On Monday 22 May 2006 Jim Nicholson, the Secretary of Veterans Affairs, announced that personal information on 26.5 million veterans, Social Security numbers and dates of birth among it, had been stolen from the home of a department employee who had taken it there without authorisation. The records were mainly those of veterans discharged since 1975. There was no sign that anyone had used them, and Nicholson offered a guess about the thieves: "It's highly probable that they do not know what they have." The FBI in Baltimore said the neighbourhood had been hit by a series of burglaries. The department opened a call centre on 1-800-FED-INFO. The burglary had taken place on 3 May, nineteen days before; the secretary had known for six.
The inspector general's report of 11 July reconstructs the afternoon. The employee's wife found their house in Aspen Hill, Maryland, burgled and called the police. Her husband, an IT specialist who supplied data analysis to the department's Office of Policy, Planning and Preparedness, got home shortly after five, found that his own laptop and external hard drive had been taken, and began telephoning colleagues. The first, a security team leader, took the call on a Metro train and told him that since nothing had happened at the department and none of its property was missing, it was a matter for the local police. He remembered an upset caller and the phrase "a career-ending incident", but no mention of department data; the analyst said he had mentioned it.
The data sat on the drive, not the laptop, unencrypted and without a password: by the analyst's account, extracts holding names, Social Security numbers, dates of birth and disability ratings for about 26 million living veterans. He had been taking such data home since 2003 for a self-initiated "fascination project", checking the answers some 7,000 veterans had given a 2001 national survey against the department's files; his managers had not known. He kept the drive hidden, away from the laptop, and conceded he had taken its physical security for granted. A deputy assistant secretary, Michael McLendon, heard on 3 May, did not tell his superior, and rewrote the incident report to say most of the critical data was protected by statistical software — which, the inspector general found, "was not the case".
The chief of staff was told on 9 May; a request for legal advice on notifying veterans waited six days; the inspector general's staff established the scale in one interview with the analyst on 15 May, and Nicholson was told the next morning. Information security officials, the report found, had "reacted with indifference and little sense of urgency or responsibility". McLendon resigned on 2 June; on 6 June the department said the files also covered as many as 2.2 million serving personnel. On 28 June, after someone holding the equipment called the US Park Police on seeing a $50,000 reward notice, it came back; the next day the FBI said "the data base remains intact and has not been accessed since it was stolen". Prosecutors declined to charge the analyst; the department fired him.
The Opt-Out That Lost
Blue Security, an Israeli company, kept a "Do Not Intrude Registry" of about 450,000 members, by The Register's count, and gave them Blue Frog, software that answered every spam a member received with an opt-out complaint posted to the advertised website. Critics likened it to a denial-of-service attack. Blue blamed what came next on a Russian-speaking spammer known as PharmaMaster; Renesys's Todd Underwood called the flood "run-of-the-mill". Blue pointed its domain at its blog on TypePad, and from about 4 p.m. Pacific on Tuesday 2 May, CNET reported, some ten million TypePad and LiveJournal blogs were offline or barely reachable for hours. "That was not friendly, nor was it clever," said a spokeswoman for Six Apart, which ran both. On 16 May Blue shut the service down to avoid "an ever-escalating cyber war through our continued operations". Hours later its farewell notice was knocked offline too, and an attack on UltraDNS cut off about 2,000 businesses whose sites Prolexic, the firm Blue had hired, protected — by Prolexic's account. On 8 May a federal judge had sentenced Jeanson James Ancheta to 57 months for selling access to botnets — January's story.
A Planning Document
By VeriSign iDefense's later reckoning, the first messages went out on 12 May 2006 to what it called a large Defense Department entity, whose staff the attacker had apparently found through Google. A few dozen files went to fewer than a dozen people to learn which version of Word the organisation ran; within a day close to 200 more followed, carrying "Planning document 5-16-2006.doc". The SANS Internet Storm Center made the attack public on 18 May from one target's account: mail from a lookalike domain, written as an internal message with a signature and the recipient's name, which antivirus did not catch. Opening the document on a fully patched machine exploited an unknown flaw in Word, installed a hidden backdoor, overwrote the file with a clean copy, crashed Word and offered to reopen it. The servers and domains were registered in China and Taiwan. Microsoft published an advisory on 22 May and fixed the flaw on 13 June in MS06-027. iDefense counted two targets, one American and one Japanese, and later wrote of "an unprecedented number of zero-day attacks" in 2006, largely through Office files; July and December carry the sequel.
A Plan to Put the State Online
On 18 May 2006 the Government of India approved the National e-Governance Plan: twenty-seven "mission mode" projects — nine run by central ministries, eleven by the states and seven integrated across both — with eight support components, at an estimated Rs 23,000 crore over five years. Its spine was plumbing. State Wide Area Networks, budgeted at Rs 3,334 crore, were to carry two megabits a second down to the block level; State Data Centres were to consolidate each state's services, applications and infrastructure; and 100,000 broadband-enabled Common Service Centres, on an outlay of Rs 5,742 crore under a public-private partnership model, were to put a government counter within reach of rural India.
