The Police and Justice Act 2006 received Royal Assent on Wednesday 8 November 2006. Its long title opened with a National Policing Improvement Agency, and much of what followed concerned police forces and their powers; four sections, 35 to 38, rewrote the Computer Misuse Act 1990. Unauthorised access to a computer, the basic hacking offence in section 1, had carried a maximum of six months' imprisonment. It now carried two years on indictment, enough to support an extradition request. Section 3, written around unauthorised modification of computer material, was replaced by an offence of doing any unauthorised act with intent to impair a computer's operation, or reckless as to whether it would, and its maximum rose from five years to ten. A new section 3A dealt with tools.
The rewrite of section 3 had a case behind it. In January 2004 a teenager whom a company had dismissed after three months, in December 2003, when he was sixteen, pointed a mail-bombing program at its servers; by most accounts they received some five million emails, many apparently from its human resources manager. At Wimbledon in November 2005 District Judge Kenneth Grant found no case to answer: the server existed to receive email, each message was authorised, and "the effect on the server is not a modification addressed by section 3." On 11 May 2006 Lord Justice Keene and Mr Justice Jack held that an owner's implied consent to receive email "is not without limit" and sent the case back. In August, having pleaded guilty, he was given a two-month curfew under an electronic tag.
Section 3A made it an offence to make, adapt or supply an article intended for hacking, to supply one "believing that it is likely to be used" for that, or to obtain one in order to supply it. An article included "any program or data held in electronic form". The bill's January 2006 text had required knowledge or intent. In June Lord Northesk, a Conservative peer, moved to strike out the "likely" limb; it stayed. When the Act was published on 22 November, Richard Clayton, a Cambridge security researcher, named nmap, a scanner administrators and attackers both use: "Distributors of this have to decide if the people getting it from them are the good guys or the bad guys." The Home Office read "likely" as better than even: "a trial within a trial", he said.
None of it took effect that month. Scotland, which has its own powers over computer crime, brought the sections into force in October 2007. England, Wales and Northern Ireland waited while the Serious Crime Act 2007 amended them, and a promised start in April 2008 slipped; an order made on 24 September 2008 commenced sections 35 to 38 on 1 October 2008, almost two years after Royal Assent. By then the Crown Prosecution Service had told prosecutors to ask whether a tool had been developed "primarily, deliberately and for the sole purpose of committing a Computer Misuse Act offence", and whether it was "available on a wide scale commercial basis and sold through legitimate channels" — comfort for commercial vendors, and, the Open Rights Group warned, cause for "alarm amongst open source advocates".
A Kernel Flaw a Day
Modelled on July's browser month, the Kernel Fun blog announced on 1 November that "The Month of Kernel Bugs has started", and published one flaw for each of the thirty days: eleven in Linux, ten in Mac OS X, two in FreeBSD, one in Solaris, one in the Windows kernel's graphics code and five in Windows drivers for Broadcom, D-Link and Netgear wireless cards. Half lay in code that reads file-system and disk images, found by feeding kernels malformed ones. Its host, a researcher using the name LMH, answered critics of publishing unpatched flaws: "Well, I'm doing their job." The first, contributed by H D Moore, corrupted kernel memory through the original AirPort card in older Macs; Apple patched it on 28 November. The Broadcom flaw of 11 November, in a driver shipped on new HP, Dell and Gateway PCs, came from Jon Ellch of August's wireless-driver dispute; Broadcom had already given its manufacturing partners updated drivers, but only some had passed them on, and Linksys appeared to be the only maker offering a download. The last entry's details were withheld until Apple's fix in January. The graphics flaw waited for April 2007, and LMH's next calendar for January.
Newport Goes Dark
Navy officials dated the intrusion to 15 November 2006 at the Naval War College in Newport, Rhode Island, the service's school for senior officers. The Navy Cyber Defense Operations Command cut the connection and removed affected systems for forensic examination; the college's email and websites went dark, and students and faculty fell back on private email from home. Two days later Strategic Command raised the alert level on the Pentagon's networks from Infocon 5 to 4 and ordered passwords changed, though a spokesman for its network task force denied a link: "We do these things periodically." On 30 November the Washington Times reported that defence officials pointed to China, and a professor there, a retired Air Force general, reportedly told his class that Chinese hackers had taken the network down. The command's spokesman, Lieutenant Commander Doug Gabos, called it "an isolated incident". In March 2007 he told USA Today that Chinese hackers were most likely behind it and that the college had lacked the latest security protections; it had been off the internet for several weeks. China was reported to deny any involvement, and no evidence was made public; September 2007 would bring more of the same.
