The admission came in a Form 8-K that Hewlett-Packard signed on Wednesday 6 September 2006. To find out who was leaking the board's deliberations, investigators working for the company had used a third party “to obtain phone information concerning certain calls between HP directors and individuals outside of HP”, and that party “had in some cases employed pretexting” — “a technique used by investigators to obtain information by disguising their identity.” Counsel had advised that the practice “was not generally unlawful (except with respect to financial institutions)” but could not say it had “complied in all respects with applicable law.” California's attorney general had already asked for information. The filing did not mention the press; within days it was known that at least nine journalists' telephone records had been taken too.
The hunt ran in two phases, Kona I from about April 2005 and Kona II from January 2006, after a CNET News.com report on the company's management retreat. HP's contractor, Security Outsourcing Solutions, hired Action Research Group of Florida, which engaged subcontractors, Bryan Wagner among them, to get the records. On 11 August AT&T wrote to the director who had resigned in protest on 18 May; according to the letter, on 30 January someone had opened an online account for his home telephone with the last four digits of his Social Security number, and looked at one bill — January's. On 8 March, Wagner later admitted, he opened an account in a Wall Street Journal reporter's name and used the reporter's Social Security number to read the calls.
The board came apart in public. On 12 September HP said Patricia Dunn would hand the chair to the chief executive, Mark Hurd, in January; the director named as the source resigned, objecting to the intrusion into his privacy and other people's. On 22 September Dunn resigned from the board with immediate effect. On 28 September ten witnesses before a House subcommittee — HP's general counsel, who had resigned earlier that day, its ethics lawyer, an investigations manager and seven outside investigators — invoked the Fifth Amendment. Dunn testified that she had authorised the inquiry, not its methods, and did “not accept personal responsibility for what happened.” Hurd, who had approved the text of a false e-mail sent to a reporter to flush out the source, called it “a rogue investigation”.
It took six years to end, and ended smaller than it began. On 4 October Bill Lockyer, California's attorney general, charged Dunn, Kevin Hunsaker, HP's former ethics chief, and the investigators Ronald DeLia, Matthew DePante and Wagner with four felonies each, identity theft among them. On 7 December HP agreed to pay $14.5 million to settle the state's civil claims, most of it into a fund for privacy and piracy enforcement; “Fortunately, Hewlett-Packard is not Enron,” Lockyer said. On 14 March 2007 a judge dismissed the charges against Dunn, and Hunsaker, DeLia and DePante pleaded no contest to a misdemeanour, with dismissal promised after 96 hours of community service. Wagner, who had pleaded guilty in federal court to conspiracy and aggravated identity theft, was sentenced in December 2012 to three months in prison.
A Patch From Strangers
On Monday 18 September 2006 Sunbelt Software reported an exploit already at work on the web: a buffer overflow in vgx.dll, the Windows library that drew Vector Markup Language, an XML format for vector graphics, inside Internet Explorer. Microsoft confirmed the flaw on the 19th and said a fix was planned for its 10 October release, or earlier if customers needed it. By Friday 22nd index files on more than 500 domains at one hosting provider had been altered to send visitors to the exploit, Outlook mail was reported exploited too, and the SANS Internet Storm Center raised its alert level to yellow for a day. That Friday a group of researchers calling itself the Zeroday Emergency Response Team posted an unofficial patch, and Microsoft added guidance on third-party patches to its advisory. MS06-055 followed on 26 September, two weeks early and rated Critical; ZERT would patch ahead of Microsoft again in April 2007. Apple had patched its AirPort driver on 21 September, crediting neither researcher from August's Black Hat quarrel.
A Key From the Minibar
On 13 September 2006 Ariel Feldman, J. Alex Halderman and Edward Felten of Princeton published a security study of a Diebold AccuVote-TS voting machine, obtained “from a private party” and running software deployed in 2002. An attacker with access to the machine or its memory card “for as little as one minute could install malicious code”, which could then alter “all records, logs, and counters” to agree with a falsified count; their demonstration virus travelled on the memory cards poll workers use to carry ballots and results, needing no network. On the 18th Felten added that a member of the technical staff had recognised the code printed on the machine's key, and a key from his home opened it; the same standard key served office furniture, jukeboxes and hotel minibars. Diebold called the study “unrealistic and inaccurate”, said the software was “two generations old” and complained that “18 enclosure screws and numbered security tags were destroyed or missing”. The researchers replied that they had tested the newest version available to them, already used in national elections, and that the main attack “does not require removal of any screws.”
