On Friday 6 October 2006 The Washington Post reported what Commerce Department officials had told it the day before: hackers working through Chinese internet servers had mounted a "debilitating attack" on the Bureau of Industry and Security, which controls exports of American goods and technology with military as well as civilian uses. It had forced the bureau to replace hundreds of workstations and to block employees from regular use of the internet for more than a month. Since 1 September nobody there could browse from their own computer; several separate machines, unconnected to the bureau's network, kept work going. The spokesman, Richard Mills, said the bureau had found "a targeted effort to gain access to BIS user accounts" and had "no evidence that BIS data has been lost or compromised".
The detail came from inside. Since July the acting under secretary, Mark Foulon, had been e-mailing staff about "a number of serious threats to the integrity of our systems and data". In August he reported "several successful attempts to attack unattended BIS workstations during the overnight hours", and he wrote that "Internet access in itself is a vulnerability that we cannot mitigate." Late that month he told staff the bureau hoped to replace all its workstations within three months. A source said the intruders had hidden with a rootkit. The attacks were traced to websites registered with Chinese service providers — "We determined they were owned by the Chinese," a senior official said — but he did not say who in China was responsible, or whether anyone had been identified.
Outside the department, people who knew no more than the Post divided over what the servers meant. Richard Stiennon of IT-Harvest, who said he had no inside information, argued that "the continuous nature of these attacks means there is a link to a state source." Others answered that a server in China said little about whoever was using it; such machines, as Martin McKeay pointed out, could have been taken over by anyone, anywhere in the world. Bruce Schneier noted what the bureau held — makers of encryption hardware filed design details with it to win export licences — and could not tell whether any of it had gone. The week's coverage carried no response from Beijing; when a congressman made a similar charge in June 2008, its foreign ministry dismissed it.
The fullest account came six months later. On 19 April 2007 Dave Jarrell, who managed the department's critical infrastructure protection programme, told a House homeland security subcommittee that the intrusion had come to light on Thursday 13 July 2006, when the bureau's deputy under secretary could not log on: his account had locked itself after repeated failed attempts. Thirty-two BIS computers and one outside the bureau were found infected; their drives were pulled and quarantined, every BIS account was suspended, and one machine had appeared to be "in the process of preparing files for exfiltration". Commerce had no evidence that data was taken, Jarrell said, but "we can't definitely say the source of the attack". As far as the chairman, James Langevin, could tell, "complete machine rebuilds have not occurred."
A Virus in the Box
On Tuesday 17 October 2006 Apple posted a notice on its support site: "We recently discovered that a small number—less than 1 percent—of the video iPods" available after 12 September had left its contract manufacturer carrying RavMonE.exe, a Windows virus. The players were unharmed and so were Macs; the risk was to any Windows PC an infected iPod was plugged into. Apple had seen fewer than 25 reports. One sentence drew more notice than the virus: "As you might imagine, we are upset at Windows for not being more hardy against such viruses, and even more upset with ourselves for not catching it." Microsoft answered that the virus did not appear to exploit any Windows vulnerability. Graham Cluley of Sophos thought it "most likely that some of the video iPods were plugged into a Windows PC for testing purposes"; the same week McDonald's in Japan was recalling prize MP3 players that carried a password-stealing Trojan. Ed Felten of Princeton would not let the blame travel: "it's their job to ship a product that won't hurt me." The virus spread through Windows autorun, which Microsoft did not restrict through automatic updates on XP and Vista until February 2011.
Warnings in the Browser
Microsoft released Internet Explorer 7 for Windows XP on Wednesday 18 October 2006 and Mozilla released Firefox 2 the following Tuesday, and both now carried a built-in warning against reported fraudulent sites. They went about it in opposite ways. Microsoft's Phishing Filter kept a list of known-legitimate sites on the computer, examined other pages for the marks of a phishing site and, "with your consent", sent some addresses to Microsoft to be checked against a frequently updated list; a reported site brought up a warning page, a suspicious one a yellow alert beside the address bar. The browser asked the user whether to switch the automatic checking on. In 2005 Microsoft had answered readers' privacy worries by promising to strip "potentially sensitive data, like the URL query string" and send the rest over SSL. Firefox was protected by default, against a local blacklist that updated hourly, "rather than sending information to an external online service", Mozilla said; users could instead have each site checked with a provider such as Google. From November, Automatic Updates carried IE7 to XP machines.
A Court Notice for Orkut
On 10 October 2006 Indian media reported that the Aurangabad bench of the Bombay High Court had directed that notice go to Google over a community on Orkut, its social network. The community, "We Hate India", had about a hundred members and a picture of the national flag being burned. The route to court had run through the platform first: a local lawyer and others flagged the group as "bogus" with Orkut's own reporting tool, and on 28 August he wrote to Google's Mumbai office asking for its removal. On 11 September he filed a public interest petition under the Information Technology Act, 2000, heard on 6 October, seeking removal and a controller under the Act — the official empowered to "direct any agency of the Government to intercept any information transmitted through any computer resource".
