not say in which city, in case the thief had not realised what it held: by Boeing's estimate, the names and Social Security numbers of about 382,000 current and former employees, most of them retirees, with addresses, telephone numbers and dates of birth in most cases and salaries in some files. Notices began going out on the night of 12 December, with an offer of three years of credit monitoring. The files were not encrypted, a person with knowledge of the matter said, though company policy required it once data left a server. On Thursday 14 December Boeing said it had fired the employee. Jim McNerney, the chief executive, told staff the loss "resulted from a clear violation of our data-protection policy", that "management must be held accountable when repeated failures like this occur", and that the company believed it was "petty theft, not an attempt at identity theft." The Chicago Sun-Times counted the third such theft in thirteen months, after laptops holding about 160,000 people's records in November 2005 and 3,600 that April.
Three Holes in Word
Microsoft published Security Advisory 929433 on Tuesday 5 December 2006: it was investigating "new public reports of limited 'zero-day' attacks" through a flaw in Word 2000, 2002 and 2003, Word Viewer 2003, Word 2004 for Mac and Works 2004 to 2006, reached by opening a crafted document. The advice was to avoid "Word files that you receive from un-trusted sources or that you receive unexpectedly from trusted sources." No fix was scheduled for the monthly release the following Tuesday. On Sunday 10 December McAfee shipped detection for a second, separate flaw it had found in a sample, whose exploit installed a password stealer; Microsoft said it was being used "on a very, very limited and targeted basis". On 12 December a proof-of-concept file for a third was posted publicly. By Friday 15 December the Security Response Center was writing of "the three current Word Zero-Day issues", two in targeted attacks and the third known only as demonstration code. All three were fixed on 13 February 2007 in MS07-014, along with a fourth that had surfaced in late January.
Rules for the Credit Bureaus
On 14 December 2006 the Credit Information Companies (Regulation) Act of 2005 came into force, and notifications of the same date carried the rules the Finance Ministry had made under it and the regulations of the Reserve Bank of India. They governed the companies that pool what lenders know about their borrowers, and the banks and other lenders that supply them, and a good part of their text concerned keeping that information safe. Section 20 of the Act set privacy principles for the collection, processing, preservation, sharing and use of credit information. The regulations required a credit information company to protect what it held against loss and against unauthorised access, use, modification or disclosure, and required bureaus and lenders alike to keep credit information for at least seven years.
Every lender had three months to adopt a board-approved policy on security safeguards, down to sending data through a secure medium, and the rules listed what that meant: round-the-clock physical security, dual control over physical access to critical systems, removable storage media secured at the end of each working day, firewalls and "stress testing of systems through ethical hacking", a disaster recovery plan, and care when machines went out for maintenance. The Information Technology Act of 2000 placed no comparable duty on other companies holding personal data. A bureau told of an error was to send the corrected record on within thirty days, a limit that since April 2024 has cost a lender or bureau ₹100 for each day a borrower's complaint runs past it.
Deep networks, layer by layer, at NIPS
The Neural Information Processing Systems conference, NIPS, met at the Hyatt Regency in Vancouver from 4 to 7 December 2006, then moved to Whistler for two days of workshops, and its 204 papers included three that took up the deep-belief-net method Geoffrey Hinton's group had published in July. Yoshua Bengio's group in Montreal trained networks one layer at a time without labels before tuning the whole: on handwritten digits a network with three hidden layers, so prepared, erred on 1.2 per cent of test cases, against 2.4 per cent when started from random weights, and auto-encoders served nearly as well as restricted Boltzmann machines for the layers. At New York University, Yann LeCun's group seeded a convolutional network with sparse features learned without labels and reached an error of 0.39 per cent, by their account the best result yet reported on those digits, though not statistically different from the previous best. Hinton, with Graham Taylor and Sam Roweis in Toronto, stacked such layers to model human motion.
Sony BMG settles; a worm targets Symantec
On Tuesday 19 December 2006 Sony BMG settled the suits Texas and California had brought over XCP and MediaMax, the copy-protection programs on its CDs, paying each state $750,000; two days later thirty-nine more states and the District of Columbia followed in a $4.25 million agreement. XCP had cloaked its own files, and removing it by hand could disable a CD drive; Sony BMG agreed to repay between $25 and $175 for computers damaged that way, to stop hiding such software and to disclose it on the packaging. Days earlier anti-virus software itself had been the target. On Friday 15 December Symantec and eEye Digital Security announced a worm, Big Yellow to eEye, that entered through out-of-date copies of Symantec AntiVirus Corporate Edition and Symantec Client Security, a hole patched in May. eEye counted about 70,000 compromised systems, Symantec three customer submissions, and Russ Cooper of Cybertrust thought eEye was "drumming up year-end press". A decade later, in June 2016, Google's Project Zero found wormable flaws in the engine inside every Symantec and Norton anti-virus product.
⏳ Time capsule — December 2006
- From 1 to 15 December Doha held the Asian Games — 9,520 athletes from 45 nations in 424 events across 39 sports — the first city in its region, and only the second in West Asia after Tehran in 1974, to host them. China led the medal table.
- On 15 December the first F-35A Lightning II, AA-1, made its maiden flight at Fort Worth, Texas, with Lockheed Martin's chief test pilot, Jon Beesley, at the controls; a disagreement between two sensors, a calibration fault, brought it back after about 35 minutes.
- Time's issue dated 25 December named "You" its Person of the Year — the millions of people contributing content to sites such as YouTube, MySpace, Facebook and Wikipedia. The cover showed an iMac whose screen held a video player with a reflective mylar pane for a window.
- James Brown died in Atlanta on 25 December, aged 73, of heart failure brought on by pneumonia. Gerald Ford, the 38th president of the United States, died at his home in Rancho Mirage, California, the next day, aged 93.
Learning to Count the Days
Thirteen months inside was not yet, in 2006, a figure the trade tracked. It became one: incident-response firms began reporting how long intruders stayed unnoticed, and when Mandiant described the group it called APT1 in February 2013 it put the average stay at 356 days — less than UCLA's intruder had managed. The rest of the case aged into routine: a target chosen for a single field, a notification decided before the forensics had settled, and a call centre as the first line of the response. Davis's conclusion, given to the Senate in March 2007, took longest to arrive: "the best protection, however, is not to have the protected data at all." Much of this archive, from the Office of Personnel Management to Equifax, records organisations that still had it.
The briefs ended in defaults. Boeing had a policy requiring encryption and an employee who had not followed it; Microsoft had released BitLocker with Windows Vista twelve days before the theft was disclosed, and the stolen laptop faded as the archetypal breach only once encryption stopped being something a user had to remember to do. The Word flaws set a pattern that outlived every version they affected — an exploit inside a document, sent to a chosen few, described by the vendor as "limited and targeted" — and the booby-trapped Word file was still opening attacks in May 2022, when Follina needed no macros at all. Six days after UCLA's letters went out, a retailer in Massachusetts noticed suspicious software on its own systems; January 2007 takes up that thread.