The Regulator's Own Website
On 27 September 2006 the Telecom Regulatory Authority of India sent the government its recommendations on allocating and pricing spectrum for 3G and broadband wireless services, and posted them on its website. The website was in poorer order than the policy. A few days before the release, TRAI officials told the Financial Express, its press-release section had been tampered with; the regulator found the change and fixed it. Then, on Saturday 30 September, someone got administrative access to the server and altered links in the recommendations and directions sections, so that clicking them opened a window reading “Pablin 77 was here” — a signature the paper said had appeared on government sites from Uruguay to the Philippines. TRAI went to the police; the defacer was reported still at large.
It was one entry in a crowded year. CERT-In's monthly tallies of defaced Indian websites ran into the hundreds and, in August, past a thousand, and the paper reported that the Home Ministry had told central ministries to host their sites only on government-owned servers. The head of a corporate security firm told it he saw no ulterior motive, likening such defacements to graffiti scribbled on walls and in lifts. The IT Act of 2000 imposed no duty to report one. CERT-In's directions of 28 April 2022 list the defacement of a website, and unauthorised changes to one such as inserted malicious code or links to outside sites, among incidents to be reported within six hours, as our India desk sets out — a fair description of TRAI's September.
UCT brings bandit ideas to tree search
The European Conference on Machine Learning met in Berlin from 18 to 22 September 2006, and its proceedings carried a paper on bandit-based Monte Carlo planning by Levente Kocsis and Csaba Szepesvári of the Hungarian Academy of Sciences. It introduced UCT, which applied UCB1, a multi-armed bandit algorithm, to steer a search by random simulation towards the moves that looked best while sparing enough effort for the rest that a good move underrated early would not be missed. They proved it would settle on the best action given enough samples, and planned to make it “the core search procedure of some real-world game programs”; by November a team at INRIA had built it into MoGo, a Go program. Variants of UCT became the usual engine of Monte Carlo tree search, behind MoGo's handicap win over a professional in August 2008 and, with deep neural networks, AlphaGo's defeat of Lee Sedol. On 17 September, in London, the Loebner Prize for the most human-like chat program went to Joan, built on Rollo Carpenter's Jabberwacky.
Symantec objects to Vista's locked kernel
On 12 September 2006 Jonathan Todd, the European Commission's competition spokesman, warned that the security market could suffer unless Microsoft let rivals compete on equal terms in Windows Vista. Symantec set out its objections a week later. Kernel Patch Protection, or PatchGuard, which barred changes to the 64-bit Windows kernel, would block Symantec's anti-tampering technology, and Sunbelt Software said it would be unable to watch for kernel exploits. Vista's Security Center would also raise alerts alongside Symantec's and, unlike XP's, could be switched off only by the user. On 27 September Symantec accused Microsoft of withholding information it needed for Vista and said it might complain formally to the Commission. Microsoft's Stephen Toulouse said the company had locked down the kernel to improve security, not to hinder its partners, that vendors could still extend it with signed drivers, and that 64-bit Vista, the only edition PatchGuard covered, would be slow to spread. The quarrel peaked in October.
⏳ Time capsule — September 2006
- On 10 September Michael Schumacher won the Italian Grand Prix at Monza and announced immediately afterwards that he would retire from racing at the end of the season.
- On 12 September Apple announced iTunes 7 and began selling films through its store — more than 75 titles from Disney, Pixar, Touchstone and Miramax, at 640 by 480 pixels and in the United States only — and previewed a set-top player under the code name iTV, which shipped the following March as Apple TV.
- From 22 to 24 September the Ryder Cup was played in Ireland for the first time, at the K Club in County Kildare, where Ian Woosnam's European team beat Tom Lehman's Americans 18½–9½ for a third consecutive win.
- On 26 September Facebook opened to everyone at least thirteen years old with a valid email address.
From the Bill to the Number
The affair's lasting product was a statute rather than a sentence. On 12 January 2007, the day Wagner pleaded guilty, the Telephone Records and Privacy Protection Act became law, making it a federal crime, punishable by up to ten years in prison, to obtain a carrier's confidential phone records by “false or fraudulent statements or representations” to its staff or by entering a customer's online account without permission — both methods the HP inquiry had used. The technique survived by changing its target. Impersonating a subscriber to a telephone company is still the opening move, but the prize now is the number itself: the SIM swap that took over Twitter's chief executive's account in August 2019, and the help-desk persuasion of the crew that ran through March 2022.
The month's other stories found their endings by other routes. Microsoft's early patch and ZERT's unofficial one were played again, over a cursor file, in April 2007, and the out-of-cycle fix for a flaw already under attack has since become an accepted tool rather than an admission. Halderman, Feldman and Felten were back in February 2008, reading disk-encryption keys out of chilled memory chips, and Halderman went on to examine an Indian voting machine, as April 2009 recalls. The quietest item has the plainest ending: what a security consultant likened to graffiti in 2006 is, twenty years on, an incident with a six-hour reporting clock.