Google's answer set out an intermediary's position as it then stood. "Orkut is not based in India. It's an open community," a spokesperson said; its terms banned hate speech, it relied on users to report abuse, and Google would "review and take appropriate action (removal in this case)". The Act gave no explicit power to block a site; blocking ran through the executive procedure of 2003 that July had seen at work. A further hearing was set for six weeks later. The amendment Parliament passed in December 2008 wrote a blocking power into the Act as section 69A, which the Supreme Court upheld in 2015; Orkut closed on 30 September 2014.
Netflix offers $1 million for better recommendations
On 2 October 2006 Netflix offered $1 million to the first person or team that could predict its subscribers' film ratings 10 per cent more accurately than Cinematch, its own recommendation system, and $50,000 a year for the best progress short of that. It released more than 100 million ratings to work on, given to 17,770 films by some 480,000 subscribers identified only by numbers, and pitched the contest at machine-learning researchers; within a week a team had beaten Cinematch, and how the prize was settled, by twenty minutes, is told in September 2009. On 12 October Microsoft bought Colloquis, on undisclosed terms. Its natural-language Automated Service Agent answered customer queries for companies such as Comcast, Cingular and Vonage, and under its first name, ActiveBuddy, the company had built SmarterChild, the instant-messaging bot. Microsoft planned customer-service agents for Xbox and conversational Windows Live Agents on Messenger; SmarterChild itself went silent in 2008, and is remembered now as a forerunner of ChatGPT.
McAfee buys a page; Microsoft gives ground
On Monday 2 October 2006 McAfee bought a full page in the Financial Times, arguing that Microsoft, by locking security vendors out of 64-bit Vista's kernel, seemed to envisage "one giant company" controlling both the systems most computers ran and their security; Microsoft said partners were at the core of its business. On 13 October, after guidance from the European Commission, Microsoft's general counsel, Brad Smith, announced that PatchGuard would stay but vendors would get new kernel-level interfaces, that Security Center would defer to a rival console's alerts, and that Vista's Welcome Center would link to rival security offerings. Five days later McAfee and Symantec said no details had reached them; Microsoft said it was gathering specifications, and the first interfaces came with Vista's first service pack. George Samenuk, who had fronted the campaign, was gone by then: on 11 October McAfee announced his retirement as chairman and chief executive, and its president's dismissal, after a special committee examined past stock-option grants; it would restate its accounts. The kernel argument returned after the CrowdStrike outage of July 2024.
⏳ Time capsule — October 2006
- On 9 October Google agreed to buy YouTube for $1.65 billion in stock. The site, then serving more than 100 million video views a day, was to keep its brand, its staff and its base in San Bruno, California, and to operate independently.
- On 10 October Kiran Desai, who had just turned 35, won the Booker Prize for The Inheritance of Loss, becoming the youngest woman to have won it at the time. Her mother, the novelist Anita Desai, had been shortlisted three times.
- On 13 October the Nobel Peace Prize went to Muhammad Yunus and the Grameen Bank he founded in Bangladesh, for their work in economic and social development among the poor.
- On 20 October Corus, the Anglo-Dutch steelmaker, accepted an offer from Tata Steel of £4.3 billion, 455 pence a share — the largest takeover of a foreign company yet attempted by an Indian firm. Brazil's CSN bid against it, and the contest went to an auction run by the Takeover Panel at the end of January 2007, which Tata won at 608 pence.
What the Department Could Not Say
The bureau's intrusion reads in 2026 as an early page in a long file, remembered less for anything taken — the department said it had no evidence that anything was — than for what it could not say: when the intruders arrived, and who they were. It answered the way Foulon's e-mail had: by April 2007 the computers that ran BIS business had no internet access at all, and the emergency block list was still in force. Attribution took years to change shape. In February 2013 Mandiant put a building in Shanghai to the work of one group it had tracked since 2006.
The month's other stories ended as infrastructure. Autorun, the route the iPods' virus used, carried Conficker from USB sticks two years later. Firefox 2's phishing protection was switched off in December 2008, when Google retired the protocol that served its lists; in Internet Explorer 8, in March 2009, Microsoft's filter became SmartScreen and took on malicious downloads, and it now runs in Windows and Edge. Google said in 2017 that more than three billion devices used Safe Browsing, and the privacy question was answered in the design: early versions sent whole addresses, later ones part of a cryptographic hash. The Orkut notice's question — what an Indian authority may ask of a platform run from abroad — returned in December 2011, when a minister asked platforms to screen posts before they appeared.