Read for its security, the plan was a decision to concentrate: services that had run office by office would share state networks, consolidate in state data centres and be reached from a hundred thousand counters run with private partners. The national emergency response team, CERT-In, had been working since January 2004. In 2011 the plan was widened to thirty-one projects, adding health, education, the public distribution system and posts. What concentration could cost showed eleven years later, when the identity authority said that about 210 websites of central and state government departments had displayed welfare beneficiaries' names, addresses and Aadhaar numbers for public view — November 2017's story. A general duty to protect personal data now has a statute behind it, which our India desk sets out.
DARPA moves its robot race into town
On 1 May 2006 the Defense Advanced Research Projects Agency, DARPA, announced the third of its Grand Challenges for driverless vehicles and moved it from the desert into town. The Urban Challenge, set for 3 November 2007, would send vehicles on a simulated military supply mission through a mock urban area among moving traffic; Tony Tether, the agency's director, said the robotics community was "ready to tackle vehicle operation inside city limits". DARPA offered $2 million, $500,000 and $250,000 for the first three places, and up to $1 million each in development funds to teams whose proposals it chose. Carnegie Mellon's Boss won it, November 2007's story; driverless taxis now carry paying passengers through American cities. In Turin, the Computers and Games conference of 29 to 31 May carried a paper by the French computer scientist Rémi Coulom whose title named a technique, Monte-Carlo tree search: searching a game tree by random play-outs, its backed-up values sliding from averages towards minimax as simulations mount. His program, Crazy Stone, took the 9×9 Go gold at the Computer Olympiad alongside.
Microsoft's OneCare goes on sale
On 30 May 2006 Microsoft put Windows Live OneCare on sale in American shops and by download, at $49.95 a year for up to three PCs. It joined anti-virus, a firewall and anti-spyware built on Windows Defender's technology to tune-ups, backup and free support. McAfee announced a rival managed service, code-named Falcon, the same day; Symantec had promised its own, Genesis, for the autumn, and had spent the week before on a flaw of its own. On 25 May the Associated Press reported that eEye Digital Security had found a hole in Symantec AntiVirus Corporate Edition 10 and Client Security 3 through which an attacker could take over a machine across the network without its user doing anything. Symantec, whose spokesman at first called it "so new that we don't have any details", confirmed it in an advisory that day and had patched builds out within a week; Norton products were unaffected. Copies left unpatched let a worm in that December. OneCare was withdrawn three years later, when Microsoft began giving protection away, as Windows still does.
⏳ Time capsule — May 2006
- On 17 May Ron Howard's film of The Da Vinci Code opened the 59th Cannes Film Festival and was poorly received by the critics there; released in the United States two days later, it took an estimated $224 million worldwide in its opening weekend.
- On 20 May the last batch of concrete was poured on the Three Gorges Dam on the Yangtze, completing its 2,309-metre main structure nearly ten months ahead of the original plan. The large celebration that had been planned gave way to a ceremony of about twenty minutes on top of the dam.
- The same day, in Athens, Finland won the Eurovision Song Contest for the first time in 45 years of taking part, with Lordi's heavy-metal song "Hard Rock Hallelujah".
- On 25 May a jury in Houston convicted Enron's two former chief executives, Kenneth Lay on six counts of conspiracy and fraud and Jeffrey Skilling on nineteen. Lay died on 5 July and his conviction was vacated that October; Skilling was sentenced to 24 years and four months, later cut to fourteen, and left federal custody in 2019.
The Copy Nobody Counted
The stolen drive had the gentlest ending and the longest reach. It came back intact; by July the FBI and the inspector general were "highly confident" its files had not been compromised; and when the department agreed in January 2009 to pay $20 million to settle the veterans' class action — $75 to $1,500 a claimant, for credit monitoring bought or physical symptoms of distress — its spokesman could say there was "no evidence that the information involved in this incident was used to harm a single veteran." Policy had not waited for the forensics. On 23 June the Office of Management and Budget asked every department and agency to encrypt all data on mobile computers and devices unless a deputy secretary ruled in writing that it was not sensitive, within 45 days.
Encryption answered the laptop, not the copy. The analyst's drive was dangerous because nobody in charge knew it existed, and the question of who holds which copy returned within the year on a laptop taken from a Boeing employee's car in December, and with HM Revenue and Customs' discs in November 2007. Blue Frog's surrender ended an experiment in answering spam in kind; Okopipi, a volunteer attempt to revive it, appears to have been abandoned. The Word attack's method, a plausible document sent to a few named people, was in use again before May was out, against the State Department in the intrusion July describes. Twenty years on, an encrypted disk is routine; knowing where every extract of a database has gone is not.