Where the Numbers Came From
On 10 November 2006 the Delhi High Court asked two private banks to disclose the source of the information on which telemarketers were calling people on their behalf. The same court had stayed a Delhi consumer commission's order of 27 September telling telephone companies to ask subscribers whether they wanted such calls at all. On 20 November the Telecom Regulatory Authority of India published Consultation Paper No. 15/2006, on Unsolicited Commercial Communication. India had more than 170 million telephone subscribers and, because the caller paid, telemarketers "call indiscriminately"; at American rates that meant about ten billion calls a year. Banks and operators kept do-not-call lists of their own, so a subscriber had to register with each. TRAI asked whether there should be one national register or one per operator, who should be punished when it was ignored, and whether the person called should be compensated — while conceding that it lacked "adequate and effective power" to penalise violators.
The answer, a national register against which telemarketers' lists were scrubbed, is June 2007's story. It governed the calling, not the question the court had put to the banks — where the numbers came from. That waited for a law on consent, the one our India desk sets out, and the call from a stranger became the opening move of the frauds Fraud Watch follows.
Nvidia unveils CUDA with the GeForce 8800
On 8 November 2006 Nvidia launched the GeForce 8800, whose G80 chip was the company's first unified shader design, with 128 stream processors on the GTX model. The same day it announced CUDA, with what it called "the industry's first C-compiler development environment" for graphics processors and a claim of speed-ups of up to a hundredfold; the partners it quoted worked on electromagnetic simulation and seismic data. On 9 November the National Institute of Standards and Technology announced its 2006 machine translation results, Arabic and Chinese into English: Google's statistical systems topped every ranking open to unlimited training data, though the institute insisted it was no product test. On 14 November, at the Supercomputing 2006 show in Tampa, AMD offered its own route, a Stream Processor board programmed through CTM, a thin interface to the bare hardware of ATI's graphics chips. CTM proved short-lived. CUDA's public beta came in February 2007, and two Nvidia gaming cards trained the network that won ImageNet in October 2012.
The FTC makes Zango ask first
On 3 November 2006 the Federal Trade Commission said the adware firm Zango, formerly 180solutions, would give up $3 million of what the commission called "ill-gotten gains". Its programs, the FTC said, had been installed more than 70 million times and shown more than 6.9 billion pop-ups, bundled by distributors with free games and screensavers without disclosure, sometimes through browser security holes. The proposed order demanded express consent, labelled advertisements and a working uninstaller. Zango settled without admitting the charges, blamed its distributors and said it had met the terms since 1 January. On 8 November Microsoft's Jim Allchin told reporters his seven-year-old son ran Vista without anti-virus software; two days later he apologised for being unclear and wrote that most users would run some. On 20 November the researchers Ben Edelman and Eric Howes documented Zango installations that, they said, still lacked proper disclosure; the company said it was reviewing their findings. Zango ceased trading in April 2009, two months before a court shielded Kaspersky for blocking its software.
⏳ Time capsule — November 2006
- On 2 November NASA lost contact with Mars Global Surveyor, in orbit around Mars since 1997, after commanding it to adjust its solar panels. NASA later traced the loss to a flaw in a parameter update to the spacecraft's system software, and ended the mission in January 2007.
- On 14 November Casino Royale had its premiere at the Odeon Leicester Square in London, the first film with Daniel Craig as James Bond. It opened in Britain two days later and in the United States on 17 November.
- On 19 November Nintendo's Wii went on sale in North America at $249.99, with a Remote and Nunchuk controller and the Wii Sports collection in the box.
- On 23 November the Ashes series opened at the Gabba in Brisbane, where Steve Harmison's first ball was a wide that went straight to Andrew Flintoff at second slip; Australia won that Test by 277 runs and the series 5–0.
A Defence Still Promised
The flood the Wimbledon court could not reach is now plainly a crime, and Parliament has since raised the stakes again: in 2015 it added an offence of causing serious damage, punishable by life imprisonment where human welfare or national security is endangered. The tools offence has stayed on the books, read through the prosecutors' guidance. What 2006 did not give researchers was a defence. When BBC Click bought a botnet and flooded a test site in March 2009, a lawyer's verdict was that the Act needed no criminal intent and allowed no public-interest argument, and a report by the CyberUp campaign and techUK in November 2020 found that 80 per cent of cyber security professionals had worried about breaking the law when researching vulnerabilities.
That is the part still unfinished. In early December 2025 the security minister, Dan Jarvis, said the government was looking at a statutory defence for researchers who meet certain safeguards; as this edition is restored, no such defence has been written into it. The month's other stories closed sooner. The Month of Kernel Bugs handed its calendar to January's Month of Apple Bugs, and its wireless-driver flaws were left to be fixed maker by maker. The Naval War College set the form of September 2007's espionage reports: attribution through officials, and no evidence offered. India's do-not-call register opened within the year, governing the calls but not the trade in the numbers behind them.